openmeld 0.3.207 → 0.3.209

package/dist/{openmeld-tools-update-coordinator-D9Skj8IE.js → openmeld-tools-update-coordinator-jJrVAHgC.js}

@@ -3,15 +3,15 @@
 import { n as toDaemonRouteObservationUrl } from "./urls-CY2uzH2-.js";
 import { t as isLoopbackHostname } from "./loopback-hostname-DHQPKq8N.js";
 import { B as deviceOpenClawProfileBootstrapPath, C as isProcessIdentityAlive, H as deviceOpenClawProfileWorkspaceDir, I as accountProfileViewPath, L as accountProfileWorkspacePath, N as OPENMELD_HOME_ENV_KEY, P as accountProfileLocalMetaPath, Q as openMeldBackupsDir, S as CURRENT_PROCESS_START_IDENTITY, V as deviceOpenClawProfileDir, X as normalizeAccountKey, Z as normalizeOpenMeldProfileId, _ as resolveCliContext, a as isOpenMeldOrphanedLockError, d as runWithHeldLock, dt as resolveOpenMeldEnvPreset, ft as resolveOpenMeldRootDir, g as readCliContextState, h as listCliContextStates, ht as runtimeDir, i as isOpenMeldLockError, q as isPublishedOpenMeldHome, rt as openMeldRootDir, t as acquireLock, tt as openMeldManagedVersionBinaryPath, y as writeCliContextState, yt as systemDir } from "./lock-Dxp6o_t_.js";
-import { Cn as toStructuredApiClientFailure, Gt as createLocalRuntimeExpectedRoutesApi, Hn as toErrorMessage$24, Ln as OPENMELD_HEADER_PROFILE_ID, Mt as createAgentProfileBindingApi, Rt as createCurrentDeviceApi, ci as agentControllerPermissionModeSchema, gr as modelCatalogSchema, li as agentControllerCollaborationModeSchema, si as openCodePermissionConfigSchema, t as OpenMeldApiClientHttpError } from "./dist-D-kJdWZE.js";
+import { Bn as OPENMELD_HEADER_PROFILE_ID, En as toStructuredApiClientFailure, Gn as toErrorMessage$24, Kt as createLocalRuntimeExpectedRoutesApi, Mt as createAgentProfileBindingApi, br as modelCatalogSchema, di as openCodePermissionConfigSchema, fi as agentControllerPermissionModeSchema, pi as agentControllerCollaborationModeSchema, t as OpenMeldApiClientHttpError, zt as createCurrentDeviceApi } from "./dist-CtoP6msP.js";
 import { _ as canonicalizeAgentControllerRef, b as normalizeKnownBuiltinAgentControllerId, d as resolveBuiltinAgentControllerConversationKind, f as HOSTED_CENTER_AGENT_CONTROLLER_REF, g as buildAgentControllerRoutingKey, l as buildAgentControllerConversationRef, m as HOSTED_REMOTE_AGENT_CONTROLLER_REF, n as runtimeAgentControllerConversationIdMappingSpecSchema, o as runtimeStreamingModeSchema, p as HOSTED_CENTER_AGENT_CONTROLLER_REF_ID, r as runtimeAgentControllerLaunchContractSchema, s as runtimeTransportModeSchema, u as conversationPolicySchema, v as canonicalizeBuiltinAgentControllerRef, x as parseAgentControllerRef$1 } from "./controller-contract-pe3_Re-c.js";
-import { B as isOriginalErrorSafeForMessageDetails, Br as profileCapabilitiesResponseSchema, Fr as ADDITIONAL_HUMAN_PROFILE_CREATION_DISABLED_CODE, G as openMeldDaemonTaskResultOpenClawGatewayVisibilityStatusSchema, Gr as openMeldProfileIdSchema, Ir as ADDITIONAL_HUMAN_PROFILE_CREATION_DISABLED_MESSAGE, Jr as resolveCommandAgentWorkActivity, N as runtimeTransportRejectedProfileRegistrationSchema, Nr as localAgentCatalogSchema, O as runtimeTransportLookupRouteOwnerServiceEvidenceSchema, Rr as authProfileManagedRoleSchema, U as openMeldDaemonProviderAccessEvidenceSchema, Vr as profileErrorResponseSchema, W as openMeldDaemonTaskResultEnvelopeWriteSchema, _ as runtimeTransportErrorCodeSchema, _n as formatCanonicalMentionLiteral, _t as agentInteractionResolutionSchema, bn as normalizeMessageEnvelope, br as resolvePublicAgentAvailabilityCopy, i as localWakeRouteReportSchema, n as daemonExecutionCompatibilitySchema, o as runtimeTransportCapabilitiesSchema, t as CURRENT_DAEMON_EXECUTION_CONTRACT_EPOCH, xr as resolvePublicAgentFailureRecovery, z as OPENMELD_ORIGINAL_ERROR_MAX_LENGTH } from "./runtime-transport-QIZmAo4-.js";
+import { An as normalizeMessageEnvelope, B as isOriginalErrorSafeForMessageDetails, Br as ADDITIONAL_HUMAN_PROFILE_CREATION_DISABLED_MESSAGE, Dn as formatCanonicalMentionLiteral, G as openMeldDaemonTaskResultOpenClawGatewayVisibilityStatusSchema, Gr as profileErrorResponseSchema, Hr as authProfileManagedRoleSchema, Jn as agentInteractionResolutionSchema, Lr as localAgentCatalogSchema, N as runtimeTransportRejectedProfileRegistrationSchema, O as runtimeTransportLookupRouteOwnerServiceEvidenceSchema, Qr as resolveCommandAgentWorkActivity, U as openMeldDaemonProviderAccessEvidenceSchema, W as openMeldDaemonTaskResultEnvelopeWriteSchema, Wr as profileCapabilitiesResponseSchema, X as resolvePublicAgentAvailabilityCopy, Yr as openMeldProfileIdSchema, Z as resolvePublicAgentFailureRecovery, _ as runtimeTransportErrorCodeSchema, i as localWakeRouteReportSchema, n as daemonExecutionCompatibilitySchema, o as runtimeTransportCapabilitiesSchema, t as CURRENT_DAEMON_EXECUTION_CONTRACT_EPOCH, z as OPENMELD_ORIGINAL_ERROR_MAX_LENGTH, zr as ADDITIONAL_HUMAN_PROFILE_CREATION_DISABLED_CODE } from "./runtime-transport-BrzIQru0.js";
 import { L as openMeldToolsUpdateAttemptSchema, St as profileWorkspaceModeSchema, V as openMeldToolsUpdateRequestSourceSchema, _ as providerDispatchRuntimeContextSchema, a as openMeldDaemonControlPlaneResponseSchema, g as skippedDaemonProfileSchema, ht as normalizeOptionalWorkingDirectory, i as openMeldDaemonControlPlaneRequestSchema, mt as agentProfileIdSchema, pt as MAX_PROFILE_WORKING_DIRECTORY_LENGTH, y as conversationExecutionStateSchema } from "./control-plane-D9jDcbMZ.js";
 import { r as daemonServiceLaneSchema } from "./service-contract-CRyDcIIf.js";
-import { $ as RUNTIME_STATE_PERSIST_MIN_INTERVAL_MS$1, F as DAEMON_STREAM_CONNECT_TIMEOUT_MS$1, H as MAX_HEARTBEAT_INTERVAL_MS$2, I as DAEMON_STREAM_KEEPALIVE_INTERVAL_MS$1, J as PROVIDER_CONVERSATION_PROOF_SYNC_RETRY_INTERVAL_MS$1, K as OPENCLAW_CLI_TIMEOUT_MS$1, L as DAEMON_STREAM_KEEPALIVE_PONG_TIMEOUT_MS$1, M as CATALOG_SYNC_RETRY_INTERVAL_MS$1, N as CATALOG_SYNC_SIGNAL_POLL_INTERVAL_MS$1, P as DAEMON_RUNTIME_CONTRACT_EPOCH$1, Q as RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_RETRY_INTERVAL_MS$1, R as DEFAULT_GATEWAY_CHAIN_TIMEOUT_MS$1, V as HEARTBEAT_RESPONSE_TIMEOUT_MS$1, W as MIN_HEARTBEAT_INTERVAL_MS$2, Y as REGISTER_RESPONSE_TIMEOUT_MS$1, Z as RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_INTERVAL_MS$1, p as hasPendingComputerSetupContinuation, q as PROVIDER_CONVERSATION_PROOF_SYNC_INTERVAL_MS$1, u as getAuthSessionState, z as DEFAULT_HEARTBEAT_INTERVAL_MS$1 } from "./auth-session-CO5XtFaq.js";
+import { $ as RUNTIME_STATE_PERSIST_MIN_INTERVAL_MS$1, F as DAEMON_STREAM_CONNECT_TIMEOUT_MS$1, H as MAX_HEARTBEAT_INTERVAL_MS$2, I as DAEMON_STREAM_KEEPALIVE_INTERVAL_MS$1, J as PROVIDER_CONVERSATION_PROOF_SYNC_RETRY_INTERVAL_MS$1, K as OPENCLAW_CLI_TIMEOUT_MS$1, L as DAEMON_STREAM_KEEPALIVE_PONG_TIMEOUT_MS$1, M as CATALOG_SYNC_RETRY_INTERVAL_MS$1, N as CATALOG_SYNC_SIGNAL_POLL_INTERVAL_MS$1, P as DAEMON_RUNTIME_CONTRACT_EPOCH$1, Q as RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_RETRY_INTERVAL_MS$1, R as DEFAULT_GATEWAY_CHAIN_TIMEOUT_MS$1, V as HEARTBEAT_RESPONSE_TIMEOUT_MS$1, W as MIN_HEARTBEAT_INTERVAL_MS$2, Y as REGISTER_RESPONSE_TIMEOUT_MS$1, Z as RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_INTERVAL_MS$1, p as hasPendingComputerSetupContinuation, q as PROVIDER_CONVERSATION_PROOF_SYNC_INTERVAL_MS$1, u as getAuthSessionState, z as DEFAULT_HEARTBEAT_INTERVAL_MS$1 } from "./auth-session-CVxflepT.js";
 import { n as resolveOpenMeldDistribution, t as isBinaryDistribution } from "./distribution-DY2fBeSW.js";
 import { r as readDaemonRuntimeLease } from "./daemon-runtime-lease-Dd4hdHNo.js";
-import { $ as readManagedCliInstallation, A as prepareDaemonServiceBundle, B as resolveDaemonServiceArtifact, Bt as readDaemonServiceContract, C as daemonServiceExecutableWrapperPath, Ct as resolveDaemonServiceUpdateWorkerLaunchdPlistPath, D as ensureDaemonServiceStableBinaryExecutable, Dt as resolveDaemonServiceUpdateWorkerWindowsScriptPath, E as discardPreparedDaemonServiceBundle, Et as resolveDaemonServiceUpdateWorkerSystemdUnitPath, F as restoreDaemonActiveBundleStateSnapshot, Ft as requestLocalSyncRouteCatalog, I as runAuditedServiceManagerCarrierMutation, L as verifyDaemonActiveBundleIntegrity, Lt as clearDaemonServiceContract, N as resolveDaemonBundleEntryPathFromState, Nt as requestLocalDaemonServiceUpdateReadiness, O as ensureDaemonServiceUpdateWorkerBinaryExecutable, P as resolveInstalledDaemonBundleFingerprint, Pt as requestLocalDaemonShutdown, Q as pruneManagedInstallVersions, R as writeDaemonServiceExecutableWrapper, Rt as isDaemonServiceContractIdentityReusable, S as daemonServiceBinaryExecutablePath, St as resolveDaemonServiceUpdateWorkerIdentity, T as daemonServiceUpdateWorkerBinaryPath, Tt as resolveDaemonServiceUpdateWorkerSystemdTimerUnitPath, U as readLatestDaemonLifecycleConnectionStateEvent, V as emitDaemonLifecycleEvent, Vt as upsertDaemonServiceContract, W as readLatestDaemonLifecycleOriginEvent, _ as matchesExpectedDaemonServiceManagerDefinition, a as resolveDaemonRuntimeState, at as persistPendingDaemonServiceUpdate, bt as daemonServiceUpdateWorkerNpmEntryPath, c as resolveObservedDaemonRuntimeStatus, ct as buildNextVersionState, d as inspectLegacySharedDaemonService, et as resolveCliSelfVersion, f as listDaemonOwnedProcesses, ft as fetchLatestPackageInfo, g as assertDaemonMaintenanceInstallationOwnership, gt as resolveBundledServiceRelease, ht as writeVersionState, i as readCurrentObservedDaemonRuntimeStatus, it as completePendingDaemonServiceUpdate, j as readDaemonActiveBundleState, jt as LocalDaemonControlPlaneClientError, k as isDaemonBundleSourceAllowedForLane, l as resolveObservedRuntimeCommandEntryPath, lt as compareSemver, m as normalizeDaemonCommandPath, mt as readVersionState, n as getEffectiveDaemonRuntimeStatus, nt as OPENMELD_VERSION, o as resolveDaemonServiceManagerForRuntimeState, pt as isPlainReleaseVersion, q as runDaemonServiceManagerAction, r as readCurrentDaemonRuntimeContext, rt as DAEMON_SERVICE_UPDATE_JOB_SCHEMA, s as waitForDaemonSystemServiceToStop, st as readPendingDaemonServiceUpdate, t as clearDaemonRuntimeStateIfDefinitelyStopped, tt as withManagedInstallTransaction, u as cleanupLegacySharedDaemonServiceState, vt as INDEPENDENT_MAINTENANCE_REGISTRATION, w as daemonServiceLauncherPath, wt as resolveDaemonServiceUpdateWorkerSystemdPathUnitPath, x as clearDaemonServiceUpdateWorkerBinaryExecutable, xt as hasIndependentMaintenanceRegistration, y as activateDaemonServiceBundle, yt as configureDaemonMaintenanceEnvironment, z as writeDaemonServiceLauncher, zt as isUnsafeProductionDeviceId } from "./daemon-service-runtime-DQW9gSLT.js";
+import { $ as readManagedCliInstallation, A as prepareDaemonServiceBundle, B as resolveDaemonServiceArtifact, Bt as readDaemonServiceContract, C as daemonServiceExecutableWrapperPath, Ct as resolveDaemonServiceUpdateWorkerLaunchdPlistPath, D as ensureDaemonServiceStableBinaryExecutable, Dt as resolveDaemonServiceUpdateWorkerWindowsScriptPath, E as discardPreparedDaemonServiceBundle, Et as resolveDaemonServiceUpdateWorkerSystemdUnitPath, F as restoreDaemonActiveBundleStateSnapshot, Ft as requestLocalSyncRouteCatalog, I as runAuditedServiceManagerCarrierMutation, L as verifyDaemonActiveBundleIntegrity, Lt as clearDaemonServiceContract, N as resolveDaemonBundleEntryPathFromState, Nt as requestLocalDaemonServiceUpdateReadiness, O as ensureDaemonServiceUpdateWorkerBinaryExecutable, P as resolveInstalledDaemonBundleFingerprint, Pt as requestLocalDaemonShutdown, Q as pruneManagedInstallVersions, R as writeDaemonServiceExecutableWrapper, Rt as isDaemonServiceContractIdentityReusable, S as daemonServiceBinaryExecutablePath, St as resolveDaemonServiceUpdateWorkerIdentity, T as daemonServiceUpdateWorkerBinaryPath, Tt as resolveDaemonServiceUpdateWorkerSystemdTimerUnitPath, U as readLatestDaemonLifecycleConnectionStateEvent, V as emitDaemonLifecycleEvent, Vt as upsertDaemonServiceContract, W as readLatestDaemonLifecycleOriginEvent, _ as matchesExpectedDaemonServiceManagerDefinition, a as resolveDaemonRuntimeState, at as persistPendingDaemonServiceUpdate, bt as daemonServiceUpdateWorkerNpmEntryPath, c as resolveObservedDaemonRuntimeStatus, ct as buildNextVersionState, d as inspectLegacySharedDaemonService, et as resolveCliSelfVersion, f as listDaemonOwnedProcesses, ft as fetchLatestPackageInfo, g as assertDaemonMaintenanceInstallationOwnership, gt as resolveBundledServiceRelease, ht as writeVersionState, i as readCurrentObservedDaemonRuntimeStatus, it as completePendingDaemonServiceUpdate, j as readDaemonActiveBundleState, jt as LocalDaemonControlPlaneClientError, k as isDaemonBundleSourceAllowedForLane, l as resolveObservedRuntimeCommandEntryPath, lt as compareSemver, m as normalizeDaemonCommandPath, mt as readVersionState, n as getEffectiveDaemonRuntimeStatus, nt as OPENMELD_VERSION, o as resolveDaemonServiceManagerForRuntimeState, pt as isPlainReleaseVersion, q as runDaemonServiceManagerAction, r as readCurrentDaemonRuntimeContext, rt as DAEMON_SERVICE_UPDATE_JOB_SCHEMA, s as waitForDaemonSystemServiceToStop, st as readPendingDaemonServiceUpdate, t as clearDaemonRuntimeStateIfDefinitelyStopped, tt as withManagedInstallTransaction, u as cleanupLegacySharedDaemonServiceState, vt as INDEPENDENT_MAINTENANCE_REGISTRATION, w as daemonServiceLauncherPath, wt as resolveDaemonServiceUpdateWorkerSystemdPathUnitPath, x as clearDaemonServiceUpdateWorkerBinaryExecutable, xt as hasIndependentMaintenanceRegistration, y as activateDaemonServiceBundle, yt as configureDaemonMaintenanceEnvironment, z as writeDaemonServiceLauncher, zt as isUnsafeProductionDeviceId } from "./daemon-service-runtime-CRHAVnEX.js";
 import { i as windowsTaskActionArguments, n as runWindowsUserTask, r as windowsPowerShellPath } from "./windows-user-task-DqJWtlAm.js";
 import { C as updateConfiguredDeviceRuntimeState, T as updateConfiguredSkillsConfig, _ as getConfiguredViewCustomization, a as resolveBaseUrl, c as resolveExplicitGatewayUrlOrThrow, d as createDefaultRuntimeAgentControllerSettings, g as getConfiguredSkillsConfig, h as getConfiguredOpenMeldToolsMaintenance, i as normalizeGatewayBaseUrlOrNull, o as resolveBaseUrlOrNull, p as getConfiguredDeviceRuntimeState, v as getRuntimeConfigReadHealth, x as setConfiguredOpenMeldToolsMaintenance, y as resolveRuntimeSkillsCustomTargetId } from "./base-url-C6sHRNGu.js";
