openmeld 0.3.233 → 0.3.235

package/dist/{runtime-reporting-health-state-a1FUE1S-.js → updates-api-B0f4KyCg.js}

@@ -2,13 +2,13 @@
 
 import { g as toSpaceUpdatesUrl } from "./urls-CY2uzH2-.js";
 import { F as resolveOpenMeldRootDir, k as organizationSkillReleaseDir, t as OPENMELD_HOME_ENV_KEY } from "./paths-De9xdA2h.js";
-import { Cr as spaceTaskMutationReceiptSchema, Fi as signalTextEnvelopeSchema, Hr as organizationSkillBundleSchema, Lt as createAgentActivityApi, Sr as spaceTaskIdSchema, br as createSpaceTaskBodySchema, fn as createRuntimeReportingApi, or as getSpaceUpdatesResponseSchema, pi as observedLocalAgentSessionSchema, qr as stringifyOrganizationSkillBundleCanonicalJson, ri as submitAgentControllerTaskLifecycleEventItemSchema, rr as OPENMELD_HEADER_SPACE_ADDRESSING_VERSION, t as OpenMeldApiClientHttpError, xr as mutateSpaceTaskBodySchema } from "./dist-BgYBvEBB.js";
-import { On as resolveInstalledClaudeCodeLaunchCandidates, Qn as buildCliLaunchInvocation, Tt as withAgentActivityLocalStateLock, Zn as resolveDispatchSpaceActionMcpServer, er as resolveExecutablePathsOnPath, ft as listProjectBindings, hn as resolveInstalledOpenCodeLaunchCandidates, ht as removeAgentActivityBindingsWhileDeliveryLocked, ir as isDispatchSpaceActionDeliveryOnly, tr as listAgentControllerSupervisedProcessIds, vn as resolveInstalledGrokBuildLaunchCandidates, vt as resolveProjectBindingForPath, wt as withAgentActivityDeliveryLock, xn as resolveInstalledCodexLaunchCandidates } from "./prepare-provider-runtime-CD6XRt7X.js";
-import { Jt as spaceWorkingCopyResultSchema, Kt as spaceWorkRelativePathSchema, Wt as SPACE_WORK_MAX_BYTES, _n as spaceFileEntryIdSchema, an as readSpaceFileTextResponseSchema, cr as executionContextTaskSchema, or as executionContextAssignmentSchema, qt as spaceWorkSelectionSchema, wn as spaceMessageFileReferenceSchema, xn as spaceFileRevisionNumberSchema } from "./runtime-transport-D4CVffnp.js";
-import { d as getAuthSessionState } from "./auth-session-iXCJO5oB.js";
+import { Cr as spaceTaskMutationReceiptSchema, Hr as organizationSkillBundleSchema, Lt as createAgentActivityApi, Pi as signalTextEnvelopeSchema, Sr as spaceTaskIdSchema, br as createSpaceTaskBodySchema, fn as createRuntimeReportingApi, or as getSpaceUpdatesResponseSchema, pi as observedLocalAgentSessionSchema, qr as stringifyOrganizationSkillBundleCanonicalJson, ri as submitAgentControllerTaskLifecycleEventItemSchema, rr as OPENMELD_HEADER_SPACE_ADDRESSING_VERSION, t as OpenMeldApiClientHttpError, xr as mutateSpaceTaskBodySchema } from "./dist-CJL7LE-y.js";
+import { Fn as spaceFileRevisionNumberSchema, Rn as spaceMessageFileReferenceSchema, Sr as executionContextTaskSchema, br as executionContextAssignmentSchema, cn as spaceWorkingCopyResultSchema, in as SPACE_WORK_MAX_BYTES, jn as spaceFileEntryIdSchema, on as spaceWorkRelativePathSchema, sn as spaceWorkSelectionSchema, yn as readSpaceFileTextResponseSchema } from "./runtime-transport-DyBmX7ds.js";
 import { O as openMeldRuntimeProfileIdSchema } from "./control-plane-QqGL-jtT.js";
-import { A as drainAgentActivityHookInbox, An as cliJsonErrorEnvelopeSchema, C as readOpenCodeSessionRows, D as resolveObservedAgentActivityBinding, F as deferAgentActivityOutbox, I as readAgentActivityOutboxHealth, L as readDueAgentActivityOutbox, M as removeProjectInbox, N as AgentActivitySubmissionResultsMismatchError, O as normalizeSharedSessionTitle, P as applyAgentActivitySubmissionResults, R as removeProjectOutbox, S as startAgentActivityTranscriptWatchers, T as resolveOpenCodeDatabasePath, a as DispatchSpaceActionClosedError, d as readDispatchSpaceActionRecord, l as readDispatchSpaceActionContextForReceiptFromEnv, o as DispatchSpaceActionRejectedError, p as writeDispatchSpaceActionRecord, s as OPENMELD_SPACE_ACTION_CONTEXT_PATH_ENV, u as readDispatchSpaceActionContextFromEnv, x as scanLocalAgentActivity, z as readRecentAgentActivityHookStatus } from "./dispatch-owned-runtime-BeIQetEt.js";
-import { B as requireOpenMeldProfile, o as dirnamePath } from "./daemon-device-id-DbSIqHoZ.js";
