openmeld 0.3.246 → 0.3.248

package/dist/{service-BEH6-P8U.js → service-8EozP77B.js}

@@ -1,48 +1,50 @@
 #!/usr/bin/env node
 
-import { At as ensureOpenMeldManagedProfileWorkspace, Br as applyIntervalJitterMs$1, Bt as createMutableRouteCatalogState, Fn as DaemonServiceRunError, Fr as resolveRouteRegistrationReconcileDecision, Ft as resolveConfiguredProfileWorkspacePathForAccount, Hr as resolveAdaptiveHeartbeatIntervalMs, Ht as summarizeSkippedDaemonProfiles, I as listAgentTargetStates, Ir as ADAPTIVE_HEARTBEAT_JITTER_RATIO, It as setCustomProfileWorkspace, Jn as buildAuthenticatedControlPlaneResponse, Jt as isDaemonReconcileInProgressError, Lr as MAX_HEARTBEAT_INTERVAL_MS, Mn as emitDriftDetectedEvidence, Nn as emitReconcileCompletedEvidence, Nt as readProfileWorkspaceConfigForAccount, O as syncDeviceRuntimeStateProjection, Ot as resolveRegistryRuntimeAdapterCapabilitySnapshot, Pn as emitReconcileStartedEvidence, Rr as MIN_HEARTBEAT_INTERVAL_MS, Ur as resolveCatalogSyncIntervalMs, Ut as syncDaemonRouteCatalogState, Vr as pruneStaleLeases, Vt as createRouteCatalogFromMutableState, _t as removeProjectConnection, bt as setDefaultProjectConnection, ct as ProjectBindingOperationError, ft as listProjectBindings, gt as removeMissingProjectConnections, ln as resolveCatalogSyncSkippedProfilesLogState, lt as ProjectBindingStoreUpdateRequiredError, pt as listProjectConnectionsWithStatus, tn as buildLocalServiceDiagnosticsPayload, ut as bindProject, zr as applyAcceptedLeases } from "./prepare-provider-runtime-_XRIioDp.js";
+import { At as ensureOpenMeldManagedProfileWorkspace, Br as applyAcceptedLeases, Bt as createMutableRouteCatalogState, Cn as resolveInstalledCodexLaunchCandidates, Ct as resolveLocalProjectConnectionForPath, Fn as emitReconcileStartedEvidence, Ft as resolveConfiguredProfileWorkspacePathForAccount, Hr as pruneStaleLeases, I as listAgentTargetStates, In as DaemonServiceRunError, Ir as resolveRouteRegistrationReconcileDecision, It as setCustomProfileWorkspace, Lr as ADAPTIVE_HEARTBEAT_JITTER_RATIO, Nn as emitDriftDetectedEvidence, Nt as readProfileWorkspaceConfigForAccount, O as syncDeviceRuntimeStateProjection, Ot as resolveRegistryRuntimeAdapterCapabilitySnapshot, Pn as emitReconcileCompletedEvidence, Rr as MAX_HEARTBEAT_INTERVAL_MS, Ur as resolveAdaptiveHeartbeatIntervalMs, Ut as summarizeSkippedDaemonProfiles, Vr as applyIntervalJitterMs$1, Vt as createRouteCatalogFromMutableState, Wr as resolveCatalogSyncIntervalMs, Wt as syncDaemonRouteCatalogState, Yn as buildAuthenticatedControlPlaneResponse, Yt as isDaemonReconcileInProgressError, _t as removeProjectConnection, bt as setDefaultProjectConnection, ct as ProjectBindingOperationError, ft as listProjectBindings, gt as removeMissingProjectConnections, lt as ProjectBindingStoreUpdateRequiredError, nn as buildLocalServiceDiagnosticsPayload, pt as listProjectConnectionsWithStatus, un as resolveCatalogSyncSkippedProfilesLogState, ut as bindProject, zr as MIN_HEARTBEAT_INTERVAL_MS } from "./prepare-provider-runtime-CWZOcEF7.js";
 import { D as openMeldRootDir, F as resolveOpenMeldRootDir, I as resolveOpenMeldServiceOwnedPathInput, P as resolveOpenMeldEnvPreset, h as isPublishedOpenMeldHome, o as accountsDir, y as normalizeAccountKey } from "./paths-De9xdA2h.js";
 import { r as resolveAuthBaseUrl } from "./auth-url-6Bb6YdNm.js";
-import { A as runtimeTransportLocalAgentControlRefreshCatalogFramePayloadSchema, C as runtimeTransportHeartbeatRequestSchema, Cr as OPENMELD_LOCAL_FOLDER_PICKER_CAPABILITY_HEADER, Er as localFolderPickerHelperResultSchema, F as runtimeTransportOpenMeldToolsControlResultFramePayloadSchema, I as runtimeTransportRegisterSessionRequestSchema, M as runtimeTransportLocalAgentControlSetProfileWorkspaceFramePayloadSchema, P as runtimeTransportOpenMeldToolsControlFramePayloadSchema, Sr as LOCAL_FOLDER_PICKER_RUNTIME_CAPABILITY, Tr as localFolderPickerHelperProtocolResultSchema, V as runtimeTransportRouteCatalogChangedFramePayloadSchema, gr as OPENMELD_REASONING_STREAM_HEADER, n as OPENMELD_ADMISSION_EVIDENCE_HEADER, nn as OPENMELD_COMPUTER_CARE_HEADER, ot as sanitizeDispatchErrorSummary, qt as SPACE_WORK_HANDOFF_CAPABILITY_HEADER, r as OPENMELD_EXECUTION_ADMISSION_HEADER, s as localWakeRouteWorkingFolderObservationSchema, t as CURRENT_DAEMON_EXECUTION_CONTRACT_EPOCH, wr as localFolderPickerDaemonFrameSchema } from "./runtime-transport-BzCp9hM3.js";
+import { A as runtimeTransportLocalAgentControlRefreshCatalogFramePayloadSchema, Ar as localFolderPickerHelperProtocolResultSchema, C as runtimeTransportHeartbeatRequestSchema, Dr as LOCAL_FOLDER_PICKER_RUNTIME_CAPABILITY, F as runtimeTransportOpenMeldToolsControlResultFramePayloadSchema, I as runtimeTransportRegisterSessionRequestSchema, M as runtimeTransportLocalAgentControlSetProfileWorkspaceFramePayloadSchema, Or as OPENMELD_LOCAL_FOLDER_PICKER_CAPABILITY_HEADER, P as runtimeTransportOpenMeldToolsControlFramePayloadSchema, V as runtimeTransportRouteCatalogChangedFramePayloadSchema, jr as localFolderPickerHelperResultSchema, kr as localFolderPickerDaemonFrameSchema, n as OPENMELD_ADMISSION_EVIDENCE_HEADER, nn as OPENMELD_COMPUTER_CARE_HEADER, ot as sanitizeDispatchErrorSummary, qt as SPACE_WORK_HANDOFF_CAPABILITY_HEADER, r as OPENMELD_EXECUTION_ADMISSION_HEADER, s as localWakeRouteWorkingFolderObservationSchema, t as CURRENT_DAEMON_EXECUTION_CONTRACT_EPOCH, xr as OPENMELD_REASONING_STREAM_HEADER } from "./runtime-transport-DFBYm5Re.js";
 import { s as openMeldDaemonControlPlaneResponseSchema } from "./control-plane-B93wmVS6.js";
 import { a as formatLocalSetupActionLabel, i as formatLocalSetupActionDescription, n as formatLocalComponentsSummaryDescription, o as installedLocalComponentsSnapshotSchema, r as formatLocalComponentsSummaryLabel } from "./local-components-jXECvlEY.js";
-import { Gi as serviceConnectionEvidenceJournalSchema, Ji as localProjectControlDaemonFrameSchema, Wi as serviceConnectionEvidenceEventSchema, Yi as localProjectControlDiscoverProjectsResponseSchema, Yn as DAEMON_STREAM_KEEPALIVE_PING, _r as betterAuthDeviceAuthorizationCodeResponseSchema, br as betterAuthDeviceAuthorizationTokenResponseSchema, gr as betterAuthDeviceAuthorizationCodeRequestSchema, hr as BETTER_AUTH_DEVICE_AUTHORIZATION_GRANT_TYPE, ia as computerFileAccessDaemonFrameSchema, mn as createServiceConnectionEvidenceApi, na as COMPUTER_FILE_ACCESS_RUNTIME_CAPABILITY, ra as OPENMELD_RUNTIME_CAPABILITIES_HEADER, vr as betterAuthDeviceAuthorizationErrorResponseSchema, xr as betterAuthSessionSnapshotResponseSchema, yr as betterAuthDeviceAuthorizationTokenRequestSchema } from "./dist-KibLweLD.js";