 import { n as writeDaemonLocalStateFile, t as readDaemonLocalStateFile } from "./daemon-local-state-file-jOXuXrky.js";
@@ -19,7 +19,7 @@ import { A as getDaemonStatus, B as restoreDaemonInstallStateSnapshot, F as read
 import { O as assertSafePublishedProductionServiceRegistrationMutation, S as resolveDaemonServiceManager, T as waitForLaunchdJobUnloaded, a as disableDaemonServiceAutostartIfConfigured, c as getDaemonSystemServiceLogPath, o as formatDaemonServiceJobDiagnosticsEvidence, s as getDaemonServiceLaunchdLabel, v as readDaemonServiceStartupPolicyCurrent, w as startLaunchdService } from "./daemon-service-manager-GiMCiTmu.js";
 import { a as formatOpenMeldCliCommand, c as formatOpenMeldCliTextBlock, i as formatInlineOpenMeldCliCommands, n as resolveOpenMeldEnvironmentTargetFromEnv, o as formatOpenMeldCliCommands, r as resolveAuthBaseUrl, t as resolveOpenMeldEnvironmentTarget } from "./openmeld-environment-target-NtJYJe1D.js";
 import { n as toErrorMessage$25, t as sleep } from "./dist-o3UL1EGQ.js";
-import { c as buildRequestAuthHeaders, d as buildOpenMeldRequestContextFromProfile, n as fetchSpaceRequestWithTimeout, s as buildOpenMeldRequestContextHeadersWithAuth, t as createCliApiClientFoundation } from "./api-client-foundation-DSurenul.js";
+import { c as buildRequestAuthHeaders, d as buildOpenMeldRequestContextFromProfile, n as fetchSpaceRequestWithTimeout, s as buildOpenMeldRequestContextHeadersWithAuth, t as createCliApiClientFoundation } from "./api-client-foundation-BGGVYxgq.js";
 import { createRequire } from "node:module";
 import { createHash, randomUUID } from "node:crypto";
 import { homedir, loadavg, tmpdir, userInfo } from "node:os";
@@ -645,7 +645,7 @@ async function requestOpenMeldProfilesApi(input) {
 			})
 		});
 	}
-	const record = isRecord$4(payload) ? payload : {};
+	const record = isRecord$5(payload) ? payload : {};
 	if (!readBooleanField(record, "ok")) {
 		const parsedError = profileErrorResponseSchema.safeParse(payload);
 		const code = parsedError.success ? parsedError.data.code : null;
@@ -723,7 +723,7 @@ async function emitRouteCatalogSync(reason) {
 	await touchDaemonCatalogSyncSignal({ reason }).catch(() => void 0);
 }
 function parseOpenMeldProfileItem(value) {
-	const record = isRecord$4(value) ? value : {};
+	const record = isRecord$5(value) ? value : {};
 	const openMeldProfileId = readOptionalStringField(record, "openMeldProfileId");
 	if (!openMeldProfileId) throw new Error("invalid profile payload: missing openMeldProfileId");
 	const profileName = readRequiredStringField(record, "profileName");
@@ -781,13 +781,13 @@ function readOptionalManagedRoleField(input, field) {
 }
 function readRecordField(input, field) {
 	const value = input[field];
-	if (isRecord$4(value)) return value;
+	if (isRecord$5(value)) return value;
 	throw new Error(`invalid api payload: missing ${field}`);
 }
 function readArrayField(input, field) {
 	const value = input[field];
 	if (!Array.isArray(value)) throw new Error(`invalid api payload: missing ${field}`);
-	return value.filter(isRecord$4);
+	return value.filter(isRecord$5);
 }
 function readRequiredStringField(input, field) {
 	const value = normalizeOptionalString$6(input[field]);
@@ -830,7 +830,7 @@ async function parseResponseJson(response) {
 	}
 }
 function extractApiErrorMessage(payload, status) {
-	const record = isRecord$4(payload) ? payload : {};
+	const record = isRecord$5(payload) ? payload : {};
 	const message = normalizeOptionalString$6(record.message) ?? normalizeOptionalString$6(record.error_description) ?? normalizeOptionalString$6(record.error);
 	if (message) return message;
 	return `request failed with status ${status}`;
@@ -868,7 +868,7 @@ function isHostedProfilesEndpoint(endpoint) {
 	const url = parseUrlOrNull(endpoint);
 	return Boolean(url && !isLoopbackHostname(url.hostname) && url.pathname.startsWith("/v1/profiles"));
 }
-function isRecord$4(value) {
+function isRecord$5(value) {
 	return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
 //#endregion
@@ -1875,7 +1875,7 @@ function resolveOpenMeldAccountContext(input) {
 	};
 }
 async function resolveCurrentOpenMeldAccountContext() {
-	const { getAuthSessionMetadata } = await import("./auth-session-B7QMhHwh.js");
+	const { getAuthSessionMetadata } = await import("./auth-session-LTSqq_Tb.js");
 	return resolveOpenMeldAccountContext({ session: await getAuthSessionMetadata().catch(() => null) });
 }
 function resolveHostKey(baseUrl) {
@@ -2338,7 +2338,7 @@ var DaemonServiceRunError = class extends Error {
 //#region src/local-service/state/runtime-contract-guard.ts
 const RUNTIME_CONTRACT_META_SCHEMA = "daemon.runtime.contract.meta";
 const RUNTIME_CONTRACT_REPAIR_REPORT_SCHEMA = "daemon.runtime.contract.repair.report";
-const isRecord$3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const isRecord$4 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const createRuntimeContractMeta = (input) => ({
 	schema: RUNTIME_CONTRACT_META_SCHEMA,
 	v: 1,
@@ -2358,7 +2358,7 @@ const createRuntimeContractRepairReport = (input) => ({
 	errorMessage: input.errorMessage
 });
 const parseRuntimeContractMeta = (value) => {
-	if (!isRecord$3(value)) return null;
+	if (!isRecord$4(value)) return null;
 	if (typeof value.v === "number" && value.v > 1) throw new Error("This OpenMeld version cannot read the newer local runtime state. Update OpenMeld to continue. Your local data has been preserved.");
 	if (value.schema !== RUNTIME_CONTRACT_META_SCHEMA || value.v !== 1) return null;
 	const contractEpoch = normalizeOptionalText$52(value.contractEpoch);
@@ -2372,7 +2372,7 @@ const parseRuntimeContractMeta = (value) => {
 	};
 };
 const parseRuntimeContractRepairReport = (value) => {
-	if (!isRecord$3(value)) return null;
+	if (!isRecord$4(value)) return null;
 	if (value.schema !== RUNTIME_CONTRACT_REPAIR_REPORT_SCHEMA || value.v !== 1) return null;
 	const status = value.status;
 	const reason = value.reason;
@@ -3165,9 +3165,9 @@ function createAgentControllerProcessTableSnapshotReader(input) {
 	if (!(Number.isFinite(input.maxAgeMs) && input.maxAgeMs > 0)) throw new Error("process table snapshot max age must be positive");
 	const now = input.now ?? Date.now;
 	let snapshot = null;
-	return async () => {
+	return async (options) => {
 		const readAtMs = now();
-		if (snapshot) {
+		if (snapshot && !options?.fresh) {
 			const ageMs = readAtMs - snapshot.capturedAtMs;
 			if (snapshot.pending || ageMs >= 0 && ageMs < input.maxAgeMs) return await snapshot.processTable;
 		}
@@ -3253,7 +3253,7 @@ function isProcessDiscoveryTimeoutError(error) {
 const processDiscoveryDiagnostics = createAgentControllerProcessDiscoveryDiagnosticAggregator();
 function spawnAgentControllerProcess(input) {
 	const signalTarget = resolveAgentControllerProcessSignalTarget();
-	const supervisionId = randomUUID();
+	const supervisionId = input.supervisionId ?? randomUUID();
 	const child = spawn(input.bin, input.args, {
 		cwd: input.cwd,
 		detached: signalTarget === "process_group",
@@ -3433,7 +3433,7 @@ const listAgentControllerSupervisedProcessIds = async (input) => {
 			processTable
 		});
 	}
-	const processTable = await readMacOsSupervisedProcessTable();
+	const processTable = await readMacOsSupervisedProcessTable({ fresh: input.fresh });
 	processDiscoveryDiagnostics.recovered("supervision_marker");
 	return resolveAgentControllerSupervisedProcessIds({
 		...input,
@@ -3462,6 +3462,7 @@ function resolveAgentControllerProcessIdsFromTable(input) {
 		processGroupByProcessId.set(processId, processGroupId);
 		if (input.supervisionMarker !== void 0 && commandParts.includes(input.supervisionMarker)) markedProcessIds.add(processId);
 	}
+	if (input.processId === null) return [...markedProcessIds];
 	return resolveOutOfGroupAgentControllerProcessIds({
 		childrenByParentProcessId,
 		markedProcessIds,
@@ -5301,6 +5302,7 @@ const SPACE_ACTION_TOOL_COMMAND_PATH_ENV = "OPENMELD_SPACE_ACTION_TOOL_COMMAND_P
 const OPENMELD_SPACE_ACTION_MCP_SERVER_ID = "openmeld_internal_dispatch_space_action";
 const OPENMELD_SPACE_ACTION_MCP_TOOL_NAMES = [
 	"read_file",
+	"read_history",
 	"reply",
 	"status",
 	"stay_silent"
@@ -7296,6 +7298,7 @@ async function invokeClaudeAgentSdkTransport(input) {
 	try {
 		queryRuntime = (input.createQuery ?? createDefaultClaudeAgentSdkQuery)({
 			options: buildClaudeAgentSdkOptions({
+				executionContext: input.executionContext,
 				onRuntimeEvent: input.onRuntimeEvent,
 				abortController,
 				agentControllerPermissionMode: input.agentControllerPermissionMode,
@@ -7558,6 +7561,7 @@ async function resolveClaudeAgentSdkExecutable(input) {
 }
 function buildClaudeAgentSdkOptions(input) {
 	const spaceActionMcpServer = resolveDispatchSpaceActionMcpServer(input.env);
+	if (input.executionContext && input.executionContext.access !== "space_context") throw new Error("execution_context.file_access_unsupported");
 	const permissionMode = resolveClaudePermissionMode({
 		agentControllerPermissionMode: input.agentControllerPermissionMode,
 		executionMode: input.executionMode
@@ -7604,6 +7608,14 @@ function buildClaudeAgentSdkOptions(input) {
 			onElicitation: createClaudeOnElicitation({ onInteractionRequest: input.onInteractionRequest })
 		} : {}
 	};
+	if (input.executionContext) {
+		options.tools = [];
+		options.strictMcpConfig = true;
+		options.settingSources = ["user"];
+		options.settings = { disableAllHooks: true };
+		options.additionalDirectories = [];
+		options.allowedTools = spaceActionMcpServer ? buildDispatchSpaceActionMcpToolIds("__").map((toolId) => `mcp__${toolId}`) : [];
+	}
 	const sessionId = normalizeOptionalText$40(input.sessionId);
 	if (sessionId) {
 		options.resume = sessionId;
@@ -7823,7 +7835,7 @@ var ClaudeRuntimeError = class extends Error {
 async function invokeClaudeWithSingleContextHeal(input) {
 	const result = await invokeWithSingleContextHeal({
 		contextId: input.sessionId,
-		contextLossPolicy: input.executionMode === "repair" ? "fail" : "rebuild",
+		contextLossPolicy: input.executionContext || input.executionMode === "repair" ? "fail" : "rebuild",
 		createRebuildFailedError: (error) => {
 			const providerAccessEvidence = getClaudeProviderAccessEvidence(error);
 			const originalError = getClaudeOriginalError(error);
@@ -7838,6 +7850,7 @@ async function invokeClaudeWithSingleContextHeal(input) {
 			});
 		},
 		invokeOnce: (sessionId) => invokeClaudeOnce({
+			executionContext: input.executionContext,
 			agentControllerPermissionMode: input.agentControllerPermissionMode,
 			launchContract: input.launchContract,
 			claudeTimeoutMs: input.claudeTimeoutMs,
@@ -7874,7 +7887,10 @@ async function invokeClaudeWithSingleContextHeal(input) {
 }
 async function invokeClaudeOnce(input) {
 	try {
-		if ((input.claudeTransport ?? "agent-sdk") === "cli") return await invokeClaudeOnceWithCli(input);
+		if ((input.claudeTransport ?? "agent-sdk") === "cli") {
+			if (input.executionContext) throw new Error("execution_context.transport_unsupported");
+			return await invokeClaudeOnceWithCli(input);
+		}
 		return await invokeClaudeOnceWithAgentSdk(input);
 	} catch (error) {
 		if (error instanceof ClaudeRuntimeError) throw error;
@@ -7917,6 +7933,7 @@ function invokeClaudeOnceWithCli(input) {
 }
 function invokeClaudeOnceWithAgentSdk(input) {
 	return invokeClaudeAgentSdkTransport({
+		executionContext: input.executionContext,
 		agentControllerPermissionMode: input.agentControllerPermissionMode,
 		launchContract: input.launchContract,
 		claudeTimeoutMs: input.claudeTimeoutMs,
@@ -8066,6 +8083,7 @@ const resolveDefaultClaudeCodeInvoke = (input) => {
 			});
 		} : void 0;
 		const result = await invokeClaudeWithSingleContextHeal({
+			executionContext: dispatchInput.executionContext,
 			agentControllerPermissionMode: dispatchInput.agentControllerPermissionMode,
 			launchContract,
 			claudeTimeoutMs,
@@ -8302,6 +8320,8 @@ function toRecord$9(value) {
 const FAST_METADATA_ADMISSION_TIMEOUT_MS = 15e3;
 const COLD_CONTROLLER_ADMISSION_TIMEOUT_MS = 9e4;
 const CONTROL_REQUEST_TIMEOUT_MS_BY_OPERATION = {
+	"command/exec": FAST_METADATA_ADMISSION_TIMEOUT_MS,
+	"mcpServerStatus/list": FAST_METADATA_ADMISSION_TIMEOUT_MS,
 	"collaborationMode/list": FAST_METADATA_ADMISSION_TIMEOUT_MS,
 	"thread/fork": COLD_CONTROLLER_ADMISSION_TIMEOUT_MS,
 	"thread/name/set": FAST_METADATA_ADMISSION_TIMEOUT_MS,
@@ -8441,7 +8461,8 @@ function resolveManagedByEnvName(input) {
 }
 //#endregion
 //#region ../../runtime/adapters/codex/dist/transport/codex-file-access-boundary.js
-const PROFILE_NAME = "openmeld_computer_boundary";
+const CODEX_FILE_ACCESS_PERMISSION_PROFILE = "openmeld_computer_boundary";
+const PROFILE_NAME = CODEX_FILE_ACCESS_PERMISSION_PROFILE;
 const TRAILING_PATH_SEPARATORS_PATTERN = /[\\/]+$/u;
 function redactCodexFileAccessBoundaryDispatchFailure(failure) {
 	const errorCode = failure.errorCode ?? "upstream_unreachable";
@@ -8459,7 +8480,25 @@ function buildCodexFileAccessBoundaryGlobalArgs(input) {
 	const permissionMode = resolveCodexPermissionMode(input.permissionMode);
 	if (permissionMode === "codex:customConfig") throw new Error("computer.file_access.unverified: Codex custom configuration cannot be safely intersected with the Computer file access boundary");
 	return [
-		"--strict-config",
+		...input.boundary.executionContextAccess === "space_context" ? ["-c", "project_root_markers=[]"] : [],
+		...input.boundary.executionContextAccess ? [
+			"-c",
+			"features.hooks=false",
+			"-c",
+			"features.plugins=false",
+			"-c",
+			"features.apps=false",
+			"-c",
+			"features.computer_use=false",
+			"-c",
+			"features.browser_use=false",
+			"-c",
+			"features.browser_use_external=false",
+			"-c",
+			"features.in_app_browser=false",
+			"-c",
+			"features.skill_mcp_dependency_install=false"
+		] : ["--strict-config"],
 		"-c",
 		buildPermissionProfile({
 			boundary: input.boundary,
@@ -8468,12 +8507,29 @@ function buildCodexFileAccessBoundaryGlobalArgs(input) {
 		}),
 		"-c",
 		`default_permissions=${tomlString(PROFILE_NAME)}`,
-		...buildApprovalArgs({
+		...input.boundary.executionContextAccess ? ["-a", "never"] : buildApprovalArgs({