+import { $n as resolveExecutablePathsOnPath, On as resolveInstalledClaudeCodeLaunchCandidates, Tt as withAgentActivityLocalStateLock, Xn as resolveDispatchSpaceActionMcpServer, Zn as buildCliLaunchInvocation, er as listAgentControllerSupervisedProcessIds, ft as listProjectBindings, hn as resolveInstalledOpenCodeLaunchCandidates, ht as removeAgentActivityBindingsWhileDeliveryLocked, rr as isDispatchSpaceActionDeliveryOnly, vn as resolveInstalledGrokBuildLaunchCandidates, vt as resolveProjectBindingForPath, wt as withAgentActivityDeliveryLock, xn as resolveInstalledCodexLaunchCandidates } from "./prepare-provider-runtime-Y2WOwFlV.js";
+import { d as getAuthSessionState } from "./auth-session-CjxqNKvh.js";
+import { A as AgentActivitySubmissionResultsMismatchError, D as drainAgentActivityHookInbox, F as removeProjectOutbox, I as readRecentAgentActivityHookStatus, L as createServiceGitEnvironment, M as deferAgentActivityOutbox, N as readAgentActivityOutboxHealth, P as readDueAgentActivityOutbox, S as resolveOpenCodeDatabasePath, T as normalizeSharedSessionTitle, a as DispatchSpaceActionClosedError, b as readOpenCodeSessionRows, d as readDispatchSpaceActionRecord, j as applyAgentActivitySubmissionResults, k as removeProjectInbox, l as readDispatchSpaceActionContextForReceiptFromEnv, o as DispatchSpaceActionRejectedError, p as writeDispatchSpaceActionRecord, pn as cliJsonErrorEnvelopeSchema, s as OPENMELD_SPACE_ACTION_CONTEXT_PATH_ENV, u as readDispatchSpaceActionContextFromEnv, v as scanLocalAgentActivity, w as resolveObservedAgentActivityBinding, y as startAgentActivityTranscriptWatchers } from "./dispatch-owned-runtime-FNjbFwSu.js";
+import { B as requireOpenMeldProfile, o as dirnamePath } from "./daemon-device-id-OMqh2F9_.js";
 import { d as runWithHeldLock, s as releaseLock, t as acquireLock } from "./lock-BMI00i2F.js";
 import { a as resolveBaseUrl } from "./base-url-0AoeTi3w.js";
 import { n as writeDaemonLocalStateFile, t as readDaemonLocalStateFile } from "./daemon-local-state-file-jOXuXrky.js";
@@ -16,8 +16,8 @@ import { _ as daemonRuntimeStateRootPath } from "./daemon-state-Dte9re5V.js";
 import { i as readDaemonServiceContract } from "./daemon-service-contract-COPKbCy_.js";
 import { l as resolveUserFacingCliEntryCommand, n as formatOpenMeldCliCommand } from "./cli-entry-command-CR_9QU1i.js";
 import { r as outLine } from "./io-DT66typ4.js";
-import { d as buildOpenMeldRequestContextFromProfile, l as canAttachAuthTokenToRequest, n as fetchSpaceRequestWithTimeout, s as buildOpenMeldRequestContextHeadersWithAuth, t as createCliApiClientFoundation } from "./api-client-foundation-C-RPnq_p.js";
-import { d as uploadPreparedSpaceFiles, f as createCliSpaceApi, l as parseJsonResponse, s as readGatewayTextResponse, u as prepareRequestedSpaceSendFiles } from "./meta-api-DgHkiIdr.js";
+import { d as buildOpenMeldRequestContextFromProfile, l as canAttachAuthTokenToRequest, n as fetchSpaceRequestWithTimeout, s as buildOpenMeldRequestContextHeadersWithAuth, t as createCliApiClientFoundation } from "./api-client-foundation-D6zHrrGV.js";
+import { d as uploadPreparedSpaceFiles, f as createCliSpaceApi, l as parseJsonResponse, s as readGatewayTextResponse, u as prepareRequestedSpaceSendFiles } from "./meta-api-ClHCkzZB.js";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { homedir } from "node:os";
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
@@ -29,9 +29,9 @@ import { execFile, spawn } from "node:child_process";
 import { promisify } from "node:util";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
 import { createInterface } from "node:readline";
+import { performance } from "node:perf_hooks";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-import { performance } from "node:perf_hooks";
 //#region ../../packages/schemas/dist/schemas/config/agent-activity-route-registry.js
 const agentActivityRouteRegistrySchema = z$1.strictObject({
 	routes: z$1.array(z$1.strictObject({ rootDir: z$1.string().trim().min(1).max(4096) })).max(64),
@@ -2876,6 +2876,169 @@ async function readLocalReportingHealth(rootDir) {
 	return await Promise.all([readAgentActivityOutboxHealth({ rootDir }), readControllerTaskLifecycleOutboxHealth({ rootDir })]);
 }
 //#endregion
+//#region src/local-service/state/ledger-io.ts
+function createLedgerIo() {
+	return {
+		appendFile: async (filePath, content, encoding) => {
+			await mkdir(dirnamePath(filePath), { recursive: true });
+			await appendFile(filePath, content, { encoding });
+		},
+		copyFile: async (fromPath, toPath) => {
+			await mkdir(dirnamePath(toPath), { recursive: true });
+			await copyFile(fromPath, toPath);
+		},
+		mkdir: async (dirPath, options) => {