+import { Br as sessionHistoryPolicySchema, Cr as betterAuthSessionSnapshotResponseSchema, Hr as sessionHistoryRequestFrameSchema, Ir as SESSION_HISTORY_CAPABILITY_HEADER, Lr as SESSION_HISTORY_RUNTIME_CAPABILITY, Rr as sessionHistoryAuditSchema, Sr as betterAuthDeviceAuthorizationTokenResponseSchema, Ur as sessionHistoryResultFrameSchema, Xi as serviceConnectionEvidenceJournalSchema, Yi as serviceConnectionEvidenceEventSchema, Zn as DAEMON_STREAM_KEEPALIVE_PING, _r as BETTER_AUTH_DEVICE_AUTHORIZATION_GRANT_TYPE, br as betterAuthDeviceAuthorizationErrorResponseSchema, da as OPENMELD_RUNTIME_CAPABILITIES_HEADER, fa as computerFileAccessDaemonFrameSchema, hn as createServiceConnectionEvidenceApi, na as localProjectControlDaemonFrameSchema, ra as localProjectControlDiscoverProjectsResponseSchema, ua as COMPUTER_FILE_ACCESS_RUNTIME_CAPABILITY, vr as betterAuthDeviceAuthorizationCodeRequestSchema, xr as betterAuthDeviceAuthorizationTokenRequestSchema, yr as betterAuthDeviceAuthorizationCodeResponseSchema } from "./dist-BQcUIyf6.js";
 import { o as resolveCliBinaryPlatform } from "./cli-binary-manifest-ChuzORh3.js";
-import { D as ServiceAccountAdmissionError, S as setAuthSession, _ as onAuthSessionCredentialAvailable, a as beginAuthSessionTransition, d as getAuthSessionState, i as assertAuthSessionMutationAvailable, o as buildStoredAuthSessionIdentity, s as clearAuthSession, v as onAuthSessionCredentialObservation, w as withAdmittedServiceSession } from "./auth-session-JhILeJRO.js";
+import { D as ServiceAccountAdmissionError, S as setAuthSession, _ as onAuthSessionCredentialAvailable, a as beginAuthSessionTransition, d as getAuthSessionState, i as assertAuthSessionMutationAvailable, o as buildStoredAuthSessionIdentity, s as clearAuthSession, v as onAuthSessionCredentialObservation, w as withAdmittedServiceSession } from "./auth-session-DywRZLBr.js";
 import { r as daemonServiceLaneSchema } from "./service-contract-CRyDcIIf.js";
-import { A as DEFAULT_RECONNECT_DELAY_MS, C as CONTROLLED_SHUTDOWN_SOCKET_CLOSE_TIMEOUT_MS, D as DAEMON_STREAM_CONNECT_TIMEOUT_MS, F as REGISTER_RESPONSE_TIMEOUT_MS, I as RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_INTERVAL_MS, L as RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_RETRY_INTERVAL_MS, M as MAX_RECONNECT_DELAY_MS, N as PROVIDER_CONVERSATION_PROOF_SYNC_INTERVAL_MS, O as DAEMON_STREAM_KEEPALIVE_INTERVAL_MS, P as PROVIDER_CONVERSATION_PROOF_SYNC_RETRY_INTERVAL_MS, R as RUNTIME_STATE_PERSIST_MIN_INTERVAL_MS, _ as toErrorMessage$5, b as CATALOG_SYNC_SIGNAL_POLL_INTERVAL_MS, c as normalizeHeartbeatIntervalMs, d as normalizeText$1, f as nowIsoString, i as resolvePreferredDaemonDeviceId, j as HEARTBEAT_RESPONSE_TIMEOUT_MS, k as DAEMON_STREAM_KEEPALIVE_PONG_TIMEOUT_MS, n as ensureDaemonRuntimePaths, r as resolveDaemonDeviceId, s as emitRunLine, u as normalizeOptionalText$1, v as warnDaemonEvent, w as DAEMON_RUNTIME_CONTRACT_EPOCH, x as CONTROLLED_SHUTDOWN_REQUEST_TIMEOUT_MS, y as CATALOG_SYNC_RETRY_INTERVAL_MS } from "./daemon-device-id-C3gKch4E.js";
-import { c as serviceExecutionHostSnapshotSchema, d as localExecutionInputResponseSchema, l as LOCAL_EXECUTION_INPUT_CAPABILITY_HEADER, n as createExecutionHostClient, o as serviceExecutionHostMethods, t as ExecutionHostError, u as localExecutionInputFrameSchema } from "./channel-C6tm9T7P.js";
-import { m as hashBundledSkillAssets, p as computeDirectoryContentHash, u as loadSelectedSkillAssets } from "./state-C_iJAzKh.js";
-import { $ as readComputerFileAccessPolicy, L as createServiceGitEnvironment, Q as ComputerFileAccessStoreError, X as emitDaemonDispatchJournalEvent, Y as resolveNextRuntimeAgentControllerReportSyncAtMs, _ as collectObservedSessionWorkingDirectories, et as resolveComputerFileAccessStorePath, g as sendDaemonFrame, h as parseDaemonFrame, hn as cliJsonOutputEnvelopeSchema, m as handleDaemonTransportFrame, n as assertDispatchOwnedRuntimeServiceMutationAllowed, tt as updateComputerFileAccessPolicy } from "./dispatch-owned-runtime-gOluDX5_.js";
-import { A as prepareDaemonServiceBundle, G as readManagedCliInstallation, M as resolveAlignedDaemonActiveBundleEntryPath, N as resolveDaemonBundleEntryPathFromState, a as resolveDaemonRuntimeState, b as cleanupInactiveDaemonServiceBundles, f as listDaemonOwnedProcesses, h as resolveDaemonBundleIdFromEntryPath, i as readCurrentObservedDaemonRuntimeStatus, j as readDaemonActiveBundleState, n as getEffectiveDaemonRuntimeStatus, o as resolveDaemonServiceManagerForRuntimeState, p as extractDaemonCommandEntryPath, r as readCurrentDaemonRuntimeContext, s as waitForDaemonSystemServiceToStop, t as clearDaemonRuntimeStateIfDefinitelyStopped, u as cleanupLegacySharedDaemonServiceState, v as isOpenMeldManagedBinaryPath } from "./daemon-service-runtime-CktU3ER4.js";
+import { A as DEFAULT_RECONNECT_DELAY_MS, C as CONTROLLED_SHUTDOWN_SOCKET_CLOSE_TIMEOUT_MS, D as DAEMON_STREAM_CONNECT_TIMEOUT_MS, F as REGISTER_RESPONSE_TIMEOUT_MS, I as RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_INTERVAL_MS, L as RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_RETRY_INTERVAL_MS, M as MAX_RECONNECT_DELAY_MS, N as PROVIDER_CONVERSATION_PROOF_SYNC_INTERVAL_MS, O as DAEMON_STREAM_KEEPALIVE_INTERVAL_MS, P as PROVIDER_CONVERSATION_PROOF_SYNC_RETRY_INTERVAL_MS, R as RUNTIME_STATE_PERSIST_MIN_INTERVAL_MS, _ as toErrorMessage$5, b as CATALOG_SYNC_SIGNAL_POLL_INTERVAL_MS, c as normalizeHeartbeatIntervalMs, d as normalizeText$1, f as nowIsoString, i as resolvePreferredDaemonDeviceId, j as HEARTBEAT_RESPONSE_TIMEOUT_MS, k as DAEMON_STREAM_KEEPALIVE_PONG_TIMEOUT_MS, n as ensureDaemonRuntimePaths, r as resolveDaemonDeviceId, s as emitRunLine, u as normalizeOptionalText$1, v as warnDaemonEvent, w as DAEMON_RUNTIME_CONTRACT_EPOCH, x as CONTROLLED_SHUTDOWN_REQUEST_TIMEOUT_MS, y as CATALOG_SYNC_RETRY_INTERVAL_MS } from "./daemon-device-id-CmykIapy.js";
+import { c as serviceExecutionHostSnapshotSchema, d as localExecutionInputResponseSchema, l as LOCAL_EXECUTION_INPUT_CAPABILITY_HEADER, n as createExecutionHostClient, o as serviceExecutionHostMethods, t as ExecutionHostError, u as localExecutionInputFrameSchema } from "./channel-40SR2b5S.js";
+import { m as hashBundledSkillAssets, p as computeDirectoryContentHash, u as loadSelectedSkillAssets } from "./state-Fskb-utn.js";
