open-walnut 0.6.11 → 0.6.12

package/dist/web/server.js

@@ -6020,6 +6020,7 @@ __export(git_sync_exports, {
   isRepoAsync: () => isRepoAsync,
   isSyncPaused: () => isSyncPaused,
   localContainsRemoteTipForTest: () => localContainsRemoteTipForTest,
+  measureRepoSize: () => measureRepoSize,
   noteNetworkFailure: () => noteNetworkFailure,
   noteNetworkSuccess: () => noteNetworkSuccess,
   parseCloudRemoteUrl: () => parseCloudRemoteUrl,
@@ -6032,6 +6033,7 @@ __export(git_sync_exports, {
   setCompactionInProgress: () => setCompactionInProgress,
   setDiskPullOnly: () => setDiskPullOnly,
   setRemote: () => setRemote,
+  setRewriteAdoptedListener: () => setRewriteAdoptedListener,
   stageAllArgs: () => stageAllArgs,
   stageAllForCommit: () => stageAllForCommit,
   sweepDeadFetchPacks: () => sweepDeadFetchPacks,
@@ -7080,6 +7082,10 @@ async function lwwMerge(branch, remoteBefore = null) {
       reason: noMergeBase ? "no-merge-base" : "upstream-force-moved",
       localOnlyCommitsParked: localOnly
     });
+    try {
+      rewriteAdoptedListener?.();
+    } catch {
+    }
     return { merged: true, conflicts: 0 };
   }
   let mergeError = null;
@@ -7311,6 +7317,9 @@ function checkRepoSize(repoDir = WALNUT_HOME) {
   const now = Date.now();
   if (now - lastRepoSizeCheck < REPO_SIZE_CHECK_INTERVAL_MS) return null;
   lastRepoSizeCheck = now;
+  return measureRepoSize(repoDir, now);
+}
+function measureRepoSize(repoDir = WALNUT_HOME, now = Date.now()) {
   const before = measurePackDir(repoDir);
   let sweptBytes = 0;
   let debrisBytes = before.debrisBytes;
@@ -7325,6 +7334,9 @@ function checkRepoSize(repoDir = WALNUT_HOME) {
   const warning2 = `data repo .git has grown to ${gbText(liveBytes)} of live packs (threshold 3GB)${debrisNote}: check for backup-* branches pinning old history, large tracked files, or tmp_pack_* debris; see open-walnut logs -s git`;
   return { liveBytes, debrisBytes, sweptBytes, over, warning: warning2 };
 }
+function setRewriteAdoptedListener(fn) {
+  rewriteAdoptedListener = fn;
+}
 function resetRepoSizeCheckForTest() {
   lastRepoSizeCheck = 0;
 }
@@ -7466,7 +7478,7 @@ function getSyncStatus() {
     diskPullOnly
   };
 }
-var LOCAL_TIMEOUT, NETWORK_TIMEOUT, PULL_TIMEOUT, FETCH_TIMEOUT, FETCH_STREAK_FOR_RECOVERY, FETCH_RECOVERY_TIMEOUT, FETCH_DEBRIS_MIN_AGE_MS, KILL_GRACE_MS, compactionInProgress, SYNC_PAUSE_MARKER, lastPauseLogAt, NETWORK_GIT_RE, execAsync, credentialGuardCache, SYNC_PROBE_TTL_MS, gitAvailableProbe, repoProbe, remoteProbe, GITIGNORE_CONTENT, CRITICAL_IGNORE_FILES, CRITICAL_IGNORE_DIRS, CRITICAL_IGNORE_LINES, CRITICAL_IGNORES, EXTRA_IGNORE_PATTERNS, CLOUD_NEVER_STAGE_DIRS, MASS_DIRTY_THRESHOLD, MASS_DIRTY_TRACKED_FRACTION, TRACKED_COUNT_TTL_MS, trackedCountCache, FAILURE_STREAK_FOR_PULL_FIRST, RESURRECTION_TRIP_COUNT, RESURRECTION_LOG_DEPTH, guard, SAFE_MODE_RELOG_MS, lastSafeModeRefusalLog, diskPullOnly, PUSH_FAILURES_FOR_BUNDLE, pushFailureStreak, localContainsRemoteTipForTest, ORPHAN_SURGERY_MIN_AGE_MS, SURGERY_RELOG_MS, lastSurgeryWarnLog, MAX_MARKER_SCAN_FILES, syncInflight, pullInflight, REPO_SIZE_WARN_BYTES, REPO_SIZE_CHECK_INTERVAL_MS, REPO_SIZE_RECOVERY_KEY, lastRepoSizeCheck, gbText, lastSyncCache, LAST_SYNC_CACHE_MS;
+var LOCAL_TIMEOUT, NETWORK_TIMEOUT, PULL_TIMEOUT, FETCH_TIMEOUT, FETCH_STREAK_FOR_RECOVERY, FETCH_RECOVERY_TIMEOUT, FETCH_DEBRIS_MIN_AGE_MS, KILL_GRACE_MS, compactionInProgress, SYNC_PAUSE_MARKER, lastPauseLogAt, NETWORK_GIT_RE, execAsync, credentialGuardCache, SYNC_PROBE_TTL_MS, gitAvailableProbe, repoProbe, remoteProbe, GITIGNORE_CONTENT, CRITICAL_IGNORE_FILES, CRITICAL_IGNORE_DIRS, CRITICAL_IGNORE_LINES, CRITICAL_IGNORES, EXTRA_IGNORE_PATTERNS, CLOUD_NEVER_STAGE_DIRS, MASS_DIRTY_THRESHOLD, MASS_DIRTY_TRACKED_FRACTION, TRACKED_COUNT_TTL_MS, trackedCountCache, FAILURE_STREAK_FOR_PULL_FIRST, RESURRECTION_TRIP_COUNT, RESURRECTION_LOG_DEPTH, guard, SAFE_MODE_RELOG_MS, lastSafeModeRefusalLog, diskPullOnly, PUSH_FAILURES_FOR_BUNDLE, pushFailureStreak, localContainsRemoteTipForTest, ORPHAN_SURGERY_MIN_AGE_MS, SURGERY_RELOG_MS, lastSurgeryWarnLog, MAX_MARKER_SCAN_FILES, syncInflight, pullInflight, REPO_SIZE_WARN_BYTES, REPO_SIZE_CHECK_INTERVAL_MS, REPO_SIZE_RECOVERY_KEY, lastRepoSizeCheck, gbText, rewriteAdoptedListener, lastSyncCache, LAST_SYNC_CACHE_MS;
 var init_git_sync = __esm({
   "src/integrations/git-sync.ts"() {
     "use strict";
@@ -7757,6 +7769,7 @@ sessions.json.*
     REPO_SIZE_RECOVERY_KEY = "git:repo-size";
     lastRepoSizeCheck = 0;
     gbText = (bytes3) => `${(bytes3 / 1024 / 1024 / 1024).toFixed(1)}GB`;
+    rewriteAdoptedListener = null;
     lastSyncCache = null;
     LAST_SYNC_CACHE_MS = 3e4;
   }
@@ -9204,6 +9217,13 @@ function ensureSilenceSweep() {
   silenceSweepTimer = setInterval(() => {
     const now = Date.now();
     for (const conn of bridges.values()) {
+      if (conn.stillValid && !conn.validating) {
+        conn.validating = true;
+        void credentialStillValid(conn.stillValid).then((valid) => {
+          conn.validating = false;
+          if (!valid && bridges.get(conn.hostAlias) === conn) revokeBridge(conn);
+        });
+      }
       if (now - conn.lastInbound > SILENCE_MS) {
         log.ws.warn("bridge: host silent \u2014 dropping", {
           hostAlias: conn.hostAlias,
@@ -9301,6 +9321,10 @@ function forwardJsonlLine(sessionId, line2) {
   }
 }
 function handleFrame(conn, raw) {
+  if (conn.scope === "status-only" && Buffer.byteLength(raw) > 65536) {
+    revokeBridge(conn);
+    return;
+  }
   conn.lastInbound = Date.now();
   let msg;
   try {
@@ -9308,6 +9332,7 @@ function handleFrame(conn, raw) {
   } catch {
     return;
   }
+  if (!msg || typeof msg !== "object" || Array.isArray(msg) || msg.ev !== void 0 && typeof msg.ev !== "string") return;
   if (conn.hostAlias === PRIMARY_ALIAS && primaryBridgeActivityHandlers.size && Date.now() - primaryBridgeActivityAt >= 15e3) {
     primaryBridgeActivityAt = Date.now();
     for (const handler of primaryBridgeActivityHandlers) {
@@ -9318,6 +9343,10 @@ function handleFrame(conn, raw) {
       }
     }
   }
+  if (conn.scope === "status-only" && msg.ev && msg.ev !== "bridge-ping") {
+    revokeBridge(conn);
+    return;
+  }
   if (msg.ev === "chunk") {
     const whole = conn.chunks.accept(msg);
     if (whole !== null) handleFrame(conn, whole);
@@ -9408,7 +9437,57 @@ function addBridgeConnectedHandler(handler) {
   hostBridgeConnectedHandlers.add(handler);
   return () => hostBridgeConnectedHandlers.delete(handler);
 }
+async function credentialStillValid(check) {
+  let timer10;
+  try {
+    return await Promise.race([
+      check(),
+      new Promise((resolve) => {
+        timer10 = setTimeout(() => resolve(false), 5e3);
+      })
+    ]);
+  } catch {
+    return false;
+  } finally {
+    if (timer10) clearTimeout(timer10);
+  }
+}
+function revokeBridge(conn) {
+  conn.stats.initiator = "none";
+  dropBridge(conn, "credential revoked");
+  try {
+    conn.ws.close(CLOSE_UNAUTHORIZED, "credential revoked");
+  } catch {
+  }
+}
+function watchBridgeRevocations() {
+  stopRevokeWatch ??= onCredentialsRevoked((names2) => {
+    const affected = [
+      ...[...preHello].filter(([, waiting3]) => names2.includes(waiting3.deviceName)).map(([ws, waiting3]) => ({ ws, check: waiting3.stillValid })),
+      ...[...bridges.values()].filter((conn) => names2.includes(conn.deviceName)).map((conn) => ({ ws: conn.ws, check: conn.stillValid }))
+    ];
+    for (const { ws, check } of affected) {
+      const closeRevoked = (valid) => {
+        if (valid) return;
+        const waiting3 = preHello.get(ws);
+        if (waiting3) {
+          clearTimeout(waiting3.timer);
+          preHello.delete(ws);
+        }
+        const conn = findConn(ws);
+        if (conn) revokeBridge(conn);
+        else try {
+          ws.close(CLOSE_UNAUTHORIZED, "credential revoked");
+        } catch {
