open-walnut 0.4.0 → 0.4.2

package/dist/cli.js

@@ -7366,6 +7366,23 @@ function findRepoRoot() {
   }
   return null;
 }
+function bunAvailable() {
+  const home = process.env.HOME ?? "";
+  const candidates = [
+    ...(process.env.PATH ?? "").split(path14.delimiter).filter(Boolean).map((d8) => path14.join(d8, "bun")),
+    path14.join(home, ".bun", "bin", "bun"),
+    "/opt/homebrew/bin/bun",
+    "/usr/local/bin/bun"
+  ];
+  return candidates.some((p6) => {
+    try {
+      fs12.accessSync(p6, fs12.constants.X_OK);
+      return true;
+    } catch {
+      return false;
+    }
+  });
+}
 function readBuiltVersions() {
   const out = /* @__PURE__ */ new Map();
   try {
@@ -7389,6 +7406,10 @@ function verifyDaemonBinaryVersion() {
     return true;
   }
   const built = readBuiltVersions();
+  if (built.size === 0 && !bunAvailable()) {
+    log.session.info("no daemon binaries and no Bun on this machine; sessions use the source daemon", { expected });
+    return true;
+  }
   if (built.size === 0) {
     return handleMismatch({
       reason: "no daemon binaries built",
@@ -7447,6 +7468,12 @@ function handleMismatch(ctx) {
     return false;
   }
   const builtAfter = readBuiltVersions();
+  if (builtAfter.size === 0) {
+    log.session.warn("daemon rebuild produced no binaries (no Bun?); continuing with the source daemon", { expected: ctx.expected });
+    console.error(`    Daemon binaries were not built (Bun is not installed). Sessions use the source daemon. Continuing startup.
+`);
+    return true;
+  }
   const stillOff = [...builtAfter].filter(([, v3]) => v3 !== ctx.expected);
   if (stillOff.length > 0) {
     log.session.error(
@@ -8788,7 +8815,26 @@ function reapSession(sid, code, reason) {
   let jsonlAgeMs = null;
   try { jsonlAgeMs = Date.now() - fs.statSync(session.jsonlPath).mtimeMs; } catch {}
   const cleanExit = isTurnCompleteExit(session.jsonlPath);
-  if (code !== 0 && cleanExit) {
+  // A DELIBERATE stop is not a failure, and the JSONL tail cannot tell us it
+  // happened. Both writers (our idle scanner, and any stop RPC via cmdStop)
+  // stamp intentionalStopAt before signalling; the death then lands here through
+  // whichever path notices it (usually orphan-poll ESRCH \u2192 code -1). Verified
+  // production case: the last line was a control_response (the reply to a
+  // Walnut-issued control request \u2014 a routine shape), so isTurnCompleteExit said
+  // false, exitCode stayed -1, and the projection painted a red "Error" over a
+  // healthy, fully resumable session that was stopped on purpose. Checked FIRST
+  // and unconditionally: the flag carries information the tail does not contain,
+  // which is why isTurnCompleteExit is left alone.
+  // Keep in sync with daemon-core.ts reapSession.
+  const intentionalStop = session.intentionalStopAt != null;
+  if (intentionalStop && code !== 0) {
+    logMsg('info', 'reapSession: intentional stop, normalizing exit code', {
+      sid, pid: session.pid, originalCode: code, originalReason: reason,
+      jsonlAgeMs, cleanExit, intentionalStopAt: session.intentionalStopAt,
+    });
+    code = 0;
+    reason = reason + '+intentional-stop';
+  } else if (code !== 0 && cleanExit) {
     logMsg('info', 'reapSession: turn-complete detected, normalizing exit code', {
       sid, pid: session.pid, originalCode: code, originalReason: reason, jsonlAgeMs,
     });
@@ -12441,6 +12487,15 @@ function cmdStop(ws, id, cmd) {
   const pid = session.pid;
   logMsg('info', 'cmdStop: stopping session (process group kill)', { sid, pid });
 
+  // Nobody sends stop by accident, so record the intent BEFORE the first signal:
+  // the death lands asynchronously (orphan poll \u2192 ESRCH \u2192 code -1) and by then
+  // nothing remembers this was asked for. This path is how the SERVER's idle
+  // reaper kills (mgr.kill() \u2192 stop RPC), not the daemon's own scan, so it needs
+  // its own stamp: a LOCAL session auto-stopped after 2h idle surfaced as
+  // "Session ended unexpectedly and no cause was recorded" (2026-09-03).
+  // Keep in sync with daemon-standalone.ts cmdStop.
+  session.intentionalStopAt = Date.now();
+
   // An explicit stop is a human decision \u2014 never undone by a pending auto-retry
   // respawning the CLI minutes later. Cancel the timer AND clear the streak so
   // an in-flight result line can't re-arm one either.
@@ -12477,7 +12532,7 @@ function cmdStop(ws, id, cmd) {
 
 // \u2500\u2500 Status \u2500\u2500
 function cmdStatus(ws, id, cmd) {
-  const { sid } = cmd;
+  const { sid, includeArgs } = cmd;
   if (!sid) return sendError(ws, id, 'status: missing sid');
 
   const session = sessions.get(sid);
@@ -12508,6 +12563,11 @@ function cmdStatus(ws, id, cmd) {
     exitCode: session.exitCode,
     exitReason: session.exitReason,
     pendingCtrl: session.pendingCtrl,
+    // Opt-in: the argv the live process was launched with (a fork copies it to
+    // reproduce the parent's prompt-cache prefix). Off by default because the
+    // health monitor polls status for every session and the argv carries the
+    // multi-KB --append-system-prompt.
+    ...(includeArgs && session.args && session.args.length > 0 ? { args: session.args } : {}),
   });
 }
 
@@ -14553,6 +14613,14 @@ function scanIdleSessions() {
       }
       const idleMinutes = Math.round(idleMs / 60000);
       logMsg('warn', 'idle scan: killing idle session (no subscribers, no output)', { sid, pid, idleMinutes, protectedBy: prot.source, thresholdMs: prot.killMs, detail: prot.detail });
+      // Record the intent BEFORE signalling: the reap arrives asynchronously
+      // (the orphan poll sees ESRCH and reports 'orphan-poll-dead', code -1), so
+      // by then nothing remembers that WE asked for this. Without the stamp
+      // reapSession can only consult the JSONL tail, which says "not a clean turn
+      // end" for any session whose last line isn't a type:result \u2014 and the
+      // projection then shows a red Error for our own routine reclamation.
+      // Keep in sync with daemon-standalone.ts scanIdleSessions.
+      session.intentionalStopAt = now;
       killSessionProcessGroup(pid, sid);
     }
   }
@@ -15236,7 +15304,20 @@ function createDaemonCore(deps) {
       jsonlAgeMs = clock() - fs121.statSync(session2.jsonlPath).mtimeMs;
     } catch {
     }
-    if (cleanExit && code !== 0) {
+    const intentionalStop = session2.intentionalStopAt != null;
+    if (intentionalStop && code !== 0) {
+      logger2("info", "reapSession: intentional stop, normalizing exit code", {
+        sid,
+        pid: session2.pid,
+        originalCode: code,
+        originalReason: reason,
+        jsonlAgeMs,
+        cleanExit,
+        intentionalStopAt: session2.intentionalStopAt
+      });
+      code = 0;
+      reason = reason + "+intentional-stop";
+    } else if (cleanExit && code !== 0) {
       logger2("info", "reapSession: turn-complete detected, normalizing exit code", {
         sid,
         pid: session2.pid,
@@ -16026,6 +16107,7 @@ var init_daemon_core = __esm({
 var claude_cli_detect_exports = {};
 __export(claude_cli_detect_exports, {
   _CLAUDE_CREDENTIALS_HOME: () => _CLAUDE_CREDENTIALS_HOME,
+  describeClaudeCliAuth: () => describeClaudeCliAuth,
   detectClaudeCli: () => detectClaudeCli,
   hasClaudeSubscriptionAuth: () => hasClaudeSubscriptionAuth,
   isClaudeCliInstalled: () => isClaudeCliInstalled,
@@ -16086,9 +16168,32 @@ function detectClaudeCli() {
   return {
     installed: installed2,
     subscriptionAuth,
-    subscriptionReady: installed2 && subscriptionAuth
+    subscriptionReady: installed2 && subscriptionAuth,
+    ready: installed2,
+    auth: installed2 ? describeClaudeCliAuth() : { mode: "unknown", label: "not installed" }
   };
 }
+function describeClaudeCliAuth(env3 = process.env, settingsEnv = readClaudeSettingsEnv()) {
+  const merged = { ...env3, ...settingsEnv };
+  const truthy = (v3) => !!v3 && v3 !== "0" && v3.toLowerCase() !== "false";
+  if (truthy(merged.CLAUDE_CODE_USE_BEDROCK)) {
+    const region = merged.AWS_REGION || merged.AWS_DEFAULT_REGION;
+    return { mode: "bedrock", label: region ? `Bedrock (${region})` : "Bedrock" };
+  }
+  if (truthy(merged.CLAUDE_CODE_USE_VERTEX)) return { mode: "vertex", label: "Vertex AI" };
+  if (merged.ANTHROPIC_API_KEY || merged.ANTHROPIC_AUTH_TOKEN) return { mode: "api-key", label: "an Anthropic API key" };
+  if (hasClaudeSubscriptionAuth()) return { mode: "subscription", label: "your Claude subscription" };
+  return { mode: "unknown", label: "its own login" };
+}
+function readClaudeSettingsEnv() {
+  try {
+    const raw = fs16.readFileSync(path17.join(os4.homedir(), ".claude", "settings.json"), "utf8");
+    const env3 = JSON.parse(raw).env ?? {};
+    return Object.fromEntries(Object.entries(env3).filter(([, v3]) => typeof v3 === "string"));
+  } catch {
+    return {};
+  }
+}
 var KEYCHAIN_OAUTH_SERVICE, _CLAUDE_CREDENTIALS_HOME;
 var init_claude_cli_detect = __esm({
   "src/core/claude-cli-detect.ts"() {
@@ -16707,6 +16812,22 @@ var init_local_daemon = __esm({
 });
 
 // src/core/session-error-kind.ts
+var session_error_kind_exports = {};
+__export(session_error_kind_exports, {
+  INFRA_STATUS_REASONS: () => INFRA_STATUS_REASONS,
+  RESCUABLE_STOPPED_WINDOW_MS: () => RESCUABLE_STOPPED_WINDOW_MS,
+  TERMINAL_STATUS_REASONS: () => TERMINAL_STATUS_REASONS,
+  assertsHostUnreachable: () => assertsHostUnreachable,
+  classifySessionError: () => classifySessionError,
+  classifyStatusReasonKind: () => classifyStatusReasonKind,
+  isInfraSessionError: () => isInfraSessionError,
+  isRecoverableSessionError: () => isRecoverableSessionError,
+  isRescuableStoppedRecord: () => isRescuableStoppedRecord
+});
+function assertsHostUnreachable(record) {
+  if (!record.errorMessage) return false;
+  return typeof record.status_reason === "string" && REACHABILITY_CLAIM_REASONS.has(record.status_reason);
+}
 function classifyStatusReasonKind(reason) {
   if (typeof reason !== "string") return void 0;
   if (INFRA_STATUS_REASONS.has(reason)) return "infra";
@@ -16735,7 +16856,7 @@ function isRescuableStoppedRecord(record, nowMs = Date.now()) {
   if (!Number.isFinite(changedAt)) return false;
   return nowMs - changedAt <= RESCUABLE_STOPPED_WINDOW_MS;
 }
-var INFRA_STATUS_REASONS, TERMINAL_STATUS_REASONS, INFRA_TEXT_SIGNATURES, RESCUABLE_STOPPED_WINDOW_MS;
+var INFRA_STATUS_REASONS, TERMINAL_STATUS_REASONS, INFRA_TEXT_SIGNATURES, REACHABILITY_CLAIM_REASONS, RESCUABLE_STOPPED_WINDOW_MS;
 var init_session_error_kind = __esm({
   "src/core/session-error-kind.ts"() {
     "use strict";
@@ -16779,6 +16900,9 @@ var init_session_error_kind = __esm({
       "ssh tunnel",
       "broken pipe"
     ];
+    REACHABILITY_CLAIM_REASONS = /* @__PURE__ */ new Set([
+      "remote_unreachable"
+    ]);
     RESCUABLE_STOPPED_WINDOW_MS = 24 * 60 * 60 * 1e3;
   }
 });
@@ -23439,7 +23563,7 @@ __export(credential_resolver_exports, {
   DEFAULT_REGION: () => DEFAULT_REGION,
   hasResolvableCredential: () => hasResolvableCredential,
   readClaudeCredentialExport: () => readClaudeCredentialExport,
-  readClaudeSettingsEnv: () => readClaudeSettingsEnv,
+  readClaudeSettingsEnv: () => readClaudeSettingsEnv2,
   resolveCredentialFrom: () => resolveCredentialFrom,
   resolveCredentials: () => resolveCredentials,
   traceCredentialResolution: () => traceCredentialResolution
@@ -23594,7 +23718,7 @@ function traceCredentialResolution(inputs) {
     region: { value: winner.region ?? DEFAULT_REGION, source: regionSource }
   };
 }
-function readClaudeSettingsEnv(settingsFile = CLAUDE_SETTINGS_FILE) {
+function readClaudeSettingsEnv2(settingsFile = CLAUDE_SETTINGS_FILE) {
   try {
     const raw = fs30.readFileSync(settingsFile, "utf-8");
     const parsed = JSON.parse(raw);
@@ -23634,7 +23758,7 @@ function probeAwsFiles() {
 function resolveCredentials(config) {
   const result = resolveCredentialFrom({
     config,
-    claudeEnv: readClaudeSettingsEnv(),
+    claudeEnv: readClaudeSettingsEnv2(),
     processEnv: process.env,
     awsFiles: probeAwsFiles(),
     claudeCredentialExport: readClaudeCredentialExport()
@@ -66416,10 +66540,9 @@ function buildArgs(opts) {
     // Input stays default (text): we write the whole prompt to stdin and close.
     // (stream-json INPUT would force us into a JSON envelope for no gain here.)
     "--tools",
-    "",
+    ""
     // disable ALL built-in tools (deny-all)
-    "--settings",
-    FORCE_SUBSCRIPTION_SETTINGS
+    // No --settings override: the user's settings.json (and so their auth) applies as-is.
   ];
   let systemText = systemToText(opts.system).trim();
   if (opts.tools && opts.tools.length > 0) {
@@ -66448,7 +66571,7 @@ function systemToText(system) {
 }
 function buildSpawnEnv(base = process.env) {
   const env3 = { ...base };
-  for (const key2 of AUTH_ENV_TO_STRIP) {
+  for (const key2 of ENV_TO_STRIP) {
     delete env3[key2];
   }
   env3.CLAUDE_CODE_ENTRYPOINT = WALNUT_UTILITY_ENTRYPOINT;
@@ -66510,7 +66633,7 @@ function normalizeCliModel(model) {
   }
   return void 0;
 }
-var AUTH_ENV_TO_STRIP, FORCE_SUBSCRIPTION_SETTINGS, CLI_TURN_TIMEOUT_MS, SESSION_REUSE_TTL_MS, MAX_TRACKED_SESSIONS, ClaudeCliAdapter;
+var ENV_TO_STRIP, MAX_CONCURRENT_CLI, CLI_TURN_TIMEOUT_MS, SESSION_REUSE_TTL_MS, MAX_TRACKED_SESSIONS, ClaudeCliAdapter;
 var init_adapter_claude_cli = __esm({
   "src/agent/providers/adapter-claude-cli.ts"() {
     "use strict";
@@ -66520,24 +66643,11 @@ var init_adapter_claude_cli = __esm({
     init_logging();
     init_claude_cli_detect();
     init_claude_cli_protocol();
-    AUTH_ENV_TO_STRIP = [
-      "ANTHROPIC_API_KEY",
-      "ANTHROPIC_AUTH_TOKEN",
-      "ANTHROPIC_BASE_URL",
-      "AWS_BEARER_TOKEN_BEDROCK",
-      "AWS_ACCESS_KEY_ID",
-      "AWS_SECRET_ACCESS_KEY",
-      "AWS_SESSION_TOKEN",
-      "AWS_PROFILE",
-      "CLAUDE_CODE_USE_BEDROCK",
-      "CLAUDE_CODE_USE_VERTEX",
-      // Nested-session marker — inline-subagent strips this too so the child doesn't
-      // think it's running inside another Claude session.
-      "CLAUDECODE"
-    ];
-    FORCE_SUBSCRIPTION_SETTINGS = JSON.stringify({
-      env: { CLAUDE_CODE_USE_BEDROCK: "", CLAUDE_CODE_USE_VERTEX: "" }
-    });
+    ENV_TO_STRIP = ["CLAUDECODE"];
+    MAX_CONCURRENT_CLI = (() => {
+      const n6 = Number(process.env.WALNUT_CLAUDE_CLI_CONCURRENCY);
+      return Number.isFinite(n6) && n6 > 0 ? Math.floor(n6) : 3;
+    })();
     CLI_TURN_TIMEOUT_MS = 12e4;
     SESSION_REUSE_TTL_MS = 30 * 60 * 1e3;
     MAX_TRACKED_SESSIONS = 50;
@@ -66545,6 +66655,25 @@ var init_adapter_claude_cli = __esm({
       protocol = "claude-cli";
       /** conversationKey → CLI session for --resume chaining. In-process only. */
       sessions = /* @__PURE__ */ new Map();
+      /** Process gate: MAX_CONCURRENT_CLI turns at once, the rest queue in order. */
+      inFlight = 0;
+      waiters = [];
+      async withSlot(fn) {
+        if (this.inFlight >= MAX_CONCURRENT_CLI) {
+          await new Promise((resolve) => this.waiters.push(resolve));
+        }
+        this.inFlight++;
+        try {
+          return await fn();
+        } finally {
+          this.inFlight--;
+          this.waiters.shift()?.();
+        }
+      }
+      /** Test hook: how many turns are running / waiting right now. */
+      _gateStateForTesting() {
+        return { inFlight: this.inFlight, waiting: this.waiters.length };
+      }
       resetClient() {
         this.sessions.clear();
       }
@@ -66622,7 +66751,7 @@ User: ${overridePrompt}` : "");
         }
         if (!prompt.trim()) prompt = "(continue)";
         const args = [...buildArgs(opts), session2.flag, session2.id];
-        return this.execCli(command6, args, env3, prompt, opts.signal, onTextDelta).then((result) => {
+        return this.withSlot(() => this.execCli(command6, args, env3, prompt, opts.signal, onTextDelta)).then((result) => {
           this.sessions.set(key2, {
             sessionId: session2.id,
             seenMessages: opts.messages.length,
@@ -66641,7 +66770,7 @@ User: ${overridePrompt}` : "");
 User: ${overridePrompt}` : "");
             const freshId = randomUUID3();
             const freshArgs = [...buildArgs(opts), "--session-id", freshId];
-            return this.execCli(command6, freshArgs, env3, freshPrompt || "(continue)", opts.signal, onTextDelta).then((result) => {
+            return this.withSlot(() => this.execCli(command6, freshArgs, env3, freshPrompt || "(continue)", opts.signal, onTextDelta)).then((result) => {
               this.sessions.set(key2, {
                 sessionId: freshId,
                 seenMessages: opts.messages.length,
@@ -66725,7 +66854,7 @@ User: ${overridePrompt}` : "");
               }
               const resultText = finalResult?.result || accumulatedText;
               if (resultText && resultText.length < 300 && /^\s*failed to authenticate|^\s*api error: 4\d\d/i.test(resultText)) {
-                reject(new Error(`claude-cli subscription auth failed \u2014 run \`claude login\` to re-authenticate. CLI said: ${resultText.slice(0, 200)}`));
+                reject(new Error(`claude-cli could not authenticate \u2014 run \`claude\` once in a terminal to sign in (or check its Bedrock settings). CLI said: ${resultText.slice(0, 200)}`));
                 return;
               }
               if (code !== 0 && !accumulatedText && !finalResult) {
@@ -66925,6 +67054,50 @@ var init_registry2 = __esm({
   }
 });
 
