open-walnut 0.4.1 → 0.4.3

package/dist/cli.js

@@ -2996,10 +2996,155 @@ var init_model_catalog = __esm({
   }
 });
 
-// src/core/ssh-config-scanner.ts
-import fs6 from "fs/promises";
-import path8 from "path";
+// src/core/claude-cli-detect.ts
+var claude_cli_detect_exports = {};
+__export(claude_cli_detect_exports, {
+  _CLAUDE_CREDENTIALS_HOME: () => _CLAUDE_CREDENTIALS_HOME,
+  describeClaudeCliAuth: () => describeClaudeCliAuth,
+  detectClaudeCli: () => detectClaudeCli,
+  hasClaudeSubscriptionAuth: () => hasClaudeSubscriptionAuth,
+  isClaudeCliInstalled: () => isClaudeCliInstalled,
+  resolveClaudeCliExecutable: () => resolveClaudeCliExecutable
+});
+import { execFileSync } from "child_process";
+import fs6 from "fs";
 import os3 from "os";
+import path8 from "path";
+function resolveClaudeCliExecutable(env3 = process.env) {
+  const home = env3.HOME || os3.homedir();
+  const pathDirs = (env3.PATH ?? "").split(path8.delimiter).filter(Boolean);
+  const fallbackDirs = [
+    path8.join(home, ".toolbox", "bin"),
+    path8.join(home, ".local", "bin"),
+    path8.join(home, ".npm-global", "bin"),
+    path8.join(home, ".bun", "bin"),
+    "/usr/local/bin",
+    "/opt/homebrew/bin",
+    "/usr/bin",
+    "/bin"
+  ];
+  for (const dir2 of [.../* @__PURE__ */ new Set([...pathDirs, ...fallbackDirs])]) {
+    const candidate = path8.join(dir2, "claude");
+    try {
+      fs6.accessSync(candidate, fs6.constants.X_OK);
+      return candidate;
+    } catch {
+    }
+  }
+  return null;
+}
+function isClaudeCliInstalled() {
+  return resolveClaudeCliExecutable() !== null;
+}
+function hasClaudeSubscriptionAuth() {
+  if (process.platform === "darwin") {
+    try {
+      execFileSync("security", ["find-generic-password", "-s", KEYCHAIN_OAUTH_SERVICE], {
+        stdio: "ignore"
+      });
+      return true;
+    } catch {
+    }
+  }
+  return fileCredentialExists();
+}
+function fileCredentialExists() {
+  try {
+    return fs6.existsSync(CLAUDE_CREDENTIALS_FILE);
+  } catch {
+    return false;
+  }
+}
+function detectClaudeCli() {
+  const installed2 = isClaudeCliInstalled();
+  const subscriptionAuth = installed2 && hasClaudeSubscriptionAuth();
+  return {
+    installed: installed2,
+    subscriptionAuth,
+    subscriptionReady: installed2 && subscriptionAuth,
+    ready: installed2,
+    auth: installed2 ? describeClaudeCliAuth() : { mode: "unknown", label: "not installed" }
+  };
+}
+function describeClaudeCliAuth(env3 = process.env, settingsEnv = readClaudeSettingsEnv()) {
+  const merged = { ...env3, ...settingsEnv };
+  const truthy = (v3) => !!v3 && v3 !== "0" && v3.toLowerCase() !== "false";
+  if (truthy(merged.CLAUDE_CODE_USE_BEDROCK)) {
+    const region = merged.AWS_REGION || merged.AWS_DEFAULT_REGION;
+    return { mode: "bedrock", label: region ? `Bedrock (${region})` : "Bedrock" };
+  }
+  if (truthy(merged.CLAUDE_CODE_USE_VERTEX)) return { mode: "vertex", label: "Vertex AI" };
+  if (merged.ANTHROPIC_API_KEY || merged.ANTHROPIC_AUTH_TOKEN) return { mode: "api-key", label: "an Anthropic API key" };
+  if (hasClaudeSubscriptionAuth()) return { mode: "subscription", label: "your Claude subscription" };
+  return { mode: "unknown", label: "its own login" };
+}
+function readClaudeSettingsEnv() {
+  try {
+    const raw = fs6.readFileSync(path8.join(os3.homedir(), ".claude", "settings.json"), "utf8");
+    const env3 = JSON.parse(raw).env ?? {};
+    return Object.fromEntries(Object.entries(env3).filter(([, v3]) => typeof v3 === "string"));
+  } catch {
+    return {};
+  }
+}
+var KEYCHAIN_OAUTH_SERVICE, _CLAUDE_CREDENTIALS_HOME;
+var init_claude_cli_detect = __esm({
+  "src/core/claude-cli-detect.ts"() {
+    "use strict";
+    init_constants();
+    KEYCHAIN_OAUTH_SERVICE = "Claude Code-credentials";
+    _CLAUDE_CREDENTIALS_HOME = os3.homedir();
+  }
+});
+
+// src/agent/providers/default-provider.ts
+var default_provider_exports = {};
+__export(default_provider_exports, {
+  CLAUDE_CLI_PROVIDER: () => CLAUDE_CLI_PROVIDER,
+  LEGACY_DEFAULT_PROVIDER: () => LEGACY_DEFAULT_PROVIDER,
+  _resetDefaultProviderCacheForTesting: () => _resetDefaultProviderCacheForTesting,
+  hasExplicitBedrockConfig: () => hasExplicitBedrockConfig,
+  mainProviderIsImplicit: () => mainProviderIsImplicit,
+  resolveMainProviderName: () => resolveMainProviderName
+});
+function claudeCliInstalledCached() {
+  const now = Date.now();
+  if (!cliProbe || now - cliProbe.at > CLI_PROBE_TTL_MS) {
+    cliProbe = { at: now, installed: isClaudeCliInstalled() };
+  }
+  return cliProbe.installed;
+}
+function _resetDefaultProviderCacheForTesting() {
+  cliProbe = void 0;
+}
+function hasExplicitBedrockConfig(config) {
+  const b8 = config.providers?.bedrock;
+  if (b8 && (b8.bearer_token || b8.aws_access_key_id || b8.aws_profile || b8.aws_credential_export)) return true;
+  return !!config.provider?.bedrock_bearer_token;
+}
+function resolveMainProviderName(config, claudeInstalled = claudeCliInstalledCached()) {
+  if (config.agent?.main_provider) return config.agent.main_provider;
+  if (claudeInstalled) return CLAUDE_CLI_PROVIDER;
+  return LEGACY_DEFAULT_PROVIDER;
+}
+function mainProviderIsImplicit(config) {
+  return !config.agent?.main_provider;
+}
+var LEGACY_DEFAULT_PROVIDER, CLAUDE_CLI_PROVIDER, CLI_PROBE_TTL_MS, cliProbe;
+var init_default_provider = __esm({
+  "src/agent/providers/default-provider.ts"() {
+    "use strict";
+    init_claude_cli_detect();
+    LEGACY_DEFAULT_PROVIDER = "bedrock";
+    CLAUDE_CLI_PROVIDER = "claude_cli";
+    CLI_PROBE_TTL_MS = 6e4;
+  }
+});
+
+// src/core/ssh-config-scanner.ts
+import fs7 from "fs/promises";
+import path9 from "path";
+import os4 from "os";
 function isGitServerHost(h8) {
   if (h8.user === "git") return true;
   const gitPrefix = /^(git|github|gitlab|bitbucket|codecommit|ssh\.github)\./i;
@@ -3015,10 +3160,10 @@ function shortLabelForFqdn(hostname) {
   return `${first.slice(0, 12)}\u2026${first.slice(-8)}`;
 }
 async function scanSshConfig(configPath) {
-  const sshConfigPath = configPath ?? path8.join(os3.homedir(), ".ssh", "config");
+  const sshConfigPath = configPath ?? path9.join(os4.homedir(), ".ssh", "config");
   let mtimeMs2;
   try {
-    mtimeMs2 = (await fs6.stat(sshConfigPath)).mtimeMs;
+    mtimeMs2 = (await fs7.stat(sshConfigPath)).mtimeMs;
   } catch {
     return /* @__PURE__ */ new Map();
   }
@@ -3031,7 +3176,7 @@ async function scanSshConfig(configPath) {
 async function parseSshConfigFile(sshConfigPath) {
   const discovered = /* @__PURE__ */ new Map();
   try {
-    const content = await fs6.readFile(sshConfigPath, "utf-8");
+    const content = await fs7.readFile(sshConfigPath, "utf-8");
     const lines = content.split("\n");
     let currentHost = null;
     for (const rawLine of lines) {
@@ -3132,23 +3277,24 @@ __export(config_manager_exports, {
   updatePushTokens: () => updatePushTokens,
   writeFileAtomic: () => writeFileAtomic2
 });
-import fs7 from "fs/promises";
+import fs8 from "fs/promises";
 import yaml from "js-yaml";
-function resolveAgentEngineProvider(config) {
+function resolveAgentEngineProvider(config, claudeInstalled) {
   if (CLOUD_MODE) return "walnut-agent";
   const raw = config.agent?.provider;
   if (typeof raw === "string" && VALID_AGENT_ENGINE_PROVIDERS.has(raw)) {
     return raw;
   }
-  if (raw !== void 0) {
-    log.session.warn("config-manager: agent.provider is not a known engine \u2014 using the default", {
-      value: typeof raw === "string" ? raw : `<${typeof raw}>`,
-      using: FALLBACK_AGENT_ENGINE_PROVIDER,
-      valid: [...VALID_AGENT_ENGINE_PROVIDERS].join(", ")
-    });
-    return FALLBACK_AGENT_ENGINE_PROVIDER;
+  if (raw === void 0) {
+    const main = claudeInstalled === void 0 ? resolveMainProviderName(config) : resolveMainProviderName(config, claudeInstalled);
+    return main === CLAUDE_CLI_PROVIDER ? "claude-code" : "walnut-agent";
   }
-  return DEFAULT_AGENT_ENGINE_PROVIDER;
+  log.session.warn("config-manager: agent.provider is not a known engine \u2014 using the fallback", {
+    value: typeof raw === "string" ? raw : `<${typeof raw}>`,
+    using: FALLBACK_AGENT_ENGINE_PROVIDER,
+    valid: [...VALID_AGENT_ENGINE_PROVIDERS].join(", ")
+  });
+  return FALLBACK_AGENT_ENGINE_PROVIDER;
 }
 function migrateConfigToProjectOnly(config) {
   let changed = false;
@@ -3221,13 +3367,13 @@ function migrateConfigToProjectOnly(config) {
 }
 async function readRawConfigContent() {
   try {
-    const primary = await fs7.readFile(CONFIG_FILE, "utf-8");
+    const primary = await fs8.readFile(CONFIG_FILE, "utf-8");
     if (primary.trim()) return primary;
     throw new Error("config.yaml is empty");
   } catch (primaryErr) {
     let backup;
     try {
-      backup = await fs7.readFile(CONFIG_BACKUP_FILE, "utf-8");
+      backup = await fs8.readFile(CONFIG_BACKUP_FILE, "utf-8");
     } catch {
       return null;
     }
@@ -3237,7 +3383,7 @@ async function readRawConfigContent() {
       backup: CONFIG_BACKUP_FILE
     });
     try {
-      await fs7.writeFile(CONFIG_FILE, backup, "utf-8");
+      await fs8.writeFile(CONFIG_FILE, backup, "utf-8");
     } catch {
     }
     return backup;
@@ -3246,10 +3392,10 @@ async function readRawConfigContent() {
 async function writeFileAtomic2(filePath, content) {
   const tmp = `${filePath}.tmp-${process.pid}-${Date.now().toString(36)}`;
   try {
-    await fs7.writeFile(tmp, content, "utf-8");
-    await fs7.rename(tmp, filePath);
+    await fs8.writeFile(tmp, content, "utf-8");
+    await fs8.rename(tmp, filePath);
   } catch (err2) {
-    await fs7.rm(tmp, { force: true }).catch(() => {
+    await fs8.rm(tmp, { force: true }).catch(() => {
     });
     throw err2;
   }
@@ -3447,7 +3593,7 @@ async function seedConfigDefaults() {
   const config = await getConfig();
   let needsWrite = false;
   try {
-    const raw = await fs7.readFile(CONFIG_FILE, "utf-8");
+    const raw = await fs8.readFile(CONFIG_FILE, "utf-8");
     if (!raw.includes("available_models")) {
       needsWrite = true;
     }
@@ -3475,6 +3621,7 @@ var init_config_manager = __esm({
     init_constants();
     init_types();
     init_model_catalog();
+    init_default_provider();
     init_ssh_config_scanner();
     DEFAULT_CONFIG = {
       version: 1,
@@ -3486,12 +3633,12 @@ var init_config_manager = __esm({
       // so this never re-routes an established setup.
       defaults: { priority: "none", platform: "local" },
       provider: { type: "claude-code" },
-      // Which ENGINE answers a Personal AI chat turn. 'walnut-agent' = today's in-process
-      // agent loop; 'claude-code' routes the turn into a lane-bound `claude` session.
-      // NOTE: getConfig() spreads the parsed file OVER these defaults at the TOP
-      // level, so a config.yaml with any `agent:` section replaces this whole object
-      // — resolveAgentEngineProvider() (below) is what actually applies the default.
-      agent: { provider: DEFAULT_AGENT_ENGINE_PROVIDER }
+      // Which ENGINE answers a Personal AI chat turn is NOT defaulted here: it follows
+      // the AI provider (Settings → AI Provider) — see resolveAgentEngineProvider().
+      // getConfig() spreads the parsed file OVER these defaults at the TOP level, so
+      // anything put in this object is dropped by any config.yaml with an `agent:`
+      // section; the resolver is what actually applies the rule.
+      agent: {}
     };
     CONFIG_BACKUP_FILE = `${CONFIG_FILE}.bak`;
     writeLock = Promise.resolve();
@@ -3500,15 +3647,15 @@ var init_config_manager = __esm({
 
