orkestrator 2.23.0 → 2.25.0-alpha

package/dist/client.js

@@ -36,6 +36,37 @@ var __exportCjs = (target, getters, setters) => {
 };
 var __require = import.meta.require;
 
+// ../toolchain/src/layout.ts
+import { existsSync, readdirSync, realpathSync } from "fs";
+import path2 from "path";
+function toolchainRootDir(dataDir) {
+  return path2.join(dataDir, TOOLCHAIN_DIRECTORY);
+}
+function currentToolchainBinDir(dataDir) {
+  return path2.join(toolchainRootDir(dataDir), "bin", CURRENT_TOOLCHAIN_LINK);
+}
+function defaultToolchainBinDir(dataDir) {
+  const current = currentToolchainBinDir(dataDir);
+  if (existsSync(current))
+    return realpathSync(current);
+  const binRoot = path2.join(toolchainRootDir(dataDir), "bin");
+  return soleActivatedToolchainSet(binRoot) ?? binRoot;
+}
+function soleActivatedToolchainSet(binRoot) {
+  try {
+    const entries = readdirSync(binRoot, { withFileTypes: true }).filter((entry) => !entry.name.startsWith("."));
+    const [only] = entries;
+    if (entries.length !== 1 || !only?.isDirectory())
+      return;
+    const set = path2.join(binRoot, only.name);
+    return readdirSync(set).length > 0 ? realpathSync(set) : undefined;
+  } catch {
+    return;
+  }
+}
+var TOOLCHAIN_DIRECTORY = "toolchains", CURRENT_TOOLCHAIN_LINK = "current";
+var init_layout = () => {};
+
 // src/client/io.ts
 async function readStreamBounded(stream, maxBytes, onOverflow, signal) {
   const reader = stream.getReader();
@@ -100,27 +131,27 @@ __export(exports_standalone_service, {
   writeServiceConfig: () => writeServiceConfig
 });
 import { execFile } from "child_process";
-import { existsSync, readFileSync, readlinkSync } from "fs";
+import { existsSync as existsSync3, readFileSync as readFileSync3, readlinkSync } from "fs";
 import { copyFile, mkdir, readFile, rename, rm, symlink, writeFile } from "fs/promises";
-import path9 from "path";
+import path12 from "path";
 import { promisify } from "util";
 function standaloneLayout(dataDir) {
-  const root = path9.join(dataDir, STANDALONE_DIRECTORY);
+  const root = path12.join(dataDir, STANDALONE_DIRECTORY);
   return {
     root,
-    releases: path9.join(root, "releases"),
-    current: path9.join(root, "current"),
-    previous: path9.join(root, "previous"),
-    serviceFile: path9.join(root, "service.json"),
-    stateFile: path9.join(root, "launcher-state.json"),
-    restartMarker: path9.join(root, "restart-requested"),
-    launcher: path9.join(root, "launcher.js"),
-    logs: path9.join(root, "logs")
+    releases: path12.join(root, "releases"),
+    current: path12.join(root, "current"),
+    previous: path12.join(root, "previous"),
+    serviceFile: path12.join(root, "service.json"),
+    stateFile: path12.join(root, "launcher-state.json"),
+    restartMarker: path12.join(root, "restart-requested"),
+    launcher: path12.join(root, "launcher.js"),
+    logs: path12.join(root, "logs")
   };
 }
 function readJson(file) {
   try {
-    return JSON.parse(readFileSync(file, "utf8"));
+    return JSON.parse(readFileSync3(file, "utf8"));
   } catch {
     return null;
   }
@@ -161,28 +192,28 @@ async function writeAtomically(file, contents) {
 }
 function linkedVersion(link) {
   try {
-    return path9.basename(readlinkSync(link));
+    return path12.basename(readlinkSync(link));
   } catch {
     return null;
   }
 }
 function releaseDirectory(layout, version) {
-  return path9.join(layout.releases, version);
+  return path12.join(layout.releases, version);
 }
 function releasePackageRoot(releaseDir) {
-  return path9.join(releaseDir, "node_modules", STANDALONE_PACKAGE);
+  return path12.join(releaseDir, "node_modules", STANDALONE_PACKAGE);
 }
 function releaseEntry(releaseDir) {
-  return path9.join(releasePackageRoot(releaseDir), "bin", "orkestrator.js");
+  return path12.join(releasePackageRoot(releaseDir), "bin", "orkestrator.js");
 }
 function releaseLauncher(releaseDir) {
-  return path9.join(releasePackageRoot(releaseDir), "bin", "orkestrator-launcher.js");
+  return path12.join(releasePackageRoot(releaseDir), "bin", "orkestrator-launcher.js");
 }
 function readReleaseManifest(releaseDir) {
-  const manifest = readJson(path9.join(releasePackageRoot(releaseDir), "package.json"));
+  const manifest = readJson(path12.join(releasePackageRoot(releaseDir), "package.json"));
   if (!manifest || typeof manifest.version !== "string")
     return null;
-  if (!existsSync(releaseEntry(releaseDir)))
+  if (!existsSync3(releaseEntry(releaseDir)))
     return null;
   return {
     version: manifest.version,
@@ -195,11 +226,11 @@ async function installRelease(layout, version, options2) {
     return target;
   const run = options2.run ?? runFile;
   await mkdir(layout.releases, { recursive: true });
-  const staging = path9.join(layout.releases, `.staging-${version}-${process.pid}`);
+  const staging = path12.join(layout.releases, `.staging-${version}-${process.pid}`);
   await rm(staging, { recursive: true, force: true });
   await mkdir(staging, { recursive: true });
   try {
-    await writeFile(path9.join(staging, "package.json"), `${JSON.stringify({
+    await writeFile(path12.join(staging, "package.json"), `${JSON.stringify({
       name: "orkestrator-release",
       private: true,
       dependencies: { [STANDALONE_PACKAGE]: version }
@@ -4825,10 +4856,6 @@ var init_manifest = __esm(() => {
   ];
 });
 
-// ../toolchain/src/layout.ts
-var TOOLCHAIN_DIRECTORY = "toolchains", CURRENT_TOOLCHAIN_LINK = "current";
-var init_layout = () => {};
-
 // ../toolchain/src/manager.ts
 import { spawn } from "child_process";
 import { createHash as createHash4, randomUUID as randomUUID4 } from "crypto";
@@ -4838,37 +4865,37 @@ import {
   copyFile as copyFile2,
   lstat,
   mkdir as mkdir3,
-  mkdtemp,
+  mkdtemp as mkdtemp2,
   open as open2,
   readFile as readFile2,
-  readdir,
+  readdir as readdir2,
   readlink,
   rename as rename2,
   rm as rm3,
-  stat,
+  stat as stat2,
   symlink as symlink2,
   utimes
 } from "fs/promises";
-import path11 from "path";
+import path14 from "path";
 import { pipeline } from "stream/promises";
 import { createGunzip } from "zlib";
 function delay(milliseconds) {
   return new Promise((resolve) => setTimeout(resolve, milliseconds));
 }
 function artifactDirectory(rootDir, artifact) {
-  return path11.join(rootDir, artifact.name, artifact.version, `${artifact.platform}-${artifact.architecture}`);
+  return path14.join(rootDir, artifact.name, artifact.version, `${artifact.platform}-${artifact.architecture}`);
 }
 function artifactExecutablePath(rootDir, artifact) {
-  return path11.join(artifactDirectory(rootDir, artifact), artifact.executable.fileName);
+  return path14.join(artifactDirectory(rootDir, artifact), artifact.executable.fileName);
 }
 function upstreamExecutablePath(rootDir, artifact) {
-  return path11.join(artifactDirectory(rootDir, artifact), `.upstream-${artifact.executable.fileName}`);
+  return path14.join(artifactDirectory(rootDir, artifact), `.upstream-${artifact.executable.fileName}`);
 }
 function artifactCompanions(artifact) {
   return artifact.companions ?? [];
 }
 function companionPath(rootDir, artifact, companion) {
-  return path11.join(artifactDirectory(rootDir, artifact), companion.fileName);
+  return path14.join(artifactDirectory(rootDir, artifact), companion.fileName);
 }
 function artifactArchiveBytes(artifact) {
   return artifactCompanions(artifact).reduce((total, companion) => total + companion.archive.size, artifact.archive.size);