+			await mkdir(dirPath, options);
+		},
+		readFile: async (filePath, encoding) => {
+			return await readFile(filePath, encoding);
+		},
+		rename: async (fromPath, toPath) => {
+			await mkdir(dirnamePath(toPath), { recursive: true });
+			await rename(fromPath, toPath);
+		},
+		syncPath: async (fileOrDirectoryPath) => {
+			const isWindows = process.platform === "win32";
+			if (isWindows && (await stat(fileOrDirectoryPath)).isDirectory()) return;
+			const handle = await open(fileOrDirectoryPath, isWindows ? "r+" : "r");
+			try {
+				await handle.sync();
+			} finally {
+				await handle.close();
+			}
+		},
+		rm: async (filePath, options) => {
+			await rm(filePath, options);
+		},
+		writeFile: async (filePath, content, encoding) => {
+			await mkdir(dirnamePath(filePath), { recursive: true });
+			await writeFile(filePath, content, encoding);
+		}
+	};
+}
+//#endregion
+//#region src/local-service/state/runtime-reporting-health-state.ts
+const RUNTIME_REPORTING_HEALTH_FILENAME = "reporting-health.json";
+const DIAGNOSTIC_WHITESPACE_RE = /\s+/gu;
+const stateUpdateQueueByPath = /* @__PURE__ */ new Map();
+function runtimeReportingHealthStatePath(pathInput = {}) {
+	return join(daemonRuntimeStateRootPath(pathInput), RUNTIME_REPORTING_HEALTH_FILENAME);
+}
+async function readRuntimeReportingHealthState(pathInput = {}, expectedServiceIdentity) {
+	const state = await readDaemonLocalStateFile({
+		path: runtimeReportingHealthStatePath(pathInput),
+		schema: runtimeReportingHealthStateSchema
+	});
+	if (!(state && expectedServiceIdentity)) return state;
+	return isSameServiceIdentity(state.serviceIdentity, expectedServiceIdentity) ? state : createInitialRuntimeReportingHealthState(expectedServiceIdentity);
+}
+async function recordRuntimeReportingFailure(input) {
+	return await updateRuntimeReportingHealthState(input.pathInput, input.serviceIdentity, (current) => {
+		const channelState = current[input.channel];
+		const observedAt = input.at ?? (/* @__PURE__ */ new Date()).toISOString();
+		return {
+			...current,
+			[input.channel]: {
+				...channelState,
+				applicability: {
+					observedAt,
+					status: "applicable"
+				},
+				consecutiveFailures: channelState.consecutiveFailures + 1,
+				lastFailure: {
+					at: observedAt,
+					reasonCode: normalizeDiagnosticText({
+						fallback: "runtime.reporting.failed",
+						maxLength: 160,
+						value: input.reasonCode
+					}),
+					message: normalizeDiagnosticText({
+						fallback: "Runtime reporting failed.",
+						maxLength: 500,
+						value: input.message
+					})
+				},
+				lastSuccessAt: channelState.applicability?.status === "not_applicable" ? null : channelState.lastSuccessAt
+			}
+		};
+	});
+}
+function normalizeDiagnosticText(input) {
+	return (input.value.replace(DIAGNOSTIC_WHITESPACE_RE, " ").trim() || input.fallback).slice(0, input.maxLength);
+}
+async function recordRuntimeReportingSuccess(input) {
+	return await updateRuntimeReportingHealthState(input.pathInput, input.serviceIdentity, (current) => {
+		const observedAt = input.at ?? (/* @__PURE__ */ new Date()).toISOString();
+		return {
+			...current,
+			[input.channel]: {
+				applicability: {
+					observedAt,
+					status: "applicable"
+				},
+				lastSuccessAt: observedAt,
+				consecutiveFailures: 0,
+				lastFailure: null
+			}
+		};
+	});
+}
+async function recordRuntimeReportingNotApplicable(input) {
+	return await updateRuntimeReportingHealthState(input.pathInput, input.serviceIdentity, (current) => ({
+		...current,
+		[input.channel]: {
+			...current[input.channel],
+			applicability: {
+				observedAt: input.at ?? (/* @__PURE__ */ new Date()).toISOString(),
+				status: "not_applicable"
+			},
+			consecutiveFailures: 0,
+			lastFailure: null
+		}
+	}));
+}
+function createInitialRuntimeReportingHealthState(serviceIdentity) {
+	return {
+		schema: RUNTIME_REPORTING_HEALTH_SCHEMA_NAME,
+		v: 1,
+		serviceIdentity,
+		serviceIdentityObservedAt: (/* @__PURE__ */ new Date()).toISOString(),
+		runtimeAgentController: createInitialRuntimeReportingChannelHealth(),
+		providerConversationProof: createInitialRuntimeReportingChannelHealth()
+	};
+}
+function createInitialRuntimeReportingChannelHealth() {
+	return {
+		lastSuccessAt: null,
+		consecutiveFailures: 0,
+		lastFailure: null
+	};
+}