 // src/core/tmp-sweep.ts
 import fsp5 from "fs/promises";
-import path9 from "path";
+import path10 from "path";
 function sweepDirs() {
   return [
     WALNUT_HOME,
     SYNC_DIR,
-    path9.join(WALNUT_HOME, "sessions"),
-    path9.join(WALNUT_HOME, "sessions", "transcripts"),
+    path10.join(WALNUT_HOME, "sessions"),
+    path10.join(WALNUT_HOME, "sessions", "transcripts"),
     TASKS_DIR,
-    path9.join(TASKS_DIR, "outbox"),
+    path10.join(TASKS_DIR, "outbox"),
     CONVERSATIONS_DIR,
     MEMORY_DIR,
     DAILY_DIR,
@@ -3529,7 +3676,7 @@ async function sweepOrphanAtomicTmpFiles() {
       const entries = await fsp5.readdir(dir2, { withFileTypes: true });
       for (const entry of entries) {
         if (!entry.isFile() || !ORPHAN_RE.test(entry.name)) continue;
-        const full = path9.join(dir2, entry.name);
+        const full = path10.join(dir2, entry.name);
         try {
           const st = await fsp5.stat(full);
           if (st.mtimeMs > cutoff) continue;
@@ -3566,10 +3713,10 @@ __export(init_exports, {
   initDirectories: () => initDirectories
 });
 import fsp6 from "fs/promises";
-import fs8 from "fs";
+import fs9 from "fs";
 async function migrateLegacyMemoryFile() {
   try {
-    if (fs8.existsSync(LEGACY_MEMORY_FILE) && !fs8.existsSync(MEMORY_FILE)) {
+    if (fs9.existsSync(LEGACY_MEMORY_FILE) && !fs9.existsSync(MEMORY_FILE)) {
       await fsp6.rename(LEGACY_MEMORY_FILE, MEMORY_FILE);
       log.memory.info("Migrated MEMORY.md into memory/ folder", { from: LEGACY_MEMORY_FILE, to: MEMORY_FILE });
     }
@@ -4524,15 +4671,15 @@ __export(task_db_exports, {
   transaction: () => transaction
 });
 import Database from "better-sqlite3";
-import fs9 from "fs";
-import path10 from "path";
+import fs10 from "fs";
+import path11 from "path";
 import yaml2 from "js-yaml";
 function getDb() {
   if (db) return db;
   if (initAttempted) throw initError;
   initAttempted = true;
   try {
-    fs9.mkdirSync(path10.dirname(TASK_DB_PATH), { recursive: true });
+    fs10.mkdirSync(path11.dirname(TASK_DB_PATH), { recursive: true });
     const handle2 = new Database(TASK_DB_PATH);
     handle2.pragma("journal_mode = WAL");
     handle2.pragma("busy_timeout = 5000");
@@ -4762,8 +4909,8 @@ function migrateToProjectOnly(handle2) {
   }
   try {
     handle2.pragma("wal_checkpoint(TRUNCATE)");
-    if (!fs9.existsSync(TASK_DB_PRE_V5_BACKUP_PATH)) {
-      fs9.copyFileSync(TASK_DB_PATH, TASK_DB_PRE_V5_BACKUP_PATH);
+    if (!fs10.existsSync(TASK_DB_PRE_V5_BACKUP_PATH)) {
+      fs10.copyFileSync(TASK_DB_PATH, TASK_DB_PRE_V5_BACKUP_PATH);
       log.task.info("task-db v5: wrote pre-migration backup", { path: TASK_DB_PRE_V5_BACKUP_PATH });
     }
   } catch (err2) {
@@ -5273,7 +5420,7 @@ var init_task_db = __esm({
     init_constants();
     init_logging();
     init_phase2();
-    TASK_DB_PATH = path10.join(TASKS_DIR, "tasks.sqlite");
+    TASK_DB_PATH = path11.join(TASKS_DIR, "tasks.sqlite");
     EXPLICIT_TASK_COLUMNS = [
       "id",
       "title",
@@ -5436,8 +5583,8 @@ var init_task_db = __esm({
 });
 
 // src/core/task-db-migration.ts
-import fs10 from "fs";
-import path11 from "path";
+import fs11 from "fs";
+import path12 from "path";
 import yaml3 from "js-yaml";
 async function runMigrationIfNeeded() {
   const db5 = getDb();
@@ -5448,7 +5595,7 @@ async function runMigrationIfNeeded() {
   if (existing.n > 0) {
     return { migrated: false, count: existing.n };
   }
-  if (!fs10.existsSync(TASKS_FILE)) {
+  if (!fs11.existsSync(TASKS_FILE)) {
     return { migrated: false, count: 0 };
   }
   const store3 = await readJsonFile(TASKS_FILE, { version: 1, tasks: [] });
@@ -5605,9 +5752,9 @@ async function runMigrationIfNeeded() {
   }
   const after = db5.prepare("SELECT COUNT(*) AS n FROM tasks").get();
   const count2 = after.n;
-  const backupPath = path11.join(path11.dirname(TASKS_FILE), "tasks.json.migrated-from-json.backup");
+  const backupPath = path12.join(path12.dirname(TASKS_FILE), "tasks.json.migrated-from-json.backup");
   try {
-    fs10.copyFileSync(TASKS_FILE, backupPath);
+    fs11.copyFileSync(TASKS_FILE, backupPath);
   } catch (err2) {
     log.task.warn("task-db migration: backup copy failed (non-fatal)", {
       path: backupPath,
@@ -5631,9 +5778,9 @@ var init_task_db_migration = __esm({
 });
 
 // src/core/memory-dir-migration.ts
-import fs11 from "fs";
+import fs12 from "fs";
 import fsp7 from "fs/promises";
-import path12 from "path";
+import path13 from "path";
 function bodyOf(content) {
   const fm = content.match(/^---\r?\n[\s\S]*?\r?\n---\r?\n?/);
   return fm ? content.slice(fm[0].length) : content;
@@ -5651,7 +5798,7 @@ ${legacyBody}
 }
 function mtimeMs(file) {
   try {
-    return fs11.statSync(file).mtimeMs;
+    return fs12.statSync(file).mtimeMs;
   } catch {
     return 0;
   }
@@ -5660,24 +5807,24 @@ function findCandidates(root6) {
   const out = [];
   let level1;
   try {
-    level1 = fs11.readdirSync(root6, { withFileTypes: true });
+    level1 = fs12.readdirSync(root6, { withFileTypes: true });
   } catch {
     return out;
   }
   for (const cat of level1) {
     if (!cat.isDirectory()) continue;
-    const catDir = path12.join(root6, cat.name);
-    if (fs11.existsSync(path12.join(catDir, MEMORY_FILE_NAME))) continue;
+    const catDir = path13.join(root6, cat.name);
+    if (fs12.existsSync(path13.join(catDir, MEMORY_FILE_NAME))) continue;
     let level2;
     try {
-      level2 = fs11.readdirSync(catDir, { withFileTypes: true });
+      level2 = fs12.readdirSync(catDir, { withFileTypes: true });
     } catch {
       continue;
     }
     for (const proj of level2) {
       if (!proj.isDirectory()) continue;
-      const sourceDir = path12.join(catDir, proj.name);
-      if (!fs11.existsSync(path12.join(sourceDir, MEMORY_FILE_NAME))) continue;
+      const sourceDir = path13.join(catDir, proj.name);
+      if (!fs12.existsSync(path13.join(sourceDir, MEMORY_FILE_NAME))) continue;
       out.push({ category: cat.name, project: proj.name, sourceDir });
     }
   }
@@ -5691,11 +5838,11 @@ async function drainDir(from, to) {
     return;
   }
   for (const name of entries) {
-    const target = path12.join(to, name);
-    if (fs11.existsSync(target)) continue;
-    await fsp7.rename(path12.join(from, name), target).catch((err2) => {
+    const target = path13.join(to, name);
+    if (fs12.existsSync(target)) continue;
+    await fsp7.rename(path13.join(from, name), target).catch((err2) => {
       log.memory.warn("memory-dir migration: entry move failed", {
-        from: path12.join(from, name),
+        from: path13.join(from, name),
         to: target,
         error: String(err2)
       });
@@ -5707,23 +5854,23 @@ async function drainDir(from, to) {
 async function migrateProjectMemoryDirs() {
   const result = { ran: false, moved: 0, merged: 0 };
   try {
-    if (!fs11.existsSync(PROJECTS_MEMORY_DIR)) return result;
-    if (fs11.existsSync(MEMORY_DIR_MIGRATION_MARKER)) return result;
+    if (!fs12.existsSync(PROJECTS_MEMORY_DIR)) return result;
+    if (fs12.existsSync(MEMORY_DIR_MIGRATION_MARKER)) return result;
     result.ran = true;
     const candidates = findCandidates(PROJECTS_MEMORY_DIR);
     const touchedCategories = new Set(candidates.map((c8) => c8.category));
     for (const c8 of candidates) {
-      const targetDir = path12.join(PROJECTS_MEMORY_DIR, c8.project);
+      const targetDir = path13.join(PROJECTS_MEMORY_DIR, c8.project);
       const label = `${c8.category}/${c8.project}`;
       try {
-        if (!fs11.existsSync(targetDir)) {
+        if (!fs12.existsSync(targetDir)) {
           await fsp7.rename(c8.sourceDir, targetDir);
           result.moved += 1;
           continue;
         }
-        const sourceMem = path12.join(c8.sourceDir, MEMORY_FILE_NAME);
-        const targetMem = path12.join(targetDir, MEMORY_FILE_NAME);
-        if (!fs11.existsSync(targetMem)) {
+        const sourceMem = path13.join(c8.sourceDir, MEMORY_FILE_NAME);
+        const targetMem = path13.join(targetDir, MEMORY_FILE_NAME);
+        if (!fs12.existsSync(targetMem)) {
           await fsp7.rename(sourceMem, targetMem);
           await drainDir(c8.sourceDir, targetDir);
           result.moved += 1;
@@ -5745,7 +5892,7 @@ async function migrateProjectMemoryDirs() {
       }
     }
     for (const cat of touchedCategories) {
-      await fsp7.rmdir(path12.join(PROJECTS_MEMORY_DIR, cat)).catch(() => {
+      await fsp7.rmdir(path13.join(PROJECTS_MEMORY_DIR, cat)).catch(() => {
       });
     }
     await fsp7.writeFile(
@@ -5773,7 +5920,7 @@ var init_memory_dir_migration = __esm({
     "use strict";
     init_constants();
     init_logging();
-    MEMORY_DIR_MIGRATION_MARKER = path12.join(PROJECTS_MEMORY_DIR, ".migrated-project-only");
+    MEMORY_DIR_MIGRATION_MARKER = path13.join(PROJECTS_MEMORY_DIR, ".migrated-project-only");
     MEMORY_FILE_NAME = "MEMORY.md";
   }
 });
@@ -5989,7 +6136,7 @@ __export(microsoft_todo_exports, {
 });
 import * as msal from "@azure/msal-node";
 import https from "https";
-import path13 from "path";
+import path14 from "path";
 function getMsTodoConfig(config) {
   return config.plugins?.["ms-todo"];
 }
@@ -7208,8 +7355,8 @@ var init_microsoft_todo = __esm({
     init_format();
     init_task_manager();
     init_task_remote_links();
-    TOKENS_FILE = path13.join(SYNC_DIR, "ms-todo-tokens.json");
-    DELTA_FILE = path13.join(SYNC_DIR, "ms-todo-delta.json");
+    TOKENS_FILE = path14.join(SYNC_DIR, "ms-todo-tokens.json");
+    DELTA_FILE = path14.join(SYNC_DIR, "ms-todo-delta.json");
     GRAPH_BASE = "https://graph.microsoft.com/v1.0";
     SCOPES = ["Tasks.ReadWrite"];
     PRIORITY_TO_IMPORTANCE = {
@@ -7332,8 +7479,8 @@ __export(daemon_version_check_exports, {
   verifyDaemonBinaryVersion: () => verifyDaemonBinaryVersion
 });
 import { createHash } from "crypto";
-import fs12 from "fs";
-import path14 from "path";
+import fs13 from "fs";
+import path15 from "path";
 import { spawnSync } from "child_process";
 import { fileURLToPath as fileURLToPath2 } from "url";
 function computeExpectedDaemonVersion() {
@@ -7342,11 +7489,11 @@ function computeExpectedDaemonVersion() {
   const hash = createHash("sha256");
   const NUL = Buffer.from([0]);
   for (const rel of DAEMON_SOURCE_FILES) {
-    const abs = path14.join(repoRoot, rel);
+    const abs = path15.join(repoRoot, rel);
     try {
       hash.update(Buffer.from(rel));
       hash.update(NUL);
-      hash.update(fs12.readFileSync(abs));
+      hash.update(fs13.readFileSync(abs));
       hash.update(NUL);
     } catch {
       return null;
@@ -7355,12 +7502,12 @@ function computeExpectedDaemonVersion() {
   return "walnut-daemon-" + hash.digest("hex").slice(0, 12);
 }
 function findRepoRoot() {
-  let dir2 = path14.dirname(fileURLToPath2(import.meta.url));
+  let dir2 = path15.dirname(fileURLToPath2(import.meta.url));
   for (let i8 = 0; i8 < 10; i8++) {
-    if (fs12.existsSync(path14.join(dir2, "package.json")) && fs12.existsSync(path14.join(dir2, "src", "providers", "daemon-standalone.ts"))) {
+    if (fs13.existsSync(path15.join(dir2, "package.json")) && fs13.existsSync(path15.join(dir2, "src", "providers", "daemon-standalone.ts"))) {
       return dir2;
     }
-    const parent = path14.dirname(dir2);
+    const parent = path15.dirname(dir2);
     if (parent === dir2) break;
     dir2 = parent;
   }
@@ -7369,14 +7516,14 @@ function findRepoRoot() {
 function bunAvailable() {
   const home = process.env.HOME ?? "";
   const candidates = [
-    ...(process.env.PATH ?? "").split(path14.delimiter).filter(Boolean).map((d8) => path14.join(d8, "bun")),
-    path14.join(home, ".bun", "bin", "bun"),
+    ...(process.env.PATH ?? "").split(path15.delimiter).filter(Boolean).map((d8) => path15.join(d8, "bun")),
+    path15.join(home, ".bun", "bin", "bun"),
     "/opt/homebrew/bin/bun",
     "/usr/local/bin/bun"
   ];
   return candidates.some((p6) => {
     try {
-      fs12.accessSync(p6, fs12.constants.X_OK);
+      fs13.accessSync(p6, fs13.constants.X_OK);
       return true;
     } catch {
       return false;
@@ -7386,10 +7533,10 @@ function bunAvailable() {
 function readBuiltVersions() {
   const out = /* @__PURE__ */ new Map();
   try {
-    for (const f8 of fs12.readdirSync(DAEMON_BINARIES_DIR)) {
+    for (const f8 of fs13.readdirSync(DAEMON_BINARIES_DIR)) {
       if (!f8.endsWith(".version")) continue;
       const arch = f8.slice(0, -".version".length);
-      const v3 = fs12.readFileSync(path14.join(DAEMON_BINARIES_DIR, f8), "utf-8").trim();
+      const v3 = fs13.readFileSync(path15.join(DAEMON_BINARIES_DIR, f8), "utf-8").trim();
       if (v3) out.set(arch, v3);
     }
   } catch {
@@ -7849,12 +7996,12 @@ var init_daemon_fold = __esm({
 });
 