@@ -4892,7 +4919,7 @@ function assertValidArtifactMetadata(artifact) {
     }
     const paths = new Set;
     for (const file of artifact.archive.bundleFiles) {
-      const normalized = path11.posix.normalize(file.path);
+      const normalized = path14.posix.normalize(file.path);
       if (normalized !== file.path || normalized.startsWith("../") || normalized.startsWith("/") || normalized.includes("\\") || paths.has(normalized) || !Number.isSafeInteger(file.size) || file.size < 1 || !/^[a-f0-9]{64}$/.test(file.sha256)) {
         throw new Error(`${artifact.name} manifest has an unsafe bundle file`);
       }
@@ -4918,7 +4945,7 @@ function assertValidArtifactMetadata(artifact) {
   }
   const activationNames = new Set([artifact.name, artifact.executable.fileName]);
   for (const alias of artifact.activationAliases ?? []) {
-    if (!alias || alias.startsWith(".") || alias.includes("/") || alias.includes("\\") || alias !== path11.basename(alias) || activationNames.has(alias)) {
+    if (!alias || alias.startsWith(".") || alias.includes("/") || alias.includes("\\") || alias !== path14.basename(alias) || activationNames.has(alias)) {
       throw new Error(`${artifact.name} manifest has an unsafe or duplicate activation alias`);
     }
     activationNames.add(alias);
@@ -4928,7 +4955,7 @@ function assertValidArtifactMetadata(artifact) {
     if (companion.archive.format !== "zip" && companion.archive.format !== "tar.gz") {
       throw new Error(`${artifact.name} companion has an unsupported archive format`);
     }
-    if (!companion.fileName || companion.fileName.startsWith(".") || companion.fileName.includes("/") || companion.fileName.includes("\\") || companion.fileName !== path11.basename(companion.fileName)) {
+    if (!companion.fileName || companion.fileName.startsWith(".") || companion.fileName.includes("/") || companion.fileName.includes("\\") || companion.fileName !== path14.basename(companion.fileName)) {
       throw new Error(`${artifact.name} companion has an unsafe file name`);
     }
     if (companionNames.has(companion.fileName)) {
@@ -4994,7 +5021,7 @@ async function isValidExecutable(rootDir, artifact) {
     if (!await isValidUpstreamExecutable(rootDir, artifact))
       return false;
     for (const bundled of artifact.archive.bundleFiles ?? []) {
-      if (!await isValidFile(path11.join(artifactDirectory(rootDir, artifact), ...bundled.path.split("/")), bundled)) {
+      if (!await isValidFile(path14.join(artifactDirectory(rootDir, artifact), ...bundled.path.split("/")), bundled)) {
         return false;
       }
     }
@@ -5011,7 +5038,7 @@ async function isValidExecutable(rootDir, artifact) {
     if ((file.mode & 511) !== 320)
       await chmod(executablePath, 320);
     for (const bundled of artifact.archive.bundleFiles ?? []) {
-      if (!await isValidFile(path11.join(artifactDirectory(rootDir, artifact), ...bundled.path.split("/")), bundled)) {
+      if (!await isValidFile(path14.join(artifactDirectory(rootDir, artifact), ...bundled.path.split("/")), bundled)) {
         return false;
       }
     }
@@ -5030,9 +5057,9 @@ async function bundleTreeEntries(directory, artifact) {
     excludedExecutablePaths.add(`.upstream-${artifact.executable.fileName}`);
   }
   const visit = async (currentDirectory, prefix = "") => {
-    for (const entry of await readdir(currentDirectory, { withFileTypes: true })) {
+    for (const entry of await readdir2(currentDirectory, { withFileTypes: true })) {
       const relativePath = prefix ? `${prefix}/${entry.name}` : entry.name;
-      const filePath = path11.join(currentDirectory, entry.name);
+      const filePath = path14.join(currentDirectory, entry.name);
       if (entry.isDirectory()) {
         await visit(filePath, relativePath);
       } else if (entry.isFile() && !entry.isSymbolicLink()) {
@@ -5147,7 +5174,7 @@ async function initializeInstallLock(lockPath, owner, openLockFile) {
   }
 }
 async function acquireInstallLock(rootDir, onProgress, timings, openLockFile, ownerProcessExists) {
-  const lockPath = path11.join(rootDir, INSTALL_LOCK);
+  const lockPath = path14.join(rootDir, INSTALL_LOCK);
   const startedAt = Date.now();
   let announcedWait = false;
   while (Date.now() - startedAt < timings.lockWaitTimeoutMs) {
@@ -5198,7 +5225,7 @@ async function acquireInstallLock(rootDir, onProgress, timings, openLockFile, ow
         continue;
       }
     }
-    const lockStat = await stat(lockPath).catch(() => null);
+    const lockStat = await stat2(lockPath).catch(() => null);
     if (!observedOwner && lockStat && Date.now() - lockStat.mtimeMs > timings.lockStaleAfterMs) {
       const currentOwner = await readInstallLockOwner(lockPath);
       if (!currentOwner) {
@@ -5328,8 +5355,8 @@ async function extractTarGzipBundle(archivePath, destinationDirectory, label, ar
       stream.resume();
       return;
     }
-    const normalized = path11.posix.normalize(relative);
-    if (normalized.startsWith("../") || normalized.startsWith("/") || normalized.includes("\\") || path11.isAbsolute(normalized)) {
+    const normalized = path14.posix.normalize(relative);
+    if (normalized.startsWith("../") || normalized.startsWith("/") || normalized.includes("\\") || path14.isAbsolute(normalized)) {
       extract2.destroy(new Error(`Unsafe path in ${label} bundle`));
       stream.resume();
       return;
@@ -5341,7 +5368,7 @@ async function extractTarGzipBundle(archivePath, destinationDirectory, label, ar
       stream.resume();
       return;
     }
-    const destination = path11.join(destinationDirectory, ...normalized.split("/"));
+    const destination = path14.join(destinationDirectory, ...normalized.split("/"));
     if (header.type === "directory") {
       stream.once("end", next);
       stream.resume();
@@ -5359,7 +5386,7 @@ async function extractTarGzipBundle(archivePath, destinationDirectory, label, ar
     }
     if (header.name === archive.entryPath)
       foundExecutable = true;
-    mkdir3(path11.dirname(destination), { recursive: true, mode: 448 }).then(() => pipeline(stream, createWriteStream(destination, {
+    mkdir3(path14.dirname(destination), { recursive: true, mode: 448 }).then(() => pipeline(stream, createWriteStream(destination, {
       flags: "wx",
       mode: (header.mode ?? 0) & 73 ? 320 : 256
     }))).then(() => next(), (error) => extract2.destroy(error instanceof Error ? error : new Error(String(error))));
@@ -5521,7 +5548,7 @@ async function repairInvalidMacSignature(executablePath, artifact, timeoutMs, sp
   await runCodesign(["--sign", "-", "--force", executablePath], `${artifact.name} could not be ad-hoc signed after source verification`, timeoutMs, spawnProcess);
 }
 async function prepareRepairableExecutable(sourcePath, executablePath, artifact, skipExecutableProbeForTests, processTimeoutMs, spawnProcess) {
-  const temporaryPath = path11.join(path11.dirname(executablePath), `.repair-${artifact.executable.fileName}-${randomUUID4()}.tmp`);
+  const temporaryPath = path14.join(path14.dirname(executablePath), `.repair-${artifact.executable.fileName}-${randomUUID4()}.tmp`);
   try {
     await copyFile2(sourcePath, temporaryPath);
     await chmod(temporaryPath, 448);
@@ -5553,8 +5580,8 @@ async function refreshRepairableArtifact(rootDir, artifact, skipExecutableProbeF
 async function stageCompanions(stagingDirectory, artifact, companions, fetchImpl, onBytes, startBytes, allowInsecureDownloadsForTests, skipExecutableProbeForTests, timings, spawnProcess) {
