openmeld 0.3.124 → 0.3.127

package/dist/{command-Cp18onuk.js → command-Dk3z-M2K.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 
-import { $ as runWithHeldLock, $t as runtimeAgentControllerConversationIdMappingSpecSchema, At as openMeldBackupsDir, B as toSpaceRemoveMembersUrl, Bt as resolveDefaultOpenMeldHomeDirname, C as updateConfiguredDeviceRuntimeState, Ct as deviceOpenClawProfileBootstrapPath, D as normalizeBaseUrl, Dt as legacyAccountProfileSpacesDir, Et as isPublishedOpenMeldHome, Ft as openMeldRootDir, Gt as resolveOpenMeldRootDir, H as toSpaceUpdatesUrl, I as toSpaceLeaveUrl, It as openMeldVersionsDir, Jt as skillsDir, K as isOpenMeldLockError, Kt as runtimeDir, L as toSpaceMembersUrl, M as toSpaceCursorUrl, Mt as openMeldManagedBinaryPath, N as toSpaceDeleteUrl, Nt as openMeldManagedVersionBinaryPath, O as toDaemonRouteObservationUrl, Ot as normalizeAccountKey, Pt as openMeldManagedVersionDir, Q as resolveOpenMeldOrphanedLockIssue, R as toSpaceMetaUrl, S as setConfiguredSkillsConfig, St as accountsDir, T as updateConfiguredSkillsConfig, Tt as deviceOpenClawProfileWorkspaceDir, U as toSpaceWsUrl, Ut as resolveOpenMeldEnvPreset, Vt as resolveExplicitOpenMeldEnvPreset, W as acquireLock, Wt as resolveOpenMeldPresetOwnedPathInput, Xt as systemDir, Zt as formatLocalMachineIssueMessage, _ as getConfiguredViewCustomization, _t as OPENMELD_HOME_ENV_KEY, a as resolveBaseUrl, an as buildAgentControllerConversationRef, at as resolveCliContext, bt as accountProfileViewPath, c as resolveExplicitGatewayUrlOrThrow, cn as HOSTED_CENTER_AGENT_CONTROLLER_REF, d as createDefaultRuntimeAgentControllerSettings, dn as buildAgentControllerRoutingKey, dt as assessLocalMachineFailure, en as runtimeAgentControllerLaunchContractSchema, f as getConfiguredDaemonDispatchLimits, fn as canonicalizeAgentControllerRef, g as getConfiguredSkillsConfig, gn as parseAgentControllerRef$1, h as getConfiguredOpenMeldToolsMaintenance, hn as normalizeKnownBuiltinAgentControllerId, i as normalizeGatewayBaseUrlOrNull, it as readCliContextState, j as toSpaceCreateUrl, jt as openMeldBinDir, kt as normalizeOpenMeldProfileId, l as DEFAULT_RUNTIME_AGENT_TRANSPORT_MODE, ln as HOSTED_CENTER_AGENT_CONTROLLER_REF_ID, lt as resolveOpenMeldLaneDescriptor, mn as normalizeBuiltinAgentControllerId, nn as runtimeStreamingModeSchema, o as resolveBaseUrlOrNull, on as conversationPolicySchema, ot as resolveCliContextId, p as getConfiguredDeviceRuntimeState, pn as canonicalizeBuiltinAgentControllerRef, pt as createBackgroundExecutionBlockedIssue, q as isOpenMeldOrphanedLockError, qt as runtimeLogsDir, r as normalizeGatewayBaseUrl, rn as runtimeTransportModeSchema, rt as listCliContextStates, s as resolveDefaultGatewayBaseUrl, sn as resolveBuiltinAgentControllerConversationKind, st as writeCliContextState, v as getRuntimeConfigReadHealth, vt as accountProfileLocalMetaPath, wt as deviceOpenClawProfileDir, x as setConfiguredOpenMeldToolsMaintenance, xt as accountProfileWorkspacePath, y as resolveRuntimeSkillsCustomTargetId, yt as accountProfileSpaceCacheDir, z as toSpacePasswordUrl } from "./base-url-PkgATS5u.js";
-import { A as MAX_TEXT_LENGTH, At as createCenterAgentRoutineResponseSchema, B as sleep, C as createSpaceApi, D as toStructuredApiClientFailure, Dt as organizationComputersResponseSchema, E as resolveProfileSpaceHistoryGatewayHost, Et as profileErrorResponseSchema, F as OPENMELD_HEADER_PROFILE_ID, Ft as resumeCenterAgentRoutineResponseSchema, Gt as localProjectControlDaemonFrameSchema, H as getSpaceUpdatesResponseSchema, It as updateCenterAgentRoutineResponseSchema, Jt as postSpaceMembersResponseSchema, Kt as localProjectControlDiscoverProjectsResponseSchema, L as OPENMELD_HEADER_REQUEST_ID, M as parseIncoming$1, Mt as listCenterAgentRoutineRunsResponseSchema, N as parseServerErrorFrame$1, Nt as listCenterAgentRoutinesResponseSchema, O as DAEMON_STREAM_KEEPALIVE_PING, Ot as submitFeedbackIssueRequestSchema, P as resolveCustomMentionAliasOverride, Pt as pauseCenterAgentRoutineResponseSchema, Q as submitAgentControllerTaskLifecycleEventItemSchema, Rt as AGENT_ACTIVITY_PRESENCE_TTL_MAX_MS, S as createRuntimeReportingApi, St as ADDITIONAL_HUMAN_PROFILE_CREATION_DISABLED_MESSAGE, T as resolveAccountSpaceIndexGatewayHost, Tt as profileCapabilitiesResponseSchema, U as SPACE_DISPATCH_TRACE_PROMPT_PREVIEW_MAX_CHARS, Ut as agentActivitySnapshotResponseSchema, V as toErrorMessage$42, Wt as localProjectControlConnectionSchema, Xt as spaceMemberDirectoryEntrySchema, Yt as removeSpaceMembersResponseSchema, Zt as spaceMemberDirectorySchema, _n as agentControllerPermissionModeSchema, _t as organizationSkillReleaseSummarySchema, a as buildSpaceAttachmentDownloadPath, an as createProjectResponseSchema, at as COMPUTER_FILE_ACCESS_RUNTIME_CAPABILITY, bt as organizationDirectoryResponseSchema, c as createAgentProfileBindingApi, cn as updateProjectResponseSchema, ct as computerFileAccessPolicyInputSchema, d as createCurrentDeviceApi, dt as organizationSpaceDirectoryWithMemberCountsResponseSchema, ft as spaceCreatorSchema, g as createOrganizationApi, h as createOpenMeldApiClient, ht as listOrganizationSkillsResponseSchema, i as buildProfileSpaceHistoryUpsertPath, in as archiveProjectResponseSchema, it as gatewayErrorEnvelopeSchema, j as parseEnvelope$1, jt as deleteCenterAgentRoutineResponseSchema, kt as submitFeedbackIssueResponseSchema, ln as centerAgentToolSpeakerSchema, lt as computerFileAccessPolicySchema, m as createLocalRuntimeExpectedRoutesApi, mt as getOrganizationSkillResponseSchema, n as OpenMeldApiClientInvalidResponseError, o as createAccountSpaceIndexApi, on as listProjectsResponseSchema, ot as OPENMELD_RUNTIME_CAPABILITIES_HEADER, p as createFetchTransport, pt as spaceMetaSchema, qt as leaveSpaceResponseSchema, r as buildProfileSpaceHistoryStatusPath, rn as observedLocalAgentSessionSchema, s as createAgentActivityApi, sn as projectSchema, st as computerFileAccessDaemonFrameSchema, t as OpenMeldApiClientHttpError, tn as agentActivitySessionInventoryResponseSchema, un as openCodePermissionConfigSchema, ut as modelCatalogSchema, vn as agentControllerCollaborationModeSchema, vt as organizationSkillSummarySchema, wt as authProfileManagedRoleSchema, xt as ADDITIONAL_HUMAN_PROFILE_CREATION_DISABLED_CODE, y as createProfileSpaceHistoryApi, yn as toLegacySpaceAddressingWireValue, z as toErrorMessage$43, zt as agentActivityEventSchema } from "./dist-DYE9Q3T4.js";
-import { $r as profileWorkspaceModeSchema, $t as skippedDaemonProfileSchema, A as runtimeTransportRegisterSessionResponseSchema, An as AGENT_INTERACTION_DEFAULT_TIMEOUT_MS, B as openMeldDaemonTaskResultPayloadSchema, Bn as localCliComponentUpdateProjectionSchema, Bt as resolveSpaceFileMimeType, C as runtimeTransportLocalAgentControlRefreshCatalogFramePayloadSchema, D as runtimeTransportOpenMeldToolsControlFramePayloadSchema, E as runtimeTransportLookupRouteOwnerServiceEvidenceSchema, Fn as formatLocalComponentsSummaryDescription, Fr as resolveSpaceMentionLabels, G as localFolderPickerDaemonFrameSchema, Gr as openMeldRequestContextSchema, H as openMeldSpaceEgressActionSchema, I as runtimeTransportSubmitTaskResultRequestSchema, In as formatLocalComponentsSummaryLabel, Jn as openMeldToolsUpdateOperationPhaseSchema, Jr as normalizeOptionalWorkingDirectory, K as localFolderPickerHelperProtocolResultSchema, Kr as MAX_PROFILE_WORKING_DIRECTORY_LENGTH, Ln as formatLocalSetupActionDescription, M as runtimeTransportResumeControllerConversationFramePayloadSchema, Mn as agentInteractionRequestSchema, Mr as normalizeSpacePasswordText, N as runtimeTransportResumeControllerConversationResultFramePayloadSchema, Nn as agentInteractionResolutionSchema, O as runtimeTransportOpenMeldToolsControlResultFramePayloadSchema, Or as runtimeCoordinatorExecutionTokenEnvelopeSchema, P as runtimeTransportRouteCatalogChangedFramePayloadSchema, Pr as resolveSingleSpaceMentionLabels, Pt as SPACE_FILE_MAX_SIZE_BYTES, R as openMeldDaemonTaskResultEnvelopeWriteSchema, Rn as formatLocalSetupActionLabel, S as runtimeTransportLocalAgentControlManageInstallationFramePayloadSchema, Sn as resolveMessageEnvelopeTargetField, T as runtimeTransportLocalAgentControlSetProfileWorkspaceFramePayloadSchema, U as LOCAL_FOLDER_PICKER_RUNTIME_CAPABILITY, W as OPENMELD_LOCAL_FOLDER_PICKER_CAPABILITY_HEADER, Wn as localServiceComponentUpdateProjectionSchema, Wt as spaceFileNameSchema, Xt as openMeldDaemonControlPlaneRequestSchema, Yr as openMeldRuntimeProfileIdSchema, Zn as openMeldToolsUpdateRequestSourceSchema, Zt as openMeldDaemonControlPlaneResponseSchema, _ as runtimeTransportHeartbeatRequestSchema, _n as collectCanonicalMentionTextFragments, a as runtimeTransportCapabilitiesSchema, ai as MAX_TEXT_LENGTH$1, b as runtimeTransportLocalAgentControlForkSessionFramePayloadSchema, br as url, c as runtimeTransportDispatchInteractionRequestSchema, ci as resolvePublicAgentAvailabilityCopy, d as runtimeTransportDispatchPreviewEndRequestSchema, di as shouldPreferMappedPublicAgentFailureReason, en as providerDispatchRuntimeContextSchema, er as boolean, f as runtimeTransportDispatchPreviewRequestSchema, g as runtimeTransportForkAgentSessionResultSchema, gn as MESSAGE_MENTION_TYPE_VALUES, gt as SPACE_MENTION_REJECT_NOTICE_PURPOSE, h as runtimeTransportErrorCodeSchema, hi as resolveCommandAgentWorkActivity, hr as string, ht as SPACE_MEMBER_REMOVE_NOTICE_PURPOSE, i as localWakeRouteReportSchema, ii as trimmedStringFromUnknown, ir as enumFactory, j as runtimeTransportRejectedProfileRegistrationSchema, k as runtimeTransportRegisterSessionRequestSchema, kr as runtimeTransportDeliveryExecutionIdentitySchema, l as runtimeTransportDispatchInteractionResponseFramePayloadSchema, li as resolvePublicAgentFailureRecovery, m as runtimeTransportDispatchToolActivityRequestSchema, mr as strictObject, mt as SPACE_MEMBER_JOIN_NOTICE_PURPOSE, n as daemonExecutionCompatibilitySchema, nr as discriminatedUnion, o as runtimeTransportDeliverDispatchRequestSchema, oi as resolveDetailedPublicAgentFailureReason$1, or as iso, p as runtimeTransportDispatchRuntimeEvidenceRequestSchema, q as localFolderPickerHelperResultSchema, qn as openMeldToolsUpdateAttemptSchema, qr as agentProfileIdSchema, r as daemonStreamFrameSchema, s as runtimeTransportDispatchInteractionDeliveredRequestSchema, si as resolveMappedPublicAgentFailureReason, sr as literal, t as CURRENT_DAEMON_EXECUTION_CONTRACT_EPOCH, tn as conversationExecutionStateSchema, u as runtimeTransportDispatchLifecycleRequestSchema, ui as sanitizeDispatchErrorSummary, ut as CONVERSATION_CONTINUITY_WARNING_PURPOSE, v as runtimeTransportHeartbeatResponseSchema, vn as formatCanonicalMentionLiteral, vt as sanitizeSignalTextPreview, w as runtimeTransportLocalAgentControlSetEnabledFramePayloadSchema, wr as parseOptionalClientMessageId, x as runtimeTransportLocalAgentControlInterruptFramePayloadSchema, xn as normalizeMessageEnvelope, y as runtimeTransportLocalAgentControlCancelFramePayloadSchema, yn as getSpaceMessageAddressingRelationSupportForTargetKind, z as openMeldDaemonTaskResultOpenClawGatewayVisibilityStatusSchema, zn as installedLocalComponentsSnapshotSchema } from "./runtime-transport-CWWB2Ily.js";
+import { $ as runWithHeldLock, $t as formatLocalMachineIssueMessage, At as normalizeAccountKey, B as toSpaceRemoveMembersUrl, C as updateConfiguredDeviceRuntimeState, Ct as accountProfileWorkspacePath, D as normalizeBaseUrl, Dt as deviceOpenClawProfileWorkspaceDir, Et as deviceOpenClawProfileDir, Ft as openMeldManagedVersionBinaryPath, Gt as resolveOpenMeldEnvPreset, H as toSpaceUpdatesUrl, Ht as resolveDefaultOpenMeldHomeDirname, I as toSpaceLeaveUrl, It as openMeldManagedVersionDir, Jt as runtimeDir, K as isOpenMeldLockError, Kt as resolveOpenMeldPresetOwnedPathInput, L as toSpaceMembersUrl, Lt as openMeldRootDir, M as toSpaceCursorUrl, Mt as openMeldBackupsDir, N as toSpaceDeleteUrl, Nt as openMeldBinDir, O as toDaemonRouteObservationUrl, Ot as isPublishedOpenMeldHome, Pt as openMeldManagedBinaryPath, Q as resolveOpenMeldOrphanedLockIssue, Qt as systemDir, R as toSpaceMetaUrl, Rt as openMeldVersionsDir, S as setConfiguredSkillsConfig, St as accountProfileViewPath, T as updateConfiguredSkillsConfig, Tt as deviceOpenClawProfileBootstrapPath, U as toSpaceWsUrl, Ut as resolveExplicitOpenMeldEnvPreset, W as acquireLock, Xt as skillsDir, Yt as runtimeLogsDir, _ as getConfiguredViewCustomization, _n as normalizeKnownBuiltinAgentControllerId, _t as CURRENT_PROCESS_START_IDENTITY, a as resolveBaseUrl, an as runtimeTransportModeSchema, at as resolveCliContext, bt as accountProfileLocalMetaPath, c as resolveExplicitGatewayUrlOrThrow, cn as conversationPolicySchema, d as createDefaultRuntimeAgentControllerSettings, dn as HOSTED_CENTER_AGENT_CONTROLLER_REF_ID, dt as assessLocalMachineFailure, f as getConfiguredDaemonDispatchLimits, g as getConfiguredSkillsConfig, gn as normalizeBuiltinAgentControllerId, h as getConfiguredOpenMeldToolsMaintenance, hn as canonicalizeBuiltinAgentControllerRef, i as normalizeGatewayBaseUrlOrNull, in as runtimeStreamingModeSchema, it as readCliContextState, j as toSpaceCreateUrl, jt as normalizeOpenMeldProfileId, kt as legacyAccountProfileSpacesDir, l as DEFAULT_RUNTIME_AGENT_TRANSPORT_MODE, ln as resolveBuiltinAgentControllerConversationKind, lt as resolveOpenMeldLaneDescriptor, mn as canonicalizeAgentControllerRef, nn as runtimeAgentControllerLaunchContractSchema, o as resolveBaseUrlOrNull, ot as resolveCliContextId, p as getConfiguredDeviceRuntimeState, pn as buildAgentControllerRoutingKey, pt as createBackgroundExecutionBlockedIssue, q as isOpenMeldOrphanedLockError, qt as resolveOpenMeldRootDir, r as normalizeGatewayBaseUrl, rt as listCliContextStates, s as resolveDefaultGatewayBaseUrl, sn as buildAgentControllerConversationRef, st as writeCliContextState, tn as runtimeAgentControllerConversationIdMappingSpecSchema, un as HOSTED_CENTER_AGENT_CONTROLLER_REF, v as getRuntimeConfigReadHealth, vn as parseAgentControllerRef$1, vt as isProcessIdentityAlive, wt as accountsDir, x as setConfiguredOpenMeldToolsMaintenance, xt as accountProfileSpaceCacheDir, y as resolveRuntimeSkillsCustomTargetId, yt as OPENMELD_HOME_ENV_KEY, z as toSpacePasswordUrl } from "./base-url-BtqW4aLS.js";
+import { A as MAX_TEXT_LENGTH, At as createCenterAgentRoutineResponseSchema, B as sleep, C as createSpaceApi, D as toStructuredApiClientFailure, Dt as organizationComputersResponseSchema, E as resolveProfileSpaceHistoryGatewayHost, Et as profileErrorResponseSchema, F as OPENMELD_HEADER_PROFILE_ID, Ft as resumeCenterAgentRoutineResponseSchema, Gt as localProjectControlDaemonFrameSchema, H as getSpaceUpdatesResponseSchema, It as updateCenterAgentRoutineResponseSchema, Jt as postSpaceMembersResponseSchema, Kt as localProjectControlDiscoverProjectsResponseSchema, L as OPENMELD_HEADER_REQUEST_ID, M as parseIncoming$1, Mt as listCenterAgentRoutineRunsResponseSchema, N as parseServerErrorFrame$1, Nt as listCenterAgentRoutinesResponseSchema, O as DAEMON_STREAM_KEEPALIVE_PING, Ot as submitFeedbackIssueRequestSchema, P as resolveCustomMentionAliasOverride, Pt as pauseCenterAgentRoutineResponseSchema, Q as submitAgentControllerTaskLifecycleEventItemSchema, Rt as AGENT_ACTIVITY_PRESENCE_TTL_MAX_MS, S as createRuntimeReportingApi, St as ADDITIONAL_HUMAN_PROFILE_CREATION_DISABLED_MESSAGE, T as resolveAccountSpaceIndexGatewayHost, Tt as profileCapabilitiesResponseSchema, U as SPACE_DISPATCH_TRACE_PROMPT_PREVIEW_MAX_CHARS, Ut as agentActivitySnapshotResponseSchema, V as toErrorMessage$43, Wt as localProjectControlConnectionSchema, Xt as spaceMemberDirectoryEntrySchema, Yt as removeSpaceMembersResponseSchema, Zt as spaceMemberDirectorySchema, _n as agentControllerPermissionModeSchema, _t as organizationSkillReleaseSummarySchema, a as buildSpaceAttachmentDownloadPath, an as createProjectResponseSchema, at as COMPUTER_FILE_ACCESS_RUNTIME_CAPABILITY, bt as organizationDirectoryResponseSchema, c as createAgentProfileBindingApi, cn as updateProjectResponseSchema, ct as computerFileAccessPolicyInputSchema, d as createCurrentDeviceApi, dt as organizationSpaceDirectoryWithMemberCountsResponseSchema, ft as spaceCreatorSchema, g as createOrganizationApi, h as createOpenMeldApiClient, ht as listOrganizationSkillsResponseSchema, i as buildProfileSpaceHistoryUpsertPath, in as archiveProjectResponseSchema, it as gatewayErrorEnvelopeSchema, j as parseEnvelope$1, jt as deleteCenterAgentRoutineResponseSchema, kt as submitFeedbackIssueResponseSchema, ln as centerAgentToolSpeakerSchema, lt as computerFileAccessPolicySchema, m as createLocalRuntimeExpectedRoutesApi, mt as getOrganizationSkillResponseSchema, n as OpenMeldApiClientInvalidResponseError, o as createAccountSpaceIndexApi, on as listProjectsResponseSchema, ot as OPENMELD_RUNTIME_CAPABILITIES_HEADER, p as createFetchTransport, pt as spaceMetaSchema, qt as leaveSpaceResponseSchema, r as buildProfileSpaceHistoryStatusPath, rn as observedLocalAgentSessionSchema, s as createAgentActivityApi, sn as projectSchema, st as computerFileAccessDaemonFrameSchema, t as OpenMeldApiClientHttpError, tn as agentActivitySessionInventoryResponseSchema, un as openCodePermissionConfigSchema, ut as modelCatalogSchema, vn as agentControllerCollaborationModeSchema, vt as organizationSkillSummarySchema, wt as authProfileManagedRoleSchema, xt as ADDITIONAL_HUMAN_PROFILE_CREATION_DISABLED_CODE, y as createProfileSpaceHistoryApi, yn as toLegacySpaceAddressingWireValue, z as toErrorMessage$44, zt as agentActivityEventSchema } from "./dist-BnHChh7U.js";
+import { $r as profileWorkspaceModeSchema, $t as skippedDaemonProfileSchema, A as runtimeTransportRegisterSessionResponseSchema, An as AGENT_INTERACTION_DEFAULT_TIMEOUT_MS, B as openMeldDaemonTaskResultPayloadSchema, Bn as localCliComponentUpdateProjectionSchema, Bt as resolveSpaceFileMimeType, C as runtimeTransportLocalAgentControlRefreshCatalogFramePayloadSchema, D as runtimeTransportOpenMeldToolsControlFramePayloadSchema, E as runtimeTransportLookupRouteOwnerServiceEvidenceSchema, Fn as formatLocalComponentsSummaryDescription, Fr as resolveSpaceMentionLabels, G as localFolderPickerDaemonFrameSchema, Gr as openMeldRequestContextSchema, H as openMeldSpaceEgressActionSchema, I as runtimeTransportSubmitTaskResultRequestSchema, In as formatLocalComponentsSummaryLabel, Jn as openMeldToolsUpdateOperationPhaseSchema, Jr as normalizeOptionalWorkingDirectory, K as localFolderPickerHelperProtocolResultSchema, Kr as MAX_PROFILE_WORKING_DIRECTORY_LENGTH, Ln as formatLocalSetupActionDescription, M as runtimeTransportResumeControllerConversationFramePayloadSchema, Mn as agentInteractionRequestSchema, Mr as normalizeSpacePasswordText, N as runtimeTransportResumeControllerConversationResultFramePayloadSchema, Nn as agentInteractionResolutionSchema, O as runtimeTransportOpenMeldToolsControlResultFramePayloadSchema, Or as runtimeCoordinatorExecutionTokenEnvelopeSchema, P as runtimeTransportRouteCatalogChangedFramePayloadSchema, Pr as resolveSingleSpaceMentionLabels, Pt as SPACE_FILE_MAX_SIZE_BYTES, R as openMeldDaemonTaskResultEnvelopeWriteSchema, Rn as formatLocalSetupActionLabel, S as runtimeTransportLocalAgentControlManageInstallationFramePayloadSchema, Sn as resolveMessageEnvelopeTargetField, T as runtimeTransportLocalAgentControlSetProfileWorkspaceFramePayloadSchema, U as LOCAL_FOLDER_PICKER_RUNTIME_CAPABILITY, W as OPENMELD_LOCAL_FOLDER_PICKER_CAPABILITY_HEADER, Wn as localServiceComponentUpdateProjectionSchema, Wt as spaceFileNameSchema, Xt as openMeldDaemonControlPlaneRequestSchema, Yr as openMeldRuntimeProfileIdSchema, Zn as openMeldToolsUpdateRequestSourceSchema, Zt as openMeldDaemonControlPlaneResponseSchema, _ as runtimeTransportHeartbeatRequestSchema, _n as collectCanonicalMentionTextFragments, a as runtimeTransportCapabilitiesSchema, ai as MAX_TEXT_LENGTH$1, b as runtimeTransportLocalAgentControlForkSessionFramePayloadSchema, br as url, c as runtimeTransportDispatchInteractionRequestSchema, ci as resolvePublicAgentAvailabilityCopy, d as runtimeTransportDispatchPreviewEndRequestSchema, di as shouldPreferMappedPublicAgentFailureReason, en as providerDispatchRuntimeContextSchema, er as boolean, f as runtimeTransportDispatchPreviewRequestSchema, g as runtimeTransportForkAgentSessionResultSchema, gn as MESSAGE_MENTION_TYPE_VALUES, gt as SPACE_MENTION_REJECT_NOTICE_PURPOSE, h as runtimeTransportErrorCodeSchema, hi as resolveCommandAgentWorkActivity, hr as string, ht as SPACE_MEMBER_REMOVE_NOTICE_PURPOSE, i as localWakeRouteReportSchema, ii as trimmedStringFromUnknown, ir as enumFactory, j as runtimeTransportRejectedProfileRegistrationSchema, k as runtimeTransportRegisterSessionRequestSchema, kr as runtimeTransportDeliveryExecutionIdentitySchema, l as runtimeTransportDispatchInteractionResponseFramePayloadSchema, li as resolvePublicAgentFailureRecovery, m as runtimeTransportDispatchToolActivityRequestSchema, mr as strictObject, mt as SPACE_MEMBER_JOIN_NOTICE_PURPOSE, n as daemonExecutionCompatibilitySchema, nr as discriminatedUnion, o as runtimeTransportDeliverDispatchRequestSchema, oi as resolveDetailedPublicAgentFailureReason$1, or as iso, p as runtimeTransportDispatchRuntimeEvidenceRequestSchema, q as localFolderPickerHelperResultSchema, qn as openMeldToolsUpdateAttemptSchema, qr as agentProfileIdSchema, r as daemonStreamFrameSchema, s as runtimeTransportDispatchInteractionDeliveredRequestSchema, si as resolveMappedPublicAgentFailureReason, sr as literal, t as CURRENT_DAEMON_EXECUTION_CONTRACT_EPOCH, tn as conversationExecutionStateSchema, u as runtimeTransportDispatchLifecycleRequestSchema, ui as sanitizeDispatchErrorSummary, ut as CONVERSATION_CONTINUITY_WARNING_PURPOSE, v as runtimeTransportHeartbeatResponseSchema, vn as formatCanonicalMentionLiteral, vt as sanitizeSignalTextPreview, w as runtimeTransportLocalAgentControlSetEnabledFramePayloadSchema, wr as parseOptionalClientMessageId, x as runtimeTransportLocalAgentControlInterruptFramePayloadSchema, xn as normalizeMessageEnvelope, y as runtimeTransportLocalAgentControlCancelFramePayloadSchema, yn as getSpaceMessageAddressingRelationSupportForTargetKind, z as openMeldDaemonTaskResultOpenClawGatewayVisibilityStatusSchema, zn as installedLocalComponentsSnapshotSchema } from "./runtime-transport-CHbXitKu.js";
 import { r as daemonServiceLaneSchema, t as daemonServiceContractSchema } from "./service-contract-CRyDcIIf.js";
-import { A as getDaemonRuntimeStatus, B as resolveDaemonServiceRuntimeMetadata, C as daemonServiceRepairJournalPath, D as daemonServiceUpdateWorkerBinaryExecutablePath, E as daemonServiceStableLauncherPath, F as readDaemonServiceLifecycleLockMeta, G as withDaemonServiceReconcileLock, H as rotateDaemonControlPlaneTokenIfExpired, I as readDaemonServiceLifecycleLockMetaWithCleanup, J as withDaemonServiceStopLock, K as withDaemonServiceRegistrationMutationLock, L as readDaemonServiceRuntimeSnapshot, M as installDaemon, N as isDaemonServiceRuntimeHeartbeatStale, O as daemonStatePath, P as readDaemonControlPlaneToken, R as releaseDaemonServiceLifecycleLock, S as daemonServiceRecognizedExecutablePaths$1, T as daemonServiceStableExecutableWrapperPath, U as setDaemonServiceRuntimeState, V as restoreDaemonInstallStateSnapshot, W as uninstallDaemon, X as writeDaemonLocalStateFile, Y as readDaemonLocalStateFile, _ as daemonRuntimeServiceManagerPath, a as DAEMON_SERVICE_RUNTIME_CONTROLLER_ENV, b as daemonServiceExecutableWrapperPaths$1, c as DAEMON_SERVICE_RUNTIME_STATE_SCHEMA, d as clearDaemonServiceRuntimeState, f as daemonDispatchJournalPath, g as daemonRuntimeRootPath, h as daemonRuntimeDataPath, i as DAEMON_SERVICE_RUNTIME_AUTO_START_ENV, j as getDaemonStatus, k as ensureDaemonControlPlaneToken, l as DAEMON_SERVICE_RUNTIME_SYSTEM_SERVICE_ENV, m as daemonRuntimeBundlesPath, n as writeDaemonRuntimeLease, o as DAEMON_SERVICE_RUNTIME_DETACHED_ENV, p as daemonLifecycleJournalPath, q as withDaemonServiceRunLock, r as DAEMON_HEARTBEAT_STALE_MS, s as DAEMON_SERVICE_RUNTIME_MODE_ENV, t as readDaemonRuntimeLease, u as acquireDaemonServiceLifecycleLock, v as daemonRuntimeStateRootPath, w as daemonServiceStableBinaryExecutablePath, x as daemonServiceLegacyExecutableWrapperPath, y as daemonServiceActiveBundleStatePath, z as resolveDaemonControlPlaneEndpoint } from "./daemon-runtime-lease-Cvo63MGd.js";
-import { D as PROVIDER_CONVERSATION_PROOF_SYNC_INTERVAL_MS$1, E as OPENCLAW_CLI_TIMEOUT_MS$1, M as RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_RETRY_INTERVAL_MS$1, N as RUNTIME_STATE_PERSIST_MIN_INTERVAL_MS$1, O as PROVIDER_CONVERSATION_PROOF_SYNC_RETRY_INTERVAL_MS$1, S as MAX_HEARTBEAT_INTERVAL_MS$2, _ as DAEMON_STREAM_KEEPALIVE_PONG_TIMEOUT_MS$1, d as resolveOpenMeldDistribution, f as CATALOG_SYNC_RETRY_INTERVAL_MS$1, g as DAEMON_STREAM_KEEPALIVE_INTERVAL_MS$1, h as DAEMON_STREAM_CONNECT_TIMEOUT_MS$1, i as getAuthSessionState, j as RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_INTERVAL_MS$1, k as REGISTER_RESPONSE_TIMEOUT_MS$1, m as DAEMON_RUNTIME_CONTRACT_EPOCH$1, n as clearAuthSession, p as CATALOG_SYNC_SIGNAL_POLL_INTERVAL_MS$1, s as setAuthSession, u as isBinaryDistribution, v as DEFAULT_GATEWAY_CHAIN_TIMEOUT_MS$1, w as MIN_HEARTBEAT_INTERVAL_MS$2, x as HEARTBEAT_RESPONSE_TIMEOUT_MS$1, y as DEFAULT_HEARTBEAT_INTERVAL_MS$1 } from "./auth-session-qk94UQqs.js";
-import { a as buildOpenMeldProfileIdentityRequestHeadersWithAuth, c as buildRequestAuthHeaders, d as buildOpenMeldRequestContextFromProfile, f as buildOpenMeldRequestContextFromProfileIdentity, i as resolveSpaceRequestTimeoutMsForDiagnostics, l as canAttachAuthTokenToRequest, m as resolveAuthRequestCompatibility, n as createCliApiClientFoundation, o as buildOpenMeldProfileRequestHeadersWithAuth, p as deriveAuthBaseUrlFromGatewayUrl, r as fetchSpaceRequestWithTimeout, s as buildOpenMeldRequestContextHeadersWithAuth, u as resolveAuthTokenAttachment } from "./api-client-foundation-w4Oa06t4.js";
+import { A as getDaemonRuntimeStatus, B as resolveDaemonServiceRuntimeMetadata, C as daemonServiceRepairJournalPath, D as daemonServiceUpdateWorkerBinaryExecutablePath, E as daemonServiceStableLauncherPath, F as readDaemonServiceLifecycleLockMeta, G as withDaemonServiceReconcileLock, H as rotateDaemonControlPlaneTokenIfExpired, I as readDaemonServiceLifecycleLockMetaWithCleanup, J as withDaemonServiceStopLock, K as withDaemonServiceRegistrationMutationLock, L as readDaemonServiceRuntimeSnapshot, M as installDaemon, N as isDaemonServiceRuntimeHeartbeatStale, O as daemonStatePath, P as readDaemonControlPlaneToken, R as releaseDaemonServiceLifecycleLock, S as daemonServiceRecognizedExecutablePaths$1, T as daemonServiceStableExecutableWrapperPath, U as setDaemonServiceRuntimeState, V as restoreDaemonInstallStateSnapshot, W as uninstallDaemon, X as writeDaemonLocalStateFile, Y as readDaemonLocalStateFile, _ as daemonRuntimeServiceManagerPath, a as DAEMON_SERVICE_RUNTIME_CONTROLLER_ENV, b as daemonServiceExecutableWrapperPaths$1, c as DAEMON_SERVICE_RUNTIME_STATE_SCHEMA, d as clearDaemonServiceRuntimeState, f as daemonDispatchJournalPath, g as daemonRuntimeRootPath, h as daemonRuntimeDataPath, i as DAEMON_SERVICE_RUNTIME_AUTO_START_ENV, j as getDaemonStatus, k as ensureDaemonControlPlaneToken, l as DAEMON_SERVICE_RUNTIME_SYSTEM_SERVICE_ENV, m as daemonRuntimeBundlesPath, n as writeDaemonRuntimeLease, o as DAEMON_SERVICE_RUNTIME_DETACHED_ENV, p as daemonLifecycleJournalPath, q as withDaemonServiceRunLock, r as DAEMON_HEARTBEAT_STALE_MS, s as DAEMON_SERVICE_RUNTIME_MODE_ENV, t as readDaemonRuntimeLease, u as acquireDaemonServiceLifecycleLock, v as daemonRuntimeStateRootPath, w as daemonServiceStableBinaryExecutablePath, x as daemonServiceLegacyExecutableWrapperPath, y as daemonServiceActiveBundleStatePath, z as resolveDaemonControlPlaneEndpoint } from "./daemon-runtime-lease-D82uDZ5s.js";
+import { A as MAX_HEARTBEAT_INTERVAL_MS$2, B as RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_RETRY_INTERVAL_MS$1, C as DAEMON_STREAM_CONNECT_TIMEOUT_MS$1, D as DEFAULT_HEARTBEAT_INTERVAL_MS$1, E as DEFAULT_GATEWAY_CHAIN_TIMEOUT_MS$1, F as PROVIDER_CONVERSATION_PROOF_SYNC_INTERVAL_MS$1, I as PROVIDER_CONVERSATION_PROOF_SYNC_RETRY_INTERVAL_MS$1, L as REGISTER_RESPONSE_TIMEOUT_MS$1, M as MIN_HEARTBEAT_INTERVAL_MS$2, P as OPENCLAW_CLI_TIMEOUT_MS$1, S as DAEMON_RUNTIME_CONTRACT_EPOCH$1, T as DAEMON_STREAM_KEEPALIVE_PONG_TIMEOUT_MS$1, V as RUNTIME_STATE_PERSIST_MIN_INTERVAL_MS$1, _ as isBinaryDistribution, a as clearAuthSession, b as CATALOG_SYNC_RETRY_INTERVAL_MS$1, c as getAuthSessionState, i as beginAuthSessionTransition, k as HEARTBEAT_RESPONSE_TIMEOUT_MS$1, m as setAuthSession, n as assertAuthSessionMutationAvailable, v as resolveOpenMeldDistribution, w as DAEMON_STREAM_KEEPALIVE_INTERVAL_MS$1, x as CATALOG_SYNC_SIGNAL_POLL_INTERVAL_MS$1, z as RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_INTERVAL_MS$1 } from "./auth-session-B1jSy0ws.js";
+import { a as AuthRequestCredentialError, c as buildOpenMeldRequestContextHeadersWithAuth, d as buildOpenMeldRequestContextFromProfile, f as buildOpenMeldRequestContextFromProfileIdentity, i as resolveSpaceRequestTimeoutMsForDiagnostics, l as buildRequestAuthHeaders, m as resolveAuthRequestCompatibility, n as createCliApiClientFoundation, o as buildOpenMeldProfileIdentityRequestHeadersWithAuth, p as deriveAuthBaseUrlFromGatewayUrl, r as fetchSpaceRequestWithTimeout, s as buildOpenMeldProfileRequestHeadersWithAuth, u as canAttachAuthTokenToRequest } from "./api-client-foundation-eG7A-GEB.js";
 import { createRequire } from "node:module";
 import { homedir, tmpdir, userInfo } from "node:os";
 import * as z$1 from "zod/v4";
@@ -20,13 +20,13 @@ import { createHash, randomUUID } from "node:crypto";
 import { access, appendFile, chmod, copyFile, cp, link, lstat, mkdir, mkdtemp, open, readFile, readdir, readlink, realpath, rename, rm, stat, symlink, unlink, writeFile } from "node:fs/promises";
 import { execFile, execFileSync, spawn } from "node:child_process";
 import { accessSync, appendFileSync, chmodSync, constants, createReadStream, existsSync, mkdirSync, readFileSync, readSync, readdirSync, realpathSync, renameSync, statSync, watch, writeFileSync } from "node:fs";
+import { setTimeout as setTimeout$1 } from "node:timers/promises";
 import { fileURLToPath } from "node:url";
 import { Worker } from "node:worker_threads";
 import { clearLine, createInterface, cursorTo, moveCursor } from "node:readline";
 import { forkSession, query } from "@anthropic-ai/claude-agent-sdk";
 import { createConnection, createServer } from "node:net";
 import { createOpencodeClient } from "@opencode-ai/sdk/v2";
-import { setTimeout as setTimeout$1 } from "node:timers/promises";
 import { cancel, confirm, isCancel, multiselect, password, select, text } from "@clack/prompts";