 // src/providers/daemon-source.ts
-import fs13 from "fs";
-import path15 from "path";
+import fs14 from "fs";
+import path16 from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 function resolveDaemonSourceVersion() {
   const here = fileURLToPath3(import.meta.url);
-  const bundled = here.split(path15.sep).includes("dist");
+  const bundled = here.split(path16.sep).includes("dist");
   if (bundled) {
     const sidecar = readSidecarDaemonVersion(here);
     if (sidecar) return sidecar;
@@ -7862,32 +8009,32 @@ function resolveDaemonSourceVersion() {
   const computed = computeExpectedDaemonVersion();
   if (computed) return computed;
   if (process.env.DAEMON_VERSION) return process.env.DAEMON_VERSION;
-  let dir2 = path15.dirname(fileURLToPath3(import.meta.url));
+  let dir2 = path16.dirname(fileURLToPath3(import.meta.url));
   for (let i8 = 0; i8 < 10; i8++) {
     try {
-      const pkg = JSON.parse(fs13.readFileSync(path15.join(dir2, "package.json"), "utf-8"));
+      const pkg = JSON.parse(fs14.readFileSync(path16.join(dir2, "package.json"), "utf-8"));
       if (pkg.name === "open-walnut" && pkg.version) return `walnut-daemon-pkg-${pkg.version}`;
     } catch {
     }
-    const parent = path15.dirname(dir2);
+    const parent = path16.dirname(dir2);
     if (parent === dir2) break;
     dir2 = parent;
   }
   return "dev-source";
 }
 function readSidecarDaemonVersion(fromPath) {
-  let dir2 = path15.dirname(fromPath);
+  let dir2 = path16.dirname(fromPath);
   for (let i8 = 0; i8 < 5; i8++) {
-    const binDir = path15.join(dir2, "daemon-binaries");
+    const binDir = path16.join(dir2, "daemon-binaries");
     try {
-      for (const name of fs13.readdirSync(binDir)) {
+      for (const name of fs14.readdirSync(binDir)) {
         if (!name.endsWith(".version")) continue;
-        const v3 = fs13.readFileSync(path15.join(binDir, name), "utf-8").trim();
+        const v3 = fs14.readFileSync(path16.join(binDir, name), "utf-8").trim();
         if (v3) return v3;
       }
     } catch {
     }
-    const parent = path15.dirname(dir2);
+    const parent = path16.dirname(dir2);
     if (parent === dir2) break;
     dir2 = parent;
   }
@@ -8815,24 +8962,25 @@ function reapSession(sid, code, reason) {
   let jsonlAgeMs = null;
   try { jsonlAgeMs = Date.now() - fs.statSync(session.jsonlPath).mtimeMs; } catch {}
   const cleanExit = isTurnCompleteExit(session.jsonlPath);
-  // An INTENTIONAL daemon-initiated reclamation is not a failure, and the JSONL
-  // tail cannot tell us it happened. The idle scanner stamps idleReclaimAt
-  // before it signals; the death then lands here through whichever path notices
-  // it (usually orphan-poll ESRCH \u2192 code -1). Verified production case: the last
-  // line was a control_response (the reply to a Walnut-issued control request \u2014
-  // a routine shape), so isTurnCompleteExit said false, exitCode stayed -1, and
-  // the projection painted a red "Error" over a healthy, fully resumable session
-  // we reclaimed on purpose. Checked FIRST and unconditionally: the flag carries
-  // information the tail does not contain, which is why isTurnCompleteExit is
-  // left alone. Keep in sync with daemon-core.ts reapSession.
-  const intentionalReclaim = session.idleReclaimAt != null;
-  if (intentionalReclaim && code !== 0) {
-    logMsg('info', 'reapSession: intentional idle reclamation, normalizing exit code', {
+  // A DELIBERATE stop is not a failure, and the JSONL tail cannot tell us it
+  // happened. Both writers (our idle scanner, and any stop RPC via cmdStop)
+  // stamp intentionalStopAt before signalling; the death then lands here through
+  // whichever path notices it (usually orphan-poll ESRCH \u2192 code -1). Verified
+  // production case: the last line was a control_response (the reply to a
+  // Walnut-issued control request \u2014 a routine shape), so isTurnCompleteExit said
+  // false, exitCode stayed -1, and the projection painted a red "Error" over a
+  // healthy, fully resumable session that was stopped on purpose. Checked FIRST
+  // and unconditionally: the flag carries information the tail does not contain,
+  // which is why isTurnCompleteExit is left alone.
+  // Keep in sync with daemon-core.ts reapSession.
+  const intentionalStop = session.intentionalStopAt != null;
+  if (intentionalStop && code !== 0) {
+    logMsg('info', 'reapSession: intentional stop, normalizing exit code', {
       sid, pid: session.pid, originalCode: code, originalReason: reason,
-      jsonlAgeMs, cleanExit, idleReclaimAt: session.idleReclaimAt,
+      jsonlAgeMs, cleanExit, intentionalStopAt: session.intentionalStopAt,
     });
     code = 0;
-    reason = reason + '+intentional-idle-reclaim';
+    reason = reason + '+intentional-stop';
   } else if (code !== 0 && cleanExit) {
     logMsg('info', 'reapSession: turn-complete detected, normalizing exit code', {
       sid, pid: session.pid, originalCode: code, originalReason: reason, jsonlAgeMs,
@@ -12486,6 +12634,15 @@ function cmdStop(ws, id, cmd) {
   const pid = session.pid;
   logMsg('info', 'cmdStop: stopping session (process group kill)', { sid, pid });
 
+  // Nobody sends stop by accident, so record the intent BEFORE the first signal:
+  // the death lands asynchronously (orphan poll \u2192 ESRCH \u2192 code -1) and by then
+  // nothing remembers this was asked for. This path is how the SERVER's idle
+  // reaper kills (mgr.kill() \u2192 stop RPC), not the daemon's own scan, so it needs
+  // its own stamp: a LOCAL session auto-stopped after 2h idle surfaced as
+  // "Session ended unexpectedly and no cause was recorded" (2026-09-03).
+  // Keep in sync with daemon-standalone.ts cmdStop.
+  session.intentionalStopAt = Date.now();
+
   // An explicit stop is a human decision \u2014 never undone by a pending auto-retry
   // respawning the CLI minutes later. Cancel the timer AND clear the streak so
   // an in-flight result line can't re-arm one either.
@@ -12522,7 +12679,7 @@ function cmdStop(ws, id, cmd) {
 
 // \u2500\u2500 Status \u2500\u2500
 function cmdStatus(ws, id, cmd) {
-  const { sid } = cmd;
+  const { sid, includeArgs } = cmd;
   if (!sid) return sendError(ws, id, 'status: missing sid');
 
   const session = sessions.get(sid);
@@ -12553,6 +12710,11 @@ function cmdStatus(ws, id, cmd) {
     exitCode: session.exitCode,
     exitReason: session.exitReason,
     pendingCtrl: session.pendingCtrl,
+    // Opt-in: the argv the live process was launched with (a fork copies it to
+    // reproduce the parent's prompt-cache prefix). Off by default because the
+    // health monitor polls status for every session and the argv carries the
+    // multi-KB --append-system-prompt.
+    ...(includeArgs && session.args && session.args.length > 0 ? { args: session.args } : {}),
   });
 }
 
@@ -14605,7 +14767,7 @@ function scanIdleSessions() {
       // end" for any session whose last line isn't a type:result \u2014 and the
       // projection then shows a red Error for our own routine reclamation.
       // Keep in sync with daemon-standalone.ts scanIdleSessions.
-      session.idleReclaimAt = now;
+      session.intentionalStopAt = now;
       killSessionProcessGroup(pid, sid);
     }
   }
@@ -14986,7 +15148,7 @@ if (action === '--start') {
 });
 
 // src/core/jsonl-tailer.ts
-import fs14 from "fs";
+import fs15 from "fs";
 var init_jsonl_tailer = __esm({
   "src/core/jsonl-tailer.ts"() {
     "use strict";
@@ -14995,10 +15157,10 @@ var init_jsonl_tailer = __esm({
 });
 
 // src/providers/session-io.ts
-import fs15 from "fs";
+import fs16 from "fs";
 import fsp8 from "fs/promises";
-import path16 from "path";
-import { execFileSync } from "child_process";
+import path17 from "path";
+import { execFileSync as execFileSync2 } from "child_process";
 function shellQuote(s4) {
   return "'" + s4.replace(/'/g, "'\\''") + "'";
 }
@@ -15043,7 +15205,7 @@ function findRelativeImageNames(text, opts) {
 function findLocalImagePaths(text) {
   return findImagePaths(text).filter((p6) => {
     try {
-      return fs15.statSync(p6).isFile();
+      return fs16.statSync(p6).isFile();
     } catch {
       return false;
     }
@@ -15289,19 +15451,19 @@ function createDaemonCore(deps) {
       jsonlAgeMs = clock() - fs121.statSync(session2.jsonlPath).mtimeMs;
     } catch {
     }
-    const intentionalReclaim = session2.idleReclaimAt != null;
-    if (intentionalReclaim && code !== 0) {
-      logger2("info", "reapSession: intentional idle reclamation, normalizing exit code", {
+    const intentionalStop = session2.intentionalStopAt != null;
+    if (intentionalStop && code !== 0) {
+      logger2("info", "reapSession: intentional stop, normalizing exit code", {
         sid,
         pid: session2.pid,
         originalCode: code,
         originalReason: reason,
         jsonlAgeMs,
         cleanExit,
-        idleReclaimAt: session2.idleReclaimAt
+        intentionalStopAt: session2.intentionalStopAt
       });
       code = 0;
-      reason = reason + "+intentional-idle-reclaim";
+      reason = reason + "+intentional-stop";
     } else if (cleanExit && code !== 0) {
       logger2("info", "reapSession: turn-complete detected, normalizing exit code", {
         sid,
@@ -16088,83 +16250,6 @@ var init_daemon_core = __esm({
   }
 });
 
-// src/core/claude-cli-detect.ts
-var claude_cli_detect_exports = {};
-__export(claude_cli_detect_exports, {
-  _CLAUDE_CREDENTIALS_HOME: () => _CLAUDE_CREDENTIALS_HOME,
-  detectClaudeCli: () => detectClaudeCli,
-  hasClaudeSubscriptionAuth: () => hasClaudeSubscriptionAuth,
-  isClaudeCliInstalled: () => isClaudeCliInstalled,
-  resolveClaudeCliExecutable: () => resolveClaudeCliExecutable
-});
-import { execFileSync as execFileSync2 } from "child_process";
-import fs16 from "fs";
-import os4 from "os";
-import path17 from "path";
-function resolveClaudeCliExecutable(env3 = process.env) {
-  const home = env3.HOME || os4.homedir();
-  const pathDirs = (env3.PATH ?? "").split(path17.delimiter).filter(Boolean);
-  const fallbackDirs = [
-    path17.join(home, ".toolbox", "bin"),
-    path17.join(home, ".local", "bin"),
-    path17.join(home, ".npm-global", "bin"),
-    path17.join(home, ".bun", "bin"),
-    "/usr/local/bin",
-    "/opt/homebrew/bin",
-    "/usr/bin",
-    "/bin"
-  ];
-  for (const dir2 of [.../* @__PURE__ */ new Set([...pathDirs, ...fallbackDirs])]) {
-    const candidate = path17.join(dir2, "claude");
-    try {
-      fs16.accessSync(candidate, fs16.constants.X_OK);
-      return candidate;
-    } catch {
-    }
-  }
-  return null;
-}
-function isClaudeCliInstalled() {
-  return resolveClaudeCliExecutable() !== null;
-}
-function hasClaudeSubscriptionAuth() {
-  if (process.platform === "darwin") {
-    try {
-      execFileSync2("security", ["find-generic-password", "-s", KEYCHAIN_OAUTH_SERVICE], {
-        stdio: "ignore"
-      });
-      return true;
-    } catch {
-    }
-  }
-  return fileCredentialExists();
-}
-function fileCredentialExists() {
-  try {
-    return fs16.existsSync(CLAUDE_CREDENTIALS_FILE);
-  } catch {
-    return false;
-  }
-}
-function detectClaudeCli() {
-  const installed2 = isClaudeCliInstalled();
-  const subscriptionAuth = installed2 && hasClaudeSubscriptionAuth();
-  return {
-    installed: installed2,
-    subscriptionAuth,
-    subscriptionReady: installed2 && subscriptionAuth
-  };
-}
-var KEYCHAIN_OAUTH_SERVICE, _CLAUDE_CREDENTIALS_HOME;
-var init_claude_cli_detect = __esm({
-  "src/core/claude-cli-detect.ts"() {
-    "use strict";
-    init_constants();
-    KEYCHAIN_OAUTH_SERVICE = "Claude Code-credentials";
-    _CLAUDE_CREDENTIALS_HOME = os4.homedir();
-  }
-});
-
 // src/providers/daemon-ownership.ts
 import fs17 from "fs";
 import os5 from "os";
@@ -23524,7 +23609,7 @@ __export(credential_resolver_exports, {
   DEFAULT_REGION: () => DEFAULT_REGION,
   hasResolvableCredential: () => hasResolvableCredential,
   readClaudeCredentialExport: () => readClaudeCredentialExport,
-  readClaudeSettingsEnv: () => readClaudeSettingsEnv,
+  readClaudeSettingsEnv: () => readClaudeSettingsEnv2,
   resolveCredentialFrom: () => resolveCredentialFrom,
   resolveCredentials: () => resolveCredentials,
   traceCredentialResolution: () => traceCredentialResolution
@@ -23679,7 +23764,7 @@ function traceCredentialResolution(inputs) {
     region: { value: winner.region ?? DEFAULT_REGION, source: regionSource }
   };
 }
-function readClaudeSettingsEnv(settingsFile = CLAUDE_SETTINGS_FILE) {
+function readClaudeSettingsEnv2(settingsFile = CLAUDE_SETTINGS_FILE) {
   try {
     const raw = fs30.readFileSync(settingsFile, "utf-8");
     const parsed = JSON.parse(raw);
@@ -23719,7 +23804,7 @@ function probeAwsFiles() {
 function resolveCredentials(config) {
   const result = resolveCredentialFrom({
     config,
-    claudeEnv: readClaudeSettingsEnv(),
+    claudeEnv: readClaudeSettingsEnv2(),
     processEnv: process.env,
     awsFiles: probeAwsFiles(),
     claudeCredentialExport: readClaudeCredentialExport()
@@ -66501,10 +66586,9 @@ function buildArgs(opts) {
     // Input stays default (text): we write the whole prompt to stdin and close.
     // (stream-json INPUT would force us into a JSON envelope for no gain here.)
     "--tools",
-    "",
+    ""
     // disable ALL built-in tools (deny-all)
-    "--settings",
-    FORCE_SUBSCRIPTION_SETTINGS
+    // No --settings override: the user's settings.json (and so their auth) applies as-is.
   ];
   let systemText = systemToText(opts.system).trim();
   if (opts.tools && opts.tools.length > 0) {
@@ -66533,7 +66617,7 @@ function systemToText(system) {
 }
 function buildSpawnEnv(base = process.env) {
   const env3 = { ...base };
-  for (const key2 of AUTH_ENV_TO_STRIP) {
+  for (const key2 of ENV_TO_STRIP) {
     delete env3[key2];
   }
   env3.CLAUDE_CODE_ENTRYPOINT = WALNUT_UTILITY_ENTRYPOINT;
@@ -66595,7 +66679,7 @@ function normalizeCliModel(model) {
   }
   return void 0;
 }
-var AUTH_ENV_TO_STRIP, FORCE_SUBSCRIPTION_SETTINGS, CLI_TURN_TIMEOUT_MS, SESSION_REUSE_TTL_MS, MAX_TRACKED_SESSIONS, ClaudeCliAdapter;
+var ENV_TO_STRIP, MAX_CONCURRENT_CLI, CLI_TURN_TIMEOUT_MS, SESSION_REUSE_TTL_MS, MAX_TRACKED_SESSIONS, ClaudeCliAdapter;
 var init_adapter_claude_cli = __esm({
   "src/agent/providers/adapter-claude-cli.ts"() {
     "use strict";
@@ -66605,24 +66689,11 @@ var init_adapter_claude_cli = __esm({
     init_logging();
     init_claude_cli_detect();
     init_claude_cli_protocol();
-    AUTH_ENV_TO_STRIP = [
-      "ANTHROPIC_API_KEY",
-      "ANTHROPIC_AUTH_TOKEN",
-      "ANTHROPIC_BASE_URL",
-      "AWS_BEARER_TOKEN_BEDROCK",
-      "AWS_ACCESS_KEY_ID",
-      "AWS_SECRET_ACCESS_KEY",
-      "AWS_SESSION_TOKEN",
-      "AWS_PROFILE",
-      "CLAUDE_CODE_USE_BEDROCK",
-      "CLAUDE_CODE_USE_VERTEX",
-      // Nested-session marker — inline-subagent strips this too so the child doesn't
-      // think it's running inside another Claude session.
-      "CLAUDECODE"
-    ];
-    FORCE_SUBSCRIPTION_SETTINGS = JSON.stringify({
-      env: { CLAUDE_CODE_USE_BEDROCK: "", CLAUDE_CODE_USE_VERTEX: "" }
-    });
+    ENV_TO_STRIP = ["CLAUDECODE"];
+    MAX_CONCURRENT_CLI = (() => {
+      const n6 = Number(process.env.WALNUT_CLAUDE_CLI_CONCURRENCY);
+      return Number.isFinite(n6) && n6 > 0 ? Math.floor(n6) : 3;
+    })();
     CLI_TURN_TIMEOUT_MS = 12e4;
     SESSION_REUSE_TTL_MS = 30 * 60 * 1e3;
     MAX_TRACKED_SESSIONS = 50;
@@ -66630,6 +66701,25 @@ var init_adapter_claude_cli = __esm({
       protocol = "claude-cli";
       /** conversationKey → CLI session for --resume chaining. In-process only. */
       sessions = /* @__PURE__ */ new Map();
+      /** Process gate: MAX_CONCURRENT_CLI turns at once, the rest queue in order. */
+      inFlight = 0;
+      waiters = [];
+      async withSlot(fn) {
+        if (this.inFlight >= MAX_CONCURRENT_CLI) {
+          await new Promise((resolve) => this.waiters.push(resolve));
+        }
+        this.inFlight++;
+        try {
+          return await fn();
+        } finally {
+          this.inFlight--;
+          this.waiters.shift()?.();
+        }
+      }
+      /** Test hook: how many turns are running / waiting right now. */
+      _gateStateForTesting() {
+        return { inFlight: this.inFlight, waiting: this.waiters.length };
+      }
       resetClient() {
         this.sessions.clear();
       }
@@ -66707,7 +66797,7 @@ User: ${overridePrompt}` : "");
         }
         if (!prompt.trim()) prompt = "(continue)";
         const args = [...buildArgs(opts), session2.flag, session2.id];
-        return this.execCli(command6, args, env3, prompt, opts.signal, onTextDelta).then((result) => {
+        return this.withSlot(() => this.execCli(command6, args, env3, prompt, opts.signal, onTextDelta)).then((result) => {
           this.sessions.set(key2, {
             sessionId: session2.id,
             seenMessages: opts.messages.length,
@@ -66726,7 +66816,7 @@ User: ${overridePrompt}` : "");
 User: ${overridePrompt}` : "");
             const freshId = randomUUID3();
             const freshArgs = [...buildArgs(opts), "--session-id", freshId];
-            return this.execCli(command6, freshArgs, env3, freshPrompt || "(continue)", opts.signal, onTextDelta).then((result) => {
+            return this.withSlot(() => this.execCli(command6, freshArgs, env3, freshPrompt || "(continue)", opts.signal, onTextDelta)).then((result) => {
               this.sessions.set(key2, {
                 sessionId: freshId,
                 seenMessages: opts.messages.length,
@@ -66810,7 +66900,7 @@ User: ${overridePrompt}` : "");
               }
               const resultText = finalResult?.result || accumulatedText;
               if (resultText && resultText.length < 300 && /^\s*failed to authenticate|^\s*api error: 4\d\d/i.test(resultText)) {
-                reject(new Error(`claude-cli subscription auth failed \u2014 run \`claude login\` to re-authenticate. CLI said: ${resultText.slice(0, 200)}`));
+                reject(new Error(`claude-cli could not authenticate \u2014 run \`claude\` once in a terminal to sign in (or check its Bedrock settings). CLI said: ${resultText.slice(0, 200)}`));
                 return;
               }
               if (code !== 0 && !accumulatedText && !finalResult) {
@@ -67044,7 +67134,7 @@ function getContextThreshold(model, percent) {
 }
 async function resolveForCall(config) {
   const fullConfig = await getConfig();
-  const providerName = config?.provider ?? fullConfig.agent?.main_provider ?? "bedrock";
+  const providerName = config?.provider ?? resolveMainProviderName(fullConfig);
   const hasExplicitProviders = fullConfig.providers && Object.keys(fullConfig.providers).length > 0;
   let providers = hasExplicitProviders ? buildProviderMap(fullConfig.providers, fullConfig) : synthesizeFromLegacy(fullConfig);
   const resolved = resolveProvider(providerName, providers);
@@ -67114,6 +67204,7 @@ var init_model = __esm({
     "use strict";
     init_config_manager();
     init_registry2();
+    init_default_provider();
     init_defaults();
     init_model_catalog();
   }
@@ -68554,7 +68645,7 @@ __export(cheap_model_exports, {
 });
 function fastModelFor(config) {
   if (config.agent?.fast_model) return config.agent.fast_model;
-  const providerName = config.agent?.main_provider ?? "bedrock";
+  const providerName = resolveMainProviderName(config);
   return MODEL_CATALOG[providerName]?.find(
     (model) => model.id.toLowerCase().includes("haiku")
   )?.id;
@@ -68566,6 +68657,7 @@ var init_cheap_model = __esm({
   "src/core/cheap-model.ts"() {
     "use strict";
     init_model_catalog();
+    init_default_provider();
   }
 });
 