+        }
+      };
+      if (check) void credentialStillValid(check).then(closeRevoked);
+      else closeRevoked(false);
+    }
+  });
+}
 function attachBridge(ws, deviceName, meta) {
+  watchBridgeRevocations();
   ensureSilenceSweep();
   const stats3 = newBridgeWireStats(meta?.clientIp ?? null);
   const helloTimer = setTimeout(() => {
@@ -9419,22 +9498,67 @@ function attachBridge(ws, deviceName, meta) {
     } catch {
     }
   }, 1e4);
-  preHello.set(ws, { deviceName, timer: helloTimer, stats: stats3 });
+  preHello.set(ws, { deviceName, order: ++bridgeOrder, timer: helloTimer, stats: stats3, stillValid: meta?.stillValid, scope: meta?.scope, queued: [], queuedBytes: 0 });
   ws.on("message", (data) => {
     const raw = data.toString();
     noteFrameIn(stats3, Buffer.isBuffer(data) ? data.length : Buffer.byteLength(raw));
     const waiting3 = preHello.get(ws);
     if (waiting3) {
+      if (waiting3.scope === "status-only" && Buffer.byteLength(raw) > 65536) {
+        clearTimeout(waiting3.timer);
+        preHello.delete(ws);
+        try {
+          ws.close(1009, "status frame too large");
+        } catch {
+        }
+        return;
+      }
+      if (waiting3.verifying) {
+        waiting3.queuedBytes += Buffer.byteLength(raw);
+        if (waiting3.queued.length >= 64 || waiting3.queuedBytes > 1048576) {
+          clearTimeout(waiting3.timer);
+          preHello.delete(ws);
+          try {
+            ws.close(1009, "hello buffer full");
+          } catch {
+          }
+        } else {
+          waiting3.queued.push(raw);
+        }
+        return;
+      }
       let msg;
       try {
         msg = JSON.parse(raw);
       } catch {
         return;
       }
+      if (!msg || typeof msg !== "object" || Array.isArray(msg)) return;
       if (msg.ev !== "hello" || typeof msg.hostAlias !== "string") return;
-      clearTimeout(waiting3.timer);
-      preHello.delete(ws);
-      registerBridge(ws, waiting3.deviceName, msg, waiting3.stats);
+      const finishHello = (valid) => {
+        if (preHello.get(ws) !== waiting3) return;
+        clearTimeout(waiting3.timer);
+        preHello.delete(ws);
+        if (!valid || ws.readyState !== void 0 && ws.readyState !== 1) {
+          try {
+            ws.close(CLOSE_UNAUTHORIZED, "credential revoked");
+          } catch {
+          }
+          return;
+        }
+        registerBridge(ws, waiting3.deviceName, msg, waiting3.stats, waiting3.stillValid, waiting3.order, waiting3.scope);
+        const conn2 = findConn(ws);
+        if (conn2) for (const queued of waiting3.queued) {
+          if (findConn(ws) !== conn2) break;
+          handleFrame(conn2, queued);
+        }
+      };
+      if (waiting3.stillValid) {
+        waiting3.verifying = true;
+        void credentialStillValid(waiting3.stillValid).then(finishHello);
+      } else {
+        finishHello(true);
+      }
       return;
     }
     const conn = findConn(ws);
@@ -9470,12 +9594,12 @@ function tokenBoundAlias(deviceName) {
   const alias = deviceName.startsWith("bridge-") ? deviceName.slice("bridge-".length) : deviceName;
   return alias === "local" ? "__local__" : alias;
 }
-function registerBridge(ws, deviceName, hello, stats3) {
+function registerBridge(ws, deviceName, hello, stats3, stillValid, order, scope) {
   const hostAlias2 = hello.hostAlias;
   if (typeof hello.connId === "string") stats3.connId = hello.connId.slice(0, 80);
   stats3.hostAlias = hostAlias2.slice(0, 120);
   const boundAlias = tokenBoundAlias(deviceName);
-  if (hostAlias2 !== boundAlias) {
+  if (hostAlias2 !== boundAlias || scope === "status-only" && hostAlias2 === PRIMARY_ALIAS) {
     log.ws.warn("bridge: hello hostAlias does not match token identity \u2014 rejecting", {
       claimedHostAlias: hostAlias2,
       tokenAlias: boundAlias,
@@ -9489,6 +9613,14 @@ function registerBridge(ws, deviceName, hello, stats3) {
     return;
   }
   const existing = bridges.get(hostAlias2);
+  if (existing && existing.order > order) {
+    stats3.initiator = "replaced";
+    try {
+      ws.close(CLOSE_REPLACED, "superseded");
+    } catch {
+    }
+    return;
+  }
   if (existing) {
     log.ws.info("bridge: replacing existing connection", { hostAlias: hostAlias2 });
     existing.stats.initiator = "replaced";
@@ -9502,6 +9634,9 @@ function registerBridge(ws, deviceName, hello, stats3) {
     ws,
     hostAlias: hostAlias2,
     deviceName,
+    order,
+    scope,
+    stillValid,
     version: hello.version,
     instanceId: hello.instanceId,
     since: Date.now(),
@@ -9524,11 +9659,11 @@ function registerBridge(ws, deviceName, hello, stats3) {
     sids: Array.isArray(hello.sids) ? hello.sids.length : 0,
     connId: stats3.connId
   });
-  if (hello.uplink === 1) {
+  if (scope !== "status-only" && hello.uplink === 1) {
     void bridgeRequest(hostAlias2, "bridge.peer", { chunkBytes: REPLICA_CHUNK_BYTES }).catch(() => {
     });
   }
-  void reattachInterestedSessions(conn);
+  if (scope !== "status-only") void reattachInterestedSessions(conn);
   if (hostAlias2 === PRIMARY_ALIAS) {
     for (const handler of [primaryBridgeConnectedHandler, ...primaryBridgeConnectedHandlers]) {
       if (!handler) continue;
@@ -9646,8 +9781,8 @@ function waitForBridge(hostAlias2, timeoutMs2) {
 function lastBridgeLossAt(hostAlias2) {
   return bridgeLossAt.get(hostAlias2) ?? null;
 }
-function bridgeHosts() {
-  return [...bridges.values()].map((c8) => ({
+function bridgeHosts(opts2 = {}) {
+  return [...bridges.values()].filter((c8) => !opts2.executionOnly || c8.scope !== "status-only").map((c8) => ({
     hostAlias: c8.hostAlias,
     since: c8.since,
     version: c8.version
@@ -9656,6 +9791,11 @@ function bridgeHosts() {
 function bridgeRequest(hostAlias2, cmd, params = {}, timeoutMs2 = DEFAULT_TIMEOUT_MS) {
   const conn = bridges.get(hostAlias2);
   if (!conn) return Promise.reject(new BridgeOfflineError(hostAlias2));
+  if (conn.scope === "status-only") {
+    if (cmd !== "ping" && cmd !== "status") return Promise.reject(new Error("Status-only bridge refuses this command"));
+    const allowed = cmd === "ping" ? ["nonce", "ackSeq"] : ["nonce"];
+    if (Object.keys(params).some((key) => !allowed.includes(key))) return Promise.reject(new Error("Status-only bridge refuses these parameters"));
+  }
   const id = ++conn.cmdCounter;
   const frame = JSON.stringify({ id, cmd, ...params });
   return new Promise((resolve, reject) => {
@@ -9722,8 +9862,10 @@ function closeAllBridges() {
     clearInterval(silenceSweepTimer);
     silenceSweepTimer = null;
   }
+  stopRevokeWatch?.();
+  stopRevokeWatch = null;
 }
-var PRIMARY_ALIAS, CLOSE_REPLACED, CLOSE_UNAUTHORIZED, DEFAULT_TIMEOUT_MS, SILENCE_MS, SILENCE_SWEEP_MS, bridges, preHello, hostInterest, bridgeWaiters, bridgeLossAt, silenceSweepTimer, lastCliState, mobileEventHandler, gatewayRequestHandler, primaryBridgeConnectedHandler, primaryBridgeConnectedHandlers, primaryBridgeActivityHandlers, primaryBridgeActivityAt, hostBridgeConnectedHandlers, BridgeOfflineError, BridgeAttachRefusedError;
+var PRIMARY_ALIAS, CLOSE_REPLACED, CLOSE_UNAUTHORIZED, DEFAULT_TIMEOUT_MS, SILENCE_MS, SILENCE_SWEEP_MS, bridges, preHello, bridgeOrder, hostInterest, bridgeWaiters, bridgeLossAt, silenceSweepTimer, lastCliState, mobileEventHandler, gatewayRequestHandler, primaryBridgeConnectedHandler, primaryBridgeConnectedHandlers, primaryBridgeActivityHandlers, primaryBridgeActivityAt, hostBridgeConnectedHandlers, stopRevokeWatch, BridgeOfflineError, BridgeAttachRefusedError;
 var init_bridge_registry = __esm({
   "src/web/ws/bridge-registry.ts"() {
     "use strict";
@@ -9735,6 +9877,7 @@ var init_bridge_registry = __esm({
     init_bridge_read_history();
     init_bridge_wire();
     init_event_loop_monitor();
+    init_device_auth();
     init_bridge_presence();
     PRIMARY_ALIAS = "__local__";