+async function writeRuntimeReportingHealthState(state, pathInput = {}) {
+	await writeDaemonLocalStateFile({
+		path: runtimeReportingHealthStatePath(pathInput),
+		schema: runtimeReportingHealthStateSchema,
+		value: state,
+		mode: 384
+	});
+}
+function updateRuntimeReportingHealthState(pathInput, serviceIdentity, update) {
+	const path = runtimeReportingHealthStatePath(pathInput);
+	const updatePromise = (stateUpdateQueueByPath.get(path) ?? Promise.resolve()).then(async () => {
+		const next = update(await readRuntimeReportingHealthState(pathInput, serviceIdentity) ?? createInitialRuntimeReportingHealthState(serviceIdentity));
+		await writeRuntimeReportingHealthState(next, pathInput);
+		return next;
+	});
+	const queueTail = updatePromise.then(() => void 0, () => void 0);
+	stateUpdateQueueByPath.set(path, queueTail);
+	return updatePromise.finally(() => {
+		if (stateUpdateQueueByPath.get(path) === queueTail) stateUpdateQueueByPath.delete(path);
+	});
+}
+function isSameServiceIdentity(left, right) {
+	return left?.deviceId === right.deviceId && left.contractGeneration === right.contractGeneration;
+}
+//#endregion
 //#region src/runtime/dispatch-space-progress-relay.ts
 const DISPATCH_PROGRESS_RELAY_FILENAME = "progress.ndjson";
 const DISPATCH_PROGRESS_RELAY_POLL_INTERVAL_MS = 50;
@@ -3246,45 +3409,159 @@ function assertContainedWorkspace(boundaryRoot, workspacePath) {
 	return within.split(sep).join("/");
 }
 //#endregion
-//#region src/local-service/state/ledger-io.ts
-function createLedgerIo() {
+//#region src/local-service/dispatch/execution-context-git-config.ts
+const entries = z.record(z.string(), z.array(z.string()));
+const executionContextGitConfigBaselineSchema = z.strictObject({
+	common: entries,
+	worktree: entries
+});
+const EXECUTABLE_KEY = /^(?:core\.(?:fsmonitor|hooksPath|sshCommand|worktree|pager|editor)|filter\..+|.+\.textconv|diff\..+\.command|credential\.helper|include\.path|includeIf\..+\.path|sequence\.editor|gpg\..*program|uploadpack\.packObjectsHook)$/iu;
+const HOOK_INSTALLER = /\b(?:husky|lefthook)\b/u;
+function executableSetting(key, values) {
+	return EXECUTABLE_KEY.test(key) || key.toLowerCase().startsWith("alias.") && values.some((value) => value.trimStart().startsWith("!"));
+}
+async function readConfig(path, run) {
+	const info = await lstat(path).catch((error) => {
+		if (error.code === "ENOENT") return null;
+		throw error;
+	});
+	if (!info) return {};
+	if (!info.isFile() || info.nlink !== 1 || info.size > 64 * 1024) throw new Error("execution_context.workspace_git_config_invalid");
+	const output = await run(dirname(path), [
+		"config",
+		"--file",
+		path,
+		"--no-includes",
+		"--null",
+		"--list"
+	]);
+	const result = {};
+	for (const field of output.split("\0")) {
+		if (!field) continue;
+		const separator = field.indexOf("\n");
+		const key = (separator < 0 ? field : field.slice(0, separator)).toLowerCase();
+		const value = separator < 0 ? "" : field.slice(separator + 1);
+		result[key] ??= [];
+		result[key].push(value);
+	}
+	return result;
+}
+function configPaths(root) {
 	return {
-		appendFile: async (filePath, content, encoding) => {
-			await mkdir(dirnamePath(filePath), { recursive: true });
-			await appendFile(filePath, content, { encoding });
-		},
-		copyFile: async (fromPath, toPath) => {
-			await mkdir(dirnamePath(toPath), { recursive: true });
-			await copyFile(fromPath, toPath);
-		},
-		mkdir: async (dirPath, options) => {
-			await mkdir(dirPath, options);
-		},
-		readFile: async (filePath, encoding) => {
-			return await readFile(filePath, encoding);
-		},
-		rename: async (fromPath, toPath) => {
-			await mkdir(dirnamePath(toPath), { recursive: true });
-			await rename(fromPath, toPath);
-		},
-		syncPath: async (fileOrDirectoryPath) => {
-			const isWindows = process.platform === "win32";
-			if (isWindows && (await stat(fileOrDirectoryPath)).isDirectory()) return;
-			const handle = await open(fileOrDirectoryPath, isWindows ? "r+" : "r");
-			try {
-				await handle.sync();
-			} finally {
-				await handle.close();
+		common: join(root, "repository.git/config"),
+		worktree: join(root, "repository.git/worktrees/worktree/config.worktree")
+	};
+}
+async function captureExecutionContextGitConfig(root, run) {
+	const paths = configPaths(root);
+	const result = {
+		common: await readConfig(paths.common, run),