+// src/agent/providers/default-provider.ts
+var default_provider_exports = {};
+__export(default_provider_exports, {
+  CLAUDE_CLI_PROVIDER: () => CLAUDE_CLI_PROVIDER,
+  LEGACY_DEFAULT_PROVIDER: () => LEGACY_DEFAULT_PROVIDER,
+  _resetDefaultProviderCacheForTesting: () => _resetDefaultProviderCacheForTesting,
+  hasExplicitBedrockConfig: () => hasExplicitBedrockConfig,
+  mainProviderIsImplicit: () => mainProviderIsImplicit,
+  resolveMainProviderName: () => resolveMainProviderName
+});
+function claudeCliInstalledCached() {
+  const now = Date.now();
+  if (!cliProbe || now - cliProbe.at > CLI_PROBE_TTL_MS) {
+    cliProbe = { at: now, installed: isClaudeCliInstalled() };
+  }
+  return cliProbe.installed;
+}
+function _resetDefaultProviderCacheForTesting() {
+  cliProbe = void 0;
+}
+function hasExplicitBedrockConfig(config) {
+  const b8 = config.providers?.bedrock;
+  if (b8 && (b8.bearer_token || b8.aws_access_key_id || b8.aws_profile || b8.aws_credential_export)) return true;
+  return !!config.provider?.bedrock_bearer_token;
+}
+function resolveMainProviderName(config, claudeInstalled = claudeCliInstalledCached()) {
+  if (config.agent?.main_provider) return config.agent.main_provider;
+  if (claudeInstalled) return CLAUDE_CLI_PROVIDER;
+  return LEGACY_DEFAULT_PROVIDER;
+}
+function mainProviderIsImplicit(config) {
+  return !config.agent?.main_provider;
+}
+var LEGACY_DEFAULT_PROVIDER, CLAUDE_CLI_PROVIDER, CLI_PROBE_TTL_MS, cliProbe;
+var init_default_provider = __esm({
+  "src/agent/providers/default-provider.ts"() {
+    "use strict";
+    init_claude_cli_detect();
+    LEGACY_DEFAULT_PROVIDER = "bedrock";
+    CLAUDE_CLI_PROVIDER = "claude_cli";
+    CLI_PROBE_TTL_MS = 6e4;
+  }
+});
+
 // src/agent/model.ts
 var model_exports = {};
 __export(model_exports, {
@@ -66959,7 +67132,7 @@ function getContextThreshold(model, percent) {
 }
 async function resolveForCall(config) {
   const fullConfig = await getConfig();
-  const providerName = config?.provider ?? fullConfig.agent?.main_provider ?? "bedrock";
+  const providerName = config?.provider ?? resolveMainProviderName(fullConfig);
   const hasExplicitProviders = fullConfig.providers && Object.keys(fullConfig.providers).length > 0;
   let providers = hasExplicitProviders ? buildProviderMap(fullConfig.providers, fullConfig) : synthesizeFromLegacy(fullConfig);
   const resolved = resolveProvider(providerName, providers);
@@ -67029,6 +67202,7 @@ var init_model = __esm({
     "use strict";
     init_config_manager();
     init_registry2();
+    init_default_provider();
     init_defaults();
     init_model_catalog();
   }
@@ -67231,8 +67405,22 @@ var init_token_truth = __esm({
 });
 
 // src/utils/image-compress.ts
-import sharp from "sharp";
+async function loadSharp() {
+  sharpLoad ??= import("sharp").then(
+    (m6) => m6.default ?? m6,
+    (err2) => {
+      log.agent.warn("sharp is not installed; images are sent uncompressed", {
+        error: err2 instanceof Error ? err2.message : String(err2),
+        fix: "a machine with glibc 2.28+ installs sharp prebuilt; otherwise install libvips and re-run npm install"
+      });
+      return null;
+    }
+  );
+  return sharpLoad;
+}
 async function clampImageDimensions(buffer2, mimeType) {
+  const sharp = await loadSharp();
+  if (!sharp) return { buffer: buffer2, mimeType };
   try {
     const meta = await sharp(buffer2).metadata();
     const longest = Math.max(meta.width ?? 0, meta.height ?? 0);
@@ -67254,6 +67442,8 @@ async function compressForApi(inputBuffer, inputMimeType) {
   if (buffer2.toString("base64").length <= MAX_BASE64_BYTES) {
     return { buffer: buffer2, mimeType };
   }
+  const sharp = await loadSharp();
+  if (!sharp) return { buffer: buffer2, mimeType };
   try {
     if (mimeType === "image/gif") {
       const webp = await sharp(buffer2, { animated: true }).webp({ quality: 80 }).toBuffer();
@@ -67291,10 +67481,11 @@ async function compressForApi(inputBuffer, inputMimeType) {
     return { buffer: buffer2, mimeType };
   }
 }
-var MAX_BASE64_BYTES, MAX_IMAGE_DIMENSION;
+var sharpLoad, MAX_BASE64_BYTES, MAX_IMAGE_DIMENSION;
 var init_image_compress = __esm({
   "src/utils/image-compress.ts"() {
     "use strict";
+    init_logging();
     MAX_BASE64_BYTES = 5e6;
     MAX_IMAGE_DIMENSION = 1568;
   }
@@ -68452,7 +68643,7 @@ __export(cheap_model_exports, {
 });
 function fastModelFor(config) {
   if (config.agent?.fast_model) return config.agent.fast_model;
-  const providerName = config.agent?.main_provider ?? "bedrock";
+  const providerName = resolveMainProviderName(config);
   return MODEL_CATALOG[providerName]?.find(
     (model) => model.id.toLowerCase().includes("haiku")
   )?.id;
@@ -68464,6 +68655,7 @@ var init_cheap_model = __esm({
   "src/core/cheap-model.ts"() {
     "use strict";
     init_model_catalog();
+    init_default_provider();
   }
 });
 
@@ -70283,11 +70475,35 @@ async function applySnapshot(sessionId, snapshot2, source) {
   if (projected !== "error") {
     updates.errorMessage = void 0;
     updates.errorKind = void 0;
-    clearSuppressedErrorReason(sessionId);
+    const stashedStop = projected === "stopped" ? takeSuppressedErrorReason(sessionId) : null;
+    if (stashedStop?.message) {
+      updates.errorMessage = stashedStop.message;
+      if (stashedStop.kind) updates.errorKind = stashedStop.kind;
+      log.session.info("snapshot projection adopted suppressed stop reason", {
+        sessionId,
+        suppressedReason: stashedStop.reason,
+        kind: stashedStop.kind ?? null,
+        projected,
+        source
+      });
+    } else {
+      clearSuppressedErrorReason(sessionId);
+    }
   } else {
+    let droppedDisproven = false;
+    if (assertsHostUnreachable(record)) {
+      updates.errorMessage = void 0;
+      droppedDisproven = true;
+      log.session.info("snapshot projection dropped disproven unreachability diagnosis", {
+        sessionId,
+        priorReason: record.status_reason ?? null,
+        projected,
+        source
+      });
+    }
     const stashed = takeSuppressedErrorReason(sessionId);
     if (stashed) {
-      if (!record.errorMessage && stashed.message) updates.errorMessage = stashed.message;
+      if ((!record.errorMessage || droppedDisproven) && stashed.message) updates.errorMessage = stashed.message;
       if (!record.errorKind && stashed.kind) updates.errorKind = stashed.kind;
       log.session.info("snapshot projection adopted suppressed error reason", {
         sessionId,
@@ -70340,6 +70556,7 @@ var init_session_snapshot_apply = __esm({
     "use strict";
     init_logging();
     init_session_snapshot_gate();
+    init_session_error_kind();
     init_engine_registry();
     init_session_snapshot_gate();
     TERMINAL = /* @__PURE__ */ new Set(["stopped", "error"]);
@@ -72954,9 +73171,15 @@ var init_acp_session = __esm({
       }
       async resolveArtifacts() {
         if (this.cfg.artifacts) return this.cfg.artifacts;
-        return resolveAcpArtifacts(this.engineId, {
+        const artifacts = resolveAcpArtifacts(this.engineId, {
           configuredAdapterCmd: await this.resolveConfiguredAdapterCmd()
         });
+        if (!fsModule.existsSync(artifacts.workerCmd[1])) {
+          throw new Error(
+            `Engine '${this.engineId}' runs on the ACP worker, which is not built (${artifacts.workerCmd[1]}). Install Bun (https://bun.sh) and run \`npm run build:daemon\`, or install Walnut from npm, which ships it.`
+          );
+        }
+        return artifacts;
       }
       async establishProviderSession() {
         await this.seedReplayCursor();
@@ -74339,6 +74562,26 @@ var init_transcript_chain = __esm({
   }
 });
 