   let downloadedBytes = startBytes;
   for (const companion of companions) {
-    const companionArchivePath = path11.join(stagingDirectory, `.archive-${companion.fileName}.${archiveExtension(companion.archive)}`);
-    const companionFilePath = path11.join(stagingDirectory, companion.fileName);
+    const companionArchivePath = path14.join(stagingDirectory, `.archive-${companion.fileName}.${archiveExtension(companion.archive)}`);
+    const companionFilePath = path14.join(stagingDirectory, companion.fileName);
     const precedingBytes = downloadedBytes;
     await downloadArchive(companion.fileName, companion.archive, companionArchivePath, fetchImpl, (received) => onBytes(precedingBytes + received), allowInsecureDownloadsForTests, timings.downloadTimeoutMs);
     downloadedBytes += companion.archive.size;
@@ -5579,28 +5606,28 @@ async function stageCompanions(stagingDirectory, artifact, companions, fetchImpl
   }
 }
 async function repairArtifactCompanions(rootDir, artifact, companions, fetchImpl, onBytes, onVerify, allowInsecureDownloadsForTests, skipExecutableProbeForTests, timings, spawnProcess) {
-  const stagingDirectory = await mkdtemp(path11.join(rootDir, `.staging-${artifact.name}-`));
+  const stagingDirectory = await mkdtemp2(path14.join(rootDir, `.staging-${artifact.name}-`));
   try {
     await stageCompanions(stagingDirectory, artifact, companions, fetchImpl, onBytes, 0, allowInsecureDownloadsForTests, skipExecutableProbeForTests, timings, spawnProcess);
     onVerify();
     const destinationDirectory = artifactDirectory(rootDir, artifact);
     for (const companion of companions) {
-      await rename2(path11.join(stagingDirectory, companion.fileName), path11.join(destinationDirectory, companion.fileName));
+      await rename2(path14.join(stagingDirectory, companion.fileName), path14.join(destinationDirectory, companion.fileName));
     }
   } finally {
     await rm3(stagingDirectory, { recursive: true, force: true });
   }
 }
 async function installArtifact(rootDir, artifact, fetchImpl, onBytes, onVerify, allowInsecureDownloadsForTests, skipExecutableProbeForTests, timings, spawnProcess) {
-  const stagingDirectory = await mkdtemp(path11.join(rootDir, `.staging-${artifact.name}-`));
-  const archivePath = path11.join(stagingDirectory, `archive.${archiveExtension(artifact.archive)}`);
-  const executablePath = path11.join(stagingDirectory, artifact.executable.fileName);
-  const extractedPath = artifact.executable.repairInvalidMacSignature ? path11.join(stagingDirectory, `.upstream-${artifact.executable.fileName}`) : executablePath;
+  const stagingDirectory = await mkdtemp2(path14.join(rootDir, `.staging-${artifact.name}-`));
+  const archivePath = path14.join(stagingDirectory, `archive.${archiveExtension(artifact.archive)}`);
+  const executablePath = path14.join(stagingDirectory, artifact.executable.fileName);
+  const extractedPath = artifact.executable.repairInvalidMacSignature ? path14.join(stagingDirectory, `.upstream-${artifact.executable.fileName}`) : executablePath;
   try {
     await downloadArchive(artifact.name, artifact.archive, archivePath, fetchImpl, onBytes, allowInsecureDownloadsForTests, timings.downloadTimeoutMs);
     if (artifact.archive.bundleRoot) {
       await extractTarGzipBundle(archivePath, stagingDirectory, artifact.name, artifact.archive);
-      const bundledExecutable = path11.join(stagingDirectory, ...artifact.archive.entryPath.slice(artifact.archive.bundleRoot.length).split("/"));
+      const bundledExecutable = path14.join(stagingDirectory, ...artifact.archive.entryPath.slice(artifact.archive.bundleRoot.length).split("/"));
       if (bundledExecutable !== extractedPath) {
         await rename2(bundledExecutable, extractedPath);
       }
@@ -5651,7 +5678,7 @@ async function installArtifact(rootDir, artifact, fetchImpl, onBytes, onVerify,
     await stageCompanions(stagingDirectory, artifact, artifactCompanions(artifact), fetchImpl, onBytes, artifact.archive.size, allowInsecureDownloadsForTests, skipExecutableProbeForTests, timings, spawnProcess);
     onVerify();
     const destinationDirectory = artifactDirectory(rootDir, artifact);
-    await mkdir3(path11.dirname(destinationDirectory), { recursive: true, mode: 448 });
+    await mkdir3(path14.dirname(destinationDirectory), { recursive: true, mode: 448 });
     await rm3(destinationDirectory, { recursive: true, force: true });
     await rename2(stagingDirectory, destinationDirectory);
     await chmod(destinationDirectory, 448);
@@ -5662,17 +5689,17 @@ async function installArtifact(rootDir, artifact, fetchImpl, onBytes, onVerify,
   }
 }
 async function cleanStagingDirectories(rootDir) {
-  const entries = await readdir(rootDir, { withFileTypes: true });
-  await Promise.all(entries.filter((entry) => entry.isDirectory() && entry.name.startsWith(".staging-")).map((entry) => rm3(path11.join(rootDir, entry.name), { recursive: true, force: true })));
+  const entries = await readdir2(rootDir, { withFileTypes: true });
+  await Promise.all(entries.filter((entry) => entry.isDirectory() && entry.name.startsWith(".staging-")).map((entry) => rm3(path14.join(rootDir, entry.name), { recursive: true, force: true })));
 }
 async function touchArtifactDirectory(rootDir, artifact) {
   const now = new Date;
-  await utimes(path11.dirname(artifactDirectory(rootDir, artifact)), now, now).catch(() => {
+  await utimes(path14.dirname(artifactDirectory(rootDir, artifact)), now, now).catch(() => {
     return;
   });
 }
 function versionLeaseDirectory(rootDir, name, version) {
-  return path11.join(rootDir, LEASE_DIRECTORY, name, version);
+  return path14.join(rootDir, LEASE_DIRECTORY, name, version);
 }
 async function acquireVersionLease(rootDir, artifact, openLeaseFile) {
   const leaseKey = `${rootDir}\x00${artifact.name}\x00${artifact.version}`;
@@ -5687,7 +5714,7 @@ async function acquireVersionLease(rootDir, artifact, openLeaseFile) {
   };
   const directory = versionLeaseDirectory(rootDir, artifact.name, artifact.version);
   await mkdir3(directory, { recursive: true, mode: 448 });
-  const leasePath = path11.join(directory, `${owner.pid}-${owner.token}.json`);
+  const leasePath = path14.join(directory, `${owner.pid}-${owner.token}.json`);
   const handle = await openLeaseFile(leasePath, "wx", 384);
   try {
     await handle.writeFile(JSON.stringify(owner), "utf8");
@@ -5705,10 +5732,10 @@ async function acquireVersionLease(rootDir, artifact, openLeaseFile) {
 }
 async function versionHasLiveLease(rootDir, name, version, ownerProcessExists) {
   const directory = versionLeaseDirectory(rootDir, name, version);
-  const entries = await readdir(directory, { withFileTypes: true }).catch(() => []);
+  const entries = await readdir2(directory, { withFileTypes: true }).catch(() => []);
   let live = false;
   await Promise.all(entries.filter((entry) => entry.isFile()).map(async (entry) => {
-    const leasePath = path11.join(directory, entry.name);
+    const leasePath = path14.join(directory, entry.name);
     try {
       const parsed = JSON.parse(await readFile2(leasePath, "utf8"));
       if (typeof parsed.token === "string" && typeof parsed.pid === "number" && typeof parsed.createdAt === "string" && ownerProcessExists(parsed.pid)) {
@@ -5731,13 +5758,13 @@ async function pruneSupersededVersions(rootDir, artifacts, retainSupersededMs, o