+		worktree: await readConfig(paths.worktree, run)
+	};
+	for (const group of Object.values(result)) for (const [key, values] of Object.entries(group)) if (!executableSetting(key, values)) delete group[key];
+	return result;
+}
+function baselinePath(ledgerRoot, contextId) {
+	if (!z.uuid().safeParse(contextId).success) throw new Error("execution_context.workspace_identity_mismatch");
+	return join(ledgerRoot, "execution-context-git-config-baselines", `${contextId}.json`);
+}
+async function saveExecutionContextGitConfigBaseline(ledgerRoot, contextId, baseline) {
+	const path = baselinePath(ledgerRoot, contextId);
+	await mkdir(dirname(path), {
+		recursive: true,
+		mode: 448
+	});
+	const temporary = `${path}.${randomUUID()}.tmp`;
+	const file = await open(temporary, "wx", 384);
+	try {
+		await file.writeFile(JSON.stringify(baseline), "utf8");
+		await file.sync();
+	} finally {
+		await file.close();
+	}
+	await rename(temporary, path);
+}
+async function readExecutionContextGitConfigBaseline(ledgerRoot, contextId) {
+	const path = baselinePath(ledgerRoot, contextId);
+	const info = await lstat(path);
+	if (!info.isFile() || info.nlink !== 1 || info.size > 256 * 1024) throw new Error("execution_context.workspace_git_config_baseline_invalid");
+	return executionContextGitConfigBaselineSchema.parse(JSON.parse(await readFile(path, "utf8")));
+}
+async function isDeclaredHookInstaller(worktree, value, run) {
+	const path = resolve(worktree, value);
+	const child = relative(worktree, path);
+	if (!child || isAbsolute(child) || child === ".." || child.startsWith(`..${sep}`)) return false;
+	const canonical = await realpath(path).catch(() => null);
+	if (!canonical || canonical !== path) return false;
+	const packageText = await run(worktree, ["show", "HEAD:package.json"]).catch(() => null);
+	if (!packageText) return false;
+	let packageValue;
+	try {
+		packageValue = JSON.parse(packageText);
+	} catch {
+		return false;
+	}
+	const parsed = z.object({ scripts: z.record(z.string(), z.string()).optional() }).safeParse(packageValue);
+	if (!(parsed.success && Object.values(parsed.data.scripts ?? {}).some((script) => HOOK_INSTALLER.test(script)))) return false;
+	return (await run(worktree, [
+		"ls-tree",
+		"-r",
+		"--name-only",
+		"HEAD",
+		"--",
+		child.split(sep)[0] ?? child
+	])).length > 0;
+}
+async function restoreSetting(input) {
+	try {
+		await input.run(input.worktree, [
+			"config",
+			"--file",
+			input.path,
+			"--unset-all",
+			input.key
+		]);
+		for (const value of input.values) await input.run(input.worktree, [
+			"config",
+			"--file",
+			input.path,
+			"--add",
+			input.key,
+			value
+		]);
+	} catch {
+		throw new Error("execution_context.workspace_git_config_audit_failed");
+	}
+}
+async function auditExecutionContextGitConfig(input) {
+	const audit = {
+		restoredSettings: 0,
+		declaredHookInstallers: 0,
+		unverifiedHookSettings: 0
+	};
+	const worktree = join(input.root, "worktree");
+	const paths = configPaths(input.root);
+	for (const group of ["common", "worktree"]) {
+		const path = paths[group];
+		const current = await readConfig(path, input.run);
+		for (const [key, values] of Object.entries(current)) {
+			if (!executableSetting(key, values) || JSON.stringify(values) === JSON.stringify(input.baseline[group][key])) continue;
+			if (key === "core.hookspath") {
+				if (await isDeclaredHookInstaller(worktree, values.at(-1) ?? "", input.run)) audit.declaredHookInstallers += 1;
+				else audit.unverifiedHookSettings += 1;
+				continue;
 			}
-		},
-		rm: async (filePath, options) => {
-			await rm(filePath, options);
-		},
-		writeFile: async (filePath, content, encoding) => {
-			await mkdir(dirnamePath(filePath), { recursive: true });
-			await writeFile(filePath, content, encoding);
+			await restoreSetting({
+				run: input.run,
+				worktree,
+				path,
+				key,
+				values: input.baseline[group][key] ?? []
+			});
+			audit.restoredSettings += 1;
 		}
-	};
+	}
+	return audit;
 }
 //#endregion
 //#region src/local-service/dispatch/execution-context-workspace.ts
@@ -3489,6 +3766,7 @@ async function markExecutionContextWorkspaceInUse(input) {
 			const path = join(root, "execution-context-workspace-records", `${context.id}.json`);
 			const record = await readManifest(path);
 			if (record?.status !== "completed") throw failure("workspace_execution_quiescence_unconfirmed");