+// src/core/sessions/side-thread-warmup.ts
+function isCacheWarmupText(text) {
+  return text.startsWith(CACHE_WARMUP_TAG);
+}
+function markWarmupTurnPending(sessionId) {
+  pendingWarmupTurns.add(sessionId);
+}
+function consumeWarmupTurn(sessionId) {
+  return pendingWarmupTurns.delete(sessionId);
+}
+var CACHE_WARMUP_TAG, CACHE_WARMUP_MESSAGE, pendingWarmupTurns;
+var init_side_thread_warmup = __esm({
+  "src/core/sessions/side-thread-warmup.ts"() {
+    "use strict";
+    CACHE_WARMUP_TAG = "<walnut-cache-warmup>";
+    CACHE_WARMUP_MESSAGE = `${CACHE_WARMUP_TAG}This is a cache warm-up from the tool hosting this side thread, not a user message. Reply with exactly one word: Ready. Use no tools and add nothing else.</walnut-cache-warmup>`;
+    pendingWarmupTurns = /* @__PURE__ */ new Set();
+  }
+});
+
 // src/core/history-disk-cache.ts
 var history_disk_cache_exports = {};
 __export(history_disk_cache_exports, {
@@ -76493,11 +76736,13 @@ __export(session_lifecycle_exports, {
   persistSessionModeChange: () => persistSessionModeChange,
   readProviderSessionHistory: () => readProviderSessionHistory,
   readSessionRichHistory: () => readSessionRichHistory,
+  recheckSession: () => recheckSession,
   respondSessionPermission: () => respondSessionPermission,
   restartSession: () => restartSession,
   retrySession: () => retrySession,
   terminateSession: () => terminateSession
 });
+import { randomUUID as randomUUID4 } from "crypto";
 async function readProviderSessionHistory(sessionId, record, nativeHost, skipSubagents = true, opts) {
   if (record && engineCaps(record.engine).historySource === "acp-journal") {
     const { readAcpSessionHistoryState: readAcpSessionHistoryState2 } = await Promise.resolve().then(() => (init_acp_session_history(), acp_session_history_exports));
@@ -76608,6 +76853,33 @@ async function changeSessionMode(existingRecord, sessionId, mode, updates = {})
   });
   return updated;
 }
+function normalizePinQuote(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new SessionControlError("pinned_messages[].quote must be an object", 400);
+  }
+  const quote = value;
+  const exact = quote.exact;
+  if (typeof exact !== "string" || !exact.trim() || exact.length > MAX_PIN_QUOTE_CHARS) {
+    throw new SessionControlError(
+      `pinned_messages[].quote.exact must be a non-empty string (max ${MAX_PIN_QUOTE_CHARS} chars)`,
+      400
+    );
+  }
+  for (const side of ["prefix", "suffix"]) {
+    const context = quote[side];
+    if (context !== void 0 && context !== null && (typeof context !== "string" || context.length > MAX_PIN_QUOTE_CONTEXT_CHARS)) {
+      throw new SessionControlError(
+        `pinned_messages[].quote.${side} must be a string (max ${MAX_PIN_QUOTE_CONTEXT_CHARS} chars)`,
+        400
+      );
+    }
+  }
+  return {
+    exact,
+    ...typeof quote.prefix === "string" && quote.prefix ? { prefix: quote.prefix } : {},
+    ...typeof quote.suffix === "string" && quote.suffix ? { suffix: quote.suffix } : {}
+  };
+}
 function normalizePinnedMessages(value) {
   if (!Array.isArray(value)) {
     throw new SessionControlError("pinned_messages must be an array", 400);
@@ -76616,7 +76888,9 @@ function normalizePinnedMessages(value) {
     throw new SessionControlError(`pinned_messages holds at most ${MAX_PINNED_MESSAGES} entries`, 400);
   }
   const out = [];
-  const seen = /* @__PURE__ */ new Set();
+  const seenWholeMessage = /* @__PURE__ */ new Set();
+  const seenQuoteId = /* @__PURE__ */ new Set();
+  const seenQuoteShape = /* @__PURE__ */ new Set();
   for (const raw of value) {
     if (!raw || typeof raw !== "object") {
       throw new SessionControlError("each pinned_messages entry must be an object", 400);
@@ -76626,13 +76900,40 @@ function normalizePinnedMessages(value) {
     if (typeof msgId !== "string" || !msgId.trim() || msgId.length > MAX_PIN_ID_CHARS) {
       throw new SessionControlError("pinned_messages[].msgId must be a non-empty string", 400);
     }
-    if (seen.has(msgId)) continue;
-    seen.add(msgId);
+    const rawId = entry.id;
+    if (rawId !== void 0 && rawId !== null && (typeof rawId !== "string" || !rawId.trim() || rawId.length > MAX_PIN_ENTRY_ID_CHARS)) {
+      throw new SessionControlError(
+        `pinned_messages[].id must be a non-empty string (max ${MAX_PIN_ENTRY_ID_CHARS} chars)`,
+        400
+      );
+    }
+    const id = typeof rawId === "string" ? rawId : void 0;
+    const quote = entry.quote === void 0 || entry.quote === null ? void 0 : normalizePinQuote(entry.quote);
+    let pinId = id;
+    if (quote) {
+      if (id && seenQuoteId.has(id)) continue;
+      const shape = [msgId, quote.exact, quote.prefix ?? "", quote.suffix ?? ""].join("\0");
+      if (seenQuoteShape.has(shape)) continue;
+      pinId = id ?? randomUUID4();
+      seenQuoteId.add(pinId);
+      seenQuoteShape.add(shape);
+    } else {
+      if (seenWholeMessage.has(msgId)) continue;
+      seenWholeMessage.add(msgId);
+    }
     const role = entry.role === "user" || entry.role === "assistant" || entry.role === "system" ? entry.role : "assistant";
     const label = typeof entry.label === "string" ? entry.label.trim().slice(0, MAX_PIN_LABEL_CHARS) : "";
     const timestamp = typeof entry.timestamp === "string" ? entry.timestamp : void 0;
     const pinnedAt = typeof entry.pinnedAt === "string" ? entry.pinnedAt : (/* @__PURE__ */ new Date()).toISOString();
-    out.push({ msgId, label, role, ...timestamp ? { timestamp } : {}, pinnedAt });
+    out.push({
+      msgId,
+      label,
+      role,
+      ...timestamp ? { timestamp } : {},
+      pinnedAt,
+      ...pinId ? { id: pinId } : {},
+      ...quote ? { quote } : {}
+    });
   }
   return out;
 }
@@ -76830,7 +77131,7 @@ async function retrySession(sessionId) {
       return { status: "reconnected", sessionId };
     }
     if (await resumeConversationExists(record)) {
-      const { sendMessageToSession: sendMessageToSession2, getQueue: getQueue2, unparkMessage: unparkMessage2 } = await Promise.resolve().then(() => (init_session_message_queue(), session_message_queue_exports));
+      const { getQueue: getQueue2, unparkMessage: unparkMessage2 } = await Promise.resolve().then(() => (init_session_message_queue(), session_message_queue_exports));
       const pendingMsgs = await getQueue2(sessionId);
       for (const parked of pendingMsgs.filter((m6) => m6.status === "parked")) {
         await unparkMessage2(sessionId, parked.id);
@@ -76840,9 +77141,22 @@ async function retrySession(sessionId) {
         log.session.info("session retry: re-processing pending queue messages", { sessionId, taskId: record.taskId, count: pendingMsgs.length });
         return { status: "resuming", sessionId, restoredMessages: pendingMsgs.length };
       }
-      await sendMessageToSession2(sessionId, "continue", { source: "retry", taskId: record.taskId });
-      log.session.info("session retry: resuming via --resume (no pending messages)", { sessionId, taskId: record.taskId });
-      return { status: "resuming", sessionId };
+      const relabelled = await updateSessionRecord2(sessionId, {
+        process_status: "stopped",
+        errorMessage: void 0,
+        errorKind: void 0,
+        activity: void 0,
+        last_status_change: (/* @__PURE__ */ new Date()).toISOString(),
+        status_reason: "retry_reconnect",
+        status_changed_by: "user"
+      });
+      emitSessionStatusChanged2(relabelled, {}, ["*"]);
+      log.session.info("session retry: reconnected \u2014 conversation preserved, no message sent", {
+        sessionId,
+        taskId: record.taskId,
+        host: record.host ?? "__local__"
+      });
+      return { status: "resumable", sessionId };
     }
     log.session.warn("session retry: conversation never persisted \u2014 starting fresh instead of --resume", {
       sessionId,
@@ -76900,6 +77214,91 @@ async function retrySession(sessionId) {
   });
   return { status: "pending", taskId: task.id, oldSessionId: sessionId };
 }
+async function withDeadline(p6, ms) {
+  let timer3;
+  try {
+    return await Promise.race([
+      p6,
+      new Promise((resolve) => {
+        timer3 = setTimeout(() => resolve(RECHECK_TIMED_OUT), ms);
+        if (timer3 && typeof timer3 === "object" && "unref" in timer3) timer3.unref();
+      })
+    ]);
+  } finally {
+    if (timer3) clearTimeout(timer3);
+  }
+}
+async function recheckSession(sessionId) {
+  const { getSessionByClaudeId: getSessionByClaudeId2 } = await Promise.resolve().then(() => (init_session_tracker(), session_tracker_exports));
+  const record = await getSessionByClaudeId2(sessionId);
+  if (!record) throw new SessionControlError("Session not found", 404);
+  const hostKey2 = record.host ?? "__local__";
+  const { classifySessionError: classifySessionError2 } = await Promise.resolve().then(() => (init_session_error_kind(), session_error_kind_exports));
+  const kind = classifySessionError2(record);
+  const base = { sessionId, processStatus: record.process_status, infraClaim: kind === "infra" };
+  const { isDaemonConnected: isDaemonConnected2, getPooledSnapshotConnection: getPooledSnapshotConnection2 } = await Promise.resolve().then(() => (init_daemon_connection(), daemon_connection_exports));
+  const reachable = isDaemonConnected2(hostKey2);
+  if (kind === "terminal") return { ...base, checked: false, reachable, reason: "terminal_error" };
+  if (record.archived) return { ...base, checked: false, reachable, reason: "archived" };
+  const conn = getPooledSnapshotConnection2(record.host);
+  if (!conn) {
+    log.session.info("session recheck: no pooled snapshot connection \u2014 nothing to ask", {
+      sessionId,
+      host: hostKey2,
+      reachable
+    });
+    return { ...base, checked: false, reachable, reason: "no_pooled_connection" };
+  }
+  let raced;
+  try {
+    raced = await withDeadline(
+      conn.send("getState", { sid: sessionId }, RECHECK_RPC_TIMEOUT_MS),
+      RECHECK_RPC_TIMEOUT_MS
+    );
+  } catch (err2) {
+    log.session.info("session recheck: getState failed", {
+      sessionId,
+      host: hostKey2,
+      error: err2 instanceof Error ? err2.message : String(err2)
+    });
+    return { ...base, checked: false, reachable, reason: "rpc_failed" };
+  }
+  if (raced === RECHECK_TIMED_OUT) {
+    log.session.warn("session recheck: getState timed out", {
+      sessionId,
+      host: hostKey2,
+      timeoutMs: RECHECK_RPC_TIMEOUT_MS
+    });
+    return { ...base, checked: false, reachable, reason: "timeout" };
+  }
+  const snapshot2 = raced?.ok ? raced.snapshot : void 0;
+  if (!snapshot2) {
+    return { ...base, checked: false, reachable: true, reason: "no_snapshot" };
+  }
+  const { applySnapshot: applySnapshot2 } = await Promise.resolve().then(() => (init_session_snapshot_apply(), session_snapshot_apply_exports));
+  const outcome = await applySnapshot2(sessionId, snapshot2, "recheck-open");
+  const after = await getSessionByClaudeId2(sessionId);
+  const processStatus = after?.process_status ?? record.process_status;
+  log.session.info("session recheck: reconciled against host", {
+    sessionId,
+    host: hostKey2,
+    previous: record.process_status,
+    processStatus,
+    cliState: snapshot2.cliState,
+    applyOutcome: outcome.outcome
+  });
+  return {
+    sessionId,
+    checked: true,
+    reachable: true,
+    alive: snapshot2.cliState !== "dead",
+    processStatus,
+    // Re-classify against the CURRENT record: a converged row may no longer
+    // carry the claim, and the client uses this to decide whether the sentence
+    // on screen is still true.
+    infraClaim: classifySessionError2(after ?? record) === "infra"
+  };
+}
 async function respondSessionPermission(sessionId, requestId, allow, denyMessage, optionId, answers) {
   if (typeof requestId !== "string" || !requestId || typeof allow !== "boolean") {
     throw new SessionControlError("requestId (string) and allow (boolean) are required", 400);
@@ -77193,7 +77592,7 @@ async function readSessionRichHistory(sessionId, tail) {
     ...historyWindowed ? { windowed: true } : {}
   };
 }
-var CLAUDE_SESSION_MODES, MAX_PINNED_MESSAGES, MAX_PIN_LABEL_CHARS, MAX_PIN_ID_CHARS, GIT_BASES, MAX_FORK_DEPTH, HISTORY_STARTUP_GRACE_MS;
+var CLAUDE_SESSION_MODES, MAX_PINNED_MESSAGES, MAX_PIN_LABEL_CHARS, MAX_PIN_ID_CHARS, MAX_PIN_ENTRY_ID_CHARS, MAX_PIN_QUOTE_CHARS, MAX_PIN_QUOTE_CONTEXT_CHARS, RECHECK_RPC_TIMEOUT_MS, RECHECK_TIMED_OUT, GIT_BASES, MAX_FORK_DEPTH, HISTORY_STARTUP_GRACE_MS;
 var init_session_lifecycle = __esm({
   "src/core/sessions/session-lifecycle.ts"() {
     "use strict";
@@ -77207,6 +77606,11 @@ var init_session_lifecycle = __esm({
     MAX_PINNED_MESSAGES = 200;
     MAX_PIN_LABEL_CHARS = 300;
     MAX_PIN_ID_CHARS = 200;
+    MAX_PIN_ENTRY_ID_CHARS = 64;
+    MAX_PIN_QUOTE_CHARS = 2e3;
+    MAX_PIN_QUOTE_CONTEXT_CHARS = 64;
+    RECHECK_RPC_TIMEOUT_MS = 5e3;
+    RECHECK_TIMED_OUT = /* @__PURE__ */ Symbol("recheck-timeout");
     GIT_BASES = /* @__PURE__ */ new Set(["uncommitted", "previous", "remote"]);
     MAX_FORK_DEPTH = 5;
     HISTORY_STARTUP_GRACE_MS = 2 * 60 * 1e3;
@@ -77507,7 +77911,7 @@ __export(compact_inject_exports, {
   extractSessionMeta: () => extractSessionMeta,
   injectCompactBoundary: () => injectCompactBoundary
 });
-import { randomUUID as randomUUID4 } from "crypto";
+import { randomUUID as randomUUID5 } from "crypto";
 import fsp26 from "fs/promises";
 async function extractSessionMeta(jsonlPath) {
   const content = await fsp26.readFile(jsonlPath, "utf-8");
@@ -77559,8 +77963,8 @@ async function injectCompactBoundary(jsonlPath, summary, meta) {
     log.session.error("Could not find last message UUID in JSONL", { jsonlPath });
     return null;
   }
-  const boundaryUuid = randomUUID4();
-  const summaryUuid = randomUUID4();
+  const boundaryUuid = randomUUID5();
+  const summaryUuid = randomUUID5();
   const now = /* @__PURE__ */ new Date();
   const boundaryTs = now.toISOString();
   const summaryTs = new Date(now.getTime() + 1e3).toISOString();
@@ -86589,7 +86993,7 @@ function isRevealSecretPath(resolved) {
   ];
   return denied.some((d8) => resolved === d8 || resolved.startsWith(d8 + path69.sep)) || /(^|\/)config\.ya?ml$/.test(resolved);
 }
-var filesRouter, MAX_ENTRIES2, REMOTE_TIMEOUT_MS3, REMOTE_RESOLVE_BUDGET_MS, FilesOpError, MAX_UPWARD_LEVELS2, MAX_DOWNWARD_DEPTH, REFERENCE_SEARCH_BUDGET_MS, SYMBOL_RE2, REVEAL_APP_DENY_EXTS;
+var filesRouter, MAX_ENTRIES2, REMOTE_TIMEOUT_MS3, REMOTE_RESOLVE_BUDGET_MS, FilesOpError, MAX_UPWARD_LEVELS2, MAX_DOWNWARD_DEPTH, REFERENCE_SEARCH_BUDGET_MS, SYMBOL_RE2, LIST_MANY_MAX_PATHS, LIST_MANY_CONCURRENCY, LIST_MANY_DEADLINE_MS, REVEAL_APP_DENY_EXTS;
 var init_files2 = __esm({
   "src/web/routes/files.ts"() {
     "use strict";
@@ -86722,6 +87126,54 @@ var init_files2 = __esm({
         next(err2);
       }
     });
+    LIST_MANY_MAX_PATHS = 64;
+    LIST_MANY_CONCURRENCY = 8;
+    LIST_MANY_DEADLINE_MS = 8e3;
+    filesRouter.post("/list-many", async (req, res, next) => {
+      try {
+        const body3 = req.body ?? {};
+        const raw = Array.isArray(body3.paths) ? body3.paths : null;
+        if (!raw) {
+          res.status(400).json({ error: "paths (string[]) is required" });
+          return;
+        }
+        const host = typeof body3.host === "string" && body3.host ? body3.host : void 0;
+        const showHidden = body3.showHidden === true || body3.showHidden === "1";
+        const paths = [...new Set(
+          raw.filter((p6) => typeof p6 === "string" && !!p6)
+        )];
+        const truncated = paths.length > LIST_MANY_MAX_PATHS;
+        const wanted = paths.slice(0, LIST_MANY_MAX_PATHS);
+        const deadline4 = Date.now() + LIST_MANY_DEADLINE_MS;
+        const listings = [];
+        let timedOut = false;
+        let next_ = 0;
+        const worker = async () => {
+          for (; ; ) {
+            const i8 = next_++;
+            if (i8 >= wanted.length) return;
+            if (Date.now() >= deadline4) {
+              timedOut = true;
+              return;
+            }
+            const dirPath = wanted[i8];
+            try {
+              listings.push(await listSessionFiles(dirPath, host, showHidden));
+            } catch (err2) {
+              listings.push({ path: dirPath, error: err2 instanceof Error ? err2.message : String(err2) });
+            }
+          }
+        };
+        await Promise.all(Array.from({ length: Math.min(LIST_MANY_CONCURRENCY, wanted.length) }, worker));
+        res.json({ listings, truncated, timedOut });
+      } catch (err2) {
+        if (err2 instanceof FilesOpError) {
+          res.status(err2.statusCode).json({ error: err2.message });
+          return;
+        }
+        next(err2);
+      }
+    });
     REVEAL_APP_DENY_EXTS = /* @__PURE__ */ new Set([
       "command",
       "sh",
@@ -88296,6 +88748,82 @@ var init_task = __esm({
   }
 });
 