     CLOSE_REPLACED = 4e3;
@@ -9744,6 +9887,7 @@ var init_bridge_registry = __esm({
     SILENCE_SWEEP_MS = 3e4;
     bridges = /* @__PURE__ */ new Map();
     preHello = /* @__PURE__ */ new Map();
+    bridgeOrder = 0;
     hostInterest = /* @__PURE__ */ new Map();
     bridgeWaiters = /* @__PURE__ */ new Map();
     bridgeLossAt = /* @__PURE__ */ new Map();
@@ -9756,6 +9900,7 @@ var init_bridge_registry = __esm({
     primaryBridgeActivityHandlers = /* @__PURE__ */ new Set();
     primaryBridgeActivityAt = 0;
     hostBridgeConnectedHandlers = /* @__PURE__ */ new Set();
+    stopRevokeWatch = null;
     BridgeOfflineError = class extends Error {
       constructor(hostAlias2) {
         super(`No live bridge for host: ${hostAlias2}`);
@@ -11584,7 +11729,7 @@ async function rotateDevice(name, opts2) {
   if (plan && (plan.push.length > 0 || plan.twins.length > 0)) trackRevokeWork(finishRevoke(plan, `device ${name} rotated`));
   return { name: out.name, token: out.token, createdAt: out.createdAt, replaced: out.replaced };
 }
-async function verifyDeviceToken(token) {
+async function verifyDeviceToken(token, opts2 = {}) {
   if (!token || typeof token !== "string") return null;
   const { devices, revoked } = await readRegistryAndRevoked();
   const matched = recordForToken(devices, token);
@@ -11595,7 +11740,7 @@ async function verifyDeviceToken(token) {
   }
   const now = Date.now();
   const lastWrite = lastUsedWriteAt.get(matched.name) ?? 0;
-  if (now - lastWrite >= LAST_USED_WRITE_THROTTLE_MS) {
+  if (opts2.touch !== false && now - lastWrite >= LAST_USED_WRITE_THROTTLE_MS) {
     lastUsedWriteAt.set(matched.name, now);
     const name = matched.name;
     try {
@@ -11612,7 +11757,7 @@ async function verifyDeviceToken(token) {
       });
     }
   }
-  return matched.kind ? { name: matched.name, kind: matched.kind } : { name: matched.name };
+  return matched.kind ? { name: matched.name, kind: matched.kind, ...matched.bridgeScope === "status-only" ? { bridgeScope: matched.bridgeScope } : {} } : { name: matched.name };
 }
 async function revokeWith(name, opts2, decide) {
   const intent = { plan: null };
@@ -11792,7 +11937,7 @@ function requestIp(req) {
 }
 async function validateBearerCredential(token) {
   const device = await verifyDeviceToken(token);
-  if (device) return { name: device.name, kind: device.kind === "machine" ? "machine" : "device" };
+  if (device) return { name: device.name, kind: device.kind === "machine" ? "machine" : "device", ...device.bridgeScope ? { bridgeScope: device.bridgeScope } : {} };
   const keyName = await validateApiKey(token);
   if (keyName) return { name: keyName, kind: "api_key" };
   return null;
@@ -25710,6 +25855,16 @@ async function resumeForTrigger(home, sid, text, messageId, taskId) {
       if (!current()) throw new Error('a stop request superseded this start');
       return startSessionProcess({ cmd: 'start', sid: sid, args: args, cwd: spawn.cwd, message: text, resume: true, mode: spawn.mode, origin: { home: home, task: taskId } }, undefined, current);
     });
+    // The turn-start marker the server writes after its own resume start
+    // (writeSyntheticUserEvent): the CLI never echoes its stdin, so without it
+    // the stream shows no turn start and the fire never appears in the chat.
+    try {
+      var started = sessions.get(sid);
+      if (started) appendUserMarkerLine(sid, started, text, messageId, false);
+      else logMsg('warn', 'trigger: no turn-start marker for a host resume', { sid: sid, messageId: messageId });
+    } catch (err) {
+      logMsg('warn', 'trigger: no turn-start marker for a host resume', { sid: sid, messageId: messageId, error: err && err.message });
+    }
     logMsg('info', 'trigger: resumed a stopped session on this host', { sid: sid, taskId: taskId, messageId: messageId, mode: spawn.mode });
     return { ok: true };
   } catch (err) {
@@ -37916,6 +38071,9 @@ function refuse2(d8) {
   throw new MachineCredentialRefused(d8.status, d8.code, d8.error);
 }
 async function mintMachineCredential(name, opts2) {
+  if (opts2.bridgeScope === "status-only" && name === PRIMARY_MACHINE_CREDENTIAL) {
+    throw new MachineCredentialRefused(400, "invalid_bridge_scope", "The primary credential cannot be status-only");
+  }
   const out = await updateAuth((auth) => {
     const decision = machineCredentialDecision(auth, { by: opts2.by, name, action: opts2.replace ? "replace" : "mint", proof: opts2.proof });
     if (!decision.ok) refuse2(decision);
@@ -37924,6 +38082,8 @@ async function mintMachineCredential(name, opts2) {
     const me = applyDecision(auth, decision);
     if (!me.tunnelDaemon) me.tunnelDaemon = { key: me.id };
     const { record: record2, token } = newMachineRecord(name, me.id, existing ? existing.daemonKey : daemonKeyFor(me));
+    const bridgeScope = opts2.bridgeScope ?? existing?.bridgeScope;
+    if (bridgeScope) record2.bridgeScope = bridgeScope;
     auth.devices = [...auth.devices.filter((d8) => d8.name !== name), record2];
     return { persist: true, result: { name, token, createdAt: record2.createdAt, replaced: existing !== void 0, owner: me.name, recorded: decision.record?.via ?? null } };
   });
@@ -38002,7 +38162,7 @@ __export(daemon_tunnel_exports, {
 import { WebSocket as WebSocket3, WebSocketServer } from "ws";
 function tunnelAdmission(cred, execEnabled2) {
   if (!cred) return { ok: false, status: 401, refusal: "unauthorized", message: "a machine credential is required" };
-  if (cred.kind !== "machine" || cred.name !== PRIMARY_MACHINE_DEVICE) {
+  if (cred.kind !== "machine" || cred.name !== PRIMARY_MACHINE_DEVICE || cred.bridgeScope === "status-only") {
     return { ok: false, status: 403, refusal: "not_primary", message: "only the paired primary may open the daemon tunnel" };
   }
   if (!execEnabled2) {
@@ -38412,7 +38572,14 @@ async function verifyCloudUpgrade(url, request2) {
     return null;
   }
   log.ws.info("cloud ws upgrade authenticated", { name: cred.name, kind: cred.kind });
-  return cred;
+  return {
+    ...cred,
+    stillValid: async () => {
+      const { verifyDeviceToken: verifyDeviceToken2 } = await Promise.resolve().then(() => (init_device_auth(), device_auth_exports));
+      const current8 = await verifyDeviceToken2(token, { touch: false });
+      return current8?.name === cred.name && current8.kind === "machine" && current8.bridgeScope === cred.bridgeScope;
+    }
+  };
 }
 function ignoreSocketError() {
 }
@@ -38464,7 +38631,7 @@ function attachWss(server) {
         }
         const clientIp = bridgeClientIp2(request2.headers["x-forwarded-for"], request2.socket.remoteAddress);
         wss.handleUpgrade(request2, socket, head2, (ws) => {
-          attachBridge2(ws, cred.name, { clientIp });
+          attachBridge2(ws, cred.name, { clientIp, stillValid: cred.stillValid, scope: cred.bridgeScope });
         });
       }).catch(() => socket.destroy());
       return;
@@ -92926,10 +93093,10 @@ var init_output_mode = __esm({
     init_types();
     init_voice_reply();
     OUTPUT_MODE_INSTRUCTION_MARKER = "[Rich output mode: ";
-    RICH_OUTPUT_MODE_ON_INSTRUCTION = `${OUTPUT_MODE_INSTRUCTION_MARKER}ON] Keep writing markdown for what markdown does well (headings, lists, tables, code blocks), and mix raw HTML into the same reply (separated by a blank line) for what markdown cannot express: colour that carries meaning, diagrams (inline <svg>), side-by-side or card layout, and interactivity (<details>, CSS :checked). The client renders it natively while streaming. Set text and background colour together or neither: a custom background with inherited or muted text loses contrast (theme vars --fg, --fg-muted, --bg-secondary, --border always fit). For anything needing <script>, emit a \`\`\`html-app fenced block (rendered in a sandboxed iframe). A short answer needs none of this. Component recipes (steppers, SVG diagrams, animations, islands): \`walnut tools call skill_read '{"dirName":"walnut-rich-output"}'\`.`;