+import { Q as emitDaemonDispatchJournalEvent, Z as resolveNextRuntimeAgentControllerReportSyncAtMs, _ as sendDaemonFrame, _n as cliJsonOutputEnvelopeSchema, et as ComputerFileAccessStoreError, g as parseDaemonFrame, h as handleDaemonTransportFrame, it as isSameOrDescendantPath, m as createCodexJsonRpcClient, n as assertDispatchOwnedRuntimeServiceMutationAllowed, nt as resolveComputerFileAccessStorePath, rt as updateComputerFileAccessPolicy, tt as readComputerFileAccessPolicy, v as collectObservedSessionWorkingDirectories, w as resolveOpenCodeDatabasePath, x as queryOpenCodeReadOnly, z as createServiceGitEnvironment } from "./dispatch-owned-runtime-QhxDRdNr.js";
+import { A as prepareDaemonServiceBundle, G as readManagedCliInstallation, M as resolveAlignedDaemonActiveBundleEntryPath, N as resolveDaemonBundleEntryPathFromState, a as resolveDaemonRuntimeState, b as cleanupInactiveDaemonServiceBundles, f as listDaemonOwnedProcesses, h as resolveDaemonBundleIdFromEntryPath, i as readCurrentObservedDaemonRuntimeStatus, j as readDaemonActiveBundleState, n as getEffectiveDaemonRuntimeStatus, o as resolveDaemonServiceManagerForRuntimeState, p as extractDaemonCommandEntryPath, r as readCurrentDaemonRuntimeContext, s as waitForDaemonSystemServiceToStop, t as clearDaemonRuntimeStateIfDefinitelyStopped, u as cleanupLegacySharedDaemonServiceState, v as isOpenMeldManagedBinaryPath } from "./daemon-service-runtime-pECs8jVc.js";
 import { i as writeDaemonRuntimeLease } from "./daemon-runtime-lease-Bv6vhqOe.js";
 import { i as readProcessStartIdentity, n as isPreciseProcessStartIdentity, t as CURRENT_PROCESS_START_IDENTITY } from "./process-identity-BRbhGGTM.js";
-import { $ as buildDaemonServiceDependencyTitle, At as DAEMON_SERVICE_FULL_ALIGNMENT_ANOMALIES, C as formatDaemonServiceRefreshReliabilityMessage, Ct as ensureDaemonRuntimeContractState, D as writeDaemonStartFailureState, Dt as isVersionDowngrade, E as clearDaemonStartFailureState, Et as resolveDaemonServiceAlignmentDecision, Ft as resolveCurrentDaemonExpectedVersion, It as resolveServiceUpdateUrgency, Lt as assessServerRequiredVersion, Nt as classifyDaemonServiceRunStartability, Pt as classifyDaemonServiceWakeability, Q as buildDaemonServiceDependencySummary, Rt as describeServerRequiredVersionUnavailableReason, S as buildDaemonServiceUpdateRequiredNextStep, Tt as buildDaemonServiceTargetSpec, Ut as ensureDaemonSystemServiceCommandFiles, Vt as assessCliUpdate, W as resolveLocalServiceDemand, Wt as resolveInstalledDaemonSystemServiceCommandSpec, X as buildDaemonServiceDependencyMeaning, Y as buildDaemonServiceDependencyDetails, Z as buildDaemonServiceDependencyNextStep, _t as readCurrentDaemonOwnerSnapshot, a as isDaemonInventoryRunningAndStartReady$1, bt as summarizeDaemonOwnerSnapshot, c as waitForSystemServiceStartup$1, ct as writeOpenMeldToolsMaintenancePolicy, d as captureDaemonServiceEvidenceBestEffort, et as resolveDaemonServiceDependencyDiagnostics, f as formatDaemonFailureContextText, ft as uninstallDaemonServiceUpdateWorker, g as resolveServiceReadiness, gt as hasActiveDaemonOwners, h as resolveDaemonStatusAuthenticationAttention, ht as formatDaemonOwnerSummaryLabel, i as runDaemonServiceLifecycle, jt as DAEMON_SERVICE_REPAIR_ANOMALIES, kt as DAEMON_SERVICE_AUTO_HEAL_ANOMALIES, l as startDaemonSystemServiceWithAutoRepair, lt as ensureDaemonServiceMaintenanceInstalled, m as resolveDaemonStatusAttention, mt as buildDaemonOwnerSnapshotFromObservedState, n as scheduleDaemonServiceUpdate, nt as createOpenMeldToolsUpdateCoordinator, o as isSystemServiceStartupTimeoutError, ot as readOpenMeldToolsMaintenancePolicy, p as resolveDaemonStatusSnapshot, pt as inspectDaemonServiceInventory, r as DaemonServiceLifecycleDrainTimeoutError, s as resolveSystemServiceStartupWaitMs, st as resolveOpenMeldToolsMaintenanceProjection, tt as writeDaemonServiceContract, u as captureDaemonServiceEvidence, v as buildDaemonServiceRefreshNextStep, vt as resolveDaemonStopStrategy, w as formatDaemonServiceUpdateRequiredMessage, wt as readDaemonRuntimeContractRepairReport, x as buildDaemonServiceStatusReadOnlyDetail, y as buildDaemonServiceRefreshPromptMessage, yt as resolveStoppedContractWriteBlockedReason } from "./daemon-service-update-coordinator-D0-15tZW.js";
+import { $ as buildDaemonServiceDependencyTitle, At as DAEMON_SERVICE_FULL_ALIGNMENT_ANOMALIES, C as formatDaemonServiceRefreshReliabilityMessage, Ct as ensureDaemonRuntimeContractState, D as writeDaemonStartFailureState, Dt as isVersionDowngrade, E as clearDaemonStartFailureState, Et as resolveDaemonServiceAlignmentDecision, Ft as resolveCurrentDaemonExpectedVersion, It as resolveServiceUpdateUrgency, Lt as assessServerRequiredVersion, Nt as classifyDaemonServiceRunStartability, Pt as classifyDaemonServiceWakeability, Q as buildDaemonServiceDependencySummary, Rt as describeServerRequiredVersionUnavailableReason, S as buildDaemonServiceUpdateRequiredNextStep, Tt as buildDaemonServiceTargetSpec, Ut as ensureDaemonSystemServiceCommandFiles, Vt as assessCliUpdate, W as resolveLocalServiceDemand, Wt as resolveInstalledDaemonSystemServiceCommandSpec, X as buildDaemonServiceDependencyMeaning, Y as buildDaemonServiceDependencyDetails, Z as buildDaemonServiceDependencyNextStep, _t as readCurrentDaemonOwnerSnapshot, a as isDaemonInventoryRunningAndStartReady$1, bt as summarizeDaemonOwnerSnapshot, c as waitForSystemServiceStartup$1, ct as writeOpenMeldToolsMaintenancePolicy, d as captureDaemonServiceEvidenceBestEffort, et as resolveDaemonServiceDependencyDiagnostics, f as formatDaemonFailureContextText, ft as uninstallDaemonServiceUpdateWorker, g as resolveServiceReadiness, gt as hasActiveDaemonOwners, h as resolveDaemonStatusAuthenticationAttention, ht as formatDaemonOwnerSummaryLabel, i as runDaemonServiceLifecycle, jt as DAEMON_SERVICE_REPAIR_ANOMALIES, kt as DAEMON_SERVICE_AUTO_HEAL_ANOMALIES, l as startDaemonSystemServiceWithAutoRepair, lt as ensureDaemonServiceMaintenanceInstalled, m as resolveDaemonStatusAttention, mt as buildDaemonOwnerSnapshotFromObservedState, n as scheduleDaemonServiceUpdate, nt as createOpenMeldToolsUpdateCoordinator, o as isSystemServiceStartupTimeoutError, ot as readOpenMeldToolsMaintenancePolicy, p as resolveDaemonStatusSnapshot, pt as inspectDaemonServiceInventory, r as DaemonServiceLifecycleDrainTimeoutError, s as resolveSystemServiceStartupWaitMs, st as resolveOpenMeldToolsMaintenanceProjection, tt as writeDaemonServiceContract, u as captureDaemonServiceEvidence, v as buildDaemonServiceRefreshNextStep, vt as resolveDaemonStopStrategy, w as formatDaemonServiceUpdateRequiredMessage, wt as readDaemonRuntimeContractRepairReport, x as buildDaemonServiceStatusReadOnlyDetail, y as buildDaemonServiceRefreshPromptMessage, yt as resolveStoppedContractWriteBlockedReason } from "./daemon-service-update-coordinator-DJKBTEjx.js";