   }
   const staleBefore = Date.now() - retainSupersededMs;
   await Promise.all(Array.from(keepByName, async ([name, keep]) => {
-    const toolDir = path11.join(rootDir, name);
+    const toolDir = path14.join(rootDir, name);
     try {
-      const entries = await readdir(toolDir, { withFileTypes: true });
+      const entries = await readdir2(toolDir, { withFileTypes: true });
       await Promise.all(entries.filter((entry) => entry.isDirectory() && !keep.has(entry.name)).map(async (entry) => {
-        const versionDir = path11.join(toolDir, entry.name);
+        const versionDir = path14.join(toolDir, entry.name);
         try {
-          if ((await stat(versionDir)).mtimeMs > staleBefore)
+          if ((await stat2(versionDir)).mtimeMs > staleBefore)
             return;
           if (await versionHasLiveLease(rootDir, name, entry.name, ownerProcessExists))
             return;
@@ -5776,8 +5803,8 @@ function activationSetId(artifacts) {
   return createHash4("sha256").update(JSON.stringify(identity)).digest("hex");
 }
 async function activateExecutables(rootDir, artifacts) {
-  const binRoot = path11.join(rootDir, "bin");
-  const binDir = path11.join(binRoot, activationSetId(artifacts));
+  const binRoot = path14.join(rootDir, "bin");
+  const binDir = path14.join(binRoot, activationSetId(artifacts));
   await mkdir3(binRoot, { recursive: true, mode: 448 });
   const binRootEntry = await lstat(binRoot);
   if (!binRootEntry.isDirectory() || binRootEntry.isSymbolicLink()) {
@@ -5792,8 +5819,8 @@ async function activateExecutables(rootDir, artifacts) {
   await chmod(binDir, 448);
   const executables = {};
   const activate = async (linkName, target) => {
-    const activePath = path11.join(binDir, linkName);
-    const temporaryLink = path11.join(binDir, `.${linkName}-${randomUUID4()}.tmp`);
+    const activePath = path14.join(binDir, linkName);
+    const temporaryLink = path14.join(binDir, `.${linkName}-${randomUUID4()}.tmp`);
     const existingTarget = await readlink(activePath).catch(() => null);
     if (existingTarget !== target) {
       await symlink2(target, temporaryLink, "file");
@@ -5841,7 +5868,7 @@ async function ensurePinnedToolchains(options2) {
   const timings = { ...DEFAULT_TIMINGS, ...options2.timingsForTests };
   const spawnProcess = options2.spawnForTests ?? spawn;
   const ownerProcessExists = options2.processExistsForTests ?? ((pid) => processExists(pid, options2.processKillForTests));
-  const rootDir = path11.join(options2.dataDir, TOOLCHAIN_DIRECTORY);
+  const rootDir = path14.join(options2.dataDir, TOOLCHAIN_DIRECTORY);
   const totalTools = artifacts.length;
   const toolFractions = new Map(artifacts.map((artifact) => [artifact.name, 0]));
   const progress = (value) => {
@@ -6006,7 +6033,7 @@ var init_agent_platforms = __esm(() => {
 
 // ../toolchain/src/platform-selection.ts
 import { promises as fs7 } from "fs";
-import path12 from "path";
+import path15 from "path";
 async function readJsonFile(filePath) {
   try {
     return JSON.parse(await fs7.readFile(filePath, "utf8"));
@@ -6015,7 +6042,7 @@ async function readJsonFile(filePath) {
   }
 }
 async function loadAgentPlatformSelection(dataDir) {
-  const config = await readJsonFile(path12.join(dataDir, AGENT_CONFIG_FILE));
+  const config = await readJsonFile(path15.join(dataDir, AGENT_CONFIG_FILE));
   if (config && typeof config === "object" && !Array.isArray(config)) {
     const global2 = config.global;
     if (global2 && typeof global2 === "object" && !Array.isArray(global2)) {
@@ -6031,7 +6058,7 @@ async function loadAgentPlatformSelection(dataDir) {
       needsFirstRunChoice: false
     };
   }
-  const sidecar = await readJsonFile(path12.join(dataDir, AGENT_PLATFORM_SELECTION_FILE));
+  const sidecar = await readJsonFile(path15.join(dataDir, AGENT_PLATFORM_SELECTION_FILE));
   if (sidecar && typeof sidecar === "object" && !Array.isArray(sidecar)) {
     const enabled = normalizeAgentPlatforms(sidecar.enabled, []);
     if (enabled.length > 0)
@@ -6046,8 +6073,8 @@ var init_platform_selection = __esm(() => {
 
 // ../toolchain/src/install.ts
 import { randomUUID as randomUUID5 } from "crypto";
-import { lstat as lstat2, mkdir as mkdir4, readdir as readdir2, readlink as readlink2, rename as rename3, rm as rm4, symlink as symlink3 } from "fs/promises";
-import path13 from "path";
+import { lstat as lstat2, mkdir as mkdir4, readdir as readdir3, readlink as readlink2, rename as rename3, rm as rm4, symlink as symlink3 } from "fs/promises";
+import path16 from "path";
 async function resolveToolchainSelection(options2) {
   const known = Object.keys(PINNED_TOOL_VERSIONS);
   const withSupportTools = (chosen) => known.filter((name) => chosen.has(name) || isSupportToolName(name));
@@ -6106,16 +6133,16 @@ async function installPinnedToolchains(options2) {
   };
 }
 async function toolsInCurrent(rootDir) {
-  const entries = await readdir2(path13.join(rootDir, "bin", CURRENT_TOOLCHAIN_LINK)).catch(() => []);
+  const entries = await readdir3(path16.join(rootDir, "bin", CURRENT_TOOLCHAIN_LINK)).catch(() => []);
   return Object.keys(PINNED_TOOL_VERSIONS).filter((tool) => entries.includes(tool));
 }
 async function pointCurrentAt(rootDir, binDir) {
-  const binRoot = path13.join(rootDir, "bin");
-  if (path13.dirname(binDir) !== binRoot) {
+  const binRoot = path16.join(rootDir, "bin");
+  if (path16.dirname(binDir) !== binRoot) {
     throw new Error(`Activation directory ${binDir} is not directly inside ${binRoot}`);
   }
-  const link = path13.join(binRoot, CURRENT_TOOLCHAIN_LINK);
-  const target = path13.basename(binDir);
+  const link = path16.join(binRoot, CURRENT_TOOLCHAIN_LINK);
+  const target = path16.basename(binDir);
   await mkdir4(binRoot, { recursive: true, mode: 448 });
   const existing = await lstat2(link).catch(() => null);
   if (existing && !existing.isSymbolicLink()) {
@@ -6123,7 +6150,7 @@ async function pointCurrentAt(rootDir, binDir) {
   }
   if (existing && await readlink2(link) === target)
     return link;
-  const temporary = path13.join(binRoot, `.${CURRENT_TOOLCHAIN_LINK}-${randomUUID5()}.tmp`);
+  const temporary = path16.join(binRoot, `.${CURRENT_TOOLCHAIN_LINK}-${randomUUID5()}.tmp`);
   await symlink3(target, temporary, "dir");
   try {
     await rename3(temporary, link);
@@ -6164,6 +6191,7 @@ var SERVER_VALUE_FLAGS = Object.freeze([
   "--docker-image",
   "--fallback-host",
   "--host",
+  "--loopback-client-port",
   "--port",
   "--renderer-dev-server-url",
   "--renderer-root",
@@ -6178,6 +6206,7 @@ var SERVER_VALUE_FLAGS = Object.freeze([
 ]);
 var SERVER_BOOLEAN_FLAGS = Object.freeze([
   "--allow-non-tailscale-bind",
+  "--command-node",
   "--desktop-updater",
   "--desktop-web-client",
   "--strict-docker-owner",
@@ -6512,6 +6541,22 @@ var PUBLIC_ACTIONS = {
     milestone: "C",
     summary: "Read one bounded, ordered transcript page with a continuation cursor."
   },
+  "changes.view": {
+    version: 1,
+    mutation: false,
+    effects: [],
+    observation: "immediate",
+    milestone: "D",
+    summary: "Read the backend's change projection for an environment (scope, state, line counts and their quality) with one page of changed files."
+  },
+  "changes.history": {
+    version: 1,
+    mutation: false,
+    effects: [],
+    observation: "immediate",
+    milestone: "D",
+    summary: "Read one page of a session's turns, each with the backend's change projection."