 			executionMode: input.executionMode,
 			permissionMode
 		})
 	];
 }
+function isCodexExecutionContextFileAccessConfirmed(value, boundary, workingDirectory, executionMode) {
+	if (!boundary.executionContextAccess) return true;
+	const response = recordValue(value);
+	const profile = recordValue(response?.activePermissionProfile);
+	const sandbox = recordValue(response?.sandbox);
+	const roots = response?.runtimeWorkspaceRoots;
+	if (!Array.isArray(roots) || roots.length !== 1 || roots[0] !== workingDirectory) return false;
+	if (profile?.id !== PROFILE_NAME || profile.extends != null || response?.cwd !== workingDirectory || response.approvalPolicy !== "never") return false;
+	if (resolveCodexExecutionContextAccess(boundary, executionMode) !== "workspace") return sandbox?.type === "readOnly";
+	return sandbox?.type === "workspaceWrite" && sandbox.excludeTmpdirEnvVar === true && sandbox.excludeSlashTmp === true && Array.isArray(sandbox.writableRoots) && sandbox.writableRoots.every((root) => typeof root === "string" && boundary.folders.includes(root));
+}
+function resolveCodexExecutionContextAccess(boundary, executionMode) {
+	return executionMode === "repair" && boundary.executionContextAccess === "workspace" ? "read_only" : boundary.executionContextAccess;
+}
+function recordValue(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
+}
 function buildPermissionProfile(input) {
 	const fileAccess = resolveFileAccess(input);
 	const fields = [
@@ -8485,6 +8541,18 @@ function buildPermissionProfile(input) {
 }
 function resolveFileAccess(input) {
 	const isRepair = input.executionMode === "repair";
+	if (input.boundary.executionContextAccess) {
+		if (input.boundary.mode !== "only_selected_folders") throw new Error("execution_context.file_access_unverified");
+		return {
+			extendsProfile: null,
+			filesystemEntries: [
+				"\":root\" = \"deny\"",
+				"\":minimal\" = \"read\"",
+				...buildFolderEntries(input.boundary.folders, resolveCodexExecutionContextAccess(input.boundary, input.executionMode) === "workspace" ? "write" : "read")
+			],
+			fullNetwork: !isRepair && input.permissionMode === "codex:fullAccess"
+		};
+	}
 	const isFullAccess = !isRepair && input.permissionMode === "codex:fullAccess";
 	const selectedFolderAccess = isFullAccess ? "write" : "read";
 	const extendsProfile = resolveBaseProfile({
@@ -8537,6 +8605,100 @@ function tomlString(value) {
 	return JSON.stringify(value);
 }
 //#endregion
+//#region ../../runtime/adapters/codex/dist/transport/codex-scoped-mcp.js
+const execFileAsync$2 = promisify(execFile);
+const MCP_INVENTORY_TIMEOUT_MS = 15e3;
+const MCP_INVENTORY_MAX_BYTES = 1024 * 1024;
+const MCP_AUTH_STATUSES = /* @__PURE__ */ new Set([
+	"unknown",
+	"unsupported",
+	"notLoggedIn",
+	"bearerToken",
+	"oAuth"
+]);
+const DISPATCH_TOOL_NAMES = new Set(OPENMELD_SPACE_ACTION_MCP_TOOL_NAMES);
+async function buildCodexScopedMcpDisableArgs(input) {
+	const launch = buildCodexAppServerLaunch({
+		args: [
+			"mcp",
+			"list",
+			"--json"
+		],
+		env: input.env,
+		launchContract: input.launchContract
+	});
+	let stdout;
+	try {
+		({stdout} = await execFileAsync$2(launch.bin, launch.args, {
+			cwd: input.workingDirectory,
+			encoding: "utf8",
+			env: launch.env,
+			killSignal: "SIGKILL",
+			maxBuffer: MCP_INVENTORY_MAX_BYTES,
+			shell: launch.shell,
+			timeout: MCP_INVENTORY_TIMEOUT_MS,
+			windowsHide: true
+		}));
+	} catch {
+		throw isolationError("the native MCP configuration inventory failed");
+	}
+	let value;
+	try {
+		value = JSON.parse(stdout);
+	} catch {
+		throw isolationError("the native MCP configuration inventory is not JSON");
+	}
+	if (!Array.isArray(value)) throw isolationError("the native MCP configuration inventory is malformed");
+	const servers = /* @__PURE__ */ new Map();
+	for (const row of value) {
+		if (!isRecord$3(row) || typeof row.name !== "string" || row.name.length === 0 || typeof row.enabled !== "boolean" || servers.has(row.name)) throw isolationError("the native MCP configuration inventory is malformed");
+		if (row.name === "openmeld_internal_dispatch_space_action") throw new Error("execution_context.mcp_server_namespace_conflict: the native MCP configuration uses the reserved dispatch server name");
+		if (!isRecord$3(row.transport) || row.transport.type !== "stdio" && row.transport.type !== "streamable_http") throw isolationError("the native MCP configuration has an unknown transport");
+		servers.set(row.name, row.transport.type);
+	}
+	if (servers.size === 0) return [];
+	return ["-c", `mcp_servers={${[...servers].map(([name, type]) => {
+		const transport = type === "stdio" ? `command=${JSON.stringify(launch.bin)},args=["--version"]` : "url=\"http://127.0.0.1:9\"";
+		return `${JSON.stringify(name)}={${transport},enabled=false}`;
+	}).join(",")}}`];
+}
+/** Checks effective tool exposure; dispatch ownership and permissions are separate checks. */
+function assertCodexScopedMcpInventory(value, options = {}) {
+	if (!(isRecord$3(value) && Array.isArray(value.data)) || value.nextCursor !== void 0 && value.nextCursor !== null) throw isolationError("the effective MCP inventory is malformed or incomplete");
+	const names = /* @__PURE__ */ new Set();
+	let hasDispatchServer = false;
+	for (const item of value.data) {
+		const row = parseMcpServerInventory(item);
+		if (names.has(row.name)) throw isolationError("the effective MCP inventory contains duplicate servers");
+		names.add(row.name);
+		if (row.runtimeStatus === "disabled" && Object.keys(row.tools).length === 0) continue;
+		if (!(options.expectDispatchServer ?? true) || row.name !== "openmeld_internal_dispatch_space_action" || row.pluginId !== void 0 && row.pluginId !== null || row.runtimeStatus !== void 0 && row.runtimeStatus !== "connected") throw isolationError("the effective MCP inventory contains an unapproved server");
+		assertDispatchTools(row.tools);
+		hasDispatchServer = true;
+	}
+	if ((options.expectDispatchServer ?? true) && !hasDispatchServer) throw isolationError("the dispatch MCP server is missing from the effective inventory");
+}
+function assertDispatchTools(tools) {
+	const toolEntries = Object.entries(tools);
+	if (toolEntries.length !== DISPATCH_TOOL_NAMES.size) throw isolationError("the effective MCP inventory has an unexpected tool catalog");
+	for (const [name, tool] of toolEntries) if (!(DISPATCH_TOOL_NAMES.has(name) && isRecord$3(tool)) || tool.name !== name || !Object.hasOwn(tool, "inputSchema")) throw isolationError("the effective MCP inventory contains an unapproved tool");
+}
+function parseMcpServerInventory(row) {
+	if (!isRecord$3(row) || typeof row.name !== "string" || row.name.length === 0 || typeof row.authStatus !== "string" || !MCP_AUTH_STATUSES.has(row.authStatus) || !isRecord$3(row.tools) || !Array.isArray(row.resources) || row.resources.length !== 0 || !Array.isArray(row.resourceTemplates) || row.resourceTemplates.length !== 0 || row.toolsError !== void 0 && row.toolsError !== null) throw isolationError("the effective MCP inventory contains unverified data");
+	return {
+		name: row.name,
+		pluginId: row.pluginId,
+		runtimeStatus: row.runtimeStatus,
+		tools: row.tools
+	};
+}
+function isRecord$3(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isolationError(reason) {
+	return /* @__PURE__ */ new Error(`context.mcp_isolation_unverified: ${reason}`);
+}
+//#endregion
 //#region ../../runtime/adapters/codex/dist/transport/codex-space-action-mcp-config.js
 function buildCodexSpaceActionMcpGlobalArgs(env) {
 	const config = resolveDispatchSpaceActionMcpServer(env);
@@ -8568,8 +8730,62 @@ function toTomlStringArray(values) {
 	return `[${values.map(toTomlString).join(",")}]`;
 }
 //#endregion
+//#region ../../runtime/adapters/codex/dist/transport/codex-workspace-access-probe.js
+const PROBE_SCRIPT = `
+outside_read=denied
+outside_write=denied
+inside_read=denied
+inside_write=denied
+if ( IFS= read -r line < "$1" ) 2>/dev/null; then outside_read=allowed; fi
+if ( printf 'changed\\n' > "$1" ) 2>/dev/null; then outside_write=allowed; fi
+if ( IFS= read -r line < "$2" ) 2>/dev/null; then inside_read=allowed; fi
+if ( printf 'changed\\n' > "$2" ) 2>/dev/null; then inside_write=allowed; fi
+printf '%s:%s:%s:%s' "$outside_read" "$outside_write" "$inside_read" "$inside_write"
+`;
+async function verifyCodexWorkspaceAccess(input) {
+	if (!input.boundary.executionContextAccess) return;
+	const boundaryRoot = input.boundary.folders[0];
+	if (process.platform === "win32" || input.boundary.folders.length !== 1 || !boundaryRoot) throw new Error("execution_context.workspace_probe_unsupported");
+	const outsideDirectory = await mkdtemp(join(dirname(boundaryRoot), ".openmeld-access-probe-"));
+	const outsidePath = join(outsideDirectory, "sentinel");
+	const insidePath = join(input.workingDirectory, `.openmeld-access-probe-${randomUUID()}`);
+	try {
+		await writeFile(outsidePath, "unchanged\n", {
+			flag: "wx",
+			mode: 384
+		});
+		await writeFile(insidePath, "unchanged\n", {
+			flag: "wx",
+			mode: 384
+		});
+		const result = await input.execute({
+			command: [
+				"/bin/sh",
+				"-c",
+				PROBE_SCRIPT,
+				"openmeld-probe",
+				outsidePath,
+				insidePath
+			],
+			cwd: input.workingDirectory,
+			permissionProfile: CODEX_FILE_ACCESS_PERMISSION_PROFILE,
+			timeoutMs: 5e3,
+			outputBytesCap: 1024
+		});
+		const expected = resolveCodexExecutionContextAccess(input.boundary, input.executionMode) === "workspace" ? "denied:denied:allowed:allowed" : "denied:denied:allowed:denied";
+		if (!result || typeof result !== "object" || !("exitCode" in result) || result.exitCode !== 0 || !("stdout" in result) || result.stdout !== expected || await readFile(outsidePath, "utf8") !== "unchanged\n") throw new Error("execution_context.workspace_access_unverified");
+	} finally {
+		await rm(insidePath, { force: true });
+		await rm(outsideDirectory, {
+			recursive: true,
+			force: true
+		});
+	}
+}
+//#endregion
 //#region ../../runtime/adapters/codex/dist/transport/codex-app-server-transport.js
 const CODEX_APP_SERVER_VERSION_PATTERN = /\/([^\s]+)/u;
+const EXECUTION_CONTEXT_ERROR_PATTERN = /^(execution_context\.[a-z_]+|context\.mcp_isolation_unverified)(?::|$)/u;
 const APP_SERVER_PROCESS_KILL_GRACE_MS = 1e3;
 const DEFAULT_APP_SERVER_STARTUP_TIMEOUT_MS = 15e3;
 var CodexAppServerTransportError = class extends Error {
@@ -8635,7 +8851,7 @@ async function invokeCodexAppServerTransport(input) {
 	});
 	const invokedAtMs = Date.now();
 	const reasoningSummary = input.onRuntimeEvent ? { summary: "auto" } : {};
-	const permissionModeParams = resolveCodexAppServerPermissionModeParams(input.agentControllerPermissionMode, input.executionMode, input.computerFileAccessBoundary !== void 0);
+	const permissionModeParams = resolveCodexAppServerPermissionModeParams(input.agentControllerPermissionMode, input.executionMode, input.computerFileAccessBoundary !== void 0, input.computerFileAccessBoundary?.executionContextAccess !== void 0);
 	const conversationPolicyParams = resolveCodexAppServerConversationPolicyParams(input.conversationPolicy);
 	return await withCodexAppServerSession({
 		codexTimeoutMs: input.codexTimeoutMs,
@@ -8653,6 +8869,7 @@ async function invokeCodexAppServerTransport(input) {
 	}, async (session) => {
 		throwIfCodexDispatchCancelled(input.cancellationSignal);
 		const threadContext = await resolveDispatchThreadContext({
+			executionContextScoped: input.computerFileAccessBoundary?.executionContextAccess !== void 0,
 			cancellationSignal: input.cancellationSignal,
 			conversationPolicyParams,
 			codexWorkdir: input.codexWorkdir,
@@ -8662,6 +8879,8 @@ async function invokeCodexAppServerTransport(input) {
 			threadId: input.threadId,
 			instructionPrompt: input.instructionPrompt
 		});
+		assertFileAccessBeforeTurn(threadContext.permissionResponse, input.computerFileAccessBoundary, input.codexWorkdir, input.executionMode);
+		await session.verifyScopedMcp(threadContext.threadId);
 		const collaborationMode = await resolveCodexAppServerTurnCollaborationMode({
 			conversationPolicy: input.conversationPolicy,
 			conversationPolicyParams,
@@ -8812,15 +9031,29 @@ async function forkCodexAppServerThread(input) {
 		errorType: "config",
 		message: "schema.invalid: sourceThreadId is required"
 	});
+	if (input.computerFileAccessBoundary?.executionContextAccess && !normalizeOptionalText$36(input.sourceCompletedTurnId)) throw new CodexAppServerTransportError({
+		code: "execution_context.fork_checkpoint_unavailable",
+		errorType: "config",
+		message: "execution_context.fork_checkpoint_unavailable: a completed turn is required for a scoped fork"
+	});
 	return await withCodexAppServerSession({
 		codexTimeoutMs: input.codexTimeoutMs,
-		codexWorkdir: input.codexWorkdir,
+		codexWorkdir: input.targetWorkingDirectory ?? input.codexWorkdir,
 		env: input.env,
-		launchContract: input.launchContract
+		launchContract: input.launchContract,
+		computerFileAccessBoundary: input.computerFileAccessBoundary,
+		onRuntimeEvent: input.onRuntimeEvent
 	}, async (session) => {
 		const threadId = readThreadIdFromResponse(await session.requestControl("thread/fork", {
 			excludeTurns: true,
-			threadId: sourceThreadId
+			threadId: sourceThreadId,
+			...input.computerFileAccessBoundary?.executionContextAccess ? {
+				permissions: CODEX_FILE_ACCESS_PERMISSION_PROFILE,
+				approvalPolicy: "never",
+				runtimeWorkspaceRoots: [input.targetWorkingDirectory ?? input.codexWorkdir]
+			} : {},
+			...input.sourceCompletedTurnId ? { lastTurnId: input.sourceCompletedTurnId } : {},
+			...input.targetWorkingDirectory ? { cwd: input.targetWorkingDirectory } : {}
 		}, {
 			code: "context.fork_timeout",
 			operation: "thread/fork"
@@ -8843,10 +9076,20 @@ async function forkCodexAppServerThread(input) {
 		return { threadId };
 	});
 }
+function assertFileAccessBeforeTurn(response, boundary, workingDirectory, executionMode) {
+	if (boundary && !isCodexExecutionContextFileAccessConfirmed(response, boundary, workingDirectory, executionMode)) throw new CodexAppServerTransportError({
+		code: "computer.file_access.unverified",
+		errorType: "config",
+		message: "Codex did not confirm the task's isolated file access profile."