+// src/core/sessions/spawn-prefix.ts
+var spawn_prefix_exports = {};
+__export(spawn_prefix_exports, {
+  MAX_SPAWN_PROMPT_BYTES: () => MAX_SPAWN_PROMPT_BYTES,
+  parseSpawnPrefixFromArgs: () => parseSpawnPrefixFromArgs,
+  readParentSpawnPrefix: () => readParentSpawnPrefix,
+  spawnPrefixFromRecord: () => spawnPrefixFromRecord
+});
+function flagValue(args, flag) {
+  const i8 = args.indexOf(flag);
+  if (i8 < 0 || i8 + 1 >= args.length) return void 0;
+  const v3 = args[i8 + 1];
+  return v3 !== void 0 && !v3.startsWith("--") ? v3 : void 0;
+}
+function parseSpawnPrefixFromArgs(args) {
+  const prompt = flagValue(args, "--append-system-prompt");
+  return {
+    appendSystemPrompt: prompt !== void 0 && Buffer.byteLength(prompt, "utf8") <= MAX_SPAWN_PROMPT_BYTES ? prompt : null,
+    ...flagValue(args, "--model") ? { model: flagValue(args, "--model") } : {},
+    ...EFFORTS.includes(flagValue(args, "--effort") ?? "") ? { effort: flagValue(args, "--effort") } : {},
+    ...flagValue(args, "--permission-mode") ? { permissionMode: flagValue(args, "--permission-mode") } : {},
+    source: "live-process"
+  };
+}
+function spawnPrefixFromRecord(record) {
+  const stored = record.appliedAppendSystemPrompt;
+  if (stored === void 0 || stored === null) return { appendSystemPrompt: null, source: "unknown" };
+  const usable = stored.length > 0 && Buffer.byteLength(stored, "utf8") <= MAX_SPAWN_PROMPT_BYTES;
+  return { appendSystemPrompt: usable ? stored : null, source: "record" };
+}
+async function defaultLiveArgsReader(hostKey2, sessionId) {
+  const { probeDaemonSessionArgs: probeDaemonSessionArgs2 } = await Promise.resolve().then(() => (init_daemon_connection(), daemon_connection_exports));
+  return probeDaemonSessionArgs2(hostKey2, sessionId);
+}
+async function readParentSpawnPrefix(parent, deps = {}) {
+  const readLiveArgs = deps.readLiveArgs ?? defaultLiveArgsReader;
+  const hostKey2 = parent.host || "__local__";
+  let live = null;
+  try {
+    live = await readLiveArgs(hostKey2, parent.claudeSessionId);
+  } catch (err2) {
+    log.session.debug("spawn prefix: live argv read threw", {
+      sessionId: parent.claudeSessionId,
+      error: err2 instanceof Error ? err2.message : String(err2)
+    });
+  }
+  if (live && live.length > 0) {
+    const prefix = parseSpawnPrefixFromArgs(live);
+    const remembered = parent.appliedAppendSystemPrompt ?? void 0;
+    const actual = prefix.appendSystemPrompt ?? "";
+    if (remembered !== actual) {
+      const persist4 = deps.persist ?? (async (sid, prompt) => {
+        const { updateSessionRecord: updateSessionRecord2 } = await Promise.resolve().then(() => (init_session_tracker(), session_tracker_exports));
+        return updateSessionRecord2(sid, { appliedAppendSystemPrompt: prompt });
+      });
+      void persist4(parent.claudeSessionId, actual).catch((err2) => {
+        log.session.warn("spawn prefix: backfill of applied prompt failed", {
+          sessionId: parent.claudeSessionId,
+          error: err2 instanceof Error ? err2.message : String(err2)
+        });
+      });
+    }
+    return prefix;
+  }
+  return spawnPrefixFromRecord(parent);
+}
+var EFFORTS, MAX_SPAWN_PROMPT_BYTES;
+var init_spawn_prefix = __esm({
+  "src/core/sessions/spawn-prefix.ts"() {
+    "use strict";
+    init_logging();
+    EFFORTS = ["low", "medium", "high", "xhigh", "max"];
+    MAX_SPAWN_PROMPT_BYTES = 65536;
+  }
+});
+
 // src/core/sessions/side-thread-fork.ts
 var side_thread_fork_exports = {};
 __export(side_thread_fork_exports, {
@@ -88352,6 +88880,10 @@ async function forkSideThreadSession(parentSid, threadId, opts) {
   const sessionId = crypto16.randomUUID();
   const lane = sideThreadLaneKey(parentSid, threadId);
   const mode = parent.mode !== "default" ? parent.mode : void 0;
+  const { readParentSpawnPrefix: readParentSpawnPrefix2 } = await Promise.resolve().then(() => (init_spawn_prefix(), spawn_prefix_exports));
+  const prefix = await readParentSpawnPrefix2(parent);
+  const cliModel = prefix.model ?? parent.cliModel;
+  const effort = prefix.effort ?? parent.effort;
   await createSessionRecord(sessionId, "", parent.project ?? "", parent.cwd, {
     title,
     ...mode ? { mode } : {},
@@ -88359,8 +88891,10 @@ async function forkSideThreadSession(parentSid, threadId, opts) {
     // The thread inherits the parent's launch bundle verbatim, re-applied from
     // the record on every cold resume.
     ...parent.profile ? { profile: parent.profile } : {},
-    ...parent.effort ? { effort: parent.effort } : {},
-    ...parent.cliModel ? { cliModel: parent.cliModel } : {},
+    ...effort ? { effort } : {},
+    ...cliModel ? { cliModel } : {},
+    // '' = the parent runs without an append prompt, and so does the thread.
+    appliedAppendSystemPrompt: prefix.appendSystemPrompt ?? "",
     lane,
     forkedFromSessionId: resumeFrom,
     initialProcessStatus: "idle",
@@ -88376,11 +88910,12 @@ async function forkSideThreadSession(parentSid, threadId, opts) {
     ...mode ? { mode } : {},
     ...parent.host ? { host: parent.host } : {},
     ...parent.profile ? { profile: parent.profile } : {},
-    ...parent.effort ? { effort: parent.effort } : {},
+    ...effort ? { effort } : {},
     // Must be `cliModel` (the parent's verbatim --model arg, [1m] marker
     // included): the CLI does NOT inherit a model across --fork-session, and
     // the reported `model` has lost the marker.
-    ...parent.cliModel ? { model: parent.cliModel } : {},
+    ...cliModel ? { model: cliModel } : {},
+    appendSystemPromptExact: prefix.appendSystemPrompt,
     lane,
     forkedFromSessionId: resumeFrom
   }, ["session-runner"], { source: "side-thread-fork" });
@@ -88389,7 +88924,9 @@ async function forkSideThreadSession(parentSid, threadId, opts) {
     threadId,
     sessionId,
     resumeFrom,
-    initOnly: !opts?.message
+    initOnly: !opts?.message,
+    prefixSource: prefix.source,
+    prefixPromptLength: prefix.appendSystemPrompt?.length ?? 0
   });
   return { sessionId, resumeFromSessionId: resumeFrom };
 }
@@ -100645,14 +101182,16 @@ function isLive(r8) {
 function isRevivable(r8) {
   return !!r8.outputFile || r8.consumedOffset !== void 0;
 }
-var STANDBY_TTL_MS, MAX_LIVE_THREADS, IDLE_SWEEP_INTERVAL_MS, THREAD_IDLE_MS, SideThreadManager, sideThreadManager;
+var STANDBY_TTL_MS, WARMED_STANDBY_TTL_MS, MAX_LIVE_THREADS, IDLE_SWEEP_INTERVAL_MS, THREAD_IDLE_MS, SideThreadManager, sideThreadManager;
 var init_side_thread_manager = __esm({
   "src/core/sessions/side-thread-manager.ts"() {
     "use strict";
     init_logging();
     init_side_thread_fork();
     init_session_controls();
+    init_side_thread_warmup();
     STANDBY_TTL_MS = 12e4;
+    WARMED_STANDBY_TTL_MS = 15 * 6e4;
     MAX_LIVE_THREADS = 3;
     IDLE_SWEEP_INTERVAL_MS = 5 * 6e4;
     THREAD_IDLE_MS = 30 * 6e4;
@@ -100663,6 +101202,8 @@ var init_side_thread_manager = __esm({
        *  In-memory only: a server restart loses it, but the boot sweep archives
        *  every standby anyway, so a record can never outlive its map entry. */
       standbyParentOffsets = /* @__PURE__ */ new Map();
+      /** parentSid → standby sid that already ran its cache warm-up turn. */
+      warmedStandbys = /* @__PURE__ */ new Map();
       /** One in-flight standby/create op per parent — two concurrent asks must not
        *  both consume the same standby (they would collide on its lane rename). */
       inFlight = /* @__PURE__ */ new Map();
@@ -100694,6 +101235,7 @@ var init_side_thread_manager = __esm({
         for (const timer3 of this.standbyTimers.values()) clearTimeout(timer3);
         this.standbyTimers.clear();
         this.standbyParentOffsets.clear();
+        this.warmedStandbys.clear();
         this.inFlight.clear();
       }
       // ── Standby ────────────────────────────────────────────────────────────────
@@ -100709,10 +101251,12 @@ var init_side_thread_manager = __esm({
           const existing = await this.findStandby(parentSid);
           if (existing) {
             if (await this.isStandbyUsable(parentSid, existing)) {
-              this.armStandbyTtl(parentSid, existing.claudeSessionId);
+              const warmed = this.warmedStandbys.get(parentSid) === existing.claudeSessionId;
+              this.armStandbyTtl(parentSid, existing.claudeSessionId, warmed ? WARMED_STANDBY_TTL_MS : STANDBY_TTL_MS);
               return existing.claudeSessionId;
             }
             void this.retireSession(existing.claudeSessionId, "side_thread_standby_stale");
+            this.warmedStandbys.delete(parentSid);
           }
           const parentOffset = parent.consumedOffset;
           const { sessionId } = await forkSideThreadSession(parentSid, STANDBY_THREAD_ID);
@@ -100738,7 +101282,7 @@ var init_side_thread_manager = __esm({
         if (!parent) return false;
         return parent.consumedOffset === this.standbyParentOffsets.get(parentSid);
       }
-      armStandbyTtl(parentSid, sessionId) {
+      armStandbyTtl(parentSid, sessionId, ttlMs = STANDBY_TTL_MS) {
         const prev = this.standbyTimers.get(parentSid);
         if (prev) clearTimeout(prev);
         const timer3 = setTimeout(() => {
@@ -100748,13 +101292,41 @@ var init_side_thread_manager = __esm({
             const record = await getSessionByClaudeId2(sessionId).catch(() => null);
             if (!record || parseSideLaneKey(record.lane)?.threadId !== STANDBY_THREAD_ID) return;
             this.standbyParentOffsets.delete(parentSid);
+            this.warmedStandbys.delete(parentSid);
             await this.retireSession(sessionId, "side_thread_standby_ttl");
           }).catch(() => {
           });
-        }, STANDBY_TTL_MS);
+        }, ttlMs);
         timer3.unref?.();
         this.standbyTimers.set(parentSid, timer3);
       }
+      /**
+       * Run the standby's cache warm-up turn (see side-thread-warmup.ts). Called
+       * when the user starts TYPING a new question: the fork's first API call pays
+       * the full prefix write no matter what, so paying it while they type turns
+       * the actual question into a cached follow-up. Idempotent per standby; a
+       * missing or stale standby is a no-op (the ask path will fork fresh anyway).
+       */
+      async warmStandby(parentSid) {
+        return this.serialize(parentSid, async () => {
+          const standby = await this.findStandby(parentSid);
+          if (!standby) return { warmed: false, reason: "no_standby" };
+          if (!await this.isStandbyUsable(parentSid, standby)) return { warmed: false, reason: "stale" };
+          if (this.warmedStandbys.get(parentSid) === standby.claudeSessionId) {
+            return { warmed: true, reason: "already_warm" };
+          }
+          const { sendMessageToSession: sendMessageToSession2 } = await Promise.resolve().then(() => (init_session_message_queue(), session_message_queue_exports));
+          markWarmupTurnPending(standby.claudeSessionId);
+          await sendMessageToSession2(standby.claudeSessionId, CACHE_WARMUP_MESSAGE, { source: "side-thread-warmup" });
+          this.warmedStandbys.set(parentSid, standby.claudeSessionId);
+          this.armStandbyTtl(parentSid, standby.claudeSessionId, WARMED_STANDBY_TTL_MS);
+          log.session.info("side thread: standby cache warm-up sent", {
+            parentSid,
+            standbySid: standby.claudeSessionId
+          });
+          return { warmed: true };
+        });
+      }
       // ── Threads ────────────────────────────────────────────────────────────────
       /**
        * Open a side thread on `parentSid` and ask `question` in it.
@@ -100765,6 +101337,10 @@ var init_side_thread_manager = __esm({
        * question as its spawn's first turn instead — a send issued right after
        * SESSION_START can lose that race and cold-`--resume` an id the CLI has never
        * seen (see personal-ai-lane.ts LaneSession.created).
+       *
+       * `imageContext` (attachment paths for the CLI to Read) rides the MESSAGE only.
+       * The stored entry keeps the plain question, so the chip label, the injected
+       * transcript and a promoted task never carry the machine preamble.
        */
       async createThread(parentSid, input) {
         const question = input.question?.trim();
@@ -100772,8 +101348,11 @@ var init_side_thread_manager = __esm({
         return this.serialize(parentSid, async () => {
           const threadId = mintSideThreadId();
           const title = input.title?.trim() || void 0;
+          const message = input.imageContext ? `${input.imageContext}
+
+${question}` : question;
           const consumed = await this.consumeStandby(parentSid, threadId, title);
-          const threadSessionId = consumed ?? (await forkSideThreadSession(parentSid, threadId, { message: question, ...title ? { title } : {} })).sessionId;
+          const threadSessionId = consumed ?? (await forkSideThreadSession(parentSid, threadId, { message, ...title ? { title } : {} })).sessionId;
           let entry;
           try {
             const { addSideThread: addSideThread2 } = await Promise.resolve().then(() => (init_side_questions(), side_questions_exports));
@@ -100785,7 +101364,7 @@ var init_side_thread_manager = __esm({
             });
             if (consumed) {
               const { sendMessageToSession: sendMessageToSession2 } = await Promise.resolve().then(() => (init_session_message_queue(), session_message_queue_exports));
-              await sendMessageToSession2(threadSessionId, question, { source: "side-thread" });
+              await sendMessageToSession2(threadSessionId, message, { source: "side-thread" });
             }
           } catch (err2) {
             void this.retireSession(threadSessionId, "side_thread_create_failed");
@@ -100820,6 +101399,7 @@ var init_side_thread_manager = __esm({
         if (!await this.isStandbyUsable(parentSid, standby)) {
           void this.retireSession(standby.claudeSessionId, "side_thread_standby_stale");
           this.standbyParentOffsets.delete(parentSid);
+          this.warmedStandbys.delete(parentSid);
           return null;
         }
         const timer3 = this.standbyTimers.get(parentSid);
@@ -100828,6 +101408,7 @@ var init_side_thread_manager = __esm({
           this.standbyTimers.delete(parentSid);
         }
         this.standbyParentOffsets.delete(parentSid);
+        this.warmedStandbys.delete(parentSid);
         const lane = sideThreadLaneKey(parentSid, threadId);
         const { updateSessionRecord: updateSessionRecord2 } = await Promise.resolve().then(() => (init_session_tracker(), session_tracker_exports));
         await updateSessionRecord2(standby.claudeSessionId, {
@@ -101014,16 +101595,30 @@ async function promoteSideThread(parentSid, threadId, opts) {
   const threadRecord = await getSessionByClaudeId2(sessionId);
   if (!threadRecord) throw new SessionControlError("Side thread session not found", 404);
   const parentRecord = await getSessionByClaudeId2(parentSid);
-  const parentTaskId = parentRecord?.taskId?.trim() || void 0;
-  const title = opts?.title?.trim() || entry.title?.trim() || entry.question;
+  const siblingOfTaskId = parentRecord?.taskId?.trim() || void 0;
+  const threadLabel = opts?.title?.trim() || entry.title?.trim() || void 0;
   const { addTask: addTask2, linkSession: linkSession2, linkSessionSlot: linkSessionSlot2 } = await Promise.resolve().then(() => (init_task_manager(), task_manager_exports));
-  const { task } = await addTask2({
-    title,
-    description: entry.question,
-    ...parentTaskId ? { parent_task_id: parentTaskId } : {},
-    // A person clicked "promote" — same board default as any hand-made task.
-    pinned: true
-  });
+  let groupId;
+  let task;
+  if (siblingOfTaskId) {
+    const created = await createForkSiblingTask(siblingOfTaskId, {
+      // A known label short-circuits the background refine; without one the
+      // thread's first question is what gets summarized (same as a fork's message).
+      titlePrefix: threadLabel,
+      prompt: entry.question,
+      description: entry.question,
+      source: "side-thread-promote"
+    });
+    task = created.task;
+    groupId = created.groupId;
+  } else {
+    ({ task } = await addTask2({
+      title: threadLabel || entry.question,
+      description: entry.question,
+      // A person clicked "promote" — same board default as any hand-made task.
+      pinned: true
+    }));
+  }
   const stamped = await markThreadPromoted2(parentSid, threadId, task.id);
   if (!stamped) {
     log.session.warn("side thread promote: entry vanished before stamp \u2014 promote proceeds, 409 guard is unarmed", {
@@ -101037,7 +101632,7 @@ async function promoteSideThread(parentSid, threadId, opts) {
     project: task.project ?? "",
     // Clearing the lane un-hides the session (see the file header).
     lane: void 0,
-    title
+    title: task.title
   });
   try {
     const { sessionRunner: sessionRunner2 } = await Promise.resolve().then(() => (init_claude_code_session(), claude_code_session_exports));
@@ -101056,10 +101651,18 @@ async function promoteSideThread(parentSid, threadId, opts) {
       error: err2 instanceof Error ? err2.message : String(err2)
     });
   }
-  log.session.info("side thread: promoted to task", { parentSid, threadId, sessionId, taskId: task.id });
+  log.session.info("side thread: promoted to task", {
+    parentSid,
+    threadId,
+    sessionId,
+    taskId: task.id,
+    siblingOfTaskId,
+    groupId
+  });
   return {
     taskId: task.id,
-    ...task.parent_task_id ? { parentTaskId: task.parent_task_id } : {},
+    ...siblingOfTaskId ? { siblingOfTaskId } : {},
+    ...groupId ? { groupId } : {},
     sessionId
   };
 }
@@ -101074,7 +101677,7 @@ var init_side_thread_promote = __esm({
 