 import WebSocket from "ws";
 import wrapAnsi from "wrap-ansi";
@@ -744,6 +744,59 @@ const daemonServiceUpdateJobSchema = daemonServiceUpdateJobBodySchema.extend({
 });
 const storedDaemonServiceUpdateJobSchema = z$1.discriminatedUnion("v", [daemonServiceUpdateJobV1Schema, daemonServiceUpdateJobSchema]);
 //#endregion
+//#region ../../packages/schemas/dist/schemas/http/auth-device-authorization.js
+const BETTER_AUTH_DEVICE_AUTHORIZATION_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
+const betterAuthDeviceAuthorizationCodeRequestSchema = z$1.object({
+	client_id: z$1.string().min(1),
+	scope: z$1.string().optional(),
+	user_id: z$1.string().optional()
+});
+const betterAuthDeviceAuthorizationCodeResponseSchema = z$1.object({
+	device_code: z$1.string().min(1),
+	user_code: z$1.string().min(1),
+	verification_uri: z$1.string().min(1),
+	verification_uri_complete: z$1.string().min(1),
+	expires_in: z$1.number().finite().positive(),
+	interval: z$1.number().finite().positive()
+});
+const betterAuthDeviceAuthorizationStatusSchema = z$1.enum([
+	"pending",
+	"approved",
+	"denied"
+]);
+z$1.object({
+	user_code: z$1.string().min(1),
+	status: betterAuthDeviceAuthorizationStatusSchema
+});
+z$1.object({ userCode: z$1.string().min(1) });
+z$1.object({ success: z$1.boolean() });
+const betterAuthDeviceAuthorizationTokenRequestSchema = z$1.object({
+	grant_type: z$1.literal(BETTER_AUTH_DEVICE_AUTHORIZATION_GRANT_TYPE),
+	device_code: z$1.string().min(1),
+	client_id: z$1.string().min(1)
+});
+const betterAuthDeviceAuthorizationTokenResponseSchema = z$1.object({
+	access_token: z$1.string().min(1),
+	token_type: z$1.string().min(1),
+	expires_in: z$1.number().finite().positive(),
+	scope: z$1.string()
+});
+const betterAuthDeviceAuthorizationErrorResponseSchema = z$1.object({
+	error: z$1.string().optional(),
+	error_description: z$1.string().optional(),
+	message: z$1.string().optional(),
+	detail: z$1.string().optional()
+});
+const betterAuthSessionUserSnapshotSchema = z$1.object({
+	id: z$1.string().optional(),
+	email: z$1.string().optional(),
+	name: z$1.string().optional()
+});
+const betterAuthSessionSnapshotResponseSchema = z$1.nullable(z$1.object({
+	session: z$1.unknown().optional(),
+	user: betterAuthSessionUserSnapshotSchema.nullable()
+}));
+//#endregion
 //#region ../../packages/schemas/dist/schemas/http/cli-binary-manifest.js
 const SHA256_HEX_PATTERN = /^[a-f0-9]{64}$/u;
 function isBase64(value) {
@@ -1174,7 +1227,6 @@ function sanitizeCardValue(value) {
 //#region src/agent-activity/local-state-lock.ts
 const POLL_MS = 20;
 const OWNER_INITIALIZATION_GRACE_MS = 1e3;
-const PROCESS_START_IDENTITY = readProcessStartIdentity(process.pid) ?? `fallback:${process.pid}:${Math.floor(Date.now() - process.uptime() * 1e3)}`;
 async function withAgentActivityLocalStateLock(input, operation) {
 	return await withDirectoryLease(input, "state", 5e3, 3e4, operation);
 }
@@ -1318,50 +1370,16 @@ function currentLeaseOwner(token, leaseMs) {
 	return {
 		expiresAtMs: Date.now() + leaseMs,
 		ownerPid: process.pid,
-		ownerProcessStartedAt: PROCESS_START_IDENTITY,
+		ownerProcessStartedAt: CURRENT_PROCESS_START_IDENTITY,
 		token,
 		version: 1
 	};
 }
 function isCurrentOwner(owner, token) {
-	return Boolean(owner && owner.token === token && owner.ownerPid === process.pid && owner.ownerProcessStartedAt === PROCESS_START_IDENTITY);
+	return Boolean(owner && owner.token === token && owner.ownerPid === process.pid && owner.ownerProcessStartedAt === CURRENT_PROCESS_START_IDENTITY);
 }
 function isLeaseOwnerStillRunning(owner) {
-	if (!isProcessAlive$1(owner.ownerPid)) return false;
-	const observedIdentity = readProcessStartIdentity(owner.ownerPid);
-	if (observedIdentity?.startsWith("ps:") && owner.ownerProcessStartedAt.startsWith("ps:")) return observedIdentity === owner.ownerProcessStartedAt;
-	return true;
-}
-function readProcessStartIdentity(pid) {
-	if (!(Number.isSafeInteger(pid) && pid > 0)) return null;
-	try {
-		const output = execFileSync("ps", [
-			"-o",
-			"lstart=",
-			"-p",
-			String(pid)
-		], {
-			encoding: "utf8",
-			stdio: [
-				"ignore",
-				"pipe",
-				"ignore"
-			],
-			timeout: 1e3,
-			windowsHide: true
-		}).trim();
-		return output.length > 0 ? `ps:${output}` : null;
-	} catch {
-		return null;
-	}
-}
-function isProcessAlive$1(pid) {
-	try {
-		process.kill(pid, 0);
-		return true;
-	} catch (error) {
-		return !isNodeError$11(error, "ESRCH");
-	}
+	return isProcessIdentityAlive(owner);
 }
 function isNodeError$11(error, code) {
 	return error instanceof Error && "code" in error && String(error.code) === code;
@@ -2161,13 +2179,13 @@ async function migrateProjectBindingStore(input) {
 	}));
 }
 function parseProjectBindingStore(value, path) {
-	if (isRecord$9(value) && typeof value.version === "number" && Number.isSafeInteger(value.version) && value.version > 3) throw new ProjectBindingStoreUpdateRequiredError(path, value.version);
-	if (!(isRecord$9(value) && (value.version === 1 || value.version === LEGACY_STORE_VERSION || value.version === 3) && Array.isArray(value.bindings))) throw new Error(`Project binding store is invalid: ${path}`);
+	if (isRecord$10(value) && typeof value.version === "number" && Number.isSafeInteger(value.version) && value.version > 3) throw new ProjectBindingStoreUpdateRequiredError(path, value.version);
+	if (!(isRecord$10(value) && (value.version === 1 || value.version === LEGACY_STORE_VERSION || value.version === 3) && Array.isArray(value.bindings))) throw new Error(`Project binding store is invalid: ${path}`);
 	const storeVersion = value.version;
 	const bindings = value.bindings.map((binding, index) => {
 		const label = `${path} bindings[${index}]`;
 		const parsed = parseBinding(binding, label, storeVersion === 1 ? 1 : LEGACY_STORE_VERSION);
-		const isDefault = storeVersion === 3 ? requireBoolean(isRecord$9(binding) ? binding.isDefault : void 0, `${label}.isDefault`) : true;
+		const isDefault = storeVersion === 3 ? requireBoolean(isRecord$10(binding) ? binding.isDefault : void 0, `${label}.isDefault`) : true;
 		return {
 			...parsed,
 			isDefault
@@ -2202,7 +2220,7 @@ function assertProjectBindingStoreV3Invariants(bindings, path, sourceVersion) {
 	}
 }
 function parseBinding(value, label, storeVersion) {
-	if (!isRecord$9(value)) throw new Error(`Agent Activity Project binding is invalid: ${label}`);
+	if (!isRecord$10(value)) throw new Error(`Agent Activity Project binding is invalid: ${label}`);
 	const repositoryFingerprint = value.repositoryFingerprint === null ? null : normalizeFingerprint(value.repositoryFingerprint);
 	const boundAtMs = Number(value.boundAtMs);
 	if (!Number.isSafeInteger(boundAtMs) || boundAtMs < 0) throw new Error(`Agent Activity Project binding is invalid: ${label}`);
@@ -2217,7 +2235,7 @@ function parseBinding(value, label, storeVersion) {
 	};
 }
 function readProjectBindingStoreVersion(value) {
-	if (!(isRecord$9(value) && (value.version === 1 || value.version === LEGACY_STORE_VERSION || value.version === 3))) throw new Error("Project binding store version is invalid");
+	if (!(isRecord$10(value) && (value.version === 1 || value.version === LEGACY_STORE_VERSION || value.version === 3))) throw new Error("Project binding store version is invalid");
 	return value.version;
 }
 function normalizeFingerprint(value) {
@@ -2234,7 +2252,7 @@ function requireBoolean(value, label) {
 	if (typeof value !== "boolean") throw new Error(`${label} is required`);
 	return value;
 }
-function isRecord$9(value) {
+function isRecord$10(value) {
 	return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
 function isNodeError$9(error, code) {
@@ -2668,7 +2686,7 @@ async function readCodexSessionTitles(input) {
 		if (!line.trim()) continue;
 		try {
 			const record = JSON.parse(line);
-			if (!isRecord$8(record)) continue;
+			if (!isRecord$9(record)) continue;
 			const sessionId = text$4(record.id);
 			const title = normalizeSharedSessionTitle(record.thread_name);
 			if (sessionId && title) titles.set(sessionId, title);
@@ -2683,7 +2701,7 @@ function normalizeSharedSessionTitle(value) {
 function text$4(value) {
 	return typeof value === "string" && value.trim() ? value.trim() : null;
 }
-function isRecord$8(value) {
+function isRecord$9(value) {
 	return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 function isNodeError$6(error) {
@@ -2693,12 +2711,12 @@ function isNodeError$6(error) {
 //#region src/agent-activity/observer-adapters.ts
 const ACTIVE_WINDOW_MS = 2 * 6e4;
 function parseCodexRolloutSnapshot(input) {
-	const meta = input.lines.find((line) => isRecord$7(line) && line.type === "session_meta" && isRecord$7(line.payload));
-	if (!(isRecord$7(meta) && isRecord$7(meta.payload))) return null;
+	const meta = input.lines.find((line) => isRecord$8(line) && line.type === "session_meta" && isRecord$8(line.payload));
+	if (!(isRecord$8(meta) && isRecord$8(meta.payload))) return null;
 	const sessionId = text$3(meta.payload.id);
 	const cwd = text$3(meta.payload.cwd);
 	if (!(sessionId && cwd)) return null;
-	const safeEvidence = input.lines.filter((line) => isRecord$7(line)).map((line) => ({
+	const safeEvidence = input.lines.filter((line) => isRecord$8(line)).map((line) => ({
 		line,
 		observedAtMs: timestamp$1(line.timestamp)
 	})).filter((entry) => entry.observedAtMs !== null).sort((left, right) => Number(left.observedAtMs) - Number(right.observedAtMs));
@@ -2706,17 +2724,17 @@ function parseCodexRolloutSnapshot(input) {
 	const latestTurn = [...safeEvidence].reverse().find((entry) => entry.line.type === "turn_context");
 	const observedAtMs = latest?.observedAtMs ?? timestamp$1(meta.timestamp);
 	if (observedAtMs === null) return null;
-	const turnPayload = isRecord$7(latestTurn?.line.payload) ? latestTurn.line.payload : {};
+	const turnPayload = isRecord$8(latestTurn?.line.payload) ? latestTurn.line.payload : {};
 	const originator = normalizeCodexOriginator(meta.payload);
 	const status = resolveObservedStatus({
 		explicitIdle: safeEvidence.slice(-4).some((entry) => {
-			const payload = isRecord$7(entry.line.payload) ? entry.line.payload : null;
+			const payload = isRecord$8(entry.line.payload) ? entry.line.payload : null;
 			return entry.line.type === "event_msg" && (payload?.type === "task_complete" || payload?.type === "turn_aborted");
 		}),
 		nowMs: input.nowMs,
 		observedAtMs
 	});
-	const git = isRecord$7(meta.payload.git) ? meta.payload.git : {};
+	const git = isRecord$8(meta.payload.git) ? meta.payload.git : {};
 	return {
 		clientKind: resolveCodexClientKind(originator),
 		cwd,
@@ -2734,7 +2752,7 @@ function parseCodexRolloutSnapshot(input) {
 				"never"
 			]),
 			cliVersion: nullableText$1(meta.payload.cli_version),
-			contextWindow: positiveInteger(isRecord$7(turnPayload.summary) ? turnPayload.summary.model_context_window : void 0),
+			contextWindow: positiveInteger(isRecord$8(turnPayload.summary) ? turnPayload.summary.model_context_window : void 0),
 			modelProvider: nullableText$1(meta.payload.model_provider),
 			originator,
 			reasoningEffort: enumValue(turnPayload.effort, [
@@ -2745,7 +2763,7 @@ function parseCodexRolloutSnapshot(input) {
 				"xhigh",
 				"ultra"
 			]),
-			sandboxMode: enumValue(isRecord$7(turnPayload.sandbox_policy) ? turnPayload.sandbox_policy.type : turnPayload.sandbox_policy, [
+			sandboxMode: enumValue(isRecord$8(turnPayload.sandbox_policy) ? turnPayload.sandbox_policy.type : turnPayload.sandbox_policy, [
 				"read-only",
 				"workspace-write",
 				"danger-full-access"
@@ -2763,7 +2781,7 @@ function resolveCodexClientKind(originator) {
 	return originator === "cli" ? "codex-cli" : "unknown";
 }
 function parseClaudeTranscriptSnapshot(input) {
-	const records = input.lines.filter((line) => isRecord$7(line));
+	const records = input.lines.filter((line) => isRecord$8(line));
 	const identity = records.find((line) => text$3(line.sessionId) && text$3(line.cwd));
 	if (!identity) return null;
 	const providerSessionId = text$3(identity.sessionId);
@@ -2775,7 +2793,7 @@ function parseClaudeTranscriptSnapshot(input) {
 	})).filter((entry) => entry.observedAtMs !== null).sort((left, right) => left.observedAtMs - right.observedAtMs);
 	const latest = timed.at(-1);
 	if (!latest) return null;
-	const latestWithModel = [...timed].reverse().find((entry) => isRecord$7(entry.line.message) && text$3(entry.line.message.model));
+	const latestWithModel = [...timed].reverse().find((entry) => isRecord$8(entry.line.message) && text$3(entry.line.message.model));
 	const customTitle = [...records].reverse().find((line) => line.type === "custom-title");
 	const status = resolveObservedStatus({
 		explicitIdle: false,
@@ -2788,7 +2806,7 @@ function parseClaudeTranscriptSnapshot(input) {
 		eventType: status === "active" ? "heartbeat" : statusEventType(status),
 		gitBranch: nullableText$1(latest.line.gitBranch ?? identity.gitBranch),
 		gitCommit: null,
-		model: isRecord$7(latestWithModel?.line.message) ? nullableText$1(latestWithModel.line.message.model) : null,
+		model: isRecord$8(latestWithModel?.line.message) ? nullableText$1(latestWithModel.line.message.model) : null,
 		observedAtMs: latest.observedAtMs,
 		provider: "claude-code",
 		providerMetadata: compact({
@@ -2915,7 +2933,7 @@ function resolveObservedStatus(input) {
 }
 function normalizeCodexOriginator(meta) {
 	if (text$3(meta.originator) === "Codex Desktop") return "desktop";
-	if (isRecord$7(meta.source) && "subagent" in meta.source) return "subagent";
+	if (isRecord$8(meta.source) && "subagent" in meta.source) return "subagent";
 	const originator = text$3(meta.originator)?.toLowerCase();
 	return originator === "codex cli" || originator === "codex_cli" ? "cli" : void 0;
 }
@@ -2960,16 +2978,16 @@ function text$3(value) {
 	return typeof value === "string" && value.trim() ? value.trim() : null;
 }
 function parseJsonRecord$1(value) {
-	if (isRecord$7(value)) return value;
+	if (isRecord$8(value)) return value;
 	if (typeof value !== "string") return null;
 	try {
 		const parsed = JSON.parse(value);
-		return isRecord$7(parsed) ? parsed : null;
+		return isRecord$8(parsed) ? parsed : null;
 	} catch {
 		return null;
 	}
 }
-function isRecord$7(value) {
+function isRecord$8(value) {
 	return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 //#endregion
@@ -4683,7 +4701,7 @@ async function verifyLaunchContractFiles(input) {
 		};
 	} catch (error) {
 		return {
-			errorMessage: toErrorMessage$41(error),
+			errorMessage: toErrorMessage$42(error),
 			failureKind: "completed_negative",
 			ok: false
 		};
@@ -4712,7 +4730,7 @@ async function verifyCliLaunchContract(input) {
 		return fileCheck;
 	} catch (error) {
 		return {
-			errorMessage: `${input.displayName} can't start on this device: ${toErrorMessage$41(error)}`,
+			errorMessage: `${input.displayName} can't start on this device: ${toErrorMessage$42(error)}`,
 			failureKind: classifyLaunchContractVerificationFailure(error),
 			ok: false
 		};
@@ -4828,7 +4846,7 @@ async function inspectInstalledNodeScriptLaunchCandidate(input) {
 		};
 	} catch (error) {
 		return {
-			errorMessage: `${input.displayName} is installed, but OpenMeld could not inspect its launch files: ${toErrorMessage$41(error)}`,
+			errorMessage: `${input.displayName} is installed, but OpenMeld could not inspect its launch files: ${toErrorMessage$42(error)}`,
 			ok: false
 		};
 	}
@@ -5256,7 +5274,7 @@ function normalizePathForDetection(path) {
 function pathIsEqualOrDescendant(path, parentPath) {
 	return path === parentPath || path.startsWith(`${parentPath}/`);
 }
-function toErrorMessage$41(error) {
+function toErrorMessage$42(error) {
 	return error instanceof Error ? error.message : String(error);
 }
 //#endregion
@@ -5534,7 +5552,7 @@ var AcpProcessSession = class {
 				cause: error,
 				code: "protocol.invalid",
 				errorType: "adapter",
-				message: `protocol.invalid: ${this.#processLabel} ACP emitted non-JSON-RPC output (${toErrorMessage$40(error)})`
+				message: `protocol.invalid: ${this.#processLabel} ACP emitted non-JSON-RPC output (${toErrorMessage$41(error)})`
 			}));
 			return;
 		}
@@ -5696,7 +5714,7 @@ function normalizeOptionalText$73(value) {
 	const normalized = String(value ?? "").trim();
 	return normalized.length > 0 ? normalized : null;
 }
-function toErrorMessage$40(error) {
+function toErrorMessage$41(error) {
 	return error instanceof Error ? error.message : String(error);
 }
 //#endregion
@@ -7971,6 +7989,7 @@ async function invokeClaudeAgentSdkTransport(input) {
 			prompt: createSinglePrompt(input.instructionPrompt?.userPrompt ?? prompt)
 		});
 		if (input.taskId) unregisterQuery = input.registerQuery?.({
+			permissionModeUpdatesAllowed: input.executionMode !== "repair",
 			query: queryRuntime,
 			taskId: input.taskId
 		});
@@ -8469,7 +8488,7 @@ async function invokeClaudeWithSingleContextHeal(input) {
 			return new ClaudeRuntimeError({
 				code: "context.rebuild_failed",
 				errorType: "adapter",
-				message: `context.rebuild_failed: ${toErrorMessage$39(error)}`,
+				message: `context.rebuild_failed: ${toErrorMessage$40(error)}`,
 				...providerAccessEvidence ? { providerAccessEvidence } : {},
 				...telemetry ? { telemetry } : {}
 			});
@@ -8529,7 +8548,7 @@ async function invokeClaudeOnce(input) {
 		throw new ClaudeRuntimeError({
 			code: "upstream_unreachable",
 			errorType: "adapter",
-			message: `upstream_unreachable: ${toErrorMessage$39(error)}`
+			message: `upstream_unreachable: ${toErrorMessage$40(error)}`
 		});
 	}
 }
@@ -8582,7 +8601,7 @@ function getClaudeTelemetry(error) {
 	const telemetry = error.telemetry;
 	return telemetry && typeof telemetry === "object" ? telemetry : null;
 }
-function toErrorMessage$39(error) {
+function toErrorMessage$40(error) {
 	if (error instanceof Error) return error.message;
 	return String(error);
 }
@@ -8592,27 +8611,31 @@ const CLAUDE_CODE_CONVERSATION_BRIDGE_SPEC = resolveBuiltinAdapterConversationBr
 const EXPECTED_FORCE_CLOSE_INTERRUPT_ERROR_RE = /query closed before response received/i;
 const createClaudeCodeAdapter = (options) => {
 	const activeAgentSdkQueries = /* @__PURE__ */ new Map();
-	const registerAgentSdkQuery = ({ query, taskId }) => {
-		activeAgentSdkQueries.set(taskId, query);
+	const registerAgentSdkQuery = ({ permissionModeUpdatesAllowed, query, taskId }) => {
+		const activeQuery = {
+			permissionModeUpdatesAllowed,
+			query
+		};
+		activeAgentSdkQueries.set(taskId, activeQuery);
 		return () => {
-			if (activeAgentSdkQueries.get(taskId) === query) activeAgentSdkQueries.delete(taskId);
+			if (activeAgentSdkQueries.get(taskId) === activeQuery) activeAgentSdkQueries.delete(taskId);
 		};
 	};
 	const sendInterrupt = async (signal) => {
 		const activeQuery = activeAgentSdkQueries.get(signal.taskId);
 		if (activeQuery) {
 			if (signal.mode === "force") {
-				Promise.resolve().then(() => activeQuery.interrupt()).catch((error) => {
+				Promise.resolve().then(() => activeQuery.query.interrupt()).catch((error) => {
 					if (isExpectedForceCloseInterruptError(error)) return;
 					console.warn("[openmeld.claude_code.force_interrupt_failed_after_close]", {
 						error: error instanceof Error ? error.message : String(error),
 						taskId: signal.taskId
 					});
 				});
-				activeQuery.close();
+				activeQuery.query.close();
 				return;
 			}
-			await activeQuery.interrupt();
+			await activeQuery.query.interrupt();
 			return;
 		}
 		if (options.sendInterrupt) {
@@ -8627,6 +8650,30 @@ const createClaudeCodeAdapter = (options) => {
 		sendInterrupt,
 		waitForMs: options.waitForMs
 	});
+	const updatePermissionMode = async (input) => {
+		if (!input.agentControllerPermissionMode.startsWith("claude-code:")) return {
+			reasonCode: "adapter.permission_mode_incompatible",
+			status: "not_applied",
+			taskId: input.taskId
+		};
+		const activeQuery = activeAgentSdkQueries.get(input.taskId);
+		if (!activeQuery) return {
+			reasonCode: "adapter.task_not_active",
+			status: "not_applied",
+			taskId: input.taskId
+		};
+		if (!activeQuery.permissionModeUpdatesAllowed) return {
+			reasonCode: "adapter.permission_mode_update_unsupported",
+			status: "not_applied",
+			taskId: input.taskId
+		};
+		await activeQuery.query.setPermissionMode(resolveClaudePermissionMode({ agentControllerPermissionMode: input.agentControllerPermissionMode }));
+		return {
+			effectiveFrom: "subsequent_tool_requests",
+			status: "applied",
+			taskId: input.taskId
+		};
+	};
 	const dispatch = createSharedDispatchShell({
 		adapterId: "claude-code",
 		bridgeSpec: CLAUDE_CODE_CONVERSATION_BRIDGE_SPEC,
@@ -8643,7 +8690,8 @@ const createClaudeCodeAdapter = (options) => {
 		adapterId: "claude-code",
 		cancel: controlShell.cancel,
 		dispatch,
-		interrupt: controlShell.interrupt
+		interrupt: controlShell.interrupt,
+		updatePermissionMode
 	};
 };
 const isExpectedForceCloseInterruptError = (error) => {
@@ -9884,7 +9932,7 @@ var CodexAppServerSession = class {
 			this.#failAll(new CodexAppServerTransportError({
 				code: "protocol.invalid",
 				errorType: "adapter",
-				message: `protocol.invalid: codex app-server emitted non-JSON output (${toErrorMessage$38(error)})`
+				message: `protocol.invalid: codex app-server emitted non-JSON output (${toErrorMessage$39(error)})`
 			}));
 			return;
 		}
@@ -10626,15 +10674,15 @@ function toCodexAppServerTransportError(error, timeoutMs) {
 		errorType: error.errorType,
 		message: error.message
 	});
-	if (timeoutMs !== null && toErrorMessage$38(error).includes("timed out")) return new CodexAppServerTransportError({
+	if (timeoutMs !== null && toErrorMessage$39(error).includes("timed out")) return new CodexAppServerTransportError({
 		code: "process.timeout",
 		errorType: "timeout",
-		message: toErrorMessage$38(error)
+		message: toErrorMessage$39(error)
 	});
 	return new CodexAppServerTransportError({
 		code: "upstream_unreachable",
 		errorType: "adapter",
-		message: `upstream_unreachable: failed to execute codex app-server (${toErrorMessage$38(error)})`
+		message: `upstream_unreachable: failed to execute codex app-server (${toErrorMessage$39(error)})`
 	});
 }
 function readRequiredText(value, label) {
@@ -10664,7 +10712,7 @@ function resolveCodexAppServerAuthStatus(input) {
 	if (input.account) return "authenticated";
 	return input.response?.requiresOpenaiAuth === true ? "unauthenticated" : "unknown";
 }
-function toErrorMessage$38(error) {
+function toErrorMessage$39(error) {
 	if (error instanceof Error) return error.message;
 	return String(error);
 }
@@ -10722,7 +10770,7 @@ async function verifyCodexLaunchContract(input) {
 		return fileCheck;
 	} catch (error) {
 		return {
-			errorMessage: `Codex app-server can't start on this device: ${toErrorMessage$37(error)}`,
+			errorMessage: `Codex app-server can't start on this device: ${toErrorMessage$38(error)}`,
 			failureKind: error instanceof CodexAppServerTransportError && error.errorType === "timeout" ? "incomplete_check" : "completed_negative",
 			ok: false
 		};
@@ -10762,7 +10810,7 @@ async function inspectCodexLaunchCandidate(input) {
 		};
 	} catch (error) {
 		return {
-			errorMessage: toErrorMessage$37(error),
+			errorMessage: toErrorMessage$38(error),
 			failureKind: error instanceof CodexAppServerTransportError && error.errorType === "timeout" ? "incomplete_check" : "completed_negative",
 			ok: false
 		};
@@ -10806,7 +10854,7 @@ function resolveCodexControlProbeTimeoutMs(timeoutMs) {
 	if (typeof timeoutMs === "number") return timeoutMs;
 	return resolveCodexTimeoutMs() ?? CODEX_CONTROL_PROBE_TIMEOUT_MS;
 }
-function toErrorMessage$37(error) {
+function toErrorMessage$38(error) {
 	return error instanceof Error ? error.message : String(error);
 }
 function normalizeOptionalText$58(value) {
@@ -11369,7 +11417,7 @@ async function invokeCodexWithSingleContextHeal(input) {
 		createRebuildFailedError: (error) => new CodexRuntimeError({
 			code: "context.rebuild_failed",
 			errorType: "adapter",
-			message: `context.rebuild_failed: ${toErrorMessage$36(error)}`
+			message: `context.rebuild_failed: ${toErrorMessage$37(error)}`
 		}),
 		invokeOnce: (threadId) => invokeCodexOnce({
 			agentControllerPermissionMode: input.agentControllerPermissionMode,
@@ -11408,7 +11456,7 @@ async function invokeCodexAppServer(input) {
 		createRebuildFailedError: (error) => new CodexRuntimeError({
 			code: "context.rebuild_failed",
 			errorType: "adapter",
-			message: `context.rebuild_failed: ${toErrorMessage$36(error)}`
+			message: `context.rebuild_failed: ${toErrorMessage$37(error)}`
 		}),
 		invokeOnce: (threadId) => invokeCodexAppServerOnceWithAdmissionRetry({
 			...input,
@@ -11472,7 +11520,7 @@ function toCodexRuntimeError(error) {
 	return new CodexRuntimeError({
 		code: "upstream_unreachable",
 		errorType: "adapter",
-		message: `upstream_unreachable: ${toErrorMessage$36(error)}`
+		message: `upstream_unreachable: ${toErrorMessage$37(error)}`
 	});
 }
 async function invokeCodexOnce(input) {
@@ -11503,11 +11551,11 @@ async function invokeCodexOnce(input) {
 		throw new CodexRuntimeError({
 			code: "upstream_unreachable",
 			errorType: "adapter",
-			message: `upstream_unreachable: ${toErrorMessage$36(error)}`
+			message: `upstream_unreachable: ${toErrorMessage$37(error)}`
 		});
 	}
 }
-function toErrorMessage$36(error) {
+function toErrorMessage$37(error) {
 	if (error instanceof Error) return error.message;
 	return String(error);
 }
@@ -11860,7 +11908,7 @@ async function interruptCodexActiveAppServerTurn(input) {
 			accepted: false,
 			plan,
 			reasonCode: "signal.send_failed",
-			reasonDetail: toErrorMessage$35(error),
+			reasonDetail: toErrorMessage$36(error),
 			signalDelivery: "not_sent",
 			taskId: input.request.taskId
 		};
@@ -11888,7 +11936,7 @@ const normalizeOptionalText$55 = (value) => {
 	const normalized = String(value ?? "").trim();
 	return normalized.length > 0 ? normalized : null;
 };
-const toErrorMessage$35 = (error) => error instanceof Error ? error.message : String(error);
+const toErrorMessage$36 = (error) => error instanceof Error ? error.message : String(error);
 const isDefaultInvokeDisabledForTests = (options) => options[TEST_DISABLE_DEFAULT_INVOKE] === true;
 //#endregion
 //#region ../../runtime/adapters/grok-build/dist/config/grok-build-runtime-config.js
@@ -12767,7 +12815,7 @@ async function emitFinalPreviewIfRequested$1(input) {
 	await input.onPreview({ text: input.output });
 }
 function toGrokBuildTransportError(error, stderr, diagnostics) {
-	const combined = [toErrorMessage$34(error), normalizeOptionalText$53(stderr)].filter((value) => value !== null).join("\n");
+	const combined = [toErrorMessage$35(error), normalizeOptionalText$53(stderr)].filter((value) => value !== null).join("\n");
 	const providerFailure = !(error instanceof GrokBuildAcpTransportError) || error.code.startsWith("protocol.") ? classifyGrokBuildProviderFailure(combined) : null;
 	if (providerFailure) return diagnostics ? new GrokBuildAcpTransportError({
 		cause: error,
@@ -12833,7 +12881,7 @@ function normalizeOptionalText$53(value) {
 function toRecord$7(value) {
 	return value && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
-function toErrorMessage$34(error) {
+function toErrorMessage$35(error) {
 	return error instanceof Error ? error.message : String(error);
 }
 //#endregion
@@ -12904,7 +12952,7 @@ function createDefaultGrokBuildInvoke(input) {
 				code: "context.rebuild_failed",
 				...error instanceof GrokBuildAcpTransportError && error.diagnostics ? { diagnostics: error.diagnostics } : {},
 				errorType: "adapter",
-				message: `context.rebuild_failed: ${toErrorMessage$33(error)}`
+				message: `context.rebuild_failed: ${toErrorMessage$34(error)}`
 			}),
 			invokeOnce: async (sessionId) => {
 				const transportResult = await invokeGrokBuildAcpTransport({
@@ -12984,7 +13032,7 @@ async function cancelActiveGrokBuildTurn(input) {
 		return {
 			accepted: false,
 			reasonCode: "signal.send_failed",
-			reasonDetail: toErrorMessage$33(error),
+			reasonDetail: toErrorMessage$34(error),
 			signalDelivery: "not_sent",
 			taskId: input.request.taskId
 		};
@@ -13013,7 +13061,7 @@ function normalizeOptionalText$52(value) {
 	const normalized = typeof value === "string" ? value.trim() : "";
 	return normalized.length > 0 ? normalized : null;
 }
-function toErrorMessage$33(error) {
+function toErrorMessage$34(error) {
 	return error instanceof Error ? error.message : String(error);
 }
 //#endregion
@@ -14744,7 +14792,7 @@ async function invokeOpenCodeWithSingleContextHeal(input) {
 		createRebuildFailedError: (error) => new OpenCodeRuntimeError({
 			code: "context.rebuild_failed",
 			errorType: "adapter",
-			message: `context.rebuild_failed: ${toErrorMessage$32(error)}`
+			message: `context.rebuild_failed: ${toErrorMessage$33(error)}`
 		}),
 		invokeOnce: (sessionId) => invokeOpenCodeOnce({
 			launchContract: input.launchContract,
@@ -14815,11 +14863,11 @@ async function invokeOpenCodeOnce(input) {
 		throw new OpenCodeRuntimeError({
 			code: "upstream_unreachable",
 			errorType: "adapter",
-			message: `upstream_unreachable: ${toErrorMessage$32(error)}`
+			message: `upstream_unreachable: ${toErrorMessage$33(error)}`
 		});
 	}
 }
-function toErrorMessage$32(error) {
+function toErrorMessage$33(error) {
 	if (error instanceof Error) return error.message;
 	return String(error);
 }
@@ -15131,7 +15179,7 @@ async function mapCodexThread(input) {
 	if (!(nativeSessionId && cwd && lastActiveAtMs !== null)) throw new Error("Codex returned a malformed retained thread record.");
 	const binding = await resolveObservedAgentActivityBinding(cwd, input.bindings);
 	if (!binding) return null;
-	const runtimeStatus = isRecord$6(input.thread.status) ? text$1(input.thread.status.type) : null;
+	const runtimeStatus = isRecord$7(input.thread.status) ? text$1(input.thread.status.type) : null;
 	return {
 		binding,
 		session: observedLocalAgentSessionSchema.parse({
@@ -15175,7 +15223,7 @@ async function listAllCodexThreads(launchContract) {
 					sourceKinds: CODEX_THREAD_SOURCE_KINDS,
 					useStateDbOnly: false
 				});
-				if (!(isRecord$6(response) && Array.isArray(response.data) && response.data.every(isRecord$6))) throw new Error("Codex thread/list response is invalid.");
+				if (!(isRecord$7(response) && Array.isArray(response.data) && response.data.every(isRecord$7))) throw new Error("Codex thread/list response is invalid.");
 				pages.push({
 					archived,
 					data: response.data
@@ -15300,12 +15348,12 @@ function consumeCodexJsonRpcChunk(input) {
 	}
 }
 function settleCodexJsonRpcResponse(message, pending) {