@@ -70385,7 +70477,20 @@ async function applySnapshot(sessionId, snapshot2, source) {
   if (projected !== "error") {
     updates.errorMessage = void 0;
     updates.errorKind = void 0;
-    clearSuppressedErrorReason(sessionId);
+    const stashedStop = projected === "stopped" ? takeSuppressedErrorReason(sessionId) : null;
+    if (stashedStop?.message) {
+      updates.errorMessage = stashedStop.message;
+      if (stashedStop.kind) updates.errorKind = stashedStop.kind;
+      log.session.info("snapshot projection adopted suppressed stop reason", {
+        sessionId,
+        suppressedReason: stashedStop.reason,
+        kind: stashedStop.kind ?? null,
+        projected,
+        source
+      });
+    } else {
+      clearSuppressedErrorReason(sessionId);
+    }
   } else {
     let droppedDisproven = false;
     if (assertsHostUnreachable(record)) {
@@ -74459,6 +74564,26 @@ var init_transcript_chain = __esm({
   }
 });
 
+// src/core/sessions/side-thread-warmup.ts
+function isCacheWarmupText(text) {
+  return text.startsWith(CACHE_WARMUP_TAG);
+}
+function markWarmupTurnPending(sessionId) {
+  pendingWarmupTurns.add(sessionId);
+}
+function consumeWarmupTurn(sessionId) {
+  return pendingWarmupTurns.delete(sessionId);
+}
+var CACHE_WARMUP_TAG, CACHE_WARMUP_MESSAGE, pendingWarmupTurns;
+var init_side_thread_warmup = __esm({
+  "src/core/sessions/side-thread-warmup.ts"() {
+    "use strict";
+    CACHE_WARMUP_TAG = "<walnut-cache-warmup>";
+    CACHE_WARMUP_MESSAGE = `${CACHE_WARMUP_TAG}This is a cache warm-up from the tool hosting this side thread, not a user message. Reply with exactly one word: Ready. Use no tools and add nothing else.</walnut-cache-warmup>`;
+    pendingWarmupTurns = /* @__PURE__ */ new Set();
+  }
+});
+
 // src/core/history-disk-cache.ts
 var history_disk_cache_exports = {};
 __export(history_disk_cache_exports, {
@@ -76619,6 +76744,7 @@ __export(session_lifecycle_exports, {
   retrySession: () => retrySession,
   terminateSession: () => terminateSession
 });
+import { randomUUID as randomUUID4 } from "crypto";
 async function readProviderSessionHistory(sessionId, record, nativeHost, skipSubagents = true, opts) {
   if (record && engineCaps(record.engine).historySource === "acp-journal") {
     const { readAcpSessionHistoryState: readAcpSessionHistoryState2 } = await Promise.resolve().then(() => (init_acp_session_history(), acp_session_history_exports));
@@ -76729,6 +76855,33 @@ async function changeSessionMode(existingRecord, sessionId, mode, updates = {})
   });
   return updated;
 }
+function normalizePinQuote(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new SessionControlError("pinned_messages[].quote must be an object", 400);
+  }
+  const quote = value;
+  const exact = quote.exact;
+  if (typeof exact !== "string" || !exact.trim() || exact.length > MAX_PIN_QUOTE_CHARS) {
+    throw new SessionControlError(
+      `pinned_messages[].quote.exact must be a non-empty string (max ${MAX_PIN_QUOTE_CHARS} chars)`,
+      400
+    );
+  }
+  for (const side of ["prefix", "suffix"]) {
+    const context = quote[side];
+    if (context !== void 0 && context !== null && (typeof context !== "string" || context.length > MAX_PIN_QUOTE_CONTEXT_CHARS)) {
+      throw new SessionControlError(
+        `pinned_messages[].quote.${side} must be a string (max ${MAX_PIN_QUOTE_CONTEXT_CHARS} chars)`,
+        400
+      );
+    }
+  }
+  return {
+    exact,
+    ...typeof quote.prefix === "string" && quote.prefix ? { prefix: quote.prefix } : {},
+    ...typeof quote.suffix === "string" && quote.suffix ? { suffix: quote.suffix } : {}
+  };
+}
 function normalizePinnedMessages(value) {
   if (!Array.isArray(value)) {
     throw new SessionControlError("pinned_messages must be an array", 400);
@@ -76737,7 +76890,9 @@ function normalizePinnedMessages(value) {
     throw new SessionControlError(`pinned_messages holds at most ${MAX_PINNED_MESSAGES} entries`, 400);
   }
   const out = [];
-  const seen = /* @__PURE__ */ new Set();
+  const seenWholeMessage = /* @__PURE__ */ new Set();
+  const seenQuoteId = /* @__PURE__ */ new Set();
+  const seenQuoteShape = /* @__PURE__ */ new Set();
   for (const raw of value) {
     if (!raw || typeof raw !== "object") {
       throw new SessionControlError("each pinned_messages entry must be an object", 400);
@@ -76747,13 +76902,40 @@ function normalizePinnedMessages(value) {
     if (typeof msgId !== "string" || !msgId.trim() || msgId.length > MAX_PIN_ID_CHARS) {
       throw new SessionControlError("pinned_messages[].msgId must be a non-empty string", 400);
     }
-    if (seen.has(msgId)) continue;
-    seen.add(msgId);
+    const rawId = entry.id;
+    if (rawId !== void 0 && rawId !== null && (typeof rawId !== "string" || !rawId.trim() || rawId.length > MAX_PIN_ENTRY_ID_CHARS)) {
+      throw new SessionControlError(
+        `pinned_messages[].id must be a non-empty string (max ${MAX_PIN_ENTRY_ID_CHARS} chars)`,
+        400
+      );
+    }
+    const id = typeof rawId === "string" ? rawId : void 0;
+    const quote = entry.quote === void 0 || entry.quote === null ? void 0 : normalizePinQuote(entry.quote);
+    let pinId = id;
+    if (quote) {
+      if (id && seenQuoteId.has(id)) continue;
+      const shape = [msgId, quote.exact, quote.prefix ?? "", quote.suffix ?? ""].join("\0");
+      if (seenQuoteShape.has(shape)) continue;
+      pinId = id ?? randomUUID4();
+      seenQuoteId.add(pinId);
+      seenQuoteShape.add(shape);
+    } else {
+      if (seenWholeMessage.has(msgId)) continue;
+      seenWholeMessage.add(msgId);
+    }
     const role = entry.role === "user" || entry.role === "assistant" || entry.role === "system" ? entry.role : "assistant";
     const label = typeof entry.label === "string" ? entry.label.trim().slice(0, MAX_PIN_LABEL_CHARS) : "";
     const timestamp = typeof entry.timestamp === "string" ? entry.timestamp : void 0;
     const pinnedAt = typeof entry.pinnedAt === "string" ? entry.pinnedAt : (/* @__PURE__ */ new Date()).toISOString();
-    out.push({ msgId, label, role, ...timestamp ? { timestamp } : {}, pinnedAt });
+    out.push({
+      msgId,
+      label,
+      role,
+      ...timestamp ? { timestamp } : {},
+      pinnedAt,
+      ...pinId ? { id: pinId } : {},
+      ...quote ? { quote } : {}
+    });
   }
   return out;
 }
@@ -77412,7 +77594,7 @@ async function readSessionRichHistory(sessionId, tail) {
     ...historyWindowed ? { windowed: true } : {}
   };
 }
-var CLAUDE_SESSION_MODES, MAX_PINNED_MESSAGES, MAX_PIN_LABEL_CHARS, MAX_PIN_ID_CHARS, RECHECK_RPC_TIMEOUT_MS, RECHECK_TIMED_OUT, GIT_BASES, MAX_FORK_DEPTH, HISTORY_STARTUP_GRACE_MS;
+var CLAUDE_SESSION_MODES, MAX_PINNED_MESSAGES, MAX_PIN_LABEL_CHARS, MAX_PIN_ID_CHARS, MAX_PIN_ENTRY_ID_CHARS, MAX_PIN_QUOTE_CHARS, MAX_PIN_QUOTE_CONTEXT_CHARS, RECHECK_RPC_TIMEOUT_MS, RECHECK_TIMED_OUT, GIT_BASES, MAX_FORK_DEPTH, HISTORY_STARTUP_GRACE_MS;
 var init_session_lifecycle = __esm({
   "src/core/sessions/session-lifecycle.ts"() {
     "use strict";
@@ -77426,6 +77608,9 @@ var init_session_lifecycle = __esm({
     MAX_PINNED_MESSAGES = 200;
     MAX_PIN_LABEL_CHARS = 300;
     MAX_PIN_ID_CHARS = 200;
+    MAX_PIN_ENTRY_ID_CHARS = 64;
+    MAX_PIN_QUOTE_CHARS = 2e3;
+    MAX_PIN_QUOTE_CONTEXT_CHARS = 64;
     RECHECK_RPC_TIMEOUT_MS = 5e3;
     RECHECK_TIMED_OUT = /* @__PURE__ */ Symbol("recheck-timeout");
     GIT_BASES = /* @__PURE__ */ new Set(["uncommitted", "previous", "remote"]);
@@ -77728,7 +77913,7 @@ __export(compact_inject_exports, {
   extractSessionMeta: () => extractSessionMeta,
   injectCompactBoundary: () => injectCompactBoundary
 });
-import { randomUUID as randomUUID4 } from "crypto";
+import { randomUUID as randomUUID5 } from "crypto";
 import fsp26 from "fs/promises";
 async function extractSessionMeta(jsonlPath) {
   const content = await fsp26.readFile(jsonlPath, "utf-8");
@@ -77780,8 +77965,8 @@ async function injectCompactBoundary(jsonlPath, summary, meta) {
     log.session.error("Could not find last message UUID in JSONL", { jsonlPath });
     return null;
   }
-  const boundaryUuid = randomUUID4();
-  const summaryUuid = randomUUID4();
+  const boundaryUuid = randomUUID5();
+  const summaryUuid = randomUUID5();
   const now = /* @__PURE__ */ new Date();
   const boundaryTs = now.toISOString();
   const summaryTs = new Date(now.getTime() + 1e3).toISOString();
@@ -88565,6 +88750,82 @@ var init_task = __esm({
   }
 });
 