+  },
   "run.get": {
     version: 1,
     mutation: false,
@@ -7138,89 +7183,115 @@ function splitFlag(token) {
   return [body.slice(0, equals), body.slice(equals + 1)];
 }
 
-// src/client/commands/connection.ts
+// src/client/fix.ts
+import { existsSync as existsSync2, readFileSync as readFileSync2, realpathSync as realpathSync2 } from "fs";
+import { mkdtemp, readdir, rmdir, stat } from "fs/promises";
+import os3 from "os";
 import path5 from "path";
-import { randomUUID as randomUUID3 } from "crypto";
-import { promises as fs4 } from "fs";
 
-// ../protocol/src/backend-instance.ts
-var BACKEND_INSTANCE_DESCRIPTOR_FILE = "backend-instance.json";
-var BACKEND_INSTANCE_DESCRIPTOR_TYPE = "orkestrator-backend-instance";
-var BACKEND_INSTANCE_DESCRIPTOR_MAX_BYTES = 16 * 1024;
+// ../protocol/src/host-maintenance.ts
+var HOST_UPDATE_IDLE_WAIT = Object.freeze({
+  defaultSeconds: 3600,
+  minSeconds: 60,
+  maxSeconds: 86400
+});
+var HOST_UPDATE_CHANNELS = ["stable", "beta", "unstable"];
+var HOST_UPDATE_CHANNEL_TAGS = Object.freeze({ stable: "latest", beta: "beta", unstable: "alpha" });
+function isHostUpdateChannel(value) {
+  return HOST_UPDATE_CHANNELS.includes(value);
+}
+var ACTIVE_HOST_UPDATE_JOB_STATES = new Set([
+  "requested",
+  "downloading",
+  "waiting-for-idle",
+  "awaiting-restart",
+  "restarting"
+]);
+var CANCELLABLE_HOST_UPDATE_JOB_STATES = new Set([
+  "requested",
+  "downloading",
+  "waiting-for-idle",
+  "awaiting-restart"
+]);
+var HOST_MAINTENANCE_LIMITS = Object.freeze({
+  idMaxChars: 100,
+  versionMaxChars: 64,
+  errorMaxChars: 500
+});
+var VERSION_PATTERN = /^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/;
+function isHostVersion(value) {
+  return typeof value === "string" && value.length <= HOST_MAINTENANCE_LIMITS.versionMaxChars && VERSION_PATTERN.test(value);
+}
+
+// ../protocol/src/node/application-logging.ts
+import { readFileSync } from "fs";
+import path from "path";
+
+// ../protocol/src/debug-logging.ts
+var DEFAULT_DEBUG_LOG_RETENTION_DAYS = 7;
+var MIN_DEBUG_LOG_RETENTION_DAYS = 1;
+var MAX_DEBUG_LOG_RETENTION_DAYS = 3650;
+function isValidDebugLogRetentionDays(value) {
+  return typeof value === "number" && Number.isSafeInteger(value) && value >= MIN_DEBUG_LOG_RETENTION_DAYS && value <= MAX_DEBUG_LOG_RETENTION_DAYS;
+}
+function normalizeDebugLogRetentionDays(value) {
+  return isValidDebugLogRetentionDays(value) ? value : DEFAULT_DEBUG_LOG_RETENTION_DAYS;
+}
+
+// ../protocol/src/node/application-logging.ts
+var LOG_CLEANUP_INTERVAL_MS = 6 * 60 * 60 * 1000;
+var MAX_PENDING_LOG_BYTES = 4 * 1024 * 1024;
+var MAX_LOG_ENTRY_BYTES = 64 * 1024;
+var MAX_LOG_FILE_BYTES = 32 * 1024 * 1024;
+var MAX_LOG_DIRECTORY_BYTES = 512 * 1024 * 1024;
 function isRecord2(value) {
-  return value !== null && typeof value === "object" && !Array.isArray(value);
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
-function isHttpUrl(value) {
-  if (typeof value !== "string" || value.length > 2048)
-    return false;
+function readApplicationLogSettings(dataDir) {
   try {
-    const url = new URL(value);
-    return (url.protocol === "http:" || url.protocol === "https:") && url.username === "" && url.password === "" && url.search === "" && url.hash === "";
+    const parsed = JSON.parse(readFileSync(path.join(dataDir, "config.json"), "utf8"));
+    const global2 = isRecord2(parsed) && isRecord2(parsed.global) ? parsed.global : {};
+    return {
+      enabled: global2.debugLogging === true,
+      retentionDays: normalizeDebugLogRetentionDays(global2.debugLogRetentionDays)
+    };
   } catch {
-    return false;
-  }
-}
-function parseBackendInstanceDescriptor(value) {
-  if (!isRecord2(value))
-    throw new Error("Backend instance descriptor must be an object");
-  if (value.version !== 1 || value.type !== BACKEND_INSTANCE_DESCRIPTOR_TYPE) {
-    throw new Error("Backend instance descriptor has an unsupported version");
-  }
-  const text = (key, max = 512) => {
-    const field = value[key];
-    if (typeof field !== "string" || field.length === 0 || field.length > max) {
-      throw new Error(`Backend instance descriptor field is invalid: ${key}`);
-    }
-    return field;
-  };
-  if (!Number.isSafeInteger(value.pid) || value.pid <= 0) {
-    throw new Error("Backend instance descriptor field is invalid: pid");
-  }
-  if (!isHttpUrl(value.url))
-    throw new Error("Backend instance descriptor field is invalid: url");
-  if (value.browserUrl !== undefined && !isHttpUrl(value.browserUrl)) {
-    throw new Error("Backend instance descriptor field is invalid: browserUrl");
-  }
-  if (!Number.isSafeInteger(value.publicApiSchemaVersion) || value.publicApiSchemaVersion < 1) {
-    throw new Error("Backend instance descriptor field is invalid: publicApiSchemaVersion");
-  }
-  const authFile = text("authFile", 4096);
-  const dataDir = text("dataDir", 4096);
-  if (!authFile.startsWith("/") || !dataDir.startsWith("/")) {
-    throw new Error("Backend instance descriptor paths must be absolute");
+    return {
+      enabled: false,
+      retentionDays: normalizeDebugLogRetentionDays(undefined)
+    };
   }
-  return {
-    version: 1,
-    type: BACKEND_INSTANCE_DESCRIPTOR_TYPE,
-    installationId: text("installationId", 200),
-    generation: text("generation", 200),
-    pid: value.pid,
-    startedAt: text("startedAt", 64),
-    url: value.url,
-    ...value.browserUrl !== undefined ? { browserUrl: value.browserUrl } : {},
-    authFile,
-    dataDir,
-    appVersion: text("appVersion", 64),
-    publicApiSchemaVersion: value.publicApiSchemaVersion
-  };
 }
+var BENIGN_RMDIR_CODES = new Set(["ENOENT", "ENOTEMPTY", "EEXIST", "ERR_FS_EISDIR"]);
+
+// ../protocol/src/terminal-agent-launch.ts
+var OPENCODE_PINNED_RUNTIME_ENV = Object.freeze({
+  OPENCODE_DISABLE_AUTOUPDATE: "1"
+});
+var CLAUDE_PINNED_RUNTIME_ENV = Object.freeze({
+  DISABLE_AUTOUPDATER: "1",
+  FORCE_AUTOUPDATE_PLUGINS: "1"
+});
+
+// src/client/fix.ts
+init_layout();
 
 // src/client/config.ts
 import { randomUUID } from "crypto";
 import { promises as fs } from "fs";
 import os from "os";
-import path from "path";
+import path3 from "path";
 var CLI_CONFIG_VERSION = 1;
 var MAX_CONFIG_BYTES = 256 * 1024;
 var MAX_CONNECTIONS = 64;
 var CONNECTION_NAME = /^[a-z0-9][a-z0-9._-]{0,47}$/;
 function defaultCliConfigDir(env, platform = process.platform, home = os.homedir()) {
   if (env.ORKESTRATOR_CLI_CONFIG_DIR)
-    return path.resolve(env.ORKESTRATOR_CLI_CONFIG_DIR);
+    return path3.resolve(env.ORKESTRATOR_CLI_CONFIG_DIR);
   if (platform === "darwin") {
-    return path.join(home, "Library", "Application Support", "orkestrator-cli");
+    return path3.join(home, "Library", "Application Support", "orkestrator-cli");
   }
-  return path.join(env.XDG_CONFIG_HOME ?? path.join(home, ".config"), "orkestrator-cli");
+  return path3.join(env.XDG_CONFIG_HOME ?? path3.join(home, ".config"), "orkestrator-cli");
 }
 function isConnectionName(value) {
   return CONNECTION_NAME.test(value);
@@ -7249,7 +7320,7 @@ function parseSaved(value) {
   const record = value;
   const addedAt = typeof record.addedAt === "string" ? record.addedAt : new Date(0).toISOString();
   const installationId = typeof record.installationId === "string" && record.installationId.length <= 200 ? record.installationId : undefined;