 import { C as assessLocalMachineFailure, E as createServiceSpawnPendingIssue, i as isOpenMeldLockError, k as formatLocalMachineIssueMessage, u as resolveOpenMeldOrphanedLockIssue, x as resolveOpenMeldLaneDescriptor } from "./lock-BMI00i2F.js";
-import { Ct as buildAgentOverviewFromContract, Q as getCommandEntryContract, ht as validateDaemonControlTargetInput, t as createAuthLoginGuideError } from "./dual-view-guide-catalog-0kSizTFt.js";
+import { Ct as buildAgentOverviewFromContract, Q as getCommandEntryContract, ht as validateDaemonControlTargetInput, t as createAuthLoginGuideError } from "./dual-view-guide-catalog-DDsnLpIT.js";
 import { a as resolveBaseUrl, c as resolveExplicitGatewayUrlOrThrow, f as getConfiguredDaemonDispatchLimits, i as normalizeGatewayBaseUrlOrNull, o as resolveBaseUrlOrNull, r as normalizeGatewayBaseUrl } from "./base-url-0AoeTi3w.js";
 import "./openmeld-dev-environment-DwdvL7jg.js";
 import { n as toErrorMessage$6, t as sleep } from "./dist-BLuEEVHh.js";
-import { D as createAuthenticationError, E as buildHumanAuthenticationCard, M as resolveAuthenticationReasonFromState, O as extractAuthenticationPromptAction, T as buildCommandAuthenticationPromptMessage$1, a as requireOpenMeldProfile, g as readDaemonCatalogSyncSignal, k as resolveAuthenticationGuidance, n as resolveRuntimeContext, o as resolveOpenMeldProfileOrNull, w as buildAuthenticationStatusLabel, y as clearAllSelectedOpenMeldProfileIds } from "./context-M7dvalCp.js";
+import { D as createAuthenticationError, E as buildHumanAuthenticationCard, M as resolveAuthenticationReasonFromState, O as extractAuthenticationPromptAction, T as buildCommandAuthenticationPromptMessage$1, a as requireOpenMeldProfile, g as readDaemonCatalogSyncSignal, k as resolveAuthenticationGuidance, n as resolveRuntimeContext, o as resolveOpenMeldProfileOrNull, w as buildAuthenticationStatusLabel, y as clearAllSelectedOpenMeldProfileIds } from "./context-BEgBhfbb.js";
 import { a as formatOpenMeldCliTextBlock, n as formatOpenMeldCliCommand, r as formatOpenMeldCliCommands, t as formatInlineOpenMeldCliCommands } from "./cli-entry-command-CR_9QU1i.js";
 import { n as writeDaemonLocalStateFile, t as readDaemonLocalStateFile } from "./daemon-local-state-file-jOXuXrky.js";
 import { t as isBinaryDistribution } from "./distribution-BDQT2ilb.js";
 import { A as getDaemonStatus, G as withDaemonServiceRegistrationMutationLock, H as setDaemonServiceRuntimeState, I as readDaemonServiceRuntimeSnapshot, K as withDaemonServiceRunLock, L as releaseDaemonServiceLifecycleLock, M as isDaemonServiceRuntimeHeartbeatStale, O as ensureDaemonControlPlaneToken, R as resolveDaemonControlPlaneEndpoint, S as daemonServiceRepairJournalPath, U as uninstallDaemon, W as withDaemonServiceReconcileLock, _ as daemonRuntimeStateRootPath, a as DAEMON_SERVICE_RUNTIME_MODE_ENV, c as acquireDaemonServiceLifecycleLock, f as daemonLifecycleJournalPath, h as daemonRuntimeRootPath, i as DAEMON_SERVICE_RUNTIME_DETACHED_ENV, j as installDaemon, l as clearDaemonServiceRuntimeState, o as DAEMON_SERVICE_RUNTIME_STATE_SCHEMA, q as withDaemonServiceStopLock, z as resolveDaemonServiceRuntimeMetadata } from "./daemon-state-Dte9re5V.js";
 import { a as outJsonLine, n as sanitizeTerminalDisplayText, o as outLine, t as createPresenter } from "./presenter-BcxiQyJg.js";
-import { c as buildRequestAuthHeaders, i as AuthRequestCredentialError, l as canAttachAuthTokenToRequest, o as buildOpenMeldProfileRequestHeadersWithAuth, p as deriveAuthBaseUrlFromGatewayUrl, t as createCliApiClientFoundation, u as fingerprintRequestAuthorization } from "./api-client-foundation-CYbEdm9o.js";
+import { c as buildRequestAuthHeaders, i as AuthRequestCredentialError, l as canAttachAuthTokenToRequest, o as buildOpenMeldProfileRequestHeadersWithAuth, p as deriveAuthBaseUrlFromGatewayUrl, t as createCliApiClientFoundation, u as fingerprintRequestAuthorization } from "./api-client-foundation-BZvzqIeX.js";
 import { a as upsertDaemonServiceContract, i as readDaemonServiceContract, n as isDaemonServiceContractIdentityReusable, t as clearDaemonServiceContract } from "./daemon-service-contract-COPKbCy_.js";
 import { t as resolveOpenMeldEnvironmentTarget } from "./openmeld-environment-target-BgYR6ozy.js";
-import { t as admitServiceAccountStop } from "./service-account-authorization-CtvSn02O.js";
-import { S as requestLocalDaemonShutdown, c as runWithDaemonLifecycleCommandJournal, d as compareSemver, i as readLatestDaemonLifecycleOriginEvent, l as OPENMELD_VERSION, n as formatDaemonLifecycleOriginSummary, o as resolveRecentDaemonSignalStopCause, r as readLatestDaemonLifecycleConnectionStateEvent, s as runDaemonServiceManagerAction, t as emitDaemonLifecycleEvent, w as sendLocalDaemonControlPlaneRequest, y as LocalDaemonControlPlaneClientError } from "./daemon-lifecycle-journal-CGUuJshv.js";
+import { t as admitServiceAccountStop } from "./service-account-authorization-CqUcNoD1.js";
+import { S as requestLocalDaemonShutdown, c as runWithDaemonLifecycleCommandJournal, d as compareSemver, i as readLatestDaemonLifecycleOriginEvent, l as OPENMELD_VERSION, n as formatDaemonLifecycleOriginSummary, o as resolveRecentDaemonSignalStopCause, r as readLatestDaemonLifecycleConnectionStateEvent, s as runDaemonServiceManagerAction, t as emitDaemonLifecycleEvent, w as sendLocalDaemonControlPlaneRequest, y as LocalDaemonControlPlaneClientError } from "./daemon-lifecycle-journal-2dzGUSWU.js";
 import { r as readWindowsManagedCliInstallation } from "./windows-managed-install-BVlswqjA.js";
 import { S as resolveDaemonServiceManager, _ as readDaemonServiceJobCrashExitCode, a as disableDaemonServiceAutostartIfConfigured, c as getDaemonSystemServiceLogPath, f as isDaemonServiceJobSpawnPending, o as formatDaemonServiceJobDiagnosticsEvidence, s as getDaemonServiceLaunchdLabel } from "./daemon-service-manager-SXQcFE9c.js";
-import { a as formatDaemonServiceDowngradeBlockedRecommendation, d as formatDaemonServiceMissingStatus, f as getDaemonDowngradeBlockedTitle, g as canUseInteractivePrompts, h as resolveOpenMeldToolsUpdateOperationProjection, l as formatDaemonServiceMissingRunStepOne, n as resolveElapsedTimeMs, o as formatDaemonServiceMissingAction, r as formatDaemonDowngradeBlockedNextStep, s as formatDaemonServiceMissingMeaning, t as formatElapsedTime, u as formatDaemonServiceMissingRunStepTwo } from "./elapsed-time-Bo1CJczC.js";