+    RICH_OUTPUT_MODE_ON_INSTRUCTION = `${OUTPUT_MODE_INSTRUCTION_MARKER}ON] Keep writing markdown for what markdown does well (headings, lists, tables, code blocks), and mix raw HTML into the same reply (separated by a blank line) for what markdown cannot express: colour that carries meaning, diagrams (inline <svg>), side-by-side or card layout, and interactivity (<details>, CSS :checked). The client renders it natively while streaming. Write visual HTML directly in your reply, not in a file, screenshot, or HTML code fence, unless the user asks for one. Keep each widget contiguous, without internal blank lines. Set text and background colour together or neither: a custom background with inherited or muted text loses contrast (theme vars --fg, --fg-muted, --bg-secondary, --border always fit). For anything needing <script>, emit a \`\`\`html-app fenced block (rendered in a sandboxed iframe). A short answer needs none of this. Component recipes (steppers, SVG diagrams, animations, islands): \`walnut tools call skill_read '{"dirName":"walnut-rich-output"}'\`.`;
     RICH_OUTPUT_MODE_OFF_INSTRUCTION = `${OUTPUT_MODE_INSTRUCTION_MARKER}OFF] Return to plain markdown replies.`;
     OUTPUT_MODE_REMINDER_MARKER = "[Rich output mode is still on";
-    RICH_OUTPUT_MODE_REMINDER = `${OUTPUT_MODE_REMINDER_MARKER} \u2014 markdown first; add HTML only for colour, diagrams, or layout markdown can't do.]`;
+    RICH_OUTPUT_MODE_REMINDER = `${OUTPUT_MODE_REMINDER_MARKER}: markdown first; for colour, diagrams, or layout, write raw HTML directly in this reply. No files, screenshots, or HTML code fences unless requested (html-app for scripts); no blank lines inside a widget.]`;
     MODEL_NATIVE_OUTPUT_MODE = "markdown";
   }
 });
@@ -105471,6 +105638,7 @@ async function applySnapshot(sessionId, snapshot4, source2, canRecoverConnection
     }
     return { outcome: "shadow", diverged, projected };
   }
+  if (sameTurn()) sessionRunner2.findSessionByClaudeId(sessionId)?.setForegroundFromSnapshot?.(snapshot4, epochChanged);
   let reconnectActivityCleared = false;
   if (!recoveringConnection && record2.activity === "Reconnecting to remote host...") {
     const cleared = await updateSessionRecordConditionally3(
@@ -107149,14 +107317,14 @@ async function terminateSession(sessionId, opts2 = {}) {
   if (acpLive) {
     log.session.info("session terminate: stopping ACP session", { sessionId });
     await acpLive.gracefulStop();
-    await updateSessionRecord2(sessionId, {
+    const stopped2 = await updateSessionRecord2(sessionId, {
       process_status: "stopped",
       activity: void 0,
       last_status_change: (/* @__PURE__ */ new Date()).toISOString(),
       status_reason: "user_stopped",
       status_changed_by: "user"
-    }).catch(() => {
-    });
+    }).catch(() => null);
+    if (stopped2) emitSessionStatusChanged2(stopped2, {}, ["*"], { source: "terminate" });
     return { status: "terminated", sessionId, tookMs: Date.now() - startedAt };
   }
   if (!isAcpEngine(record2.engine)) {
@@ -119372,6 +119540,28 @@ function probeAllOverride(env3) {
 function enginePathOverrideVar(engineId) {
   return `WALNUT_${engineId.toUpperCase()}_PATH`;
 }
+function resolveOverridePath(override2, cwd = process.cwd()) {
+  const literal = path83.resolve(cwd, override2);
+  const segments2 = literal.split(path83.sep);
+  const starAt = segments2.findIndex((segment) => segment.includes("*"));
+  if (starAt <= 0 || segments2.slice(starAt + 1).some((segment) => segment.includes("*"))) return literal;
+  const parent = segments2.slice(0, starAt).join(path83.sep) || path83.sep;
+  const [head2, tail4, ...more] = segments2[starAt].split("*");
+  if (more.length > 0) return literal;
+  let names2;
+  try {
+    names2 = fs56.readdirSync(parent);
+  } catch {
+    return literal;
+  }
+  const rest = segments2.slice(starAt + 1);
+  const matches = names2.filter((name) => name.length >= head2.length + tail4.length && name.startsWith(head2) && name.endsWith(tail4)).sort((a8, b8) => b8.localeCompare(a8, void 0, { numeric: true }));
+  for (const name of matches) {
+    const candidate = path83.join(parent, name, ...rest);
+    if (inspectExecutable(candidate).executable) return candidate;
+  }
+  return literal;
+}
 function findEngineBinary(binaryName, options = {}) {
   const env3 = options.env ?? process.env;
   const cwd = options.cwd ?? process.cwd();
@@ -119511,7 +119701,7 @@ async function runProbe(caps, options) {
   const override2 = env3[overrideVar];
   let binary;
   if (override2) {
-    const verdict = inspectExecutable(path83.resolve(options.cwd ?? process.cwd(), override2));
+    const verdict = inspectExecutable(resolveOverridePath(override2, options.cwd ?? process.cwd()));
     if (!verdict.executable) return { availability: unavailable(overrideReason(overrideVar, override2, verdict.rejection)) };
     binary = verdict.executable;
   } else {
@@ -127867,7 +128057,7 @@ var PRICING_VERSION, DEFAULT_PRICING;
 var init_pricing = __esm({
   "src/core/usage/pricing.ts"() {
     "use strict";
-    PRICING_VERSION = "2026-10-07";
+    PRICING_VERSION = "2026-10-12";
     DEFAULT_PRICING = [
       // ── Claude models (Anthropic/Bedrock on-demand) ──
       // Opus 5.5 (2026-09-22 list price). Must sit above 'claude-opus-5', which is a
@@ -127895,6 +128085,16 @@ var init_pricing = __esm({
       { pattern: "claude-haiku-4-5", input: 1, output: 5, cacheWrite: 1.25, cacheRead: 0.1 },
       { pattern: "claude-3-5-haiku", input: 0.8, output: 4, cacheWrite: 1, cacheRead: 0.08 },
       { pattern: "claude-3-haiku", input: 0.25, output: 1.25, cacheWrite: 0.3, cacheRead: 0.03 },
+      // ── OpenAI GPT on Amazon Bedrock (Global CRIS) ──
+      // GPT-6.1 Sol and GPT-6 Astra have a short and a long tier split at 272K
+      // input tokens; these are the long tier, so an estimate errs high. Specific
+      // ids sit above the shorter ones they contain ('gpt-6-sol' is not in
+      // 'gpt-6.1-sol', but 'gpt-6' is in every GPT-6 id).
+      { pattern: "gpt-6.1-sol", input: 4, output: 15, cacheRead: 0.2 },
+      { pattern: "gpt-6-sol", input: 2, output: 10, cacheRead: 0.2 },
+      { pattern: "gpt-6-luna", input: 0.1, output: 0.5, cacheRead: 0.01 },
+      { pattern: "gpt-6-astra", input: 20, output: 75, cacheRead: 2 },
+      { pattern: "gpt-5.6", input: 8.8, output: 33, cacheRead: 0.88 },
       // ── Zhipu GLM (docs.z.ai international USD pricing) ──
       { pattern: "glm-4.7-flashx", input: 0.07, output: 0.4, cacheRead: 0.01 },
       { pattern: "glm-4.7", input: 0.6, output: 2.2, cacheRead: 0.11 },
@@ -143658,8 +143858,8 @@ import path106 from "path";
 import { fileURLToPath as fileURLToPath8 } from "url";
 function getVersion() {
   if (cachedVersion) return cachedVersion;
-  if ("0.6.11") {
-    cachedVersion = "0.6.11";
+  if ("0.6.12") {
+    cachedVersion = "0.6.12";
     versionKnown = true;
     return cachedVersion;
   }
@@ -168265,7 +168465,7 @@ async function getBackupLeader() {
     instance3 = createBackupLeader({
       now: () => Date.now(),
       takeoverMs: takeoverMsFromEnv(),
-      hosts: () => registry3.bridgeHosts().map((h8) => h8.hostAlias),
+      hosts: () => registry3.bridgeHosts({ executionOnly: true }).map((h8) => h8.hostAlias),
       request: (host, cmd, params, timeoutMs2) => registry3.bridgeRequest(host, cmd, params, timeoutMs2),
       stateFile: path131.join(LEADER_STATE_DIR2, "companion.json")
     });
@@ -199029,7 +199229,14 @@ function normalizeProjectedEvent(event) {
     case "usage":
       return [{
         name: "session:usage-update",
-        payload: { used: event.used, size: event.size }
+        // Spoken in the Claude event's vocabulary too, so the composer's
+        // context badge reads an ACP session the same way.