-  if (record.kind === "descriptor" && typeof record.descriptorPath === "string" && path.isAbsolute(record.descriptorPath)) {
+  if (record.kind === "descriptor" && typeof record.descriptorPath === "string" && path3.isAbsolute(record.descriptorPath)) {
     return {
       kind: "descriptor",
       descriptorPath: record.descriptorPath,
@@ -7257,7 +7328,7 @@ function parseSaved(value) {
       addedAt
     };
   }
-  if (record.kind === "endpoint" && typeof record.url === "string" && typeof record.credentialFile === "string" && path.isAbsolute(record.credentialFile)) {
+  if (record.kind === "endpoint" && typeof record.url === "string" && typeof record.credentialFile === "string" && path3.isAbsolute(record.credentialFile)) {
     return {
       kind: "endpoint",
       url: record.url,
@@ -7276,13 +7347,13 @@ class CliConfigStore {
     this.directory = directory;
   }
   get file() {
-    return path.join(this.directory, "connections.json");
+    return path3.join(this.directory, "connections.json");
   }
   get credentialsDirectory() {
-    return path.join(this.directory, "credentials");
+    return path3.join(this.directory, "credentials");
   }
   get receiptsDirectory() {
-    return path.join(this.directory, "receipts");
+    return path3.join(this.directory, "receipts");
   }
   async read() {
     let text;
@@ -7338,24 +7409,24 @@ class CliConfigStore {
 `);
   }
   async storeCredential(name, token) {
-    const file = path.join(this.credentialsDirectory, `${name}.json`);
+    const file = path3.join(this.credentialsDirectory, `${name}.json`);
     await writePrivateFile(file, `${JSON.stringify({ token })}
 `);
     return file;
   }
   async removeOwnedCredential(file) {
-    if (path.dirname(file) !== this.credentialsDirectory)
+    if (path3.dirname(file) !== this.credentialsDirectory)
       return;
     await fs.rm(file, { force: true });
   }
 }
 async function writePrivateFile(file, contents) {
-  const directory = path.dirname(file);
+  const directory = path3.dirname(file);
   await fs.mkdir(directory, { recursive: true, mode: 448 });
   await fs.chmod(directory, 448).catch(() => {
     return;
   });
-  const temporary = path.join(directory, `.${path.basename(file)}.${randomUUID()}.tmp`);
+  const temporary = path3.join(directory, `.${path3.basename(file)}.${randomUUID()}.tmp`);
   try {
     await fs.writeFile(temporary, contents, { mode: 384, flag: "wx" });
     await fs.rename(temporary, file);
@@ -7367,126 +7438,1271 @@ async function writePrivateFile(file, contents) {
   }
 }
 
-// src/client/format.ts
-function table(headers, rows) {
-  if (rows.length === 0)
-    return ["(none)"];
-  const widths = headers.map((header, index) => Math.min(60, Math.max(header.length, ...rows.map((row) => (row[index] ?? "").length))));
-  const line = (cells) => cells.map((cell, index) => {
-    const text = cell.length > widths[index] ? `${cell.slice(0, widths[index] - 1)}\u2026` : cell;
-    return text.padEnd(widths[index]);
-  }).join("  ").trimEnd();
-  return [line(headers), ...rows.map(line)];
-}
-function keyValues(entries) {
-  const width = Math.max(...entries.map(([key]) => key.length));
-  return entries.filter(([, value]) => value !== undefined).map(([key, value]) => {
-    const text = value === null ? "-" : typeof value === "object" ? JSON.stringify(value) : String(value);
-    return `${key.padEnd(width)}  ${text}`;
-  });
+// ../../apps/backend/src/data-dir.ts
+import os2 from "os";
+import path4 from "path";
+// ../../apps/backend/package.json
+var package_default = {
+  name: "@orkestrator/backend",
+  version: "2.25.0-alpha",
+  private: true,
+  type: "module",
+  exports: {
+    "./gateway": "./src/gateway.ts"
+  },
+  scripts: {
+    build: "bun scripts/build.ts",
+    dev: "bun --watch src/main.ts",
+    "dev:web": "bun --watch src/main.ts --port 34121 --fallback-host 127.0.0.1 --renderer-dev-server-url http://127.0.0.1:1420",
+    start: "bun dist/main.js",
+    "start:web": "bun dist/main.js --fallback-host 127.0.0.1",
+    "start:web-public": "bun dist/main.js --tailscale-serve --allowed-origins https://orkestrator.dev,https://www.orkestrator.dev",
+    test: "bun test --preload ../../tests/setup-node.ts src tests --parallel",
+    "test:workspace": "bun test --preload ../../tests/setup-node.ts src tests --only-failures ${ORKESTRATOR_TEST_TIMINGS_DIR:+--timings=$ORKESTRATOR_TEST_TIMINGS_DIR/backend.json --update-timings} --parallel=${ORKESTRATOR_TEST_WORKERS:-2}",
+    typecheck: "bunx tsc --noEmit -p tsconfig.json && bunx tsc --noEmit -p tsconfig.test.json"
+  },
+  dependencies: {
+    "@modelcontextprotocol/node": "2.1.1",
+    "@modelcontextprotocol/server": "2.3.1",
+    "@opencode-ai/sdk": "1.19.0",
+    "@orkestrator/protocol": "workspace:*",
+    "@orkestrator/toolchain": "workspace:*",
+    "@xterm/addon-serialize": "0.14.0",
+    "@xterm/headless": "6.0.0",
+    "chart.js": "4.5.1",
+    d3: "7.9.0",
+    dompurify: "3.4.17",
+    mermaid: "12.2.0",
+    "pdfjs-dist": "6.4.299",
+    "playwright-core": "1.64.0",
+    sharp: "^0.35.5",
+    ws: "8.22.0",
+    zod: "4.6.7"
+  },
+  devDependencies: {
+    "@modelcontextprotocol/client": "2.3.1",
+    "@types/ws": "8.18.2"
+  }
+};
+
+// ../../apps/backend/src/core/constants.ts
+var APP_SLUG = "orkestrator-v2";
+var AGENT_NETWORK_DOMAINS_BY_PLATFORM = Object.freeze({
+  codex: Object.freeze(["chatgpt.com", "auth.openai.com"]),
+  cursor: Object.freeze([
+    "api2.cursor.sh",
+    "api3.cursor.sh",
+    "api4.cursor.sh",
+    "api5.cursor.sh",
+    "repo42.cursor.sh",
+    "authenticator.cursor.sh",
+    "marketplace.cursorapi.com",
+    "cursor-cdn.com",
+    "cursor.com"
+  ]),
+  grok: Object.freeze([
+    "x.ai",
+    "auth.x.ai",
+    "api.x.ai",
+    "cli-chat-proxy.grok.com"
+  ]),
+  pi: Object.freeze([
+    "pi.dev",
+    "radius.pi.dev",
+    "api.anthropic.com",
+    "api.openai.com",
+    "generativelanguage.googleapis.com",
+    "api.x.ai",
+    "api.mistral.ai",
+    "api.groq.com",
+    "api.deepseek.com",
+    "api.cerebras.ai",
+    "api.together.ai",
+    "openrouter.ai"
+  ])
+});
+var MAX_CODEX_CONCURRENT_THREADS = Number.MAX_SAFE_INTEGER - 1;
+function sanitizeAppVersion(raw) {
+  const trimmed = raw?.trim() ?? "";
+  return /^[A-Za-z0-9._+-]{1,64}$/.test(trimmed) ? trimmed : "0.0.0";
 }
-function projectLines(project) {
-  return keyValues([
-    ["id", project.id],
-    ["name", project.name],
-    ["remote", project.gitUrl],
-    ["path", project.localPath],
-    ["folder", project.folder],
-    ["environments", project.environmentCount],
-    ["revision", project.revision]
-  ]);
+var BACKEND_PACKAGE_VERSION = sanitizeAppVersion(package_default.version);
+var APP_VERSION = sanitizeAppVersion(process.env.ORKESTRATOR_VERSION?.trim() || BACKEND_PACKAGE_VERSION);
+
+// ../../apps/backend/src/data-dir.ts
+function assertSupportedPlatform(platform = process.platform) {
+  if (platform === "win32") {
+    throw new Error("Orkestrator does not support Windows. Use macOS or Linux.");
+  }
 }
-function projectRows(projects) {
-  return table(["ID", "NAME", "ENVS", "PATH"], projects.map((project) => [
-    project.id,
-    project.name,
-    String(project.environmentCount),
-    project.localPath ?? "-"
-  ]));