+	});
+}
+function scopedRuntimeWorkspaceParams(permissions, workingDirectory) {
+	return permissions.permissions ? { runtimeWorkspaceRoots: [workingDirectory] } : {};
+}
 async function resolveDispatchThreadContext(input) {
 	const existingThreadId = normalizeOptionalText$36(input.threadId);
 	if (existingThreadId) {
-		if (input.executionMode === "repair") return await forkEphemeralCodexRepairThread({
+		if (input.executionMode === "repair" && !input.executionContextScoped) return await forkEphemeralCodexRepairThread({
 			conversationPolicyParams: input.conversationPolicyParams,
 			codexWorkdir: input.codexWorkdir,
 			permissionModeParams: input.permissionModeParams,
@@ -8860,6 +9103,7 @@ async function resolveDispatchThreadContext(input) {
 				...input.conversationPolicyParams.model ? { model: input.conversationPolicyParams.model } : {},
 				...input.permissionModeParams,
 				cwd: input.codexWorkdir,
+				...scopedRuntimeWorkspaceParams(input.permissionModeParams, input.codexWorkdir),
 				excludeTurns: true,
 				threadId: existingThreadId
 			}, {
@@ -8889,6 +9133,7 @@ async function resolveDispatchThreadContext(input) {
 		...input.conversationPolicyParams.model ? { model: input.conversationPolicyParams.model } : {},
 		...input.permissionModeParams,
 		cwd: input.codexWorkdir,
+		...scopedRuntimeWorkspaceParams(input.permissionModeParams, input.codexWorkdir),
 		...input.instructionPrompt ? {
 			developerInstructions: input.instructionPrompt.developerInstructions,
 			threadSource: buildOpenMeldCodexThreadSource(input.instructionPrompt.instructionEpoch)
@@ -8903,6 +9148,7 @@ async function forkEphemeralCodexRepairThread(input) {
 		...input.conversationPolicyParams.model ? { model: input.conversationPolicyParams.model } : {},
 		...input.permissionModeParams,
 		cwd: input.codexWorkdir,
+		...scopedRuntimeWorkspaceParams(input.permissionModeParams, input.codexWorkdir),
 		ephemeral: true,
 		excludeTurns: true,
 		threadId: input.sourceThreadId
@@ -8964,7 +9210,14 @@ function readCodexAppServerCollaborationModePreset(value) {
 		reasoningEffort: normalizeOptionalText$36(preset?.reasoning_effort)
 	};
 }
-function resolveCodexAppServerPermissionModeParams(value, executionMode, hasComputerFileAccessBoundary = false) {
+function resolveCodexAppServerPermissionModeParams(value, executionMode, hasComputerFileAccessBoundary = false, hasExecutionContextBoundary = false) {
+	if (hasExecutionContextBoundary) return {
+		thread: {
+			approvalPolicy: "never",
+			permissions: CODEX_FILE_ACCESS_PERMISSION_PROFILE
+		},
+		turn: { approvalPolicy: "never" }
+	};
 	if (executionMode === "repair") return {
 		thread: {
 			approvalPolicy: "untrusted",
@@ -9033,6 +9286,7 @@ async function withCodexAppServerSession(input, callback) {
 	}
 }
 var CodexAppServerSession = class {
+	#processCleanup = null;
 	#codexTimeoutMs;
 	#codexWorkdir;
 	#controlRequestTimeoutMs;
@@ -9098,9 +9352,15 @@ var CodexAppServerSession = class {
 			...this.#env ?? {}
 		};
 		const spaceActionMcpArgs = buildCodexSpaceActionMcpGlobalArgs(env);
+		const scopedMcpArgs = this.#computerFileAccessBoundary?.executionContextAccess ? await buildCodexScopedMcpDisableArgs({
+			env,
+			launchContract: this.#launchContract,
+			workingDirectory: this.#codexWorkdir
+		}) : [];
 		const launch = buildCodexAppServerLaunch({
 			args: [
 				...computerFileAccessArgs,
+				...scopedMcpArgs,
 				...spaceActionMcpArgs,
 				"app-server",
 				"--listen",
@@ -9114,7 +9374,8 @@ var CodexAppServerSession = class {
 			bin: launch.bin,
 			cwd: tmpdir(),
 			env: launch.env,
-			shell: launch.shell ?? false
+			shell: launch.shell ?? false,
+			...this.#computerFileAccessBoundary?.executionContextAccess && this.#env?.OPENMELD_PROCESS_SUPERVISION_ID ? { supervisionId: this.#env.OPENMELD_PROCESS_SUPERVISION_ID } : {}
 		});
 		const { child, processId, signalTarget } = runtimeProcess;
 		this.#child = child;
@@ -9171,19 +9432,30 @@ var CodexAppServerSession = class {
 			}));
 		});
 		child.on("close", (exitCode, signal) => {
-			runtimeProcess.terminateRemainingDescendants();
 			this.#clearTimers();
 			this.#lifecycle.exitCode = exitCode;
 			this.#lifecycle.exitObservedAtMs = Date.now();
 			this.#lifecycle.exitSignal = signal;
-			this.#emitRuntimeEvent({
-				exitCode,
-				phase: "process_exit",
-				processId,
-				signal,
-				signalTarget,
-				tsMs: this.#lifecycle.exitObservedAtMs
-			});
+			const exitObservedAtMs = this.#lifecycle.exitObservedAtMs;
+			this.#processCleanup = (async () => {
+				let ownedProcessesQuiescent = false;
+				try {
+					if ((await runtimeProcess.terminateRemainingDescendants()).ok && signalTarget === "process_group" && processId !== null && isProcessGroupAbsent(processId)) ownedProcessesQuiescent = (await listAgentControllerSupervisedProcessIds({
+						fresh: true,
+						processId,
+						supervisionId: runtimeProcess.supervisionId
+					})).length === 0 && isProcessGroupAbsent(processId);
+				} catch {}
+				this.#emitRuntimeEvent({
+					exitCode,
+					phase: "process_exit",
+					processId,
+					signal,
+					signalTarget,
+					tsMs: exitObservedAtMs,
+					...ownedProcessesQuiescent ? { ownedProcessesQuiescent: true } : {}
+				});
+			})();
 			this.#onProcessControlEvent?.({
 				phase: "process_exit",
 				processId,
@@ -9234,6 +9506,15 @@ var CodexAppServerSession = class {
 				}
 			});
 			this.notify("initialized", {});
+			if (this.#computerFileAccessBoundary?.executionContextAccess) await verifyCodexWorkspaceAccess({
+				boundary: this.#computerFileAccessBoundary,
+				executionMode: this.#executionMode,
+				workingDirectory: this.#codexWorkdir,
+				execute: (params) => this.requestControl("command/exec", params, {
+					code: "execution_context.workspace_probe_timeout",
+					operation: "command/exec"
+				})
+			});
 			return initialized;
 		} finally {
 			if (this.#startupTimeout !== null) {
@@ -9242,6 +9523,17 @@ var CodexAppServerSession = class {
 			}
 		}
 	}
+	async verifyScopedMcp(threadId) {
+		if (!this.#computerFileAccessBoundary?.executionContextAccess) return;
+		assertCodexScopedMcpInventory(await this.requestControl("mcpServerStatus/list", {
+			threadId,
+			detail: "full",
+			limit: 100
+		}, {
+			code: "execution_context.mcp_inventory_timeout",
+			operation: "mcpServerStatus/list"
+		}), { expectDispatchServer: resolveDispatchSpaceActionMcpServer(this.#env) !== null });
+	}
 	async close() {
 		this.#clearTimers();
 		const child = this.#child;
@@ -9255,17 +9547,21 @@ var CodexAppServerSession = class {
 			});
 		}
 		if (!(child.stdin.destroyed || child.stdin.writableEnded)) child.stdin.end();
-		if (this.#lifecycle.exitObservedAtMs !== null) return;
+		if (this.#lifecycle.exitObservedAtMs !== null) {
+			await this.#processCleanup;
+			return;
+		}
 		this.#requestProcessTermination();
 		await new Promise((resolve) => {
 			const timeout = setTimeout(() => {
 				resolve();
-			}, APP_SERVER_PROCESS_KILL_GRACE_MS);
+			}, APP_SERVER_PROCESS_KILL_GRACE_MS * 2);
 			child.once("close", () => {
 				clearTimeout(timeout);
 				resolve();
 			});
 		});
+		await this.#processCleanup;
 	}
 	async request(method, params, timeout) {
 		if (this.#settledFailure) throw this.#settledFailure;
@@ -9627,6 +9923,7 @@ function readThreadIdFromResponse(value) {
 function readThreadContextFromResponse(value) {
 	const response = toRecord$8(value);
 	return {
+		permissionResponse: value,
 		model: normalizeOptionalText$36(response?.model),
 		threadId: readRequiredText(response?.thread?.id, "thread response thread.id"),
 		threadSource: normalizeOptionalText$36(response?.thread?.threadSource)
@@ -10185,6 +10482,12 @@ function toJsonRpcTransportError$1(error) {
 }
 function toCodexAppServerTransportError(error, timeoutMs) {
 	if (error instanceof CodexAppServerTransportError) return error;
+	const contextError = error instanceof Error ? EXECUTION_CONTEXT_ERROR_PATTERN.exec(error.message)?.[1] : void 0;
+	if (contextError) return new CodexAppServerTransportError({
+		code: contextError,
+		errorType: "config",
+		message: `${contextError}: the local execution boundary could not be verified`
+	});
 	if (error && typeof error === "object" && "code" in error && typeof error.code === "string" && "errorType" in error && typeof error.errorType === "string" && error instanceof Error) return new CodexAppServerTransportError({
 		code: error.code,
 		errorType: error.errorType,
@@ -10221,6 +10524,14 @@ function normalizeOptionalText$36(value) {
 	const normalized = normalizeText$7(value);
 	return normalized.length > 0 ? normalized : null;
 }
+function isProcessGroupAbsent(processId) {
+	try {
+		process.kill(-processId, 0);
+		return false;
+	} catch (error) {
+		return error.code === "ESRCH";
+	}
+}
 function parseCodexAppServerVersion(response) {
 	return normalizeOptionalText$36(toRecord$8(response)?.userAgent)?.match(CODEX_APP_SERVER_VERSION_PATTERN)?.[1] ?? null;
 }
@@ -10943,7 +11254,7 @@ var CodexRuntimeError = class extends Error {
 async function invokeCodexWithSingleContextHeal(input) {
 	const result = await invokeWithSingleContextHeal({
 		contextId: input.threadId,
-		contextLossPolicy: input.executionMode === "repair" ? "fail" : "rebuild",
+		contextLossPolicy: input.computerFileAccessBoundary?.executionContextAccess || input.executionMode === "repair" ? "fail" : "rebuild",
 		createRebuildFailedError: (error) => new CodexRuntimeError({
 			code: "context.rebuild_failed",
 			errorType: "adapter",
@@ -10982,7 +11293,7 @@ async function invokeCodexWithSingleContextHeal(input) {
 async function invokeCodexAppServer(input) {
 	const result = await invokeWithSingleContextHeal({
 		contextId: input.threadId,
-		contextLossPolicy: input.executionMode === "repair" ? "fail" : "rebuild",
+		contextLossPolicy: input.computerFileAccessBoundary?.executionContextAccess || input.executionMode === "repair" ? "fail" : "rebuild",
 		createRebuildFailedError: (error) => new CodexRuntimeError({
 			code: "context.rebuild_failed",
 			errorType: "adapter",
@@ -19704,6 +20015,7 @@ var registry_default$1 = {
 					},
 					"transportModes": ["local-cli"],
 					"capabilityDeclaration": {
+						"executionContextVersion": 2,
 						"streamingCapability": "preview_capable",
 						"imageInputCapability": "local_file_path",
 						"runtimeWorkingDirectoryMode": "spawn_cwd",
@@ -19773,6 +20085,7 @@ var registry_default$1 = {
 					},
 					"transportModes": ["codex-app-server"],
 					"capabilityDeclaration": {
+						"executionContextVersion": 2,
 						"streamingCapability": "preview_capable",
 						"imageInputCapability": "local_file_path",
 						"runtimeWorkingDirectoryMode": "spawn_cwd",
@@ -20686,6 +20999,10 @@ const FAILED_TASK_RESULT_DELIVERY_SEMANTIC = {
 };
 const isTaskResultStatusSuccessLike = (status) => status === "success" || status === "partial_success";
 const resolveTaskResultDeliverySemantic = (input) => isTaskResultStatusSuccessLike(input.payloadStatus) ? SUCCESS_LIKE_TASK_RESULT_DELIVERY_SEMANTIC : FAILED_TASK_RESULT_DELIVERY_SEMANTIC;
+Object.freeze({
+	concurrencyLimit: 5,
+	maxWaiting: 50
+});
 const WORKING_LANGUAGE_DEVELOPER_INSTRUCTIONS = `Working language:
 
 You decide the language for this response from full semantic context, not text classification.