-	if (!isRecord$6(message) || typeof message.id !== "number") return;
+	if (!isRecord$7(message) || typeof message.id !== "number") return;
 	const request = pending.get(message.id);
 	if (!request) return;
 	pending.delete(message.id);
 	clearTimeout(request.timer);
-	if (isRecord$6(message.error)) {
+	if (isRecord$7(message.error)) {
 		request.reject(new Error(text$1(message.error.message) ?? "Codex app-server request failed."));
 		return;
 	}
@@ -15426,7 +15474,7 @@ function applyClaudeSessionLine(state, line) {
 	} catch (error) {
 		throw new Error("Claude Code Session file contains malformed JSON.", { cause: error });
 	}
-	if (!isRecord$6(value)) return;
+	if (!isRecord$7(value)) return;
 	const rowSessionId = text$1(value.sessionId);
 	if (rowSessionId && state.nativeSessionId !== rowSessionId) {
 		if (state.nativeSessionId) throw new Error("Claude Code Session file contains conflicting IDs.");
@@ -15598,12 +15646,12 @@ async function discoverGrokBuildRetainedSessions(input) {
 	const identities = /* @__PURE__ */ new Set();
 	for (const path of paths) {
 		const summary = JSON.parse(await readFile(path, "utf8"));
-		if (!isRecord$6(summary)) throw new Error("Grok Build summary metadata is invalid.");
+		if (!isRecord$7(summary)) throw new Error("Grok Build summary metadata is invalid.");
 		const topLevelIdentity = {
 			cwd: text$1(summary.cwd),
 			nativeSessionId: text$1(summary.id)
 		};
-		const nestedInfo = isRecord$6(summary.info) ? summary.info : null;
+		const nestedInfo = isRecord$7(summary.info) ? summary.info : null;
 		const nestedIdentity = {
 			cwd: text$1(nestedInfo?.cwd),
 			nativeSessionId: text$1(nestedInfo?.id)
@@ -15753,7 +15801,7 @@ function mapClaudeAgentStatus(value) {
 }
 function collectRecords(value) {
 	if (Array.isArray(value)) return value.flatMap(collectRecords);
-	if (!isRecord$6(value)) return [];
+	if (!isRecord$7(value)) return [];
 	return [value, ...Object.values(value).flatMap(collectRecords)];
 }
 function secondsTimestamp(value) {
@@ -15776,7 +15824,7 @@ function parseCodexNextCursor(value) {
 function text$1(value) {
 	return nullableText(value);
 }
-function isRecord$6(value) {
+function isRecord$7(value) {
 	return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 function isNodeError$4(error, code) {
@@ -16963,7 +17011,7 @@ async function readAgentActivityIntegrationStatus(paths) {
 		claude: claude !== null && CLAUDE_EVENTS.every((event) => {
 			try {
 				const settings = parseSettings(claude);
-				const hooks = isRecord$5(settings.hooks) ? settings.hooks : null;
+				const hooks = isRecord$6(settings.hooks) ? settings.hooks : null;
 				return Array.isArray(hooks?.[event]) && hooks[event].some((group) => knownArtifacts.some((artifacts) => hasOwnedClaudeHook(group, artifacts)));
 			} catch {
 				return false;
@@ -16973,7 +17021,7 @@ async function readAgentActivityIntegrationStatus(paths) {
 		cursor: cursor !== null && CURSOR_EVENTS.every((event) => {
 			try {
 				const settings = parseJsonObject(cursor, "Cursor hooks");
-				const hooks = isRecord$5(settings.hooks) ? settings.hooks : null;
+				const hooks = isRecord$6(settings.hooks) ? settings.hooks : null;
 				return Array.isArray(hooks?.[event]) && hooks[event].some((entry) => knownArtifacts.some((artifacts) => isOwnedCursorHook(entry, artifacts.cursorCommand)));
 			} catch {
 				return false;
@@ -17028,7 +17076,7 @@ function installCursorHooks(raw, artifacts, knownArtifacts) {
 }
 function uninstallCursorHooks(raw, knownArtifacts) {
 	const settings = parseJsonObject(raw, "Cursor hooks");
-	const hooks = isRecord$5(settings.hooks) ? settings.hooks : null;
+	const hooks = isRecord$6(settings.hooks) ? settings.hooks : null;
 	if (!hooks) return raw;
 	for (const event of CURSOR_EVENTS) {
 		if (!Array.isArray(hooks[event])) continue;
@@ -17044,17 +17092,17 @@ function ownedCursorHook(command) {
 	};
 }
 function isOwnedCursorHook(value, command) {
-	return isRecord$5(value) && Object.keys(value).length === 2 && value.command === command && value.timeout === 10;
+	return isRecord$6(value) && Object.keys(value).length === 2 && value.command === command && value.timeout === 10;
 }
 function isKnownOwnedCursorHook(value, knownArtifacts) {
 	return knownArtifacts.some((artifacts) => isOwnedCursorHook(value, artifacts.cursorCommand) || isOwnedCursorHook(value, artifacts.legacyCursorCommand));
 }
 function hasUnknownOpenMeldCursorHook(value, knownArtifacts) {
-	return isRecord$5(value) && typeof value.command === "string" && value.command.includes(" activity hook --provider cursor --owner ") && value.command.includes("openmeld-agent-activity-") && !isKnownOwnedCursorHook(value, knownArtifacts);
+	return isRecord$6(value) && typeof value.command === "string" && value.command.includes(" activity hook --provider cursor --owner ") && value.command.includes("openmeld-agent-activity-") && !isKnownOwnedCursorHook(value, knownArtifacts);
 }
 function uninstallClaudeHooks(raw, knownArtifacts) {
 	const settings = parseSettings(raw);
-	const hooks = isRecord$5(settings.hooks) ? settings.hooks : null;
+	const hooks = isRecord$6(settings.hooks) ? settings.hooks : null;
 	if (!hooks) return raw;
 	for (const event of CLAUDE_EVENTS) {
 		if (!Array.isArray(hooks[event])) continue;
@@ -17071,14 +17119,14 @@ function ownedClaudeGroup(artifacts) {
 	}] };
 }
 function isOwnedClaudeGroup(value, artifacts) {
-	if (!isRecord$5(value) || Object.keys(value).length !== 1 || !Array.isArray(value.hooks)) return false;
-	return value.hooks.length === 1 && isRecord$5(value.hooks[0]) && value.hooks[0].command === artifacts.claudeCommand && value.hooks[0].timeout === 10 && value.hooks[0].type === "command" && Object.keys(value.hooks[0]).length === 3;
+	if (!isRecord$6(value) || Object.keys(value).length !== 1 || !Array.isArray(value.hooks)) return false;
+	return value.hooks.length === 1 && isRecord$6(value.hooks[0]) && value.hooks[0].command === artifacts.claudeCommand && value.hooks[0].timeout === 10 && value.hooks[0].type === "command" && Object.keys(value.hooks[0]).length === 3;
 }
 function hasOwnedClaudeHook(value, artifacts) {
-	return isRecord$5(value) && Array.isArray(value.hooks) && value.hooks.some((hook) => isRecord$5(hook) && hook.command === artifacts.claudeCommand);
+	return isRecord$6(value) && Array.isArray(value.hooks) && value.hooks.some((hook) => isRecord$6(hook) && hook.command === artifacts.claudeCommand);
 }
 function hasUnknownOpenMeldClaudeHook(value, knownArtifacts) {
-	return isRecord$5(value) && Array.isArray(value.hooks) && value.hooks.some((hook) => isRecord$5(hook) && typeof hook.command === "string" && hook.command.includes(" activity hook --provider claude-code --owner ") && hook.command.includes("openmeld-agent-activity-")) && !isKnownOwnedClaudeGroup(value, knownArtifacts);
+	return isRecord$6(value) && Array.isArray(value.hooks) && value.hooks.some((hook) => isRecord$6(hook) && typeof hook.command === "string" && hook.command.includes(" activity hook --provider claude-code --owner ") && hook.command.includes("openmeld-agent-activity-")) && !isKnownOwnedClaudeGroup(value, knownArtifacts);
 }
 function isLegacyOwnedClaudeGroup(value, artifacts) {
 	return isOwnedClaudeGroupForCommand(value, artifacts.legacyClaudeCommand);
@@ -17137,8 +17185,8 @@ function extractCodexTrustState(block, endMarker) {
 	};
 }
 function isOwnedClaudeGroupForCommand(value, command) {
-	if (!isRecord$5(value) || Object.keys(value).length !== 1 || !Array.isArray(value.hooks)) return false;
-	return value.hooks.length === 1 && isRecord$5(value.hooks[0]) && value.hooks[0].command === command && value.hooks[0].timeout === 10 && value.hooks[0].type === "command" && Object.keys(value.hooks[0]).length === 3;
+	if (!isRecord$6(value) || Object.keys(value).length !== 1 || !Array.isArray(value.hooks)) return false;
+	return value.hooks.length === 1 && isRecord$6(value.hooks[0]) && value.hooks[0].command === command && value.hooks[0].timeout === 10 && value.hooks[0].type === "command" && Object.keys(value.hooks[0]).length === 3;
 }
 async function planPluginInstall(path, artifacts, knownArtifacts) {
 	const current = await readOptionalFile$1(path);
@@ -17278,12 +17326,12 @@ function parseSettings(raw) {
 function parseJsonObject(raw, label) {
 	if (!raw.trim()) return {};
 	const value = JSON.parse(raw);
-	if (!isRecord$5(value)) throw new Error(`${label} must be a JSON object.`);
+	if (!isRecord$6(value)) throw new Error(`${label} must be a JSON object.`);
 	return value;
 }
 function ensureRecord(parent, key, label = "Claude settings") {
 	if (parent[key] === void 0) parent[key] = {};
-	if (!isRecord$5(parent[key])) throw new Error(`${label} ${key} must be an object.`);
+	if (!isRecord$6(parent[key])) throw new Error(`${label} ${key} must be an object.`);
 	return parent[key];
 }
 function emptyFileFor(path) {
@@ -17293,7 +17341,7 @@ function revisionConflict(path) {
 	const digest = createHash("sha256").update(path).digest("hex").slice(0, 12);
 	return /* @__PURE__ */ new Error(`Managed integration revision changed before commit (${digest}).`);
 }
-function isRecord$5(value) {
+function isRecord$6(value) {
 	return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 function isNodeError$2(error, code) {
@@ -17910,13 +17958,13 @@ function resolveOpenMeldAccountContext(input) {
 		key: normalizeAccountKey({}),
 		source: "fallback"
 	};
-	const normalizedBaseUrl = normalizeOptionalString$16(session.authBaseUrl);
+	const normalizedBaseUrl = normalizeOptionalString$18(session.authBaseUrl);
 	const hostKey = resolveHostKey(normalizedBaseUrl);
 	const user = normalizeUser(session.user);
 	const userKey = user?.id ?? user?.email ?? buildSessionScopedUserKey({
 		authBaseUrl: normalizedBaseUrl,
-		clientId: normalizeOptionalString$16(session.clientId),
-		createdAt: normalizeOptionalString$16(session.createdAt)
+		clientId: normalizeOptionalString$18(session.clientId),
+		createdAt: normalizeOptionalString$18(session.createdAt)
 	});
 	return {
 		key: normalizeAccountKey({
@@ -17929,7 +17977,7 @@ function resolveOpenMeldAccountContext(input) {
 	};
 }
 async function resolveCurrentOpenMeldAccountContext() {
-	const { getAuthSessionMetadata } = await import("./auth-session-qk94UQqs.js").then((n) => n.t);
+	const { getAuthSessionMetadata } = await import("./auth-session-B1jSy0ws.js").then((n) => n.r);
 	return resolveOpenMeldAccountContext({ session: await getAuthSessionMetadata().catch(() => null) });
 }
 function resolveHostKey(baseUrl) {
@@ -17952,9 +18000,9 @@ function buildSessionScopedUserKey(input) {
 function normalizeUser(value) {
 	if (!(value && typeof value === "object")) return null;
 	const record = value;
-	const id = normalizeOptionalString$16(record.id);
-	const email = normalizeOptionalString$16(record.email);
-	const name = normalizeOptionalString$16(record.name);
+	const id = normalizeOptionalString$18(record.id);
+	const email = normalizeOptionalString$18(record.email);
+	const name = normalizeOptionalString$18(record.name);
 	if (!(id || email || name)) return null;
 	return {
 		...id ? { id } : {},
@@ -17962,7 +18010,7 @@ function normalizeUser(value) {
 		...name ? { name } : {}
 	};
 }
-function normalizeOptionalString$16(value) {
+function normalizeOptionalString$18(value) {
 	if (typeof value !== "string") return null;
 	const normalized = value.trim();
 	return normalized.length > 0 ? normalized : null;
@@ -18072,9 +18120,9 @@ function createAuthenticationError(input) {
 	return new OpenMeldAuthenticationError(resolveAuthenticationGuidance(input));
 }
 function resolveAuthenticationGuidance(input) {
-	const action = normalizeOptionalString$15(input.action);
-	const authBaseUrl = normalizeOptionalString$15(input.authBaseUrl);
-	const gatewayUrl = normalizeOptionalString$15(input.gatewayUrl);
+	const action = normalizeOptionalString$17(input.action);
+	const authBaseUrl = normalizeOptionalString$17(input.authBaseUrl);
+	const gatewayUrl = normalizeOptionalString$17(input.gatewayUrl);
 	if (input.reason === "mismatch") return {
 		reason: input.reason,
 		action,
@@ -18098,7 +18146,7 @@ function resolveAuthenticationGuidance(input) {
 	};
 }
 function buildCommandAuthenticationPromptMessage$1(action) {
-	const normalizedAction = normalizeOptionalString$15(action);
+	const normalizedAction = normalizeOptionalString$17(action);
 	if (!normalizedAction) return "Sign in is required to continue. What do you want to do?";
 	return `Sign in is required before ${normalizedAction}. What do you want to do?`;
 }
@@ -18185,7 +18233,7 @@ function resolveAuthenticationGuidanceFromMessage(message) {
 function extractAuthenticationPromptAction(promptMessage) {
 	const normalizedMessage = String(promptMessage ?? "").trim();
 	if (normalizedMessage.length === 0) return null;
-	return normalizeOptionalString$15(AUTH_PROMPT_ACTION_RE.exec(normalizedMessage)?.groups?.action);
+	return normalizeOptionalString$17(AUTH_PROMPT_ACTION_RE.exec(normalizedMessage)?.groups?.action);
 }
 function resolveRequiredAuthenticationGuidance(reason) {
 	switch (reason) {
@@ -18265,7 +18313,7 @@ function buildAgentAuthenticationNotes(guidance) {
 	if (guidance.gatewayUrl) notes.push(`Current gateway: ${guidance.gatewayUrl}`);
 	return notes;
 }
-function normalizeOptionalString$15(value) {
+function normalizeOptionalString$17(value) {
 	const normalized = String(value ?? "").trim();
 	return normalized.length > 0 ? normalized : null;
 }
@@ -18419,15 +18467,15 @@ function parseLegacySelectionPayload(raw) {
 	try {
 		const payload = JSON.parse(raw);
 		if (payload.v !== 1) return null;
-		const sessionId = normalizeOptionalString$14(payload.sessionId);
-		const openMeldProfileId = normalizeOptionalString$14(payload.openMeldProfileId);
+		const sessionId = normalizeOptionalString$16(payload.sessionId);
+		const openMeldProfileId = normalizeOptionalString$16(payload.openMeldProfileId);
 		if (!(sessionId && openMeldProfileId)) return null;
 		return {
 			v: 1,
 			sessionId,
-			sessionSource: normalizeOptionalString$14(payload.sessionSource) ?? "manual",
+			sessionSource: normalizeOptionalString$16(payload.sessionSource) ?? "manual",
 			openMeldProfileId,
-			updatedAt: normalizeOptionalString$14(payload.updatedAt) ?? (/* @__PURE__ */ new Date(0)).toISOString()
+			updatedAt: normalizeOptionalString$16(payload.updatedAt) ?? (/* @__PURE__ */ new Date(0)).toISOString()
 		};
 	} catch {
 		return null;
@@ -18457,12 +18505,12 @@ function toSafeSessionFile(value) {
 	const maxBaseLength = Math.max(1, SESSION_FILE_MAX_LENGTH - SESSION_FILE_HASH_LENGTH - 1);
 	return `${safeBase.slice(0, maxBaseLength)}-${hash}`;
 }
-function normalizeOptionalString$14(value) {
+function normalizeOptionalString$16(value) {
 	const normalized = String(value ?? "").trim();
 	return normalized.length > 0 ? normalized : null;
 }
 function normalizeRequiredString$1(value, field) {
-	const normalized = normalizeOptionalString$14(value);
+	const normalized = normalizeOptionalString$16(value);
 	if (!normalized) throw new Error(`${field} is required`);
 	return normalized;
 }
@@ -18558,7 +18606,7 @@ var AuthProfilesApiError = class extends Error {
 		this.name = "AuthProfilesApiError";
 		this.status = input.status;
 		this.endpoint = input.endpoint;
-		this.code = normalizeOptionalString$13(input.code);
+		this.code = normalizeOptionalString$15(input.code);
 	}
 };
 function isAuthProfilesApiError(error) {
@@ -18584,13 +18632,13 @@ async function resolveOpenMeldProfile(input) {
 		method: "POST",
 		path: "/v1/profiles/resolve",
 		body: {
-			...normalizeOptionalString$13(input.openMeldProfileId) ? { openMeldProfileId: normalizeOptionalString$13(input.openMeldProfileId) } : {},
+			...normalizeOptionalString$15(input.openMeldProfileId) ? { openMeldProfileId: normalizeOptionalString$15(input.openMeldProfileId) } : {},
 			...input.profileKind ? { profileKind: input.profileKind } : {}
 		}
 	}), "profile"));
 }
 async function resolveOpenMeldProfileByIdOrName(input) {
-	const profileIdentifier = normalizeOptionalString$13(input.profileIdentifier);
+	const profileIdentifier = normalizeOptionalString$15(input.profileIdentifier);
 	if (!profileIdentifier) throw new Error("profile identifier is required");
 	try {
 		return await resolveOpenMeldProfile({
@@ -18609,8 +18657,8 @@ async function resolveOpenMeldProfileByIdOrName(input) {
 	}
 }
 function createOpenMeldAgentProfile(input) {
-	const profileName = normalizeOptionalString$13(input.profileName);
-	const creatorProfileId = normalizeOptionalString$13(input.creatorProfileId) ?? void 0;
+	const profileName = normalizeOptionalString$15(input.profileName);
+	const creatorProfileId = normalizeOptionalString$15(input.creatorProfileId) ?? void 0;
 	if (!profileName) throw new Error("profile name is required");
 	return createOpenMeldAgentProfileRequest({
 		profileName,
@@ -18618,8 +18666,8 @@ function createOpenMeldAgentProfile(input) {
 	});
 }
 async function createOpenMeldHumanProfile(input) {
-	const profileName = normalizeOptionalString$13(input.profileName);
-	const creatorProfileId = normalizeOptionalString$13(input.creatorProfileId) ?? void 0;
+	const profileName = normalizeOptionalString$15(input.profileName);
+	const creatorProfileId = normalizeOptionalString$15(input.creatorProfileId) ?? void 0;
 	if (!profileName) throw new Error("profile name is required");
 	try {
 		assertAdditionalHumanProfileCreationEnabled(await getOpenMeldProfileCapabilities());
@@ -18642,9 +18690,9 @@ async function createOpenMeldHumanProfile(input) {
 	return created;
 }
 async function updateOpenMeldProfile(input) {
-	const openMeldProfileId = normalizeOptionalString$13(input.openMeldProfileId);
+	const openMeldProfileId = normalizeOptionalString$15(input.openMeldProfileId);
 	if (!openMeldProfileId) throw new Error("openMeldProfileId is required");
-	const profileName = normalizeOptionalString$13(input.profileName);
+	const profileName = normalizeOptionalString$15(input.profileName);
 	if (!Boolean(profileName)) throw new Error("profileName is required");
 	const updated = parseOpenMeldProfileItem(readRecordField(await requestOpenMeldProfilesApi({
 		method: "PATCH",
@@ -18655,7 +18703,7 @@ async function updateOpenMeldProfile(input) {
 	return updated;
 }
 async function deleteOpenMeldProfile(input) {
-	const openMeldProfileId = normalizeOptionalString$13(input.openMeldProfileId);
+	const openMeldProfileId = normalizeOptionalString$15(input.openMeldProfileId);
 	if (!openMeldProfileId) throw new Error("openMeldProfileId is required");
 	const deleted = parseOpenMeldProfileItem(readRecordField(await requestOpenMeldProfilesApi({
 		method: "DELETE",
@@ -18666,7 +18714,7 @@ async function deleteOpenMeldProfile(input) {
 }
 async function requestOpenMeldProfilesApi(input) {
 	const session = await requireOpenMeldProfilesSession();
-	const endpoint = toAuthEndpoint$2(session.authBaseUrl, input.path);
+	const endpoint = toAuthEndpoint$4(session.authBaseUrl, input.path);
 	const response = await fetch(endpoint, {
 		method: input.method,
 		headers: {
@@ -18676,7 +18724,7 @@ async function requestOpenMeldProfilesApi(input) {
 		...input.body ? { body: JSON.stringify(input.body) } : {},
 		signal: AbortSignal.timeout(resolveOpenMeldProfilesApiTimeoutMs(endpoint))
 	});
-	const payload = await parseResponseJson$1(response);
+	const payload = await parseResponseJson$3(response);
 	if (!response.ok) {
 		const parsedError = profileErrorResponseSchema.safeParse(payload);
 		const status = response.status;
@@ -18697,7 +18745,7 @@ async function requestOpenMeldProfilesApi(input) {
 			})
 		});
 	}
-	const record = isRecord$4(payload) ? payload : {};
+	const record = isRecord$5(payload) ? payload : {};
 	if (!readBooleanField(record, "ok")) {
 		const parsedError = profileErrorResponseSchema.safeParse(payload);
 		const code = parsedError.success ? parsedError.data.code : null;
@@ -18778,8 +18826,8 @@ async function emitRouteCatalogSync(reason) {
 	await touchDaemonCatalogSyncSignal({ reason }).catch(() => void 0);
 }
 function parseOpenMeldProfileItem(value) {
-	const record = isRecord$4(value) ? value : {};
-	const openMeldProfileId = readOptionalStringField$1(record, "openMeldProfileId");
+	const record = isRecord$5(value) ? value : {};
+	const openMeldProfileId = readOptionalStringField(record, "openMeldProfileId");
 	if (!openMeldProfileId) throw new Error("invalid profile payload: missing openMeldProfileId");
 	const profileName = readRequiredStringField(record, "profileName");
 	const profileHandle = readRequiredStringField(record, "profileHandle");
@@ -18787,14 +18835,14 @@ function parseOpenMeldProfileItem(value) {
 	const isDefault = readOptionalBooleanField(record, "isDefault") ?? false;
 	const status = readProfileStatus(record, "status");
 	const ownerUserId = readRequiredStringField(record, "ownerUserId");
-	const ownerName = readOptionalStringField$1(record, "ownerName") ?? void 0;
+	const ownerName = readOptionalStringField(record, "ownerName") ?? void 0;
 	const source = readRequiredStringField(record, "source");
 	const managedRole = readOptionalManagedRoleField(record, "managedRole");
-	const createdByUserId = readOptionalStringField$1(record, "createdByUserId") ?? null;
-	const defaultProjectId = readOptionalStringField$1(record, "defaultProjectId");
-	const creationActorProfileId = readOptionalStringField$1(record, "creationActorProfileId") ?? null;
-	const creatorProfileId = readOptionalStringField$1(record, "creatorProfileId") ?? null;
-	const lastUsedAt = readOptionalStringField$1(record, "lastUsedAt");
+	const createdByUserId = readOptionalStringField(record, "createdByUserId") ?? null;
+	const defaultProjectId = readOptionalStringField(record, "defaultProjectId");
+	const creationActorProfileId = readOptionalStringField(record, "creationActorProfileId") ?? null;
+	const creatorProfileId = readOptionalStringField(record, "creatorProfileId") ?? null;
+	const lastUsedAt = readOptionalStringField(record, "lastUsedAt");
 	const createdAt = readRequiredStringField(record, "createdAt");
 	const updatedAt = readRequiredStringField(record, "updatedAt");
 	return {
@@ -18828,7 +18876,7 @@ function readProfileStatus(input, field) {
 	throw new Error(`invalid profile payload: unsupported ${field}`);
 }
 function readOptionalManagedRoleField(input, field) {
-	const value = readOptionalStringField$1(input, field);
+	const value = readOptionalStringField(input, field);
 	if (!value) return null;
 	const parsed = authProfileManagedRoleSchema.safeParse(value);
 	if (parsed.success) return parsed.data;
@@ -18836,21 +18884,21 @@ function readOptionalManagedRoleField(input, field) {
 }
 function readRecordField(input, field) {
 	const value = input[field];
-	if (isRecord$4(value)) return value;
+	if (isRecord$5(value)) return value;
 	throw new Error(`invalid api payload: missing ${field}`);
 }
 function readArrayField(input, field) {
 	const value = input[field];
 	if (!Array.isArray(value)) throw new Error(`invalid api payload: missing ${field}`);
-	return value.filter(isRecord$4);
+	return value.filter(isRecord$5);
 }
 function readRequiredStringField(input, field) {
-	const value = normalizeOptionalString$13(input[field]);
+	const value = normalizeOptionalString$15(input[field]);
 	if (!value) throw new Error(`invalid profile payload: missing ${field}`);
 	return value;
 }
-function readOptionalStringField$1(input, field) {
-	return normalizeOptionalString$13(input[field]);
+function readOptionalStringField(input, field) {
+	return normalizeOptionalString$15(input[field]);
 }
 function readBooleanField(input, field) {
 	return input[field] === true;
@@ -18860,7 +18908,7 @@ function readOptionalBooleanField(input, field) {
 	if (typeof value === "boolean") return value;
 	return null;
 }
-function normalizeOptionalString$13(value) {
+function normalizeOptionalString$15(value) {
 	const normalized = String(value ?? "").trim();
 	return normalized.length > 0 ? normalized : null;
 }
@@ -18868,14 +18916,14 @@ function normalizeTokenType(tokenType) {
 	const normalized = tokenType.trim();
 	return normalized.length > 0 ? normalized : "Bearer";
 }
-function toAuthEndpoint$2(baseUrl, pathname) {
+function toAuthEndpoint$4(baseUrl, pathname) {
 	const url = new URL(baseUrl);
 	url.pathname = pathname;
 	url.search = "";
 	url.hash = "";
 	return url.toString();
 }
-async function parseResponseJson$1(response) {
+async function parseResponseJson$3(response) {
 	const raw = await response.text();
 	if (!raw) return null;
 	try {
@@ -18885,8 +18933,8 @@ async function parseResponseJson$1(response) {
 	}
 }
 function extractApiErrorMessage$1(payload, status) {
-	const record = isRecord$4(payload) ? payload : {};
-	const message = normalizeOptionalString$13(record.message) ?? normalizeOptionalString$13(record.error_description) ?? normalizeOptionalString$13(record.error);
+	const record = isRecord$5(payload) ? payload : {};
+	const message = normalizeOptionalString$15(record.message) ?? normalizeOptionalString$15(record.error_description) ?? normalizeOptionalString$15(record.error);
 	if (message) return message;
 	return `request failed with status ${status}`;
 }
@@ -18923,7 +18971,7 @@ function isHostedProfilesEndpoint(endpoint) {
 	const url = parseUrlOrNull$1(endpoint);
 	return Boolean(url && !isLoopbackHostname$2(url.hostname) && url.pathname.startsWith("/v1/profiles"));
 }
-function isRecord$4(value) {
+function isRecord$5(value) {
 	return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
 //#endregion
@@ -18940,7 +18988,7 @@ function isSelectedOpenMeldProfileRequiredError(error) {
 	return error.message.startsWith(PROFILE_REQUIRED_ERROR_PREFIX) && error.message.endsWith(PROFILE_REQUIRED_ERROR_SUFFIX);
 }
 async function resolveOpenMeldProfileOrNull(input = {}) {
-	const explicitOpenMeldProfileId = normalizeOptionalString$12(input.openMeldProfileId);
+	const explicitOpenMeldProfileId = normalizeOptionalString$14(input.openMeldProfileId);
 	if (explicitOpenMeldProfileId) return await resolveExplicitOpenMeldProfile(explicitOpenMeldProfileId, {
 		profileKind: input.profileKind,
 		allowUnauthenticated: input.allowUnauthenticated === true,
@@ -19013,7 +19061,7 @@ async function resolveSelectedOpenMeldProfile(selectedOpenMeldProfileId, input)
 		throw error;
 	}
 }
-function normalizeOptionalString$12(value) {
+function normalizeOptionalString$14(value) {
 	const normalized = String(value ?? "").trim();
 	return normalized.length > 0 ? normalized : null;
 }
@@ -19027,13 +19075,13 @@ function isProfileMissingError(error) {
 //#endregion
 //#region src/config/view-profile-key.ts
 async function resolveViewProfileKey(inputProfile) {
-	const explicit = normalizeOptionalString$11(inputProfile);
+	const explicit = normalizeOptionalString$13(inputProfile);
 	if (explicit) return (await resolveOpenMeldProfileByIdOrName({ profileIdentifier: explicit }).catch(() => null))?.openMeldProfileId ?? explicit;
 	const selected = await getSelectedOpenMeldProfileId();
 	if (selected) return selected;
 	return null;
 }
-function normalizeOptionalString$11(value) {
+function normalizeOptionalString$13(value) {
 	const normalized = String(value ?? "").trim();
 	return normalized.length > 0 ? normalized : null;
 }
@@ -19470,7 +19518,7 @@ function splitSentences(message) {
 var package_default = {
 	$schema: "https://www.schemastore.org/package.json",
 	name: "openmeld",
-	version: "0.3.124",
+	version: "0.3.127",
 	openMeldReleaseDate: "2026-08-28",
 	description: "OpenMeld CLI - https://openmeld.ai",
 	license: "MIT",
@@ -19670,7 +19718,7 @@ function warnDaemonEvent(eventName, fields) {
 	const definedFields = Object.fromEntries(Object.entries(fields).filter((entry) => entry[1] !== void 0));
 	console.warn(`${nowIsoString()} ${eventName} ${JSON.stringify(definedFields)}`);
 }
-const toErrorMessage$31 = toErrorMessage$42;
+const toErrorMessage$32 = toErrorMessage$43;
 function dirnamePath(path) {
 	const lastSlash = Math.max(path.lastIndexOf("/"), path.lastIndexOf("\\"));
 	if (lastSlash <= 0) return ".";
@@ -19696,7 +19744,7 @@ var DaemonServiceRunError = class extends Error {
 //#region src/local-service/state/runtime-contract-guard.ts
 const RUNTIME_CONTRACT_META_SCHEMA = "daemon.runtime.contract.meta";
 const RUNTIME_CONTRACT_REPAIR_REPORT_SCHEMA = "daemon.runtime.contract.repair.report";
-const isRecord$3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const isRecord$4 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const createRuntimeContractMeta = (input) => ({
 	schema: RUNTIME_CONTRACT_META_SCHEMA,
 	v: 1,
@@ -19716,7 +19764,7 @@ const createRuntimeContractRepairReport = (input) => ({
 	errorMessage: input.errorMessage
 });
 const parseRuntimeContractMeta = (value) => {
-	if (!isRecord$3(value)) return null;
+	if (!isRecord$4(value)) return null;
 	if (value.schema !== RUNTIME_CONTRACT_META_SCHEMA || value.v !== 1) return null;
 	const contractEpoch = normalizeOptionalText$46(value.contractEpoch);
 	const updatedAt = normalizeOptionalText$46(value.updatedAt);
@@ -19729,7 +19777,7 @@ const parseRuntimeContractMeta = (value) => {
 	};
 };
 const parseRuntimeContractRepairReport = (value) => {
-	if (!isRecord$3(value)) return null;
+	if (!isRecord$4(value)) return null;
 	if (value.schema !== RUNTIME_CONTRACT_REPAIR_REPORT_SCHEMA || value.v !== 1) return null;
 	const status = value.status;
 	const reason = value.reason;
@@ -19875,7 +19923,7 @@ const backupAndCleanRuntimeState = async (input) => {
 			appliedAt: input.nowIso,
 			backupPaths,
 			cleanedPaths,
-			errorMessage: toErrorMessage$31(error),
+			errorMessage: toErrorMessage$32(error),
 			fromEpoch: input.fromEpoch,
 			reason: input.reason,
 			status: "failed",
@@ -19965,7 +20013,7 @@ async function resolveDaemonRuntimeContractCompatibility(input) {
 			observedEpoch: null,
 			updatedAt: null,
 			reasonCode: "daemon.runtime_contract.unavailable",
-			errorMessage: toErrorMessage$31(error)
+			errorMessage: toErrorMessage$32(error)
 		};
 	}
 	if (!meta) return {
@@ -20188,7 +20236,7 @@ async function requestLatestPackageInfo(packageName) {
 			minRequiredCliVersion: readMinRequiredCliVersion(parsed.openmeld)
 		};
 	} catch (error) {
-		throw new Error(`version check failed: invalid registry response: ${toErrorMessage$30(error)}`);
+		throw new Error(`version check failed: invalid registry response: ${toErrorMessage$31(error)}`);
 	}
 }
 const CLI_BINARY_MANIFEST_URL = toNonEmptyString(process$1.env.OPENMELD_CLI_BINARY_MANIFEST_URL) ?? "https://openmeld.ai/cli/manifest.json";
@@ -20209,7 +20257,7 @@ async function requestCliBinaryManifest() {
 	try {
 		return parseCliBinaryManifest(raw);
 	} catch (error) {