 // src/web/routes/sessions.ts
 import { Router as Router10 } from "express";
-import { randomUUID as randomUUID5 } from "crypto";
+import { randomUUID as randomUUID6 } from "crypto";
 import os19 from "os";
 import path91 from "path";
 function condenseStaleReason(msg) {
@@ -101420,7 +102023,7 @@ var init_sessions2 = __esm({
           }
           const isNativeEngine = !isAcpEngine(engine);
           const clientSessionId = typeof req.body.sessionId === "string" && UUID_RE2.test(req.body.sessionId) ? req.body.sessionId : void 0;
-          const preassignedSessionId = isNativeEngine ? clientSessionId ?? randomUUID5() : void 0;
+          const preassignedSessionId = isNativeEngine ? clientSessionId ?? randomUUID6() : void 0;
           const updatedTask = await quickStartSession({
             message: sessionMessage,
             messagePrefix,
@@ -102395,18 +102998,38 @@ var init_sessions2 = __esm({
         });
       }
     });
+    sessionsRouter.post("/:sessionId/side-threads/standby/warm", async (req, res) => {
+      if (refuseSideThreadsOnReplica(res)) return;
+      const sessionId = String(req.params.sessionId);
+      try {
+        const { sideThreadManager: sideThreadManager2 } = await Promise.resolve().then(() => (init_side_thread_manager(), side_thread_manager_exports));
+        res.json(await sideThreadManager2.warmStandby(sessionId));
+      } catch (err2) {
+        log.web.warn("side thread standby warm-up failed", {
+          sessionId,
+          error: err2 instanceof Error ? err2.message : String(err2)
+        });
+        res.json({ warmed: false, reason: "error" });
+      }
+    });
     sessionsRouter.post("/:sessionId/side-threads", async (req, res, next) => {
       if (refuseSideThreadsOnReplica(res)) return;
       try {
-        const { question, title } = req.body ?? {};
+        const { question, title, images } = req.body ?? {};
         if (!question || typeof question !== "string" || !question.trim()) {
           res.status(400).json({ error: "question (non-empty string) is required" });
           return;
         }
+        let imageContext = "";
+        if (images && images.length > 0) {
+          const processed = await processAndSaveImages(images);
+          if (processed) imageContext = buildSessionImageContext(processed.savedImages);
+        }
         const { sideThreadManager: sideThreadManager2 } = await Promise.resolve().then(() => (init_side_thread_manager(), side_thread_manager_exports));
         const thread = await sideThreadManager2.createThread(String(req.params.sessionId), {
           question,
-          ...typeof title === "string" && title.trim() ? { title } : {}
+          ...typeof title === "string" && title.trim() ? { title } : {},
+          ...imageContext ? { imageContext } : {}
         });
         res.json({ thread });
       } catch (err2) {
@@ -102425,7 +103048,8 @@ var init_sessions2 = __esm({
         );
         res.json({
           taskId: result.taskId,
-          ...result.parentTaskId ? { parentTaskId: result.parentTaskId } : {},
+          ...result.siblingOfTaskId ? { siblingOfTaskId: result.siblingOfTaskId } : {},
+          ...result.groupId ? { groupId: result.groupId } : {},
           sessionId: result.sessionId
         });
       } catch (err2) {
@@ -102616,6 +103240,19 @@ var init_sessions2 = __esm({
         next(err2);
       }
     });
+    sessionsRouter.post("/:sessionId/recheck", async (req, res, next) => {
+      try {
+        const sessionId = req.params.sessionId;
+        const result = await recheckSession(sessionId);
+        res.json(result);
+      } catch (err2) {
+        if (err2 instanceof SessionControlError) {
+          res.status(err2.statusCode).json({ error: err2.message });
+          return;
+        }
+        next(err2);
+      }
+    });
     sessionsRouter.post("/:sessionId/restart", async (req, res, next) => {
       const sessionId = req.params.sessionId;
       const startedAt = Date.now();
@@ -103107,7 +103744,7 @@ var micro_claude_exports = {};
 __export(micro_claude_exports, {
   runMicroClaude: () => runMicroClaude
 });
-import { randomUUID as randomUUID6 } from "crypto";
+import { randomUUID as randomUUID7 } from "crypto";
 async function runMicroClaude(opts) {
   if (opts.warm) {
     const run10 = await runWarmMicroClaude({
@@ -103116,7 +103753,7 @@ async function runMicroClaude(opts) {
       tools: opts.tools ?? [],
       prompt: opts.prompt,
       timeoutMs: opts.timeoutMs ?? DEFAULT_TIMEOUT_MS2,
-      toolUseId: opts.toolUseId ?? `micro-claude-${randomUUID6()}`,
+      toolUseId: opts.toolUseId ?? `micro-claude-${randomUUID7()}`,
       ...opts.onBlock ? { onBlock: opts.onBlock } : {}
     });
     return { response: run10.response, costUsd: run10.costUsd, durationMs: run10.durationMs };
@@ -103126,7 +103763,7 @@ async function runMicroClaude(opts) {
     systemPrompt: opts.system,
     model: opts.model ?? DEFAULT_MODEL2,
     timeoutMs: opts.timeoutMs ?? DEFAULT_TIMEOUT_MS2,
-    toolUseId: opts.toolUseId ?? `micro-claude-${randomUUID6()}`,
+    toolUseId: opts.toolUseId ?? `micro-claude-${randomUUID7()}`,
     slim: true,
     thinking: opts.thinking ?? false,
     ...opts.tools && opts.tools.length > 0 ? { tools: opts.tools } : {},
@@ -103951,7 +104588,7 @@ __export(micro_agent_exports, {
 async function resolveTierModel(tier) {
   const { getConfig: getConfig2 } = await Promise.resolve().then(() => (init_config_manager(), config_manager_exports));
   const config = await getConfig2();
-  const provider = config.agent?.main_provider ?? "bedrock";
+  const provider = resolveMainProviderName(config);
   const { MODEL_CATALOG: MODEL_CATALOG3 } = await Promise.resolve().then(() => (init_model_catalog(), model_catalog_exports));
   const entry = MODEL_CATALOG3[provider]?.find((m6) => {
     const id = m6.id.toLowerCase();
@@ -104020,6 +104657,7 @@ var DEFAULT_TIER, DEFAULT_MAX_TOKENS2, DEFAULT_MAX_ROUNDS, DEFAULT_TIMEOUT_MS3;
 var init_micro_agent = __esm({
   "src/agent/micro-agent.ts"() {
     "use strict";
+    init_default_provider();
     DEFAULT_TIER = "sonnet";
     DEFAULT_MAX_TOKENS2 = 2e3;
     DEFAULT_MAX_ROUNDS = 3;
@@ -104035,7 +104673,7 @@ __export(task_search_agent_exports, {
   prewarmAgentSearchChild: () => prewarmAgentSearchChild,
   runTaskSearchAgent: () => runTaskSearchAgent
 });
-import { randomUUID as randomUUID7 } from "crypto";
+import { randomUUID as randomUUID8 } from "crypto";
 function useCliEngine() {
   return process.env.WALNUT_AGENT_SEARCH_ENGINE !== "inprocess";
 }
@@ -104115,7 +104753,7 @@ async function claudeCliEngine(userPrompt, options) {
     model: options.model,
     timeoutMs: options.timeoutMs,
     tools: ["Bash"],
-    toolUseId: `task-search-${randomUUID7()}`,
+    toolUseId: `task-search-${randomUUID8()}`,
     warm: true,
     onBlock
   });
@@ -105319,9 +105957,13 @@ var init_credential_verify = __esm({
 var config_exports = {};
 __export(config_exports, {
   buildProvidersPayload: () => buildProvidersPayload,
-  configRouter: () => configRouter
+  configRouter: () => configRouter,
+  setStaticRootReporter: () => setStaticRootReporter
 });
 import { Router as Router14 } from "express";
+function setStaticRootReporter(fn) {
+  staticRootReporter = fn;
+}
 async function fetchOllamaModels(baseUrl) {
   if (Date.now() - _ollamaCache.ts < OLLAMA_CACHE_TTL) return _ollamaCache.models;
   const url = (baseUrl ?? DEFAULT_BASE_URLS["ollama"] ?? "http://localhost:11434") + "/api/tags";
@@ -105374,10 +106016,11 @@ async function buildProvidersPayload() {
       providers[name] = {
         api: prov.api,
         base_url: prov.base_url,
-        status: caps.subscriptionReady ? "ready" : "no_key",
+        status: caps.installed ? "ready" : "no_key",
         auto_detected: !explicitNames.has(name),
         models: getModelsForProvider(name, prov.models),
-        credential_source: caps.subscriptionReady ? "subscription" : caps.installed ? "cli_no_subscription" : "cli_not_installed"
+        credential_source: caps.installed ? `cli_${caps.auth.mode}` : "cli_not_installed",
+        credential_detail: caps.installed ? caps.auth.label : void 0
       };
       continue;
     }
@@ -105436,10 +106079,11 @@ async function buildProvidersPayload() {
         const caps = detectClaudeCli2();
         providers[name] = {
           api: template.api,
-          status: caps.subscriptionReady ? "ready" : "no_key",
+          status: caps.installed ? "ready" : "no_key",
           auto_detected: false,
           models: getModelsForProvider(name),
-          credential_source: caps.subscriptionReady ? "subscription" : caps.installed ? "cli_no_subscription" : "cli_not_installed"
+          credential_source: caps.installed ? `cli_${caps.auth.mode}` : "cli_not_installed",
+          credential_detail: caps.installed ? caps.auth.label : void 0
         };
         continue;
       }
@@ -105454,7 +106098,7 @@ async function buildProvidersPayload() {
   }
   return { providers };
 }
-var configRouter, _ollamaCache, OLLAMA_CACHE_TTL;
+var configRouter, staticRootReporter, _ollamaCache, OLLAMA_CACHE_TTL;
 var init_config11 = __esm({
   "src/web/routes/config.ts"() {
     "use strict";
@@ -105469,6 +106113,7 @@ var init_config11 = __esm({
     init_defaults();
     init_config_redact();
     configRouter = Router14();
+    staticRootReporter = null;
     configRouter.get("/", async (_req, res, next) => {
       try {
         const config = await getConfig();
@@ -105495,7 +106140,8 @@ var init_config11 = __esm({
           remoteIdUniquenessGaps = getExtIndexUniquenessGaps2();
         } catch {
         }
-        res.json({ config: CLOUD_MODE ? redactConfig(config) : config, envTokenHint, installDir: CLOUD_MODE ? null : WALNUT_INSTALL_DIR, notesDir: CLOUD_MODE ? null : NOTES_DIR, processNice, memory, canRevealLocalFiles, remoteIdUniquenessGaps, cloud: CLOUD_MODE });
+        const webAssets = staticRootReporter?.() ?? null;
+        res.json({ config: CLOUD_MODE ? redactConfig(config) : config, envTokenHint, installDir: CLOUD_MODE ? null : WALNUT_INSTALL_DIR, notesDir: CLOUD_MODE ? null : NOTES_DIR, processNice, memory, canRevealLocalFiles, remoteIdUniquenessGaps, cloud: CLOUD_MODE, webAssets });
       } catch (err2) {
         next(err2);
       }
@@ -105593,7 +106239,7 @@ var init_config11 = __esm({
         const {
           traceCredentialResolution: traceCredentialResolution2,
           resolveCredentials: resolveCredentials2,
-          readClaudeSettingsEnv: readClaudeSettingsEnv2,
+          readClaudeSettingsEnv: readClaudeSettingsEnv3,
           readClaudeCredentialExport: readClaudeCredentialExport2
         } = await Promise.resolve().then(() => (init_credential_resolver(), credential_resolver_exports));
         const fs121 = await import("fs");
@@ -105609,7 +106255,7 @@ var init_config11 = __esm({
         };
         const trace = traceCredentialResolution2({
           config,
-          claudeEnv: readClaudeSettingsEnv2(),
+          claudeEnv: readClaudeSettingsEnv3(),
           processEnv: process.env,
           awsFiles: {
             credentials: exists3(path193.join(home, ".aws", "credentials")),
@@ -110364,6 +111010,9 @@ var init_session_chat = __esm({
 