@@ -20863,6 +21180,7 @@ const parseLocalAgentControllerRef = (input) => {
 const areAgentControllerRefsEquivalent = (input) => resolveCanonicalAgentControllerRef({ agentControllerRef: input.leftAgentControllerRef }) === resolveCanonicalAgentControllerRef({ agentControllerRef: input.rightAgentControllerRef });
 const listCompatibleAgentControllerRefs = (input) => [resolveCanonicalAgentControllerRef({ agentControllerRef: input.agentControllerRef })];
 const buildLookupKey = (input) => [
+	...input.executionContextId ? ["execution-context", input.executionContextId] : [],
 	input.targetProfileId,
 	input.agentControllerRef,
 	input.transportMode,
@@ -20875,7 +21193,7 @@ const buildLegacySpaceScopedLookupKey = (input) => [
 	input.transportMode,
 	input.runtimeWorkspaceFingerprint
 ].map(encodeLookupKeyPart).join(AGENT_CONTEXT_LOOKUP_KEY_SEPARATOR$1);
-const listCompatibleAgentContextLookupKeys = (input) => listCompatibleAgentControllerRefs(input).flatMap((agentControllerRef) => [buildLookupKey({
+const listCompatibleAgentContextLookupKeys = (input) => input.executionContextId ? [buildAgentContextLookupKey(input)] : listCompatibleAgentControllerRefs(input).flatMap((agentControllerRef) => [buildLookupKey({
 	agentControllerRef,
 	targetProfileId: input.targetProfileId,
 	transportMode: input.transportMode,
@@ -20888,6 +21206,7 @@ const listCompatibleAgentContextLookupKeys = (input) => listCompatibleAgentContr
 	runtimeWorkspaceFingerprint: input.runtimeWorkspaceFingerprint
 })]).filter((lookupKey, index, values) => values.indexOf(lookupKey) === index);
 const buildAgentContextLookupKey = (input) => buildLookupKey({
+	executionContextId: input.executionContextId,
 	agentControllerRef: resolveCanonicalAgentControllerRef(input),
 	targetProfileId: input.targetProfileId,
 	transportMode: input.transportMode,
@@ -20898,6 +21217,16 @@ const normalizeContextId = (value) => {
 	const normalized = value.trim();
 	return normalized.length > 0 ? normalized : null;
 };
+function assertLegacyAgentContextAssociation(input) {
+	const expectedNativeId = normalizeContextId(input.legacyNativeConversationId);
+	if (!expectedNativeId) return;
+	const selectedContext = listCompatibleAgentContextLookupKeys({
+		...input.key,
+		executionContextId: void 0
+	}).map((lookupKey) => input.state.agentContextByLookupKey[lookupKey]).find((context) => context !== void 0);
+	const localNativeId = normalizeContextId(selectedContext?.agentControllerConversationId);
+	if (localNativeId && localNativeId !== expectedNativeId) throw new Error("execution_context.legacy_native_identity_mismatch");
+}
 const isAgentContextCompatibleWithLookupKeyInput = (input) => isAgentContextCompatibleWithScopeInput({
 	agentContext: input.agentContext,
 	scope: input.key
@@ -20906,14 +21235,14 @@ const isAgentContextStoredUnderCompatibleLookupKeyInput = (input) => listCompati
 	...input.key,
 	spaceId: input.agentContext.spaceId
 }).includes(input.agentContext.agentContextLookupKey);
-const isAgentContextCompatibleWithScopeInput = (input) => input.agentContext.targetProfileId === input.scope.targetProfileId && input.agentContext.transportMode === input.scope.transportMode && areAgentControllerRefsEquivalent({
+const isAgentContextCompatibleWithScopeInput = (input) => (input.scope.executionContextId ? input.agentContext.agentContextLookupKey.startsWith(`execution-context|${encodeURIComponent(input.scope.executionContextId)}|`) : !input.agentContext.agentContextLookupKey.startsWith("execution-context|")) && input.agentContext.targetProfileId === input.scope.targetProfileId && input.agentContext.transportMode === input.scope.transportMode && areAgentControllerRefsEquivalent({
 	leftAgentControllerRef: input.agentContext.agentControllerRef,
 	rightAgentControllerRef: input.scope.agentControllerRef
 });
 const resolveAgentContextConversationProfileConflict = (input) => {
 	const agentControllerConversationId = normalizeContextId(input.agentControllerConversationId);
 	if (!agentControllerConversationId) return null;
-	return Object.values(input.state.agentContextByLookupKey).filter((agentContext) => agentContext.agentControllerConversationId === agentControllerConversationId && agentContext.targetProfileId !== input.key.targetProfileId && agentContext.transportMode === input.key.transportMode && areAgentControllerRefsEquivalent({
+	return Object.values(input.state.agentContextByLookupKey).filter((agentContext) => agentContext.agentControllerConversationId === agentControllerConversationId && (agentContext.targetProfileId !== input.key.targetProfileId || (input.key.executionContextId || agentContext.agentContextLookupKey.startsWith("execution-context|")) && agentContext.agentContextLookupKey !== buildAgentContextLookupKey(input.key)) && agentContext.transportMode === input.key.transportMode && areAgentControllerRefsEquivalent({
 		leftAgentControllerRef: agentContext.agentControllerRef,
 		rightAgentControllerRef: input.key.agentControllerRef
 	})).sort((left, right) => {
@@ -20944,7 +21273,7 @@ const resolveExistingAgentContext = (input) => {
 };
 const resolveNextAgentContextLookupKey = (input) => resolveAgentControllerRefKind({ agentControllerRef: input.existing.agentControllerRef }) === "builtin" ? buildAgentContextLookupKey(input.key) : input.existing.agentContextLookupKey;
 const resolveIncompatibleAgentContext = (input) => {
-	const candidates = Object.values(input.state.agentContextByLookupKey).filter((agentContext) => agentContext.targetProfileId === input.key.targetProfileId && agentContext.runtimeWorkspaceFingerprint === input.key.runtimeWorkspaceFingerprint);
+	const candidates = Object.values(input.state.agentContextByLookupKey).filter((agentContext) => (input.key.executionContextId ? agentContext.agentContextLookupKey.startsWith(`execution-context|${encodeURIComponent(input.key.executionContextId)}|`) : !agentContext.agentContextLookupKey.startsWith("execution-context|")) && agentContext.targetProfileId === input.key.targetProfileId && agentContext.runtimeWorkspaceFingerprint === input.key.runtimeWorkspaceFingerprint);
 	candidates.sort((left, right) => {
 		if (left.updatedAtMs !== right.updatedAtMs) return right.updatedAtMs - left.updatedAtMs;
 		if (left.createdAtMs !== right.createdAtMs) return right.createdAtMs - left.createdAtMs;
@@ -20979,28 +21308,24 @@ const createAgentContextState = (input) => ({
 	runtimeWorkspaceFingerprint: input.key.runtimeWorkspaceFingerprint,
 	updatedAtMs: input.nowMs
 });
-const resolveAgentContextForDispatch = (input) => {
-	const agentContextLookupKey = buildAgentContextLookupKey(input.key);
-	const existing = resolveExistingAgentContext({
-		key: input.key,
-		state: input.state
-	});
-	const providerContextId = normalizeContextId(input.providerContextId);
-	if (existing) {
-		const nextAgentContext = {
-			...existing,
-			agentContextLookupKey: resolveNextAgentContextLookupKey({
-				existing,
-				key: input.key
-			}),
-			agentControllerRef: resolveCanonicalAgentControllerRef({ agentControllerRef: existing.agentControllerRef }),
-			lastTaskId: input.taskId,
-			runtimeWorkspaceFingerprint: input.key.runtimeWorkspaceFingerprint,
-			spaceId: input.key.spaceId,
-			updatedAtMs: input.nowMs
-		};
-		const replacedAgentContextLookupKey = existing.agentContextLookupKey === nextAgentContext.agentContextLookupKey ? null : existing.agentContextLookupKey;
-		if (providerContextId && providerContextId !== existing.agentControllerConversationId) return {
+function reuseExistingAgentContext(input) {
+	const { existing, providerContextId } = input;
+	const nextAgentContext = {
+		...existing,
+		agentContextLookupKey: resolveNextAgentContextLookupKey({
+			existing,
+			key: input.key
+		}),
+		agentControllerRef: resolveCanonicalAgentControllerRef({ agentControllerRef: existing.agentControllerRef }),
+		lastTaskId: input.taskId,
+		runtimeWorkspaceFingerprint: input.key.runtimeWorkspaceFingerprint,
+		spaceId: input.key.spaceId,
+		updatedAtMs: input.nowMs
+	};
+	const replacedAgentContextLookupKey = existing.agentContextLookupKey === nextAgentContext.agentContextLookupKey ? null : existing.agentContextLookupKey;
+	if (providerContextId && providerContextId !== existing.agentControllerConversationId) {
+		if (input.key.executionContextId) throw new Error("execution_context.native_identity_mismatch");
+		return {
 			counterDelta: {
 				guardBlocked: 1,
 				reused: 1
@@ -21012,16 +21337,29 @@ const resolveAgentContextForDispatch = (input) => {
 			...replacedAgentContextLookupKey ? { replacedAgentContextLookupKey } : {},
 			sourceFieldOverride: LEDGER_AGENT_CONTEXT_SOURCE_FIELD
 		};
-		return {
-			counterDelta: { reused: 1 },
-			lifecycleReason: "reused_existing_context",
-			resolvedAgentControllerConversationId: existing.agentControllerConversationId,
-			agentContext: nextAgentContext,
-			agentContextLookupKey: nextAgentContext.agentContextLookupKey,
-			...replacedAgentContextLookupKey ? { replacedAgentContextLookupKey } : {},
-			...providerContextId ? {} : { sourceFieldOverride: LEDGER_AGENT_CONTEXT_SOURCE_FIELD }
-		};
 	}
+	return {
+		counterDelta: { reused: 1 },
+		lifecycleReason: "reused_existing_context",
+		resolvedAgentControllerConversationId: existing.agentControllerConversationId,
+		agentContext: nextAgentContext,
+		agentContextLookupKey: nextAgentContext.agentContextLookupKey,
+		...replacedAgentContextLookupKey ? { replacedAgentContextLookupKey } : {},
+		...providerContextId ? {} : { sourceFieldOverride: LEDGER_AGENT_CONTEXT_SOURCE_FIELD }
+	};
+}
+const resolveAgentContextForDispatch = (input) => {
+	const agentContextLookupKey = buildAgentContextLookupKey(input.key);
+	const existing = resolveExistingAgentContext({
+		key: input.key,
+		state: input.state
+	});
+	const providerContextId = normalizeContextId(input.providerContextId);
+	if (existing) return reuseExistingAgentContext({
+		...input,
+		existing,
+		providerContextId
+	});
 	if (!providerContextId) return {
 		counterDelta: {},
 		lifecycleReason: "missing_context_unresolved",
@@ -21032,13 +21370,16 @@ const resolveAgentContextForDispatch = (input) => {
 		agentControllerConversationId: providerContextId,
 		key: input.key,
 		state: input.state
-	})) return {
-		counterDelta: { guardBlocked: 1 },
-		lifecycleReason: "profile_conversation_conflict",
-		resolvedAgentControllerConversationId: null,
-		agentContextLookupKey,
-		sourceFieldOverride: LEDGER_AGENT_CONTEXT_SOURCE_FIELD
-	};
+	})) {
+		if (input.key.executionContextId) throw new Error("execution_context.native_identity_conflict");
+		return {
+			counterDelta: { guardBlocked: 1 },
+			lifecycleReason: "profile_conversation_conflict",
+			resolvedAgentControllerConversationId: null,
+			agentContextLookupKey,
+			sourceFieldOverride: LEDGER_AGENT_CONTEXT_SOURCE_FIELD
+		};
+	}
 	const incompatibleContextResolution = resolveIncompatibleAgentContext({
 		key: input.key,
 		state: input.state
@@ -21355,6 +21696,7 @@ const HEARTBEAT_POLICY_DEFAULTS = {
 		3e4
 	]
 };
+const EXECUTION_CONTEXT_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 const LEDGER_STATE_INVALID_JSON_ERROR = "ledger.state.invalid_json";
 const LEDGER_STATE_SCHEMA_ERROR = "ledger.state.schema_invalid";
 const LEDGER_STATE_BACKUP_ERROR = "ledger.state.backup_failed";
@@ -21401,6 +21743,7 @@ const toErrorCode = (error) => {
 };
 const encodeAgentContextLookupKeyPart = (value) => encodeURIComponent(value);
 const buildStoredAgentContextLookupKey = (input) => [
+	...input.executionContextId ? ["execution-context", input.executionContextId] : [],
 	input.targetProfileId,
 	input.agentControllerRef,
 	input.transportMode,
@@ -21432,7 +21775,13 @@ const parseAgentContextState = (agentContextLookupKey, value) => {
 	const { agentControllerConversationId, agentControllerRef, createdAtMs, lastTaskId, spaceId, targetProfileId, transportMode, runtimeWorkspaceFingerprint, updatedAtMs } = value;
 	const parsedAgentControllerRef = typeof agentControllerRef === "string" ? parseAgentControllerRef$1(agentControllerRef) : null;
 	if (!isRuntimeTransportMode(transportMode) || typeof agentContextLookupKey !== "string" || agentContextLookupKey.length === 0 || typeof spaceId !== "string" || spaceId.length === 0 || typeof targetProfileId !== "string" || targetProfileId.length === 0 || !parsedAgentControllerRef || typeof runtimeWorkspaceFingerprint !== "string" || runtimeWorkspaceFingerprint.length === 0 || typeof agentControllerConversationId !== "string" || agentControllerConversationId.length === 0 || !isPositiveInteger(createdAtMs) || !isPositiveInteger(updatedAtMs) || typeof lastTaskId !== "string" || lastTaskId.length === 0) return null;
+	let executionContextId;
+	if (agentContextLookupKey.startsWith("execution-context|")) {
+		executionContextId = agentContextLookupKey.split("|")[1];
+		if (!(executionContextId && EXECUTION_CONTEXT_ID_PATTERN.test(executionContextId))) return null;
+	}
 	const canonicalLookupKey = buildStoredAgentContextLookupKey({
+		executionContextId,
 		agentControllerRef: parsedAgentControllerRef.ref,
 		runtimeWorkspaceFingerprint,
 		targetProfileId,
@@ -21551,10 +21900,10 @@ const parseBootstrapExecutionByLookupKey = (value) => {
 	}
 	return nextBootstrapExecutionByLookupKey;
 };
-const parseLedgerStateV1 = (value) => {
+const decodeLedgerState = (value) => {
 	if (!isRecord$2(value)) return null;
 	const { agentContextRotations, dedupeFirstSeenByKey, inflightByTaskId, replayedTaskIds, agentContextByLookupKey, bootstrapExecutionByLookupKey, agentContextLifecycleCounters, updatedAtMs, v } = value;
-	if (v !== 1 || !isPositiveInteger(updatedAtMs)) return null;
+	if (v !== 2 && v !== 1 || !isPositiveInteger(updatedAtMs)) return null;
 	const nextDedupeFirstSeenByKey = parseDedupeFirstSeenByKey(dedupeFirstSeenByKey);
 	const nextInflightByTaskId = parseInflightByTaskId(inflightByTaskId);
 	const nextReplayedTaskIds = parseReplayedTaskIds(replayedTaskIds);
@@ -21572,7 +21921,7 @@ const parseLedgerStateV1 = (value) => {