+function defaultDataDir(platform = process.platform, env = process.env, home = os2.homedir()) {
+  assertSupportedPlatform(platform);
+  if (platform === "darwin")
+    return path4.join(home, "Library", "Application Support", APP_SLUG);
+  return path4.join(env.XDG_CONFIG_HOME ?? path4.join(home, ".config"), APP_SLUG);
 }
-function environmentLines(environment) {
-  return keyValues([
-    ["id", environment.id],
-    ["project", environment.projectId],
-    ["name", environment.name],
-    ["branch", environment.branch],
-    ["type", environment.environmentType],
-    ["status", environment.status],
-    ["ready", environment.ready],
-    ["setup", `${environment.setup.phase}${environment.setup.overridden ? " (overridden)" : ""}`],
-    ["activity", environment.activity.state],
-    ["lifecycle error", environment.lifecycle.error],
-    ["workspace", environment.workspacePath],
-    ["base", environment.base.commit ?? environment.base.branch],
-    ["startup session", environment.startupSession?.sessionId]
-  ]);
+
+// src/client/fix.ts
+var FIX_ISSUE_REPOSITORY = "orkestrator-ai/orkestrator-v2";
+var FIX_AGENTS = [
+  {
+    name: "claude",
+    displayName: "Claude Code",
+    args: (prompt, { logsDir }) => [prompt, ...logsDir ? ["--add-dir", logsDir] : []],
+    managedEnv: CLAUDE_PINNED_RUNTIME_ENV
+  },
+  { name: "codex", displayName: "Codex", args: (prompt) => [prompt] },
+  {
+    name: "opencode",
+    displayName: "OpenCode",
+    args: (prompt) => ["--prompt", prompt],
+    env: OPENCODE_PINNED_RUNTIME_ENV
+  }
+];
+var AGENT_LIST = FIX_AGENTS.map((agent) => agent.name).join(", ");
+var FIX_HELP = [
+  "Usage: orkestrator --fix AGENT [--data-dir DIR]",
+  "",
+  "Report a problem with Orkestrator. Instead of starting Orkestrator, opens AGENT",
+  `(${AGENT_LIST}) with instructions to ask you what went wrong, collect`,
+  "logs and version details from this machine, and draft a GitHub issue for",
+  `${FIX_ISSUE_REPOSITORY}. Nothing is filed until you approve the draft, and the`,
+  "agent is told to leave Orkestrator's files and settings unchanged.",
+  "",
+  "The agent on PATH is used; otherwise the copy Orkestrator installed. The agent",
+  "works in a new temporary directory, where it saves the draft as issue.md.",
+  "",
+  "Options:",
+  "  --data-dir DIR    Orkestrator data directory to inspect (default: ORKESTRATOR_DATA_DIR,",
+  "                    then the platform default)",
+  "",
+  "Examples:",
+  "  orkestrator --fix claude",
+  "  bunx orkestrator --fix codex"
+].join(`
+`);
+var SAFE_WORD2 = /^[a-z][a-z0-9-]{0,39}$/;
+function describeToken2(token) {
+  return SAFE_WORD2.test(token) ? `'${token}'` : "argument";
 }
-function environmentRows(environments) {
-  return table(["ID", "NAME", "TYPE", "STATUS", "READY"], environments.map((environment) => [
-    environment.id,
-    environment.name,
-    environment.environmentType,
-    environment.status,
-    environment.ready ? "yes" : "no"
-  ]));
+function isFixInvocation(argv) {
+  const end = argv.indexOf("--");
+  return (end < 0 ? argv : argv.slice(0, end)).some((token) => token === "--fix" || token.startsWith("--fix="));
 }
-function sessionRows(sessions) {
-  return table(["SESSION", "AGENT", "TAB", "ACTIVITY", "TITLE"], sessions.map((session) => [
-    session.id,
-    session.agent,
-    session.tabId,
-    session.activity,
-    session.title ?? ""
-  ]));
+function parseFixArguments(argv) {
+  const values = {};
+  let help = false;
+  for (let index = 0;index < argv.length; index += 1) {
+    const token = argv[index];
+    if (token === "--help" || token === "-h") {
+      help = true;
+      continue;
+    }
+    const equals = token.indexOf("=");
+    const name = token.startsWith("--") ? token.slice(2, equals > 0 ? equals : undefined) : null;
+    if (name !== "fix" && name !== "data-dir") {
+      return {
+        kind: "error",
+        message: name === null ? `Unexpected ${describeToken2(token)} for --fix; usage: orkestrator --fix AGENT` : `Unknown option for --fix: ${describeToken2(name)}`
+      };
+    }
+    if (values[name] !== undefined) {
+      return { kind: "error", message: `--${name} may be given only once` };
+    }
+    let value = "";
+    if (equals > 0) {
+      value = token.slice(equals + 1);
+    } else if (argv[index + 1] !== undefined && !argv[index + 1].startsWith("-")) {
+      value = argv[index + 1];
+      index += 1;
+    }
+    values[name] = value;
+  }
+  if (help)
+    return { kind: "help" };
+  if (values["data-dir"] === "")
+    return { kind: "error", message: "Missing value for --data-dir" };
+  if (!values.fix)
+    return { kind: "error", message: `--fix needs an agent: ${AGENT_LIST}` };
+  const normalized = values.fix.toLowerCase();
+  const known = FIX_AGENTS.find((candidate) => candidate.name === normalized);
+  if (!known) {
+    return {
+      kind: "error",
+      message: `Unknown agent ${describeToken2(normalized)} for --fix; choose ${AGENT_LIST}`
+    };
+  }
+  const dataDir = values["data-dir"];
+  return { kind: "run", agent: known.name, ...dataDir !== undefined ? { dataDir } : {} };
 }
-function sessionLines(session) {
-  return keyValues([
-    ["id", session.id],
-    ["environment", session.environmentId],
-    ["tab", session.tabId],
-    ["agent", session.agent],
-    ["title", session.title],
-    ["activity", session.activity],
-    ["latest request", session.latestRequestId],
-    ["pending interactions", session.pendingInteractionCount],
-    ["recoverable dispatch", session.recoverableDispatch]
-  ]);
+function resolveFixAgent(name, options2) {
+  const agent = FIX_AGENTS.find((candidate) => candidate.name === name);
+  const onPath = Bun.which(agent.name, { PATH: options2.env.PATH ?? "" });
+  const managed = path5.join(defaultToolchainBinDir(options2.dataDir), agent.name);
+  if (onPath) {
+    let isManaged = false;
+    try {
+      const root = realpathSync2(toolchainRootDir(options2.dataDir));
+      const target = realpathSync2(onPath);
+      const relative = path5.relative(root, target);
+      isManaged = !relative.startsWith(`..${path5.sep}`) && relative !== ".." && !path5.isAbsolute(relative) || existsSync2(managed) && target === realpathSync2(managed);
+    } catch {}
+    return { agent, executable: onPath, source: isManaged ? "managed" : "path" };
+  }
+  if (existsSync2(managed))
+    return { agent, executable: managed, source: "managed" };
+  return null;
 }
-function receiptLines(receipt) {
-  return keyValues([
-    ["operation", receipt.operationId],
-    ["action", receipt.action],
-    ["state", receipt.state],
-    ["stage", receipt.stage],
-    ["request", `${receipt.requestId} (${receipt.namespace})`],
-    ["replayed", receipt.replayed],
-    ["resources", receipt.resources],
-    ["dispatch", receipt.dispatch?.state],
-    ["execution", receipt.execution?.state],
-    ["evidence", receipt.execution?.evidence],
-    ["exit code", receipt.execution?.exitCode],
-    ["error", receipt.error ? `${receipt.error.code}: ${receipt.error.message}` : undefined],
-    ["updated", receipt.updatedAt],
-    ["retained until", receipt.retainedUntil]
-  ]);
+var MAX_LISTED_LOGS = 8;
+async function recentLogFiles(logsDir) {
+  const names = await readdir(logsDir).catch(() => []);
+  const files = await Promise.all(names.filter((name) => name.endsWith(".log")).map(async (name) => {