-		throw new Error(`version check failed: invalid CLI manifest response: ${toErrorMessage$30(error)}`);
+		throw new Error(`version check failed: invalid CLI manifest response: ${toErrorMessage$31(error)}`);
 	}
 }
 function parseCliBinaryManifest(raw) {
@@ -20295,7 +20343,7 @@ function toNonEmptyString(value) {
 	const normalized = value.trim();
 	return normalized.length > 0 ? normalized : null;
 }
-function toErrorMessage$30(error) {
+function toErrorMessage$31(error) {
 	if (error instanceof Error) return error.message;
 	return String(error);
 }
@@ -25487,10 +25535,17 @@ async function runCursorAcpTurn(input) {
 		session: input.session
 	});
 	const unregisterActiveTurn = input.input.onActiveTurn?.({
+		agentControllerPermissionMode: resolveCursorPermissionMode(input.input.agentControllerPermissionMode),
 		cancel: () => {
 			input.session.notify("session/cancel", { sessionId: descriptor.sessionId });
 			return Promise.resolve();
 		},
+		setPermissionMode: async (permissionMode) => {
+			await input.session.request("session/set_mode", {
+				modeId: resolveCursorAcpMode(permissionMode),
+				sessionId: descriptor.sessionId
+			});
+		},
 		sessionId: descriptor.sessionId,
 		taskId: input.input.taskId
 	});
@@ -26023,7 +26078,7 @@ function toCursorAcpTransportError(error, stderr, diagnostics) {
 		errorType: error.errorType,
 		message: error.message
 	});
-	const classified = classifyCursorFailure([toErrorMessage$29(error), normalizeOptionalText$42(stderr)].filter((value) => value !== null).join("\n"));
+	const classified = classifyCursorFailure([toErrorMessage$30(error), normalizeOptionalText$42(stderr)].filter((value) => value !== null).join("\n"));
 	return diagnostics ? new CursorAcpTransportError({
 		code: classified.code,
 		diagnostics,
@@ -26070,7 +26125,7 @@ function normalizeOptionalText$42(value) {
 function toRecord$4(value) {
 	return value && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
-function toErrorMessage$29(error) {
+function toErrorMessage$30(error) {
 	return error instanceof Error ? error.message : String(error);
 }
 //#endregion
@@ -26080,7 +26135,9 @@ function createCursorAdapter(options) {
 	const activeTurns = /* @__PURE__ */ new Map();
 	const registerActiveTurn = (registration) => {
 		const turn = {
+			agentControllerPermissionMode: registration.agentControllerPermissionMode,
 			cancel: registration.cancel,
+			setPermissionMode: registration.setPermissionMode,
 			sessionId: registration.sessionId
 		};
 		activeTurns.set(registration.taskId, turn);
@@ -26112,9 +26169,41 @@ function createCursorAdapter(options) {
 		interrupt: (request) => interruptActiveCursorTurn({
 			activeTurns,
 			request
+		}),
+		updatePermissionMode: (request) => updateCursorActivePermissionMode({
+			activeTurns,
+			request
 		})
 	};
 }
+async function updateCursorActivePermissionMode(input) {
+	if (!input.request.agentControllerPermissionMode.startsWith("cursor:")) return {
+		reasonCode: "adapter.permission_mode_incompatible",
+		status: "not_applied",
+		taskId: input.request.taskId
+	};
+	const activeTurn = input.activeTurns.get(input.request.taskId);
+	if (!activeTurn) return {
+		reasonCode: "adapter.task_not_active",
+		status: "not_applied",
+		taskId: input.request.taskId
+	};
+	if (!(isCursorAcpSessionPermissionMode(activeTurn.agentControllerPermissionMode) && isCursorAcpSessionPermissionMode(input.request.agentControllerPermissionMode))) return {
+		reasonCode: "adapter.permission_mode_update_unsupported",
+		status: "not_applied",
+		taskId: input.request.taskId
+	};
+	await activeTurn.setPermissionMode(input.request.agentControllerPermissionMode);
+	activeTurn.agentControllerPermissionMode = input.request.agentControllerPermissionMode;
+	return {
+		effectiveFrom: "subsequent_tool_requests",
+		status: "applied",
+		taskId: input.request.taskId
+	};
+}
+function isCursorAcpSessionPermissionMode(permissionMode) {
+	return permissionMode === "cursor:ask" || permissionMode === "cursor:default" || permissionMode === "cursor:plan";
+}
 function createDefaultCursorInvoke(input) {
 	const cursorTimeoutMs = input.options.cursorTimeoutMs ?? resolveCursorTimeoutMs();
 	return async (dispatchInput) => {
@@ -26137,7 +26226,7 @@ function createDefaultCursorInvoke(input) {
 				code: "context.rebuild_failed",
 				...error instanceof CursorAcpTransportError && error.diagnostics ? { diagnostics: error.diagnostics } : {},
 				errorType: "adapter",
-				message: `context.rebuild_failed: ${toErrorMessage$28(error)}`
+				message: `context.rebuild_failed: ${toErrorMessage$29(error)}`
 			}),
 			invokeOnce: async (sessionId) => {
 				const transportResult = await invokeCursorAcpTransport({
@@ -26216,7 +26305,7 @@ async function cancelActiveCursorTurn(input) {
 		return {
 			accepted: false,
 			reasonCode: "signal.send_failed",
-			reasonDetail: toErrorMessage$28(error),
+			reasonDetail: toErrorMessage$29(error),
 			signalDelivery: "not_sent",
 			taskId: input.request.taskId
 		};
@@ -26250,7 +26339,7 @@ async function interruptActiveCursorTurn(input) {
 			accepted: false,
 			plan,
 			reasonCode: "signal.send_failed",
-			reasonDetail: toErrorMessage$28(error),
+			reasonDetail: toErrorMessage$29(error),
 			signalDelivery: "not_sent",
 			taskId: input.request.taskId
 		};
@@ -26260,7 +26349,7 @@ function normalizeOptionalText$41(value) {
 	const normalized = typeof value === "string" ? value.trim() : "";
 	return normalized.length > 0 ? normalized : null;
 }
-function toErrorMessage$28(error) {
+function toErrorMessage$29(error) {
 	return error instanceof Error ? error.message : String(error);
 }
 //#endregion
@@ -26928,7 +27017,7 @@ async function invokeOpenClawWithSingleContextHeal(input) {
 		createRebuildFailedError: (error) => new OpenClawRuntimeError({
 			code: "context.rebuild_failed",
 			errorType: "adapter",
-			message: `context.rebuild_failed: ${toErrorMessage$27(error)}`
+			message: `context.rebuild_failed: ${toErrorMessage$28(error)}`
 		}),
 		invokeOnce: (sessionId) => invokeOpenClawOnce({
 			openClawAgentId: input.openClawAgentId,
@@ -26979,11 +27068,11 @@ async function invokeOpenClawOnce(input) {
 		throw new OpenClawRuntimeError({
 			code: "upstream_unreachable",
 			errorType: "adapter",
-			message: `upstream_unreachable: ${toErrorMessage$27(error)}`
+			message: `upstream_unreachable: ${toErrorMessage$28(error)}`
 		});
 	}
 }
-function toErrorMessage$27(error) {
+function toErrorMessage$28(error) {
 	if (error instanceof Error) return error.message;
 	return String(error);
 }
@@ -27275,7 +27364,7 @@ function toOpenClawGatewayTransportError(error) {
 	});
 	const stderr = normalizeOptionalText$35(error?.stderr);
 	const stdout = normalizeOptionalText$35(error?.stdout);
-	return classifyGatewayFailure(stderr ?? stdout ?? toErrorMessage$26(error));
+	return classifyGatewayFailure(stderr ?? stdout ?? toErrorMessage$27(error));
 }
 function classifyGatewayFailure(message) {
 	return new OpenClawGatewayTransportError(classifyOpenClawFailureMessage({ message }));
@@ -27284,7 +27373,7 @@ function normalizeOptionalText$35(value) {
 	const normalized = String(value ?? "").trim();
 	return normalized.length > 0 ? normalized : null;
 }
-function toErrorMessage$26(error) {
+function toErrorMessage$27(error) {
 	return error instanceof Error ? error.message : String(error);
 }
 //#endregion
@@ -28940,14 +29029,14 @@ const createAuthorityOpenMeldServiceRuntimeId = (input) => {
 		source: RUNTIME_REGISTRY_AUTHORITY_SOURCE
 	};
 };
-const normalizeOptionalString$10 = (value) => {
+const normalizeOptionalString$12 = (value) => {
 	const normalized = String(value ?? "").trim();
 	return normalized.length > 0 ? normalized : void 0;
 };
 const createAgentProfileBindingModelSelection = (input) => {
-	const modelId = normalizeOptionalString$10(input?.modelId);
+	const modelId = normalizeOptionalString$12(input?.modelId);
 	if (!modelId) return;
-	const reasoningLevel = normalizeOptionalString$10(input?.reasoningLevel);
+	const reasoningLevel = normalizeOptionalString$12(input?.reasoningLevel);
 	return {
 		modelId,
 		...reasoningLevel ? { reasoningLevel } : {}
@@ -31198,7 +31287,7 @@ const INFLIGHT_RETENTION_MS = DEDUPE_RETENTION_MS;
 const AGENT_CONTEXT_RETENTION_MS = 720 * 60 * 60 * 1e3;
 const AGENT_CONTEXT_MAX_ENTRIES = 2e3;
 const AGENT_CONTEXT_LOOKUP_KEY_SEPARATOR = "|";
-const isRecord$2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const isRecord$3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const isPositiveInteger = (value) => Number.isInteger(value) && typeof value === "number" && value >= 0;
 const isRuntimeTransportMode = (value) => runtimeTransportModeSchema.safeParse(value).success;
 const utf8ByteLength = (value) => {
@@ -31222,7 +31311,7 @@ const utf8ByteLength = (value) => {
 	return byteLength;
 };
 const toErrorCode = (error) => {
-	if (!isRecord$2(error)) return null;
+	if (!isRecord$3(error)) return null;
 	const code = error.code;
 	if (typeof code !== "string") return null;
 	return code;
@@ -31242,7 +31331,7 @@ const buildLegacySpaceScopedAgentContextLookupKey = (input) => [
 	input.runtimeWorkspaceFingerprint
 ].map(encodeAgentContextLookupKeyPart).join(AGENT_CONTEXT_LOOKUP_KEY_SEPARATOR);
 const parseInflightTask = (value) => {
-	if (!isRecord$2(value)) return null;
+	if (!isRecord$3(value)) return null;
 	const { bindingKey, firstSeenAtMs, idempotencyKey, output, sequence, taskId } = value;
 	if (typeof taskId !== "string" || taskId.length === 0 || typeof bindingKey !== "string" || bindingKey.length === 0 || typeof idempotencyKey !== "string" || idempotencyKey.length === 0 || !isPositiveInteger(sequence) || !isPositiveInteger(firstSeenAtMs)) return null;
 	if (output !== void 0 && (typeof output !== "string" || output.length === 0)) return null;
@@ -31256,7 +31345,7 @@ const parseInflightTask = (value) => {
 	};
 };
 const parseAgentContextState = (agentContextLookupKey, value) => {
-	if (!isRecord$2(value)) return null;
+	if (!isRecord$3(value)) return null;
 	const { agentControllerConversationId, agentControllerRef, createdAtMs, lastTaskId, spaceId, targetProfileId, transportMode, runtimeWorkspaceFingerprint, updatedAtMs } = value;
 	const parsedAgentControllerRef = typeof agentControllerRef === "string" ? parseAgentControllerRef$1(agentControllerRef) : null;
 	if (!isRuntimeTransportMode(transportMode) || typeof agentContextLookupKey !== "string" || agentContextLookupKey.length === 0 || typeof spaceId !== "string" || spaceId.length === 0 || typeof targetProfileId !== "string" || targetProfileId.length === 0 || !parsedAgentControllerRef || typeof runtimeWorkspaceFingerprint !== "string" || runtimeWorkspaceFingerprint.length === 0 || typeof agentControllerConversationId !== "string" || agentControllerConversationId.length === 0 || !isPositiveInteger(createdAtMs) || !isPositiveInteger(updatedAtMs) || typeof lastTaskId !== "string" || lastTaskId.length === 0) return null;
@@ -31288,7 +31377,7 @@ const parseAgentContextState = (agentContextLookupKey, value) => {
 	};
 };
 const parseAgentContextLifecycleCounters = (value) => {
-	if (!isRecord$2(value)) return null;
+	if (!isRecord$3(value)) return null;
 	const { created, guardBlocked, recreated, reused } = value;
 	if (!(isPositiveInteger(created) && isPositiveInteger(recreated) && isPositiveInteger(reused) && isPositiveInteger(guardBlocked))) return null;
 	return {
@@ -31305,7 +31394,7 @@ const createEmptyAgentContextLifecycleCounters = () => ({
 	reused: 0
 });
 const parseAgentContextRotationRecord = (value) => {
-	if (!isRecord$2(value)) return null;
+	if (!isRecord$3(value)) return null;
 	const { nextAgentControllerConversationId, previousAgentControllerConversationId, rotationAt, rotationReason, rotationTaskId, rotationTriggerErrorCode } = value;
 	if (typeof previousAgentControllerConversationId !== "string" || previousAgentControllerConversationId.length === 0 || typeof nextAgentControllerConversationId !== "string" || nextAgentControllerConversationId.length === 0 || typeof rotationTriggerErrorCode !== "string" || rotationTriggerErrorCode.length === 0 || typeof rotationReason !== "string" || rotationReason.length === 0 || !isPositiveInteger(rotationAt) || typeof rotationTaskId !== "string" || rotationTaskId.length === 0) return null;
 	return {
@@ -31329,7 +31418,7 @@ const parseAgentContextRotationsOrDefault = (value) => {
 	return nextRecords;
 };
 const parseDedupeFirstSeenByKey = (value) => {
-	if (!isRecord$2(value)) return null;
+	if (!isRecord$3(value)) return null;
 	const nextDedupeFirstSeenByKey = {};
 	for (const [key, firstSeenAtMs] of Object.entries(value)) {
 		if (!isPositiveInteger(firstSeenAtMs)) return null;
@@ -31338,7 +31427,7 @@ const parseDedupeFirstSeenByKey = (value) => {
 	return nextDedupeFirstSeenByKey;
 };
 const parseInflightByTaskId = (value) => {
-	if (!isRecord$2(value)) return null;
+	if (!isRecord$3(value)) return null;
 	const nextInflightByTaskId = {};
 	for (const [taskId, inflightTask] of Object.entries(value)) {
 		const parsedTask = parseInflightTask(inflightTask);
@@ -31348,7 +31437,7 @@ const parseInflightByTaskId = (value) => {
 	return nextInflightByTaskId;
 };
 const parseReplayedTaskIds = (value) => {
-	if (!isRecord$2(value)) return null;
+	if (!isRecord$3(value)) return null;
 	const nextReplayedTaskIds = {};
 	for (const [taskId, replayed] of Object.entries(value)) {
 		if (replayed !== true) return null;
@@ -31357,7 +31446,7 @@ const parseReplayedTaskIds = (value) => {
 	return nextReplayedTaskIds;
 };
 const parseAgentContextByLookupKey = (value) => {
-	if (!isRecord$2(value)) return null;
+	if (!isRecord$3(value)) return null;
 	const nextAgentContextByLookupKey = {};
 	for (const [agentContextLookupKey, rawAgentContextState] of Object.entries(value)) {
 		const parsedAgentContextState = parseAgentContextState(agentContextLookupKey, rawAgentContextState);
@@ -31369,7 +31458,7 @@ const parseAgentContextByLookupKey = (value) => {
 const parseAgentContextLifecycleCountersOrDefault = (value) => parseAgentContextLifecycleCounters(value);
 const parseBootstrapExecutionByLookupKey = (value) => {
 	if (value === void 0) return {};
-	if (!isRecord$2(value)) return null;
+	if (!isRecord$3(value)) return null;
 	const nextBootstrapExecutionByLookupKey = {};
 	for (const [agentContextLookupKey, executionState] of Object.entries(value)) {
 		const parsedExecutionState = conversationExecutionStateSchema.safeParse(executionState);
@@ -31380,7 +31469,7 @@ const parseBootstrapExecutionByLookupKey = (value) => {
 	return nextBootstrapExecutionByLookupKey;
 };
 const parseLedgerStateV1 = (value) => {
-	if (!isRecord$2(value)) return null;
+	if (!isRecord$3(value)) return null;
 	const { agentContextRotations, dedupeFirstSeenByKey, inflightByTaskId, replayedTaskIds, agentContextByLookupKey, bootstrapExecutionByLookupKey, agentContextLifecycleCounters, updatedAtMs, v } = value;
 	if (v !== 1 || !isPositiveInteger(updatedAtMs)) return null;
 	const nextDedupeFirstSeenByKey = parseDedupeFirstSeenByKey(dedupeFirstSeenByKey);
@@ -32823,10 +32912,12 @@ function createInflightTaskControlRegistry() {
 			if (existing && existing.dispatchId !== input.dispatchId && taskIdByDispatchId.get(existing.dispatchId) === existing.taskId) taskIdByDispatchId.delete(existing.dispatchId);
 			const record = {
 				adapterId: input.adapterId,
+				agentControllerPermissionMode: input.agentControllerPermissionMode ?? existing?.agentControllerPermissionMode ?? null,
 				dispatchId: input.dispatchId,
 				processId: existing?.processId ?? null,
 				runtimeCoordinatorExecutionId: input.runtimeCoordinatorExecutionId ?? null,
 				signalTarget: existing?.signalTarget ?? null,
+				targetProfileId: input.targetProfileId ?? existing?.targetProfileId ?? null,
 				taskId: input.taskId,
 				updatedAt: (/* @__PURE__ */ new Date()).toISOString()
 			};
@@ -32834,6 +32925,17 @@ function createInflightTaskControlRegistry() {
 			taskIdByDispatchId.set(input.dispatchId, input.taskId);
 			return record;
 		},
+		updateTaskPermissionMode(input) {
+			const existing = readRecord(input.taskId);
+			if (!existing) return null;
+			const updated = {
+				...existing,
+				agentControllerPermissionMode: input.agentControllerPermissionMode,
+				updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+			};
+			recordByTaskId.set(input.taskId, updated);
+			return updated;
+		},
 		updateTaskProcess(input) {
 			const existing = readRecord(input.taskId);
 			if (!existing) return null;
@@ -33003,7 +33105,7 @@ function createLocalExecutionSlots(input) {
 					}),
 					durationMs: Math.max(0, Date.now() - startedAtMs),
 					errorCode: null,
-					errorMessage: toErrorMessage$25(error),
+					errorMessage: toErrorMessage$26(error),
 					result: "failed"
 				});
 			}).finally(() => {
@@ -33118,7 +33220,7 @@ function createLocalExecutionSlots(input) {
 function buildAttemptKey(dispatchId, attemptId) {
 	return `${dispatchId}::${attemptId}`;
 }
-function toErrorMessage$25(error) {
+function toErrorMessage$26(error) {
 	if (error instanceof Error && error.message.trim().length > 0) return error.message;
 	if (typeof error === "string" && error.trim().length > 0) return error;
 	return "unknown error";
@@ -37510,7 +37612,7 @@ async function syncDeviceRuntimeStateProjection(input) {
 	});
 	const registeredCustomTargetIds = await loadRegisteredCustomTargetIds();
 	const targetStates = await listAgentTargetStates().catch((error) => {
-		throw new Error(`failed to load OpenMeld agent target states: ${toErrorMessage$24(error)}`);
+		throw new Error(`failed to load OpenMeld agent target states: ${toErrorMessage$25(error)}`);
 	});
 	const targetStateById = new Map(targetStates.map((state) => [state.agentId, state]));
 	const projectedControllerIds = [...projectedControllers.keys()].sort();
@@ -37586,7 +37688,7 @@ async function loadProjectedControllers(input) {
 	const expectedRoutesResult = await (input.expectedRoutesRead ?? createExpectedRoutesReadSession()).read();
 	if (expectedRoutesResult.status === "resolved") return collectProjectedControllersFromExpectedRoutes(expectedRoutesResult.response.expectedRoutes);
 	const profiles = await listOpenMeldProfiles().catch((error) => {
-		throw new Error(`failed to list OpenMeld profiles: ${toErrorMessage$24(error)}`);
+		throw new Error(`failed to list OpenMeld profiles: ${toErrorMessage$25(error)}`);
 	});
 	return await collectProjectedControllers({
 		bindingReads: input.bindingReads,
@@ -37607,7 +37709,7 @@ function collectProjectedControllersFromExpectedRoutes(expectedRoutes) {
 }
 async function loadRegisteredCustomTargetIds() {
 	const customTargets = await listAgentCustomTargets().catch((error) => {
-		throw new Error(`failed to list OpenMeld custom targets: ${toErrorMessage$24(error)}`);
+		throw new Error(`failed to list OpenMeld custom targets: ${toErrorMessage$25(error)}`);
 	});
 	return new Set(customTargets.map((target) => target.id));
 }
@@ -37885,7 +37987,7 @@ function emitProjectionEvidence(result) {
 function normalizeText$2(value) {
 	return String(value ?? "").trim();
 }
-function toErrorMessage$24(error) {
+function toErrorMessage$25(error) {
 	if (error instanceof Error) return error.message;
 	return String(error);
 }
@@ -38490,9 +38592,9 @@ function createModelCatalogReadSession(input) {
 async function readModelCatalogOnce(baseUrl) {
 	try {
 		const [apiClient, baseUrlModule, clientFoundationModule] = await Promise.all([
-			import("./dist-DYE9Q3T4.js").then((n) => n.w),
-			import("./base-url-PkgATS5u.js").then((n) => n.n),
-			import("./api-client-foundation-w4Oa06t4.js").then((n) => n.t)
+			import("./dist-BnHChh7U.js").then((n) => n.w),
+			import("./base-url-BtqW4aLS.js").then((n) => n.n),
+			import("./api-client-foundation-eG7A-GEB.js").then((n) => n.t)
 		]);
 		if (typeof apiClient.createConfigApi !== "function") throw new Error("config api client is unavailable");
 		const resolvedBaseUrl = baseUrl ?? await baseUrlModule.resolveBaseUrl();
@@ -39108,7 +39210,7 @@ async function repairLocalReplyStateOrThrow(input) {
 			mode: "repair"
 		});
 	} catch (error) {
-		const errorMessage = toErrorMessage$31(error);
+		const errorMessage = toErrorMessage$32(error);
 		emitRunLine({
 			presenter: input.presenter,
 			code: "daemon.run.projection_sync_failed",
@@ -39125,7 +39227,7 @@ async function repairLocalReplyStateOrThrow(input) {
 	try {
 		await syncProfileWorkspaceState({ mode: "repair" });
 	} catch (error) {
-		const errorMessage = toErrorMessage$31(error);
+		const errorMessage = toErrorMessage$32(error);
 		emitRunLine({
 			presenter: input.presenter,
 			code: "daemon.run.profile_workspace_sync_failed",
@@ -39177,7 +39279,7 @@ async function syncDaemonRouteCatalogState(input) {
 		return {
 			status: "failed",
 			reason: "load_failed",
-			errorMessage: toErrorMessage$31(error)
+			errorMessage: toErrorMessage$32(error)
 		};
 	}
 	const nextFingerprint = buildRouteCatalogFingerprint(nextCatalog);
@@ -39190,7 +39292,7 @@ async function syncDaemonRouteCatalogState(input) {
 				return {
 					status: "failed",
 					reason: "register_failed",
-					errorMessage: toErrorMessage$31(error)
+					errorMessage: toErrorMessage$32(error)
 				};
 			}
 			applyAcceptedLeases({
@@ -39223,7 +39325,7 @@ async function syncDaemonRouteCatalogState(input) {
 		return {
 			status: "failed",
 			reason: "register_failed",
-			errorMessage: toErrorMessage$31(error)
+			errorMessage: toErrorMessage$32(error)
 		};
 	}
 	const diff = buildRouteCatalogDiff({
@@ -39344,7 +39446,7 @@ async function resolveLocalServiceDemand(input) {
 		expectedRoutesRead: input.expectedRoutesRead,
 		mode: "check"
 	}).catch(() => null) : input.projection;
-	const ownerUserId = normalizeOptionalString$9(input.ownerUserId);
+	const ownerUserId = normalizeOptionalString$11(input.ownerUserId);
 	if (!ownerUserId) return {
 		decision: "indeterminate",
 		hasLocalExecutionRoute: false,
@@ -39382,7 +39484,7 @@ async function resolveLocalServiceDemand(input) {
 			decision: "indeterminate",
 			hasLocalExecutionRoute: false,
 			repairableReplyCandidateCount: 0,
-			reason: `failed to load local daemon routes: ${toErrorMessage$31(error)}`,
+			reason: `failed to load local daemon routes: ${toErrorMessage$32(error)}`,
 			localExecutionRouteCount: 0,
 			projection
 		};
@@ -39415,7 +39517,7 @@ async function resolveLocalServiceDemand(input) {
 function isRepairableSkippedDaemonProfile(skipReason) {
 	return skipReason === "projection.missing" || skipReason === "workspace.missing";
 }
-function normalizeOptionalString$9(value) {
+function normalizeOptionalString$11(value) {
 	const normalized = String(value ?? "").trim();
 	return normalized.length > 0 ? normalized : null;
 }
@@ -39879,7 +39981,7 @@ async function runOpenClawJsonCommand(input) {
 	try {
 		return JSON.parse(stdout);
 	} catch (error) {
-		throw new Error(`openclaw JSON output could not be parsed: ${toErrorMessage$23(error)}`);
+		throw new Error(`openclaw JSON output could not be parsed: ${toErrorMessage$24(error)}`);
 	}
 }
 async function runOpenClawCommand(input) {
@@ -39914,7 +40016,7 @@ function normalizeOptionalText$24(value) {
 	const normalized = String(value ?? "").trim();
 	return normalized.length > 0 ? normalized : null;
 }
-function toErrorMessage$23(error) {
+function toErrorMessage$24(error) {
 	return error instanceof Error ? error.message : String(error);
 }
 function isExecFileTimeoutError(error) {
@@ -39928,7 +40030,7 @@ function resolveOpenClawCliErrorMessage(error, timeoutMs) {
 	const cliMessage = normalizeOptionalText$24(error.stderr) ?? stdout;
 	if (timeoutMs !== void 0 && isExecFileTimeoutError(error)) return cliMessage ? `openclaw command timed out after ${String(timeoutMs)}ms: ${cliMessage}` : `openclaw command timed out after ${String(timeoutMs)}ms`;
 	if (cliMessage) return cliMessage;
-	return `openclaw command failed: ${toErrorMessage$23(error)}`;
+	return `openclaw command failed: ${toErrorMessage$24(error)}`;
 }
 function parseOpenClawAgentSummary(value) {
 	if (!value || typeof value !== "object") return null;
@@ -40305,7 +40407,7 @@ async function ensureOpenClawGatewayAgentVisible(input, deps = DEFAULT_OPENCLAW_
 				gatewayRestartAttempted: true,
 				gatewayVisibility: "missing_before_restart"
 			},
-			message: `OpenClaw gateway restart failed while making agent '${agentId}' visible: ${toErrorMessage$22(error)}`
+			message: `OpenClaw gateway restart failed while making agent '${agentId}' visible: ${toErrorMessage$23(error)}`
 		});
 	}
 	let lastVisibilityError = null;
@@ -40334,7 +40436,7 @@ async function ensureOpenClawGatewayAgentVisible(input, deps = DEFAULT_OPENCLAW_
 			gatewayRestartAttempted: true,
 			gatewayVisibility: "missing_after_restart"
 		},
-		message: lastVisibilityError === null ? `OpenClaw gateway is running but agent '${agentId}' is still not visible after a gateway restart` : `OpenClaw gateway still cannot confirm agent '${agentId}' after a gateway restart: ${toErrorMessage$22(lastVisibilityError)}`
+		message: lastVisibilityError === null ? `OpenClaw gateway is running but agent '${agentId}' is still not visible after a gateway restart` : `OpenClaw gateway still cannot confirm agent '${agentId}' after a gateway restart: ${toErrorMessage$23(lastVisibilityError)}`
 	});
 }
 async function maybeCopyOpenClawAuth(input) {
@@ -40375,7 +40477,7 @@ async function ensureParentDirectory(path) {
 async function pathExists$1(path) {
 	return await access(path, constants.F_OK).then(() => true).catch(() => false);
 }
-function toErrorMessage$22(error) {
+function toErrorMessage$23(error) {
 	return error instanceof Error ? error.message : String(error);
 }
 function normalizeBootstrapReadError(error) {
@@ -40494,7 +40596,7 @@ function assertOpenClawWorkspaceMatch(input) {
 	});
 }
 function isOpenClawAgentAlreadyExistsError(error) {
-	const normalizedMessage = toErrorMessage$22(error).toLowerCase();
+	const normalizedMessage = toErrorMessage$23(error).toLowerCase();
 	return normalizedMessage.includes("agent") && normalizedMessage.includes("already exists");
 }
 function resolveProviderRuntimeWorkingDirectory(value) {
@@ -40531,7 +40633,7 @@ async function prepareOpenClawRuntime(input, deps = DEFAULT_OPENCLAW_RUNTIME_PRE
 	}).catch((error) => {
 		throw new DaemonServiceRunError({
 			code: "controller.bootstrap.failed",
-			message: `controller.bootstrap.failed: ${toErrorMessage$21(error)}`,
+			message: `controller.bootstrap.failed: ${toErrorMessage$22(error)}`,
 			providerErrorCode: extractErrorCode$1(error)
 		});
 	});
@@ -40541,7 +40643,7 @@ async function prepareOpenClawRuntime(input, deps = DEFAULT_OPENCLAW_RUNTIME_PRE
 	}).catch((error) => {
 		throw new DaemonServiceRunError({
 			code: "controller.gateway.unhealthy",
-			message: `controller.gateway.unhealthy: ${toErrorMessage$21(error)}`,
+			message: `controller.gateway.unhealthy: ${toErrorMessage$22(error)}`,
 			providerErrorCode: extractErrorCode$1(error)
 		});
 	});
@@ -40553,7 +40655,7 @@ async function prepareOpenClawRuntime(input, deps = DEFAULT_OPENCLAW_RUNTIME_PRE
 		const gatewayFailure = buildOpenClawGatewayVisibilityFailure(error);
 		throw new DaemonServiceRunError({
 			code: "controller.gateway.unhealthy",
-			message: `controller.gateway.unhealthy: ${toErrorMessage$21(error)}`,
+			message: `controller.gateway.unhealthy: ${toErrorMessage$22(error)}`,
 			providerErrorCode: extractErrorCode$1(error),
 			...gatewayFailure
 		});
@@ -40592,7 +40694,7 @@ function resolveOpenClawGatewayVisibilityDiagnostics(error) {
 		gatewayVisibility: parsedGatewayVisibility.data
 	};
 }
-function toErrorMessage$21(error) {
+function toErrorMessage$22(error) {
 	return error instanceof Error ? error.message : String(error);
 }
 //#endregion
@@ -40640,7 +40742,7 @@ function createOpenClawLocalDiagnosticsFailure(error) {
 	return {
 		errorCode: extractErrorCode(error),
 		kind: "failed",
-		message: toErrorMessage$20(error)
+		message: toErrorMessage$21(error)
 	};
 }
 function isOpenClawLocalDiagnosticsFailure(diagnostics) {
@@ -40724,7 +40826,7 @@ async function resolveInspectModeDiagnostics(input) {
 		openClawBin: input.openClawBin
 	}).then(() => "healthy").catch((error) => ({
 		errorCode: extractErrorCode(error),
-		message: toErrorMessage$20(error)
+		message: toErrorMessage$21(error)
 	}));
 	if (gatewayHealth !== "healthy") return {
 		...inspected,
@@ -40804,7 +40906,7 @@ async function resolveInspectGatewayVisibility(input) {
 		return {
 			errorCode: extractErrorCode(error),
 			gatewayVisibility: "not_checked",
-			message: toErrorMessage$20(error)
+			message: toErrorMessage$21(error)
 		};
 	}
 }
@@ -40813,7 +40915,7 @@ function resolveDiagnosticsFailureDetail(input) {
 	const inspectedMessage = typeof input.inspected.message === "string" && input.inspected.message.trim().length > 0 ? input.inspected.message.trim() : null;
 	return {
 		errorCode: inspectedErrorCode ?? extractErrorCode(input.error),
-		message: inspectedMessage ?? toErrorMessage$20(input.error)
+		message: inspectedMessage ?? toErrorMessage$21(input.error)
 	};
 }
 function resolveDiagnosticsTargetAgent(input) {
@@ -40874,7 +40976,7 @@ function buildBootstrapDiagnosticStatus(bootstrapStatus, errorCode, message) {
 }
 function resolveExplicitBootstrapDiagnostic(error) {
 	const explicitErrorCode = extractErrorCode(error);
-	const explicitMessage = error ? toErrorMessage$20(error) : null;
+	const explicitMessage = error ? toErrorMessage$21(error) : null;
 	switch (explicitErrorCode) {
 		case "openclaw.bootstrap.binding_conflict": return buildBootstrapDiagnosticStatus("binding_conflict", explicitErrorCode, explicitMessage);
 		case "openclaw.bootstrap.workspace_mismatch": return buildBootstrapDiagnosticStatus("workspace_mismatch", explicitErrorCode, explicitMessage);
@@ -40894,7 +40996,7 @@ function resolveExistingBootstrapStatus(input) {
 }
 function resolveInvalidBootstrapStatus(input) {
 	if (input.workspaceAgents.length > 1) return buildBootstrapDiagnosticStatus("workspace_ambiguous", "openclaw.bootstrap.workspace_ambiguous", null);
-	return buildBootstrapDiagnosticStatus("invalid", input.bootstrapRead.error?.code ?? extractErrorCode(input.error), input.bootstrapRead.error?.message ?? (input.error ? toErrorMessage$20(input.error) : null));
+	return buildBootstrapDiagnosticStatus("invalid", input.bootstrapRead.error?.code ?? extractErrorCode(input.error), input.bootstrapRead.error?.message ?? (input.error ? toErrorMessage$21(input.error) : null));
 }
 function resolveMissingBootstrapStatus(workspaceAgents, input = {}) {
 	if (workspaceAgents.length > 1) return buildBootstrapDiagnosticStatus("workspace_ambiguous", "openclaw.bootstrap.workspace_ambiguous", null);