-import { t as childExecutionHostChannel } from "./process-channel-CTXWjlBP.js";
-import { n as collectSkillsReadinessSnapshot } from "./installation-inventory-BZgQmVup.js";
+import { a as formatDaemonServiceDowngradeBlockedRecommendation, d as formatDaemonServiceMissingStatus, f as getDaemonDowngradeBlockedTitle, g as canUseInteractivePrompts, h as resolveOpenMeldToolsUpdateOperationProjection, l as formatDaemonServiceMissingRunStepOne, n as resolveElapsedTimeMs, o as formatDaemonServiceMissingAction, r as formatDaemonDowngradeBlockedNextStep, s as formatDaemonServiceMissingMeaning, t as formatElapsedTime, u as formatDaemonServiceMissingRunStepTwo } from "./elapsed-time-DTb6L36x.js";
+import { t as childExecutionHostChannel } from "./process-channel-DLXPiGRF.js";
+import { n as collectSkillsReadinessSnapshot } from "./installation-inventory-CCkKix8R.js";
 import { createHash, randomUUID } from "node:crypto";
+import { homedir } from "node:os";
 import { delimiter, dirname, isAbsolute, join, resolve } from "node:path";
 import { access, mkdir, open, readFile, readdir, realpath, rename, rm, stat, writeFile } from "node:fs/promises";
 import * as z$1 from "zod/v4";
+import { z } from "zod/v4";
 import { accessSync, constants, readSync } from "node:fs";
 import process$1 from "node:process";
 import { execFile, spawn } from "node:child_process";
@@ -52,6 +54,7 @@ import { createServer } from "node:net";
 import { cancel, confirm, isCancel, select } from "@clack/prompts";
 import stringWidth from "string-width";
 import WebSocket from "ws";
+import { getSessionInfo, getSessionMessages } from "@anthropic-ai/claude-agent-sdk";
 //#region ../../packages/schemas/dist/schemas/daemon/service-connection-correlation.js
 const SERVICE_CONNECTION_ID_QUERY_PARAMETER = "connectionId";
 z$1.uuid();
@@ -5790,6 +5793,508 @@ function waitForRegisterResponse(input) {
 	});
 }
 //#endregion
+//#region src/local-service/session-history/claude-history-reader.ts
+function projectClaudeHistory(items, sessionId) {
+	const messages = [];
+	let omittedNonMessageItems = false;
+	for (const item of items) {
+		if (item.session_id !== sessionId) throw new Error("Session identity mismatch.");
+		if (item.type === "system" || item.parent_tool_use_id || item.parent_agent_id) {
+			omittedNonMessageItems = true;
+			continue;
+		}
+		const message = z.object({ content: z.union([z.string(), z.array(z.unknown())]) }).parse(item.message);
+		const parts = typeof message.content === "string" ? [message.content] : message.content.flatMap((part) => {
+			const text = z.object({
+				type: z.literal("text"),
+				text: z.string()
+			}).safeParse(part);
+			if (text.success) return [text.data.text];
+			omittedNonMessageItems = true;
+			return [];
+		});
+		if (!parts.length) continue;
+		const text = parts.join("\n");
+		messages.push({
+			role: item.type,
+			text: text.slice(0, 8e3),
+			truncated: text.length > 8e3
+		});
+	}
+	return {
+		messages,
+		omittedNonMessageItems
+	};
+}
+async function readClaudeHistory(input) {
+	const metadata = await getSessionInfo(input.sessionId);
+	if (!metadata?.cwd || metadata.sessionId !== input.sessionId || metadata.fileSize === void 0 || metadata.fileSize > 8 * 1024 * 1024) throw new Error("Claude Code session metadata is unavailable or too large.");
+	await input.authorizePath(metadata.cwd);
+	const items = await getSessionMessages(input.sessionId, { dir: metadata.cwd });
+	const current = await getSessionInfo(input.sessionId, { dir: metadata.cwd });
+	if (!current || current.cwd !== metadata.cwd || current.fileSize !== metadata.fileSize || current.lastModified !== metadata.lastModified) throw new Error("Claude Code session changed during the read.");
+	await input.authorizePath(current.cwd);
+	return {
+		cwd: current.cwd,
+		...projectClaudeHistory(items, input.sessionId)
+	};
+}
+//#endregion
+//#region src/local-service/session-history/codex-history-reader.ts
+const threadSchema = z.object({
+	id: z.string(),
+	cwd: z.string().min(1),
+	turns: z.array(z.object({ items: z.array(z.unknown()) })).max(1e5)
+});
+const userMessage = z.object({
+	type: z.literal("userMessage"),
+	content: z.array(z.unknown())
+});
+const assistantMessage = z.object({
+	type: z.literal("agentMessage"),
+	text: z.string()
+});
+const textContent = z.object({
+	type: z.literal("text"),
+	text: z.string()
+});
+function projectCodexHistory(value, sessionId) {
+	const { thread } = z.object({ thread: threadSchema }).parse(value);
+	if (thread.id !== sessionId) throw new Error("Session identity mismatch.");
+	const messages = [];
+	let omittedNonMessageItems = false;
+	for (const turn of thread.turns) for (const item of turn.items) {
+		const assistant = assistantMessage.safeParse(item);
+		const user = userMessage.safeParse(item);
+		let text;
+		let role;
+		if (assistant.success) {
+			text = assistant.data.text;
+			role = "assistant";
+		} else if (user.success) {
+			text = user.data.content.flatMap((part) => {
+				const parsed = textContent.safeParse(part);
+				if (parsed.success) return [parsed.data.text];
+				omittedNonMessageItems = true;
+				return [];
+			}).join("\n");
+			role = "user";
+		} else {
+			omittedNonMessageItems = true;
+			continue;
+		}
+		messages.push({
+			role,
+			text: text.slice(0, 8e3),
+			truncated: text.length > 8e3
+		});
+	}
+	return {
+		cwd: thread.cwd,
+		messages,
+		omittedNonMessageItems
+	};
+}
+async function readCodexHistory(input) {
+	const launch = await resolveInstalledCodexLaunchCandidates({ timeoutMs: 5e3 });
+	if (!(launch.ok && launch.candidates[0])) throw new Error("Codex is unavailable.");
+	const client = createCodexJsonRpcClient(launch.candidates[0].launchContract);
+	try {
+		await client.request("initialize", { clientInfo: {
+			name: "openmeld-session-history",
+			version: "1"
+		} });
+		client.notify("initialized", {});
+		const metadata = z.object({ thread: threadSchema }).parse(await client.request("thread/read", {
+			threadId: input.sessionId,
+			includeTurns: false
+		}));
+		if (metadata.thread.id !== input.sessionId) throw new Error("Session identity mismatch.");
+		await input.authorizePath(metadata.thread.cwd);
+		const history = projectCodexHistory(await client.request("thread/read", {
+			threadId: input.sessionId,
+			includeTurns: true
+		}), input.sessionId);
+		await input.authorizePath(history.cwd);