+// src/core/sessions/spawn-prefix.ts
+var spawn_prefix_exports = {};
+__export(spawn_prefix_exports, {
+  MAX_SPAWN_PROMPT_BYTES: () => MAX_SPAWN_PROMPT_BYTES,
+  parseSpawnPrefixFromArgs: () => parseSpawnPrefixFromArgs,
+  readParentSpawnPrefix: () => readParentSpawnPrefix,
+  spawnPrefixFromRecord: () => spawnPrefixFromRecord
+});
+function flagValue(args, flag) {
+  const i8 = args.indexOf(flag);
+  if (i8 < 0 || i8 + 1 >= args.length) return void 0;
+  const v3 = args[i8 + 1];
+  return v3 !== void 0 && !v3.startsWith("--") ? v3 : void 0;
+}
+function parseSpawnPrefixFromArgs(args) {
+  const prompt = flagValue(args, "--append-system-prompt");
+  return {
+    appendSystemPrompt: prompt !== void 0 && Buffer.byteLength(prompt, "utf8") <= MAX_SPAWN_PROMPT_BYTES ? prompt : null,
+    ...flagValue(args, "--model") ? { model: flagValue(args, "--model") } : {},
+    ...EFFORTS.includes(flagValue(args, "--effort") ?? "") ? { effort: flagValue(args, "--effort") } : {},
+    ...flagValue(args, "--permission-mode") ? { permissionMode: flagValue(args, "--permission-mode") } : {},
+    source: "live-process"
+  };
+}
+function spawnPrefixFromRecord(record) {
+  const stored = record.appliedAppendSystemPrompt;
+  if (stored === void 0 || stored === null) return { appendSystemPrompt: null, source: "unknown" };
+  const usable = stored.length > 0 && Buffer.byteLength(stored, "utf8") <= MAX_SPAWN_PROMPT_BYTES;
+  return { appendSystemPrompt: usable ? stored : null, source: "record" };
+}
+async function defaultLiveArgsReader(hostKey2, sessionId) {
+  const { probeDaemonSessionArgs: probeDaemonSessionArgs2 } = await Promise.resolve().then(() => (init_daemon_connection(), daemon_connection_exports));
+  return probeDaemonSessionArgs2(hostKey2, sessionId);
+}
+async function readParentSpawnPrefix(parent, deps = {}) {
+  const readLiveArgs = deps.readLiveArgs ?? defaultLiveArgsReader;
+  const hostKey2 = parent.host || "__local__";
+  let live = null;
+  try {
+    live = await readLiveArgs(hostKey2, parent.claudeSessionId);
+  } catch (err2) {
+    log.session.debug("spawn prefix: live argv read threw", {
+      sessionId: parent.claudeSessionId,
+      error: err2 instanceof Error ? err2.message : String(err2)
+    });
+  }
+  if (live && live.length > 0) {
+    const prefix = parseSpawnPrefixFromArgs(live);
+    const remembered = parent.appliedAppendSystemPrompt ?? void 0;
+    const actual = prefix.appendSystemPrompt ?? "";
+    if (remembered !== actual) {
+      const persist4 = deps.persist ?? (async (sid, prompt) => {
+        const { updateSessionRecord: updateSessionRecord2 } = await Promise.resolve().then(() => (init_session_tracker(), session_tracker_exports));
+        return updateSessionRecord2(sid, { appliedAppendSystemPrompt: prompt });
+      });
+      void persist4(parent.claudeSessionId, actual).catch((err2) => {
+        log.session.warn("spawn prefix: backfill of applied prompt failed", {
+          sessionId: parent.claudeSessionId,
+          error: err2 instanceof Error ? err2.message : String(err2)
+        });
+      });
+    }
+    return prefix;
+  }
+  return spawnPrefixFromRecord(parent);
+}
+var EFFORTS, MAX_SPAWN_PROMPT_BYTES;
+var init_spawn_prefix = __esm({
+  "src/core/sessions/spawn-prefix.ts"() {
+    "use strict";
+    init_logging();
+    EFFORTS = ["low", "medium", "high", "xhigh", "max"];
+    MAX_SPAWN_PROMPT_BYTES = 65536;
+  }
+});
+
 // src/core/sessions/side-thread-fork.ts
 var side_thread_fork_exports = {};
 __export(side_thread_fork_exports, {
@@ -88621,6 +88882,10 @@ async function forkSideThreadSession(parentSid, threadId, opts) {
   const sessionId = crypto16.randomUUID();
   const lane = sideThreadLaneKey(parentSid, threadId);
   const mode = parent.mode !== "default" ? parent.mode : void 0;
+  const { readParentSpawnPrefix: readParentSpawnPrefix2 } = await Promise.resolve().then(() => (init_spawn_prefix(), spawn_prefix_exports));
+  const prefix = await readParentSpawnPrefix2(parent);
+  const cliModel = prefix.model ?? parent.cliModel;
+  const effort = prefix.effort ?? parent.effort;
   await createSessionRecord(sessionId, "", parent.project ?? "", parent.cwd, {
     title,
     ...mode ? { mode } : {},
@@ -88628,8 +88893,10 @@ async function forkSideThreadSession(parentSid, threadId, opts) {
     // The thread inherits the parent's launch bundle verbatim, re-applied from
     // the record on every cold resume.
     ...parent.profile ? { profile: parent.profile } : {},
-    ...parent.effort ? { effort: parent.effort } : {},
-    ...parent.cliModel ? { cliModel: parent.cliModel } : {},
+    ...effort ? { effort } : {},
+    ...cliModel ? { cliModel } : {},
+    // '' = the parent runs without an append prompt, and so does the thread.
+    appliedAppendSystemPrompt: prefix.appendSystemPrompt ?? "",
     lane,
     forkedFromSessionId: resumeFrom,
     initialProcessStatus: "idle",
@@ -88645,11 +88912,12 @@ async function forkSideThreadSession(parentSid, threadId, opts) {
     ...mode ? { mode } : {},
     ...parent.host ? { host: parent.host } : {},
     ...parent.profile ? { profile: parent.profile } : {},
-    ...parent.effort ? { effort: parent.effort } : {},
+    ...effort ? { effort } : {},
     // Must be `cliModel` (the parent's verbatim --model arg, [1m] marker
     // included): the CLI does NOT inherit a model across --fork-session, and
     // the reported `model` has lost the marker.
-    ...parent.cliModel ? { model: parent.cliModel } : {},
+    ...cliModel ? { model: cliModel } : {},
+    appendSystemPromptExact: prefix.appendSystemPrompt,
     lane,
     forkedFromSessionId: resumeFrom
   }, ["session-runner"], { source: "side-thread-fork" });
@@ -88658,7 +88926,9 @@ async function forkSideThreadSession(parentSid, threadId, opts) {
     threadId,
     sessionId,
     resumeFrom,
-    initOnly: !opts?.message
+    initOnly: !opts?.message,
+    prefixSource: prefix.source,
+    prefixPromptLength: prefix.appendSystemPrompt?.length ?? 0
   });
   return { sessionId, resumeFromSessionId: resumeFrom };
 }
@@ -100914,14 +101184,16 @@ function isLive(r8) {
 function isRevivable(r8) {
   return !!r8.outputFile || r8.consumedOffset !== void 0;
 }
-var STANDBY_TTL_MS, MAX_LIVE_THREADS, IDLE_SWEEP_INTERVAL_MS, THREAD_IDLE_MS, SideThreadManager, sideThreadManager;
+var STANDBY_TTL_MS, WARMED_STANDBY_TTL_MS, MAX_LIVE_THREADS, IDLE_SWEEP_INTERVAL_MS, THREAD_IDLE_MS, SideThreadManager, sideThreadManager;
 var init_side_thread_manager = __esm({
   "src/core/sessions/side-thread-manager.ts"() {
     "use strict";
     init_logging();
     init_side_thread_fork();
     init_session_controls();
+    init_side_thread_warmup();
     STANDBY_TTL_MS = 12e4;
+    WARMED_STANDBY_TTL_MS = 15 * 6e4;
     MAX_LIVE_THREADS = 3;
     IDLE_SWEEP_INTERVAL_MS = 5 * 6e4;
     THREAD_IDLE_MS = 30 * 6e4;
@@ -100932,6 +101204,8 @@ var init_side_thread_manager = __esm({
        *  In-memory only: a server restart loses it, but the boot sweep archives
        *  every standby anyway, so a record can never outlive its map entry. */
       standbyParentOffsets = /* @__PURE__ */ new Map();
+      /** parentSid → standby sid that already ran its cache warm-up turn. */
+      warmedStandbys = /* @__PURE__ */ new Map();
       /** One in-flight standby/create op per parent — two concurrent asks must not
        *  both consume the same standby (they would collide on its lane rename). */
       inFlight = /* @__PURE__ */ new Map();
@@ -100963,6 +101237,7 @@ var init_side_thread_manager = __esm({
         for (const timer3 of this.standbyTimers.values()) clearTimeout(timer3);
         this.standbyTimers.clear();
         this.standbyParentOffsets.clear();
+        this.warmedStandbys.clear();
         this.inFlight.clear();
       }
       // ── Standby ────────────────────────────────────────────────────────────────
@@ -100978,10 +101253,12 @@ var init_side_thread_manager = __esm({
           const existing = await this.findStandby(parentSid);
           if (existing) {
             if (await this.isStandbyUsable(parentSid, existing)) {
-              this.armStandbyTtl(parentSid, existing.claudeSessionId);
+              const warmed = this.warmedStandbys.get(parentSid) === existing.claudeSessionId;
+              this.armStandbyTtl(parentSid, existing.claudeSessionId, warmed ? WARMED_STANDBY_TTL_MS : STANDBY_TTL_MS);
               return existing.claudeSessionId;
             }
             void this.retireSession(existing.claudeSessionId, "side_thread_standby_stale");
+            this.warmedStandbys.delete(parentSid);
           }
           const parentOffset = parent.consumedOffset;
           const { sessionId } = await forkSideThreadSession(parentSid, STANDBY_THREAD_ID);
@@ -101007,7 +101284,7 @@ var init_side_thread_manager = __esm({
         if (!parent) return false;
         return parent.consumedOffset === this.standbyParentOffsets.get(parentSid);
       }
-      armStandbyTtl(parentSid, sessionId) {
+      armStandbyTtl(parentSid, sessionId, ttlMs = STANDBY_TTL_MS) {
         const prev = this.standbyTimers.get(parentSid);
         if (prev) clearTimeout(prev);
         const timer3 = setTimeout(() => {
@@ -101017,13 +101294,41 @@ var init_side_thread_manager = __esm({
             const record = await getSessionByClaudeId2(sessionId).catch(() => null);
             if (!record || parseSideLaneKey(record.lane)?.threadId !== STANDBY_THREAD_ID) return;
             this.standbyParentOffsets.delete(parentSid);
+            this.warmedStandbys.delete(parentSid);
             await this.retireSession(sessionId, "side_thread_standby_ttl");
           }).catch(() => {
           });
-        }, STANDBY_TTL_MS);
+        }, ttlMs);
         timer3.unref?.();
         this.standbyTimers.set(parentSid, timer3);
       }
+      /**
+       * Run the standby's cache warm-up turn (see side-thread-warmup.ts). Called
+       * when the user starts TYPING a new question: the fork's first API call pays
+       * the full prefix write no matter what, so paying it while they type turns
+       * the actual question into a cached follow-up. Idempotent per standby; a
+       * missing or stale standby is a no-op (the ask path will fork fresh anyway).
+       */
+      async warmStandby(parentSid) {
+        return this.serialize(parentSid, async () => {
+          const standby = await this.findStandby(parentSid);
+          if (!standby) return { warmed: false, reason: "no_standby" };
+          if (!await this.isStandbyUsable(parentSid, standby)) return { warmed: false, reason: "stale" };
+          if (this.warmedStandbys.get(parentSid) === standby.claudeSessionId) {
+            return { warmed: true, reason: "already_warm" };
+          }
+          const { sendMessageToSession: sendMessageToSession2 } = await Promise.resolve().then(() => (init_session_message_queue(), session_message_queue_exports));
+          markWarmupTurnPending(standby.claudeSessionId);
+          await sendMessageToSession2(standby.claudeSessionId, CACHE_WARMUP_MESSAGE, { source: "side-thread-warmup" });
+          this.warmedStandbys.set(parentSid, standby.claudeSessionId);
+          this.armStandbyTtl(parentSid, standby.claudeSessionId, WARMED_STANDBY_TTL_MS);
+          log.session.info("side thread: standby cache warm-up sent", {
+            parentSid,
+            standbySid: standby.claudeSessionId
+          });
+          return { warmed: true };
+        });
+      }
       // ── Threads ────────────────────────────────────────────────────────────────
       /**
        * Open a side thread on `parentSid` and ask `question` in it.
@@ -101034,6 +101339,10 @@ var init_side_thread_manager = __esm({
        * question as its spawn's first turn instead — a send issued right after
        * SESSION_START can lose that race and cold-`--resume` an id the CLI has never
        * seen (see personal-ai-lane.ts LaneSession.created).
+       *
+       * `imageContext` (attachment paths for the CLI to Read) rides the MESSAGE only.
+       * The stored entry keeps the plain question, so the chip label, the injected
+       * transcript and a promoted task never carry the machine preamble.
        */
       async createThread(parentSid, input) {
         const question = input.question?.trim();
@@ -101041,8 +101350,11 @@ var init_side_thread_manager = __esm({
         return this.serialize(parentSid, async () => {
           const threadId = mintSideThreadId();
           const title = input.title?.trim() || void 0;
+          const message = input.imageContext ? `${input.imageContext}
+
+${question}` : question;
           const consumed = await this.consumeStandby(parentSid, threadId, title);
-          const threadSessionId = consumed ?? (await forkSideThreadSession(parentSid, threadId, { message: question, ...title ? { title } : {} })).sessionId;
+          const threadSessionId = consumed ?? (await forkSideThreadSession(parentSid, threadId, { message, ...title ? { title } : {} })).sessionId;
           let entry;
           try {
             const { addSideThread: addSideThread2 } = await Promise.resolve().then(() => (init_side_questions(), side_questions_exports));
@@ -101054,7 +101366,7 @@ var init_side_thread_manager = __esm({
             });
             if (consumed) {
               const { sendMessageToSession: sendMessageToSession2 } = await Promise.resolve().then(() => (init_session_message_queue(), session_message_queue_exports));
-              await sendMessageToSession2(threadSessionId, question, { source: "side-thread" });
+              await sendMessageToSession2(threadSessionId, message, { source: "side-thread" });
             }
           } catch (err2) {
             void this.retireSession(threadSessionId, "side_thread_create_failed");
@@ -101089,6 +101401,7 @@ var init_side_thread_manager = __esm({
         if (!await this.isStandbyUsable(parentSid, standby)) {
           void this.retireSession(standby.claudeSessionId, "side_thread_standby_stale");
           this.standbyParentOffsets.delete(parentSid);
+          this.warmedStandbys.delete(parentSid);
           return null;
         }
         const timer3 = this.standbyTimers.get(parentSid);
@@ -101097,6 +101410,7 @@ var init_side_thread_manager = __esm({
           this.standbyTimers.delete(parentSid);
         }
         this.standbyParentOffsets.delete(parentSid);
+        this.warmedStandbys.delete(parentSid);
         const lane = sideThreadLaneKey(parentSid, threadId);
         const { updateSessionRecord: updateSessionRecord2 } = await Promise.resolve().then(() => (init_session_tracker(), session_tracker_exports));
         await updateSessionRecord2(standby.claudeSessionId, {
@@ -101283,16 +101597,30 @@ async function promoteSideThread(parentSid, threadId, opts) {
   const threadRecord = await getSessionByClaudeId2(sessionId);
   if (!threadRecord) throw new SessionControlError("Side thread session not found", 404);
   const parentRecord = await getSessionByClaudeId2(parentSid);
-  const parentTaskId = parentRecord?.taskId?.trim() || void 0;
-  const title = opts?.title?.trim() || entry.title?.trim() || entry.question;
+  const siblingOfTaskId = parentRecord?.taskId?.trim() || void 0;
+  const threadLabel = opts?.title?.trim() || entry.title?.trim() || void 0;
   const { addTask: addTask2, linkSession: linkSession2, linkSessionSlot: linkSessionSlot2 } = await Promise.resolve().then(() => (init_task_manager(), task_manager_exports));
-  const { task } = await addTask2({
-    title,
-    description: entry.question,
-    ...parentTaskId ? { parent_task_id: parentTaskId } : {},
-    // A person clicked "promote" — same board default as any hand-made task.
-    pinned: true
-  });
+  let groupId;
+  let task;
+  if (siblingOfTaskId) {
+    const created = await createForkSiblingTask(siblingOfTaskId, {
+      // A known label short-circuits the background refine; without one the
+      // thread's first question is what gets summarized (same as a fork's message).
+      titlePrefix: threadLabel,
+      prompt: entry.question,
+      description: entry.question,
+      source: "side-thread-promote"
+    });
+    task = created.task;
+    groupId = created.groupId;
+  } else {
+    ({ task } = await addTask2({
+      title: threadLabel || entry.question,
+      description: entry.question,
+      // A person clicked "promote" — same board default as any hand-made task.
+      pinned: true
+    }));
+  }
   const stamped = await markThreadPromoted2(parentSid, threadId, task.id);
   if (!stamped) {
     log.session.warn("side thread promote: entry vanished before stamp \u2014 promote proceeds, 409 guard is unarmed", {
@@ -101306,7 +101634,7 @@ async function promoteSideThread(parentSid, threadId, opts) {
     project: task.project ?? "",
     // Clearing the lane un-hides the session (see the file header).
     lane: void 0,
-    title
+    title: task.title
   });
   try {
     const { sessionRunner: sessionRunner2 } = await Promise.resolve().then(() => (init_claude_code_session(), claude_code_session_exports));
@@ -101325,10 +101653,18 @@ async function promoteSideThread(parentSid, threadId, opts) {
       error: err2 instanceof Error ? err2.message : String(err2)
     });
   }
-  log.session.info("side thread: promoted to task", { parentSid, threadId, sessionId, taskId: task.id });
+  log.session.info("side thread: promoted to task", {
+    parentSid,
+    threadId,
+    sessionId,
+    taskId: task.id,
+    siblingOfTaskId,
+    groupId
+  });
   return {
     taskId: task.id,
-    ...task.parent_task_id ? { parentTaskId: task.parent_task_id } : {},
+    ...siblingOfTaskId ? { siblingOfTaskId } : {},
+    ...groupId ? { groupId } : {},
     sessionId
   };
 }
@@ -101343,7 +101679,7 @@ var init_side_thread_promote = __esm({
 