+			await saveExecutionContextGitConfigBaseline(root, context.id, await captureExecutionContextGitConfig(record.boundaryRoot, git));
 			await writeManifest(path, {
 				...record,
 				status: "in_use",
@@ -3509,6 +3787,15 @@ async function markExecutionContextWorkspaceInUse(input) {
 		throw error;
 	}
 }
+async function auditWorkspaceGitConfig(input) {
+	if (!input.use) return;
+	const audit = await auditExecutionContextGitConfig({
+		root: input.boundaryRoot,
+		baseline: await readExecutionContextGitConfigBaseline(input.ledgerRoot, input.contextId),
+		run: git
+	});
+	return Object.values(audit).some((count) => count > 0) ? audit : void 0;
+}
 async function releaseExecutionContextWorkspace(input) {
 	const root = await canonicalDirectory(input.ledgerRootPath);
 	try {
@@ -3528,6 +3815,12 @@ async function releaseExecutionContextWorkspace(input) {
 				status: "retained",
 				reason: "execution_quiescence_unconfirmed"
 			};
+			const gitConfigAudit = await auditWorkspaceGitConfig({
+				use: input.use,
+				boundaryRoot: record.boundaryRoot,
+				ledgerRoot: root,
+				contextId: input.context.id
+			});
 			const { activeAttemptId: _activeAttemptId, activeDispatchId: _activeDispatchId, containerRuntime: _containerRuntime, ...quiescentRecord } = record;
 			const completed = {
 				...quiescentRecord,
@@ -3537,24 +3830,32 @@ async function releaseExecutionContextWorkspace(input) {
 			record = await removePristineRetirement(completed, path);
 			if (record.retirement) return {
 				status: "retained",
-				reason: "cleanup_incomplete"
+				reason: "cleanup_incomplete",
+				gitConfigAudit
 			};
 			if (!record.pristineFingerprint) return {
 				status: "retained",
-				reason: "baseline_unverified"
+				reason: "baseline_unverified",
+				gitConfigAudit
 			};
 			await verifyRetainedWorkspace(record);
 			if (await fingerprintDirectory(record.boundaryRoot) !== record.pristineFingerprint) return {
 				status: "retained",
-				reason: "workspace_changed"
+				reason: "workspace_changed",
+				gitConfigAudit
 			};
 			if (record.sourceWorkingDirectory && !await sourceHasCommit(record)) return {
 				status: "retained",
-				reason: "source_commit_unavailable"
+				reason: "source_commit_unavailable",
+				gitConfigAudit
 			};
-			return (await retirePristineWorkspace(record, path)).status === "released" ? { status: "released" } : {
+			return (await retirePristineWorkspace(record, path)).status === "released" ? {
+				status: "released",
+				gitConfigAudit
+			} : {
 				status: "retained",
-				reason: "workspace_changed"
+				reason: "workspace_changed",
+				gitConfigAudit
 			};
 		});
 	} finally {
@@ -3756,7 +4057,17 @@ async function acquireWorkspaceExecutionLock(root, contextId) {
 	});
 }
 function workspaceResult(manifest) {
+	const repository = join(manifest.boundaryRoot, "repository.git");
+	const gitDirectory = join(repository, "worktrees", "worktree");
 	return {
+		...manifest.sourceWorkingDirectory ? { gitMetadata: {
+			commonDirectoryPointerPath: join(gitDirectory, "commondir"),
+			configPath: join(repository, "config"),
+			gitDirectoryPointerPath: join(gitDirectory, "gitdir"),
+			hooksPath: join(repository, "hooks"),
+			worktreeConfigPath: join(gitDirectory, "config.worktree"),
+			worktreeGitPointerPath: join(manifest.workingDirectory, ".git")
+		} } : {},
 		workingDirectory: manifest.workingDirectory,
 		boundaryRoot: manifest.boundaryRoot,
 		...manifest.sourceWorkingDirectory ? { sourceWorkingDirectory: manifest.sourceWorkingDirectory } : {},
@@ -3870,38 +4181,17 @@ function within(child, parent) {
 	const path = relative(resolve(parent), child);
 	return path === "" || path !== ".." && !path.startsWith(`..${sep}`) && !isAbsolute(path);
 }
-const GIT_SETTINGS = {
-	"core.hooksPath": "/dev/null",
-	"core.attributesFile": "/dev/null",
-	"core.fsmonitor": "false",
-	"credential.helper": "",
-	"protocol.allow": "never",
-	"protocol.file.allow": "always",
-	"fetch.recurseSubmodules": "false",
-	"submodule.recurse": "false",
-	"uploadpack.packObjectsHook": "",
-	"gc.auto": "0",
-	"maintenance.auto": "false"
-};
 async function git(cwd, args, processSupervisionId) {
-	const env = Object.fromEntries(Object.entries(process.env).filter(([key]) => !key.startsWith("GIT_")));
-	Object.assign(env, {
-		...processSupervisionId ? { OPENMELD_PROCESS_SUPERVISION_ID: processSupervisionId } : {},