+		return history;
+	} finally {
+		await client.close();
+	}
+}
+//#endregion
+//#region src/local-service/session-history/grok-history-reader.ts
+async function readBoundedFile(path) {
+	const file = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+	try {
+		const before = await file.stat();
+		if (!before.isFile() || before.size > 8 * 1024 * 1024) throw new Error("Session file is too large.");
+		const buffer = Buffer.alloc(before.size + 1);
+		let length = 0;
+		while (length < buffer.length) {
+			const { bytesRead } = await file.read(buffer, length, buffer.length - length, null);
+			if (!bytesRead) break;
+			length += bytesRead;
+		}
+		const after = await file.stat();
+		if (length !== before.size || after.mtimeMs !== before.mtimeMs || after.size !== before.size) throw new Error("Session changed during the read.");
+		return buffer.subarray(0, length).toString("utf8");
+	} finally {
+		await file.close();
+	}
+}
+function projectGrokHistory(source, sessionId) {
+	const messages = [];
+	let omittedNonMessageItems = false;
+	let previousRole = null;
+	for (const line of source.split("\n").filter(Boolean)) {
+		const envelope = z.object({
+			method: z.string(),
+			params: z.object({
+				sessionId: z.string(),
+				update: z.object({ sessionUpdate: z.string() }).passthrough()
+			})
+		}).parse(JSON.parse(line));
+		if (envelope.params.sessionId !== sessionId) throw new Error("Session identity mismatch.");
+		const update = envelope.params.update;
+		if (update.sessionUpdate === "rewind_marker") throw new Error("Rewound sessions are not supported.");
+		if (envelope.method !== "session/update" || !["user_message_chunk", "agent_message_chunk"].includes(update.sessionUpdate)) {
+			omittedNonMessageItems = true;
+			previousRole = null;
+			continue;
+		}
+		const chunk = z.object({
+			content: z.object({
+				type: z.string(),
+				text: z.string().optional(),
+				_meta: z.object({ bash_command: z.unknown().optional() }).optional()
+			}),
+			_meta: z.object({ host_turn: z.boolean().optional() }).optional()
+		}).parse(update);
+		if (chunk.content.type !== "text" || chunk.content.text === void 0 || chunk._meta?.host_turn || chunk.content._meta?.bash_command !== void 0) {
+			omittedNonMessageItems = true;
+			previousRole = null;
+			continue;
+		}
+		const role = update.sessionUpdate === "user_message_chunk" ? "user" : "assistant";
+		const previous = messages.at(-1);
+		if (previous && previousRole === role) {
+			const text = previous.text + chunk.content.text;
+			previous.text = text.slice(0, 8e3);
+			previous.truncated ||= text.length > 8e3;
+		} else messages.push({
+			role,
+			text: chunk.content.text.slice(0, 8e3),
+			truncated: chunk.content.text.length > 8e3
+		});
+		previousRole = role;
+	}
+	return {
+		messages,
+		omittedNonMessageItems
+	};
+}
+async function readGrokHistory(input) {
+	const sessionId = z.uuid().parse(input.sessionId);
+	const root = join(input.grokHome ?? process.env.GROK_HOME ?? join(homedir(), ".grok"), "sessions");
+	const matches = [];
+	for (const project of await readdir(root, { withFileTypes: true })) {
+		if (!project.isDirectory()) continue;
+		for (const session of await readdir(join(root, project.name), { withFileTypes: true })) if (session.isDirectory() && session.name === sessionId) matches.push(join(root, project.name, session.name));
+	}
+	if (matches.length !== 1) throw new Error("Session identity is missing or ambiguous.");
+	const directory = z.string().parse(matches[0]);
+	const source = await readBoundedFile(join(directory, "summary.json"));
+	const identity = z.object({
+		id: z.string(),
+		cwd: z.string().min(1)
+	});
+	const value = JSON.parse(source);
+	const summary = identity.or(z.object({ info: identity }).transform(({ info }) => info)).parse(value);
+	if (summary.id !== sessionId) throw new Error("Session identity mismatch.");
+	await input.authorizePath(summary.cwd);
+	const history = projectGrokHistory(await readBoundedFile(join(directory, "updates.jsonl")), sessionId);
+	if (await readBoundedFile(join(directory, "summary.json")) !== source) throw new Error("Session changed during the read.");
+	await input.authorizePath(summary.cwd);
+	return {
+		cwd: summary.cwd,
+		...history
+	};
+}
+//#endregion
+//#region src/local-service/session-history/opencode-history-reader.ts
+async function readOpenCodeHistory(input) {
+	const databasePath = input.databasePath ?? resolveOpenCodeDatabasePath({ homeDir: homedir() });
+	const metadataSchema = z.object({
+		id: z.string(),
+		directory: z.string().min(1),
+		time_updated: z.number(),
+		revert: z.string().nullable()
+	});
+	const metadataSql = "SELECT id, directory, time_updated, revert FROM session WHERE id = ?";
+	const [row] = await queryOpenCodeReadOnly(databasePath, metadataSql, [input.sessionId]);
+	const metadata = metadataSchema.parse(row);
+	await input.authorizePath(metadata.directory);
+	const revert = metadata.revert ? z.object({ messageID: z.string() }).parse(JSON.parse(metadata.revert)) : null;
+	const rows = await queryOpenCodeReadOnly(databasePath, `
+    SELECT m.id, json_extract(m.data, '$.role') AS role,
+      substr(json_extract(p.data, '$.text'), 1, 8001) AS text
+    FROM message m JOIN part p ON p.message_id = m.id AND p.session_id = m.session_id
+    WHERE m.session_id = ? AND json_extract(p.data, '$.type') = 'text'
+      AND coalesce(json_extract(p.data, '$.synthetic'), 0) = 0
+      AND coalesce(json_extract(p.data, '$.ignored'), 0) = 0
+      AND json_extract(m.data, '$.role') IN ('user', 'assistant')
+    ORDER BY m.time_created, m.id, p.id LIMIT 1001`, [input.sessionId]);
+	if (rows.length > 1e3 || JSON.stringify(rows).length > 8 * 1024 * 1024) throw new Error("Session is too large.");
+	const messages = [];
+	let previousId = null;
+	for (const row of rows) {
+		const part = z.object({
+			id: z.string(),
+			role: z.enum(["user", "assistant"]),
+			text: z.string()
+		}).parse(row);
+		if (revert && part.id >= revert.messageID) break;
+		const previous = messages.at(-1);
+		if (previous && previousId === part.id) {
+			const combined = `${previous.text}\n${part.text}`;
+			previous.text = combined.slice(0, 8e3);
+			previous.truncated ||= combined.length > 8e3;
+		} else messages.push({
+			role: part.role,
+			text: part.text.slice(0, 8e3),
+			truncated: part.text.length > 8e3
+		});
+		previousId = part.id;
+	}
+	const [current] = await queryOpenCodeReadOnly(databasePath, metadataSql, [input.sessionId]);