 		agentContextLifecycleCounters: nextAgentContextLifecycleCounters,
 		agentContextRotations: nextAgentContextRotations,
 		updatedAtMs,
-		v: 1
+		v: 2
 	};
 };
 const serializeLedgerState = (state) => `${JSON.stringify(state, null, 2)}\n`;
@@ -21588,7 +21937,7 @@ const cloneLedgerState$1 = (state) => ({
 	agentContextLifecycleCounters: { ...state.agentContextLifecycleCounters },
 	agentContextRotations: state.agentContextRotations.map((record) => ({ ...record })),
 	updatedAtMs: state.updatedAtMs,
-	v: 1
+	v: 2
 });
 const buildHistoryArchivePath = (historyFilePath, index) => {
 	const suffix = ".ndjson";
@@ -21661,7 +22010,7 @@ const compactLedgerState = (input) => {
 		agentContextLifecycleCounters: { ...input.state.agentContextLifecycleCounters },
 		agentContextRotations: input.state.agentContextRotations.map((record) => ({ ...record })),
 		updatedAtMs: persistedAtMs,
-		v: 1
+		v: 2
 	};
 };
 const resolveCompactionReferenceNowMs = (input) => {
@@ -21712,10 +22061,10 @@ const createEmptyLedgerState = (nowMs = Date.now()) => ({
 	agentContextLifecycleCounters: createEmptyAgentContextLifecycleCounters(),
 	agentContextRotations: [],
 	updatedAtMs: nowMs,
-	v: 1
+	v: 2
 });
-const parseLedgerState = (value) => parseLedgerStateV1(value);
-const loadLedgerState = async (input) => {
+const parseLedgerState = (value) => decodeLedgerState(value);
+const loadLedgerStateUnlocked = async (input) => {
 	let rawState = "";
 	try {
 		rawState = await input.io.readFile(input.paths.stateFilePath, UTF8_ENCODING);
@@ -21745,8 +22094,43 @@ const loadLedgerState = async (input) => {
 			paths: input.paths
 		});
 	}
+	if (isRecord$2(parsedUnknown) && parsedUnknown.v === 1) await backupPriorVersionLedgerState({
+		...input,
+		rawState
+	});
 	return parsedState;
 };
+const loadLedgerState = async (input) => enqueueLedgerStateWrite({
+	operation: () => loadLedgerStateUnlocked(input),
+	stateFilePath: input.paths.stateFilePath
+});
+const backupPriorVersionLedgerState = async (input) => {
+	const backupPath = `${input.paths.stateFilePath}.v1.bak`;
+	let tempPath;
+	try {
+		let existingBackup;
+		try {
+			existingBackup = await input.io.readFile(backupPath, UTF8_ENCODING);
+		} catch (error) {
+			if (toErrorCode(error) !== "ENOENT") throw error;
+		}
+		if (existingBackup === void 0) {
+			tempPath = buildScopedStateTempFilePath({ stateTempFilePath: `${backupPath}.tmp` });
+			await input.io.copyFile(input.paths.stateFilePath, tempPath);
+			await input.io.syncPath(tempPath);
+			if (await input.io.readFile(tempPath, UTF8_ENCODING) !== input.rawState) throw new Error(LEDGER_STATE_BACKUP_ERROR);
+			await input.io.rename(tempPath, backupPath);
+			tempPath = void 0;
+		} else if (existingBackup !== input.rawState) throw new Error(LEDGER_STATE_BACKUP_ERROR);
+		await input.io.syncPath(backupPath);
+		await input.io.syncPath(input.paths.rootDirPath);
+		if (await input.io.readFile(backupPath, UTF8_ENCODING) !== input.rawState) throw new Error(LEDGER_STATE_BACKUP_ERROR);
+	} catch (error) {
+		throw new Error(LEDGER_STATE_BACKUP_ERROR, { cause: error });
+	} finally {
+		if (tempPath) await input.io.rm(tempPath, { force: true }).catch(() => void 0);
+	}
+};
 const handleInvalidLedgerState = async (input) => {
 	if (input.invalidStateStrategy !== "backup_and_reset") throw new Error(input.errorCode);
 	const resetAtMs = Date.now();
@@ -21770,7 +22154,9 @@ const persistLedgerStateAtomic = async (input) => {
 	const scopedTempFilePath = buildScopedStateTempFilePath({ stateTempFilePath: input.paths.stateTempFilePath });
 	try {
 		await input.io.writeFile(scopedTempFilePath, serializeLedgerState(normalizedState), UTF8_ENCODING);
+		await input.io.syncPath(scopedTempFilePath);
 		await input.io.rename(scopedTempFilePath, input.paths.stateFilePath);
+		await input.io.syncPath(input.paths.rootDirPath);
 	} catch (error) {
 		await input.io.rm(scopedTempFilePath, { force: true });
 		throw error;
@@ -21778,7 +22164,7 @@ const persistLedgerStateAtomic = async (input) => {
 };
 const withLedgerStateTransaction = async (input) => enqueueLedgerStateWrite({
 	operation: async () => {
-		const state = await loadLedgerState({
+		const state = await loadLedgerStateUnlocked({
 			invalidStateStrategy: input.invalidStateStrategy,
 			io: input.io,
 			paths: input.paths
@@ -22272,6 +22658,7 @@ const mapAdapterErrorType = (errorType) => {
 };
 const buildDispatchRequest = (input) => ({
 	agentId: input.task.agentId,
+	executionContext: input.task.executionContext,
 	...input.agentControllerPermissionMode ? { agentControllerPermissionMode: input.agentControllerPermissionMode } : {},
 	...input.conversationPolicy ? { conversationPolicy: input.conversationPolicy } : {},
 	...input.task.computerFileAccessBoundary ? { computerFileAccessBoundary: input.task.computerFileAccessBoundary } : {},
@@ -22444,6 +22831,7 @@ const resolvePostDispatchAgentContextInput = (input) => {
 const resolvePostDispatchAgentContextResolution = (input) => resolveAgentContextForDispatch({
 	key: {
 		agentControllerRef: input.postDispatchAgentContext.route.agentControllerRef,
+		executionContextId: input.postDispatchAgentContext.task.executionContext?.id,
 		runtimeWorkspaceFingerprint: input.postDispatchAgentContext.route.runtimeWorkspaceFingerprint ?? buildRuntimeWorkspaceFingerprint(input.postDispatchAgentContext.task.runtimeContext.providerRuntimeWorkingDirectory),
 		spaceId: input.postDispatchAgentContext.task.spaceId,
 		targetProfileId: input.postDispatchAgentContext.task.agentId,
@@ -22489,7 +22877,7 @@ const resolveRuntimeLifecycleMetadata = (committedAgentContextResolution) => {
 	};
 };
 const prepareRuntimeTaskExecution = async (input) => withLedgerStateTransaction({
-	invalidStateStrategy: "backup_and_reset",
+	invalidStateStrategy: input.task.executionContext ? "throw" : "backup_and_reset",
 	io: input.io,
 	mutate: (state) => {
 		const repairExecution = isRepairExecutionMode(input.task.executionMode);
@@ -22525,6 +22913,7 @@ const prepareRuntimeTaskExecution = async (input) => withLedgerStateTransaction(
 		const agentContextResolution = input.route ? resolveAgentContextForDispatch({
 			key: {
 				agentControllerRef: input.route.agentControllerRef,
+				executionContextId: input.task.executionContext?.id,
 				runtimeWorkspaceFingerprint: input.route.runtimeWorkspaceFingerprint ?? buildRuntimeWorkspaceFingerprint(input.task.runtimeContext.providerRuntimeWorkingDirectory),
 				spaceId: input.task.spaceId,
 				targetProfileId: input.task.agentId,
@@ -22635,7 +23024,7 @@ const emitRuntimeTaskOutcomeHealthFindings = (input) => {
 	});
 };
 const settleRuntimeTaskState = async (input) => withLedgerStateTransaction({
-	invalidStateStrategy: "backup_and_reset",
+	invalidStateStrategy: input.committedAgentContextResolution?.agentContextLookupKey.startsWith("execution-context|") || input.postDispatchAgentContext?.task.executionContext ? "throw" : "backup_and_reset",
 	io: input.io,
 	mutate: (state) => {
 		let committedAgentContextResolution = input.committedAgentContextResolution;
@@ -22924,6 +23313,7 @@ function resolveDispatchQueueLogMeta(input) {
 		adapterId: input.runtimeAdapterId,
 		controllerKey,
 		localExecutionLaneKey: buildDispatchLocalExecutionLaneKey({
+			executionContextId: input.parsedTask.executionContext?.id,
 			agentControllerConversationId: input.parsedTask.agentControllerConversationId,
 			controllerKey,
 			profileId: input.profileId
@@ -22939,6 +23329,7 @@ function buildDispatchControllerKey(input) {
 	return `profile:${input.profileId}`;
 }
 function buildDispatchLocalExecutionLaneKey(input) {
+	if (input.executionContextId) return `execution-context:${input.profileId}:${input.executionContextId}`;
 	const agentControllerConversationId = normalizeOptionalText$10(input.agentControllerConversationId);
 	if (agentControllerConversationId) return `agent-controller-conversation:${input.controllerKey}:${agentControllerConversationId}`;
 	return `agent-profile:${input.profileId}`;
@@ -23074,10 +23465,19 @@ function createInflightTaskControlRegistry() {
 //#endregion
 //#region ../../runtime/local-service/src/local-execution-slots.ts
 const LOCAL_EXECUTION_LANE_CONCURRENCY_LIMIT = 1;
+function resourcesConflict(left, right) {
+	if (left === void 0 && right === void 0) return false;
+	if (left === void 0 || right === void 0) return true;
+	if (left === "exclusive" || right === "exclusive") return true;
+	if (left === "none" || right === "none") return false;
+	return left === "read_only" && right === "isolated" || right === "read_only" && left === "isolated";
+}
 function createLocalExecutionSlots(input) {
 	const pendingTasks = [];
 	const activeCountByAdapterId = /* @__PURE__ */ new Map();
 	const activeCountByLaneKey = /* @__PURE__ */ new Map();
+	const activeCountByProfileId = /* @__PURE__ */ new Map();
+	const activeResources = /* @__PURE__ */ new Map();
 	const adapterOperationIds = /* @__PURE__ */ new Set();
 	const ownedAttemptKeys = /* @__PURE__ */ new Set();
 	const ownedTaskIds = /* @__PURE__ */ new Map();
@@ -23103,11 +23503,15 @@ function createLocalExecutionSlots(input) {
 	const resolveWaitReason = (inputWait) => {
 		if (inputWait.adapterId && adapterOperationIds.has(inputWait.adapterId)) return "agent_controller_maintenance";
 		if (activeGlobal >= input.limits.globalConcurrency) return "global_concurrency";
+		if (inputWait.resourceScope !== void 0 && (activeCountByProfileId.get(inputWait.profileId ?? "") ?? 0) >= (input.limits.contextConcurrency ?? 0)) return "agent_profile_concurrency";
+		if ([...activeResources.values()].some((active) => resourcesConflict(active, inputWait.resourceScope))) return "workspace_conflict";
 		if (resolveActiveForLane(inputWait.localExecutionLaneKey) >= LOCAL_EXECUTION_LANE_CONCURRENCY_LIMIT) return "local_execution_lane_concurrency";
 		return "none";
 	};
 	const buildLocalQueueDiagnostics = (inputDiagnostics) => {
 		const waitReason = inputDiagnostics.waitReason ?? resolveWaitReason({
+			profileId: inputDiagnostics.profileId,
+			resourceScope: inputDiagnostics.resourceScope,
 			adapterId: inputDiagnostics.adapterId,
 			localExecutionLaneKey: inputDiagnostics.localExecutionLaneKey
 		});
@@ -23127,6 +23531,8 @@ function createLocalExecutionSlots(input) {
 			dispatchId: task.dispatchId,
 			localExecutionLaneKey: task.localExecutionLaneKey,
 			localQueue: buildLocalQueueDiagnostics({
+				profileId: task.profileId,
+				resourceScope: task.resourceScope,
 				adapterId: task.adapterId,
 				localExecutionLaneKey: task.localExecutionLaneKey,
 				queuePosition: inputEvent.queuePosition,
@@ -23165,15 +23571,15 @@ function createLocalExecutionSlots(input) {
 	};
 	const pump = () => {
 		while (activeGlobal < input.limits.globalConcurrency) {
-			const nextTaskIndex = pendingTasks.findIndex((candidate) => {
-				return !(candidate.task.adapterId && adapterOperationIds.has(candidate.task.adapterId)) && resolveActiveForLane(candidate.task.localExecutionLaneKey) < LOCAL_EXECUTION_LANE_CONCURRENCY_LIMIT;
-			});
+			const nextTaskIndex = pendingTasks.findIndex((candidate) => resolveWaitReason(candidate.task) === "none");
 			if (nextTaskIndex < 0) break;
 			const selectedPendingTask = pendingTasks.splice(nextTaskIndex, 1)[0];
 			if (!selectedPendingTask) continue;
 			clearQueuedLifecycle(selectedPendingTask);
 			const selectedTask = selectedPendingTask.task;
 			activeGlobal += 1;
+			activeResources.set(selectedTask.taskId, selectedTask.resourceScope);
+			activeCountByProfileId.set(selectedTask.profileId, (activeCountByProfileId.get(selectedTask.profileId) ?? 0) + 1);
 			if (selectedTask.adapterId) activeCountByAdapterId.set(selectedTask.adapterId, (activeCountByAdapterId.get(selectedTask.adapterId) ?? 0) + 1);
 			activeCountByLaneKey.set(selectedTask.localExecutionLaneKey, resolveActiveForLane(selectedTask.localExecutionLaneKey) + 1);
 			const startedEvent = buildTaskLifecycleEvent(selectedTask, {
@@ -23211,6 +23617,8 @@ function createLocalExecutionSlots(input) {
 			}).finally(() => {
 				releaseTaskOwnership(selectedTask);
 				activeGlobal = Math.max(0, activeGlobal - 1);
+				activeResources.delete(selectedTask.taskId);
+				activeCountByProfileId.set(selectedTask.profileId, Math.max(0, (activeCountByProfileId.get(selectedTask.profileId) ?? 0) - 1));
 				if (selectedTask.adapterId) {
 					const remainingActiveForAdapter = Math.max(0, (activeCountByAdapterId.get(selectedTask.adapterId) ?? 0) - 1);
 					if (remainingActiveForAdapter === 0) activeCountByAdapterId.delete(selectedTask.adapterId);
@@ -24584,6 +24992,7 @@ var registry_default = {
 					},
 					"transportModes": ["local-cli"],
 					"capabilityDeclaration": {
+						"executionContextVersion": 2,
 						"streamingCapability": "preview_capable",
 						"imageInputCapability": "local_file_path",
 						"runtimeWorkingDirectoryMode": "spawn_cwd",
@@ -24653,6 +25062,7 @@ var registry_default = {
 					},
 					"transportModes": ["codex-app-server"],
 					"capabilityDeclaration": {
+						"executionContextVersion": 2,
 						"streamingCapability": "preview_capable",
 						"imageInputCapability": "local_file_path",
 						"runtimeWorkingDirectoryMode": "spawn_cwd",
@@ -26695,6 +27105,7 @@ function parseAgentsRegistryAdapterBinding(value, context) {
 }
 function parseAgentsRegistryRuntimeCapabilityDeclaration(value, context) {
 	const objectValue = readObjectValue(value, context);
+	if (objectValue.executionContextVersion !== void 0 && objectValue.executionContextVersion !== 1 && objectValue.executionContextVersion !== 2) throw new Error(`${context}.executionContextVersion is unsupported`);
 	const streamingCapability = readEnumValue(objectValue.streamingCapability, `${context}.streamingCapability`, ["preview_capable", "final_only"]);
 	const imageInputCapability = readOptionalEnumValue(objectValue.imageInputCapability, `${context}.imageInputCapability`, ["local_file_path", "unsupported"]);