-		GIT_CONFIG_NOSYSTEM: "1",
-		GIT_CONFIG_SYSTEM: "/dev/null",
-		GIT_CONFIG_GLOBAL: "/dev/null",
-		GIT_ATTR_NOSYSTEM: "1",
-		GIT_NO_REPLACE_OBJECTS: "1",
-		GIT_NO_LAZY_FETCH: "1",
-		GIT_ALLOW_PROTOCOL: "file",
-		GIT_TERMINAL_PROMPT: "0",
-		GIT_CONFIG_COUNT: String(Object.keys(GIT_SETTINGS).length)
-	});
-	for (const [index, [key, value]] of Object.entries(GIT_SETTINGS).entries()) {
-		env[`GIT_CONFIG_KEY_${index}`] = key;
-		env[`GIT_CONFIG_VALUE_${index}`] = value;
-	}
-	return (await execFileAsync$1("git", args, {
+	const env = createServiceGitEnvironment();
+	Object.assign(env, { ...processSupervisionId ? { OPENMELD_PROCESS_SUPERVISION_ID: processSupervisionId } : {} });
+	return (await execFileAsync$1("git", [
+		"-c",
+		"core.fsmonitor=false",
+		"-c",
+		"core.hooksPath=/dev/null",
+		...await lstat(join(cwd, ".git")).catch(() => null) ? ["-c", `core.worktree=${cwd}`] : [],
+		...args
+	], {
 		cwd,
 		env,
 		encoding: "utf8",
@@ -5632,128 +5922,6 @@ async function fetchSpaceUpdates(input) {
 	return parsed.data;
 }
 //#endregion
-//#region src/local-service/state/runtime-reporting-health-state.ts
-const RUNTIME_REPORTING_HEALTH_FILENAME = "reporting-health.json";
-const DIAGNOSTIC_WHITESPACE_RE = /\s+/gu;
-const stateUpdateQueueByPath = /* @__PURE__ */ new Map();
-function runtimeReportingHealthStatePath(pathInput = {}) {
-	return join(daemonRuntimeStateRootPath(pathInput), RUNTIME_REPORTING_HEALTH_FILENAME);
-}
-async function readRuntimeReportingHealthState(pathInput = {}, expectedServiceIdentity) {
-	const state = await readDaemonLocalStateFile({
-		path: runtimeReportingHealthStatePath(pathInput),
-		schema: runtimeReportingHealthStateSchema
-	});
-	if (!(state && expectedServiceIdentity)) return state;
-	return isSameServiceIdentity(state.serviceIdentity, expectedServiceIdentity) ? state : createInitialRuntimeReportingHealthState(expectedServiceIdentity);
-}
-async function recordRuntimeReportingFailure(input) {
-	return await updateRuntimeReportingHealthState(input.pathInput, input.serviceIdentity, (current) => {
-		const channelState = current[input.channel];
-		const observedAt = input.at ?? (/* @__PURE__ */ new Date()).toISOString();
-		return {
-			...current,
-			[input.channel]: {
-				...channelState,
-				applicability: {
-					observedAt,
-					status: "applicable"
-				},
-				consecutiveFailures: channelState.consecutiveFailures + 1,
-				lastFailure: {
-					at: observedAt,
-					reasonCode: normalizeDiagnosticText({
-						fallback: "runtime.reporting.failed",
-						maxLength: 160,
-						value: input.reasonCode
-					}),
-					message: normalizeDiagnosticText({
-						fallback: "Runtime reporting failed.",
-						maxLength: 500,
-						value: input.message
-					})
-				},
-				lastSuccessAt: channelState.applicability?.status === "not_applicable" ? null : channelState.lastSuccessAt
-			}
-		};
-	});
-}
-function normalizeDiagnosticText(input) {
-	return (input.value.replace(DIAGNOSTIC_WHITESPACE_RE, " ").trim() || input.fallback).slice(0, input.maxLength);
-}
-async function recordRuntimeReportingSuccess(input) {
-	return await updateRuntimeReportingHealthState(input.pathInput, input.serviceIdentity, (current) => {
-		const observedAt = input.at ?? (/* @__PURE__ */ new Date()).toISOString();
-		return {
-			...current,
-			[input.channel]: {
-				applicability: {
-					observedAt,
-					status: "applicable"
-				},
-				lastSuccessAt: observedAt,
-				consecutiveFailures: 0,
-				lastFailure: null
-			}
-		};
-	});
-}
-async function recordRuntimeReportingNotApplicable(input) {
-	return await updateRuntimeReportingHealthState(input.pathInput, input.serviceIdentity, (current) => ({
-		...current,
-		[input.channel]: {
-			...current[input.channel],
-			applicability: {
-				observedAt: input.at ?? (/* @__PURE__ */ new Date()).toISOString(),
-				status: "not_applicable"
-			},
-			consecutiveFailures: 0,
-			lastFailure: null
-		}
-	}));
-}
-function createInitialRuntimeReportingHealthState(serviceIdentity) {
-	return {
-		schema: RUNTIME_REPORTING_HEALTH_SCHEMA_NAME,
-		v: 1,
-		serviceIdentity,
-		serviceIdentityObservedAt: (/* @__PURE__ */ new Date()).toISOString(),
-		runtimeAgentController: createInitialRuntimeReportingChannelHealth(),
-		providerConversationProof: createInitialRuntimeReportingChannelHealth()