 // src/web/routes/browser-logs.ts
 import { Router as Router25 } from "express";
+function entrySubsystem(entry) {
+  return entry.subsystem && ENTRY_SUBSYSTEMS.has(entry.subsystem) ? entry.subsystem : "browser";
+}
 function checkRate(client, entryCount) {
   const now = Date.now();
   let state9 = clientRates.get(client);
@@ -110405,10 +111054,11 @@ function writeEntries(entries) {
     if (entry.args) meta.args = truncate(entry.args, 1e3);
     if (entry.url) meta.url = entry.url;
     if (entry.count && entry.count > 1) meta.count = entry.count;
+    if (entry.client === "mac-app") meta.client = entry.client;
     writeLogEntry({
       time: entry.time,
       level: mapLevel(entry.level),
-      subsystem: "browser",
+      subsystem: entrySubsystem(entry),
       message: truncate(entry.message, 2e3),
       browserLevel: entry.level,
       // preserve original level (e.g. 'log' vs 'info')
@@ -110431,13 +111081,14 @@ function registerBrowserLogsRpc() {
     writeEntries(entries);
   });
 }
-var RATE_WINDOW_MS, RATE_LIMIT, clientRates, REST_MAX_ENTRIES, browserLogsRouter;
+var ENTRY_SUBSYSTEMS, RATE_WINDOW_MS, RATE_LIMIT, clientRates, REST_MAX_ENTRIES, browserLogsRouter;
 var init_browser_logs = __esm({
   "src/web/routes/browser-logs.ts"() {
     "use strict";
     init_handler();
     init_logging();
     init_logger();
+    ENTRY_SUBSYSTEMS = /* @__PURE__ */ new Set(["browser", "desktop"]);
     RATE_WINDOW_MS = 1e4;
     RATE_LIMIT = 500;
     clientRates = /* @__PURE__ */ new WeakMap();
@@ -118518,6 +119169,7 @@ var init_session_health_monitor = __esm({
           log.session.info("health monitor: drained orphan dead-pool", { orphanCount: orphanIds.length, written: written.length });
         }
         if (sessions3.length === 0) {
+          if (!ctx.overBudget()) await this.checkSnapshotPull(sessions3, ctx, allSessions);
           const total = Date.now() - checkT0;
           if (total > 500) log.session.warn("health monitor: check() slow (no active sessions)", { totalMs: total, orphanMs: tOrphan - checkT0, recoverMs: tRecover - tOrphan });
           return;
@@ -118547,7 +119199,7 @@ var init_session_health_monitor = __esm({
         await this.reconcilePendingBackgroundTasks(sessions3);
         endPhase("pendingBgTasks");
         if (ctx.overBudget()) return;
-        await this.checkSnapshotPull(sessions3, ctx);
+        await this.checkSnapshotPull(sessions3, ctx, allSessions);
         endPhase("snapshotPull");
         if (ctx.overBudget()) return;
         const reconciledIds = await this.reconcileStuckRunningSessions(sessions3, taskMap);
@@ -119041,15 +119693,39 @@ var init_session_health_monitor = __esm({
         bus.emit(EventNames.SESSION_WILL_REAP, payload, ["*"], { source: "health-monitor" });
       }
       /**
-       * C2 snapshot pull channel (contract §5): every 30s tick, for records in
-       * {running, idle} on a native (non-codex, non-embedded/sdk) engine whose
-       * host has a POOLED CONNECTED DaemonConnection advertising 'snapshot-v1',
-       * PULL getState and feed the snapshot to applySnapshot. NEVER dials a new
-       * connection. Sequential, capped at 10 sids/tick, per-sid 25s spacing.
+       * C2 snapshot pull channel (contract §5): every 30s tick, PULL getState from
+       * the host's POOLED CONNECTED DaemonConnection advertising 'snapshot-v1' and
+       * feed the answer to applySnapshot. NEVER dials a new connection, always
+       * sequential. TWO candidate classes with SEPARATE budgets and cadences:
+       *
+       *  - LIVE — {running, idle}: 10 sids/tick, 25s per-sid spacing. The steady
+       *    state channel.
+       *  - RE-EXAMINATION — {error, stopped} whose cause is NOT positively terminal
+       *    (classifySessionError) and whose last_status_change is inside
+       *    RESCUABLE_STOPPED_WINDOW_MS: 5 sids/tick, 5 min per-sid spacing. Same
+       *    engine/provider/awaiting_spawn/archived exclusions as the live class.
+       *
+       * WHY RE-EXAMINATION EXISTS — do not "optimize" the error class back out. A
+       * wrongly-'error' record was a two-sided deadlock: this lane is the ONE writer
+       * the enforce-mode gate sanctions for a snapshot-covered session, and while it
+       * looked at live records only it never re-derived status for an 'error' one.
+       * recoverInfraFailedSessions DOES look, but the fix it writes
+       * (('health-monitor','auto_recovered_dead')) is itself category-①, so the gate
+       * drops the whole patch — the lane allowed to write refused to look, and the
+       * lane that looked was not allowed to write. Records froze in 'error' with
+       * "Connection lost — unable to reach remote host" for hours after their host
+       * came back (2026-09-03, a remote dev host whose tunnel flapped: prose still on
+       * the record 2h after the reconnect), burning a 30s log-churn loop the whole
+       * time. Terminality is decided STRUCTURALLY, never by matching errorMessage
+       * prose — see the header of session-error-kind.ts for why that ban exists.
        *
-       * TWO fairness/budget properties this loop must keep (C8/C9/C12/C29):
+       * Re-examination candidates come from a WIDER pool than the live ones: the
+       * tick's own working set drops every 'error' row (isTerminalSession), so the
+       * caller passes the unfiltered health-scan set for this class only.
        *
-       *  - It honors the TickContext budget INSIDE the loop (same discipline as
+       * THREE fairness/budget properties both classes must keep (C8/C9/C12/C29):
+       *
+       *  - The TickContext budget is honored INSIDE the loop (same discipline as
        *    checkHungSessions). Each iteration is a real daemon RPC with a
        *    probe-timeout ceiling, so 10 slow hosts could burn 10 × the probe
        *    timeout sequentially BEFORE the authoritative reconcile phases that run
@@ -119058,70 +119734,101 @@ var init_session_health_monitor = __esm({
        *    next tick (see the rotation below).
        *
        *  - Candidates are ordered by lastPullAt ASCENDING (never-pulled first),
-       *    which turns the 10/tick cap into a round-robin. In list order the SAME
-       *    first ten sids were pulled every tick and — because the 25s spacing is
-       *    shorter than the 30s cadence — sids 11+ were never pulled at all: the
-       *    pull channel silently did not exist for them.
+       *    which turns each cap into a round-robin. In list order the SAME first ten
+       *    sids were pulled every tick and — because the 25s spacing is shorter than
+       *    the 30s cadence — sids 11+ were never pulled at all: the pull channel
+       *    silently did not exist for them. Each class rotates on its OWN timestamps.
+       *
+       *  - The classes cannot spend each other's budget. Re-examination is
+       *    speculative ("is this record still true?") and a settled-death cohort
+       *    dwarfs the live set (the live DB measured 100 stopped candidates against
+       *    4 error rows), so it must cost a handful of cheap RPCs per tick and
+       *    nothing more — the same reasoning as MAX_STOPPED_PROBES_PER_TICK below.
        */
       snapshotPullAt = /* @__PURE__ */ new Map();
-      async checkSnapshotPull(sessions3, ctx) {
+      /** Separate from snapshotPullAt on purpose: the two classes rotate
+       *  independently, so a live pull can never reset the slow re-examination
+       *  cadence (or vice versa) when a record moves between them. */
+      snapshotReexamPullAt = /* @__PURE__ */ new Map();
+      async checkSnapshotPull(sessions3, ctx, reexamPool = sessions3) {
         const PULL_MIN_GAP_MS = 25e3;
         const MAX_PULLS_PER_TICK = 10;
+        const REEXAM_MIN_GAP_MS = 5 * 6e4;
+        const MAX_REEXAM_PULLS_PER_TICK = 5;
         try {
           const { getSnapshotStatusMode: getSnapshotStatusMode2 } = await Promise.resolve().then(() => (init_session_snapshot_gate(), session_snapshot_gate_exports));
           if (getSnapshotStatusMode2() === "off") return;
           const { getPooledSnapshotConnection: getPooledSnapshotConnection2 } = await Promise.resolve().then(() => (init_daemon_connection(), daemon_connection_exports));
           const { applySnapshot: applySnapshot2 } = await Promise.resolve().then(() => (init_session_snapshot_apply(), session_snapshot_apply_exports));
           const now = Date.now();
-          const candidates = sessions3.filter((s4) => {
-            if (s4.process_status !== "running" && s4.process_status !== "idle") return false;
+          const pullable = (s4) => {
+            if (s4.archived) return false;
             if (!engineCaps(s4.engine).snapshotPull) return false;
             if (s4.provider === "embedded" || s4.provider === "sdk") return false;
-            if (s4.status_reason === "awaiting_spawn") return false;
-            const lastPull = this.snapshotPullAt.get(s4.claudeSessionId) ?? 0;
-            return now - lastPull >= PULL_MIN_GAP_MS;
-          }).sort((a8, b8) => (this.snapshotPullAt.get(a8.claudeSessionId) ?? 0) - (this.snapshotPullAt.get(b8.claudeSessionId) ?? 0));
-          let pulled = 0;
-          let capped = false;
-          for (const s4 of candidates) {
-            if (ctx?.overBudget()) {
-              log.session.warn("health monitor: checkSnapshotPull abandoned mid-loop (over budget)", {
-                pulled,
-                candidateCount: candidates.length
-              });
-              break;
-            }
-            const conn = getPooledSnapshotConnection2(s4.host);
-            if (!conn) continue;
-            if (pulled >= MAX_PULLS_PER_TICK) {
-              capped = true;
-              break;
-            }
-            pulled++;
-            this.snapshotPullAt.set(s4.claudeSessionId, now);
-            try {
-              const resp = await probeWithTimeout(
-                conn.send("getState", { sid: s4.claudeSessionId }),
-                null,
-                "snapshot-pull-getState",
-                s4.claudeSessionId
-              );
-              const snapshot2 = resp?.ok ? resp.snapshot : void 0;
-              if (snapshot2) await applySnapshot2(s4.claudeSessionId, snapshot2, "pull-30s");
-            } catch (err2) {
-              log.session.debug("health monitor: snapshot pull failed", {
-                sessionId: s4.claudeSessionId,
-                host: s4.host ?? "__local__",
-                error: err2 instanceof Error ? err2.message : String(err2)
-              });
+            return s4.status_reason !== "awaiting_spawn";
+          };
+          const byPullAge = (at) => (a8, b8) => (at.get(a8.claudeSessionId) ?? 0) - (at.get(b8.claudeSessionId) ?? 0);
+          const live = sessions3.filter((s4) => {
+            if (s4.process_status !== "running" && s4.process_status !== "idle") return false;
+            if (!pullable(s4)) return false;
+            return now - (this.snapshotPullAt.get(s4.claudeSessionId) ?? 0) >= PULL_MIN_GAP_MS;
+          }).sort(byPullAge(this.snapshotPullAt));
+          const reexam = reexamPool.filter((s4) => {
+            if (s4.process_status !== "error" && s4.process_status !== "stopped") return false;
+            if (!pullable(s4)) return false;
+            if (classifySessionError(s4) === "terminal") return false;
+            const changedAt = s4.last_status_change ? Date.parse(s4.last_status_change) : NaN;
+            if (!Number.isFinite(changedAt)) return false;
+            if (now - changedAt > RESCUABLE_STOPPED_WINDOW_MS) return false;
+            return now - (this.snapshotReexamPullAt.get(s4.claudeSessionId) ?? 0) >= REEXAM_MIN_GAP_MS;
+          }).sort(byPullAge(this.snapshotReexamPullAt));
+          let abandoned = false;
+          const runClass = async (candidates, cap2, at, candidateClass) => {
+            let pulled = 0;
+            for (const s4 of candidates) {
+              if (ctx?.overBudget()) {
+                abandoned = true;
+                log.session.warn("health monitor: checkSnapshotPull abandoned mid-loop (over budget)", {
+                  pulled,
+                  candidateCount: candidates.length,
+                  candidateClass
+                });
+                break;
+              }
+              const conn = getPooledSnapshotConnection2(s4.host);
+              if (!conn) continue;
+              if (pulled >= cap2) {
+                log.session.info("health monitor: snapshot pull capped this tick", {
+                  cap: cap2,
+                  sessionCount: sessions3.length,
+                  candidateCount: candidates.length,
+                  candidateClass
+                });
+                break;
+              }
+              pulled++;
+              at.set(s4.claudeSessionId, now);
+              try {
+                const resp = await probeWithTimeout(
+                  conn.send("getState", { sid: s4.claudeSessionId }),
+                  null,
+                  "snapshot-pull-getState",
+                  s4.claudeSessionId
+                );
+                const snapshot2 = resp?.ok ? resp.snapshot : void 0;
+                if (snapshot2) await applySnapshot2(s4.claudeSessionId, snapshot2, "pull-30s");
+              } catch (err2) {
+                log.session.debug("health monitor: snapshot pull failed", {
+                  sessionId: s4.claudeSessionId,
+                  host: s4.host ?? "__local__",
+                  error: err2 instanceof Error ? err2.message : String(err2)
+                });
+              }
             }
-          }
-          if (capped) {
-            log.session.info("health monitor: snapshot pull capped this tick", {
-              cap: MAX_PULLS_PER_TICK,
-              sessionCount: sessions3.length,
-              candidateCount: candidates.length
-            });
+          };
+          await runClass(live, MAX_PULLS_PER_TICK, this.snapshotPullAt, "live");
+          if (!abandoned) {
+            await runClass(reexam, MAX_REEXAM_PULLS_PER_TICK, this.snapshotReexamPullAt, "reexam");
           }
           if (this.snapshotPullAt.size > 200) {
             const liveIds = new Set(sessions3.map((s4) => s4.claudeSessionId));
@@ -119129,6 +119836,12 @@ var init_session_health_monitor = __esm({
               if (!liveIds.has(sid)) this.snapshotPullAt.delete(sid);
             }
           }
+          if (this.snapshotReexamPullAt.size > 200) {
+            const poolIds = new Set(reexamPool.map((s4) => s4.claudeSessionId));
+            for (const sid of this.snapshotReexamPullAt.keys()) {
+              if (!poolIds.has(sid)) this.snapshotReexamPullAt.delete(sid);
+            }
+          }
         } catch (err2) {
           log.session.warn("health monitor: checkSnapshotPull failed", {
             error: err2 instanceof Error ? err2.message : String(err2)
@@ -119291,6 +120004,31 @@ var init_session_health_monitor = __esm({
           });
         }
       }
+      /**
+       * Can a scheduled auto-recovery actually FIRE for this record?
+       *
+       * fire() (session-auto-recover) hard-requires the linked task to still be
+       * IN_PROGRESS — AGENT_COMPLETE means the work was already handed back and
+       * resuming would talk over the human. Arming a recovery that cannot pass that
+       * check is not free: the 30s tick re-armed it forever and each arming logged
+       * an abort 20s later (measured running for 2+ hours on one session), while
+       * `if (armed) continue` also skipped the phase sync that IS appropriate there.
+       *
+       * A lookup that cannot answer (no task id, deleted task, DB error) returns
+       * true: only a KNOWN non-IN_PROGRESS phase blocks arming, so a transient read
+       * failure can never disable recovery. schedule()'s own guards still apply.
+       */
+      async autoRecoverCanFire(s4) {
+        if (!s4.taskId) return true;
+        try {
+          const { getTask: getTask2 } = await Promise.resolve().then(() => (init_task_manager(), task_manager_exports));
+          const task = await getTask2(s4.taskId);
+          if (!task) return true;
+          return task.phase === "IN_PROGRESS";
+        } catch {
+          return true;
+        }
+      }
       /**
        * Auto-recover remote sessions stuck in 'error' with "Connection lost" message.
        *
@@ -119377,28 +120115,31 @@ var init_session_health_monitor = __esm({
                 } else if (wasStopped) {
                   continue;
                 } else {
-                  const updated = await updateSessionRecord2(s4.claudeSessionId, {
-                    process_status: "stopped",
-                    errorMessage: void 0,
-                    errorKind: "infra",
-                    activity: void 0,
-                    last_status_change: now,
-                    status_reason: "auto_recovered_dead",
-                    status_changed_by: "health-monitor"
-                  });
-                  emitSessionStatusChanged(
-                    updated,
-                    {},
-                    ["*"],
-                    { source: "health-monitor", urgency: "urgent" }
-                  );
-                  log.session.info("health monitor: auto-recovered connection-lost session (process dead)", {
-                    sessionId: s4.claudeSessionId,
-                    host: s4.host,
-                    alive: false
-                  });
+                  const { isSnapshotCovered: isSnapshotCovered2 } = await Promise.resolve().then(() => (init_session_snapshot_gate(), session_snapshot_gate_exports));
+                  if (!isSnapshotCovered2(s4.claudeSessionId)) {
+                    const updated = await updateSessionRecord2(s4.claudeSessionId, {
+                      process_status: "stopped",
+                      errorMessage: void 0,
+                      errorKind: "infra",
+                      activity: void 0,
+                      last_status_change: now,
+                      status_reason: "auto_recovered_dead",
+                      status_changed_by: "health-monitor"
+                    });
+                    emitSessionStatusChanged(
+                      updated,
+                      {},
+                      ["*"],
+                      { source: "health-monitor", urgency: "urgent" }
+                    );
+                    log.session.info("health monitor: auto-recovered connection-lost session (process dead)", {
+                      sessionId: s4.claudeSessionId,
+                      host: s4.host,
+                      alive: false
+                    });
+                  }
                   const { scheduleSessionAutoRecover: scheduleSessionAutoRecover2 } = await Promise.resolve().then(() => (init_session_auto_recover(), session_auto_recover_exports));
-                  const armed = scheduleSessionAutoRecover2(s4, s4.status_reason ?? "daemon_reported_exit");
+                  const armed = await this.autoRecoverCanFire(s4) && scheduleSessionAutoRecover2(s4, s4.status_reason ?? "daemon_reported_exit");
                   if (armed) continue;
                   if (s4.taskId) {
                     try {
@@ -132723,6 +133464,20 @@ var init_session_lifecycle_v1 = __esm({
         next(err2);
       }
     });
+    sessionLifecycleV1Router.post("/sessions/:id/recheck", async (req, res, next) => {
+      try {
+        const sessionId = validSid2(req, res);
+        if (!sessionId) return;
+        if (CLOUD_MODE) {
+          await relayControlAction(res, "recheck", sessionId, void 0, 200);
+          return;
+        }
+        const { recheckSession: recheckSession2 } = await Promise.resolve().then(() => (init_session_lifecycle(), session_lifecycle_exports));
+        await runLocal(res, next, 200, () => recheckSession2(sessionId));
+      } catch (err2) {
+        next(err2);
+      }
+    });
     sessionLifecycleV1Router.post("/sessions/:id/permission", async (req, res, next) => {
       try {
         const sessionId = validSid2(req, res);
@@ -132935,7 +133690,7 @@ __export(session_requests_exports, {
   settleNotified: () => settleNotified,
   settleReplied: () => settleReplied
 });
-import { createHash as createHash18, randomUUID as randomUUID8 } from "crypto";
+import { createHash as createHash18, randomUUID as randomUUID9 } from "crypto";
 import path137 from "path";
 function oneLine(text, max = 160) {
   const flat = text.replace(/\s+/g, " ").trim();
@@ -132959,7 +133714,7 @@ function clampReplyTimeoutSecs(secs) {
 }
 async function createSessionRequest(input) {
   const request3 = {
-    id: `rq-${randomUUID8().replace(/-/g, "").slice(0, 12)}`,
+    id: `rq-${randomUUID9().replace(/-/g, "").slice(0, 12)}`,
     fromSessionId: input.fromSessionId,
     ...input.toSessionId ? { toSessionId: input.toSessionId } : {},
     ...input.toTaskId ? { toTaskId: input.toTaskId } : {},
@@ -133392,7 +134147,7 @@ __export(task_start_exports, {
   SessionExistsError: () => SessionExistsError,
   startSessionForTask: () => startSessionForTask
 });
-import { randomUUID as randomUUID9 } from "crypto";
+import { randomUUID as randomUUID10 } from "crypto";
 async function startSessionForTask(params) {
   const { taskIdPrefix, source } = params;
   let task;
@@ -133443,7 +134198,7 @@ async function startSessionForTask(params) {
   }
   let message = params.message?.trim() || `Working on task: ${task.title}`;
   const engine = normalizeEngine(params.engine);
-  const preassignedSessionId = engineCaps(engine).idProvisioning === "provider-issued" ? void 0 : randomUUID9();
+  const preassignedSessionId = engineCaps(engine).idProvisioning === "provider-issued" ? void 0 : randomUUID10();
   let requestId;
   if (params.expectReply) {
     const { resolveCaller: resolveCaller2 } = await Promise.resolve().then(() => (init_session_send_core(), session_send_core_exports));
@@ -148941,7 +149696,7 @@ async function generateLedgerDesc(task, timeoutMs = 15e3) {
   try {
     const { getConfig: getConfig2 } = await Promise.resolve().then(() => (init_config_manager(), config_manager_exports));
     const config = await getConfig2();
-    const providerName = config.agent?.main_provider ?? "bedrock";
+    const providerName = resolveMainProviderName(config);
     const model = cheapModelFor(providerName);
     const detail = (task.description ?? "").trim().slice(0, 800);
     const project = (task.project ?? "").trim();
@@ -149000,6 +149755,7 @@ var init_task_ledger_desc = __esm({
     "use strict";
     init_model();
     init_model_catalog();
+    init_default_provider();
     init_logging();
     init_task_manager();
     MAX_DESC_LEN = 120;
@@ -149023,6 +149779,10 @@ function diffStreamedVsPersisted(streamedTextMsgIds, persistedMsgIds) {
 }
 function armStreamConvergenceCheck(sessionId, streamedTextMsgIds) {
   if (streamedTextMsgIds.length === 0) return;
+  if (consumeWarmupTurn(sessionId)) {
+    log.obs.debug("stream-convergence: skipped hidden warm-up turn", { sessionId });
+    return;
+  }
   const timer3 = setTimeout(() => {
     void runCheck(sessionId, streamedTextMsgIds).catch((err2) => {
       log.obs.warn("stream-convergence check failed", {
@@ -149088,6 +149848,7 @@ var init_stream_convergence = __esm({
   "src/core/observability/stream-convergence.ts"() {
     "use strict";
     init_logging();
+    init_side_thread_warmup();
     CHECK_DELAY_MS = 15e3;
     INCIDENT_DEDUPE_MS = 30 * 6e4;
     lastIncidentAt = /* @__PURE__ */ new Map();
@@ -149338,12 +150099,17 @@ function getSystemHealth() {
 }
 async function refreshSystemHealth() {
   systemHealth.claudeCliAvailable = checkClaudeCliAvailable();
-  const cred = await resolveCredentialHealth();
+  applyCredentialHealth(await resolveCredentialHealth());
+  broadcastEvent("system:health", systemHealth);
+  return systemHealth;
+}
+function applyCredentialHealth(cred) {
   systemHealth.hasReadyProvider = cred.hasReadyProvider;
   systemHealth.credentialSource = cred.source;
   systemHealth.credentialDetail = cred.detail;
-  broadcastEvent("system:health", systemHealth);
-  return systemHealth;
+  systemHealth.mainProvider = cred.mainProvider;
+  systemHealth.mainProviderImplicit = cred.mainProviderImplicit;
+  systemHealth.claudeCliAuth = cred.claudeCliAuth;
 }
 function checkClaudeCliAvailable() {
   return isClaudeCliInstalled();
@@ -149353,31 +150119,50 @@ async function resolveCredentialHealth() {
     const { getConfig: getConfig2 } = await Promise.resolve().then(() => (init_config_manager(), config_manager_exports));
     const { resolveCredentials: resolveCredentials2 } = await Promise.resolve().then(() => (init_credential_resolver(), credential_resolver_exports));
     const { buildProviderMap: buildProviderMap2 } = await Promise.resolve().then(() => (init_registry2(), registry_exports));
+    const { resolveMainProviderName: resolveMainProviderName2, mainProviderIsImplicit: mainProviderIsImplicit2 } = await Promise.resolve().then(() => (init_default_provider(), default_provider_exports));
+    const { detectClaudeCli: detectClaudeCli2 } = await Promise.resolve().then(() => (init_claude_cli_detect(), claude_cli_detect_exports));
     const config = await getConfig2();