+        payload: {
+          used: event.used,
+          size: event.size,
+          inputTokens: event.used,
+          ...event.size > 0 ? { contextWindow: event.size, contextPercent: Math.round(event.used / event.size * 100) } : {}
+        }
       }];
     case "system":
       return [{
@@ -199084,6 +199291,154 @@ var init_acp_stream_normalizer = __esm({
   }
 });
 
+// src/core/sessions/acp-turn-speed.ts
+var AcpTurnSpeedMeter;
+var init_acp_turn_speed = __esm({
+  "src/core/sessions/acp-turn-speed.ts"() {
+    "use strict";
+    init_pricing();
+    AcpTurnSpeedMeter = class {
+      startedAt;
+      firstChunkAt;
+      model;
+      open;
+      /** Start of the call that was open last (the counted one at turn end). */
+      lastCallStartedAt;
+      lastCallFirstChunkAt;
+      lastCallEndedAt;
+      pendingTools = /* @__PURE__ */ new Set();
+      calls = 0;
+      usageUpdates = 0;
+      partial = false;
+      seenAnything = false;
+      finalSnapshot;
+      get active() {
+        return this.finalSnapshot === void 0 && (this.startedAt !== void 0 || this.seenAnything);
+      }
+      start(ts, model) {
+        this.startedAt = ts;
+        this.firstChunkAt = void 0;
+        this.model = model;
+        this.openCall(ts);
+        this.pendingTools.clear();
+        this.calls = 0;
+        this.usageUpdates = 0;
+        this.partial = false;
+        this.seenAnything = true;
+        this.finalSnapshot = void 0;
+      }
+      /** Text or thought characters streamed by the model. */
+      chunk(ts, chars2) {
+        if (this.finalSnapshot || !(chars2 > 0)) return;
+        this.attachIfNeeded(ts);
+        if (this.firstChunkAt === void 0) this.firstChunkAt = ts;
+        if (!this.open) this.openCall(ts);
+        const open3 = this.open;
+        if (open3.firstChunkAt === void 0) open3.firstChunkAt = ts;
+        open3.chars += chars2;
+      }
+      /** The model asked for a tool: its call ended here. */
+      toolCall(ts, toolCallId) {
+        if (this.finalSnapshot) return;
+        this.attachIfNeeded(ts);
+        if (this.firstChunkAt === void 0) this.firstChunkAt = ts;
+        this.closeCall(ts);
+        this.pendingTools.add(toolCallId);
+      }
+      /** A tool finished; the next model call starts once none is pending. */
+      toolDone(ts, toolCallId) {
+        if (this.finalSnapshot) return;
+        if (!this.pendingTools.delete(toolCallId)) return;
+        if (this.pendingTools.size === 0 && !this.open) this.openCall(ts);
+      }
+      /** One usage_update per finished model call. */
+      usage() {
+        if (this.finalSnapshot) return;
+        this.usageUpdates += 1;
+      }
+      snapshot(now) {
+        if (this.finalSnapshot) return this.finalSnapshot;
+        const open3 = this.open;
+        const streaming = !!open3 && open3.chars > 0;
+        return {
+          ...this.startedAt !== void 0 ? { startedAt: this.startedAt } : {},
+          ttftMs: this.startedAt !== void 0 && this.firstChunkAt !== void 0 ? Math.max(0, this.firstChunkAt - this.startedAt) : null,
+          generationMs: 0,
+          outputTokens: 0,
+          messages: this.calls,
+          ...this.model ? { model: this.model } : {},
+          inFlight: streaming,
+          inFlightChars: streaming ? open3.chars : 0,
+          inFlightMs: streaming ? Math.max(0, now - open3.startedAt) : 0,
+          inFlightVisibleMs: streaming && open3.firstChunkAt !== void 0 ? Math.max(0, now - open3.firstChunkAt) : 0,
+          final: false,
+          ...this.partial ? { partial: true } : {}
+        };
+      }
+      finish(ts, usage, interrupted) {
+        if (this.finalSnapshot) return this.finalSnapshot;
+        if (this.open) this.closeCall(ts);
+        const live5 = this.snapshot(ts);
+        const calls = Math.max(this.calls, this.usageUpdates);
+        const output = usage?.outputTokens;
+        const hiddenReasoning = (usage?.thoughtTokens ?? 0) > 0;
+        const windowStart = hiddenReasoning ? this.lastCallStartedAt : this.lastCallFirstChunkAt ?? this.lastCallStartedAt;
+        const lastCallMs = windowStart !== void 0 && this.lastCallEndedAt !== void 0 ? Math.max(0, this.lastCallEndedAt - windowStart) : 0;
+        const counted = typeof output === "number";
+        const cost = counted && this.model && findPricing(this.model) ? computeCost({
+          model: this.model,
+          input_tokens: usage?.inputTokens ?? 0,
+          output_tokens: output,
+          cache_creation_input_tokens: 0,
+          cache_read_input_tokens: usage?.cachedReadTokens ?? 0
+        }) : 0;
+        this.finalSnapshot = {
+          ...live5,
+          messages: calls,
+          generationMs: counted ? lastCallMs : 0,
+          outputTokens: counted ? output : 0,
+          ...counted ? { turnOutputTokens: output } : {},
+          ...counted && calls > 1 ? { tokenScope: "last-call" } : {},
+          ...typeof usage?.inputTokens === "number" ? { inputTokens: usage.inputTokens } : {},
+          ...typeof usage?.cachedReadTokens === "number" ? { cachedInputTokens: usage.cachedReadTokens } : {},
+          ...typeof usage?.thoughtTokens === "number" && usage.thoughtTokens > 0 ? { reasoningTokens: usage.thoughtTokens } : {},
+          // One call's price is not the turn's: a several-call turn shows no cost.
+          ...cost > 0 && calls <= 1 ? { costUsd: cost, costEstimated: true } : {},
+          ...this.startedAt !== void 0 ? { durationMs: Math.max(0, ts - this.startedAt) } : {},
+          inFlight: false,
+          inFlightChars: 0,
+          inFlightMs: 0,
+          inFlightVisibleMs: 0,
+          final: true,
+          ...interrupted ? { interrupted: true } : {},
+          endedAt: ts
+        };
+        return this.finalSnapshot;
+      }
+      attachIfNeeded(ts) {
+        if (this.startedAt !== void 0 || this.seenAnything) return;
+        this.seenAnything = true;
+        this.partial = true;
+        this.openCall(ts);
+      }
+      openCall(ts) {
+        this.open = { startedAt: ts, chars: 0 };
+        this.lastCallStartedAt = ts;
+        this.lastCallFirstChunkAt = void 0;
+        this.lastCallEndedAt = void 0;
+      }
+      closeCall(ts) {
+        if (!this.open) return;
+        this.calls += 1;
+        this.lastCallStartedAt = this.open.startedAt;
+        this.lastCallFirstChunkAt = this.open.firstChunkAt;
+        this.lastCallEndedAt = ts;
+        this.open = void 0;
+      }
+    };
+  }
+});
+
 // src/providers/acp-worker/protocol.ts
 function resolveWalnutMcpServers(session2) {
   if (session2?.acp_walnut_mcp !== true) return [];
@@ -199315,7 +199670,7 @@ function resolveSystemCodexPath(options = {}) {
   });
 }
 function inspectExecutableCandidate(candidate, cwd) {
-  const executable = path161.resolve(cwd, candidate);
+  const executable = resolveOverridePath(candidate, cwd);
   const verdict = inspectExecutable(executable);
   if (verdict.executable) return { executable: verdict.executable };
   if (verdict.rejection === "npm_injected_path") return { failure: "override_forbidden" };
@@ -199509,6 +199864,7 @@ var init_acp_session = __esm({
     init_daemon_connection();
     init_acp_journal_projector();
     init_acp_stream_normalizer();
+    init_acp_turn_speed();
     init_self_api_root();
     init_protocol2();
     init_session_tracker();
@@ -199583,6 +199939,11 @@ var init_acp_session = __esm({
       _pendingPermissionCommit = Promise.resolve();
       _selfReport = null;
       normalizer;
+      /** The composer's turn speed readout, measured from the journal (see acp-turn-speed.ts). */
+      _speed = new AcpTurnSpeedMeter();
+      _speedEmitAt = 0;
+      /** Latest usage_update, written to the record at turn end (one write per turn). */
+      _lastContext = null;
       constructor(cfg) {
         this.cfg = cfg;
         this.taskId = cfg.taskId;
@@ -199777,6 +200138,7 @@ var init_acp_session = __esm({
             }
           }
         }
+        this.meterTurnSpeed(record2);
         for (const { name, payload } of this.normalizer.normalize(record2)) {
           const full = { ...payload, sessionId: this.trackingId(), taskId: this.taskId };
           if (name === "session:permission-request") {
@@ -199812,6 +200174,78 @@ var init_acp_session = __esm({
           this.commitTerminal(v3, record2);
         }
       }
+      /** Feed one journal record to the turn speed meter; emit its readout. */
+      meterTurnSpeed(record2) {
+        if (record2.kind === "meta") {
+          const event = record2.event;
+          if (event.type === "turn-started") {
+            this._speed.start(record2.ts, this.meterModel());
+            this.emitTurnSpeed(record2.ts, false);
+          } else if (event.type === "turn-ended" || event.type === "turn-interrupted") {
+            if (!this._speed.active) return;
+            const usage = event.type === "turn-ended" ? event.usage : void 0;
+            const interrupted = event.type === "turn-interrupted" || event.type === "turn-ended" && event.stopReason === "cancelled";
+            const speed = this._speed.finish(record2.ts, usage, interrupted);
+            this.emitTurnSpeed(record2.ts, true);
+            const sid = this._providerSessionId;
+            const context = this._lastContext;
+            if (sid) {
+              void updateSessionRecord(sid, {
+                lastTurnSpeed: speed,
+                ...context ? { contextTokens: context.used, ...context.size > 0 ? { modelMaxWindow: context.size } : {} } : {}
+              }).catch(() => {
+              });
+            }
+          }
+          return;
+        }
+        if (record2.source !== void 0 && record2.source !== "live") return;
+        const frame = record2.frame;
+        if (frame?.method !== "session/update") return;
+        const update3 = frame.params?.update;
+        if (!update3) return;
+        switch (update3.sessionUpdate) {
+          case "agent_message_chunk":
+          case "agent_thought_chunk": {
+            const content = update3.content;
+            const chars2 = content?.type === "text" && typeof content.text === "string" ? content.text.length : 0;
+            this._speed.chunk(record2.ts, chars2);
+            if (record2.ts - this._speedEmitAt >= 400) this.emitTurnSpeed(record2.ts, false);
+            return;
+          }
+          case "tool_call":
+            if (typeof update3.toolCallId === "string") this._speed.toolCall(record2.ts, update3.toolCallId);
+            this.emitTurnSpeed(record2.ts, false);
+            return;
+          case "tool_call_update":
+            if (typeof update3.toolCallId === "string" && (update3.status === "completed" || update3.status === "failed")) {
+              this._speed.toolDone(record2.ts, update3.toolCallId);
+            }
+            return;
+          case "usage_update":
+            this._speed.usage();