-	};
-}
-function createInitialRuntimeReportingChannelHealth() {
-	return {
-		lastSuccessAt: null,
-		consecutiveFailures: 0,
-		lastFailure: null
-	};
-}
-async function writeRuntimeReportingHealthState(state, pathInput = {}) {
-	await writeDaemonLocalStateFile({
-		path: runtimeReportingHealthStatePath(pathInput),
-		schema: runtimeReportingHealthStateSchema,
-		value: state,
-		mode: 384
-	});
-}
-function updateRuntimeReportingHealthState(pathInput, serviceIdentity, update) {
-	const path = runtimeReportingHealthStatePath(pathInput);
-	const updatePromise = (stateUpdateQueueByPath.get(path) ?? Promise.resolve()).then(async () => {
-		const next = update(await readRuntimeReportingHealthState(pathInput, serviceIdentity) ?? createInitialRuntimeReportingHealthState(serviceIdentity));
-		await writeRuntimeReportingHealthState(next, pathInput);
-		return next;
-	});
-	const queueTail = updatePromise.then(() => void 0, () => void 0);
-	stateUpdateQueueByPath.set(path, queueTail);
-	return updatePromise.finally(() => {
-		if (stateUpdateQueueByPath.get(path) === queueTail) stateUpdateQueueByPath.delete(path);
-	});
-}
-function isSameServiceIdentity(left, right) {
-	return left?.deviceId === right.deviceId && left.contractGeneration === right.contractGeneration;
-}
-//#endregion
-export { enqueueControllerTaskLifecycleEventWhileLocked as A, resolveAgentActivityDispatcherCommand as B, startDispatchSpaceProgressRelay as C, recordOpenMeldCreatedLocalAgentSession as D, discoverLocalAgentSessionProviders as E, unregisterAgentActivityRoute as F, AGENT_ACTIVITY_INTEGRATION_OWNER as I, defaultManagedIntegrationPaths as L, isAgentActivityRouteRegistered as M, registerAgentActivityRoute as N, readAgentActivityContextForPath as O, resolveAgentActivityRouteForPath as P, installAgentActivityIntegrations as R, prepareClaudeProjectContainer as S, syncLocalAgentActivity as T, uninstallAgentActivityIntegrations as V, markExecutionContextWorkspaceInUse as _, fetchSpaceUpdates as a, releaseExecutionContextWorkspace as b, materializeOrganizationSkillRelease as c, runSpaceActionHelp as d, runSpaceActionReply as f, runSpaceActionWake as g, runSpaceActionTargets as h, recordRuntimeReportingSuccess as i, readControllerTaskLifecycleOutboxHealth as j, removeAgentActivityContextCache as k, createDispatchSpaceTools as l, runSpaceActionStatus as m, recordRuntimeReportingFailure as n, createSpaceWorkingCopies as o, runSpaceActionSilent as p, recordRuntimeReportingNotApplicable as r, downloadWorkingCopyFile as s, readRuntimeReportingHealthState as t, runSpaceActionMcpServer as u, prepareExecutionContextWorkspace as v, startLocalAgentActivitySyncLoop as w, createLedgerIo as x, readExecutionContextWorkspace as y, readAgentActivityIntegrationStatus as z };
+export { enqueueControllerTaskLifecycleEventWhileLocked as A, resolveAgentActivityDispatcherCommand as B, createLedgerIo as C, recordOpenMeldCreatedLocalAgentSession as D, discoverLocalAgentSessionProviders as E, unregisterAgentActivityRoute as F, AGENT_ACTIVITY_INTEGRATION_OWNER as I, defaultManagedIntegrationPaths as L, isAgentActivityRouteRegistered as M, registerAgentActivityRoute as N, readAgentActivityContextForPath as O, resolveAgentActivityRouteForPath as P, installAgentActivityIntegrations as R, recordRuntimeReportingSuccess as S, syncLocalAgentActivity as T, uninstallAgentActivityIntegrations as V, prepareClaudeProjectContainer as _, createDispatchSpaceTools as a, recordRuntimeReportingFailure as b, runSpaceActionReply as c, runSpaceActionTargets as d, runSpaceActionWake as f, releaseExecutionContextWorkspace as g, readExecutionContextWorkspace as h, materializeOrganizationSkillRelease as i, readControllerTaskLifecycleOutboxHealth as j, removeAgentActivityContextCache as k, runSpaceActionSilent as l, prepareExecutionContextWorkspace as m, createSpaceWorkingCopies as n, runSpaceActionMcpServer as o, markExecutionContextWorkspaceInUse as p, downloadWorkingCopyFile as r, runSpaceActionHelp as s, fetchSpaceUpdates as t, runSpaceActionStatus as u, startDispatchSpaceProgressRelay as v, startLocalAgentActivitySyncLoop as w, recordRuntimeReportingNotApplicable as x, readRuntimeReportingHealthState as y, readAgentActivityIntegrationStatus as z };
 
-//# sourceMappingURL=runtime-reporting-health-state-a1FUE1S-.js.map
+//# sourceMappingURL=updates-api-B0f4KyCg.js.map