+    const cli = detectClaudeCli2();
+    const mainProvider = resolveMainProviderName2(config, cli.installed);
+    const base = {
+      mainProvider,
+      mainProviderImplicit: mainProviderIsImplicit2(config),
+      claudeCliAuth: cli.installed ? cli.auth.label : void 0
+    };
+    if (mainProvider === "claude_cli") {
+      return cli.installed ? { ...base, hasReadyProvider: true, source: "config", detail: `claude-cli (${cli.auth.label})` } : { ...base, hasReadyProvider: false, source: "none" };
+    }
     const cred = resolveCredentials2(config);
     if (cred.source !== "none") {
-      return { hasReadyProvider: true, source: cred.source, detail: cred.detail };
+      return { ...base, hasReadyProvider: true, source: cred.source, detail: cred.detail };
     }
     const providers = buildProviderMap2(config.providers, config);
     for (const [, prov] of Object.entries(providers)) {
       if (prov.api === "bedrock" || prov.api === "ollama") continue;
       if (prov.api === "claude-cli") {
-        const { detectClaudeCli: detectClaudeCli2 } = await Promise.resolve().then(() => (init_claude_cli_detect(), claude_cli_detect_exports));
-        if (detectClaudeCli2().subscriptionReady) {
-          return { hasReadyProvider: true, source: "config", detail: "claude-cli (subscription)" };
-        }
+        if (cli.installed) return { ...base, hasReadyProvider: true, source: "config", detail: `claude-cli (${cli.auth.label})` };
         continue;
       }
       const implemented = prov.api === "anthropic-messages" || prov.api === "openai-chat" || prov.api === "google-generative-ai";
       if (implemented && (prov.api_key || prov.bearer_token)) {
-        return { hasReadyProvider: true, source: "config", detail: prov.api };
+        return { ...base, hasReadyProvider: true, source: "config", detail: prov.api };
       }
     }
-    return { hasReadyProvider: false, source: "none" };
+    return { ...base, hasReadyProvider: false, source: "none" };
   } catch {
     return { hasReadyProvider: false, source: "none" };
   }
 }
+async function isWalnutAnsweringOn(port) {
+  try {
+    const res = await fetch(`http://127.0.0.1:${port}/api/system/health`, { signal: AbortSignal.timeout(1500) });
+    if (!res.ok) return false;
+    const body3 = await res.json();
+    return !!body3 && typeof body3 === "object" && "hasReadyProvider" in body3;
+  } catch {
+    return false;
+  }
+}
 async function startServer(options = {}) {
   if (httpServer) throw new Error("Server already running. Call stopServer() first.");
   bootCompleted = false;
@@ -149402,11 +150187,11 @@ async function startServer(options = {}) {
   }
   {
     const cred = await resolveCredentialHealth();
-    systemHealth.hasReadyProvider = cred.hasReadyProvider;
-    systemHealth.credentialSource = cred.source;
-    systemHealth.credentialDetail = cred.detail;
+    applyCredentialHealth(cred);
     if (!systemHealth.hasReadyProvider) {
       log.web.warn("No AI provider configured \u2014 configure one in Settings");
+    } else if (cred.mainProvider === "claude_cli") {
+      log.web.info("AI provider: Claude Code", { auth: cred.claudeCliAuth, implicit: cred.mainProviderImplicit });
     } else if (cred.source && cred.source !== "config") {
       log.web.info("Auto-detected Bedrock credential", { source: cred.source, detail: cred.detail });
     }
@@ -149904,6 +150689,7 @@ async function startServer(options = {}) {
   });
   if (!dev) {
     const staticDir = (() => {
+      if (process.env.WALNUT_WEB_STATIC_DIR) return process.env.WALNUT_WEB_STATIC_DIR;
       let dir2 = path157.dirname(fileURLToPath13(import.meta.url));
       for (let i8 = 0; i8 < 5; i8++) {
         const candidate = path157.join(dir2, "web", "static", "index.html");
@@ -149920,11 +150706,65 @@ async function startServer(options = {}) {
       }
       return path157.join(process.cwd(), "dist", "web", "static");
     })();
+    const mirrorDir = process.env.WALNUT_WEB_STATIC_MIRROR || path157.join(WALNUT_HOME, "cache", "web-static");
+    let mirrorReady = false;
+    try {
+      const want = fs98.readFileSync(path157.join(staticDir, "index.html"), "utf-8");
+      let have = null;
+      try {
+        have = fs98.readFileSync(path157.join(mirrorDir, "index.html"), "utf-8");
+      } catch {
+      }
+      if (have !== want) {
+        fs98.rmSync(mirrorDir, { recursive: true, force: true });
+        fs98.mkdirSync(path157.dirname(mirrorDir), { recursive: true });
+        fs98.cpSync(staticDir, mirrorDir, { recursive: true });
+      }
+    } catch (err2) {
+      log.web.warn("could not refresh the web-asset mirror", {
+        mirrorDir,
+        error: err2 instanceof Error ? err2.message : String(err2)
+      });
+    }
+    try {
+      mirrorReady = fs98.statSync(path157.join(mirrorDir, "index.html")).isFile();
+    } catch {
+      mirrorReady = false;
+    }
     app.use(express3.static(staticDir));
+    if (mirrorReady) app.use(express3.static(mirrorDir));
+    const checkStaticRoot = () => {
+      try {
+        return fs98.statSync(path157.join(staticDir, "index.html")).isFile();
+      } catch {
+        return false;
+      }
+    };
+    let staticRootOk = checkStaticRoot();
+    if (!staticRootOk) {
+      log.web.error("web assets are NOT servable at startup", { staticDir, mirrorReady });
+    }
+    const staticRootTimer = setInterval(() => {
+      const ok2 = checkStaticRoot();
+      if (ok2 === staticRootOk) return;
+      staticRootOk = ok2;
+      if (ok2) log.web.info("web assets are servable again", { staticDir });
+      else log.web.error("web assets VANISHED from under the running server", { staticDir, mirrorReady });
+    }, 6e4);
+    staticRootTimer.unref();
+    setStaticRootReporter(() => ({ staticDir, ok: staticRootOk, mirrorDir, mirrorReady }));
     app.use((req, res, next) => {
       if (req.method !== "GET" || req.path.startsWith("/api/")) return next();
       if (isStaticAssetPath(req.path)) return next();
-      res.sendFile("index.html", { root: staticDir });
+      res.sendFile("index.html", { root: staticDir }, (err2) => {
+        if (!err2) return;
+        if (mirrorReady) {
+          res.sendFile("index.html", { root: mirrorDir }, () => {
+          });
+          return;
+        }
+        next(err2);
+      });
     });
   }
   app.use("/api", notFoundHandler);
@@ -149944,9 +150784,21 @@ async function startServer(options = {}) {
   }
   httpServer = createServer(app);
   attachWss(httpServer);
-  await new Promise((resolve, reject) => {
-    httpServer.listen(port, () => resolve());
-    httpServer.once("error", reject);
+  try {
+    await new Promise((resolve, reject) => {
+      httpServer.once("error", reject);
+      httpServer.listen(port, () => resolve());
+    });
+  } catch (err2) {
+    if (err2?.code !== "EADDRINUSE") throw err2;
+    const already = await isWalnutAnsweringOn(port);
+    throw new Error(
+      already ? `Walnut is already running at http://localhost:${port} (EADDRINUSE). Open that address; there is nothing to start.` : `Port ${port} is in use by another program (EADDRINUSE). Start Walnut on a free one instead, for example:
+    open-walnut web --port ${port + 1}`
+    );
+  }
+  httpServer.on("error", (err2) => {
+    log.web.error("http server error after listen", { error: err2 instanceof Error ? err2.message : String(err2) });
   });
   const label = dev ? "dev" : "production";
   log.web.info(`server listening on http://localhost:${port}`, { mode: label, port });
@@ -149956,6 +150808,7 @@ async function startServer(options = {}) {
       const { updateInstanceLockPort: updateInstanceLockPort2 } = await Promise.resolve().then(() => (init_instance_lock(), instance_lock_exports));
       updateInstanceLockPort2(bound.port);
       setPluginApiBase(`http://127.0.0.1:${bound.port}`);
+      process.env.WALNUT_SERVER_URL = `http://localhost:${bound.port}`;
     }
   }
   if (CLOUD_MODE) {
@@ -150618,10 +151471,9 @@ async function startServer(options = {}) {
       const prev = systemHealth.hasReadyProvider;
       const prevSource = systemHealth.credentialSource;
       const cred = await resolveCredentialHealth();
-      systemHealth.hasReadyProvider = cred.hasReadyProvider;
-      systemHealth.credentialSource = cred.source;
-      systemHealth.credentialDetail = cred.detail;
-      if (cred.hasReadyProvider !== prev || cred.source !== prevSource) {
+      const prevProvider = systemHealth.mainProvider;
+      applyCredentialHealth(cred);
+      if (cred.hasReadyProvider !== prev || cred.source !== prevSource || cred.mainProvider !== prevProvider) {
         broadcastEvent("system:health", systemHealth);
       }
     } catch {
@@ -158048,11 +158900,12 @@ __export(session_controls_exports, {
   applySessionModelChange: () => applySessionModelChange,
   computeModelOptions: () => computeModelOptions,
   controlErrorKind: () => controlErrorKind,
+  createForkSiblingTask: () => createForkSiblingTask,
   forkSessionToTask: () => forkSessionToTask,
   handleSessionControlRelay: () => handleSessionControlRelay,
   modelReadBackMatches: () => modelReadBackMatches
 });
-import { randomUUID as randomUUID10 } from "crypto";
+import { randomUUID as randomUUID11 } from "crypto";
 function controlErrorKind(status2) {
   if (status2 === 404) return "not_found";
   if (status2 === 405) return "method_not_allowed";
@@ -158225,6 +159078,124 @@ async function computeModelOptions(sessionId) {
     currentEffort: liveEffort ?? record.effectiveEffort ?? record.effort ?? null
   };
 }
+async function createForkSiblingTask(sourceTaskId, opts) {
+  const {
+    getTask: getTask2,
+    addTask: addTask2,
+    updateTask: updateTask2,
+    groupTasks: groupTasks2,
+    addToGroup: addToGroup2,
+    renameGroup: renameGroup2
+  } = await Promise.resolve().then(() => (init_task_manager(), task_manager_exports));
+  let sourceTask;
+  try {
+    sourceTask = await getTask2(sourceTaskId);
+  } catch {
+    throw new SessionControlError(`Source task "${sourceTaskId}" not found`, 404);
+  }
+  const sourceBaseTitle = sourceTask.title.replace(/^Fork of\s+/i, "").replace(/\s+-\s+fork of\s+.*$/i, "").trim() || sourceTask.title;
+  const explicitTitle = opts.childTitle || (opts.titlePrefix ? `${opts.titlePrefix} - fork of ${sourceBaseTitle}` : void 0);
+  const autoTitle = !explicitTitle;
+  const newTitle = explicitTitle || `Fork of ${sourceBaseTitle}`;
+  let inheritedTier;
+  if (sourceTask.pinned && sourceTask.focus_tier) {
+    const { getCustomTiers: getCustomTiers2 } = await Promise.resolve().then(() => (init_task_manager(), task_manager_exports));
+    const known = ["focus", "backlog", "wait"].includes(sourceTask.focus_tier) || (await getCustomTiers2()).some((t3) => t3.id === sourceTask.focus_tier);
+    if (known) inheritedTier = sourceTask.focus_tier;
+    else {
+      log.session.warn("fork: source tier is not registered, filing the fork in Satellite", {
+        sourceTaskId: sourceTask.id,
+        tier: sourceTask.focus_tier
+      });
+    }
+  }
+  const { task: newFork } = await addTask2({
+    title: newTitle,
+    project: sourceTask.project || "",
+    source: sourceTask.source,
+    ...opts.description ? { description: opts.description } : {},
+    // A fork is a person splitting off live work, so it joins the board like
+    // any other hand-made task (Satellite = pinned, no stored tier).
+    pinned: true,
+    ...inheritedTier ? { focus_tier: inheritedTier } : {},
+    // Forking an Ask Walnut conversation yields another Ask Walnut
+    // conversation: without the flag the fork loses the amber marker AND the
+    // persona drift repair (both key on task.walnut_agent, never on project).
+    ...sourceTask.walnut_agent ? { walnut_agent: true } : {}
+  });
+  let forkGroupId;
+  try {
+    if (sourceTask.group_id) {
+      const r8 = await addToGroup2(sourceTask.group_id, [newFork.id]);
+      forkGroupId = r8.group_id;
+    } else {
+      const r8 = await groupTasks2([sourceTask.id, newFork.id], sourceTask.title);
+      forkGroupId = r8.group_id;
+    }
+  } catch (err2) {
+    log.session.warn("fork: failed to group source + fork", {
+      sourceTaskId: sourceTask.id,
+      forkTaskId: newFork.id,
+      error: err2 instanceof Error ? err2.message : String(err2)
+    });
+  }
+  let task;
+  try {
+    task = await getTask2(newFork.id);
+  } catch {
+    task = newFork;
+  }
+  bus.emit(EventNames.TASK_CREATED, { task }, ["web-ui", "main-agent"], { source: opts.source });
+  if (autoTitle && opts.prompt?.trim()) {
+    const forkId = newFork.id;
+    const sourceTitle = sourceBaseTitle;
+    const placeholderTitle = newTitle;
+    const prompt = opts.prompt;
+    const titleSource = `${opts.source}-title`;
+    void (async () => {
+      try {
+        const { summarizeForkPrompt: summarizeForkPrompt2 } = await Promise.resolve().then(() => (init_fork_title(), fork_title_exports));
+        const label = await summarizeForkPrompt2(prompt);
+        if (!label) return;
+        const current5 = await getTask2(forkId);
+        if (current5.title !== placeholderTitle) {
+          log.session.info("fork title refine skipped \u2014 title changed since fork", { taskId: forkId });
+          return;
+        }
+        const refinedTitle = `${label} - fork of ${sourceTitle}`;
+        const { task: updated } = await updateTask2(forkId, { title: refinedTitle }, { source: titleSource });
+        bus.emit(EventNames.TASK_UPDATED, { task: updated }, ["web-ui", "main-agent"], { source: titleSource });
+        log.session.info("fork title refined", { taskId: forkId, title: refinedTitle });
+      } catch (err2) {
+        log.session.warn("fork title refine failed", {
+          taskId: forkId,
+          error: err2 instanceof Error ? err2.message : String(err2)
+        });
+      }
+    })();
+  }
+  if (forkGroupId && !sourceTask.group_id) {
+    const gid = forkGroupId;
+    const seedTitles = [sourceTask.title, newTitle];
+    const groupSource = opts.source;
+    void (async () => {
+      try {
+        const { summarizeGroupLabel: summarizeGroupLabel2 } = await Promise.resolve().then(() => (init_fork_title(), fork_title_exports));
+        const label = await summarizeGroupLabel2(seedTitles);
+        if (!label) return;
+        await renameGroup2(gid, label);
+        bus.emit(EventNames.TASK_GROUPS_CHANGED, { group_id: gid, label }, ["web-ui", "main-agent"], { source: groupSource });
+        log.session.info("fork group label refined", { groupId: gid, label });
+      } catch (err2) {
+        log.session.warn("fork group label refine failed", {
+          groupId: gid,
+          error: err2 instanceof Error ? err2.message : String(err2)
+        });
+      }
+    })();
+  }
+  return { task, ...forkGroupId ? { groupId: forkGroupId } : {} };
+}
 async function forkSessionToTask(sourceSessionId, input, source = "web-api") {
   const { task_id, create_child_task, child_title, message, title, model, imageContext } = input;
   if (!task_id && !create_child_task) {
@@ -158234,14 +159205,7 @@ async function forkSessionToTask(sourceSessionId, input, source = "web-api") {
     throw new SessionControlError("task_id and create_child_task are mutually exclusive", 400);
   }
   const { getSessionByClaudeId: getSessionByClaudeId2, getSessionsForTask: getSessionsForTask2, createSessionRecord: createSessionRecord2 } = await Promise.resolve().then(() => (init_session_tracker(), session_tracker_exports));
-  const {
-    getTask: getTask2,
-    addTask: addTask2,
-    updateTask: updateTask2,
-    groupTasks: groupTasks2,
-    addToGroup: addToGroup2,
-    renameGroup: renameGroup2
-  } = await Promise.resolve().then(() => (init_task_manager(), task_manager_exports));
+  const { getTask: getTask2 } = await Promise.resolve().then(() => (init_task_manager(), task_manager_exports));
   const sourceRecord = await getSessionByClaudeId2(sourceSessionId);
   if (!sourceRecord) throw new SessionControlError("Source session not found", 404);
   if (!engineCaps(sourceRecord.engine).fork) {
@@ -158258,108 +159222,13 @@ async function forkSessionToTask(sourceSessionId, input, source = "web-api") {
     if (!sourceRecord.taskId) {
       throw new SessionControlError("Source session has no task \u2014 cannot create fork task", 400);
     }
-    let sourceTask;
-    try {
-      sourceTask = await getTask2(sourceRecord.taskId);
-    } catch {
-      throw new SessionControlError(`Source task "${sourceRecord.taskId}" not found`, 404);
-    }
-    const sourceBaseTitle = sourceTask.title.replace(/^Fork of\s+/i, "").replace(/\s+-\s+fork of\s+.*$/i, "").trim() || sourceTask.title;
-    const autoTitle = !child_title;
-    const newTitle = child_title || `Fork of ${sourceBaseTitle}`;
-    let inheritedTier;
-    if (sourceTask.pinned && sourceTask.focus_tier) {
-      const { getCustomTiers: getCustomTiers2 } = await Promise.resolve().then(() => (init_task_manager(), task_manager_exports));
-      const known = ["focus", "backlog", "wait"].includes(sourceTask.focus_tier) || (await getCustomTiers2()).some((t3) => t3.id === sourceTask.focus_tier);
-      if (known) inheritedTier = sourceTask.focus_tier;
-      else {
-        log.session.warn("fork: source tier is not registered, filing the fork in Satellite", {
-          sourceTaskId: sourceTask.id,
-          tier: sourceTask.focus_tier
-        });
-      }
-    }
-    const { task: newFork } = await addTask2({
-      title: newTitle,
-      project: sourceTask.project || "",
-      source: sourceTask.source,
-      // A fork is a person splitting off live work, so it joins the board like
-      // any other hand-made task (Satellite = pinned, no stored tier).
-      pinned: true,
-      ...inheritedTier ? { focus_tier: inheritedTier } : {},
-      // Forking an Ask Walnut conversation yields another Ask Walnut
-      // conversation: without the flag the fork loses the amber marker AND the
-      // persona drift repair (both key on task.walnut_agent, never on project).
-      ...sourceTask.walnut_agent ? { walnut_agent: true } : {}
-    });
-    let forkGroupId;
-    try {
-      if (sourceTask.group_id) {
-        const r8 = await addToGroup2(sourceTask.group_id, [newFork.id]);
-        forkGroupId = r8.group_id;
-      } else {
-        const r8 = await groupTasks2([sourceTask.id, newFork.id], sourceTask.title);
-        forkGroupId = r8.group_id;
-      }
-    } catch (err2) {
-      log.session.warn("fork: failed to group source + fork", {
-        sourceTaskId: sourceTask.id,
-        forkTaskId: newFork.id,
-        error: err2 instanceof Error ? err2.message : String(err2)
-      });
-    }
-    try {
-      task = await getTask2(newFork.id);
-    } catch {
-      task = newFork;
-    }
-    bus.emit(EventNames.TASK_CREATED, { task }, ["web-ui", "main-agent"], { source: "fork" });
+    const created = await createForkSiblingTask(sourceRecord.taskId, {
+      childTitle: child_title,
+      prompt: message,
+      source: "fork"
+    });
+    task = created.task;
     childTaskCreated = true;
-    if (autoTitle && message?.trim()) {
-      const forkId = newFork.id;
-      const sourceTitle = sourceBaseTitle;
-      const placeholderTitle = newTitle;
-      void (async () => {
-        try {
-          const { summarizeForkPrompt: summarizeForkPrompt2 } = await Promise.resolve().then(() => (init_fork_title(), fork_title_exports));
-          const label = await summarizeForkPrompt2(message);
-          if (!label) return;
-          const current5 = await getTask2(forkId);
-          if (current5.title !== placeholderTitle) {
-            log.session.info("fork title refine skipped \u2014 title changed since fork", { taskId: forkId });
-            return;
-          }
-          const refinedTitle = `${label} - fork of ${sourceTitle}`;
-          const { task: updated } = await updateTask2(forkId, { title: refinedTitle }, { source: "fork-title" });
-          bus.emit(EventNames.TASK_UPDATED, { task: updated }, ["web-ui", "main-agent"], { source: "fork-title" });
-          log.session.info("fork title refined", { taskId: forkId, title: refinedTitle });
-        } catch (err2) {
-          log.session.warn("fork title refine failed", {
-            taskId: forkId,
-            error: err2 instanceof Error ? err2.message : String(err2)
-          });
-        }
-      })();
-    }
-    if (forkGroupId && !sourceTask.group_id) {
-      const gid = forkGroupId;
-      const seedTitles = [sourceTask.title, newTitle];
-      void (async () => {
-        try {
-          const { summarizeGroupLabel: summarizeGroupLabel2 } = await Promise.resolve().then(() => (init_fork_title(), fork_title_exports));
-          const label = await summarizeGroupLabel2(seedTitles);
-          if (!label) return;
-          await renameGroup2(gid, label);
-          bus.emit(EventNames.TASK_GROUPS_CHANGED, { group_id: gid, label }, ["web-ui", "main-agent"], { source: "fork" });
-          log.session.info("fork group label refined", { groupId: gid, label });
-        } catch (err2) {
-          log.session.warn("fork group label refine failed", {
-            groupId: gid,
-            error: err2 instanceof Error ? err2.message : String(err2)
-          });
-        }
-      })();
-    }
   } else {
     try {
       task = await getTask2(task_id);
@@ -158381,7 +159250,7 @@ async function forkSessionToTask(sourceSessionId, input, source = "web-api") {
   const FORK_FOCUS_PREFIX = "This is a forked session. Focus on the NEW request below \u2014 treat it as your primary task. Do not resume or continue the parent session's previous work unless the user explicitly asks you to.\n\n";
   const forkMessage = `${FORK_FOCUS_PREFIX}${imageContext ?? ""}New request:
 ${userRequest}`;
-  const forkSessionId = randomUUID10();
+  const forkSessionId = randomUUID11();
   const forkTitle = title ?? `Fork of ${sourceRecord.title ?? sourceSessionId.slice(0, 16)}`;
   try {
     await createSessionRecord2(forkSessionId, task.id, task.project ?? "", sourceRecord.cwd, {
@@ -158532,6 +159401,11 @@ async function handleSessionControlRelay(action, sessionId, params) {
         result = await retrySession2(sessionId);
         break;
       }
+      case "recheck": {
+        const { recheckSession: recheckSession2 } = await Promise.resolve().then(() => (init_session_lifecycle(), session_lifecycle_exports));
+        result = await recheckSession2(sessionId);
+        break;
+      }
       case "permission": {
         const { respondSessionPermission: respondSessionPermission2 } = await Promise.resolve().then(() => (init_session_lifecycle(), session_lifecycle_exports));
         result = await respondSessionPermission2(sessionId, p6.requestId, p6.allow, p6.message, p6.optionId, p6.answers);
@@ -159099,7 +159973,7 @@ __export(session_rewind_exports, {
   probeRewindViaDaemon: () => probeRewindViaDaemon,
   rewindSessionToMessage: () => rewindSessionToMessage
 });
-import { randomUUID as randomUUID11 } from "crypto";
+import { randomUUID as randomUUID12 } from "crypto";
 function cutAncestorHistoryAtRewindPoint(ancestorMessages, rewoundAtMessageUuid) {
   if (!rewoundAtMessageUuid) {
     return { messages: ancestorMessages, found: false, dropped: 0 };
@@ -159300,7 +160174,7 @@ async function rewindSessionToMessage(sessionId, input, source = "web-api") {
       error: err2 instanceof Error ? err2.message : String(err2)
     });
   }
-  const rewoundId = randomUUID11();
+  const rewoundId = randomUUID12();
   const baseTitle = (record.title ?? sessionId.slice(0, 16)).replace(/\s*\(rewound\)$/i, "");
   const title = `${baseTitle} (rewound)`.slice(0, 200);
   const { createSessionRecord: createSessionRecord2 } = await Promise.resolve().then(() => (init_session_tracker(), session_tracker_exports));
@@ -160020,6 +160894,7 @@ function parseSessionMessages(content, opts) {
     }
   }
   let lastPlanContent = null;
+  let dropWarmupReply = false;
   const resultParentIds = [];
   const result = [];
   for (const [mapMsgId, msg] of messageMap) {
@@ -160097,10 +160972,18 @@ ${imgPath}` : imgPath;
     let text = textParts.join("\n").trim();
     if (!text && tools2.length === 0 && !thinking) continue;
     if (msg.role === "user" && text.startsWith("<")) {
+      if (isCacheWarmupText(text)) {
+        dropWarmupReply = true;
+        continue;
+      }
       const transformed = transformInjectedUserText(text);
       if (transformed === null) continue;
       if (transformed !== void 0) text = transformed;
     }
+    if (msg.role === "assistant" && dropWarmupReply) {
+      dropWarmupReply = false;
+      if (tools2.length === 0) continue;
+    }
     if (msg.role === "user") text = stripOutputModeWrappers(text);
     if (msg.role === "assistant" && !text && tools2.length === 0) continue;
     result.push({
@@ -161051,6 +161934,7 @@ var init_session_history = __esm({
     init_session_io();
     init_constants();
     init_remote_image_mirror();
+    init_side_thread_warmup();
     init_session_file_reader();
     LOCAL_HOME = os36.homedir();
     TAIL_SEGMENT_ROLL_BYTES = 4 * 1024 * 1024;
@@ -161198,7 +162082,7 @@ var init_context_window = __esm({
 });
 