 	const runtimeWorkingDirectoryMode = readEnumValue(objectValue.runtimeWorkingDirectoryMode, `${context}.runtimeWorkingDirectoryMode`, [
@@ -26712,6 +27123,7 @@ function parseAgentsRegistryRuntimeCapabilityDeclaration(value, context) {
 	]);
 	return {
 		continuationCapability,
+		...objectValue.executionContextVersion === 1 || objectValue.executionContextVersion === 2 ? { executionContextVersion: objectValue.executionContextVersion } : {},
 		...imageInputCapability ? { imageInputCapability } : {},
 		preparationRequirement,
 		runtimeWorkingDirectoryMode,
@@ -29551,9 +29963,9 @@ function createModelCatalogReadSession(input) {
 async function readModelCatalogOnce(baseUrl) {
 	try {
 		const [apiClient, baseUrlModule, clientFoundationModule] = await Promise.all([
-			import("./dist-DTG_Vqc7.js"),
+			import("./dist-DVciurWV.js"),
 			import("./base-url-BE3pFiOZ.js"),
-			import("./api-client-foundation-D6_NXHPV.js")
+			import("./api-client-foundation-LfQQZwak.js")
 		]);
 		if (typeof apiClient.createConfigApi !== "function") throw new Error("config api client is unavailable");
 		const resolvedBaseUrl = baseUrl ?? await baseUrlModule.resolveBaseUrl();
@@ -37360,6 +37772,6 @@ function projectServiceJob(job) {
 	};
 }
 //#endregion
-export { formatDeviceReplyReadinessLabel as $, listOpenMeldProfiles as $a, buildDaemonServiceTargetSpec as $i, resolveRouteRegistrationReconcileDecision as $n, resolveAgentControllerPermissionModeForController as $r, resolveProjectBindingForPath as $t, resolveDaemonStatusSnapshot as A, DAEMON_STREAM_KEEPALIVE_INTERVAL_MS as Aa, readCurrentDaemonOwnerSnapshot as Ai, resolveSkillsAgentRegistry as An, seedLegacyAgentContext as Ar, createModelCatalogReadSession as At, formatDaemonServiceRefreshReliabilityMessage as B, RUNTIME_STATE_PERSIST_MIN_INTERVAL_MS as Ba, PREPARE_SESSION_RECONNECT_GRACE_MS as Bi, repairBuiltinControllerInstall as Bn, buildWorkingLanguagePromptPlan as Br, setOpenMeldManagedProfileWorkspace as Bt, isSystemServiceStartupTimeoutError as C, CATALOG_SYNC_RETRY_INTERVAL_MS as Ca, buildCliLaunchInvocation as Ci, removeAgentCustomTarget as Cn, buildRuntimeWorkspaceFingerprint as Cr, summarizeSkippedDaemonProfiles as Ct, captureDaemonServiceEvidence as D, CONTROLLED_SHUTDOWN_SOCKET_CLOSE_TIMEOUT_MS as Da, buildDaemonOwnerSnapshotFromObservedState as Di, updateAgentRegistrations as Dn, loadLedgerState as Dr, resolveLocalController as Dt, startDaemonSystemServiceWithAutoRepair as E, CONTROLLED_SHUTDOWN_RESULT_ACK_TIMEOUT_MS as Ea, inspectDaemonServiceInventory as Ei, updateAgentCustomTarget as En, commitResolvedAgentContext as Er, readLocalEnabledControllers as Et, buildDaemonServiceRefreshNextStep as F, PROVIDER_CONVERSATION_PROOF_SYNC_INTERVAL_MS as Fa, toStartBackgroundHelperExecutionCompatibility as Fi, notifyDaemonRouteCatalogChanged as Fn, buildAgentContextLookupKey as Fr, readProfileWorkspaceConfig as Ft, buildDaemonServiceDependencyDetails as G, clearAllSelectedOpenMeldProfileIds as Ga, resolveRuntimeContext as Gi, isNpmGlobalCommandPath as Gn, getAgentControllerPermissionModeFieldLabel as Gr, bindProject as Gt, resolveDaemonServiceFreshnessWarning as H, requireOpenMeldProfile as Ha, buildOnboardingPlan as Hi, resolveBuiltinAgentControllerDefinition as Hn, createAgentExecutionStatusDisplayRows as Hr, describeProfileWorkspacePathValidationFailure as Ht, buildDaemonServiceRefreshPromptMessage as I, PROVIDER_CONVERSATION_PROOF_SYNC_RETRY_INTERVAL_MS as Ia, ensureDaemonRuntimeContractState as Ii, normalizeAgentId as In, DEFAULT_TASK_LIFECYCLE_HEARTBEAT_INTERVAL_MS as Ir, readProfileWorkspaceConfigForAccount as It, buildDaemonServiceDependencySummary as J, setSelectedOpenMeldProfileId as Ja, setProfileDefaultView as Ji, normalizeDispatchThreadAction as Jn, parseAgentControllerRef as Jr, listProjectConnectionsWithStatus as Jt, buildDaemonServiceDependencyMeaning as K, clearSelectedOpenMeldProfileId as Ka, resolveViewProfileKey as Ki, isPnpmGlobalCommandPath as Kn, isAgentExecutionReadyOrConnecting as Kr, isProjectBound as Kt, buildDaemonServiceRepairGuidance as L, REGISTER_RESPONSE_TIMEOUT_MS as La, readDaemonRuntimeContractRepairReport as Li, normalizeAgentIds as Ln, areAgentControllerInterfaceAccountsSame as Lr, resolveConfiguredProfileWorkspacePath as Lt, resolveDaemonStatusAuthenticationAttention as M, DEFAULT_RECONNECT_DELAY_MS as Ma, resolveStoppedContractWriteBlockedReason as Mi, resolveRegistryOriginLaunchCommand as Mn, upsertConversationExecutionState as Mr, resolveProfileWorkspaceRuntime as Mt, resolveServiceReadiness as N, HEARTBEAT_RESPONSE_TIMEOUT_MS as Na, summarizeDaemonOwnerSnapshot as Ni, resolveRegistryRuntimeAdapterCapabilitySnapshot as Nn, withLedgerStateTransaction as Nr, ensureOpenMeldManagedProfileWorkspace as Nt, captureDaemonServiceEvidenceBestEffort as O, DAEMON_RUNTIME_CONTRACT_EPOCH as Oa, formatDaemonOwnerSummaryLabel as Oi, canManageRegistryAgentSkillTargets as On, removeConversationExecutionState as Or, resolveLocalRuntimeControllerSupport as Ot, resolveServiceReadinessFromServiceStatus as P, MAX_RECONNECT_DELAY_MS as Pa, resolveDaemonRuntimeContractCompatibility as Pi, resolveRegistryRuntimeAdapterContractByAgentControllerRef as Pn, buildAuthenticatedControlPlaneResponse as Pr, normalizeCustomProfileWorkspacePath as Pt, formatAgentReplyReadinessLabel as Q, getOpenMeldProfileCapabilities as Qa, ensureDaemonSystemServiceCommandFiles as Qi, isDaemonReconcileInProgressError as Qn, renderWorkingLanguagePrompt as Qr, removeProjectConnection as Qt, buildDaemonServiceStatusReadOnlyDetail as R, RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_INTERVAL_MS as Ra, DaemonServiceRunError as Ri, parseAgentEnabledOption as Rn, buildAgentControllerRef as Rr, resolveConfiguredProfileWorkspacePathForAccount as Rt, isDaemonInventoryRunningAndStartReady as S, warnDaemonEvent as Sa, resolveDispatchSpaceActionMcpServer as Si, reconcileNewRunnableBuiltinAgentsForSetup as Sn, runRuntimeTask as Sr, loadDaemonRouteCatalog as St, waitForSystemServiceStartup as T, CONTROLLED_SHUTDOWN_REQUEST_TIMEOUT_MS as Ta, createProviderOriginalError as Ti, setAgentRegistrationEnabled as Tn, appendLedgerHistoryEntry as Tr, buildRuntimeRouteTargets as Tt, clearDaemonStartFailureState as U, resolveOpenMeldProfileOrNull as Ua, getSetupFlowCopy as Ui, isBunGlobalCommandPath as Un, createAuthorityOpenMeldServiceRuntimeId as Ur, ProjectBindingOperationError as Ut, formatDaemonServiceUpdateRequiredMessage as V, isSelectedOpenMeldProfileRequiredError as Va, buildDaemonRouteObservationPresentation as Vi, EMPTY_AGENT_CONTROLLER_INTERFACE_CAPABILITIES as Vn, createAgentControllerInterfaceDisplayRows as Vr, validateCustomProfileWorkspacePath as Vt, writeDaemonStartFailureState as W, alignSelectedOpenMeldProfileStorage as Wa, parseCliViewMode as Wi, isHomebrewCommandPath as Wn, getAgentControllerPermissionModeDisplayMetadata as Wr, ProjectBindingStoreUpdateRequiredError as Wt, resolveDaemonServiceDependencyDiagnostics as X, createOpenMeldHumanProfile as Xa, writeDaemonServiceContract as Xi, SPACE_ACTION_CONTEXT_GUIDANCE_LINES as Xn, projectPeopleComputersToLegacyLocalRuntimes as Xr, removeAgentActivityBindingsWhileDeliveryLocked as Xt, buildDaemonServiceDependencyTitle as Y, createOpenMeldAgentProfile as Ya, resolveCurrentOpenMeldAccountContext as Yi, syncRuntimeEventToInflightTaskControlRegistry as Yn, peopleComputerContainsDevice as Yr, migrateProjectBindingStore as Yt, resolveCurrentReplyReadinessSnapshot as Z, deleteOpenMeldProfile as Za, buildDaemonSystemServiceCommandSpec as Zi, SPACE_ACTION_TARGET_GUIDANCE_LINES as Zn, renderInformationProtectionPrompt as Zr, removeMissingProjectConnections as Zt, DaemonServiceLifecycleDrainTimeoutError as _, normalizeNonNegativeInteger as _a, forkCodexAppServerThread as _i, listAgentRegistrations as _n, resolveDispatchQueueLogMeta as _r, readDaemonRouteCatalogCache as _t, resolveServiceUpdateUrgency as a, DAEMON_SERVICE_REPAIR_ANOMALIES as aa, resolveCatalogSyncSkippedProfilesLogState as ai, withAgentActivityDeliveryLock as an, buildAgentAuthenticationGuide as ao, createLocalTaskInterruptSender as ar, resolveReplyReadinessAvailabilityReasonCopy as at, prepareDaemonServiceUpdateWorkerCarrier as b, nowIsoString as ba, createUnavailableProviderUsageLimits as bi, readAgentRuntimeConfigHealth as bn, resolveCompatibleConversationExecutionState as br, createMutableRouteCatalogState as bt, buildLocalAgentCatalogFromReadiness as c, classifyDaemonServiceWakeability as ca, parseOpenCodeGoUsageResponse as ci, syncDeviceRuntimeStateProjection as cn, buildHumanAuthenticationCard as co, createInflightTaskControlRegistry as cr, classifyGatewayChainFailure as ct, isCliUpdateCheckApplicable as d, resolveDaemonDeviceId as da, GrokBuildAcpTransportError as di, emitReconcileStartedEvidence as dn, resolveAuthenticationGuidance as do, MIN_HEARTBEAT_INTERVAL_MS as dr, resolveGatewayChainRetryGuidance as dt, resolveDaemonServiceAlignmentDecision as ea, resolveAgentExecutionStatus as ei, runIfAgentActivityBindingGenerationIsCurrent as en, primeOpenMeldProfilesSessionCache as eo, createSerialAgentInteractionCallback as er, formatHumanReplyReadinessReason as et, readLastOpenMeldToolsUpdateAttempt as f, resolvePreferredDaemonDeviceId as fa, probeGrokBuildAcpInterface as fi, createPrimaryBindingReadSession as fn, resolveAuthenticationGuidanceFromError as fo, applyAcceptedLeases as fr, resolveOpenClawLocalDiagnosticsValue as ft, scheduleDaemonServiceUpdate as g, normalizeHeartbeatIntervalMs as ga, resolveInstalledCodexLaunchCandidates as gi, listAgentCustomTargets as gn, resolveBuiltinAgentControllerBrand as go, resolveCatalogSyncIntervalMs as gr, slugifyOpenClawNamePart as gt, runPendingDaemonServiceUpdate as h, emitRunLine as ha, resolveCodexTimeoutMs as hi, createRegistrationFromCatalogTarget as hn, compareAgentControllerRefsForDisplay as ho, resolveAdaptiveHeartbeatIntervalMs as hr, normalizeOpenClawSpaceIdPrefix as ht, writeOpenMeldToolsMaintenancePolicy as i, DAEMON_SERVICE_FULL_ALIGNMENT_ANOMALIES as ia, resolveSelectableCandidates as ii, resolveLocalProjectConnectionForPath as in, readDaemonCatalogSyncSignal as io, mergeOpenClawGatewayVisibility as ir, formatSpaceMemberCommandRecoveryCopy as it, resolveDaemonStatusAttention as j, DAEMON_STREAM_KEEPALIVE_PONG_TIMEOUT_MS as ja, resolveDaemonStopStrategy as ji, listBuiltinAgentsRegistryEntries as jn, settleInflightTask as jr, resolveCurrentEffectiveProfileWorkingFolderRuntime as jt, formatDaemonFailureContextText as k, DAEMON_STREAM_CONNECT_TIMEOUT_MS as ka, hasActiveDaemonOwners as ki, detectInstalledSkillsAgents as kn, resolveConversationExecutionStateByLookupKey as kr, syncProfileWorkspaceState as kt, readCurrentLocalDeviceId as l, buildLedgerPaths as la, forkOpenCodeServerSession as li, emitDriftDetectedEvidence as ln, createAuthenticationError as lo, ADAPTIVE_HEARTBEAT_JITTER_RATIO as lr, resolveGatewayChainReadiness as lt, readOpenMeldToolsUpdateContextFromEnv as m, dirnamePath as ma, projectCodexUsageLimits as mi, addAgentCustomTarget as mn, resolveAuthenticationReasonFromState as mo, pruneStaleLeases as mr, buildOpenClawSpaceSessionKey as mt, readOpenMeldToolsMaintenancePolicy as n, resolveVersionChangeDirection as na, resolveEvidenceSyncHealth as ni, unbindProject as nn, updateOpenMeldProfile as no, normalizeDispatchPostMessageAction as nr, mapAgentReplyReadinessToLegacyAutoReply as nt, assessServerRequiredVersion as o, DAEMON_SERVICE_WAKEABILITY_ADVISORY_ANOMALIES as oa, createLocalAdapterContainer as oi, withAgentActivityLocalStateLock as on, buildAuthenticationStatusLabel as oo, buildLocalServiceDiagnosticsPayload as or, resolveReplyReadinessGuidanceSummaryCopy as ot, readPendingOpenMeldToolsUpdateAttempt as p, asRecord as pa, resolveInstalledGrokBuildLaunchCandidates as pi, resolveAgentProfilePrimaryAgentControllerReport as pn, resolveAuthenticationGuidanceFromMessage as po, applyIntervalJitterMs as pr, prepareProviderRuntime as pt, buildDaemonServiceDependencyNextStep as q, getSelectedOpenMeldProfileId as qa, getProfileDefaultView as qi, resolveLocalRegistryAgentIdFromAgentControllerRef as qn, listAgentControllerPermissionModeOptions as qr, listProjectBindings as qt, resolveOpenMeldToolsMaintenanceProjection as r, DAEMON_SERVICE_AUTO_HEAL_ANOMALIES as ra, resolveNativeAgentControllerPermissionModeForController as ri, canonicalizeLocalProjectPath as rn, assertAdditionalHumanProfileCreationEnabled as ro, createPendingAgentInteractionRegistry as rr, REPLY_READINESS_COPY as rt, describeServerRequiredVersionUnavailableReason as s, classifyDaemonServiceRunStartability as sa, createLocalAdapterEntries as si, NO_LOCAL_AGENTS_NEED_OPENMELD_SERVICE_REASON as sn, buildCommandAuthenticationPromptMessage as so, createLocalExecutionSlots as sr, resolveOpenClawDiagnosticsGuidance as st, createOpenMeldToolsUpdateCoordinator as t, isVersionDowngrade as ta, resolveAgentProfileEditCapabilities as ti, setDefaultProjectConnection as tn, resolveOpenMeldProfile as to, buildDispatchReplyContextSummary as tr, formatReplyReadinessSummary as tt, assessCliUpdate as u, ensureDaemonRuntimePaths as ua, resolveInstalledOpenCodeLaunchCandidates as ui, emitReconcileCompletedEvidence as un, extractAuthenticationPromptAction as uo, MAX_HEARTBEAT_INTERVAL_MS as ur, resolveGatewayChainRepairGuidance as ut, runDaemonServiceLifecycle as v, normalizeOptionalText$52 as va, verifyCodexAppServerThread as vi, listAgentTargetStates as vn, resolveDispatchContinuityObservation as vr, writeDaemonRouteCatalogCache as vt, resolveSystemServiceStartupWaitMs as w, CATALOG_SYNC_SIGNAL_POLL_INTERVAL_MS as wa, materializeCliLaunchCommand as wi, resolveAgentTargetState as wn, buildTaskResultEnvelope as wr, syncDaemonRouteCatalogState as wt, uninstallDaemonServiceUpdateWorker as x, toErrorMessage$23 as xa, createUnsupportedProviderUsageLimits as xi, reconcileNewRunnableBuiltinAgentRegistrations as xn, resolveLatestScopedConversationExecutionState as xr, createRouteCatalogFromMutableState as xt, ensureDaemonServiceMaintenanceInstalled as y, normalizeText$11 as ya, resolveInstalledClaudeCodeLaunchCandidates as yi, manageAgentRegistrationInstallation as yn, resolveCompatibleAgentContextMatch as yr, resolveLocalServiceDemand as yt, buildDaemonServiceUpdateRequiredNextStep as z, RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_RETRY_INTERVAL_MS as za, resolveCurrentDaemonExpectedVersion as zi, sortAgentRegistrations as zn, buildInformationProtectionPromptPlan as zr, setCustomProfileWorkspace as zt };