+            if (typeof update3.used === "number" && typeof update3.size === "number") {
+              this._lastContext = { used: update3.used, size: update3.size };
+            }
+            return;
+        }
+      }
+      /** The model the meter prices and names: the family id, without its effort. */
+      meterModel() {
+        const current8 = this._models.currentModelId;
+        return current8 ? splitAcpModelId(current8).base : void 0;
+      }
+      emitTurnSpeed(now, final) {
+        const sid = this._providerSessionId;
+        if (!sid) return;
+        if (!final && !this._speed.active) return;
+        this._speedEmitAt = now;
+        bus.emit(EventNames.SESSION_TURN_SPEED, {
+          sessionId: sid,
+          taskId: this.taskId,
+          speed: this._speed.snapshot(now)
+        }, ["web-ui"], { source: "session-runner" });
+      }
       /** Records/API key: providerSessionId once known, else runtimeId (pending phase). */
       trackingId() {
         return this._providerSessionId ?? this.runtimeId;
@@ -203975,6 +204409,8 @@ var init_claude_code_session = __esm({
       /** THE authoritative set of background tasks (dynamic workflows / subagents), keyed by
        *  task_id, each carrying its latest status. "Is bg work in flight" is derived from this
        *  set (see hasActiveBackgroundWork) — there is no parallel scalar counter to desync. */
+      _foregroundActive;
+      _foregroundEvidenceV = 0;
       _bgTasks = /* @__PURE__ */ new Map();
       /** Task ids that have EVER appeared in a `background_tasks_changed` payload — proof of
        *  membership in the CLI's level universe. Only a task the CLI itself once listed may be
@@ -204117,6 +204553,7 @@ var init_claude_code_session = __esm({
        *  from the init line. */
       _onTurnStartEdge(source2, persist5, sidHint) {
         const sid = this.claudeSessionId ?? sidHint;
+        this.setForegroundActive(true);
         this._turnGen++;
         if (source2 !== "state-running" || this._turnResultEmitted || this._turnEdgeAt === void 0) {
           this._turnEdgeAt = Date.now();
@@ -204174,6 +204611,7 @@ var init_claude_code_session = __esm({
       _completeTurnOnIdle() {
         const sid = this.claudeSessionId;
         if (!sid) return;
+        this.setForegroundActive(false);
         const interrupted = this.consumeInterruptRequest();
         const outcome = this._deferredOutcome;
         this._deferredOutcome = void 0;
@@ -204306,6 +204744,7 @@ var init_claude_code_session = __esm({
           taskId: this.taskId,
           workflowName: this._workflowName,
           inFlight: this._runningBgCount(),
+          foregroundActive: this._foregroundActive,
           tasks: this.backgroundTasks,
           phases: sortedPhases(this._workflowPhases),
           agents: this.workflowAgents,
@@ -204342,6 +204781,12 @@ var init_claude_code_session = __esm({
         });
         return { stopped: true, status: row.status };
       }
+      setForegroundActive(active6) {
+        if (this._currentEventV !== void 0) this._foregroundEvidenceV = Math.max(this._foregroundEvidenceV, this._currentEventV);
+        if (this._foregroundActive === active6) return;
+        this._foregroundActive = active6;
+        if (this.claudeSessionId && this._bgTasks.size > 0) this._emitBackgroundTasksUpdate(this.claudeSessionId);
+      }
       /** Broadcast the current background-task set so the UI can render workflow progress. */
       _emitBackgroundTasksUpdate(sessionId) {
         bus.emit(EventNames.SESSION_BACKGROUND_TASKS, {
@@ -204349,6 +204794,7 @@ var init_claude_code_session = __esm({
           taskId: this.taskId,
           workflowName: this._workflowName,
           inFlight: this._runningBgCount(),
+          foregroundActive: this._foregroundActive,
           tasks: this.backgroundTasks,
           phases: sortedPhases(this._workflowPhases),
           agents: this.workflowAgents,
@@ -204629,6 +205075,15 @@ var init_claude_code_session = __esm({
       setProcessStatusFromReconciler(status2) {
         this._processStatus = status2;
       }
+      setForegroundFromSnapshot(snapshot4, epochChanged = false) {
+        if (epochChanged) this._foregroundEvidenceV = 0;
+        if (snapshot4.v < this._foregroundEvidenceV) return;
+        const active6 = snapshot4.lastResult ? false : snapshot4.turnActive ? true : void 0;
+        this._foregroundEvidenceV = snapshot4.v;
+        if (active6 === void 0 || active6 === this._foregroundActive) return;
+        this._foregroundActive = active6;
+        if (this.claudeSessionId && this._bgTasks.size > 0) this._emitBackgroundTasksUpdate(this.claudeSessionId);
+      }
       /**
        * Epoch-reset the in-memory consumed watermark from the snapshot layer.
        * The ONLY sanctioned backwards move (mirrors the record-side epoch
@@ -204853,6 +205308,8 @@ var init_claude_code_session = __esm({
         }
         this._active = true;
         this._processStatus = initOnly ? "idle" : "running";
+        this._foregroundActive = !initOnly;
+        this._foregroundEvidenceV = 0;
         this._exitCode = null;
         this._exitStderr = void 0;
         this.resultEmitted = false;
@@ -204884,6 +205341,7 @@ var init_claude_code_session = __esm({
         this._bgSeenInLevel.clear();
         this._deferredOutcome = void 0;
         this._resetWorkflowState();
+        if (this.claudeSessionId) this._emitBackgroundTasksUpdate(this.claudeSessionId);
         this._teamActive = false;
         this._cliSessionState = void 0;
         this._transportGeneration++;
@@ -205262,12 +205720,16 @@ var init_claude_code_session = __esm({
               status: status2,
               toolUseId: foldToolUseId ?? prev?.toolUseId,
               isBackgrounded: t3.isBackgrounded || prev?.isBackgrounded,
+              taskType: t3.taskType ?? prev?.taskType,
+              subagentType: t3.subagentType ?? prev?.subagentType,
+              ownedBySubagent: t3.ownedBySubagent ?? prev?.ownedBySubagent,
               // #870: the fold's level verdict rides along so a wedged hold stays
               // un-wedged across an attach (gating skips endedPerLevel entries).
               endedPerLevel: t3.endedPerLevel || prev?.endedPerLevel
             });
             if (t3.endedPerLevel) session2._bgSeenInLevel.add(taskId2);
           }
+          session2._foregroundActive = fold2.lastResult ? false : fold2.cliState === "running" ? true : void 0;
           if (fold2.cliState != null) {
             session2._sessionStateSeen = true;
             session2._cliSessionState = fold2.cliState;
@@ -205529,6 +205991,8 @@ var init_claude_code_session = __esm({
           const before = {
             _processStatus: this._processStatus,
             _activity: this._activity,
+            _foregroundActive: this._foregroundActive,
+            _foregroundEvidenceV: this._foregroundEvidenceV,
             resultEmitted: this.resultEmitted,
             _turnResultEmitted: this._turnResultEmitted,
             _expectedTeardown: this._expectedTeardown,
@@ -205555,6 +206019,7 @@ var init_claude_code_session = __esm({
           undoDispatch = () => {
             if (this._transport === transport && this._turnGen === before._turnGen + 1 && this._lastJsonlEventTs === eventAt && transport.fileSize === offset) {
               Object.assign(this, before);
+              if (this.claudeSessionId) this._emitBackgroundTasksUpdate(this.claudeSessionId);
               if (speedBefore.final) {
                 this._speed.restore(speedBefore);
                 this.emitTurnSpeed(true);
@@ -205567,6 +206032,8 @@ var init_claude_code_session = __esm({
           this._activity = void 0;
           this.resultEmitted = false;
           this._turnResultEmitted = false;
+          this._foregroundEvidenceV = Math.max(this._foregroundEvidenceV, transport.fileSize + 1);
+          this.setForegroundActive(true);
           this._expectedTeardown = false;
           this._turnGen++;
           this._turnEdgeAt = Date.now();
@@ -206841,6 +207308,7 @@ var init_claude_code_session = __esm({
           this._deferredOutcome = void 0;
           this._onTurnStartEdge("user-message", true);
         }
+        if ((event.type === "assistant" || event.type === "stream_event") && !event.parent_tool_use_id && this._isReplayedByOffset() !== true) this.setForegroundActive(true);
         try {
           switch (event.type) {
             case "system": {
@@ -207182,6 +207650,7 @@ var init_claude_code_session = __esm({
                     }
                     const wasCompanionIdle = this._idleDebt > 0;
                     if (wasCompanionIdle) this._idleDebt--;
+                    else this.setForegroundActive(false);
                     if (this.hasActiveBackgroundWork()) {
                       log.session.info("idle while background work in flight \u2014 staying running, awaiting drain", {
                         sessionId: sid,
@@ -207245,6 +207714,7 @@ var init_claude_code_session = __esm({
                       // read it here too in case a future CLI stamps it at start. Never
                       // un-background: keep a previously-recorded true.
                       isBackgrounded: sys.is_backgrounded === true || prevStarted?.isBackgrounded,
+                      ownedBySubagent: typeof sys.owned_by_subagent === "boolean" ? sys.owned_by_subagent : prevStarted?.ownedBySubagent,
                       // Display-only. toolUseId: within ONE call the first non-empty wins (never
                       // clobber with undefined). startedAt is OUR clock at the first start we saw — a
                       // replayed task_started must not restart the row's elapsed timer.
@@ -207746,6 +208216,7 @@ var init_claude_code_session = __esm({
                 this._turnResultEmitted = true;
                 break;
               }
+              this.setForegroundActive(false);
               const resultOrigin = event.origin;
               const isTaskNotificationResult = resultOrigin?.kind === "task-notification";
               if (isTaskNotificationResult) {
@@ -227968,6 +228439,9 @@ function foldSessionTail(content, baseOffset, opts2) {
         fold2.bgTasks[taskId2] = {
           status: !restarted && prev && BG_TERMINAL.has(prev.status) ? prev.status : "running",
           toolUseId: toolUseId ?? prev?.toolUseId,
+          taskType: typeof parsed.task_type === "string" ? parsed.task_type : prev?.taskType,
+          subagentType: typeof parsed.subagent_type === "string" ? parsed.subagent_type : prev?.subagentType,
+          ownedBySubagent: typeof parsed.owned_by_subagent === "boolean" ? parsed.owned_by_subagent : prev?.ownedBySubagent,
           // A run_in_background Bash task carries is_backgrounded:true TOP-LEVEL
           // on its task_started (verified live, local_bash 2026-08-28). Sticky,
           // same as the task_updated patch path. Keep in parity with daemon-fold.