+	if (JSON.stringify(metadataSchema.parse(current)) !== JSON.stringify(metadata)) throw new Error("Session changed during the read.");
+	await input.authorizePath(metadata.directory);
+	return {
+		cwd: metadata.directory,
+		messages,
+		omittedNonMessageItems: true
+	};
+}
+//#endregion
+//#region src/local-service/session-history/history-reader.ts
+async function readSessionHistory(input) {
+	return await {
+		codex: readCodexHistory,
+		"claude-code": readClaudeHistory,
+		opencode: readOpenCodeHistory,
+		"grok-build": readGrokHistory
+	}[input.provider ?? "codex"](input);
+}
+//#endregion
+//#region src/local-service/session-history/session-history-store.ts
+const storeSchema = z.strictObject({
+	version: z.literal(2),
+	policy: sessionHistoryPolicySchema,
+	entries: z.array(sessionHistoryAuditSchema).max(200)
+});
+const legacyStoreSchema = storeSchema.extend({
+	version: z.literal(1),
+	policy: sessionHistoryPolicySchema.extend({ readerProfileIds: z.array(z.string()).max(64) })
+});
+const tails = /* @__PURE__ */ new Map();
+function sessionHistoryStorePath(dataRoot, owner, organization) {
+	return join(dataRoot, "session-history", `${createHash("sha256").update(JSON.stringify([owner, organization])).digest("hex")}.json`);
+}
+async function readSessionHistoryStore(path) {
+	const body = await readFile(path, "utf8").catch((error) => {
+		if (error && typeof error === "object" && "code" in error && error.code === "ENOENT") return null;
+		throw error;
+	});
+	if (body === null) return storeSchema.parse({
+		version: 2,
+		policy: {
+			enabled: false,
+			connections: [],
+			revision: 1,
+			updatedAtMs: 0
+		},
+		entries: []
+	});
+	const parsed = JSON.parse(body);
+	const legacy = legacyStoreSchema.safeParse(parsed);
+	if (legacy.success) {
+		const { readerProfileIds: _readers, ...policy } = legacy.data.policy;
+		return storeSchema.parse({
+			...legacy.data,
+			version: 2,
+			policy: {
+				...policy,
+				enabled: false,
+				revision: policy.revision + 1
+			}
+		});
+	}
+	return storeSchema.parse(parsed);
+}
+async function updateSessionHistoryStore(path, operation) {
+	const previous = tails.get(path) ?? Promise.resolve();
+	let release = () => void 0;
+	const next = new Promise((resolve) => {
+		release = resolve;
+	});
+	tails.set(path, next);
+	await previous;
+	try {
+		const store = await readSessionHistoryStore(path);
+		const result = operation(store);
+		const temporary = `${path}.${randomUUID()}.tmp`;
+		await mkdir(dirname(path), {
+			recursive: true,
+			mode: 448
+		});
+		try {
+			await writeFile(temporary, JSON.stringify(storeSchema.parse(store)), { mode: 384 });
+			await rename(temporary, path);
+		} finally {
+			await rm(temporary, { force: true });
+		}
+		return result;
+	} finally {
+		release();
+		if (tails.get(path) === next) tails.delete(path);
+	}
+}
+async function appendSessionHistoryAudit(path, entry, expectedRevision) {
+	return await updateSessionHistoryStore(path, (store) => {
+		const current = expectedRevision === void 0 || store.policy.revision === expectedRevision;
+		store.entries = [{
+			...entry,
+			outcome: current ? entry.outcome : "denied",
+			count: current ? entry.count : 0
+		}, ...store.entries].slice(0, 200);
+		return current;
+	});
+}
+//#endregion
+//#region src/local-service/session-history/session-history-handler.ts
+var HistoryDenied = class extends Error {};
+const denied = () => ({
+	kind: "error",
+	code: "denied",
+	message: "This session is outside your authorized history access."
+});
+async function handleSessionHistoryFrame(input) {
+	const { requestId, request: envelope } = input.frame.payload;
+	const { request, requester, organizationId } = envelope;
+	const path = sessionHistoryStorePath(dirname(input.computerFileAccessStorePath), input.ownerUserId, organizationId);
+	let result;
+	try {
+		if (envelope.expectedDeviceId !== input.deviceId || requester.ownerUserId !== input.ownerUserId || requester.requesterUserId !== input.ownerUserId) throw new HistoryDenied();
+		if (request.operation !== "read_session" && (requester.readerProfileId !== null || requester.audience !== "owner_private")) throw new HistoryDenied();
+		result = await execute();
+	} catch (error) {
+		result = error instanceof HistoryDenied ? denied() : {
+			kind: "error",
+			code: "failed",
+			message: "Conversation could not be read. Check the local agent on this computer, then try again."
+		};
+		if (request.operation === "read_session") await appendSessionHistoryAudit(path, audit(error instanceof HistoryDenied ? "denied" : "failed", 0)).catch(() => void 0);
+	}
+	return sessionHistoryResultFrameSchema.parse({
+		v: 1,
+		code: "daemon.session_history.request_result",
+		payload: {
+			requestId,
+			result
+		}
+	});
+	function audit(outcome, count) {
+		if (request.operation !== "read_session") throw new HistoryDenied();
+		return {
+			requestId,
+			atMs: Date.now(),
+			requester,
+			projectId: request.projectId,
+			provider: request.provider ?? "codex",
+			sessionId: request.sessionId,
+			offset: request.offset,
+			outcome,
+			count
+		};
+	}
+	async function saveSettings(request, connections) {
+		if (!request.policy.connections.every((grant) => connections.some((connection) => connection.projectId === grant.projectId && connection.bindingGeneration === grant.bindingGeneration))) throw new HistoryDenied();
+		return await updateSessionHistoryStore(path, (current) => {
+			if (current.policy.revision !== request.expectedRevision) return null;
+			current.policy = {
+				...request.policy,
+				revision: current.policy.revision + 1,
+				updatedAtMs: Date.now()
+			};
+			return current.policy;
+		});
+	}
+	async function execute() {
+		const store = await readSessionHistoryStore(path);
+		const connections = await listProjectBindings({
+			rootDir: input.rootDir,
+			organizationId
+		});
+		const settings = () => ({
+			kind: "settings",
+			policy: store.policy,
+			connections: connections.map(({ projectId, bindingGeneration, projectSlug }) => ({
+				projectId,
+				bindingGeneration,
+				projectSlug
+			}))
+		});
+		if (request.operation === "read_settings") return settings();
+		if (request.operation === "read_audit") return {
+			kind: "audit",
+			entries: store.entries
+		};
+		if (request.operation === "update_settings") {
+			const updated = await saveSettings(request, connections);
+			if (!updated) return {
+				kind: "error",
+				code: "changed",
+				message: "History settings changed. Reload them before saving."