@@ -40938,7 +41040,7 @@ function extractProviderErrorCode(error) {
 	const normalized = String(error.providerErrorCode ?? "").trim();
 	return normalized.length > 0 ? normalized : null;
 }
-function toErrorMessage$20(error) {
+function toErrorMessage$21(error) {
 	return error instanceof Error ? error.message : String(error);
 }
 //#endregion
@@ -41011,9 +41113,9 @@ async function resolveGatewayChainReadiness(input = {}) {
 			applicable: true,
 			baseUrl: fallbackBaseUrl,
 			checkedAt,
-			details: toErrorMessage$43(error),
+			details: toErrorMessage$44(error),
 			errorCode: null,
-			errorMessage: toErrorMessage$43(error),
+			errorMessage: toErrorMessage$44(error),
 			failureKind: "gateway_unreachable",
 			ready: false,
 			status: null,
@@ -42101,7 +42203,7 @@ function buildLookupFailedRouteObservationDetail(input) {
 		observedAt: input.observedAt,
 		reasonCode: "lookup_failed"
 	});
-	const rawError = toErrorMessage$19(input.error).trim();
+	const rawError = toErrorMessage$20(input.error).trim();
 	if (rawError.length === 0 || rawError === detail) return detail;
 	return `${detail} Raw lookup error: ${rawError}`;
 }
@@ -42129,7 +42231,7 @@ function enrichRuntimeStateWithManager(input) {
 		serviceController: input.runtimeState.serviceController === "unknown" && input.serviceManager?.controller !== void 0 ? input.serviceManager.controller : input.runtimeState.serviceController
 	};
 }
-function toErrorMessage$19(error) {
+function toErrorMessage$20(error) {
 	if (error instanceof Error) return error.message;
 	return String(error);
 }
@@ -42342,7 +42444,7 @@ async function clearDaemonStartFailureState(pathInput = {}) {
 	await rm(daemonStartFailureStatePath(pathInput), { force: true }).catch(() => void 0);
 }
 function parseDaemonStartFailureState(value) {
-	if (!isRecord$1(value)) return null;
+	if (!isRecord$2(value)) return null;
 	if (value.schema !== DAEMON_START_FAILURE_STATE_SCHEMA || value.v !== 1) return null;
 	const recordedAt = normalizeOptionalText$46(value.recordedAt);
 	const detail = normalizeOptionalText$46(value.detail);
@@ -42365,7 +42467,7 @@ function parseDaemonStartFailureState(value) {
 function normalizeDependencyIssues(issues) {
 	const normalized = [];
 	for (const issue of issues) {
-		if (!isRecord$1(issue)) continue;
+		if (!isRecord$2(issue)) continue;
 		const kind = issue.kind;
 		const status = issue.status;
 		const scope = issue.scope;
@@ -42384,7 +42486,7 @@ function normalizeDependencyIssues(issues) {
 	}
 	return normalized;
 }
-function isRecord$1(value) {
+function isRecord$2(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 async function writeJsonAtomic(input) {
@@ -43146,7 +43248,7 @@ async function captureDaemonServiceEvidence(input = {}) {
 			errorMessage: null
 		})).catch((error) => ({
 			snapshot: null,
-			errorMessage: toErrorMessage$18(error)
+			errorMessage: toErrorMessage$19(error)
 		})),
 		captureOwnedProcessesArtifact(phaseRootPath),
 		captureSystemServiceDiagnosticsArtifact(phaseRootPath)
@@ -43260,7 +43362,7 @@ async function captureDirectoryArtifact(input) {
 		};
 	} catch (error) {
 		return {
-			errorMessage: toErrorMessage$18(error),
+			errorMessage: toErrorMessage$19(error),
 			relativePath: null,
 			sourcePath: input.sourcePath,
 			status: "error"
@@ -43286,7 +43388,7 @@ async function captureFileArtifact(input) {
 		};
 	} catch (error) {
 		return {
-			errorMessage: toErrorMessage$18(error),
+			errorMessage: toErrorMessage$19(error),
 			relativePath: null,
 			sourcePath: input.sourcePath,
 			status: "error"
@@ -43308,7 +43410,7 @@ async function captureOwnedProcessesArtifact(evidencePath) {
 		} };
 	} catch (error) {
 		return { artifact: {
-			errorMessage: toErrorMessage$18(error),
+			errorMessage: toErrorMessage$19(error),
 			relativePath: null,
 			sourcePath: null,
 			status: "error"
@@ -43415,7 +43517,7 @@ async function runCommand$2(command, args, input = {}) {
 		child.once("close", handleClose);
 	});
 }
-function toErrorMessage$18(error) {
+function toErrorMessage$19(error) {
 	if (error instanceof Error) return error.message;
 	return String(error);
 }
@@ -43887,7 +43989,7 @@ var DaemonServiceLifecycleDrainTimeoutError = class extends Error {
 var DaemonServiceLifecycleControlledDrainError = class extends Error {
 	cause;
 	constructor(cause) {
-		super(`controlled service drain failed: ${toErrorMessage$42(cause)}`);
+		super(`controlled service drain failed: ${toErrorMessage$43(cause)}`);
 		this.name = "DaemonServiceLifecycleControlledDrainError";
 		this.cause = cause;
 	}
@@ -44051,7 +44153,7 @@ async function runDaemonServiceLifecycle(input) {
 			evidencePath: state.evidencePath,
 			recoveryStatus: "failed_before_safe_state",
 			errorCode: resolveLifecycleFailureErrorCode(error),
-			errorMessage: toErrorMessage$42(error)
+			errorMessage: toErrorMessage$43(error)
 		};
 	} finally {
 		await cleanupPreparedBundleAfterLifecycle({
@@ -44087,7 +44189,7 @@ async function cleanupPreparedBundleAfterLifecycle(input) {
 	} catch (error) {
 		console.warn("[openmeld.daemon_bundle.cleanup_warning]", {
 			bundleId: input.preparedBundle.bundleId,
-			errorMessage: toErrorMessage$42(error),
+			errorMessage: toErrorMessage$43(error),
 			operation: input.operation
 		});
 	}
@@ -44243,7 +44345,7 @@ async function executeDaemonServiceLifecycle(input) {
 	}
 }
 async function recoverLifecycleFailure(input) {
-	const originalErrorMessage = toErrorMessage$42(input.error);
+	const originalErrorMessage = toErrorMessage$43(input.error);
 	const originalErrorCode = resolveLifecycleFailureErrorCode(input.error);
 	const originalFailureStage = resolveLifecycleFailureStage(input.error, input.state.failureStage);
 	const originalReasonCodes = resolveLifecycleFailureReasonCodes(input.error);
@@ -44277,7 +44379,7 @@ async function recoverLifecycleFailure(input) {
 		}).catch((error) => {
 			verifiedRollbackError = error;
 			console.warn("[openmeld.daemon_service.verified_rollback_failed]", {
-				errorMessage: toErrorMessage$42(error),
+				errorMessage: toErrorMessage$43(error),
 				failureStage: originalFailureStage,
 				operation: input.operation,
 				previousVersion: input.restorePoint.previousInstallState?.daemonVersion ?? null,
@@ -44302,7 +44404,7 @@ async function recoverLifecycleFailure(input) {
 			errorMessage: originalErrorMessage
 		};
 	}
-	const recoveryErrorMessage = verifiedRollbackError ? `${originalErrorMessage}; verified previous Service recovery failed: ${toErrorMessage$42(verifiedRollbackError)}` : originalErrorMessage;
+	const recoveryErrorMessage = verifiedRollbackError ? `${originalErrorMessage}; verified previous Service recovery failed: ${toErrorMessage$43(verifiedRollbackError)}` : originalErrorMessage;
 	const stoppedSafe = await transitionLifecycleToStoppedSafeCurrentVersion({
 		commandOptions: input.commandOptions,
 		currentContract: input.currentContract,
@@ -44330,7 +44432,7 @@ async function recoverLifecycleFailure(input) {
 			evidencePath: input.state.evidencePath,
 			recoveryStatus: "failed_before_safe_state",
 			errorCode: originalErrorCode,
-			errorMessage: `${recoveryErrorMessage}; stopped-safe recovery failed: ${toErrorMessage$42(stoppedSafe.safeStopError)}`
+			errorMessage: `${recoveryErrorMessage}; stopped-safe recovery failed: ${toErrorMessage$43(stoppedSafe.safeStopError)}`
 		};
 	}
 	input.state.runtimeDataBackup = null;
@@ -44562,7 +44664,7 @@ async function stopLifecycleSystemServiceRuntime(input) {
 		} catch (restoreError) {
 			throw new DaemonServiceLifecycleStageError({
 				cause: restoreError,
-				message: `${toErrorMessage$42(drainError)}; failed to restore service autostart: ${toErrorMessage$42(restoreError)}`,
+				message: `${toErrorMessage$43(drainError)}; failed to restore service autostart: ${toErrorMessage$43(restoreError)}`,
 				stage: "stop_or_drain"
 			});
 		}
@@ -44617,7 +44719,7 @@ async function requestControlledSystemServiceDrain(input) {
 					observedDaemonVersion
 				} : {},
 				...isManagerRunningWithoutRuntime ? { compatibilityReason: "manager_running_without_runtime" } : {},
-				errorMessage: toErrorMessage$42(error)
+				errorMessage: toErrorMessage$43(error)
 			},
 			result: isCompatibilityFallback ? "fallback" : "failed",
 			stopCause: "controlled_service_update",
@@ -44689,7 +44791,7 @@ async function waitForLifecycleRuntimeAbsentWithRetry(serviceManager) {
 	} catch (retryError) {
 		throw new DaemonServiceLifecycleStageError({
 			cause: retryError,
-			message: `${toErrorMessage$42(retryError)}; initial absence verification failed: ${toErrorMessage$42(initialError)}`,
+			message: `${toErrorMessage$43(retryError)}; initial absence verification failed: ${toErrorMessage$43(initialError)}`,
 			stage: "wait_absent"
 		});
 	}
@@ -44699,7 +44801,7 @@ async function cleanupStaleDaemonRuntimeDataBackupsAfterHealthyLifecycle(operati
 		await cleanupStaleDaemonRuntimeDataBackups();
 	} catch (error) {
 		console.warn("[openmeld.daemon_runtime_data.cleanup_warning]", {
-			errorMessage: toErrorMessage$42(error),
+			errorMessage: toErrorMessage$43(error),
 			operation
 		});
 	}
@@ -45109,7 +45211,7 @@ async function stopDaemonProcess$1(pid, signal) {
 		process$1.kill(pid, signal);
 	} catch (error) {
 		if (error instanceof Error && error.code === "ESRCH") return true;
-		throw new Error(`Failed to send ${signal} to pid ${String(pid)}: ${toErrorMessage$42(error)}`);
+		throw new Error(`Failed to send ${signal} to pid ${String(pid)}: ${toErrorMessage$43(error)}`);
 	}
 	if (signal === "SIGKILL") return true;
 	return await waitForProcessToExit$1(pid, PROCESS_STOP_WAIT_MS);
@@ -45119,7 +45221,7 @@ async function stopDaemonProcessWithTimeout(pid, signal, timeoutMs) {
 		process$1.kill(pid, signal);
 	} catch (error) {
 		if (error instanceof Error && error.code === "ESRCH") return true;
-		throw new Error(`Failed to send ${signal} to pid ${String(pid)}: ${toErrorMessage$42(error)}`);
+		throw new Error(`Failed to send ${signal} to pid ${String(pid)}: ${toErrorMessage$43(error)}`);
 	}
 	return await waitForProcessToExit$1(pid, timeoutMs);
 }
@@ -45133,7 +45235,7 @@ async function waitForProcessToExit$1(pid, timeoutMs) {
 }
 function isLaunchdBootstrapIoError(serviceManager, error) {
 	if (serviceManager.controller !== "launchd") return false;
-	const message = toErrorMessage$42(error).toLowerCase();
+	const message = toErrorMessage$43(error).toLowerCase();
 	return message.includes("bootstrap failed") && message.includes("input/output error");
 }
 async function writeLifecycleEvidenceEvent(input) {
@@ -45660,7 +45762,7 @@ async function discardReplacedBundleBestEffort(input) {
 	await input.dependencies.discardBundle(input.pending.preparedBundle).catch((error) => {
 		console.warn("[openmeld.daemon_service.update_bundle_cleanup_failed]", {
 			bundleId: input.pending.preparedBundle.bundleId,
-			errorMessage: toErrorMessage$42(error),
+			errorMessage: toErrorMessage$43(error),
 			operationId: input.pending.jobId
 		});
 	});
@@ -45694,7 +45796,7 @@ async function preparePendingUpdateForSwitch(deps) {
 		} catch (error) {
 			await deps.persistPendingJob({
 				...waiting,
-				errorMessage: toErrorMessage$42(error),
+				errorMessage: toErrorMessage$43(error),
 				updatedAt: deps.now()
 			});
 			throw error;
@@ -45742,7 +45844,7 @@ async function runPreparedPendingUpdate(deps) {
 		await deps.completePendingJob(completed);
 		return completed;
 	} catch (error) {
-		const errorMessage = toErrorMessage$42(error);
+		const errorMessage = toErrorMessage$43(error);
 		if (running.attempts < MAX_BACKGROUND_UPDATE_ATTEMPTS) {
 			const retry = {
 				...running,
@@ -52265,7 +52367,7 @@ function storeNewestSpaceConfig(list, candidate) {
 	if (!existing || compareIsoDateDesc(candidate.updatedAt, existing.updatedAt) < 0) list.set(candidate.space, candidate);
 }
 function normalizeSpaceConfig(value) {
-	if (!isRecord(value)) return null;
+	if (!isRecord$1(value)) return null;
 	if (value.v === 2) return normalizeCurrentSpaceConfig(value);
 	if (value.v === 1) return normalizeLegacySpaceConfig(value);
 	return null;
@@ -52294,7 +52396,7 @@ function normalizeCurrentSpaceConfig(parsed) {
 	});
 }
 function normalizeSpaceCacheMaintenanceState(value) {
-	if (!isRecord(value)) return null;
+	if (!isRecord$1(value)) return null;
 	const lastRunAt = resolveIsoTimestamp(value.lastRunAt);
 	const lastRemovedByRemote = resolveOptionalNonNegativeInteger(value.lastRemovedByRemote);
 	const lastRemovedByTtl = resolveOptionalNonNegativeInteger(value.lastRemovedByTtl);
@@ -52309,8 +52411,8 @@ function normalizeSpaceCacheMaintenanceState(value) {
 	};
 }
 function normalizeSpaceCacheDeletionNoticeState(value) {
-	if (!isRecord(value)) return null;
-	if (value.v !== SPACE_CACHE_DELETION_NOTICE_SCHEMA_VERSION || !isRecord(value.seen)) return null;
+	if (!isRecord$1(value)) return null;
+	if (value.v !== SPACE_CACHE_DELETION_NOTICE_SCHEMA_VERSION || !isRecord$1(value.seen)) return null;
 	const seen = {};
 	for (const [rawKey, rawValue] of Object.entries(value.seen)) {
 		const key = normalizeTrimmedOptionalString(rawKey);
@@ -52411,7 +52513,7 @@ function hasInvalidLegacySpaceConfigPrimitives(parsed) {
 		hasInvalidOptionalStringEntry(parsed, "role"),
 		hasInvalidOptionalStringEntry(parsed, "mentionAlias"),
 		hasInvalidOptionalStringEntry(parsed, "guide"),
-		hasOwn(parsed, "permissions") && !isRecord(parsed.permissions),
+		hasOwn(parsed, "permissions") && !isRecord$1(parsed.permissions),
 		hasInvalidOptionalBooleanEntry(parsed, "passwordProtected"),
 		hasInvalidOptionalStringEntry(parsed, "spacePurpose"),
 		hasInvalidOptionalNonNegativeIntegerEntry(parsed, "activeAgentCount"),
@@ -52496,7 +52598,7 @@ function areStringListsEqual(left, right) {
 	for (let index = 0; index < left.length; index += 1) if (left[index] !== right[index]) return false;
 	return true;
 }
-function isRecord(value) {
+function isRecord$1(value) {
 	return !!value && typeof value === "object" && !Array.isArray(value);
 }
 function hasOwn(value, key) {
@@ -53348,7 +53450,7 @@ async function probeOpenCodeReadiness(input) {
 		const auth = resolveOpenCodeAuthSnapshotFromProbeError(error);
 		return {
 			auth,
-			message: `OpenCode is installed, but OpenMeld could not confirm a connected OpenCode provider: ${toErrorMessage$17(error)}`,
+			message: `OpenCode is installed, but OpenMeld could not confirm a connected OpenCode provider: ${toErrorMessage$18(error)}`,
 			models: [],
 			probeCompleted: auth.status === "unauthenticated",
 			status: "error"
@@ -53596,7 +53698,7 @@ function stripAnsi$1(value) {
 	}
 	return output;
 }
-function toErrorMessage$17(error) {
+function toErrorMessage$18(error) {
 	if (error instanceof Error) {
 		const message = error.message.trim();
 		return message.length > 0 ? message : "unknown error";
@@ -54089,7 +54191,7 @@ async function resolveGrokBuildInterfaceSnapshot(input) {
 		snapshot: {
 			...input.baseSnapshot,
 			auth: { status: unauthenticated ? "unauthenticated" : "unknown" },
-			message: unauthenticated ? requireControllerSignInInterfaceDescription("grok-build") : `OpenMeld could not read Grok Build's ACP status: ${toErrorMessage$16(interfaceProbe.error)}`,
+			message: unauthenticated ? requireControllerSignInInterfaceDescription("grok-build") : `OpenMeld could not read Grok Build's ACP status: ${toErrorMessage$17(interfaceProbe.error)}`,
 			status: unauthenticated ? "error" : "warning",
 			version,
 			versionAdvisory: await resolveControllerVersionAdvisory({
@@ -54323,7 +54425,7 @@ function probeCodexAppServer(launchContract) {
 		child.stdin.on("error", (error) => {
 			finish({
 				auth: { status: "unknown" },
-				message: `Codex app-server input closed before status could be read: ${toErrorMessage$16(error)}`,
+				message: `Codex app-server input closed before status could be read: ${toErrorMessage$17(error)}`,
 				ok: false
 			});
 		});
@@ -54351,7 +54453,7 @@ function probeCodexAppServer(launchContract) {
 		}).catch((error) => {
 			finish({
 				auth: { status: "unknown" },
-				message: `Codex app-server status check failed: ${toErrorMessage$16(error)}`,
+				message: `Codex app-server status check failed: ${toErrorMessage$17(error)}`,
 				ok: false
 			});
 		});
@@ -54614,7 +54716,7 @@ function normalizeOptionalText$15(value) {
 	const normalized = value.trim();
 	return normalized.length > 0 ? normalized : null;
 }
-function toErrorMessage$16(error) {
+function toErrorMessage$17(error) {
 	if (error instanceof Error) {
 		const message = error.message.trim();
 		return message.length > 0 ? message : "unknown error";
@@ -55162,7 +55264,7 @@ async function notifyRuntimeReportingAttemptObserver(observer, attempt) {
 	} catch (error) {
 		warnDaemonEvent("[openmeld.runtime_reporting.attempt_observer_failed]", {
 			authenticationRejected: attempt.authenticationRejected,
-			error: toErrorMessage$15(error),
+			error: toErrorMessage$16(error),
 			event: "cli.runtime_reporting.attempt_observer_failed",
 			family: attempt.family,
 			reasonCode: attempt.reasonCode,
@@ -55223,7 +55325,7 @@ async function submitAgentControllerReportsWithCompatibilityRetry(input) {
 			requestedReports: input.requestedReports
 		})) {
 			warnDaemonEvent("[openmeld.runtime_reporting.usage_limits_downgraded]", {
-				error: toErrorMessage$15(error),
+				error: toErrorMessage$16(error),
 				event: "cli.runtime_reporting.usage_limits_downgraded",
 				reportCount: input.requestedReports.length
 			});
@@ -55239,7 +55341,7 @@ async function submitAgentControllerReportsWithCompatibilityRetry(input) {
 			requestedReports: input.requestedReports
 		})) throw compatibilityError;
 		warnDaemonEvent("[openmeld.runtime_reporting.agent_controller_interface_downgraded]", {
-			error: toErrorMessage$15(compatibilityError),
+			error: toErrorMessage$16(compatibilityError),
 			event: "cli.runtime_reporting.agent_controller_interface_downgraded",
 			profileIds: input.requestedReports.map((report) => report.diagnosticProfileId).filter((profileId) => Boolean(profileId)),
 			reportCount: input.requestedReports.length
@@ -55448,7 +55550,7 @@ function failedProviderConversationProofSubmission(input) {
 		status: "failed"
 	};
 }
-function toErrorMessage$15(error) {
+function toErrorMessage$16(error) {
 	if (error instanceof Error) {
 		const message = error.message.trim();
 		return message.length > 0 ? message : "unknown error";
@@ -55780,7 +55882,7 @@ async function ensureAgentProfileRuntimeBinding(input) {
 		};
 	} catch (error) {
 		console.warn("[openmeld.agent_profile_binding.ensure_failed]", {
-			error: toErrorMessage$14(error),
+			error: toErrorMessage$15(error),
 			event: "cli.agent_profile_binding.ensure_failed",
 			profileId: input.profile.openMeldProfileId
 		});
@@ -55917,7 +56019,7 @@ function orderReasonCodesBySupportRelevance(input) {
 		reasonCodes: input.reasonCodes
 	}), ...input.reasonCodes]);
 }
-function toErrorMessage$14(error) {
+function toErrorMessage$15(error) {
 	if (error instanceof Error) {
 		const message = error.message.trim();
 		return message.length > 0 ? message : "unknown error";
@@ -56348,6 +56450,195 @@ function resolveOpenCommand() {
 	return "xdg-open";
 }
 //#endregion
+//#region src/commands/auth-device-session-client.ts
+const DEFAULT_DEVICE_CLIENT_ID = "openmeld-cli";
+const DEVICE_CLIENT_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:-]{1,63}$/;
+var AuthDeviceSessionClientError = class extends Error {
+	endpoint;
+	operation;
+	status;
+	constructor(input) {
+		super(input.message, input.cause === void 0 ? void 0 : { cause: input.cause });
+		this.name = "AuthDeviceSessionClientError";
+		this.endpoint = input.endpoint;
+		this.operation = input.operation;
+		this.status = input.status ?? null;
+	}
+};
+async function requestDeviceToken(input) {
+	const endpoint = toAuthEndpoint$3(input.authBaseUrl, "/api/auth/device/token");
+	const parsedRequest = betterAuthDeviceAuthorizationTokenRequestSchema.safeParse({
+		grant_type: BETTER_AUTH_DEVICE_AUTHORIZATION_GRANT_TYPE,
+		device_code: input.deviceCode,
+		client_id: input.clientId
+	});
+	if (!parsedRequest.success) throw createClientError({
+		endpoint,
+		operation: "exchange_device_token",
+		message: "computer authorization token request was invalid",
+		cause: parsedRequest.error
+	});
+	let response;
+	try {
+		response = await fetch(endpoint, {
+			method: "POST",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify(parsedRequest.data),
+			signal: AbortSignal.timeout(1e4)
+		});
+	} catch (error) {
+		throw createClientError({
+			endpoint,
+			operation: "exchange_device_token",
+			message: "computer authorization token request failed",
+			cause: error
+		});
+	}
+	const payload = await parseResponseJson$2(response);
+	if (response.ok) {
+		const parsed = betterAuthDeviceAuthorizationTokenResponseSchema.safeParse(payload);
+		if (!parsed.success) throw createClientError({
+			endpoint,
+			operation: "exchange_device_token",
+			status: response.status,
+			message: "computer authorization token response was invalid",
+			cause: parsed.error
+		});
+		return {
+			ok: true,
+			data: parsed.data
+		};
+	}
+	const parsedError = betterAuthDeviceAuthorizationErrorResponseSchema.safeParse(payload);
+	return {
+		ok: false,
+		error: parsedError.success ? parsedError.data : { message: response.statusText || `HTTP ${response.status}` },
+		status: response.status
+	};
+}
+async function fetchAuthUserSnapshot(input) {
+	const endpoint = toAuthEndpoint$3(input.authBaseUrl, "/api/auth/get-session");
+	let response;
+	try {
+		response = await fetch(endpoint, {
+			method: "GET",
+			headers: { authorization: `Bearer ${input.accessToken}` },
+			signal: AbortSignal.timeout(1e4)
+		});
+	} catch (error) {
+		throw createClientError({
+			endpoint,
+			operation: "read_auth_session",
+			message: "computer authorization account request failed",
+			cause: error
+		});
+	}
+	if (!response.ok) {
+		const payload = await parseResponseJson$2(response);
+		throw createClientError({
+			endpoint,
+			operation: "read_auth_session",
+			status: response.status,
+			message: `computer authorization account request failed: ${extractAuthApiErrorMessage(payload, response.status)}`
+		});
+	}
+	const payload = await parseResponseJson$2(response);
+	const parsed = betterAuthSessionSnapshotResponseSchema.safeParse(payload);
+	if (!parsed.success) throw createClientError({
+		endpoint,
+		operation: "read_auth_session",
+		status: response.status,
+		message: "computer authorization account response was invalid",
+		cause: parsed.error
+	});
+	if (!parsed.data?.user) throw createClientError({
+		endpoint,
+		operation: "read_auth_session",
+		status: response.status,
+		message: "computer authorization account response did not include a user"
+	});
+	return parsed.data.user;
+}
+async function revokeAuthAccessToken(input) {
+	const endpoint = toAuthEndpoint$3(input.authBaseUrl, "/api/auth/sign-out");
+	let response;
+	try {
+		response = await fetch(endpoint, {
+			method: "POST",
+			headers: { authorization: `${input.tokenType} ${input.accessToken}` },
+			signal: AbortSignal.timeout(1e4)
+		});
+	} catch (error) {
+		return {
+			ok: false,
+			error: createClientError({
+				endpoint,
+				operation: "revoke_auth_session",
+				message: "unused computer authorization session could not be revoked",
+				cause: error
+			})
+		};
+	}
+	if (!response.ok) {
+		const payload = await parseResponseJson$2(response);
+		return {
+			ok: false,
+			error: createClientError({
+				endpoint,
+				operation: "revoke_auth_session",
+				status: response.status,
+				message: `unused computer authorization session could not be revoked: ${extractAuthApiErrorMessage(payload, response.status)}`
+			})
+		};
+	}
+	return { ok: true };
+}
+function resolveDeviceAuthClientId(value) {
+	const clientId = normalizeOptionalString$10(value) ?? normalizeOptionalString$10(process.env.OPENMELD_AUTH_CLIENT_ID) ?? DEFAULT_DEVICE_CLIENT_ID;
+	if (!DEVICE_CLIENT_ID_PATTERN.test(clientId)) throw new Error(`invalid client_id "${clientId}" (allowed: letters, numbers, . _ : -)`);
+	return clientId;
+}
+function resolveDeviceTokenExpiresAt(expiresIn) {
+	if (typeof expiresIn !== "number" || !Number.isFinite(expiresIn) || expiresIn <= 0) return;
+	const now = Date.now();
+	const maxFutureMs = Math.max(0, Math.min(Number.MAX_SAFE_INTEGER, 864e13) - now);
+	const safeExpiresInSeconds = Math.min(Math.floor(expiresIn), Math.floor(maxFutureMs / 1e3));
+	if (safeExpiresInSeconds <= 0) return;
+	return new Date(now + safeExpiresInSeconds * 1e3).toISOString();
+}
+function extractAuthApiErrorMessage(payload, status) {
+	const parsed = betterAuthDeviceAuthorizationErrorResponseSchema.safeParse(payload);
+	if (!parsed.success) return `HTTP ${status}`;
+	return normalizeOptionalString$10(parsed.data.error_description) ?? normalizeOptionalString$10(parsed.data.detail) ?? normalizeOptionalString$10(parsed.data.message) ?? normalizeOptionalString$10(parsed.data.error) ?? `HTTP ${status}`;
+}
+function readAuthUserFromSessionPayload(payload) {
+	const parsed = betterAuthSessionSnapshotResponseSchema.safeParse(payload);
+	return parsed.success ? parsed.data?.user ?? null : null;
+}
+function createClientError(input) {
+	return new AuthDeviceSessionClientError(input);
+}
+function toAuthEndpoint$3(baseUrl, pathname) {
+	const url = new URL(baseUrl);
+	url.pathname = pathname;
+	url.search = "";
+	url.hash = "";
+	return url.toString();
+}
+function normalizeOptionalString$10(value) {
+	const normalized = String(value ?? "").trim();
+	return normalized.length > 0 ? normalized : null;
+}
+async function parseResponseJson$2(response) {
+	const raw = await response.text();
+	if (!raw) return null;
+	try {
+		return JSON.parse(raw);
+	} catch {
+		return { message: raw };
+	}
+}
+//#endregion
 //#region src/commands/auth-status-shared.ts
 function buildAuthStatusSnapshot(input) {
 	const session = input.session;
@@ -56369,7 +56660,7 @@ function buildAuthStatusSnapshot(input) {
 		expired: false,
 		activeOrganization: null
 	};
-	const expiresAt = normalizeOptionalString$8(session.expiresAt);
+	const expiresAt = normalizeOptionalString$9(session.expiresAt);
 	const expiresAtMs = expiresAt ? Date.parse(expiresAt) : NaN;
 	const hasValidExpiresAt = Number.isFinite(expiresAtMs);
 	const expiresInMs = hasValidExpiresAt ? expiresAtMs - Date.now() : NaN;
@@ -56379,14 +56670,14 @@ function buildAuthStatusSnapshot(input) {
 		state: input.state,
 		...input.reasonCode ? { reasonCode: input.reasonCode } : {},
 		...input.errorMessage ? { errorMessage: input.errorMessage } : {},
-		userId: normalizeOptionalString$8(session.user?.id),
-		userEmail: normalizeOptionalString$8(session.user?.email),
-		userName: normalizeOptionalString$8(session.user?.name),
-		clientId: normalizeOptionalString$8(session.clientId),
-		authBaseUrl: normalizeOptionalString$8(session.authBaseUrl),
-		tokenType: normalizeOptionalString$8(session.tokenType),
-		scope: normalizeOptionalString$8(session.scope),
-		createdAt: normalizeOptionalString$8(session.createdAt),
+		userId: normalizeOptionalString$9(session.user?.id),
+		userEmail: normalizeOptionalString$9(session.user?.email),
+		userName: normalizeOptionalString$9(session.user?.name),
+		clientId: normalizeOptionalString$9(session.clientId),
+		authBaseUrl: normalizeOptionalString$9(session.authBaseUrl),
+		tokenType: normalizeOptionalString$9(session.tokenType),
+		scope: normalizeOptionalString$9(session.scope),
+		createdAt: normalizeOptionalString$9(session.createdAt),
 		expiresAt,
 		expiresIn: hasValidExpiresAt ? formatRemainingDuration(expiresInMs) : null,
 		expired,
@@ -56470,7 +56761,7 @@ function appendRowIfValue(rows, label, value) {
 		value
 	});
 }
-function normalizeOptionalString$8(value) {
+function normalizeOptionalString$9(value) {
 	const normalized = String(value ?? "").trim();
 	return normalized.length > 0 ? normalized : null;
 }
@@ -56487,8 +56778,196 @@ function formatRemainingDuration(inputMs) {
 	return `${seconds}s`;
 }
 //#endregion
+//#region src/commands/one-time-token-auth-session.ts
+var OneTimeTokenAuthError = class extends Error {
+	code;
+	constructor(code, message, options) {
+		super(message, options);
+		this.name = "OneTimeTokenAuthError";
+		this.code = code;
+	}
+};
+var OneTimeTokenCandidateSessionCleanupError = class extends OneTimeTokenAuthError {
+	cleanup;
+	constructor(input) {
+		const redactedValues = input.redactedValues ?? [];
+		const cleanup = createSanitizedErrorDiagnostic(input.cleanupError, redactedValues);
+		const primary = createSanitizedErrorDiagnostic(input.cause, redactedValues);
+		const safeCause = input.cause instanceof OneTimeTokenLocalSessionRecoveryError ? input.cause : createErrorFromDiagnostic(primary);
+		const status = cleanup.status === null ? "network error" : `HTTP ${String(cleanup.status)}`;
+		super(input.cause instanceof OneTimeTokenAuthError ? input.cause.code : "unknown", `${primary.message}; cleanup failed at ${cleanup.endpoint ?? "unknown endpoint"} (${status}): ${cleanup.message}`, { cause: safeCause });
+		this.name = "OneTimeTokenCandidateSessionCleanupError";
+		this.cleanup = cleanup;
+	}
+};
+var OneTimeTokenLocalSessionRecoveryError = class extends OneTimeTokenAuthError {
+	primary;
+	recovery;
+	constructor(input) {
+		const redactedValues = input.redactedValues ?? [];
+		const primary = createSanitizedErrorDiagnostic(input.cause, redactedValues);
+		const recovery = createSanitizedErrorDiagnostic(input.recoveryError, redactedValues);
+		const aggregateCause = new AggregateError([createErrorFromDiagnostic(primary), createErrorFromDiagnostic(recovery)], "one-time token local session recovery failed");
+		super(input.cause instanceof OneTimeTokenAuthError ? input.cause.code : "unknown", `${primary.message}; local session recovery failed: ${recovery.message}`, { cause: aggregateCause });
+		this.name = "OneTimeTokenLocalSessionRecoveryError";
+		this.primary = primary;
+		this.recovery = recovery;
+	}
+};
+async function rejectOneTimeTokenCandidateSession(input) {
+	const cleanup = await revokeAuthAccessToken(input.session);
+	if (cleanup.ok) throw input.cause;
+	throw new OneTimeTokenCandidateSessionCleanupError({
+		cause: input.cause,
+		cleanupError: cleanup.error,
+		redactedValues: [input.session.accessToken]
+	});
+}
+async function exchangeOneTimeTokenAuthSession(input) {
+	const endpoint = toAuthEndpoint$2(input.authBaseUrl, "/api/auth/one-time-token/verify");
+	let response;
+	try {
+		response = await fetch(endpoint, {
+			method: "POST",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify({ token: input.token }),