@@ -227977,6 +228451,11 @@ function foldSessionTail(content, baseOffset, opts2) {
         const prev = fold2.bgTasks[taskId2];
         const patch = parsed.patch;
         fold2.bgTasks[taskId2] = {
+          // Keep what task_started said (its type, its owner), but not a level
+          // snapshot's endedPerLevel mark: the task's own event un-marks it, as
+          // daemon-fold's task_updated does (gatingBgCount parity).
+          ...prev,
+          endedPerLevel: void 0,
           status: patch?.status ?? prev?.status ?? "running",
           toolUseId: toolUseId ?? prev?.toolUseId,
           // Sticky: is_backgrounded=true detaches the task from gating forever.
@@ -227985,6 +228464,8 @@ function foldSessionTail(content, baseOffset, opts2) {
       } else if (taskId2 && subtype === "task_notification") {
         const prev = fold2.bgTasks[taskId2];
         fold2.bgTasks[taskId2] = {
+          ...prev,
+          endedPerLevel: void 0,
           status: parsed.status ?? "completed",
           isBackgrounded: prev?.isBackgrounded,
           toolUseId: toolUseId ?? prev?.toolUseId
@@ -246557,6 +247038,11 @@ var init_devices = __esm({
         const existingMachine = CLOUD_MODE && req.body?.kind !== "machine" && (await listDeviceRecords()).some((d8) => d8.name === name && d8.kind === "machine");
         const kind = req.body?.kind === "machine" || existingMachine ? "machine" : void 0;
         const wantsCloud = req.body?.target === "cloud" && !CLOUD_MODE;
+        const bridgeScope = req.body?.bridge_scope;
+        if (bridgeScope !== void 0 && (bridgeScope !== "status-only" || kind !== "machine" || !CLOUD_MODE)) {
+          res.status(400).json({ error: "bridge_scope requires a status-only machine credential on the companion" });
+          return;
+        }
         const replace = req.body?.replace === true;
         if (wantsCloud) {
           if (!await cloudRelayAllowed(req, res, replace ? "rotate" : "create")) return;
@@ -246574,7 +247060,7 @@ var init_devices = __esm({
         const target = CLOUD_MODE ? { origin: consoleOrigin, kind: "cloud" } : localTargets.find((t3) => t3.kind === req.body?.target) ?? localTargets[0];
         const by = actorOf(req);
         if (kind === "machine" && CLOUD_MODE) {
-          const minted = await mintMachineCredential(name, { by, replace, proof: machineProof(req) });
+          const minted = await mintMachineCredential(name, { by, replace, proof: machineProof(req), bridgeScope });
           log.web.info("devices: machine credential created via console", { name, caller: callerDevice(req) });
           res.status(201).json({ name, token: minted.token, pairingURI: buildPairingURI(name, minted.token, target?.origin), createdAt: minted.createdAt, target: target?.kind ?? null, server: target?.origin ?? null });
           return;
@@ -264159,6 +264645,7 @@ var init_system = __esm({
 
 // src/web/routes/hosts.ts
 import { Router as Router70 } from "express";
+import { randomBytes as randomBytes6 } from "crypto";
 async function cloudState(hostKey2) {
   const { bridgeForHost: bridgeForHost2 } = await Promise.resolve().then(() => (init_bridge_registry(), bridge_registry_exports));
   const connected2 = bridgeForHost2(hostKey2).connected;
@@ -264197,6 +264684,37 @@ var init_hosts = __esm({
         next(err2);
       }
     });
+    hostsRouter.get("/:host/status", async (req, res, next) => {
+      const host = String(req.params.host ?? "");
+      if (!/^[A-Za-z0-9_][A-Za-z0-9_.-]{0,79}$/.test(host)) {
+        res.status(400).json({ error: "Invalid host alias" });
+        return;
+      }
+      if (!CLOUD_MODE) {
+        res.status(409).json({ error: "Outbound host status is served by the cloud companion" });
+        return;
+      }
+      try {
+        const { bridgeForHost: bridgeForHost2, bridgeRequest: bridgeRequest2 } = await Promise.resolve().then(() => (init_bridge_registry(), bridge_registry_exports));
+        if (!bridgeForHost2(host).connected) {
+          res.status(503).json({ host, connected: false, code: "bridge_offline" });
+          return;
+        }
+        const nonce = randomBytes6(16).toString("hex");
+        try {
+          const reply2 = await bridgeRequest2(host, "ping", { nonce }, 5e3);
+          if (reply2.ok !== true || reply2.pong !== true || reply2.nonce !== nonce) {
+            res.status(503).json({ host, connected: false, code: "bridge_unconfirmed" });
+            return;
+          }
+          res.json({ host, connected: true, transport: "outbound_bridge" });
+        } catch {
+          res.status(503).json({ host, connected: false, code: "bridge_unavailable" });
+        }
+      } catch (err2) {
+        next(err2);
+      }
+    });
     hostsRouter.post("/:host/connect", async (req, res, next) => {
       try {
         const host = typeof req.params.host === "string" ? req.params.host.trim() : "";
@@ -266314,6 +266832,7 @@ async function runJob2(state13, opts2) {
       state13.error = void 0;
       state13.steps[id] = { status: "running", startedAt: (/* @__PURE__ */ new Date()).toISOString() };
       await persistIfCurrent();
+      if (handle4.cancelled || superseded()) return;
       emitProgress(state13);
       const outcome = await runners[id](ctx);
       if (handle4.cancelled || superseded()) return;
@@ -267597,7 +268116,7 @@ import fs133 from "fs";
 import path237 from "path";
 import { createRequire as createRequire3 } from "module";
 import { spawn as spawn31 } from "child_process";
-import { randomBytes as randomBytes6 } from "crypto";
+import { randomBytes as randomBytes7 } from "crypto";
 var RECORDING_STATE_FILE, require2, DEFAULT_CHUNK_MINUTES, DEFAULT_SAMPLE_RATE, DEFAULT_CHANNELS, DEFAULT_REFRESH_INTERVAL_SEC, WAV_FORMAT_PCM, AudioCaptureService, audioCaptureService;
 var init_audio_capture = __esm({
   "src/core/audio-capture.ts"() {
@@ -267818,7 +268337,7 @@ var init_audio_capture = __esm({
           throw new Error("Audio capture not available. macOS 13+ with Screen Recording permission required.");
         }
         const { AudioCapture } = require2("screencapturekit-audio-capture");
-        this.recordingId = randomBytes6(6).toString("hex");
+        this.recordingId = randomBytes7(6).toString("hex");
         this.source = options.source;
         this.mode = options.mode;
         this.apps = options.apps ?? [];
@@ -286534,6 +287053,7 @@ __export(git_maintenance_exports, {
   DEBRIS_MAX_AGE_MS: () => DEBRIS_MAX_AGE_MS,
   FAILED_GC_BACKOFF_MS: () => FAILED_GC_BACKOFF_MS,
   MAINTENANCE_INTERVAL_DAYS: () => MAINTENANCE_INTERVAL_DAYS,
+  REWRITE_MAINTENANCE_DELAY_MS: () => REWRITE_MAINTENANCE_DELAY_MS,
   SIZE_REGROWTH_RATIO: () => SIZE_REGROWTH_RATIO,
   SIZE_TRIGGER_BYTES: () => SIZE_TRIGGER_BYTES,
   expireCompactionBackups: () => expireCompactionBackups,
@@ -286542,7 +287062,9 @@ __export(git_maintenance_exports, {
   maintenanceDue: () => maintenanceDue,
   packDirBytes: () => packDirBytes,
   readLastRun: () => readLastRun,
+  requestMaintenancePass: () => requestMaintenancePass,
   resolveGitDir: () => resolveGitDir,
+  settleRepoSize: () => settleRepoSize,
   staleCompactionBackups: () => staleCompactionBackups,
   staleQuarantineDirs: () => staleQuarantineDirs,
   startGitMaintenance: () => startGitMaintenance,
@@ -286695,7 +287217,7 @@ function staleCompactionBackups(gitDir, now = Date.now()) {
     return d8 !== null && now - d8 > maxAgeMs;
   }).sort();
 }
-function maintenanceDue(gitDir, now = Date.now()) {
+function maintenanceDue(gitDir, now = Date.now(), opts2 = {}) {
   const last2 = readLastRun(gitDir);
   const pack = packDirBytes(gitDir);
   const recentlyFailed = last2.failedAt !== void 0 && now - last2.failedAt < FAILED_GC_BACKOFF_MS;
@@ -286705,6 +287227,7 @@ function maintenanceDue(gitDir, now = Date.now()) {
   }
   if (staleQuarantineDirs(gitDir, now) >= DEBRIS_COUNT_TRIGGER) return "debris";
   if (staleCompactionBackups(gitDir, now).length > 0 && !recentlyFailed) return "backup";
+  if (opts2.afterRewrite && !recentlyFailed) return "rewrite";
   if (now - last2.at >= MAINTENANCE_INTERVAL_DAYS * 864e5) return "interval";
   return null;
 }
@@ -286771,7 +287294,7 @@ async function maintainRepo(repoDir, opts2 = {}) {
     packBytesBefore: 0,
     packBytesAfter: 0
   };
-  const due2 = opts2.force ? "forced" : maintenanceDue(gitDir);