 // src/providers/turn-ledger.ts
-import { randomUUID as randomUUID12 } from "crypto";
+import { randomUUID as randomUUID13 } from "crypto";
 function openTurn(sessionId) {
   const existing = openTurns.get(sessionId);
   if (existing && !existing.settled) {
@@ -161208,7 +162092,7 @@ function openTurn(sessionId) {
     });
     return { turnId: existing.turnId, promise: existing.promise };
   }
-  const turnId = randomUUID12();
+  const turnId = randomUUID13();
   let resolve;
   let reject;
   const promise = new Promise((res, rej) => {
@@ -167956,11 +168840,39 @@ var init_claude_code_session = __esm({
         session2.pendingDescription = message.slice(0, 500);
         let appendSystemPrompt;
         const isFork = !!data.forkedFromSessionId;
-        if (data.appendSystemPrompt && !isFork) {
-          appendSystemPrompt = data.appendSystemPrompt;
-          log.session.info("using caller-provided system prompt", { taskId: taskId2, promptLength: data.appendSystemPrompt.length });
-        }
-        {
+        const { parseSideLaneKey: parseSideLaneKey2 } = await Promise.resolve().then(() => (init_side_thread_fork(), side_thread_fork_exports));
+        const sideIds = parseSideLaneKey2(data.lane);
+        if (sideIds) {
+          let exact = data.appendSystemPromptExact;
+          let source = "live-or-record";
+          if (exact === void 0) {
+            try {
+              const { getSessionByClaudeId: getSessionByClaudeId2 } = await Promise.resolve().then(() => (init_session_tracker(), session_tracker_exports));
+              const { spawnPrefixFromRecord: spawnPrefixFromRecord2 } = await Promise.resolve().then(() => (init_spawn_prefix(), spawn_prefix_exports));
+              const parentRecord = await getSessionByClaudeId2(sideIds.parentSid);
+              const prefix = parentRecord ? spawnPrefixFromRecord2(parentRecord) : null;
+              exact = prefix?.appendSystemPrompt ?? null;
+              source = prefix?.source ?? "no-parent-record";
+            } catch (err2) {
+              exact = null;
+              source = "lookup-failed";
+              log.session.warn("side thread: parent prompt lookup failed \u2014 spawning without an append prompt", {
+                parentSid: sideIds.parentSid,
+                error: err2 instanceof Error ? err2.message : String(err2)
+              });
+            }
+          }
+          appendSystemPrompt = exact ?? void 0;
+          log.session.info("side thread: prefix prompt resolved", {
+            parentSid: sideIds.parentSid,
+            source,
+            promptLength: appendSystemPrompt?.length ?? 0
+          });
+        } else {
+          if (data.appendSystemPrompt && !isFork) {
+            appendSystemPrompt = data.appendSystemPrompt;
+            log.session.info("using caller-provided system prompt", { taskId: taskId2, promptLength: data.appendSystemPrompt.length });
+          }
           try {
             const { buildSessionContext: buildSessionContext2 } = await Promise.resolve().then(() => (init_session_context(), session_context_exports));
             const ctx = await buildSessionContext2(taskId2 ?? "", cwd, data.host);
@@ -167978,32 +168890,6 @@ ${ctx.systemPrompt}` : ctx.systemPrompt;
             log.session.warn("failed to build session context", { taskId: taskId2, error: err2 instanceof Error ? err2.message : String(err2) });
           }
         }
-        {
-          const { parseSideLaneKey: parseSideLaneKey2 } = await Promise.resolve().then(() => (init_side_thread_fork(), side_thread_fork_exports));
-          const sideIds = parseSideLaneKey2(data.lane);
-          if (sideIds) {
-            try {
-              const { getSessionByClaudeId: getSessionByClaudeId2 } = await Promise.resolve().then(() => (init_session_tracker(), session_tracker_exports));
-              const parentRecord = await getSessionByClaudeId2(sideIds.parentSid);
-              const inherited = parentRecord?.appliedAppendSystemPrompt;
-              if (inherited && Buffer.byteLength(inherited, "utf8") <= 65536) {
-                appendSystemPrompt = inherited;
-                log.session.info("side thread: inherited parent system prompt verbatim", {
-                  parentSid: sideIds.parentSid,
-                  promptLength: appendSystemPrompt.length
-                });
-              } else {
-                log.session.info("side thread: parent has no stored system prompt \u2014 fresh build (cache prefix will diverge)", {
-                  parentSid: sideIds.parentSid
-                });
-              }
-            } catch (err2) {
-              log.session.warn("side thread: parent prompt lookup failed \u2014 fresh build", {
-                error: err2 instanceof Error ? err2.message : String(err2)
-              });
-            }
-          }
-        }
         if (data.preassignedSessionId && appendSystemPrompt && Buffer.byteLength(appendSystemPrompt, "utf8") <= 65536) {
           const promptToStore = appendSystemPrompt;
           const sidToStore = data.preassignedSessionId;
@@ -177002,7 +177888,7 @@ __export(mobile_launch_exports, {
   performMobileLaunch: () => performMobileLaunch,
   validateMobileLaunchBody: () => validateMobileLaunchBody
 });
-import { randomUUID as randomUUID13 } from "crypto";
+import { randomUUID as randomUUID14 } from "crypto";
 function launchErrorCode(status2) {
   if (status2 === 404) return "not_found";
   if (status2 === 409) return "conflict";
@@ -177124,7 +178010,7 @@ async function performMobileLaunch(input, source) {
       );
     }
   }
-  const preassignedSessionId = engineCaps(input.engine).idProvisioning === "provider-issued" ? void 0 : randomUUID13();
+  const preassignedSessionId = engineCaps(input.engine).idProvisioning === "provider-issued" ? void 0 : randomUUID14();
   const task = await quickStartSession({
     message: input.message,
     cwd: input.cwd,
@@ -177551,6 +178437,7 @@ __export(daemon_connection_exports, {
   isDaemonConnected: () => isDaemonConnected,
   isPooledConnection: () => isPooledConnection,
   probeDaemonSession: () => probeDaemonSession,
+  probeDaemonSessionArgs: () => probeDaemonSessionArgs,
   pushDaemonHooksToAllHosts: () => pushDaemonHooksToAllHosts,
   setOnDaemonHostConnected: () => setOnDaemonHostConnected,
   setOnDaemonStatusChange: () => setOnDaemonStatusChange,
@@ -177727,6 +178614,28 @@ async function probeDaemonSession(hostKey2, sessionId) {
     return null;
   }
 }
+async function probeDaemonSessionArgs(hostKey2, sessionId, deadlineMs = 2e3) {
+  const conn = getConnectedDaemonConnection(hostKey2);
+  if (!conn) return null;
+  try {
+    const result = await Promise.race([
+      conn.send("status", { sid: sessionId, includeArgs: true }),
+      new Promise((_, reject) => setTimeout(
+        () => reject(new Error(`status probe exceeded ${deadlineMs}ms`)),
+        deadlineMs
+      ).unref?.())
+    ]);
+    if (!result.ok || !result.alive || !Array.isArray(result.args)) return null;
+    return result.args.filter((a8) => typeof a8 === "string");
+  } catch (err2) {
+    log.session.debug("probeDaemonSessionArgs: status probe failed", {
+      hostKey: hostKey2,
+      sessionId,
+      error: err2 instanceof Error ? err2.message : String(err2)
+    });
+    return null;
+  }
+}
 var execFileAsync23, MOBILE_ENQUEUE_LEDGER_MAX, recentMobileEnqueues, DaemonConnection, onPoolStatusChange, onHostConnected, hostConnectedListeners, connectionPool, connectingPromises, failureCache, FAILURE_CACHE_TTL_MS;
 var init_daemon_connection = __esm({
   "src/providers/daemon-connection.ts"() {
@@ -182294,6 +183203,7 @@ async function createSessionRecord(claudeSessionId, taskId2, project, cwd, extra
         ...extra?.effort ? { effort: extra.effort } : {},
         ...extra?.profile ? { profile: extra.profile } : {},
         ...extra?.lane ? { lane: extra.lane } : {},
+        ...extra?.appliedAppendSystemPrompt !== void 0 ? { appliedAppendSystemPrompt: extra.appliedAppendSystemPrompt } : {},
         ...extra?.engine ? { engine: extra.engine } : {},
         ...extra?.acpRuntimeId ? { acpRuntimeId: extra.acpRuntimeId } : {},
         ...extra?.acpJournalPath ? { acpJournalPath: extra.acpJournalPath } : {},
@@ -182448,7 +183358,7 @@ function applyUpdateToSession(session2, updates, logLabel) {
       };
       if (count2 === 1) log.session.info("legacy status write suppressed", payload);
       else log.session.debug("legacy status write suppressed", payload);
-      if (updates.process_status === "error") {
+      if (updates.process_status === "error" || updates.process_status === "stopped") {
         noteSuppressedErrorReason(session2.claudeSessionId, {
           reason: typeof reason === "string" ? reason : "unknown",
           message: typeof updates.errorMessage === "string" ? updates.errorMessage : void 0,