+			};
+			store.policy = updated;
+			return settings();
+		}
+		const revision = store.policy.revision;
+		const authorizePath = async (cwd) => {
+			const current = await readSessionHistoryStore(path);
+			if (!current.policy.enabled || current.policy.revision !== revision) throw new HistoryDenied();
+			const binding = await resolveLocalProjectConnectionForPath({
+				path: cwd,
+				connections: await listProjectBindings({ rootDir: input.rootDir })
+			});
+			if (!binding || binding.organizationId !== organizationId || binding.projectId !== request.projectId || !current.policy.connections.some((grant) => grant.projectId === binding.projectId && grant.bindingGeneration === binding.bindingGeneration)) throw new HistoryDenied();
+			const canonical = await realpath(cwd);
+			const files = await readComputerFileAccessPolicy(input.computerFileAccessStorePath);
+			if (files.mode === "local_agent_settings") return;
+			const folders = await Promise.all(files.folders.map((folder) => realpath(folder)));
+			if (!(files.mode === "only_selected_folders" ? folders.some((folder) => isSameOrDescendantPath(canonical, folder)) : !folders.some((folder) => isSameOrDescendantPath(canonical, folder) || isSameOrDescendantPath(folder, binding.repositoryPath)))) throw new HistoryDenied();
+		};
+		if (!store.policy.enabled) throw new HistoryDenied();
+		const history = await (input.readHistory ?? readSessionHistory)({
+			provider: request.provider,
+			sessionId: request.sessionId,
+			authorizePath
+		});
+		await authorizePath(history.cwd);
+		const messages = history.messages.slice(request.offset, request.offset + request.limit);
+		if (!await appendSessionHistoryAudit(path, audit("allowed", messages.length), revision)) return denied();
+		return {
+			kind: "session",
+			provider: request.provider ?? "codex",
+			sessionId: request.sessionId,
+			requester,
+			messages,
+			nextOffset: request.offset + messages.length < history.messages.length ? request.offset + messages.length : null,
+			omittedNonMessageItems: history.omittedNonMessageItems
+		};
+	}
+}
+//#endregion
 //#region src/local-service/carrier/run-socket-session.ts
 function buildShutdownHeartbeatFacts(input) {
 	if (input.acceptingDispatches) return {};
@@ -5851,6 +6356,22 @@ function classifyDaemonSocketDisconnect(input) {
 	if (input.closeCode === 1006) return "possible_deploy_or_edge_restart";
 	return "abnormal_socket_close";
 }
+function handleSessionHistorySocketFrame(input) {
+	if (input.frame.code !== "daemon.session_history.request") return false;
+	const parsed = sessionHistoryRequestFrameSchema.safeParse(input.frame);
+	if (!parsed.success) return true;
+	handleSessionHistoryFrame({
+		...input,
+		frame: parsed.data
+	}).then((frame) => input.socket.send(JSON.stringify(frame))).catch(() => {
+		emitRunLine({
+			presenter: input.presenter,
+			code: "daemon.run.session_history_failed",
+			text: "Session history request failed. No transcript content was logged."
+		});
+	});
+	return true;
+}
 function handleComputerFileAccessSocketFrame(input) {
 	if (!input.frame.code.startsWith("daemon.computer_file_access.")) return false;
 	const parsed = computerFileAccessDaemonFrameSchema.safeParse(input.frame);
@@ -6976,7 +7497,10 @@ async function runDaemonSocketSession(input) {
 			});
 			return;
 		}
-		if (handleLocalFolderPickerSocketFrame({
+		if (handleSessionHistorySocketFrame({
+			...input,
+			frame: parsedFrame
+		}) || handleLocalFolderPickerSocketFrame({
 			deviceId: input.deviceId,
 			frame: parsedFrame,
 			presenter: input.presenter,
@@ -7806,7 +8330,8 @@ function buildLocalServiceCapabilityHeaders(input) {
 		[OPENMELD_EXECUTION_ADMISSION_HEADER]: "1",
 		[OPENMELD_ADMISSION_EVIDENCE_HEADER]: "1",
 		...input.localFolderPickerAvailable ? { [OPENMELD_LOCAL_FOLDER_PICKER_CAPABILITY_HEADER]: LOCAL_FOLDER_PICKER_RUNTIME_CAPABILITY } : {},
-		[OPENMELD_RUNTIME_CAPABILITIES_HEADER]: COMPUTER_FILE_ACCESS_RUNTIME_CAPABILITY
+		[OPENMELD_RUNTIME_CAPABILITIES_HEADER]: COMPUTER_FILE_ACCESS_RUNTIME_CAPABILITY,
+		[SESSION_HISTORY_CAPABILITY_HEADER]: SESSION_HISTORY_RUNTIME_CAPABILITY
 	};
 }
 var DaemonStreamAuthenticationRequiredError = class extends Error {
@@ -16065,4 +16590,4 @@ function parseDaemonRunMode(rawMode) {
 //#endregion
 export { buildAuthStatusSnapshot as $, buildDaemonStartNeedsAttentionCard as A, resolveDaemonServiceParticipationStatus as B, buildProfileWorkspaceRows as C, createDelayedSpinner as D, emitDaemonAgentOverview as E, emitCliJsonEnvelope as F, ensureCommandAuthenticationOrCancel as G, validateLocalProjectConnectionPath as H, runDaemonStartupPreflight as I, runAuthLogout as J, evaluateCommandAuthentication as K, readDaemonIncidentLogTail as L, buildHumanErrorCopy as M, renderHumanErrorCard as N, shouldEmitAgentOverview as O, renderHumanTextErrorCard as P, buildAuthStatusRows as Q, resolveLocalComponentsStatus as R, buildProfileWorkspacePresentation as S, createQuietPresenter as T, connectWebSocket as U, LocalProjectConnectionError as V, buildCommandAuthenticationPromptMessage as W, runAuthStatus as X, runAuthMenu as Y, exchangeOneTimeTokenAuthSession as Z, buildDaemonBackgroundStartFailure as _, resolveDeviceTokenExpiresAt as _t, runDaemonBackgroundStartForDecision as a, promptTextEntry as at, formatServiceRuntimeHeadline as b, runDaemonInterrupt as c, finishCurrentCommandCheckScope as ct, runDaemonServiceDetached as d, resetCurrentCommandCheckState as dt, formatActiveOrganizationLabel as et, runDaemonSnapshot as f, startCurrentCommandCheckScope as ft, runDaemonUninstall as g, resolveDeviceAuthClientId as gt, runDaemonTeardownStrict as h, requestDeviceToken as ht, runDaemonAutostart as i, buildUnifiedCardFrame as it, runDaemonStartDecisionPrompt as j, buildDaemonStartDeferredCard as k, runDaemonReinstall as l, getCurrentCommandCheckState as lt, runDaemonStop as m, fetchAuthUserSnapshot as mt, isManagedSystemServiceBootstrapRun as n, renderInfoCard as nt, runDaemonCancel as o, isReturnKeypress as ot, runDaemonStatusFlow as p, extractAuthApiErrorMessage as pt, runAuthLogin as q, runDaemon as r, renderTextInfoCard as rt, runDaemonInstall as s, runInteractivePrompt as st, bestEffortStopCurrentLaneDaemonService as t, buildTextInfoCardLines as tt, runDaemonRunAfterEntryChecks as u, isCurrentCommandCheckScopeActive as ut, buildSystemServiceStartupFailureReportFromVerdict as v, revokeAuthAccessToken as vt, reconcileCliVersionView as w, resolveServiceParticipationReadiness as x, formatServiceParticipationReadinessLabel as y, writeInstalledLocalComponentsSnapshot as z };
 
-//# sourceMappingURL=service-BEH6-P8U.js.map
+//# sourceMappingURL=service-8EozP77B.js.map