+			signal: AbortSignal.timeout(1e4)
+		});
+	} catch (error) {
+		throw new OneTimeTokenAuthError("unknown", `one-time token verification request failed at ${endpoint}: ${toErrorMessage$14(error)}`);
+	}
+	const payload = await parseResponseJson$1(response);
+	if (!response.ok) throw mapOneTimeTokenHttpError(payload, response.status);
+	const accessToken = normalizeOptionalString$8(response.headers.get("set-auth-token"));
+	if (!accessToken) throw new OneTimeTokenAuthError("missing_access_token", "one-time token verified but auth response is missing set-auth-token");
+	try {
+		const user = readAuthUserFromSessionPayload(payload) ?? await fetchAuthUserSnapshot({
+			authBaseUrl: input.authBaseUrl,
+			accessToken
+		});
+		const userId = normalizeOptionalString$8(user.id);
+		if (!userId) throw new OneTimeTokenAuthError("unknown", "one-time token account response did not include a user id");
+		return {
+			accessToken,
+			tokenType: "Bearer",
+			authBaseUrl: input.authBaseUrl,
+			clientId: input.clientId,
+			...readSessionExpiresAtFromPayload(payload),
+			user: {
+				...user,
+				id: userId
+			}
+		};
+	} catch (error) {
+		return await rejectOneTimeTokenCandidateSession({
+			cause: error,
+			session: {
+				accessToken,
+				authBaseUrl: input.authBaseUrl,
+				tokenType: "Bearer"
+			}
+		});
+	}
+}
+function mapOneTimeTokenHttpError(payload, status) {
+	const message = extractAuthApiErrorMessage(payload, status);
+	const normalizedMessage = message.toLowerCase();
+	if (normalizedMessage.includes("expired")) return new OneTimeTokenAuthError("expired_token", "one-time token expired; generate a new token and retry");
+	if (normalizedMessage.includes("session not found")) return new OneTimeTokenAuthError("expired_token", "one-time token session is no longer valid; sign in to OpenMeld Web again, copy a fresh command, and retry");
+	if (normalizedMessage.includes("invalid")) return new OneTimeTokenAuthError("invalid_token", "invalid one-time token; generate a new token and retry");
+	return new OneTimeTokenAuthError("unknown", `one-time token verification failed: ${message}`);
+}
+function readSessionExpiresAtFromPayload(payload) {
+	if (!(payload && typeof payload === "object" && "session" in payload)) return {};
+	const session = payload.session;
+	if (!(session && typeof session === "object")) return {};
+	const raw = normalizeOptionalString$8(session.expiresAt);
+	if (!raw) return {};
+	const expiresAtMs = Date.parse(raw);
+	return Number.isNaN(expiresAtMs) ? {} : { expiresAt: new Date(expiresAtMs).toISOString() };
+}
+function toAuthEndpoint$2(baseUrl, pathname) {
+	const url = new URL(baseUrl);
+	url.pathname = pathname;
+	url.search = "";
+	url.hash = "";
+	return url.toString();
+}
+function normalizeOptionalString$8(value) {
+	const normalized = String(value ?? "").trim();
+	return normalized.length > 0 ? normalized : null;
+}
+function toErrorMessage$14(error) {
+	return error instanceof Error && error.message.trim() ? error.message.trim() : String(error ?? "unknown error");
+}
+function createSanitizedErrorDiagnostic(error, redactedValues, seen = /* @__PURE__ */ new Set(), depth = 0) {
+	if (depth >= 8) return {
+		message: "Nested error cause omitted after maximum diagnostic depth",
+		name: "ErrorCauseDepthLimit"
+	};
+	if (typeof error === "object" && error !== null || typeof error === "function") {
+		if (seen.has(error)) return {
+			message: "Circular error cause omitted",
+			name: "CircularErrorCause"
+		};
+		seen.add(error);
+	}
+	const record = isRecord(error) ? error : null;
+	const diagnostic = {
+		name: redactSensitiveText(error instanceof Error && error.name.trim() ? error.name.trim() : readDiagnosticString(record?.name) ?? "Error", redactedValues),
+		message: redactSensitiveText(toErrorMessage$14(error), redactedValues)
+	};
+	const stack = error instanceof Error ? readDiagnosticString(error.stack) : void 0;
+	if (stack) diagnostic.stack = redactSensitiveText(stack, redactedValues);
+	copyDiagnosticString(record, diagnostic, "path", redactedValues);
+	copyDiagnosticString(record, diagnostic, "endpoint", redactedValues);
+	copyDiagnosticString(record, diagnostic, "operation", redactedValues);
+	const code = record?.code;
+	if (typeof code === "string" || typeof code === "number") diagnostic.code = typeof code === "string" ? redactSensitiveText(code, redactedValues) : code;
+	const status = record?.status;
+	if (status === null || typeof status === "number") diagnostic.status = status;
+	if (record && "cause" in record && record.cause !== void 0) diagnostic.cause = createSanitizedErrorDiagnostic(record.cause, redactedValues, seen, depth + 1);
+	return diagnostic;
+}
+function createErrorFromDiagnostic(diagnostic) {
+	const cause = diagnostic.cause ? createErrorFromDiagnostic(diagnostic.cause) : void 0;
+	const error = new Error(diagnostic.message, cause === void 0 ? void 0 : { cause });
+	error.name = diagnostic.name;
+	if (diagnostic.stack) error.stack = diagnostic.stack;
+	const enriched = error;
+	enriched.code = diagnostic.code;
+	enriched.endpoint = diagnostic.endpoint;
+	enriched.operation = diagnostic.operation;
+	enriched.path = diagnostic.path;
+	enriched.status = diagnostic.status;
+	return enriched;
+}
+function copyDiagnosticString(source, target, key, redactedValues) {
+	const value = readDiagnosticString(source?.[key]);
+	if (value) target[key] = redactSensitiveText(value, redactedValues);
+}
+function readDiagnosticString(value) {
+	return typeof value === "string" && value.trim() ? value.trim() : void 0;
+}
+function redactSensitiveText(value, redactedValues) {
+	let redacted = value;
+	for (const sensitiveValue of redactedValues) if (sensitiveValue) redacted = redacted.split(sensitiveValue).join("[REDACTED]");
+	return redacted;
+}
+function isRecord(value) {
+	return Boolean(value && typeof value === "object");
+}
+async function parseResponseJson$1(response) {
+	const raw = await response.text();
+	if (!raw) return null;
+	try {
+		return JSON.parse(raw);
+	} catch {
+		return { message: raw };
+	}
+}
+//#endregion
 //#region src/commands/auth.ts
-const DEFAULT_DEVICE_CLIENT_ID = "openmeld-cli";
 const LOGIN_METHOD_DEVICE = "device";
 const LOGIN_METHOD_OTT = "ott";
 const LOGIN_METHOD_CANCEL = "__auth_login_method_cancel__";
@@ -56499,8 +56978,6 @@ const DEFAULT_POLL_INTERVAL_SECONDS = 5;
 const MAX_POLL_INTERVAL_SECONDS = 60;
 const MIN_POLL_INTERVAL_SECONDS = 1;
 const POLL_PROGRESS_EMIT_INTERVAL_MS = 15e3;
-const DEVICE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
-const DEVICE_CLIENT_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:-]{1,63}$/;
 const TRAILING_SLASH_PATTERN = /\/+$/;
 var DeviceAuthError = class extends Error {
 	code;
@@ -56509,13 +56986,6 @@ var DeviceAuthError = class extends Error {
 		this.code = code;
 	}
 };
-var OneTimeTokenAuthError = class extends Error {
-	code;
-	constructor(code, message) {
-		super(message);
-		this.code = code;
-	}
-};
 var AuthHttpError = class extends Error {
 	status;
 	endpoint;
@@ -56526,6 +56996,7 @@ var AuthHttpError = class extends Error {
 	}
 };
 async function runAuthLogin(input) {
+	await assertAuthSessionMutationAvailable();
 	const runtime = await resolveRuntimeContext({ view: input.view });
 	const presenter = createPresenter(runtime);
 	emitAuthOverviewIfNeeded({
@@ -56859,7 +57330,7 @@ async function runDeviceLoginFlow(input) {
 		tokenType: token.token_type ?? "Bearer",
 		authBaseUrl: input.authBaseUrl,
 		clientId: input.clientId,
-		expiresAt: resolveExpiresAt(token.expires_in),
+		expiresAt: resolveDeviceTokenExpiresAt(token.expires_in),
 		scope: normalizeOptionalString$7(token.scope) ?? void 0,
 		user: authUser ?? void 0
 	});
@@ -56876,28 +57347,44 @@ async function runOneTimeTokenLoginFlow(input) {
 		isHumanView: input.isHumanView,
 		authBaseUrl: input.authBaseUrl
 	});
-	const verified = await verifyOneTimeToken({
-		authBaseUrl: input.authBaseUrl,
-		token: input.token
-	});
-	const authUser = verified.user ?? await fetchAuthUserSnapshot({
-		authBaseUrl: input.authBaseUrl,
-		accessToken: verified.accessToken
-	});
-	await setAuthSession({
-		accessToken: verified.accessToken,
-		tokenType: "Bearer",
+	const verified = await exchangeOneTimeTokenAuthSession({
 		authBaseUrl: input.authBaseUrl,
 		clientId: input.clientId,
-		expiresAt: verified.expiresAt,
-		user: authUser ?? void 0
+		token: input.token
 	});
-	await assertOneTimeTokenAuthSessionSaved({ accessToken: verified.accessToken });
+	let transition = null;
+	try {
+		transition = await beginAuthSessionTransition({
+			accessToken: verified.accessToken,
+			tokenType: verified.tokenType,
+			authBaseUrl: verified.authBaseUrl,
+			clientId: verified.clientId,
+			expiresAt: verified.expiresAt,
+			user: verified.user
+		});
+		await assertOneTimeTokenAuthSessionSaved({ accessToken: verified.accessToken });
+		await transition.commit();
+	} catch (error) {
+		let failure = error;
+		if (transition) try {
+			await transition.rollback();
+		} catch (recoveryError) {
+			failure = new OneTimeTokenLocalSessionRecoveryError({
+				cause: error,
+				recoveryError,
+				redactedValues: [verified.accessToken]
+			});
+		}
+		await rejectOneTimeTokenCandidateSession({
+			cause: failure,
+			session: verified
+		});
+	}
 	emitLineWithHumanSpacer({
 		presenter: input.presenter,
 		isHumanView: input.isHumanView,
 		code: "auth.login.success",
-		text: input.isHumanView ? pc.green(resolveHumanLoginSuccessText(authUser)) : "one-time token verified; bearer token saved on this device"
+		text: input.isHumanView ? pc.green(resolveHumanLoginSuccessText(verified.user)) : "one-time token verified; bearer token saved on this device"
 	});
 }
 async function assertOneTimeTokenAuthSessionSaved(input) {
@@ -56957,7 +57444,7 @@ function parseAuthLoginMethod(value) {
 }
 function resolveClientIdForLogin(value, resolvedView) {
 	try {
-		return resolveClientId(value);
+		return resolveDeviceAuthClientId(value);
 	} catch (error) {
 		if (resolvedView === "agent") throw createAuthLoginGuideError(toErrorMessage$13(error));
 		throw error;
@@ -57027,6 +57514,7 @@ function emitBrowserOpenLine(input) {
 	});
 }
 async function runAuthLogout(input) {
+	await assertAuthSessionMutationAvailable();
 	const runtime = await resolveRuntimeContext({ view: input?.view });
 	const presenter = createPresenter(runtime);
 	emitAuthOverviewIfNeeded({
@@ -57199,47 +57687,13 @@ function resolveDaemonStopWarningText(input) {
 	if (input.reason === "invalid_state") return "OpenMeld found stale local OpenMeld Service runtime state and cleared what it could.";
 	return formatInlineOpenMeldCliCommands(`OpenMeld could not stop OpenMeld Service cleanly.${input.errorMessage ? ` ${input.errorMessage}` : ""} Run \`openmeld service stop --force\` if it is still running.`);
 }
-async function verifyOneTimeToken(input) {
-	const endpoint = toAuthEndpoint$1(input.authBaseUrl, "/api/auth/one-time-token/verify");
-	const response = await fetch(endpoint, {
-		method: "POST",
-		headers: { "content-type": "application/json" },
-		body: JSON.stringify({ token: input.token }),
-		signal: AbortSignal.timeout(1e4)
-	});
-	const payload = await parseResponseJson(response);
-	if (!response.ok) {
-		const message = extractApiErrorMessage(payload, response.status);
-		const normalizedMessage = message.toLowerCase();
-		if (normalizedMessage.includes("expired")) throw new OneTimeTokenAuthError("expired_token", "one-time token expired; generate a new token and retry");
-		if (normalizedMessage.includes("session not found")) throw new OneTimeTokenAuthError("expired_token", "one-time token session is no longer valid; sign in to OpenMeld Web again, copy a fresh command, and retry");
-		if (normalizedMessage.includes("invalid")) throw new OneTimeTokenAuthError("invalid_token", "invalid one-time token; generate a new token and retry");
-		throw new OneTimeTokenAuthError("unknown", `one-time token verification failed: ${message}`);
-	}
-	const accessToken = normalizeOptionalString$7(response.headers.get("set-auth-token"));
-	if (!accessToken) throw new OneTimeTokenAuthError("missing_access_token", "one-time token verified but auth response is missing set-auth-token");
-	return {
-		accessToken,
-		user: readAuthUserFromSessionPayload(payload),
-		expiresAt: readSessionExpiresAtFromPayload(payload)
-	};
-}
-function readSessionExpiresAtFromPayload(payload) {
-	if (!(payload && typeof payload === "object" && "session" in payload)) return;
-	const session = payload.session;
-	if (!(session && typeof session === "object")) return;
-	const raw = readOptionalStringField(session, "expiresAt");
-	if (!raw) return;
-	const parsed = new Date(raw);
-	if (Number.isNaN(parsed.getTime())) return;
-	return parsed.toISOString();
-}
 async function requestDeviceCode(input) {
 	const endpoint = toAuthEndpoint$1(input.authBaseUrl, "/api/auth/device/code");
+	const requestBody = betterAuthDeviceAuthorizationCodeRequestSchema.parse({ client_id: input.clientId });
 	const response = await fetch(endpoint, {
 		method: "POST",
 		headers: { "content-type": "application/json" },
-		body: JSON.stringify({ client_id: input.clientId }),
+		body: JSON.stringify(requestBody),
 		signal: AbortSignal.timeout(1e4)
 	});
 	const payload = await parseResponseJson(response);
@@ -57248,46 +57702,13 @@ async function requestDeviceCode(input) {
 		status: response.status,
 		endpoint
 	});
-	return {
-		device_code: normalizeRequiredString(readStringField$2(payload, "device_code"), "missing device_code in device code response"),
-		user_code: normalizeRequiredString(readStringField$2(payload, "user_code"), "missing user_code in device code response"),
-		verification_uri: normalizeOptionalString$7(readStringField$2(payload, "verification_uri")) ?? void 0,
-		verification_uri_complete: normalizeOptionalString$7(readStringField$2(payload, "verification_uri_complete")) ?? void 0,
-		expires_in: readNumberField(payload, "expires_in"),
-		interval: readNumberField(payload, "interval")
-	};
-}
-async function requestDeviceToken(input) {
-	const endpoint = toAuthEndpoint$1(input.authBaseUrl, "/api/auth/device/token");
-	const response = await fetch(endpoint, {
-		method: "POST",
-		headers: { "content-type": "application/json" },
-		body: JSON.stringify({
-			grant_type: DEVICE_GRANT_TYPE,
-			device_code: input.deviceCode,
-			client_id: input.clientId
-		}),
-		signal: AbortSignal.timeout(1e4)
+	const parsed = betterAuthDeviceAuthorizationCodeResponseSchema.safeParse(payload);
+	if (!parsed.success) throw new AuthHttpError({
+		message: "device code response did not match the Better Auth contract",
+		status: response.status,
+		endpoint
 	});
-	const payload = await parseResponseJson(response);
-	if (response.ok) return {
-		ok: true,
-		data: {
-			access_token: normalizeRequiredString(readStringField$2(payload, "access_token"), "missing access_token in device token response"),
-			token_type: normalizeOptionalString$7(readStringField$2(payload, "token_type")) ?? void 0,
-			expires_in: readNumberField(payload, "expires_in"),
-			scope: normalizeOptionalString$7(readStringField$2(payload, "scope")) ?? void 0
-		}
-	};
-	return {
-		ok: false,
-		error: {
-			error: normalizeOptionalString$7(readStringField$2(payload, "error")) ?? void 0,
-			error_description: normalizeOptionalString$7(readStringField$2(payload, "error_description")) ?? void 0,
-			message: normalizeOptionalString$7(readStringField$2(payload, "message")) ?? void 0
-		},
-		status: response.status
-	};
+	return parsed.data;
 }
 async function pollForDeviceToken(input) {
 	const deadline = Date.now() + input.expiresInSeconds * 1e3;
@@ -57326,7 +57747,7 @@ async function pollForDeviceToken(input) {
 		if (errorCode === "access_denied") throw new DeviceAuthError("access_denied", "browser sign-in was canceled");
 		if (errorCode === "expired_token") throw new DeviceAuthError("expired_token", "browser sign-in expired; sign in again");
 		if (errorCode === "invalid_grant") throw new DeviceAuthError("invalid_grant", "browser sign-in is no longer valid; sign in again");
-		throw new DeviceAuthError("unknown", `browser sign-in failed: ${extractApiErrorMessage(result.error, result.status)}`);
+		throw new DeviceAuthError("unknown", `browser sign-in failed: ${extractAuthApiErrorMessage(result.error, result.status)}`);
 	}
 	throw new DeviceAuthError("expired_token", "browser sign-in timed out; sign in again");
 }
@@ -57359,23 +57780,9 @@ function resolveExpiresInSeconds(value) {
 	if (typeof value !== "number" || !Number.isFinite(value) || value <= 0) return 1800;
 	return clampInteger(value, 60, 1440 * 60);
 }
-function resolveExpiresAt(expiresIn) {
-	if (typeof expiresIn !== "number" || !Number.isFinite(expiresIn) || expiresIn <= 0) return;
-	const now = Date.now();
-	const maxFutureMs = Math.max(0, Math.min(Number.MAX_SAFE_INTEGER, 864e13) - now);
-	const maxFutureSeconds = Math.floor(maxFutureMs / 1e3);
-	const safeExpiresInSeconds = Math.min(Math.floor(expiresIn), maxFutureSeconds);
-	if (safeExpiresInSeconds <= 0) return;
-	return new Date(now + safeExpiresInSeconds * 1e3).toISOString();
-}
 function clampInteger(value, min, max) {
 	return Math.max(min, Math.min(max, Math.floor(value)));
 }
-function resolveClientId(value) {
-	const clientId = normalizeOptionalString$7(value) ?? normalizeOptionalString$7(process.env.OPENMELD_AUTH_CLIENT_ID) ?? DEFAULT_DEVICE_CLIENT_ID;
-	if (!DEVICE_CLIENT_ID_PATTERN.test(clientId)) throw new Error(`invalid client_id "${clientId}" (allowed: letters, numbers, . _ : -)`);
-	return clientId;
-}
 function normalizeRequiredString(value, message) {
 	const normalized = normalizeOptionalString$7(value);
 	if (!normalized) throw new Error(message);
@@ -57394,11 +57801,6 @@ function readStringField$2(payload, key) {
 	const value = payload[key];
 	return typeof value === "string" ? value : null;
 }
-function readNumberField(payload, key) {
-	if (!(payload && typeof payload === "object" && key in payload)) return;
-	const value = payload[key];
-	return typeof value === "number" && Number.isFinite(value) ? value : void 0;
-}
 async function parseResponseJson(response) {
 	const raw = await response.text();
 	if (!raw) return null;
@@ -57459,45 +57861,11 @@ function emitLineWithHumanSpacer(input) {
 		text: ""
 	});
 }
-async function fetchAuthUserSnapshot(input) {
-	const endpoint = toAuthEndpoint$1(input.authBaseUrl, "/api/auth/get-session");
-	try {
-		const response = await fetch(endpoint, {
-			method: "GET",
-			headers: { authorization: `Bearer ${input.accessToken}` },
-			signal: AbortSignal.timeout(1e4)
-		});
-		if (!response.ok) return null;
-		return readAuthUserFromSessionPayload(await parseResponseJson(response));
-	} catch {
-		return null;
-	}
-}
-function readAuthUserFromSessionPayload(payload) {
-	if (!(payload && typeof payload === "object" && "user" in payload)) return null;
-	const user = payload.user;
-	if (!(user && typeof user === "object")) return null;
-	const userRecord = user;
-	const id = readOptionalStringField(userRecord, "id");
-	const email = readOptionalStringField(userRecord, "email");
-	const name = readOptionalStringField(userRecord, "name");
-	if (!(id || email || name)) return null;
-	return {
-		...id ? { id } : {},
-		...email ? { email } : {},
-		...name ? { name } : {}
-	};
-}
 function resolveHumanLoginSuccessText(user) {
 	const email = normalizeOptionalString$7(user?.email);
 	if (email) return `✅ Welcome ${email}`;
 	return "✅ Signed in.";
 }
-function readOptionalStringField(input, key) {
-	const value = input[key];
-	if (typeof value !== "string") return;
-	return normalizeOptionalString$7(value) ?? void 0;
-}
 function toDeviceAuthError(error) {
 	if (error instanceof DeviceAuthError) return error;
 	if (error instanceof Error) return new DeviceAuthError("unknown", error.message);
@@ -58887,7 +59255,7 @@ function flushDispatchResultOutbox(input) {
 			return {
 				...record,
 				attemptCount: record.attemptCount + 1,
-				lastFailureReason: toErrorMessage$31(error),
+				lastFailureReason: toErrorMessage$32(error),
 				nextAttemptAtMs: nowMs + resolveSendFailureBackoffMs(record.attemptCount + 1),
 				updatedAtMs: nowMs
 			};
@@ -60865,7 +61233,7 @@ async function runAttempt(attempt, deps) {
 	} catch (error) {
 		await deps.completeAttempt({
 			...running,
-			errorMessage: toErrorMessage$42(error),
+			errorMessage: toErrorMessage$43(error),
 			operation: {
 				...running.operation,
 				phase: "needs_help",
@@ -61129,7 +61497,7 @@ async function persistRuntimeReportingAttempt(attempt, serviceIdentity) {
 		});
 	} catch (error) {
 		warnDaemonEvent("[openmeld.runtime_reporting.health_write_failed]", {
-			error: toErrorMessage$31(error),
+			error: toErrorMessage$32(error),
 			event: "cli.runtime_reporting.health_write_failed",
 			family: attempt.family,
 			reasonCode: attempt.reasonCode,
@@ -65152,7 +65520,7 @@ function resolveSystemServiceStartupFailureVerdict(input) {
 		controller: input.controller,
 		jobDiagnostics,
 		localMachineIssue,
-		message: sanitizeSystemServiceErrorMessage$1(toErrorMessage$42(input.error)),
+		message: sanitizeSystemServiceErrorMessage$1(toErrorMessage$43(input.error)),
 		detail: input.detail ?? null
 	};
 }
@@ -65671,7 +66039,7 @@ async function runDaemonServiceParticipationRefresh(input) {
 			suppressed: input.input.suppressRefreshHumanResultCard === true
 		});
 		return {
-			errorMessage: toErrorMessage$31(error),
+			errorMessage: toErrorMessage$32(error),
 			status: "needs_attention"
 		};
 	}
@@ -67454,6 +67822,66 @@ function summarizeSubmissions(submissions) {
 	};
 }
 //#endregion
+//#region src/local-service/routing/active-permission-mode-sync.ts
+async function syncActiveTaskPermissionModes(input) {
+	const outcomes = [];
+	for (const task of input.inflightTaskControlRegistry.listTasks()) {
+		if (!task.targetProfileId) continue;
+		const nextPermissionMode = input.catalogState.routeByProfileId.get(task.targetProfileId)?.agentControllerPermissionMode;
+		if (!nextPermissionMode || nextPermissionMode === task.agentControllerPermissionMode) continue;
+		const updatePermissionMode = input.localAdapterContainer.getAdapter(task.adapterId)?.adapter.updatePermissionMode;
+		if (!updatePermissionMode) {
+			outcomes.push({
+				adapterId: task.adapterId,
+				agentControllerPermissionMode: nextPermissionMode,
+				reasonCode: "adapter.permission_mode_update_unsupported",
+				status: "not_applied",
+				targetProfileId: task.targetProfileId,
+				taskId: task.taskId
+			});
+			continue;
+		}
+		try {
+			const result = await updatePermissionMode({
+				agentControllerPermissionMode: nextPermissionMode,
+				taskId: task.taskId
+			});
+			if (result.status === "not_applied") {
+				outcomes.push({
+					adapterId: task.adapterId,
+					agentControllerPermissionMode: nextPermissionMode,
+					reasonCode: result.reasonCode,
+					status: "not_applied",
+					targetProfileId: task.targetProfileId,
+					taskId: task.taskId
+				});
+				continue;
+			}
+			input.inflightTaskControlRegistry.updateTaskPermissionMode({
+				agentControllerPermissionMode: nextPermissionMode,
+				taskId: task.taskId
+			});
+			outcomes.push({
+				adapterId: task.adapterId,
+				agentControllerPermissionMode: nextPermissionMode,
+				status: "applied",
+				targetProfileId: task.targetProfileId,
+				taskId: task.taskId
+			});
+		} catch (error) {
+			outcomes.push({
+				adapterId: task.adapterId,
+				agentControllerPermissionMode: nextPermissionMode,
+				errorMessage: error instanceof Error ? error.message : String(error),
+				status: "failed",
+				targetProfileId: task.targetProfileId,
+				taskId: task.taskId
+			});
+		}
+	}
+	return outcomes;
+}
+//#endregion
 //#region src/local-service/session-control/fork-agent-session.ts
 const PROVIDER_PROBE_TIMEOUT_MS = 5e3;
 const PROVIDER_FORK_TIMEOUT_MS = 3e4;
@@ -67806,7 +68234,7 @@ function toTaskExecutionError(error) {
 	return {
 		errorCode: "dispatch.execution_failed",
 		errorType: "internal",
-		message: toErrorMessage$31(error)
+		message: toErrorMessage$32(error)
 	};
 }
 //#endregion
@@ -69637,7 +70065,7 @@ function reportInvalidDeliverRequest(input) {
 			leaseEpoch: identity.leaseEpoch,
 			metadata: {
 				...buildResultDispatchJournalMetadata(resultPayload),
-				errorMessage: toErrorMessage$31(error),
+				errorMessage: toErrorMessage$32(error),
 				parseIssues: issues
 			},
 			profileId: identity.targetProfileId,
@@ -69648,10 +70076,10 @@ function reportInvalidDeliverRequest(input) {
 		emitRunLine({
 			presenter: input.presenter,
 			code: "daemon.run.invalid_deliver_result_send_failed",
-			text: `failed to send invalid deliver result for dispatch ${identity.dispatchId}: ${toErrorMessage$31(error)}`,
+			text: `failed to send invalid deliver result for dispatch ${identity.dispatchId}: ${toErrorMessage$32(error)}`,
 			payload: {
 				dispatchId: identity.dispatchId,
-				errorMessage: toErrorMessage$31(error),
+				errorMessage: toErrorMessage$32(error),
 				result: "failed",
 				taskId: identity.taskId
 			}
@@ -69814,8 +70242,10 @@ async function handleDispatchDeliverFrame(input) {
 	let firstOutputEvidenceSent = false;
 	input.inflightTaskControlRegistry.registerTask({
 		adapterId: runtimeControllerSupport.runtimeAdapterMatch.adapterId,
+		agentControllerPermissionMode: routeConfig?.agentControllerPermissionMode ?? null,
 		dispatchId: parsedTask.dispatchId,
 		runtimeCoordinatorExecutionId: parsedTask.runtimeCoordinatorExecutionId,
+		targetProfileId: parsedTask.targetProfileId,
 		taskId: parsedTask.taskId
 	});
 	const runtimeStartedAtMs = Date.now();
@@ -70102,7 +70532,7 @@ async function handleDispatchDeliverFrame(input) {
 						text: `Session Inventory origin could not be recorded for task ${parsedTask.taskId}`,
 						payload: {
 							dispatchId: parsedTask.dispatchId,
-							errorMessage: toErrorMessage$31(error),
+							errorMessage: toErrorMessage$32(error),
 							targetProfileId: parsedTask.targetProfileId,
 							taskId: parsedTask.taskId
 						}
@@ -70135,7 +70565,7 @@ async function handleDispatchDeliverFrame(input) {
 					text: `provider conversation observation could not be persisted for task ${parsedTask.taskId}`,
 					payload: {
 						dispatchId: parsedTask.dispatchId,
-						errorMessage: toErrorMessage$31(error),
+						errorMessage: toErrorMessage$32(error),
 						source: observation.source,
 						targetProfileId: parsedTask.targetProfileId,
 						taskId: parsedTask.taskId
@@ -70219,7 +70649,7 @@ async function handleDispatchDeliverFrame(input) {
 							payload: {
 								agentControllerRef: parsedTask.agentControllerRef,
 								dispatchId: parsedTask.dispatchId,
-								errorMessage: toErrorMessage$31(error),
+								errorMessage: toErrorMessage$32(error),
 								observedLimitKeys: event.usageLimits.map((limit) => limit.key),
 								targetProfileId: parsedTask.targetProfileId,
 								taskId: parsedTask.taskId
@@ -70904,7 +71334,7 @@ async function resolveDispatchSpaceMetaContext(input) {
 	} catch (error) {
 		return {
 			status: "failed",
-			errorMessage: toErrorMessage$31(error),
+			errorMessage: toErrorMessage$32(error),
 			spaceGuide: null,
 			spaceName: null,
 			spacePurpose: null
@@ -71278,7 +71708,7 @@ async function resolveAlreadyCompletedRuntimeResultAfterCliSpaceAction(input) {
 			text: `runtime failed after CLI OpenMeld Space Action finalized task ${input.parsedTask.taskId}`,
 			payload: {
 				dispatchId: input.parsedTask.dispatchId,
-				errorMessage: toErrorMessage$31(error),
+				errorMessage: toErrorMessage$32(error),
 				targetProfileId: input.parsedTask.targetProfileId,
 				taskId: input.parsedTask.taskId
 			}
@@ -71296,7 +71726,7 @@ function observeRuntimeResultAfterCliSpaceAction(input) {
 			text: `runtime failed after CLI OpenMeld Space Action finalized task ${input.parsedTask.taskId}`,
 			payload: {
 				dispatchId: input.parsedTask.dispatchId,
-				errorMessage: toErrorMessage$31(error),
+				errorMessage: toErrorMessage$32(error),
 				targetProfileId: input.parsedTask.targetProfileId,
 				taskId: input.parsedTask.taskId
 			}
@@ -71544,7 +71974,7 @@ async function coordinateConcurrentAgentReply(input) {
 				text: `Agent reply observation unavailable for task ${input.parsedTask.taskId}`,
 				payload: {
 					dispatchId: input.parsedTask.dispatchId,
-					errorMessage: toErrorMessage$31(error),
+					errorMessage: toErrorMessage$32(error),
 					observedThroughSignalId,
 					targetProfileId: input.parsedTask.targetProfileId,
 					taskId: input.parsedTask.taskId
@@ -71716,7 +72146,7 @@ function normalizeResolvedPostMessageAction(input) {
 			resolvedSpaceAction: normalizedPostMessageAction.action
 		};
 	} catch (error) {
-		const failureReason = toErrorMessage$31(error);
+		const failureReason = toErrorMessage$32(error);
 		emitRunLine({
 			presenter: input.presenter,
 			code: "daemon.run.post_message_validation_rejected",
@@ -71778,7 +72208,7 @@ function normalizeResolvedThreadAction(input) {
 			})
 		};
 	} catch (error) {
-		const failureReason = toErrorMessage$31(error);
+		const failureReason = toErrorMessage$32(error);
 		emitRunLine({
 			presenter: input.presenter,
 			code: "daemon.run.thread_action_validation_rejected",
@@ -71861,7 +72291,7 @@ async function maybeRepairStructuredSpaceAction(input) {
 				dispatchId: input.parsedTask.dispatchId,
 				...resolveStructuredActionFailureDiagnostics({
 					carrierKind: "none",
-					parseError: toErrorMessage$31(error),
+					parseError: toErrorMessage$32(error),
 					publicFailureReason: input.failureReason,
 					repairMode: "controller_roundtrip",
 					runtimeResult: input.runtimeResult
@@ -71877,7 +72307,7 @@ async function maybeRepairStructuredSpaceAction(input) {
 		return {
 			finalFailureDiagnostics: resolveStructuredActionFailureDiagnostics({
 				carrierKind: "none",
-				parseError: toErrorMessage$31(error),
+				parseError: toErrorMessage$32(error),
 				publicFailureReason: input.failureReason,
 				repairMode: "controller_roundtrip",
 				runtimeResult: input.runtimeResult
@@ -72320,7 +72750,7 @@ function sendResultAndSummarize(input) {
 			leaseEpoch: input.leaseEpoch,
 			metadata: {
 				...buildResultDispatchJournalMetadata(input.payload),
-				errorMessage: toErrorMessage$31(error)
+				errorMessage: toErrorMessage$32(error)
 			},
 			result: input.payload.status,
 			taskId: input.taskId,
@@ -72329,7 +72759,7 @@ function sendResultAndSummarize(input) {
 		emitRunLine({
 			presenter: input.presenter,
 			code: "daemon.run.result_send_failed",
-			text: `daemon result send failed for dispatch ${input.dispatchId}: ${toErrorMessage$31(error)}`,