+export { formatDeviceReplyReadinessLabel as $, deleteOpenMeldProfile as $a, buildDaemonSystemServiceCommandSpec as $i, resolveRouteRegistrationReconcileDecision as $n, renderWorkingLanguagePrompt as $r, resolveProjectBindingForPath as $t, resolveDaemonStatusSnapshot as A, DAEMON_RUNTIME_CONTRACT_EPOCH as Aa, formatDaemonOwnerSummaryLabel as Ai, resolveSkillsAgentRegistry as An, seedLegacyAgentContext as Ar, createModelCatalogReadSession as At, formatDaemonServiceRefreshReliabilityMessage as B, RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_INTERVAL_MS as Ba, DaemonServiceRunError as Bi, repairBuiltinControllerInstall as Bn, buildInformationProtectionPromptPlan as Br, setOpenMeldManagedProfileWorkspace as Bt, isSystemServiceStartupTimeoutError as C, toErrorMessage$23 as Ca, resolveDispatchSpaceActionMcpServer as Ci, removeAgentCustomTarget as Cn, buildRuntimeWorkspaceFingerprint as Cr, summarizeSkippedDaemonProfiles as Ct, captureDaemonServiceEvidence as D, CONTROLLED_SHUTDOWN_REQUEST_TIMEOUT_MS as Da, createProviderOriginalError as Di, updateAgentRegistrations as Dn, loadLedgerState as Dr, resolveLocalController as Dt, startDaemonSystemServiceWithAutoRepair as E, CATALOG_SYNC_SIGNAL_POLL_INTERVAL_MS as Ea, listAgentControllerSupervisedProcessIds as Ei, updateAgentCustomTarget as En, commitResolvedAgentContext as Er, readLocalEnabledControllers as Et, buildDaemonServiceRefreshNextStep as F, HEARTBEAT_RESPONSE_TIMEOUT_MS as Fa, summarizeDaemonOwnerSnapshot as Fi, notifyDaemonRouteCatalogChanged as Fn, assertLegacyAgentContextAssociation as Fr, readProfileWorkspaceConfig as Ft, buildDaemonServiceDependencyDetails as G, resolveOpenMeldProfileOrNull as Ga, getSetupFlowCopy as Gi, isNpmGlobalCommandPath as Gn, getAgentControllerPermissionModeDisplayMetadata as Gr, bindProject as Gt, resolveDaemonServiceFreshnessWarning as H, RUNTIME_STATE_PERSIST_MIN_INTERVAL_MS as Ha, PREPARE_SESSION_RECONNECT_GRACE_MS as Hi, resolveBuiltinAgentControllerDefinition as Hn, createAgentControllerInterfaceDisplayRows as Hr, describeProfileWorkspacePathValidationFailure as Ht, buildDaemonServiceRefreshPromptMessage as I, MAX_RECONNECT_DELAY_MS as Ia, resolveDaemonRuntimeContractCompatibility as Ii, normalizeAgentId as In, buildAgentContextLookupKey as Ir, readProfileWorkspaceConfigForAccount as It, buildDaemonServiceDependencySummary as J, clearSelectedOpenMeldProfileId as Ja, resolveViewProfileKey as Ji, normalizeDispatchThreadAction as Jn, listAgentControllerPermissionModeOptions as Jr, listProjectConnectionsWithStatus as Jt, buildDaemonServiceDependencyMeaning as K, alignSelectedOpenMeldProfileStorage as Ka, parseCliViewMode as Ki, isPnpmGlobalCommandPath as Kn, getAgentControllerPermissionModeFieldLabel as Kr, isProjectBound as Kt, buildDaemonServiceRepairGuidance as L, PROVIDER_CONVERSATION_PROOF_SYNC_INTERVAL_MS as La, toStartBackgroundHelperExecutionCompatibility as Li, normalizeAgentIds as Ln, DEFAULT_TASK_LIFECYCLE_HEARTBEAT_INTERVAL_MS as Lr, resolveConfiguredProfileWorkspacePath as Lt, resolveDaemonStatusAuthenticationAttention as M, DAEMON_STREAM_KEEPALIVE_INTERVAL_MS as Ma, readCurrentDaemonOwnerSnapshot as Mi, resolveRegistryOriginLaunchCommand as Mn, upsertConversationExecutionState as Mr, resolveProfileWorkspaceRuntime as Mt, resolveServiceReadiness as N, DAEMON_STREAM_KEEPALIVE_PONG_TIMEOUT_MS as Na, resolveDaemonStopStrategy as Ni, resolveRegistryRuntimeAdapterCapabilitySnapshot as Nn, withLedgerStateTransaction as Nr, ensureOpenMeldManagedProfileWorkspace as Nt, captureDaemonServiceEvidenceBestEffort as O, CONTROLLED_SHUTDOWN_RESULT_ACK_TIMEOUT_MS as Oa, inspectDaemonServiceInventory as Oi, canManageRegistryAgentSkillTargets as On, removeConversationExecutionState as Or, resolveLocalRuntimeControllerSupport as Ot, resolveServiceReadinessFromServiceStatus as P, DEFAULT_RECONNECT_DELAY_MS as Pa, resolveStoppedContractWriteBlockedReason as Pi, resolveRegistryRuntimeAdapterContractByAgentControllerRef as Pn, buildAuthenticatedControlPlaneResponse as Pr, normalizeCustomProfileWorkspacePath as Pt, formatAgentReplyReadinessLabel as Q, createOpenMeldHumanProfile as Qa, writeDaemonServiceContract as Qi, isDaemonReconcileInProgressError as Qn, renderInformationProtectionPrompt as Qr, removeProjectConnection as Qt, buildDaemonServiceStatusReadOnlyDetail as R, PROVIDER_CONVERSATION_PROOF_SYNC_RETRY_INTERVAL_MS as Ra, ensureDaemonRuntimeContractState as Ri, parseAgentEnabledOption as Rn, areAgentControllerInterfaceAccountsSame as Rr, resolveConfiguredProfileWorkspacePathForAccount as Rt, isDaemonInventoryRunningAndStartReady as S, nowIsoString as Sa, createUnsupportedProviderUsageLimits as Si, reconcileNewRunnableBuiltinAgentsForSetup as Sn, runRuntimeTask as Sr, loadDaemonRouteCatalog as St, waitForSystemServiceStartup as T, CATALOG_SYNC_RETRY_INTERVAL_MS as Ta, materializeCliLaunchCommand as Ti, setAgentRegistrationEnabled as Tn, appendLedgerHistoryEntry as Tr, buildRuntimeRouteTargets as Tt, clearDaemonStartFailureState as U, isSelectedOpenMeldProfileRequiredError as Ua, buildDaemonRouteObservationPresentation as Ui, isBunGlobalCommandPath as Un, createAgentExecutionStatusDisplayRows as Ur, ProjectBindingOperationError as Ut, formatDaemonServiceUpdateRequiredMessage as V, RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_RETRY_INTERVAL_MS as Va, resolveCurrentDaemonExpectedVersion as Vi, EMPTY_AGENT_CONTROLLER_INTERFACE_CAPABILITIES as Vn, buildWorkingLanguagePromptPlan as Vr, validateCustomProfileWorkspacePath as Vt, writeDaemonStartFailureState as W, requireOpenMeldProfile as Wa, buildOnboardingPlan as Wi, isHomebrewCommandPath as Wn, createAuthorityOpenMeldServiceRuntimeId as Wr, ProjectBindingStoreUpdateRequiredError as Wt, resolveDaemonServiceDependencyDiagnostics as X, setSelectedOpenMeldProfileId as Xa, setProfileDefaultView as Xi, SPACE_ACTION_CONTEXT_GUIDANCE_LINES as Xn, peopleComputerContainsDevice as Xr, removeAgentActivityBindingsWhileDeliveryLocked as Xt, buildDaemonServiceDependencyTitle as Y, getSelectedOpenMeldProfileId as Ya, getProfileDefaultView as Yi, syncRuntimeEventToInflightTaskControlRegistry as Yn, parseAgentControllerRef as Yr, migrateProjectBindingStore as Yt, resolveCurrentReplyReadinessSnapshot as Z, createOpenMeldAgentProfile as Za, resolveCurrentOpenMeldAccountContext as Zi, SPACE_ACTION_TARGET_GUIDANCE_LINES as Zn, projectPeopleComputersToLegacyLocalRuntimes as Zr, removeMissingProjectConnections as Zt, DaemonServiceLifecycleDrainTimeoutError as _, emitRunLine as _a, resolveInstalledCodexLaunchCandidates as _i, listAgentRegistrations as _n, compareAgentControllerRefsForDisplay as _o, resolveDispatchQueueLogMeta as _r, readDaemonRouteCatalogCache as _t, resolveServiceUpdateUrgency as a, DAEMON_SERVICE_AUTO_HEAL_ANOMALIES as aa, resolveSelectableCandidates as ai, withAgentActivityDeliveryLock as an, assertAdditionalHumanProfileCreationEnabled as ao, createLocalTaskInterruptSender as ar, resolveReplyReadinessAvailabilityReasonCopy as at, prepareDaemonServiceUpdateWorkerCarrier as b, normalizeOptionalText$52 as ba, resolveInstalledClaudeCodeLaunchCandidates as bi, readAgentRuntimeConfigHealth as bn, resolveCompatibleConversationExecutionState as br, createMutableRouteCatalogState as bt, buildLocalAgentCatalogFromReadiness as c, DAEMON_SERVICE_WAKEABILITY_ADVISORY_ANOMALIES as ca, createLocalAdapterEntries as ci, syncDeviceRuntimeStateProjection as cn, buildAuthenticationStatusLabel as co, createInflightTaskControlRegistry as cr, classifyGatewayChainFailure as ct, isCliUpdateCheckApplicable as d, buildLedgerPaths as da, resolveInstalledOpenCodeLaunchCandidates as di, emitReconcileStartedEvidence as dn, createAuthenticationError as do, MIN_HEARTBEAT_INTERVAL_MS as dr, resolveGatewayChainRetryGuidance as dt, ensureDaemonSystemServiceCommandFiles as ea, resolveAgentControllerPermissionModeForController as ei, runIfAgentActivityBindingGenerationIsCurrent as en, getOpenMeldProfileCapabilities as eo, createSerialAgentInteractionCallback as er, formatHumanReplyReadinessReason as et, readLastOpenMeldToolsUpdateAttempt as f, ensureDaemonRuntimePaths as fa, GrokBuildAcpTransportError as fi, createPrimaryBindingReadSession as fn, extractAuthenticationPromptAction as fo, applyAcceptedLeases as fr, resolveOpenClawLocalDiagnosticsValue as ft, scheduleDaemonServiceUpdate as g, dirnamePath as ga, resolveCodexTimeoutMs as gi, listAgentCustomTargets as gn, resolveAuthenticationReasonFromState as go, resolveCatalogSyncIntervalMs as gr, slugifyOpenClawNamePart as gt, runPendingDaemonServiceUpdate as h, asRecord as ha, projectCodexUsageLimits as hi, createRegistrationFromCatalogTarget as hn, resolveAuthenticationGuidanceFromMessage as ho, resolveAdaptiveHeartbeatIntervalMs as hr, normalizeOpenClawSpaceIdPrefix as ht, writeOpenMeldToolsMaintenancePolicy as i, resolveVersionChangeDirection as ia, resolveNativeAgentControllerPermissionModeForController as ii, resolveLocalProjectConnectionForPath as in, updateOpenMeldProfile as io, mergeOpenClawGatewayVisibility as ir, formatSpaceMemberCommandRecoveryCopy as it, resolveDaemonStatusAttention as j, DAEMON_STREAM_CONNECT_TIMEOUT_MS as ja, hasActiveDaemonOwners as ji, listBuiltinAgentsRegistryEntries as jn, settleInflightTask as jr, resolveCurrentEffectiveProfileWorkingFolderRuntime as jt, formatDaemonFailureContextText as k, CONTROLLED_SHUTDOWN_SOCKET_CLOSE_TIMEOUT_MS as ka, buildDaemonOwnerSnapshotFromObservedState as ki, detectInstalledSkillsAgents as kn, resolveConversationExecutionStateByLookupKey as kr, syncProfileWorkspaceState as kt, readCurrentLocalDeviceId as l, classifyDaemonServiceRunStartability as la, parseOpenCodeGoUsageResponse as li, emitDriftDetectedEvidence as ln, buildCommandAuthenticationPromptMessage as lo, ADAPTIVE_HEARTBEAT_JITTER_RATIO as lr, resolveGatewayChainReadiness as lt, readOpenMeldToolsUpdateContextFromEnv as m, resolvePreferredDaemonDeviceId as ma, resolveInstalledGrokBuildLaunchCandidates as mi, addAgentCustomTarget as mn, resolveAuthenticationGuidanceFromError as mo, pruneStaleLeases as mr, buildOpenClawSpaceSessionKey as mt, readOpenMeldToolsMaintenancePolicy as n, resolveDaemonServiceAlignmentDecision as na, resolveAgentProfileEditCapabilities as ni, unbindProject as nn, primeOpenMeldProfilesSessionCache as no, normalizeDispatchPostMessageAction as nr, mapAgentReplyReadinessToLegacyAutoReply as nt, assessServerRequiredVersion as o, DAEMON_SERVICE_FULL_ALIGNMENT_ANOMALIES as oa, resolveCatalogSyncSkippedProfilesLogState as oi, withAgentActivityLocalStateLock as on, readDaemonCatalogSyncSignal as oo, buildLocalServiceDiagnosticsPayload as or, resolveReplyReadinessGuidanceSummaryCopy as ot, readPendingOpenMeldToolsUpdateAttempt as p, resolveDaemonDeviceId as pa, probeGrokBuildAcpInterface as pi, resolveAgentProfilePrimaryAgentControllerReport as pn, resolveAuthenticationGuidance as po, applyIntervalJitterMs as pr, prepareProviderRuntime as pt, buildDaemonServiceDependencyNextStep as q, clearAllSelectedOpenMeldProfileIds as qa, resolveRuntimeContext as qi, resolveLocalRegistryAgentIdFromAgentControllerRef as qn, isAgentExecutionReadyOrConnecting as qr, listProjectBindings as qt, resolveOpenMeldToolsMaintenanceProjection as r, isVersionDowngrade as ra, resolveEvidenceSyncHealth as ri, canonicalizeLocalProjectPath as rn, resolveOpenMeldProfile as ro, createPendingAgentInteractionRegistry as rr, REPLY_READINESS_COPY as rt, describeServerRequiredVersionUnavailableReason as s, DAEMON_SERVICE_REPAIR_ANOMALIES as sa, createLocalAdapterContainer as si, NO_LOCAL_AGENTS_NEED_OPENMELD_SERVICE_REASON as sn, buildAgentAuthenticationGuide as so, createLocalExecutionSlots as sr, resolveOpenClawDiagnosticsGuidance as st, createOpenMeldToolsUpdateCoordinator as t, buildDaemonServiceTargetSpec as ta, resolveAgentExecutionStatus as ti, setDefaultProjectConnection as tn, listOpenMeldProfiles as to, buildDispatchReplyContextSummary as tr, formatReplyReadinessSummary as tt, assessCliUpdate as u, classifyDaemonServiceWakeability as ua, forkOpenCodeServerSession as ui, emitReconcileCompletedEvidence as un, buildHumanAuthenticationCard as uo, MAX_HEARTBEAT_INTERVAL_MS as ur, resolveGatewayChainRepairGuidance as ut, runDaemonServiceLifecycle as v, normalizeHeartbeatIntervalMs as va, forkCodexAppServerThread as vi, listAgentTargetStates as vn, resolveBuiltinAgentControllerBrand as vo, resolveDispatchContinuityObservation as vr, writeDaemonRouteCatalogCache as vt, resolveSystemServiceStartupWaitMs as w, warnDaemonEvent as wa, buildCliLaunchInvocation as wi, resolveAgentTargetState as wn, buildTaskResultEnvelope as wr, syncDaemonRouteCatalogState as wt, uninstallDaemonServiceUpdateWorker as x, normalizeText$11 as xa, createUnavailableProviderUsageLimits as xi, reconcileNewRunnableBuiltinAgentRegistrations as xn, resolveLatestScopedConversationExecutionState as xr, createRouteCatalogFromMutableState as xt, ensureDaemonServiceMaintenanceInstalled as y, normalizeNonNegativeInteger as ya, verifyCodexAppServerThread as yi, manageAgentRegistrationInstallation as yn, resolveCompatibleAgentContextMatch as yr, resolveLocalServiceDemand as yt, buildDaemonServiceUpdateRequiredNextStep as z, REGISTER_RESPONSE_TIMEOUT_MS as za, readDaemonRuntimeContractRepairReport as zi, sortAgentRegistrations as zn, buildAgentControllerRef as zr, setCustomProfileWorkspace as zt };
 
-//# sourceMappingURL=openmeld-tools-update-coordinator-D9Skj8IE.js.map
+//# sourceMappingURL=openmeld-tools-update-coordinator-jJrVAHgC.js.map