 // src/web/routes/sessions.ts
 import { Router as Router10 } from "express";
-import { randomUUID as randomUUID5 } from "crypto";
+import { randomUUID as randomUUID6 } from "crypto";
 import os19 from "os";
 import path91 from "path";
 function condenseStaleReason(msg) {
@@ -101689,7 +102025,7 @@ var init_sessions2 = __esm({
           }
           const isNativeEngine = !isAcpEngine(engine);
           const clientSessionId = typeof req.body.sessionId === "string" && UUID_RE2.test(req.body.sessionId) ? req.body.sessionId : void 0;
-          const preassignedSessionId = isNativeEngine ? clientSessionId ?? randomUUID5() : void 0;
+          const preassignedSessionId = isNativeEngine ? clientSessionId ?? randomUUID6() : void 0;
           const updatedTask = await quickStartSession({
             message: sessionMessage,
             messagePrefix,
@@ -102664,18 +103000,38 @@ var init_sessions2 = __esm({
         });
       }
     });
+    sessionsRouter.post("/:sessionId/side-threads/standby/warm", async (req, res) => {
+      if (refuseSideThreadsOnReplica(res)) return;
+      const sessionId = String(req.params.sessionId);
+      try {
+        const { sideThreadManager: sideThreadManager2 } = await Promise.resolve().then(() => (init_side_thread_manager(), side_thread_manager_exports));
+        res.json(await sideThreadManager2.warmStandby(sessionId));
+      } catch (err2) {
+        log.web.warn("side thread standby warm-up failed", {
+          sessionId,
+          error: err2 instanceof Error ? err2.message : String(err2)
+        });
+        res.json({ warmed: false, reason: "error" });
+      }
+    });
     sessionsRouter.post("/:sessionId/side-threads", async (req, res, next) => {
       if (refuseSideThreadsOnReplica(res)) return;
       try {
-        const { question, title } = req.body ?? {};
+        const { question, title, images } = req.body ?? {};
         if (!question || typeof question !== "string" || !question.trim()) {
           res.status(400).json({ error: "question (non-empty string) is required" });
           return;
         }
+        let imageContext = "";
+        if (images && images.length > 0) {
+          const processed = await processAndSaveImages(images);
+          if (processed) imageContext = buildSessionImageContext(processed.savedImages);
+        }
         const { sideThreadManager: sideThreadManager2 } = await Promise.resolve().then(() => (init_side_thread_manager(), side_thread_manager_exports));
         const thread = await sideThreadManager2.createThread(String(req.params.sessionId), {
           question,
-          ...typeof title === "string" && title.trim() ? { title } : {}
+          ...typeof title === "string" && title.trim() ? { title } : {},
+          ...imageContext ? { imageContext } : {}
         });
         res.json({ thread });
       } catch (err2) {
@@ -102694,7 +103050,8 @@ var init_sessions2 = __esm({
         );
         res.json({
           taskId: result.taskId,
-          ...result.parentTaskId ? { parentTaskId: result.parentTaskId } : {},
+          ...result.siblingOfTaskId ? { siblingOfTaskId: result.siblingOfTaskId } : {},
+          ...result.groupId ? { groupId: result.groupId } : {},
           sessionId: result.sessionId
         });
       } catch (err2) {
@@ -103389,7 +103746,7 @@ var micro_claude_exports = {};
 __export(micro_claude_exports, {
   runMicroClaude: () => runMicroClaude
 });
-import { randomUUID as randomUUID6 } from "crypto";
+import { randomUUID as randomUUID7 } from "crypto";
 async function runMicroClaude(opts) {
   if (opts.warm) {
     const run10 = await runWarmMicroClaude({
@@ -103398,7 +103755,7 @@ async function runMicroClaude(opts) {
       tools: opts.tools ?? [],
       prompt: opts.prompt,
       timeoutMs: opts.timeoutMs ?? DEFAULT_TIMEOUT_MS2,
-      toolUseId: opts.toolUseId ?? `micro-claude-${randomUUID6()}`,
+      toolUseId: opts.toolUseId ?? `micro-claude-${randomUUID7()}`,
       ...opts.onBlock ? { onBlock: opts.onBlock } : {}
     });
     return { response: run10.response, costUsd: run10.costUsd, durationMs: run10.durationMs };
@@ -103408,7 +103765,7 @@ async function runMicroClaude(opts) {
     systemPrompt: opts.system,
     model: opts.model ?? DEFAULT_MODEL2,
     timeoutMs: opts.timeoutMs ?? DEFAULT_TIMEOUT_MS2,
-    toolUseId: opts.toolUseId ?? `micro-claude-${randomUUID6()}`,
+    toolUseId: opts.toolUseId ?? `micro-claude-${randomUUID7()}`,
     slim: true,
     thinking: opts.thinking ?? false,
     ...opts.tools && opts.tools.length > 0 ? { tools: opts.tools } : {},
@@ -104233,7 +104590,7 @@ __export(micro_agent_exports, {
 async function resolveTierModel(tier) {
   const { getConfig: getConfig2 } = await Promise.resolve().then(() => (init_config_manager(), config_manager_exports));
   const config = await getConfig2();
-  const provider = config.agent?.main_provider ?? "bedrock";
+  const provider = resolveMainProviderName(config);
   const { MODEL_CATALOG: MODEL_CATALOG3 } = await Promise.resolve().then(() => (init_model_catalog(), model_catalog_exports));
   const entry = MODEL_CATALOG3[provider]?.find((m6) => {
     const id = m6.id.toLowerCase();
@@ -104302,6 +104659,7 @@ var DEFAULT_TIER, DEFAULT_MAX_TOKENS2, DEFAULT_MAX_ROUNDS, DEFAULT_TIMEOUT_MS3;
 var init_micro_agent = __esm({
   "src/agent/micro-agent.ts"() {
     "use strict";
+    init_default_provider();
     DEFAULT_TIER = "sonnet";
     DEFAULT_MAX_TOKENS2 = 2e3;
     DEFAULT_MAX_ROUNDS = 3;
@@ -104317,7 +104675,7 @@ __export(task_search_agent_exports, {
   prewarmAgentSearchChild: () => prewarmAgentSearchChild,
   runTaskSearchAgent: () => runTaskSearchAgent
 });
-import { randomUUID as randomUUID7 } from "crypto";
+import { randomUUID as randomUUID8 } from "crypto";
 function useCliEngine() {
   return process.env.WALNUT_AGENT_SEARCH_ENGINE !== "inprocess";
 }
@@ -104397,7 +104755,7 @@ async function claudeCliEngine(userPrompt, options) {
     model: options.model,
     timeoutMs: options.timeoutMs,
     tools: ["Bash"],
-    toolUseId: `task-search-${randomUUID7()}`,
+    toolUseId: `task-search-${randomUUID8()}`,
     warm: true,
     onBlock
   });
@@ -105660,10 +106018,11 @@ async function buildProvidersPayload() {
       providers[name] = {
         api: prov.api,
         base_url: prov.base_url,
-        status: caps.subscriptionReady ? "ready" : "no_key",
+        status: caps.installed ? "ready" : "no_key",
         auto_detected: !explicitNames.has(name),
         models: getModelsForProvider(name, prov.models),
-        credential_source: caps.subscriptionReady ? "subscription" : caps.installed ? "cli_no_subscription" : "cli_not_installed"
+        credential_source: caps.installed ? `cli_${caps.auth.mode}` : "cli_not_installed",
+        credential_detail: caps.installed ? caps.auth.label : void 0
       };
       continue;
     }
@@ -105722,10 +106081,11 @@ async function buildProvidersPayload() {
         const caps = detectClaudeCli2();
         providers[name] = {
           api: template.api,
-          status: caps.subscriptionReady ? "ready" : "no_key",
+          status: caps.installed ? "ready" : "no_key",
           auto_detected: false,
           models: getModelsForProvider(name),
-          credential_source: caps.subscriptionReady ? "subscription" : caps.installed ? "cli_no_subscription" : "cli_not_installed"
+          credential_source: caps.installed ? `cli_${caps.auth.mode}` : "cli_not_installed",
+          credential_detail: caps.installed ? caps.auth.label : void 0
         };
         continue;
       }
@@ -105881,7 +106241,7 @@ var init_config11 = __esm({
         const {
           traceCredentialResolution: traceCredentialResolution2,
           resolveCredentials: resolveCredentials2,
-          readClaudeSettingsEnv: readClaudeSettingsEnv2,
+          readClaudeSettingsEnv: readClaudeSettingsEnv3,
           readClaudeCredentialExport: readClaudeCredentialExport2
         } = await Promise.resolve().then(() => (init_credential_resolver(), credential_resolver_exports));
         const fs121 = await import("fs");
@@ -105897,7 +106257,7 @@ var init_config11 = __esm({
         };
         const trace = traceCredentialResolution2({
           config,
-          claudeEnv: readClaudeSettingsEnv2(),
+          claudeEnv: readClaudeSettingsEnv3(),
           processEnv: process.env,
           awsFiles: {
             credentials: exists3(path193.join(home, ".aws", "credentials")),
@@ -133332,7 +133692,7 @@ __export(session_requests_exports, {
   settleNotified: () => settleNotified,
   settleReplied: () => settleReplied
 });
-import { createHash as createHash18, randomUUID as randomUUID8 } from "crypto";
+import { createHash as createHash18, randomUUID as randomUUID9 } from "crypto";
 import path137 from "path";
 function oneLine(text, max = 160) {
   const flat = text.replace(/\s+/g, " ").trim();
@@ -133356,7 +133716,7 @@ function clampReplyTimeoutSecs(secs) {
 }
 async function createSessionRequest(input) {
   const request3 = {
-    id: `rq-${randomUUID8().replace(/-/g, "").slice(0, 12)}`,
+    id: `rq-${randomUUID9().replace(/-/g, "").slice(0, 12)}`,
     fromSessionId: input.fromSessionId,
     ...input.toSessionId ? { toSessionId: input.toSessionId } : {},
     ...input.toTaskId ? { toTaskId: input.toTaskId } : {},
@@ -133789,7 +134149,7 @@ __export(task_start_exports, {
   SessionExistsError: () => SessionExistsError,
   startSessionForTask: () => startSessionForTask
 });
-import { randomUUID as randomUUID9 } from "crypto";
+import { randomUUID as randomUUID10 } from "crypto";
 async function startSessionForTask(params) {
   const { taskIdPrefix, source } = params;
   let task;
@@ -133840,7 +134200,7 @@ async function startSessionForTask(params) {
   }
   let message = params.message?.trim() || `Working on task: ${task.title}`;
   const engine = normalizeEngine(params.engine);
-  const preassignedSessionId = engineCaps(engine).idProvisioning === "provider-issued" ? void 0 : randomUUID9();
+  const preassignedSessionId = engineCaps(engine).idProvisioning === "provider-issued" ? void 0 : randomUUID10();
   let requestId;
   if (params.expectReply) {
     const { resolveCaller: resolveCaller2 } = await Promise.resolve().then(() => (init_session_send_core(), session_send_core_exports));
@@ -149338,7 +149698,7 @@ async function generateLedgerDesc(task, timeoutMs = 15e3) {
   try {
     const { getConfig: getConfig2 } = await Promise.resolve().then(() => (init_config_manager(), config_manager_exports));
     const config = await getConfig2();
-    const providerName = config.agent?.main_provider ?? "bedrock";
+    const providerName = resolveMainProviderName(config);
     const model = cheapModelFor(providerName);
     const detail = (task.description ?? "").trim().slice(0, 800);
     const project = (task.project ?? "").trim();
@@ -149397,6 +149757,7 @@ var init_task_ledger_desc = __esm({
     "use strict";
     init_model();
     init_model_catalog();
+    init_default_provider();
     init_logging();
     init_task_manager();
     MAX_DESC_LEN = 120;
@@ -149420,6 +149781,10 @@ function diffStreamedVsPersisted(streamedTextMsgIds, persistedMsgIds) {
 }
 function armStreamConvergenceCheck(sessionId, streamedTextMsgIds) {
   if (streamedTextMsgIds.length === 0) return;
+  if (consumeWarmupTurn(sessionId)) {
+    log.obs.debug("stream-convergence: skipped hidden warm-up turn", { sessionId });
+    return;
+  }
   const timer3 = setTimeout(() => {
     void runCheck(sessionId, streamedTextMsgIds).catch((err2) => {
       log.obs.warn("stream-convergence check failed", {
@@ -149485,6 +149850,7 @@ var init_stream_convergence = __esm({
   "src/core/observability/stream-convergence.ts"() {
     "use strict";
     init_logging();
+    init_side_thread_warmup();
     CHECK_DELAY_MS = 15e3;
     INCIDENT_DEDUPE_MS = 30 * 6e4;
     lastIncidentAt = /* @__PURE__ */ new Map();
@@ -149735,12 +150101,17 @@ function getSystemHealth() {
 }
 async function refreshSystemHealth() {
   systemHealth.claudeCliAvailable = checkClaudeCliAvailable();
-  const cred = await resolveCredentialHealth();
+  applyCredentialHealth(await resolveCredentialHealth());
+  broadcastEvent("system:health", systemHealth);
+  return systemHealth;
+}
+function applyCredentialHealth(cred) {
   systemHealth.hasReadyProvider = cred.hasReadyProvider;
   systemHealth.credentialSource = cred.source;
   systemHealth.credentialDetail = cred.detail;
-  broadcastEvent("system:health", systemHealth);
-  return systemHealth;
+  systemHealth.mainProvider = cred.mainProvider;
+  systemHealth.mainProviderImplicit = cred.mainProviderImplicit;
+  systemHealth.claudeCliAuth = cred.claudeCliAuth;
 }
 function checkClaudeCliAvailable() {
   return isClaudeCliInstalled();
@@ -149750,27 +150121,36 @@ async function resolveCredentialHealth() {
     const { getConfig: getConfig2 } = await Promise.resolve().then(() => (init_config_manager(), config_manager_exports));
     const { resolveCredentials: resolveCredentials2 } = await Promise.resolve().then(() => (init_credential_resolver(), credential_resolver_exports));
     const { buildProviderMap: buildProviderMap2 } = await Promise.resolve().then(() => (init_registry2(), registry_exports));
+    const { resolveMainProviderName: resolveMainProviderName2, mainProviderIsImplicit: mainProviderIsImplicit2 } = await Promise.resolve().then(() => (init_default_provider(), default_provider_exports));
+    const { detectClaudeCli: detectClaudeCli2 } = await Promise.resolve().then(() => (init_claude_cli_detect(), claude_cli_detect_exports));
     const config = await getConfig2();
+    const cli = detectClaudeCli2();
+    const mainProvider = resolveMainProviderName2(config, cli.installed);
+    const base = {
+      mainProvider,
+      mainProviderImplicit: mainProviderIsImplicit2(config),
+      claudeCliAuth: cli.installed ? cli.auth.label : void 0
+    };
+    if (mainProvider === "claude_cli") {
+      return cli.installed ? { ...base, hasReadyProvider: true, source: "config", detail: `claude-cli (${cli.auth.label})` } : { ...base, hasReadyProvider: false, source: "none" };
+    }
     const cred = resolveCredentials2(config);
     if (cred.source !== "none") {
-      return { hasReadyProvider: true, source: cred.source, detail: cred.detail };
+      return { ...base, hasReadyProvider: true, source: cred.source, detail: cred.detail };
     }
     const providers = buildProviderMap2(config.providers, config);
     for (const [, prov] of Object.entries(providers)) {
       if (prov.api === "bedrock" || prov.api === "ollama") continue;
       if (prov.api === "claude-cli") {
-        const { detectClaudeCli: detectClaudeCli2 } = await Promise.resolve().then(() => (init_claude_cli_detect(), claude_cli_detect_exports));
-        if (detectClaudeCli2().subscriptionReady) {
-          return { hasReadyProvider: true, source: "config", detail: "claude-cli (subscription)" };
-        }
+        if (cli.installed) return { ...base, hasReadyProvider: true, source: "config", detail: `claude-cli (${cli.auth.label})` };
         continue;
       }
       const implemented = prov.api === "anthropic-messages" || prov.api === "openai-chat" || prov.api === "google-generative-ai";
       if (implemented && (prov.api_key || prov.bearer_token)) {
-        return { hasReadyProvider: true, source: "config", detail: prov.api };
+        return { ...base, hasReadyProvider: true, source: "config", detail: prov.api };
       }
     }
-    return { hasReadyProvider: false, source: "none" };
+    return { ...base, hasReadyProvider: false, source: "none" };
   } catch {
     return { hasReadyProvider: false, source: "none" };
   }
@@ -149809,11 +150189,11 @@ async function startServer(options = {}) {
   }
   {
     const cred = await resolveCredentialHealth();
-    systemHealth.hasReadyProvider = cred.hasReadyProvider;
-    systemHealth.credentialSource = cred.source;
-    systemHealth.credentialDetail = cred.detail;
+    applyCredentialHealth(cred);
     if (!systemHealth.hasReadyProvider) {
       log.web.warn("No AI provider configured \u2014 configure one in Settings");
+    } else if (cred.mainProvider === "claude_cli") {
+      log.web.info("AI provider: Claude Code", { auth: cred.claudeCliAuth, implicit: cred.mainProviderImplicit });
     } else if (cred.source && cred.source !== "config") {
       log.web.info("Auto-detected Bedrock credential", { source: cred.source, detail: cred.detail });
     }