+			text: `daemon result send failed for dispatch ${input.dispatchId}: ${toErrorMessage$32(error)}`,
 			payload: {
 				attemptId: input.attemptId,
 				connectionGeneration: input.connectionGeneration,
@@ -72434,7 +72864,7 @@ async function requestDispatchAgentInteraction(input) {
 			taskId: input.parsedTask.taskId
 		});
 	} catch (error) {
-		input.pendingAgentInteractionRegistry.reject(parsedInteraction.data.interactionId, error instanceof Error ? error : new Error(toErrorMessage$31(error)));
+		input.pendingAgentInteractionRegistry.reject(parsedInteraction.data.interactionId, error instanceof Error ? error : new Error(toErrorMessage$32(error)));
 		throw error;
 	}
 	emitRunLine({
@@ -72470,7 +72900,7 @@ function emitDispatchPreviewFrame(input) {
 		emitRunLine({
 			presenter: input.presenter,
 			code: "daemon.run.preview_send_failed",
-			text: `daemon preview send failed for dispatch ${input.dispatchId}: ${toErrorMessage$31(error)}`,
+			text: `daemon preview send failed for dispatch ${input.dispatchId}: ${toErrorMessage$32(error)}`,
 			payload: {
 				attemptId: input.attemptId,
 				dispatchId: input.dispatchId,
@@ -72512,7 +72942,7 @@ function emitDispatchAgentToolActivityFrame(input) {
 		emitRunLine({
 			presenter: input.presenter,
 			code: "daemon.run.tool_activity_send_failed",
-			text: `daemon tool activity send failed for dispatch ${input.parsedTask.dispatchId}: ${toErrorMessage$31(error)}`,
+			text: `daemon tool activity send failed for dispatch ${input.parsedTask.dispatchId}: ${toErrorMessage$32(error)}`,
 			payload: {
 				attemptId: input.parsedTask.attemptId,
 				dispatchId: input.parsedTask.dispatchId,
@@ -72541,7 +72971,7 @@ function emitDispatchPreviewEndFrame(input) {
 		emitRunLine({
 			presenter: input.presenter,
 			code: "daemon.run.preview_end_send_failed",
-			text: `daemon preview end send failed for dispatch ${input.dispatchId}: ${toErrorMessage$31(error)}`,
+			text: `daemon preview end send failed for dispatch ${input.dispatchId}: ${toErrorMessage$32(error)}`,
 			payload: {
 				attemptId: input.attemptId,
 				dispatchId: input.dispatchId,
@@ -72583,7 +73013,7 @@ function emitDispatchRuntimeEvidenceTransition(input) {
 		emitRunLine({
 			presenter: input.presenter,
 			code: "daemon.run.runtime_evidence_send_failed",
-			text: `daemon runtime evidence ${input.phase} send failed for dispatch ${identity.dispatchId}: ${toErrorMessage$31(error)}`,
+			text: `daemon runtime evidence ${input.phase} send failed for dispatch ${identity.dispatchId}: ${toErrorMessage$32(error)}`,
 			payload: {
 				attemptId: identity.attemptId,
 				dispatchId: identity.dispatchId,
@@ -72682,7 +73112,7 @@ function emitDispatchLifecycleTransition(input) {
 			dispatchId: input.dispatchId,
 			leaseEpoch: input.leaseEpoch,
 			metadata: {
-				errorMessage: toErrorMessage$31(error),
+				errorMessage: toErrorMessage$32(error),
 				localQueue: input.localQueue ?? null,
 				phase: input.phase
 			},
@@ -72693,7 +73123,7 @@ function emitDispatchLifecycleTransition(input) {
 		emitRunLine({
 			presenter: input.presenter,
 			code: "daemon.run.lifecycle_send_failed",
-			text: `daemon lifecycle ${input.phase} send failed for dispatch ${input.dispatchId}: ${toErrorMessage$31(error)}`,
+			text: `daemon lifecycle ${input.phase} send failed for dispatch ${input.dispatchId}: ${toErrorMessage$32(error)}`,
 			payload: {
 				attemptId: input.attemptId,
 				dispatchId: input.dispatchId,
@@ -73120,7 +73550,7 @@ function handleDaemonSocketFrame(input) {
 				emitRunLine({
 					presenter: input.presenter,
 					code: "daemon.run.control_cancel_failed",
-					text: `local cancel handling failed: ${toErrorMessage$31(error)}`,
+					text: `local cancel handling failed: ${toErrorMessage$32(error)}`,
 					payload: {
 						requestId: parsedCancelFrame.data.requestId,
 						target: parsedCancelFrame.data.payload.target
@@ -73132,7 +73562,7 @@ function handleDaemonSocketFrame(input) {
 						requestId: parsedCancelFrame.data.requestId,
 						payload: {
 							accepted: false,
-							note: toErrorMessage$31(error),
+							note: toErrorMessage$32(error),
 							reasonCode: "local_control.unhandled_error",
 							target: parsedCancelFrame.data.payload.target
 						}
@@ -73168,7 +73598,7 @@ function handleDaemonSocketFrame(input) {
 				emitRunLine({
 					presenter: input.presenter,
 					code: "daemon.run.control_interrupt_failed",
-					text: `local interrupt handling failed: ${toErrorMessage$31(error)}`,
+					text: `local interrupt handling failed: ${toErrorMessage$32(error)}`,
 					payload: {
 						requestId: parsedInterruptFrame.data.requestId,
 						target: parsedInterruptFrame.data.payload.target
@@ -73180,7 +73610,7 @@ function handleDaemonSocketFrame(input) {
 						requestId: parsedInterruptFrame.data.requestId,
 						payload: {
 							accepted: false,
-							note: toErrorMessage$31(error),
+							note: toErrorMessage$32(error),
 							reasonCode: "local_control.unhandled_error",
 							target: parsedInterruptFrame.data.payload.target
 						}
@@ -73371,7 +73801,7 @@ function handleComputerFileAccessSocketFrame(input) {
 		emitRunLine({
 			presenter: input.presenter,
 			code: "daemon.run.computer_file_access_failed",
-			text: `Computer file access failed: ${toErrorMessage$31(error)}`
+			text: `Computer file access failed: ${toErrorMessage$32(error)}`
 		});
 	});
 	return true;
@@ -73390,14 +73820,14 @@ function handleLocalProjectControlSocketFrame(input) {
 			emitRunLine({
 				presenter: input.presenter,
 				code: "daemon.run.agent_activity_connection_signal_failed",
-				text: `Agent Activity connection signal failed: ${toErrorMessage$31(error)}`
+				text: `Agent Activity connection signal failed: ${toErrorMessage$32(error)}`
 			});
 		}
 	}).catch((error) => {
 		emitRunLine({
 			presenter: input.presenter,
 			code: "daemon.run.local_project_control_failed",
-			text: `local Project control failed: ${toErrorMessage$31(error)}`
+			text: `local Project control failed: ${toErrorMessage$32(error)}`
 		});
 	});
 	return true;
@@ -73612,7 +74042,7 @@ async function runDaemonSocketSession(input) {
 	function recordHeartbeatFailure(error) {
 		consecutiveHeartbeatFailures += 1;
 		const shouldCloseSocket = consecutiveHeartbeatFailures >= 3;
-		const errorMessage = toErrorMessage$31(error);
+		const errorMessage = toErrorMessage$32(error);
 		emitRunLine({
 			presenter: input.presenter,
 			code: "daemon.run.heartbeat_failed",
@@ -73805,7 +74235,7 @@ async function runDaemonSocketSession(input) {
 				emitRunLine({
 					presenter: input.presenter,
 					code: "daemon.run.heartbeat_failed",
-					text: `heartbeat failed: ${toErrorMessage$31(error)}`
+					text: `heartbeat failed: ${toErrorMessage$32(error)}`
 				});
 			});
 		}, normalizedDelayMs);
@@ -73847,7 +74277,7 @@ async function runDaemonSocketSession(input) {
 				emitRunLine({
 					presenter: input.presenter,
 					code: "daemon.run.catalog_sync_signal_read_failed",
-					text: `catalog sync signal read failed: ${toErrorMessage$31(error)}`
+					text: `catalog sync signal read failed: ${toErrorMessage$32(error)}`
 				});
 			}).finally(() => {
 				scheduleCatalogSyncSignalPoll();
@@ -73908,7 +74338,7 @@ async function runDaemonSocketSession(input) {
 			emitRunLine({
 				presenter: input.presenter,
 				code: "daemon.run.local_components_status_failed",
-				text: `local components status unavailable: ${toErrorMessage$31(error)}`
+				text: `local components status unavailable: ${toErrorMessage$32(error)}`
 			});
 			return null;
 		}
@@ -74072,6 +74502,14 @@ async function runDaemonSocketSession(input) {
 			}),
 			registerCatalog: registerDaemonSession
 		});
+		if (syncResult.status !== "failed") {
+			const permissionModeOutcomes = await syncActiveTaskPermissionModes({
+				catalogState: input.routeCatalogState,
+				inflightTaskControlRegistry: input.inflightTaskControlRegistry,
+				localAdapterContainer: input.localAdapterContainer
+			});
+			emitActivePermissionModeSyncOutcomes(permissionModeOutcomes);
+		}
 		if (syncResult.status === "changed") {
 			await handleChangedCatalogSync(syncResult, inputSync);
 			resolvePendingRouteCatalogSyncRequests(syncResult);
@@ -74090,17 +74528,36 @@ async function runDaemonSocketSession(input) {
 		handleFailedCatalogSync(syncResult);
 		resolvePendingRouteCatalogSyncRequests(syncResult);
 	};
+	const emitActivePermissionModeSyncOutcomes = (outcomes) => {
+		for (const outcome of outcomes) {
+			if (outcome.status === "applied") {
+				emitRunLine({
+					presenter: input.presenter,
+					code: "daemon.run.active_permission_mode_updated",
+					text: `updated permission mode for active task ${outcome.taskId}`,
+					payload: outcome
+				});
+				continue;
+			}
+			emitRunLine({
+				presenter: input.presenter,
+				code: outcome.status === "failed" ? "daemon.run.active_permission_mode_update_failed" : "daemon.run.active_permission_mode_not_applied",
+				text: outcome.status === "failed" ? `failed to update permission mode for active task ${outcome.taskId}: ${outcome.errorMessage ?? "unknown error"}` : `active permission mode update was not applied for task ${outcome.taskId} (${outcome.reasonCode})`,
+				payload: outcome
+			});
+		}
+	};
 	const shouldStartRouteCatalogSync = () => Boolean(forceCatalogSyncReason) || Date.now() >= nextCatalogSyncAtMs;
 	function startRouteCatalogSyncIfDue() {
 		if (closed || routeCatalogSyncInFlight || !shouldStartRouteCatalogSync()) return;
 		routeCatalogSyncInFlight = true;
 		syncRouteCatalogIfDue().catch((error) => {
-			const syncError = error instanceof Error ? error : new Error(toErrorMessage$31(error));
+			const syncError = error instanceof Error ? error : new Error(toErrorMessage$32(error));
 			failPendingRouteCatalogSyncRequests(syncError);
 			emitRunLine({
 				presenter: input.presenter,
 				code: "daemon.run.catalog_sync_failed",
-				text: `catalog sync failed: ${toErrorMessage$31(error)}`
+				text: `catalog sync failed: ${toErrorMessage$32(error)}`
 			});
 		}).finally(() => {
 			routeCatalogSyncInFlight = false;
@@ -74158,7 +74615,7 @@ async function runDaemonSocketSession(input) {
 			emitRunLine({
 				presenter: input.presenter,
 				code: "daemon.run.runtime_agent_controller_report_sync_failed",
-				text: `runtime agent controller report sync failed: ${toErrorMessage$31(error)}`
+				text: `runtime agent controller report sync failed: ${toErrorMessage$32(error)}`
 			});
 			throw error;
 		}
@@ -74233,7 +74690,7 @@ async function runDaemonSocketSession(input) {
 			emitRunLine({
 				presenter: input.presenter,
 				code: "daemon.run.provider_conversation_proof_sync_failed",
-				text: `provider conversation proof sync failed: ${toErrorMessage$31(error)}`
+				text: `provider conversation proof sync failed: ${toErrorMessage$32(error)}`
 			});
 		} finally {
 			providerConversationProofSyncInFlight = false;
@@ -74244,14 +74701,14 @@ async function runDaemonSocketSession(input) {
 			emitRunLine({
 				presenter: input.presenter,
 				code: "daemon.run.runtime_agent_controller_report_sync_failed",
-				text: `runtime agent controller report sync failed: ${toErrorMessage$31(error)}`
+				text: `runtime agent controller report sync failed: ${toErrorMessage$32(error)}`
 			});
 		});
 		syncProviderConversationProofsIfDue().catch((error) => {
 			emitRunLine({
 				presenter: input.presenter,
 				code: "daemon.run.provider_conversation_proof_sync_failed",
-				text: `provider conversation proof sync failed: ${toErrorMessage$31(error)}`
+				text: `provider conversation proof sync failed: ${toErrorMessage$32(error)}`
 			});
 		});
 	};
@@ -74403,7 +74860,7 @@ async function runDaemonSocketSession(input) {
 				emitRunLine({
 					presenter: input.presenter,
 					code: "daemon.run.local_agent_control_report_sync_failed",
-					text: `runtime agent controller report sync failed after local agent control: ${toErrorMessage$31(error)}`
+					text: `runtime agent controller report sync failed after local agent control: ${toErrorMessage$32(error)}`
 				});
 			}
 			if (result.changed) requestLocalExecutionEvidenceRefresh({
@@ -74432,7 +74889,7 @@ async function runDaemonSocketSession(input) {
 				status: result.status
 			};
 		} catch (error) {
-			const message = toErrorMessage$31(error);
+			const message = toErrorMessage$32(error);
 			const reasonCode = resolveLocalAgentEnabledErrorCode$1(error);
 			emitRunLine({
 				presenter: input.presenter,
@@ -74468,7 +74925,7 @@ async function runDaemonSocketSession(input) {
 					emitRunLine({
 						presenter: input.presenter,
 						code: "daemon.run.local_agent_installation_report_sync_failed",
-						text: `runtime agent controller report sync failed after installation change: ${toErrorMessage$31(error)}`
+						text: `runtime agent controller report sync failed after installation change: ${toErrorMessage$32(error)}`
 					});
 				}
 				requestLocalExecutionEvidenceRefresh({
@@ -74501,7 +74958,7 @@ async function runDaemonSocketSession(input) {
 				status: result.status
 			};
 		} catch (error) {
-			const message = toErrorMessage$31(error);
+			const message = toErrorMessage$32(error);
 			const reasonCode = resolveLocalAgentEnabledErrorCode$1(error);
 			emitRunLine({
 				presenter: input.presenter,
@@ -74554,7 +75011,7 @@ async function runDaemonSocketSession(input) {
 				workspacePath: result.workspacePath
 			};
 		} catch (error) {
-			const message = toErrorMessage$31(error);
+			const message = toErrorMessage$32(error);
 			const reasonCode = resolveProfileWorkspaceControlErrorCode(error);
 			emitRunLine({
 				presenter: input.presenter,
@@ -74593,7 +75050,7 @@ async function runDaemonSocketSession(input) {
 			});
 			return payload;
 		} catch (error) {
-			const errorMessage = toErrorMessage$31(error);
+			const errorMessage = toErrorMessage$32(error);
 			emitRunLine({
 				presenter: input.presenter,
 				code: "daemon.run.local_agent_control_refresh_catalog_failed",
@@ -74611,7 +75068,7 @@ async function runDaemonSocketSession(input) {
 		emitRunLine({
 			presenter: input.presenter,
 			code: "daemon.run.socket_error",
-			text: `daemon stream socket error: ${toErrorMessage$31(error)}`
+			text: `daemon stream socket error: ${toErrorMessage$32(error)}`
 		});
 	});
 	const handleLocalAgentRegistrationControlFrame = (frame) => {
@@ -74620,7 +75077,7 @@ async function runDaemonSocketSession(input) {
 				emitRunLine({
 					presenter: input.presenter,
 					code: "daemon.run.local_agent_control_failed",
-					text: `local agent control failed: ${toErrorMessage$31(error)}`
+					text: `local agent control failed: ${toErrorMessage$32(error)}`
 				});
 			});
 			return true;
@@ -74630,7 +75087,7 @@ async function runDaemonSocketSession(input) {
 				emitRunLine({
 					presenter: input.presenter,
 					code: "daemon.run.agent_session_fork_failed",
-					text: `Agent Session Fork failed: ${toErrorMessage$31(error)}`
+					text: `Agent Session Fork failed: ${toErrorMessage$32(error)}`
 				});
 			});
 			return true;
@@ -74640,7 +75097,7 @@ async function runDaemonSocketSession(input) {
 				emitRunLine({
 					presenter: input.presenter,
 					code: "daemon.run.local_agent_control_failed",
-					text: `local agent installation control failed: ${toErrorMessage$31(error)}`
+					text: `local agent installation control failed: ${toErrorMessage$32(error)}`
 				});
 			});
 			return true;
@@ -74678,7 +75135,7 @@ async function runDaemonSocketSession(input) {
 			emitRunLine({
 				presenter: input.presenter,
 				code: "daemon.run.openmeld_tools_control_failed",
-				text: `OpenMeld Tools control failed: ${toErrorMessage$31(error)}`
+				text: `OpenMeld Tools control failed: ${toErrorMessage$32(error)}`
 			});
 		});
 		return true;
@@ -74717,7 +75174,7 @@ async function runDaemonSocketSession(input) {
 				emitRunLine({
 					presenter: input.presenter,
 					code: "daemon.run.local_agent_control_failed",
-					text: `local agent control failed: ${toErrorMessage$31(error)}`
+					text: `local agent control failed: ${toErrorMessage$32(error)}`
 				});
 			});
 			return;
@@ -74727,7 +75184,7 @@ async function runDaemonSocketSession(input) {
 				emitRunLine({
 					presenter: input.presenter,
 					code: "daemon.run.local_agent_control_failed",
-					text: `local agent control failed: ${toErrorMessage$31(error)}`
+					text: `local agent control failed: ${toErrorMessage$32(error)}`
 				});
 			});
 			return;
@@ -74737,7 +75194,7 @@ async function runDaemonSocketSession(input) {
 				emitRunLine({
 					presenter: input.presenter,
 					code: "daemon.run.execution_recovery_failed",
-					text: `execution recovery failed: ${toErrorMessage$31(error)}`
+					text: `execution recovery failed: ${toErrorMessage$32(error)}`
 				});
 			});
 			return;
@@ -75147,41 +75604,51 @@ async function resolveDaemonServiceOwnerContext(input) {
 	});
 }
 async function resolveDaemonStreamAuthContext(input) {
-	const authState = await getAuthSessionState({ validateRemote: false });
-	if (authState.state !== "valid" || authState.session === null) return {
-		authState: resolveAuthenticationRequiredAuthState(authState),
-		status: "authentication_required"
-	};
-	const attachment = resolveAuthTokenAttachment({
-		session: authState.session,
-		requestUrl: input.requestUrl
-	});
-	if (attachment.status === "dropped") return {
-		authState: "invalid",
-		credentialFailure: attachment,
+	let headers;
+	try {
+		headers = await buildDaemonStreamRequestHeaders({
+			requestUrl: input.requestUrl,
+			selectedOpenMeldProfile: input.selectedOpenMeldProfile
+		});
+	} catch (error) {
+		if (!(error instanceof AuthRequestCredentialError)) throw error;
+		return {
+			authState: resolveCredentialFailureAuthState(error.reason),
+			credentialFailure: toDaemonStreamCredentialFailure(error),
+			status: "authentication_required"
+		};
+	}
+	if (!headers.Authorization) return {
+		authState: "missing",
 		status: "authentication_required"
 	};
 	return {
 		authState: "valid",
-		headers: await buildDaemonStreamRequestHeaders({
-			authSession: authState.session,
-			requestUrl: input.requestUrl,
-			selectedOpenMeldProfile: input.selectedOpenMeldProfile
-		}),
+		headers,
 		status: "ready"
 	};
 }
-function resolveAuthenticationRequiredAuthState(input) {
-	if (input.state !== "valid") return input.state;
+function resolveCredentialFailureAuthState(reason) {
+	if (reason === "session_expired") return "expired";
+	if (reason === "remote_session_revoked" || reason === "session_revoked") return "revoked";
 	return "invalid";
 }
+function toDaemonStreamCredentialFailure(error) {
+	return {
+		authHost: error.authHost,
+		expectedGatewayHost: error.expectedGatewayHost,
+		reason: error.reason,
+		requestHost: error.requestHost,
+		status: "dropped"
+	};
+}
 async function buildDaemonStreamRequestHeaders(input) {
 	return input.selectedOpenMeldProfile ? await buildOpenMeldProfileRequestHeadersWithAuth({
 		openMeldProfile: input.selectedOpenMeldProfile,
-		authSession: input.authSession,
+		...input.authSession ? { authSession: input.authSession } : {},
 		requestUrl: input.requestUrl
 	}) : await buildRequestAuthHeaders({
-		authSession: input.authSession,
+		...input.authSession ? { authSession: input.authSession } : {},
 		requestUrl: input.requestUrl
 	});
 }
@@ -75539,7 +76006,7 @@ const runDaemonServiceLoop = async (input) => {
 		emitRunLine({
 			presenter: input.presenter,
 			code: "daemon.run.agent_activity_integration_refresh_failed",
-			text: `Managed Agent integration refresh failed: ${toErrorMessage$31(error)}`
+			text: `Managed Agent integration refresh failed: ${toErrorMessage$32(error)}`
 		});
 	});
 	const stopRegistrationReconcile = startDaemonServiceRegistrationReconcileLoop({
@@ -75555,7 +76022,7 @@ const runDaemonServiceLoop = async (input) => {
 	const openMeldToolsUpdateCoordinator = createOpenMeldToolsUpdateCoordinator({ reportBackgroundError: (error) => {
 		warnDaemonEvent("[openmeld.tools.update_failed]", {
 			event: "cli.openmeld_tools.update_failed",
-			errorMessage: toErrorMessage$31(error)
+			errorMessage: toErrorMessage$32(error)
 		});
 	} });
 	const stopOpenMeldToolsAutomaticUpdates = startOpenMeldToolsAutomaticUpdateLoop({
@@ -75563,7 +76030,7 @@ const runDaemonServiceLoop = async (input) => {
 		onError: (error) => {
 			warnDaemonEvent("[openmeld.tools.automatic_update_failed]", {
 				event: "cli.openmeld_tools.automatic_update_failed",
-				errorMessage: toErrorMessage$31(error)
+				errorMessage: toErrorMessage$32(error)
 			});
 		}
 	});
@@ -75572,7 +76039,7 @@ const runDaemonServiceLoop = async (input) => {
 			emitRunLine({
 				presenter: input.presenter,
 				code: "daemon.run.agent_activity_sync_failed",
-				text: `Agent Activity sync failed: ${toErrorMessage$31(error)}`
+				text: `Agent Activity sync failed: ${toErrorMessage$32(error)}`
 			});
 		},
 		onResult: (result) => {
@@ -75605,7 +76072,7 @@ const runDaemonServiceLoop = async (input) => {
 			emitRunLine({
 				presenter: input.presenter,
 				code: "daemon.run.agent_activity_integration_refresh_failed",
-				text: `Managed Agent integration refresh failed: ${toErrorMessage$31(error)}`
+				text: `Managed Agent integration refresh failed: ${toErrorMessage$32(error)}`
 			});
 		},
 		onResult: (result) => {
@@ -75825,14 +76292,14 @@ async function loadInitialDaemonRouteCatalog(input) {
 			emitRunLine({
 				presenter: input.presenter,
 				code: "daemon.run.route_catalog_initial_load_failed",
-				text: `initial route catalog load failed; starting with an empty catalog and retrying via catalog sync: ${toErrorMessage$31(error)}`,
+				text: `initial route catalog load failed; starting with an empty catalog and retrying via catalog sync: ${toErrorMessage$32(error)}`,
 				payload: { reason: "initial_load_failed_no_cache" }
 			});
 			await emitInitialRouteCatalogLoadEvent({
 				result: "failed_empty_start",
 				metadata: {
 					durationMs: Date.now() - loadStartedAt,
-					errorMessage: toErrorMessage$31(error),
+					errorMessage: toErrorMessage$32(error),
 					phaseTimings
 				}
 			});
@@ -75845,7 +76312,7 @@ async function loadInitialDaemonRouteCatalog(input) {
 		emitRunLine({
 			presenter: input.presenter,
 			code: "daemon.run.route_catalog_cache_recovered",
-			text: `using last known route catalog after initial catalog load failed: ${toErrorMessage$31(error)}`,
+			text: `using last known route catalog after initial catalog load failed: ${toErrorMessage$32(error)}`,
 			payload: {
 				profileIds: cached.profileIds,
 				reason: "initial_load_failed"
@@ -75855,7 +76322,7 @@ async function loadInitialDaemonRouteCatalog(input) {
 			result: "cache_recovered",
 			metadata: {
 				durationMs: Date.now() - loadStartedAt,
-				errorMessage: toErrorMessage$31(error),
+				errorMessage: toErrorMessage$32(error),
 				phaseTimings,
 				profileCount: cached.profileIds.length
 			}
@@ -75882,7 +76349,7 @@ async function persistDaemonRouteCatalogCache(input) {
 		emitRunLine({
 			presenter: input.presenter,
 			code: "daemon.run.route_catalog_cache_write_failed",
-			text: `route catalog cache write failed: ${toErrorMessage$31(error)}`
+			text: `route catalog cache write failed: ${toErrorMessage$32(error)}`
 		});
 	}
 }
@@ -75922,14 +76389,14 @@ async function handleLocalControlPlaneSetLocalAgentEnabled(input) {
 			emitRunLine({
 				presenter: input.presenter,
 				code: "daemon.run.local_agent_enabled_report_sync_failed",
-				text: `local agent report sync failed after enabled update: ${toErrorMessage$31(error)}`
+				text: `local agent report sync failed after enabled update: ${toErrorMessage$32(error)}`
 			});
 		}
 		if (result.changed && input.requestActiveRouteCatalogSync) await input.requestActiveRouteCatalogSync("local_agent_enabled_changed").catch((error) => {
 			emitRunLine({
 				presenter: input.presenter,
 				code: "daemon.run.local_agent_enabled_route_sync_failed",
-				text: `route catalog sync failed after enabled update: ${toErrorMessage$31(error)}`
+				text: `route catalog sync failed after enabled update: ${toErrorMessage$32(error)}`
 			});
 		});
 		emitRunLine({
@@ -75954,7 +76421,7 @@ async function handleLocalControlPlaneSetLocalAgentEnabled(input) {
 			status: result.status
 		};
 	} catch (error) {
-		const message = toErrorMessage$31(error);
+		const message = toErrorMessage$32(error);
 		emitRunLine({
 			presenter: input.presenter,
 			code: "daemon.run.local_agent_enabled_rejected",
@@ -76077,7 +76544,7 @@ function createRunLoopConnectionStateTracker(presenter) {
 	} });
 }
 function noteRunLoopReconnectScheduled(input) {
-	const errorMessage = toErrorMessage$31(input.error);
+	const errorMessage = toErrorMessage$32(input.error);
 	const failureReason = classifyConnectionFailureReason(errorMessage);
 	const authState = input.error instanceof DaemonStreamAuthenticationRequiredError ? input.error.authState : null;
 	const backoffMs = resolveServiceConnectionReconnectBackoffMs({
@@ -78629,7 +79096,7 @@ var DaemonReinstallUnexpectedStartError = class extends Error {
 	diagnosticDetail;
 	outcome;
 	constructor(input) {
-		super(toErrorMessage$42(input.cause));
+		super(toErrorMessage$43(input.cause));
 		this.name = "DaemonReinstallUnexpectedStartError";
 		this.cause = input.cause;
 		this.diagnosticDetail = input.diagnosticDetail;
@@ -78648,7 +79115,7 @@ var DaemonReinstallFailureError = class extends Error {
 	evidencePath;
 	failureStage;
 	constructor(input) {
-		super(toErrorMessage$42(input.cause));
+		super(toErrorMessage$43(input.cause));
 		this.name = "DaemonReinstallFailureError";
 		this.backupDataPath = input.backupDataPath;
 		this.cause = input.cause;
@@ -79306,18 +79773,18 @@ async function prepareManagedDaemonServiceForStop(input) {
 			intent: "stop",
 			metadata: {
 				compatibilityFallback: isCompatibilityFallback,
-				errorMessage: toErrorMessage$42(error)
+				errorMessage: toErrorMessage$43(error)
 			},
 			result: isCompatibilityFallback ? "fallback" : "failed",
 			stopCause: "user_stop",
 			type: "stop.controlled_drain"
 		});
 		if (isCompatibilityFallback) return null;
-		let errorMessage = toErrorMessage$42(error);
+		let errorMessage = toErrorMessage$43(error);
 		if (shouldRestoreAutostart) try {
 			await serviceManager.enableAutostart();
 		} catch (restoreError) {
-			errorMessage = `${errorMessage}; failed to restore service autostart: ${toErrorMessage$42(restoreError)}`;
+			errorMessage = `${errorMessage}; failed to restore service autostart: ${toErrorMessage$43(restoreError)}`;
 		}
 		if (input.mode !== "best_effort") throw new Error(`OpenMeld Service stayed running because its final offline status could not be delivered: ${errorMessage}`);
 		return buildDaemonStopWarningResult({
@@ -79367,11 +79834,11 @@ async function stopRegisteredDaemonServiceManager(input) {
 			run: async () => await input.ownerSnapshot.serviceManager?.stop()
 		});
 	} catch (error) {
-		if (input.mode !== "best_effort") throw new Error(`Failed to stop system service (${input.ownerSnapshot.runtimeStatus.serviceController}): ${toErrorMessage$42(error)}`);
+		if (input.mode !== "best_effort") throw new Error(`Failed to stop system service (${input.ownerSnapshot.runtimeStatus.serviceController}): ${toErrorMessage$43(error)}`);
 		return buildDaemonStopWarningResult({
 			reason: "stop_failed",
 			runtimeStatus: input.ownerSnapshot.runtimeStatus,
-			errorMessage: toErrorMessage$42(error)
+			errorMessage: toErrorMessage$43(error)
 		});
 	}
 	if (!await waitForDaemonSystemServiceToStop({
@@ -79402,7 +79869,7 @@ async function stopRegisteredDaemonServiceManager(input) {
 		return buildDaemonStopWarningResult({
 			reason: "stop_failed",
 			runtimeStatus: input.ownerSnapshot.runtimeStatus,
-			errorMessage: toErrorMessage$42(error)
+			errorMessage: toErrorMessage$43(error)
 		});
 	}
 	const finalOwnerSnapshot = residualCleanupResult.shouldRefresh ? await readCurrentDaemonOwnerSnapshot() : residualCleanupResult.ownerSnapshot;
@@ -79475,7 +79942,7 @@ async function stopCurrentLaneDaemonProcess(input) {
 			pid: daemonPid,
 			reason: "stop_failed",
 			runtimeStatus: input.runtimeStatus,
-			errorMessage: toErrorMessage$42(error)
+			errorMessage: toErrorMessage$43(error)
 		};
 	}
 }
@@ -79559,7 +80026,7 @@ async function stopTrackedDaemonProcess(input) {
 			type: "process_stop.action",
 			result: "failed",
 			metadata: {
-				errorMessage: toErrorMessage$42(error),
+				errorMessage: toErrorMessage$43(error),
 				pid: input.pid,
 				reason: input.reason,
 				signal: input.signal
@@ -79594,7 +80061,7 @@ async function stopDaemonProcess(pid, signal) {
 		process.kill(pid, signal);
 	} catch (error) {
 		if (isNodeErrorCode(error, "ESRCH")) return true;
-		throw new Error(`Failed to send ${signal} to pid ${String(pid)}: ${toErrorMessage$42(error)}`);
+		throw new Error(`Failed to send ${signal} to pid ${String(pid)}: ${toErrorMessage$43(error)}`);
 	}
 	if (signal === "SIGKILL") return true;
 	return await waitForProcessToExit(pid);
@@ -79668,7 +80135,7 @@ async function stopDaemonForStrictTeardown(input) {
 	await input.context.serviceManager.stop().catch((error) => {
 		throw createStrictTeardownError({
 			reason: input.reason,
-			message: `failed to stop system service (${input.context.serviceManager?.controller}): ${toErrorMessage$42(error)}`,
+			message: `failed to stop system service (${input.context.serviceManager?.controller}): ${toErrorMessage$43(error)}`,
 			hint: "run `openmeld service stop --force` and retry",
 			stage: "stop-wait"
 		});
@@ -79713,7 +80180,7 @@ async function uninstallSystemServiceForStrictTeardown(input) {
 	for (const manager of managers) await manager.uninstall().catch((error) => {
 		throw createStrictTeardownError({
 			reason: input.reason,
-			message: `failed to uninstall system service (${manager.controller}): ${toErrorMessage$42(error)}`,
+			message: `failed to uninstall system service (${manager.controller}): ${toErrorMessage$43(error)}`,
 			hint: "fix OS service permissions and retry",
 			stage: "uninstall-verify"
 		});
@@ -79730,7 +80197,7 @@ async function verifySystemServiceRemovedAfterStrictTeardown(input) {
 			const finalManagerStatus = await manager.status().catch((error) => {
 				throw createStrictTeardownError({
 					reason: input.reason,
-					message: `failed to verify system service status (${manager.controller}): ${toErrorMessage$42(error)}`,
+					message: `failed to verify system service status (${manager.controller}): ${toErrorMessage$43(error)}`,
 					hint: "run `openmeld service status` and confirm service manager state",