+  const due2 = opts2.force ? "forced" : maintenanceDue(gitDir, Date.now(), { afterRewrite: opts2.afterRewrite });
   if (!due2) return result;
   result.reason = due2;
   result.packBytesBefore = packDirBytes(gitDir);
@@ -286844,14 +287367,34 @@ function sweepDeployBundles(dir4 = os64.tmpdir(), now = Date.now()) {
   }
   return swept;
 }
+function requestMaintenancePass() {
+  return activePass ? activePass(false) : null;
+}
+async function settleRepoSize(verdict) {
+  if (!verdict.over) return verdict;
+  const pass = requestMaintenancePass();
+  if (!pass) return verdict;
+  const results = await pass;
+  const worktree = results.find((r8) => r8.repo === WALNUT_HOME);
+  if (!worktree?.ran) return verdict;
+  return measureRepoSize(WALNUT_HOME);
+}
 function startGitMaintenance(opts2 = {}) {
   let stopped2 = false;
   let timer10 = null;
+  let rewriteTimer = null;
+  let rewritePending = false;
+  let inflight7 = null;
   const pass = async (force = false) => {
     const results = [];
+    const afterRewrite = rewritePending;
+    rewritePending = false;
     try {
-      results.push(await maintainRepo(WALNUT_HOME, { pauseSync: true, force }));
+      const worktree = await maintainRepo(WALNUT_HOME, { pauseSync: true, force, afterRewrite });
+      results.push(worktree);
+      if (afterRewrite && !worktree.ran) rewritePending = true;
     } catch (err2) {
+      if (afterRewrite) rewritePending = true;
       log.git.warn("git-maintenance worktree pass failed", {
         error: err2 instanceof Error ? err2.message : String(err2)
       });
@@ -286874,9 +287417,32 @@ function startGitMaintenance(opts2 = {}) {
     }
     return results;
   };
+  const runPass = (force = false) => {
+    if (inflight7 && force) return inflight7.then(() => runPass(true));
+    if (inflight7) return inflight7;
+    inflight7 = pass(force).finally(() => {
+      inflight7 = null;
+    });
+    return inflight7;
+  };
+  activePass = runPass;
+  const onRewriteAdopted = () => {
+    if (stopped2) return;
+    rewritePending = true;
+    if (rewriteTimer) return;
+    rewriteTimer = setTimeout(() => {
+      rewriteTimer = null;
+      void (async () => {
+        if (inflight7) await inflight7;
+        if (!stopped2 && rewritePending) await runPass();
+      })();
+    }, opts2.rewriteDelayMs ?? REWRITE_MAINTENANCE_DELAY_MS);
+    rewriteTimer.unref?.();
+  };
+  setRewriteAdoptedListener(onRewriteAdopted);
   const tick = async () => {
     try {
-      await pass();
+      await runPass();
     } finally {
       if (!stopped2) {
         timer10 = setTimeout(() => {
@@ -286899,11 +287465,16 @@ function startGitMaintenance(opts2 = {}) {
     stop() {
       stopped2 = true;
       if (timer10) clearTimeout(timer10);
+      if (rewriteTimer) clearTimeout(rewriteTimer);
+      if (activePass === runPass) {
+        activePass = null;
+        setRewriteAdoptedListener(null);
+      }
     },
-    runOnce: (force = false) => pass(force)
+    runOnce: (force = false) => runPass(force)
   };
 }
-var MAINTENANCE_INTERVAL_DAYS, SIZE_TRIGGER_BYTES, DEBRIS_MAX_AGE_MS, BACKUP_BRANCH_MAX_AGE_DAYS, COMPACTION_BACKUP_MAX_AGE_DAYS, SIZE_REGROWTH_RATIO, GC_TIMEOUT_MS, CHECK_INTERVAL_MS, LAST_RUN_FILE, FAILED_GC_BACKOFF_MS, DEBRIS_COUNT_TRIGGER, DEPLOY_DEBRIS_RE, DEPLOY_DEBRIS_MAX_AGE_MS;
+var MAINTENANCE_INTERVAL_DAYS, SIZE_TRIGGER_BYTES, DEBRIS_MAX_AGE_MS, BACKUP_BRANCH_MAX_AGE_DAYS, COMPACTION_BACKUP_MAX_AGE_DAYS, SIZE_REGROWTH_RATIO, GC_TIMEOUT_MS, CHECK_INTERVAL_MS, LAST_RUN_FILE, REWRITE_MAINTENANCE_DELAY_MS, FAILED_GC_BACKOFF_MS, DEBRIS_COUNT_TRIGGER, DEPLOY_DEBRIS_RE, DEPLOY_DEBRIS_MAX_AGE_MS, activePass;
 var init_git_maintenance = __esm({
   "src/integrations/git-maintenance.ts"() {
     "use strict";
@@ -286919,10 +287490,12 @@ var init_git_maintenance = __esm({
     GC_TIMEOUT_MS = 30 * 6e4;
     CHECK_INTERVAL_MS = 24 * 60 * 60 * 1e3;
     LAST_RUN_FILE = "walnut-last-maintenance";
+    REWRITE_MAINTENANCE_DELAY_MS = 6e4;
     FAILED_GC_BACKOFF_MS = 24 * 60 * 60 * 1e3;
     DEBRIS_COUNT_TRIGGER = 10;
     DEPLOY_DEBRIS_RE = /^(?:wn[-.].*\.bundle(?:\.\w+)?|walnut-[\w.-]*\.(?:bundle|tar\.gz|tgz)|deploy-seed[\w.-]*\.sh|wn\.bundle)$/;
     DEPLOY_DEBRIS_MAX_AGE_MS = 24 * 60 * 60 * 1e3;
+    activePass = null;
   }
 });
 
@@ -292805,17 +293378,27 @@ async function startServer(options = {}) {
           recoveryKey: COMPACTION_RECOVERY_KEY
         });
       };
-      const attemptCompaction = async (retriesLeft = 2) => {
+      const attemptCompaction = async (retriesLeft = 2, deferralsLeft = 6) => {
         if (!workerPath) {
           reportCompactionFailure("compaction worker build is missing from dist/workers", "missing-worker");
           return;
         }
-        const { setCompactionInProgress: setCompactionInProgress2, waitForSyncSettled: waitForSyncSettled2, syncPauseReason: syncPauseReason2 } = await Promise.resolve().then(() => (init_git_sync(), git_sync_exports));
+        const gitSync = await Promise.resolve().then(() => (init_git_sync(), git_sync_exports));
+        const { setCompactionInProgress: setCompactionInProgress2, waitForSyncSettled: waitForSyncSettled2, syncPauseReason: syncPauseReason2 } = gitSync;
         const pausedBy = syncPauseReason2();
         if (pausedBy) {
           log.git.info("git compaction skipped \u2014 operator pause marker active", { reason: pausedBy });
           return;
         }
+        if (gitSync.compactionInProgress) {
+          if (deferralsLeft > 0) {
+            log.git.info("git compaction deferred \u2014 git maintenance holds the repo", { deferralsLeft });
+            setTimeout(() => {
+              void attemptCompaction(retriesLeft, deferralsLeft - 1);
+            }, 10 * 6e4).unref?.();
+          }
+          return;
+        }
         setCompactionInProgress2(true);
         await waitForSyncSettled2();
         const { utilityQosForkExec: utilityQosForkExec2 } = await Promise.resolve().then(() => (init_background_qos(), background_qos_exports));
@@ -294192,23 +294775,33 @@ function startGitAutoCommit() {
         Promise.resolve().then(() => (init_task_outbox(), task_outbox_exports)).then(({ reconcileAfterPull: reconcileAfterPull2 }) => reconcileAfterPull2()).catch(() => {
         });
       }
-      const size = checkRepoSize();
-      if (size) {
-        if (size.sweptBytes > 0) {
-          log.git.warn("repo-size sentinel swept dead transfer debris", { sweptBytes: size.sweptBytes, liveBytes: size.liveBytes });
-        }
-        if (size.over && size.warning) {
-          log.git.warn(size.warning);
-          void publishErrorNotification({
-            title: "Data Repo Growing Too Large",
-            body: size.warning,
-            dedupScope: "git:repo-size",
-            recoveryKey: REPO_SIZE_RECOVERY_KEY
-          });
-        }
-        if (gitRecoveryTracker.observe(REPO_SIZE_RECOVERY_KEY, size.over)) {
-          void publishRecovery([REPO_SIZE_RECOVERY_KEY]);
+      const measured2 = checkRepoSize();
+      if (measured2) {
+        if (measured2.sweptBytes > 0) {
+          log.git.warn("repo-size sentinel swept dead transfer debris", { sweptBytes: measured2.sweptBytes, liveBytes: measured2.liveBytes });
         }
+        void Promise.resolve().then(() => (init_git_maintenance(), git_maintenance_exports)).then(({ settleRepoSize: settleRepoSize2 }) => settleRepoSize2(measured2)).then((size) => {
+          if (gitTickStopped) return;
+          if (size.over && size.warning) {
+            log.git.warn(size.warning);
+            void publishErrorNotification({
+              title: "Data Repo Growing Too Large",
+              body: size.warning,
+              dedupScope: "git:repo-size",
+              recoveryKey: REPO_SIZE_RECOVERY_KEY
+            });
+          } else if (measured2.over) {
+            log.git.info("repo-size sentinel: maintenance brought the data repo under the threshold", {
+              liveBytesBefore: measured2.liveBytes,
+              liveBytesAfter: size.liveBytes
+            });
+          }
+          if (gitRecoveryTracker.observe(REPO_SIZE_RECOVERY_KEY, size.over)) {
+            void publishRecovery([REPO_SIZE_RECOVERY_KEY]);
+          }
+        }).catch((err2) => {
+          log.git.warn("repo-size sentinel failed", { error: String(err2) });
+        });
       }
       const guardState = getSyncGuardState();
       if (guardState.safeMode !== health2.safeMode) {