@@ -151093,10 +151473,9 @@ async function startServer(options = {}) {
       const prev = systemHealth.hasReadyProvider;
       const prevSource = systemHealth.credentialSource;
       const cred = await resolveCredentialHealth();
-      systemHealth.hasReadyProvider = cred.hasReadyProvider;
-      systemHealth.credentialSource = cred.source;
-      systemHealth.credentialDetail = cred.detail;
-      if (cred.hasReadyProvider !== prev || cred.source !== prevSource) {
+      const prevProvider = systemHealth.mainProvider;
+      applyCredentialHealth(cred);
+      if (cred.hasReadyProvider !== prev || cred.source !== prevSource || cred.mainProvider !== prevProvider) {
         broadcastEvent("system:health", systemHealth);
       }
     } catch {
@@ -158523,11 +158902,12 @@ __export(session_controls_exports, {
   applySessionModelChange: () => applySessionModelChange,
   computeModelOptions: () => computeModelOptions,
   controlErrorKind: () => controlErrorKind,
+  createForkSiblingTask: () => createForkSiblingTask,
   forkSessionToTask: () => forkSessionToTask,
   handleSessionControlRelay: () => handleSessionControlRelay,
   modelReadBackMatches: () => modelReadBackMatches
 });
-import { randomUUID as randomUUID10 } from "crypto";
+import { randomUUID as randomUUID11 } from "crypto";
 function controlErrorKind(status2) {
   if (status2 === 404) return "not_found";
   if (status2 === 405) return "method_not_allowed";
@@ -158700,6 +159080,124 @@ async function computeModelOptions(sessionId) {
     currentEffort: liveEffort ?? record.effectiveEffort ?? record.effort ?? null
   };
 }
+async function createForkSiblingTask(sourceTaskId, opts) {
+  const {
+    getTask: getTask2,
+    addTask: addTask2,
+    updateTask: updateTask2,
+    groupTasks: groupTasks2,
+    addToGroup: addToGroup2,
+    renameGroup: renameGroup2
+  } = await Promise.resolve().then(() => (init_task_manager(), task_manager_exports));
+  let sourceTask;
+  try {
+    sourceTask = await getTask2(sourceTaskId);
+  } catch {
+    throw new SessionControlError(`Source task "${sourceTaskId}" not found`, 404);
+  }
+  const sourceBaseTitle = sourceTask.title.replace(/^Fork of\s+/i, "").replace(/\s+-\s+fork of\s+.*$/i, "").trim() || sourceTask.title;
+  const explicitTitle = opts.childTitle || (opts.titlePrefix ? `${opts.titlePrefix} - fork of ${sourceBaseTitle}` : void 0);
+  const autoTitle = !explicitTitle;
+  const newTitle = explicitTitle || `Fork of ${sourceBaseTitle}`;
+  let inheritedTier;
+  if (sourceTask.pinned && sourceTask.focus_tier) {
+    const { getCustomTiers: getCustomTiers2 } = await Promise.resolve().then(() => (init_task_manager(), task_manager_exports));
+    const known = ["focus", "backlog", "wait"].includes(sourceTask.focus_tier) || (await getCustomTiers2()).some((t3) => t3.id === sourceTask.focus_tier);
+    if (known) inheritedTier = sourceTask.focus_tier;
+    else {
+      log.session.warn("fork: source tier is not registered, filing the fork in Satellite", {
+        sourceTaskId: sourceTask.id,
+        tier: sourceTask.focus_tier
+      });
+    }
+  }
+  const { task: newFork } = await addTask2({
+    title: newTitle,
+    project: sourceTask.project || "",
+    source: sourceTask.source,
+    ...opts.description ? { description: opts.description } : {},
+    // A fork is a person splitting off live work, so it joins the board like
+    // any other hand-made task (Satellite = pinned, no stored tier).
+    pinned: true,
+    ...inheritedTier ? { focus_tier: inheritedTier } : {},
+    // Forking an Ask Walnut conversation yields another Ask Walnut
+    // conversation: without the flag the fork loses the amber marker AND the
+    // persona drift repair (both key on task.walnut_agent, never on project).
+    ...sourceTask.walnut_agent ? { walnut_agent: true } : {}
+  });
+  let forkGroupId;
+  try {
+    if (sourceTask.group_id) {
+      const r8 = await addToGroup2(sourceTask.group_id, [newFork.id]);
+      forkGroupId = r8.group_id;
+    } else {
+      const r8 = await groupTasks2([sourceTask.id, newFork.id], sourceTask.title);
+      forkGroupId = r8.group_id;
+    }
+  } catch (err2) {
+    log.session.warn("fork: failed to group source + fork", {
+      sourceTaskId: sourceTask.id,
+      forkTaskId: newFork.id,
+      error: err2 instanceof Error ? err2.message : String(err2)
+    });
+  }
+  let task;
+  try {
+    task = await getTask2(newFork.id);
+  } catch {
+    task = newFork;
+  }
+  bus.emit(EventNames.TASK_CREATED, { task }, ["web-ui", "main-agent"], { source: opts.source });
+  if (autoTitle && opts.prompt?.trim()) {
+    const forkId = newFork.id;
+    const sourceTitle = sourceBaseTitle;
+    const placeholderTitle = newTitle;
+    const prompt = opts.prompt;
+    const titleSource = `${opts.source}-title`;
+    void (async () => {
+      try {
+        const { summarizeForkPrompt: summarizeForkPrompt2 } = await Promise.resolve().then(() => (init_fork_title(), fork_title_exports));
+        const label = await summarizeForkPrompt2(prompt);
+        if (!label) return;
+        const current5 = await getTask2(forkId);
+        if (current5.title !== placeholderTitle) {
+          log.session.info("fork title refine skipped \u2014 title changed since fork", { taskId: forkId });
+          return;
+        }
+        const refinedTitle = `${label} - fork of ${sourceTitle}`;
+        const { task: updated } = await updateTask2(forkId, { title: refinedTitle }, { source: titleSource });
+        bus.emit(EventNames.TASK_UPDATED, { task: updated }, ["web-ui", "main-agent"], { source: titleSource });
+        log.session.info("fork title refined", { taskId: forkId, title: refinedTitle });
+      } catch (err2) {
+        log.session.warn("fork title refine failed", {
+          taskId: forkId,
+          error: err2 instanceof Error ? err2.message : String(err2)
+        });
+      }
+    })();
+  }
+  if (forkGroupId && !sourceTask.group_id) {
+    const gid = forkGroupId;
+    const seedTitles = [sourceTask.title, newTitle];
+    const groupSource = opts.source;
+    void (async () => {
+      try {
+        const { summarizeGroupLabel: summarizeGroupLabel2 } = await Promise.resolve().then(() => (init_fork_title(), fork_title_exports));
+        const label = await summarizeGroupLabel2(seedTitles);
+        if (!label) return;
+        await renameGroup2(gid, label);
+        bus.emit(EventNames.TASK_GROUPS_CHANGED, { group_id: gid, label }, ["web-ui", "main-agent"], { source: groupSource });
+        log.session.info("fork group label refined", { groupId: gid, label });
+      } catch (err2) {
+        log.session.warn("fork group label refine failed", {
+          groupId: gid,
+          error: err2 instanceof Error ? err2.message : String(err2)
+        });
+      }
+    })();
+  }
+  return { task, ...forkGroupId ? { groupId: forkGroupId } : {} };
+}
 async function forkSessionToTask(sourceSessionId, input, source = "web-api") {
   const { task_id, create_child_task, child_title, message, title, model, imageContext } = input;
   if (!task_id && !create_child_task) {
@@ -158709,14 +159207,7 @@ async function forkSessionToTask(sourceSessionId, input, source = "web-api") {
     throw new SessionControlError("task_id and create_child_task are mutually exclusive", 400);
   }
   const { getSessionByClaudeId: getSessionByClaudeId2, getSessionsForTask: getSessionsForTask2, createSessionRecord: createSessionRecord2 } = await Promise.resolve().then(() => (init_session_tracker(), session_tracker_exports));
-  const {
-    getTask: getTask2,
-    addTask: addTask2,
-    updateTask: updateTask2,
-    groupTasks: groupTasks2,
-    addToGroup: addToGroup2,
-    renameGroup: renameGroup2
-  } = await Promise.resolve().then(() => (init_task_manager(), task_manager_exports));
+  const { getTask: getTask2 } = await Promise.resolve().then(() => (init_task_manager(), task_manager_exports));
   const sourceRecord = await getSessionByClaudeId2(sourceSessionId);
   if (!sourceRecord) throw new SessionControlError("Source session not found", 404);
   if (!engineCaps(sourceRecord.engine).fork) {
@@ -158733,108 +159224,13 @@ async function forkSessionToTask(sourceSessionId, input, source = "web-api") {
     if (!sourceRecord.taskId) {
       throw new SessionControlError("Source session has no task \u2014 cannot create fork task", 400);
     }
-    let sourceTask;
-    try {
-      sourceTask = await getTask2(sourceRecord.taskId);
-    } catch {
-      throw new SessionControlError(`Source task "${sourceRecord.taskId}" not found`, 404);
-    }
-    const sourceBaseTitle = sourceTask.title.replace(/^Fork of\s+/i, "").replace(/\s+-\s+fork of\s+.*$/i, "").trim() || sourceTask.title;
-    const autoTitle = !child_title;
-    const newTitle = child_title || `Fork of ${sourceBaseTitle}`;
-    let inheritedTier;
-    if (sourceTask.pinned && sourceTask.focus_tier) {
-      const { getCustomTiers: getCustomTiers2 } = await Promise.resolve().then(() => (init_task_manager(), task_manager_exports));
-      const known = ["focus", "backlog", "wait"].includes(sourceTask.focus_tier) || (await getCustomTiers2()).some((t3) => t3.id === sourceTask.focus_tier);
-      if (known) inheritedTier = sourceTask.focus_tier;
-      else {
-        log.session.warn("fork: source tier is not registered, filing the fork in Satellite", {
-          sourceTaskId: sourceTask.id,
-          tier: sourceTask.focus_tier
-        });
-      }
-    }
-    const { task: newFork } = await addTask2({
-      title: newTitle,
-      project: sourceTask.project || "",
-      source: sourceTask.source,
-      // A fork is a person splitting off live work, so it joins the board like
-      // any other hand-made task (Satellite = pinned, no stored tier).
-      pinned: true,
-      ...inheritedTier ? { focus_tier: inheritedTier } : {},
-      // Forking an Ask Walnut conversation yields another Ask Walnut
-      // conversation: without the flag the fork loses the amber marker AND the
-      // persona drift repair (both key on task.walnut_agent, never on project).
-      ...sourceTask.walnut_agent ? { walnut_agent: true } : {}
-    });
-    let forkGroupId;
-    try {
-      if (sourceTask.group_id) {
-        const r8 = await addToGroup2(sourceTask.group_id, [newFork.id]);
-        forkGroupId = r8.group_id;
-      } else {
-        const r8 = await groupTasks2([sourceTask.id, newFork.id], sourceTask.title);
-        forkGroupId = r8.group_id;
-      }
-    } catch (err2) {
-      log.session.warn("fork: failed to group source + fork", {
-        sourceTaskId: sourceTask.id,
-        forkTaskId: newFork.id,
-        error: err2 instanceof Error ? err2.message : String(err2)
-      });
-    }
-    try {
-      task = await getTask2(newFork.id);
-    } catch {
-      task = newFork;
-    }
-    bus.emit(EventNames.TASK_CREATED, { task }, ["web-ui", "main-agent"], { source: "fork" });
+    const created = await createForkSiblingTask(sourceRecord.taskId, {
+      childTitle: child_title,
+      prompt: message,
+      source: "fork"
+    });
+    task = created.task;
     childTaskCreated = true;
-    if (autoTitle && message?.trim()) {
-      const forkId = newFork.id;
-      const sourceTitle = sourceBaseTitle;
-      const placeholderTitle = newTitle;
-      void (async () => {
-        try {
-          const { summarizeForkPrompt: summarizeForkPrompt2 } = await Promise.resolve().then(() => (init_fork_title(), fork_title_exports));
-          const label = await summarizeForkPrompt2(message);
-          if (!label) return;
-          const current5 = await getTask2(forkId);
-          if (current5.title !== placeholderTitle) {
-            log.session.info("fork title refine skipped \u2014 title changed since fork", { taskId: forkId });
-            return;
-          }
-          const refinedTitle = `${label} - fork of ${sourceTitle}`;
-          const { task: updated } = await updateTask2(forkId, { title: refinedTitle }, { source: "fork-title" });
-          bus.emit(EventNames.TASK_UPDATED, { task: updated }, ["web-ui", "main-agent"], { source: "fork-title" });
-          log.session.info("fork title refined", { taskId: forkId, title: refinedTitle });
-        } catch (err2) {
-          log.session.warn("fork title refine failed", {
-            taskId: forkId,
-            error: err2 instanceof Error ? err2.message : String(err2)
-          });
-        }
-      })();
-    }
-    if (forkGroupId && !sourceTask.group_id) {
-      const gid = forkGroupId;
-      const seedTitles = [sourceTask.title, newTitle];
-      void (async () => {
-        try {
-          const { summarizeGroupLabel: summarizeGroupLabel2 } = await Promise.resolve().then(() => (init_fork_title(), fork_title_exports));
-          const label = await summarizeGroupLabel2(seedTitles);
-          if (!label) return;
-          await renameGroup2(gid, label);
-          bus.emit(EventNames.TASK_GROUPS_CHANGED, { group_id: gid, label }, ["web-ui", "main-agent"], { source: "fork" });
-          log.session.info("fork group label refined", { groupId: gid, label });
-        } catch (err2) {
-          log.session.warn("fork group label refine failed", {
-            groupId: gid,
-            error: err2 instanceof Error ? err2.message : String(err2)
-          });
-        }
-      })();
-    }
   } else {
     try {
       task = await getTask2(task_id);
@@ -158856,7 +159252,7 @@ async function forkSessionToTask(sourceSessionId, input, source = "web-api") {
   const FORK_FOCUS_PREFIX = "This is a forked session. Focus on the NEW request below \u2014 treat it as your primary task. Do not resume or continue the parent session's previous work unless the user explicitly asks you to.\n\n";
   const forkMessage = `${FORK_FOCUS_PREFIX}${imageContext ?? ""}New request:
 ${userRequest}`;
-  const forkSessionId = randomUUID10();
+  const forkSessionId = randomUUID11();
   const forkTitle = title ?? `Fork of ${sourceRecord.title ?? sourceSessionId.slice(0, 16)}`;
   try {
     await createSessionRecord2(forkSessionId, task.id, task.project ?? "", sourceRecord.cwd, {
@@ -159579,7 +159975,7 @@ __export(session_rewind_exports, {
   probeRewindViaDaemon: () => probeRewindViaDaemon,
   rewindSessionToMessage: () => rewindSessionToMessage
 });
-import { randomUUID as randomUUID11 } from "crypto";
+import { randomUUID as randomUUID12 } from "crypto";
 function cutAncestorHistoryAtRewindPoint(ancestorMessages, rewoundAtMessageUuid) {
   if (!rewoundAtMessageUuid) {
     return { messages: ancestorMessages, found: false, dropped: 0 };
@@ -159780,7 +160176,7 @@ async function rewindSessionToMessage(sessionId, input, source = "web-api") {
       error: err2 instanceof Error ? err2.message : String(err2)
     });
   }
-  const rewoundId = randomUUID11();
+  const rewoundId = randomUUID12();
   const baseTitle = (record.title ?? sessionId.slice(0, 16)).replace(/\s*\(rewound\)$/i, "");
   const title = `${baseTitle} (rewound)`.slice(0, 200);
   const { createSessionRecord: createSessionRecord2 } = await Promise.resolve().then(() => (init_session_tracker(), session_tracker_exports));
@@ -160500,6 +160896,7 @@ function parseSessionMessages(content, opts) {
     }
   }
   let lastPlanContent = null;
+  let dropWarmupReply = false;
   const resultParentIds = [];
   const result = [];
   for (const [mapMsgId, msg] of messageMap) {
@@ -160577,10 +160974,18 @@ ${imgPath}` : imgPath;
     let text = textParts.join("\n").trim();
     if (!text && tools2.length === 0 && !thinking) continue;
     if (msg.role === "user" && text.startsWith("<")) {
+      if (isCacheWarmupText(text)) {
+        dropWarmupReply = true;
+        continue;
+      }
       const transformed = transformInjectedUserText(text);
       if (transformed === null) continue;
       if (transformed !== void 0) text = transformed;
     }
+    if (msg.role === "assistant" && dropWarmupReply) {
+      dropWarmupReply = false;
+      if (tools2.length === 0) continue;
+    }
     if (msg.role === "user") text = stripOutputModeWrappers(text);
     if (msg.role === "assistant" && !text && tools2.length === 0) continue;
     result.push({
@@ -161531,6 +161936,7 @@ var init_session_history = __esm({
     init_session_io();
     init_constants();
     init_remote_image_mirror();
+    init_side_thread_warmup();
     init_session_file_reader();
     LOCAL_HOME = os36.homedir();
     TAIL_SEGMENT_ROLL_BYTES = 4 * 1024 * 1024;
@@ -161678,7 +162084,7 @@ var init_context_window = __esm({
 });
 