 					stage: "uninstall-verify"
 				});
@@ -79747,7 +80214,7 @@ async function verifySystemServiceRemovedAfterStrictTeardown(input) {
 		const finalManagerStatus = await manager.status().catch((error) => {
 			throw createStrictTeardownError({
 				reason: input.reason,
-				message: `failed to verify system service status (${manager.controller}): ${toErrorMessage$42(error)}`,
+				message: `failed to verify system service status (${manager.controller}): ${toErrorMessage$43(error)}`,
 				hint: "run `openmeld service status` and confirm service manager state",
 				stage: "uninstall-verify"
 			});
@@ -80187,7 +80654,7 @@ async function runDaemonReinstall(input, options = {}) {
 					action: displayAction,
 					backupDataPath: error.backupDataPath,
 					errorCode: error.errorCode,
-					errorMessage: toErrorMessage$42(error.cause),
+					errorMessage: toErrorMessage$43(error.cause),
 					failureStage: error.failureStage,
 					evidencePath: error.evidencePath ?? await captureDaemonServiceEvidenceBestEffort({
 						runtime,
@@ -81026,7 +81493,7 @@ async function runDirectDaemonServiceLoop(input) {
 		};
 	} catch (error) {
 		return await handleDaemonRunStartFailure({
-			fallbackRawLine: toErrorMessage$42(error),
+			fallbackRawLine: toErrorMessage$43(error),
 			gatewayUrl: input.gatewayUrl,
 			presenter: input.presenter,
 			runtime: input.runtime,
@@ -81227,7 +81694,7 @@ async function bestEffortStopCurrentLaneDaemonService(input) {
 		if (!isOpenMeldLockError(error)) throw error;
 		let errorMessage = error.message;
 		const runtimeStatus = await readCurrentObservedDaemonRuntimeStatus().catch((statusError) => {
-			errorMessage = `${errorMessage}; service status could not be read: ${toErrorMessage$42(statusError)}`;
+			errorMessage = `${errorMessage}; service status could not be read: ${toErrorMessage$43(statusError)}`;
 			return {
 				status: "unknown",
 				mode: null,
@@ -81663,7 +82130,7 @@ async function runSystemDaemonCore(context) {
 	} catch (error) {
 		if (!isSystemServiceBootstrap) throw error;
 		return await handleDaemonRunStartFailure({
-			fallbackRawLine: toErrorMessage$42(error),
+			fallbackRawLine: toErrorMessage$43(error),
 			gatewayUrl: input.gatewayUrl,
 			presenter,
 			runtime,
@@ -82264,7 +82731,7 @@ async function recoverSystemServiceStartupAfterTimeout(input) {
 			error,
 			recovery: {
 				...recovery,
-				failureMessage: toErrorMessage$42(error)
+				failureMessage: toErrorMessage$43(error)
 			}
 		};
 	}
@@ -82490,7 +82957,7 @@ function resolvePersistedDaemonServiceContractGatewayUrl(gatewayUrl) {
 	try {
 		return normalizeGatewayBaseUrl(gatewayUrl);
 	} catch (error) {
-		throw new Error(`Invalid persisted OpenMeld Service contract gateway URL "${gatewayUrl}": ${toErrorMessage$42(error)}`);
+		throw new Error(`Invalid persisted OpenMeld Service contract gateway URL "${gatewayUrl}": ${toErrorMessage$43(error)}`);
 	}
 }
 function resolveSystemServiceStartupWaitMs(controller) {
@@ -82619,13 +83086,13 @@ async function runDaemonServiceDetached(input) {
 		if (typeof child.pid === "number" && child.pid > 0) await cleanupDetachedRuntimeStateIfOwnedByPid(child.pid).catch(() => {});
 		return await handleDaemonRunStartFailure({
 			cursor: startFailureLogCursor,
-			fallbackRawLine: selectRelevantDaemonStartFailureLogLine(startupOutput.summary()) ?? toErrorMessage$42(error),
+			fallbackRawLine: selectRelevantDaemonStartFailureLogLine(startupOutput.summary()) ?? toErrorMessage$43(error),
 			gatewayUrl: input.gatewayUrl,
 			presenter: input.presenter,
 			runtime: input.runtime,
 			genericErrorPayload: {
 				codePrefix: "daemon.run.start_failed",
-				error: /* @__PURE__ */ new Error(`Failed to start OpenMeld Service process: ${toErrorMessage$42(error)}`)
+				error: /* @__PURE__ */ new Error(`Failed to start OpenMeld Service process: ${toErrorMessage$43(error)}`)
 			}
 		});
 	} finally {
@@ -109545,6 +110012,6 @@ function isHumanInteractiveSpaceRuntime(runtime) {
 	return runtime.resolvedView === "human" && canUseInteractivePrompts(runtime);
 }
 //#endregion
-export { runAgentsRepair as $, installAgentActivityIntegrations as $a, readRecentDaemonLifecycleEvents as $i, canUseInteractivePrompts as $n, syncProfileWorkspaceState as $r, readRuntimeReportingHealthState as $t, assertFullSignalIdArgument as A, updateOpenMeldProfile as Aa, buildDaemonRouteObservationPresentation as Ai, assertNoRemovedCcSpaceAddressingSyntax as An, setDefaultProjectConnection as Ao, formatDualViewGuideForDisplay as Ar, runDaemonStartupPreflight as At, persistAgentTransportSelection as B, resolveAuthenticationGuidanceFromMessage as Ba, finishCurrentCommandCheckScope as Bi, promptSearchSelect as Bn, outJsonLine as Bo, scheduleDaemonServiceUpdate as Br, resolveLocalComponentsStatus as Bt, toSpaceMetaUpsertInput as C, resolveOpenMeldProfileOrNull as Ca, parseAgentControllerRef as Ci, submitRuntimeAgentControllerReports as Cn, removeProjectOutbox as Co, registerSkillsTargetSelectionOptions as Cr, runDaemonUninstall as Ct, formatHumanReadTargetList as D, listOpenMeldProfiles as Da, resolveEvidenceSyncHealth as Di, resolveLocalAgentControllerReportDecision as Dn, migrateProjectBindingStore as Do, registerBuiltinAgentSelectionOptions as Dr, emitDaemonAgentOverview as Dt, buildHumanReplyContextSummary as E, deleteOpenMeldProfile as Ea, resolveAgentProfileEditCapabilities as Ei, resolveLocalAgentControllerLaunchability as En, listProjectConnectionsWithStatus as Eo, registerAuthLoginRequestOptions as Er, reconcileCliVersionView as Et, emitSpaceAgentOverview as F, buildAgentAuthenticationGuide as Fa, classifyDaemonServiceRunStartability as Fi, buildSpaceRoundReadProjection as Fn, renderInfoCard as Fo, areAllowedActionsEquivalent as Fr, updateSpaceMeta as Ft, runAgentsCustomList as G, LocalDaemonControlPlaneClientError as Ga, inspectDaemonServiceInventory as Gi, assertDispatchOwnedRuntimePublicWriteAllowed as Gn, cliJsonSkillsLoadEnvelopeSchema as Go, resolveDaemonServiceFreshnessWarning as Gr, collectSkillsReadinessSnapshot as Gt, runAgents as H, setProfileDefaultView as Ha, isCurrentCommandCheckScopeActive as Hi, runInteractivePrompt as Hn, cliBinaryDeltaPatchSchema as Ho, resolveDaemonDeviceId as Hr, resolveDaemonServiceParticipationStatus as Ht, emitSpaceCliAgentOverview as I, buildHumanAuthenticationCard as Ia, classifyDaemonServiceWakeability as Ii, buildUpdatesReplyWorkflowProjection as In, renderTextInfoCard as Io, buildAgentFacingPublicationModeGuideLines as Ir, readGatewayJsonResponse as It, runAgentsDetect as J, registerAgentActivityRoute as Ja, readCurrentObservedDaemonRuntimeStatus as Ji, writeDispatchSpaceActionRecord as Jn, organizationJoinLinkErrorResponseSchema as Jo, formatDeviceReplyReadinessLabel as Jr, runSkillsInstall as Jt, runAgentsCustomRemove as K, requestLocalAgentActivitySync as Ka, resolveVersionChangeDirection as Ki, readDispatchOwnedRuntimeGuard as Kn, cliJsonSkillsShowEnvelopeSchema as Ko, resolveCurrentReplyReadinessSnapshot as Kr, runSkillsCheck as Kt, prepareLocalAgentReadiness as L, createAuthenticationError as La, resolveServiceUpdateUrgency as Li, createSpaceMemberIdentityIndex as Ln, sanitizeTerminalDisplayText as Lo, canonicalizeAllowedActions as Lr, readGatewayTextResponse as Lt, prepareAuthenticatedSpaceCommandContext as M, clearSelectedOpenMeldProfileId as Ma, getSetupFlowCopy as Mi, buildDispatchResultReplyWorkflowProjection as Mn, canonicalizeLocalProjectPath as Mo, formatAgentOverviewPayload as Mr, fetchSpaceUpdates as Mt, resolveOpenMeldProfileForSpaceCommand as N, getSelectedOpenMeldProfileId as Na, buildDaemonServiceTargetSpec as Ni, buildSignalIndex as Nn, enqueueControllerTaskLifecycleEventWhileLocked as No, OPENMELD_AGENT_MENTAL_MODEL_LINES as Nr, createCliSpaceApi as Nt, parseEnvelope as O, primeOpenMeldProfilesSessionCache as Oa, resolveNativeAgentControllerPermissionModeForController as Oi, inspectSpaceCacheFile as On, removeProjectConnection as Oo, buildAgentOverviewFromContract as Or, createDelayedSpinner as Ot, resolveSpaceAccessLabel as P, setSelectedOpenMeldProfileId as Pa, resolveDaemonServiceAlignmentDecision as Pi, buildSignalMessageReadProjection as Pn, readControllerTaskLifecycleOutboxHealth as Po, SPACE_CONTRACT_ALLOWED_ACTION_ORDER as Pr, fetchSpaceMeta as Pt, runAgentsManage as Q, defaultManagedIntegrationPaths as Qa, resolveDaemonServiceManager as Qi, formatDaemonServiceMissingRecommendation as Qn, resolveOpenClawLocalDiagnosticsValue as Qr, readBundledOpenMeldCliSkillDocumentByPath as Qt, buildReplyReadinessGuidance as R, resolveAuthenticationGuidance as Ra, assessServerRequiredVersion as Ri, formatRemovedCcRelationMessage as Rn, emitCliJsonEnvelope as Ro, readOpenMeldToolsUpdateContextFromEnv as Rr, toStructuredGatewayFailure as Rt, loadSpaceSignalIndexOrNull as S, requireOpenMeldProfile as Sa, listAgentControllerPermissionModeOptions as Si, submitRuntimeAgentControllerReport as Sn, readAgentActivityOutboxHealth as So, SPACE_ADD_MEMBERS_PROGRESS_HEARTBEAT_MS as Sr, runDaemonTeardownStrict as St, buildFormalSignalReadPayload as T, createOpenMeldHumanProfile as Ta, resolveAgentExecutionStatus as Ti, resolveLocalAgentControllerBlockerReasonCodes as Tn, listProjectBindings as To, registerDaemonControlTargetOptions as Tr, buildProfileWorkspaceRows as Tt, runAgentsConfig as U, LocalProjectConnectionError as Ua, resetCurrentCommandCheckState as Ui, assessCliUpdate as Un, cliJsonOutputEnvelopeSchema as Uo, formatDaemonFailureContextText as Ur, runDaemonServiceParticipationGate as Ut, resolveAgentProfileSetup as V, getProfileDefaultView as Va, getCurrentCommandCheckState as Vi, isReturnKeypress as Vn, outLine as Vo, ensureDaemonRuntimePaths as Vr, writeInstalledLocalComponentsSnapshot as Vt, runAgentsCustomAdd as W, validateLocalProjectConnectionPath as Wa, startCurrentCommandCheckScope as Wi, isCliUpdateCheckApplicable as Wn, cliJsonSkillsListEnvelopeSchema as Wo, resolveServiceReadinessFromServiceStatus as Wr, runDaemonStartDecisionPrompt as Wt, runAgentsEnable as X, unregisterAgentActivityRoute as Xa, isDaemonServiceJobNeverSpawned as Xi, resolveElapsedTimeMs as Xn, compareAgentControllerRefsForDisplay as Xo, mapAgentReplyReadinessToLegacyAutoReply as Xr, runSkillsUpdate as Xt, runAgentsDisable as Y, resolveAgentActivityRouteForPath as Ya, getDaemonSystemServiceLogPath as Yi, formatElapsedTime as Yn, revokeOrganizationJoinLinkResponseSchema as Yo, formatHumanReplyReadinessReason as Yr, runSkillsUninstall as Yt, runAgentsList as Z, AGENT_ACTIVITY_INTEGRATION_OWNER as Za, readDaemonServiceJobCrashExitCode as Zi, formatDaemonServiceDowngradeBlockedRecommendation as Zn, resolveGatewayChainReadiness as Zr, ensureLocalSkills as Zt, runSpaceWriteWithPasswordRetry as _, formatMessage as _a, resolveLocalRegistryAgentIdFromAgentControllerRef as _i, formatServiceParticipationReadinessLabel as _n, resolveObservedAgentActivityBinding as _o, createStartAuthenticationGuideError as _r, runDaemonReinstall as _t, runSpaceDelete as a, fetchLatestCliBinaryRelease as aa, resolveConfiguredProfileWorkspacePath as ai, runAuthLogin as an, formatOpenMeldCliCommands as ao, createSpaceAddMembersGuideError as ar, renderOpenMeldBrandBlockLines as at, buildIdentityOnlyMembersSnapshotForReadProjection as b, resolveViewProfileKey as ba, getAgentControllerPermissionModeDisplayMetadata as bi, computeRetryDelayMs as bn, enqueueAgentActivityHookEvent as bo, getCommandHintsFromContract as br, runDaemonStatusFlow as bt, runSpaceLeave as c, writeVersionState as ca, validateCustomProfileWorkspacePath as ci, runAuthStatus as cn, formatProfileAwareOpenMeldCliCommands as co, createSpaceLeaveGuideError as cr, renderOpenMeldTagline as ct, runSpaceRemoveMembers as d, resolveCurrentDaemonExpectedVersion as da, createPrimaryBindingReadSession as di, formatActiveOrganizationLabel as dn, syncLocalAgentActivity as do, createSpaceRemoveMembersGuideError as dr, runDaemon as dt, buildInstallSelfJsonPayload as ea, createModelCatalogReadSession as ei, readRecentDaemonDispatchJournalEvents as en, readAgentActivityIntegrationStatus as eo, createDoctorFailedGuideError as er, runAgentsShow as et, runSpaceSend as f, OPENMELD_VERSION as fa, resolveAgentProfilePrimaryAgentControllerReport as fi, createProfileByKind as fn, readDaemonServiceContract as fo, createSpaceResultGuideError as fr, runDaemonAutostart as ft, runSpaceReadWithPasswordRetry as g, createPresenter as ga, notifyDaemonRouteCatalogChanged as gi, ensureAgentProfileRuntimeBinding as gn, buildAgentActivityEvent as go, createStartAgentIdentityGuideError as gr, runDaemonInterrupt as gt, uploadPreparedSpaceFiles as h, renderHumanTextErrorCard as ha, listBuiltinAgentsRegistryEntries as hi, promptTextEntry as hn, removeAgentActivityContextCache as ho, createSpaceUpdatesGuideError as hr, runDaemonInstall as ht, runSpaceCreate as i, ensureVersionStateReady as ia, readProfileWorkspaceConfig as ii, evaluateCommandAuthentication as in, formatOpenMeldCliCommand as io, createResetConfirmationGuideError as ir, printOpenMeldBanner as it, assertValidSpaceIdTarget as j, alignSelectedOpenMeldProfileStorage as ja, buildOnboardingPlan as ji, buildDispatchResultMessageReadProjection as jn, unbindProject as jo, buildDualViewGuideMessage as jr, readDaemonStartFailureLogTailLines as jt, isSpaceCommandOutputHandledError as k, resolveOpenMeldProfile as ka, PREPARE_SESSION_RECONNECT_GRACE_MS as ki, upsertSpaceConfig as kn, runIfAgentActivityBindingGenerationIsCurrent as ko, DualViewGuideError as kr, shouldEmitAgentOverview as kt, runSpaceList as l, resolveDaemonRuntimeContractCompatibility as la, describeProfileWorkspacePathValidationFailure as li, buildAuthStatusRows as ln, resolveSetupFollowUpCliEntryCommand as lo, createSpaceMenuGuideError as lr, resolveGatewayWebOrigin as lt, prepareRequestedSpaceSendFiles as m, renderHumanErrorCard as ma, reconcileNewRunnableBuiltinAgentsForSetup as mi, resolveCreateProfileName as mn, readAgentActivityContextForPath as mo, createSpaceTargetGuideError as mr, runDaemonCancel as mt, promptAndConfirmSpacePassword as n, buildNextVersionState as na, ensureOpenMeldManagedProfileWorkspace as ni, buildCommandAuthenticationPromptMessage as nn, uninstallAgentActivityIntegrations as no, createProfileCreateGuideError as nr, colorizeAgentLabel as nt, runSpaceHistory as o, fetchLatestPackageInfo as oa, setCustomProfileWorkspace as oi, runAuthLogout as on, formatOpenMeldCliLine as oo, createSpaceAliasTargetGuideError as or, renderOpenMeldHeader as ot, runSpaceWatch as p, buildHumanErrorCopy as pa, listAgentTargetStates as pi, resolveCreateProfileKind as pn, upsertDaemonServiceContract as po, createSpaceSubcommandTargetGuideError as pr, runDaemonBackgroundStartForDecision as pt, runAgentsCustomUpdate as q, isAgentActivityRouteRegistered as qa, readCurrentDaemonRuntimeContext as qi, readDispatchSpaceActionContextFromEnv as qn, getOrganizationJoinLinkResponseSchema as qo, formatAgentReplyReadinessLabel as qr, runSkillsEnsure as qt, runSpaceAddMembers as r, compareSemver as ra, normalizeCustomProfileWorkspacePath as ri, ensureCommandAuthenticationOrCancel as rn, formatInlineOpenMeldCliCommands as ro, createProfileMenuGuideError as rr, colorizeDisplayProfileLabel as rt, runSpaceJoin as s, readVersionState as sa, setOpenMeldManagedProfileWorkspace as si, runAuthMenu as sn, formatOpenMeldCliTextBlock as so, createSpaceContractSetGuideError as sr, renderOpenMeldLogo as st, buildCreateSpacePasswordPromptConfig as t, performManagedInstall as ta, resolveProfileWorkspaceRuntime as ti, connectWebSocket as tn, resolveAgentActivityDispatcherCommand as to, createProfileActionGuideError as tr, formatTransportModeDisplay as tt, runSpacePassword as u, toStartBackgroundHelperExecutionCompatibility as ua, syncDeviceRuntimeStateProjection as ui, buildAuthStatusSnapshot as un, resolveUserFacingCliEntryCommand as uo, createSpacePublicationSetGuideError as ur, resolveSpaceSendText as ut, buildHumanReadSignalsTranscriptItems as v, parseCliViewMode as va, buildAgentControllerRef as vi, resolveServiceParticipationReadiness as vn, normalizeSharedSessionTitle as vo, createUpgradeConfirmationGuideError as vr, runDaemonRunAfterEntryChecks as vt, buildFormalDispatchResultReadPayload as w, createOpenMeldAgentProfile as wa, resolveAgentControllerPermissionModeForController as wi, collectLocalAgentControllerInventory as wn, bindProject as wo, getCliVersionInfo as wr, buildProfileWorkspacePresentation as wt, loadSpaceIdentityDirectoryOrNull as x, isSelectedOpenMeldProfileRequiredError as xa, getAgentControllerPermissionModeFieldLabel as xi, submitProfileRuntimeAgentControllerReport as xn, removeProjectInbox as xo, registerSpaceMemberSelectionOptions as xr, runDaemonStop as xt, emitHumanReadSignalsTextProjection as y, resolveRuntimeContext as ya, createAgentExecutionStatusDisplayRows as yi, assessActionParticipationCandidate as yn, readCodexSessionTitles as yo, getCommandEntryContract as yr, runDaemonSnapshot as yt, resolveHumanControllerDisplayName as z, resolveAuthenticationGuidanceFromError as za, resolveOpenMeldEnvironmentTarget as zi, promptSearchMultiselect as zn, errLine as zo, runPendingDaemonServiceUpdate as zr, parseJsonResponse$1 as zt };
+export { runAgentsRepair as $, validateLocalProjectConnectionPath as $a, startCurrentCommandCheckScope as $i, assertDispatchOwnedRuntimePublicWriteAllowed as $n, cliJsonSkillsListEnvelopeSchema as $o, resolveDaemonServiceFreshnessWarning as $r, readBundledOpenMeldCliSkillDocumentByPath as $t, assertFullSignalIdArgument as A, isSelectedOpenMeldProfileRequiredError as Aa, listAgentControllerPermissionModeOptions as Ai, submitRuntimeAgentControllerReport as An, removeProjectInbox as Ao, SPACE_ADD_MEMBERS_PROGRESS_HEARTBEAT_MS as Ar, shouldEmitAgentOverview as At, persistAgentTransportSelection as B, alignSelectedOpenMeldProfileStorage as Ba, getSetupFlowCopy as Bi, buildDispatchResultReplyWorkflowProjection as Bn, unbindProject as Bo, formatAgentOverviewPayload as Br, parseJsonResponse$1 as Bt, toSpaceMetaUpsertInput as C, renderHumanErrorCard as Ca, listBuiltinAgentsRegistryEntries as Ci, promptTextEntry as Cn, readAgentActivityContextForPath as Co, createSpaceUpdatesGuideError as Cr, runDaemonTeardownStrict as Ct, formatHumanReadTargetList as D, parseCliViewMode as Da, createAgentExecutionStatusDisplayRows as Di, assessActionParticipationCandidate as Dn, normalizeSharedSessionTitle as Do, getCommandEntryContract as Dr, reconcileCliVersionView as Dt, buildHumanReplyContextSummary as E, formatMessage as Ea, buildAgentControllerRef as Ei, resolveServiceParticipationReadiness as En, resolveObservedAgentActivityBinding as Eo, createUpgradeConfirmationGuideError as Er, buildProfileWorkspaceRows as Et, emitSpaceAgentOverview as F, deleteOpenMeldProfile as Fa, resolveEvidenceSyncHealth as Fi, resolveLocalAgentControllerReportDecision as Fn, listProjectConnectionsWithStatus as Fo, registerBuiltinAgentSelectionOptions as Fr, fetchSpaceMeta as Ft, runAgentsCustomList as G, buildHumanAuthenticationCard as Ga, resolveServiceUpdateUrgency as Gi, createSpaceMemberIdentityIndex as Gn, renderTextInfoCard as Go, canonicalizeAllowedActions as Gr, runDaemonStartDecisionPrompt as Gt, runAgents as H, getSelectedOpenMeldProfileId as Ha, resolveDaemonServiceAlignmentDecision as Hi, buildSignalMessageReadProjection as Hn, enqueueControllerTaskLifecycleEventWhileLocked as Ho, SPACE_CONTRACT_ALLOWED_ACTION_ORDER as Hr, writeInstalledLocalComponentsSnapshot as Ht, emitSpaceCliAgentOverview as I, listOpenMeldProfiles as Ia, resolveNativeAgentControllerPermissionModeForController as Ii, inspectSpaceCacheFile as In, migrateProjectBindingStore as Io, buildAgentOverviewFromContract as Ir, updateSpaceMeta as It, runAgentsDetect as J, resolveAuthenticationGuidanceFromError as Ja, resolveAuthBaseUrl as Ji, promptSearchSelect as Jn, errLine as Jo, scheduleDaemonServiceUpdate as Jr, runSkillsEnsure as Jt, runAgentsCustomRemove as K, createAuthenticationError as Ka, assessServerRequiredVersion as Ki, formatRemovedCcRelationMessage as Kn, sanitizeTerminalDisplayText as Ko, readOpenMeldToolsUpdateContextFromEnv as Kr, collectSkillsReadinessSnapshot as Kt, prepareLocalAgentReadiness as L, primeOpenMeldProfilesSessionCache as La, PREPARE_SESSION_RECONNECT_GRACE_MS as Li, upsertSpaceConfig as Ln, removeProjectConnection as Lo, DualViewGuideError as Lr, readGatewayJsonResponse as Lt, prepareAuthenticatedSpaceCommandContext as M, resolveOpenMeldProfileOrNull as Ma, resolveAgentControllerPermissionModeForController as Mi, collectLocalAgentControllerInventory as Mn, removeProjectOutbox as Mo, getCliVersionInfo as Mr, readDaemonStartFailureLogTailLines as Mt, resolveOpenMeldProfileForSpaceCommand as N, createOpenMeldAgentProfile as Na, resolveAgentExecutionStatus as Ni, resolveLocalAgentControllerBlockerReasonCodes as Nn, bindProject as No, registerDaemonControlTargetOptions as Nr, fetchSpaceUpdates as Nt, parseEnvelope as O, resolveRuntimeContext as Oa, getAgentControllerPermissionModeDisplayMetadata as Oi, computeRetryDelayMs as On, readCodexSessionTitles as Oo, getCommandHintsFromContract as Or, emitDaemonAgentOverview as Ot, resolveSpaceAccessLabel as P, createOpenMeldHumanProfile as Pa, resolveAgentProfileEditCapabilities as Pi, resolveLocalAgentControllerLaunchability as Pn, listProjectBindings as Po, registerAuthLoginRequestOptions as Pr, createCliSpaceApi as Pt, runAgentsManage as Q, LocalProjectConnectionError as Qa, resetCurrentCommandCheckState as Qi, isCliUpdateCheckApplicable as Qn, cliJsonOutputEnvelopeSchema as Qo, resolveServiceReadinessFromServiceStatus as Qr, ensureLocalSkills as Qt, buildReplyReadinessGuidance as R, resolveOpenMeldProfile as Ra, buildDaemonRouteObservationPresentation as Ri, assertNoRemovedCcSpaceAddressingSyntax as Rn, runIfAgentActivityBindingGenerationIsCurrent as Ro, formatDualViewGuideForDisplay as Rr, readGatewayTextResponse as Rt, loadSpaceSignalIndexOrNull as S, buildHumanErrorCopy as Sa, reconcileNewRunnableBuiltinAgentsForSetup as Si, resolveCreateProfileName as Sn, upsertDaemonServiceContract as So, createSpaceTargetGuideError as Sr, runDaemonStop as St, buildFormalSignalReadPayload as T, createPresenter as Ta, resolveLocalRegistryAgentIdFromAgentControllerRef as Ti, formatServiceParticipationReadinessLabel as Tn, buildAgentActivityEvent as To, createStartAuthenticationGuideError as Tr, buildProfileWorkspacePresentation as Tt, runAgentsConfig as U, setSelectedOpenMeldProfileId as Ua, classifyDaemonServiceRunStartability as Ui, buildSpaceRoundReadProjection as Un, readControllerTaskLifecycleOutboxHealth as Uo, areAllowedActionsEquivalent as Ur, resolveDaemonServiceParticipationStatus as Ut, resolveAgentProfileSetup as V, clearSelectedOpenMeldProfileId as Va, buildDaemonServiceTargetSpec as Vi, buildSignalIndex as Vn, canonicalizeLocalProjectPath as Vo, OPENMELD_AGENT_MENTAL_MODEL_LINES as Vr, resolveLocalComponentsStatus as Vt, runAgentsCustomAdd as W, buildAgentAuthenticationGuide as Wa, classifyDaemonServiceWakeability as Wi, buildUpdatesReplyWorkflowProjection as Wn, renderInfoCard as Wo, buildAgentFacingPublicationModeGuideLines as Wr, runDaemonServiceParticipationGate as Wt, runAgentsEnable as X, getProfileDefaultView as Xa, getCurrentCommandCheckState as Xi, runInteractivePrompt as Xn, outLine as Xo, resolveDaemonDeviceId as Xr, runSkillsUninstall as Xt, runAgentsDisable as Y, resolveAuthenticationGuidanceFromMessage as Ya, finishCurrentCommandCheckScope as Yi, isReturnKeypress as Yn, outJsonLine as Yo, ensureDaemonRuntimePaths as Yr, runSkillsInstall as Yt, runAgentsList as Z, setProfileDefaultView as Za, isCurrentCommandCheckScopeActive as Zi, assessCliUpdate as Zn, cliBinaryDeltaPatchSchema as Zo, formatDaemonFailureContextText as Zr, runSkillsUpdate as Zt, runSpaceWriteWithPasswordRetry as _, writeVersionState as _a, describeProfileWorkspacePathValidationFailure as _i, resolveDeviceAuthClientId as _n, formatProfileAwareOpenMeldCliCommands as _o, createSpaceMenuGuideError as _r, runDaemonInterrupt as _t, runSpaceDelete as a, isDaemonServiceJobNeverSpawned as aa, resolveGatewayChainReadiness as ai, evaluateCommandAuthentication as an, unregisterAgentActivityRoute as ao, formatDaemonServiceDowngradeBlockedRecommendation as ar, compareAgentControllerRefsForDisplay as as, renderOpenMeldBrandBlockLines as at, buildIdentityOnlyMembersSnapshotForReadProjection as b, resolveCurrentDaemonExpectedVersion as ba, resolveAgentProfilePrimaryAgentControllerReport as bi, createProfileByKind as bn, syncLocalAgentActivity as bo, createSpaceResultGuideError as br, runDaemonSnapshot as bt, runSpaceLeave as c, readRecentDaemonLifecycleEvents as ca, createModelCatalogReadSession as ci, runAuthMenu as cn, installAgentActivityIntegrations as co, createDoctorFailedGuideError as cr, renderOpenMeldTagline as ct, runSpaceRemoveMembers as d, buildNextVersionState as da, normalizeCustomProfileWorkspacePath as di, buildAuthStatusRows as dn, uninstallAgentActivityIntegrations as do, createProfileMenuGuideError as dr, bestEffortStopCurrentLaneDaemonService as dt, inspectDaemonServiceInventory as ea, resolveCurrentReplyReadinessSnapshot as ei, readRuntimeReportingHealthState as en, LocalDaemonControlPlaneClientError as eo, readDispatchOwnedRuntimeGuard as er, cliJsonSkillsLoadEnvelopeSchema as es, runAgentsShow as et, runSpaceSend as f, compareSemver as fa, readProfileWorkspaceConfig as fi, buildAuthStatusSnapshot as fn, formatInlineOpenMeldCliCommands as fo, createResetConfirmationGuideError as fr, runDaemon as ft, runSpaceReadWithPasswordRetry as g, readVersionState as ga, validateCustomProfileWorkspacePath as gi, requestDeviceToken as gn, formatOpenMeldCliTextBlock as go, createSpaceLeaveGuideError as gr, runDaemonInstall as gt, uploadPreparedSpaceFiles as h, fetchLatestPackageInfo as ha, setOpenMeldManagedProfileWorkspace as hi, fetchAuthUserSnapshot as hn, formatOpenMeldCliLine as ho, createSpaceContractSetGuideError as hr, runDaemonCancel as ht, runSpaceCreate as i, getDaemonSystemServiceLogPath as ia, mapAgentReplyReadinessToLegacyAutoReply as ii, ensureCommandAuthenticationOrCancel as in, resolveAgentActivityRouteForPath as io, resolveElapsedTimeMs as ir, revokeOrganizationJoinLinkResponseSchema as is, printOpenMeldBanner as it, assertValidSpaceIdTarget as j, requireOpenMeldProfile as ja, parseAgentControllerRef as ji, submitRuntimeAgentControllerReports as jn, readAgentActivityOutboxHealth as jo, registerSkillsTargetSelectionOptions as jr, runDaemonStartupPreflight as jt, isSpaceCommandOutputHandledError as k, resolveViewProfileKey as ka, getAgentControllerPermissionModeFieldLabel as ki, submitProfileRuntimeAgentControllerReport as kn, enqueueAgentActivityHookEvent as ko, registerSpaceMemberSelectionOptions as kr, createDelayedSpinner as kt, runSpaceList as l, buildInstallSelfJsonPayload as la, resolveProfileWorkspaceRuntime as li, runAuthStatus as ln, readAgentActivityIntegrationStatus as lo, createProfileActionGuideError as lr, resolveGatewayWebOrigin as lt, prepareRequestedSpaceSendFiles as m, fetchLatestCliBinaryRelease as ma, setCustomProfileWorkspace as mi, extractAuthApiErrorMessage as mn, formatOpenMeldCliCommands as mo, createSpaceAliasTargetGuideError as mr, runDaemonBackgroundStartForDecision as mt, promptAndConfirmSpacePassword as n, readCurrentDaemonRuntimeContext as na, formatDeviceReplyReadinessLabel as ni, connectWebSocket as nn, isAgentActivityRouteRegistered as no, writeDispatchSpaceActionRecord as nr, getOrganizationJoinLinkResponseSchema as ns, colorizeAgentLabel as nt, runSpaceHistory as o, readDaemonServiceJobCrashExitCode as oa, resolveOpenClawLocalDiagnosticsValue as oi, runAuthLogin as on, AGENT_ACTIVITY_INTEGRATION_OWNER as oo, formatDaemonServiceMissingRecommendation as or, renderOpenMeldHeader as ot, runSpaceWatch as p, ensureVersionStateReady as pa, resolveConfiguredProfileWorkspacePath as pi, formatActiveOrganizationLabel as pn, formatOpenMeldCliCommand as po, createSpaceAddMembersGuideError as pr, runDaemonAutostart as pt, runAgentsCustomUpdate as q, resolveAuthenticationGuidance as qa, resolveOpenMeldEnvironmentTarget as qi, promptSearchMultiselect as qn, emitCliJsonEnvelope as qo, runPendingDaemonServiceUpdate as qr, runSkillsCheck as qt, runSpaceAddMembers as r, readCurrentObservedDaemonRuntimeStatus as ra, formatHumanReplyReadinessReason as ri, buildCommandAuthenticationPromptMessage as rn, registerAgentActivityRoute as ro, formatElapsedTime as rr, organizationJoinLinkErrorResponseSchema as rs, colorizeDisplayProfileLabel as rt, runSpaceJoin as s, resolveDaemonServiceManager as sa, syncProfileWorkspaceState as si, runAuthLogout as sn, defaultManagedIntegrationPaths as so, canUseInteractivePrompts as sr, renderOpenMeldLogo as st, buildCreateSpacePasswordPromptConfig as t, resolveVersionChangeDirection as ta, formatAgentReplyReadinessLabel as ti, readRecentDaemonDispatchJournalEvents as tn, requestLocalAgentActivitySync as to, readDispatchSpaceActionContextFromEnv as tr, cliJsonSkillsShowEnvelopeSchema as ts, formatTransportModeDisplay as tt, runSpacePassword as u, performManagedInstall as ua, ensureOpenMeldManagedProfileWorkspace as ui, exchangeOneTimeTokenAuthSession as un, resolveAgentActivityDispatcherCommand as uo, createProfileCreateGuideError as ur, resolveSpaceSendText as ut, buildHumanReadSignalsTranscriptItems as v, resolveDaemonRuntimeContractCompatibility as va, syncDeviceRuntimeStateProjection as vi, resolveDeviceTokenExpiresAt as vn, resolveSetupFollowUpCliEntryCommand as vo, createSpacePublicationSetGuideError as vr, runDaemonReinstall as vt, buildFormalDispatchResultReadPayload as w, renderHumanTextErrorCard as wa, notifyDaemonRouteCatalogChanged as wi, ensureAgentProfileRuntimeBinding as wn, removeAgentActivityContextCache as wo, createStartAgentIdentityGuideError as wr, runDaemonUninstall as wt, loadSpaceIdentityDirectoryOrNull as x, OPENMELD_VERSION as xa, listAgentTargetStates as xi, resolveCreateProfileKind as xn, readDaemonServiceContract as xo, createSpaceSubcommandTargetGuideError as xr, runDaemonStatusFlow as xt, emitHumanReadSignalsTextProjection as y, toStartBackgroundHelperExecutionCompatibility as ya, createPrimaryBindingReadSession as yi, revokeAuthAccessToken as yn, resolveUserFacingCliEntryCommand as yo, createSpaceRemoveMembersGuideError as yr, runDaemonRunAfterEntryChecks as yt, resolveHumanControllerDisplayName as z, updateOpenMeldProfile as za, buildOnboardingPlan as zi, buildDispatchResultMessageReadProjection as zn, setDefaultProjectConnection as zo, buildDualViewGuideMessage as zr, toStructuredGatewayFailure as zt };
 
-//# sourceMappingURL=command-Cp18onuk.js.map
+//# sourceMappingURL=command-Dk3z-M2K.js.map