 // src/providers/turn-ledger.ts
-import { randomUUID as randomUUID12 } from "crypto";
+import { randomUUID as randomUUID13 } from "crypto";
 function openTurn(sessionId) {
   const existing = openTurns.get(sessionId);
   if (existing && !existing.settled) {
@@ -161688,7 +162094,7 @@ function openTurn(sessionId) {
     });
     return { turnId: existing.turnId, promise: existing.promise };
   }
-  const turnId = randomUUID12();
+  const turnId = randomUUID13();
   let resolve;
   let reject;
   const promise = new Promise((res, rej) => {
@@ -168436,11 +168842,39 @@ var init_claude_code_session = __esm({
         session2.pendingDescription = message.slice(0, 500);
         let appendSystemPrompt;
         const isFork = !!data.forkedFromSessionId;
-        if (data.appendSystemPrompt && !isFork) {
-          appendSystemPrompt = data.appendSystemPrompt;
-          log.session.info("using caller-provided system prompt", { taskId: taskId2, promptLength: data.appendSystemPrompt.length });
-        }
-        {
+        const { parseSideLaneKey: parseSideLaneKey2 } = await Promise.resolve().then(() => (init_side_thread_fork(), side_thread_fork_exports));
+        const sideIds = parseSideLaneKey2(data.lane);
+        if (sideIds) {
+          let exact = data.appendSystemPromptExact;
+          let source = "live-or-record";
+          if (exact === void 0) {
+            try {
+              const { getSessionByClaudeId: getSessionByClaudeId2 } = await Promise.resolve().then(() => (init_session_tracker(), session_tracker_exports));
+              const { spawnPrefixFromRecord: spawnPrefixFromRecord2 } = await Promise.resolve().then(() => (init_spawn_prefix(), spawn_prefix_exports));
+              const parentRecord = await getSessionByClaudeId2(sideIds.parentSid);
+              const prefix = parentRecord ? spawnPrefixFromRecord2(parentRecord) : null;
+              exact = prefix?.appendSystemPrompt ?? null;
+              source = prefix?.source ?? "no-parent-record";
+            } catch (err2) {
+              exact = null;
+              source = "lookup-failed";
+              log.session.warn("side thread: parent prompt lookup failed \u2014 spawning without an append prompt", {
+                parentSid: sideIds.parentSid,
+                error: err2 instanceof Error ? err2.message : String(err2)
+              });
+            }
+          }
+          appendSystemPrompt = exact ?? void 0;
+          log.session.info("side thread: prefix prompt resolved", {
+            parentSid: sideIds.parentSid,
+            source,
+            promptLength: appendSystemPrompt?.length ?? 0
+          });
+        } else {
+          if (data.appendSystemPrompt && !isFork) {
+            appendSystemPrompt = data.appendSystemPrompt;
+            log.session.info("using caller-provided system prompt", { taskId: taskId2, promptLength: data.appendSystemPrompt.length });
+          }
           try {
             const { buildSessionContext: buildSessionContext2 } = await Promise.resolve().then(() => (init_session_context(), session_context_exports));
             const ctx = await buildSessionContext2(taskId2 ?? "", cwd, data.host);
@@ -168458,32 +168892,6 @@ ${ctx.systemPrompt}` : ctx.systemPrompt;
             log.session.warn("failed to build session context", { taskId: taskId2, error: err2 instanceof Error ? err2.message : String(err2) });
           }
         }
-        {
-          const { parseSideLaneKey: parseSideLaneKey2 } = await Promise.resolve().then(() => (init_side_thread_fork(), side_thread_fork_exports));
-          const sideIds = parseSideLaneKey2(data.lane);
-          if (sideIds) {
-            try {
-              const { getSessionByClaudeId: getSessionByClaudeId2 } = await Promise.resolve().then(() => (init_session_tracker(), session_tracker_exports));
-              const parentRecord = await getSessionByClaudeId2(sideIds.parentSid);
-              const inherited = parentRecord?.appliedAppendSystemPrompt;
-              if (inherited && Buffer.byteLength(inherited, "utf8") <= 65536) {
-                appendSystemPrompt = inherited;
-                log.session.info("side thread: inherited parent system prompt verbatim", {
-                  parentSid: sideIds.parentSid,
-                  promptLength: appendSystemPrompt.length
-                });
-              } else {
-                log.session.info("side thread: parent has no stored system prompt \u2014 fresh build (cache prefix will diverge)", {
-                  parentSid: sideIds.parentSid
-                });
-              }
-            } catch (err2) {
-              log.session.warn("side thread: parent prompt lookup failed \u2014 fresh build", {
-                error: err2 instanceof Error ? err2.message : String(err2)
-              });
-            }
-          }
-        }
         if (data.preassignedSessionId && appendSystemPrompt && Buffer.byteLength(appendSystemPrompt, "utf8") <= 65536) {
           const promptToStore = appendSystemPrompt;
           const sidToStore = data.preassignedSessionId;
@@ -177482,7 +177890,7 @@ __export(mobile_launch_exports, {
   performMobileLaunch: () => performMobileLaunch,
   validateMobileLaunchBody: () => validateMobileLaunchBody
 });
-import { randomUUID as randomUUID13 } from "crypto";
+import { randomUUID as randomUUID14 } from "crypto";
 function launchErrorCode(status2) {
   if (status2 === 404) return "not_found";
   if (status2 === 409) return "conflict";
@@ -177604,7 +178012,7 @@ async function performMobileLaunch(input, source) {
       );
     }
   }
-  const preassignedSessionId = engineCaps(input.engine).idProvisioning === "provider-issued" ? void 0 : randomUUID13();
+  const preassignedSessionId = engineCaps(input.engine).idProvisioning === "provider-issued" ? void 0 : randomUUID14();
   const task = await quickStartSession({
     message: input.message,
     cwd: input.cwd,
@@ -178031,6 +178439,7 @@ __export(daemon_connection_exports, {
   isDaemonConnected: () => isDaemonConnected,
   isPooledConnection: () => isPooledConnection,
   probeDaemonSession: () => probeDaemonSession,
+  probeDaemonSessionArgs: () => probeDaemonSessionArgs,
   pushDaemonHooksToAllHosts: () => pushDaemonHooksToAllHosts,
   setOnDaemonHostConnected: () => setOnDaemonHostConnected,
   setOnDaemonStatusChange: () => setOnDaemonStatusChange,
@@ -178207,6 +178616,28 @@ async function probeDaemonSession(hostKey2, sessionId) {
     return null;
   }
 }
+async function probeDaemonSessionArgs(hostKey2, sessionId, deadlineMs = 2e3) {
+  const conn = getConnectedDaemonConnection(hostKey2);
+  if (!conn) return null;
+  try {
+    const result = await Promise.race([
+      conn.send("status", { sid: sessionId, includeArgs: true }),
+      new Promise((_, reject) => setTimeout(
+        () => reject(new Error(`status probe exceeded ${deadlineMs}ms`)),
+        deadlineMs
+      ).unref?.())
+    ]);
+    if (!result.ok || !result.alive || !Array.isArray(result.args)) return null;
+    return result.args.filter((a8) => typeof a8 === "string");
+  } catch (err2) {
+    log.session.debug("probeDaemonSessionArgs: status probe failed", {
+      hostKey: hostKey2,
+      sessionId,
+      error: err2 instanceof Error ? err2.message : String(err2)
+    });
+    return null;
+  }
+}
 var execFileAsync23, MOBILE_ENQUEUE_LEDGER_MAX, recentMobileEnqueues, DaemonConnection, onPoolStatusChange, onHostConnected, hostConnectedListeners, connectionPool, connectingPromises, failureCache, FAILURE_CACHE_TTL_MS;
 var init_daemon_connection = __esm({
   "src/providers/daemon-connection.ts"() {
@@ -182774,6 +183205,7 @@ async function createSessionRecord(claudeSessionId, taskId2, project, cwd, extra
         ...extra?.effort ? { effort: extra.effort } : {},
         ...extra?.profile ? { profile: extra.profile } : {},
         ...extra?.lane ? { lane: extra.lane } : {},
+        ...extra?.appliedAppendSystemPrompt !== void 0 ? { appliedAppendSystemPrompt: extra.appliedAppendSystemPrompt } : {},
         ...extra?.engine ? { engine: extra.engine } : {},
         ...extra?.acpRuntimeId ? { acpRuntimeId: extra.acpRuntimeId } : {},
         ...extra?.acpJournalPath ? { acpJournalPath: extra.acpJournalPath } : {},
@@ -182928,7 +183360,7 @@ function applyUpdateToSession(session2, updates, logLabel) {
       };
       if (count2 === 1) log.session.info("legacy status write suppressed", payload);
       else log.session.debug("legacy status write suppressed", payload);
-      if (updates.process_status === "error") {
+      if (updates.process_status === "error" || updates.process_status === "stopped") {
         noteSuppressedErrorReason(session2.claudeSessionId, {
           reason: typeof reason === "string" ? reason : "unknown",
           message: typeof updates.errorMessage === "string" ? updates.errorMessage : void 0,