+    const info = await stat(path5.join(logsDir, name)).catch(() => null);
+    return info?.isFile() ? { name, bytes: info.size, modifiedMs: info.mtimeMs } : null;
+  }));
+  return files.filter((file) => file !== null).sort((left, right) => right.modifiedMs - left.modifiedMs).slice(0, MAX_LISTED_LOGS).map((file) => ({
+    name: file.name,
+    bytes: file.bytes,
+    modified: new Date(file.modifiedMs).toISOString()
+  }));
 }
-function settingsLines(snapshot) {
+function processRunning(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error.code === "EPERM";
+  }
+}
+function backendInstance(dataDir) {
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync2(path5.join(dataDir, "backend-instance.json"), "utf8"));
+  } catch {
+    return null;
+  }
+  if (!parsed || typeof parsed !== "object")
+    return null;
+  const record = parsed;
+  const pid = typeof record.pid === "number" ? record.pid : undefined;
+  return {
+    ...typeof record.appVersion === "string" ? { appVersion: record.appVersion } : {},
+    ...typeof record.startedAt === "string" ? { startedAt: record.startedAt } : {},
+    ...pid !== undefined ? { pid } : {},
+    running: pid !== undefined && processRunning(pid)
+  };
+}
+async function managedGhBinary(dataDir) {
+  const activated = path5.join(defaultToolchainBinDir(dataDir), "gh");
+  if (existsSync2(activated))
+    return activated;
+  const latestRoot = path5.join(toolchainRootDir(dataDir), "gh-latest");
+  const latestVersions = await readdir(latestRoot).catch(() => []);
+  for (const version of latestVersions.filter(isHostVersion).sort((left, right) => right.localeCompare(left, undefined, { numeric: true }))) {
+    const candidate = path5.join(latestRoot, version, "gh");
+    if (existsSync2(candidate))
+      return candidate;
+  }
+  const root = path5.join(toolchainRootDir(dataDir), "gh");
+  const versions = await readdir(root).catch(() => []);
+  for (const version of versions.sort((left, right) => right.localeCompare(left, undefined, { numeric: true }))) {
+    const platforms = await readdir(path5.join(root, version)).catch(() => []);
+    for (const platform of platforms) {
+      const candidate = path5.join(root, version, platform, "gh");
+      if (existsSync2(candidate))
+        return candidate;
+    }
+  }
+  return null;
+}
+async function diagnosticConnection(dataDir, env) {
+  try {
+    const descriptor = realpathSync2(path5.join(dataDir, "backend-instance.json"));
+    const config = await new CliConfigStore(defaultCliConfigDir(env)).read();
+    for (const [name, connection] of Object.entries(config.connections)) {
+      if (connection.kind !== "descriptor")
+        continue;
+      try {
+        if (realpathSync2(connection.descriptorPath) === descriptor)
+          return name;
+      } catch {}
+    }
+  } catch {}
+  return null;
+}
+function desktopAppPath(home) {
+  if (process.platform !== "darwin")
+    return null;
+  for (const candidate of [
+    "/Applications/OrkestratorV2.app",
+    path5.join(home, "Applications", "OrkestratorV2.app")
+  ]) {
+    if (existsSync2(candidate))
+      return candidate;
+  }
+  return null;
+}
+async function collectFixFacts(options2) {
+  const { resolved, dataDir, env } = options2;
+  const logsDir = path5.join(dataDir, "logs");
+  const binDir = defaultToolchainBinDir(dataDir);
+  return {
+    agent: {
+      name: resolved.agent.name,
+      displayName: resolved.agent.displayName,
+      executable: resolved.executable,
+      source: resolved.source === "path" ? "PATH" : "Orkestrator's managed toolchain"
+    },
+    cliVersion: options2.version,
+    cliCommand: Bun.which("orkestrator", { PATH: env.PATH ?? "" }) ? "orkestrator" : `bunx orkestrator@${options2.version}`,
+    platform: process.platform,
+    osRelease: `${os3.type()} ${os3.release()}`,
+    arch: process.arch,
+    bunVersion: Bun.version,
+    now: (options2.now ?? new Date).toISOString(),
+    workDir: options2.workDir,
+    dataDir,
+    dataDirExists: existsSync2(dataDir),
+    logsDir,
+    debugLogging: readApplicationLogSettings(dataDir).enabled,
+    recentLogs: await recentLogFiles(logsDir),
+    backend: backendInstance(dataDir),
+    toolchainBinDir: existsSync2(binDir) ? binDir : null,
+    managedGh: await managedGhBinary(dataDir),
+    diagnosticConnection: await diagnosticConnection(dataDir, env),
+    desktopApp: desktopAppPath(os3.homedir())
+  };
+}
+function describeBackend(facts) {
+  const backend = facts.backend;
+  if (!backend)
+    return "no `backend-instance.json` (no backend has run with this data directory, or it was removed)";
+  const parts = [
+    backend.appVersion ? `version ${backend.appVersion}` : "version not recorded",
+    backend.startedAt ? `started ${backend.startedAt}` : null,
+    backend.pid !== undefined ? `pid ${backend.pid} ${backend.running ? "(running)" : "(not running)"}` : null
+  ];
+  return parts.filter(Boolean).join(", ");
+}
+function describeLogs(facts) {
+  const state = facts.debugLogging ? "on" : "off (Settings \u2192 Debug \u2192 Save Logs for Debugging); new events are not being written";
+  const lines = [`- Logs directory: ${facts.logsDir} \u2014 debug logging is ${state}`];
+  if (facts.recentLogs.length === 0) {
+    lines.push("- Log files: none");
+  } else {
+    lines.push("- Most recent log files:");
+    for (const log of facts.recentLogs) {
+      lines.push(`  - ${log.name} (${log.bytes} bytes, modified ${log.modified})`);
+    }
+  }
+  return lines;
+}
+function buildFixPrompt(facts) {
+  const issue = path5.join(facts.workDir, "issue.md");
+  const gh = facts.managedGh ? `\`gh\` on PATH, or Orkestrator's copy at ${facts.managedGh}` : "`gh`";
   return [
-    `revision ${snapshot.revision}`,
-    ...table(["KEY", "VALUE", "EFFECTIVE", "SOURCE", "APPLIES"], snapshot.settings.map((setting) => [
-      setting.key,
-      setting.value === null || setting.value === undefined ? "-" : JSON.stringify(setting.value),
-      setting.effective === null || setting.effective === undefined ? "-" : JSON.stringify(setting.effective),
-      setting.source,
-      setting.application
-    ]))
+    `I started you with \`orkestrator --fix ${facts.agent.name}\` because something in Orkestrator is not working for me. Help me report it to the Orkestrator maintainers. Your job is to (1) understand the problem by talking with me, (2) collect the evidence a maintainer needs from this machine, and (3) file a GitHub issue on https://github.com/${FIX_ISSUE_REPOSITORY} detailed enough that the maintainer can understand, reproduce and fix the problem without coming back to me with questions.`,
+    "",
+    "## About Orkestrator",
+    "Orkestrator runs coding agents (Claude Code, Codex, OpenCode, Cursor, Grok Build, Pi) in isolated environments: local git worktrees or Docker containers. It is an Electron desktop app with a Bun backend. The backend can also run on its own through the `orkestrator` CLI (`orkestrator serve`, or as a launchd/systemd service) and be used from a browser or the iOS app, including from another computer over Tailscale. In that case the logs that matter are on the backend's computer.",
+    "",
+    "## This machine",
+    `- Collected: ${facts.now}`,
+    `- OS: ${facts.platform} (${facts.osRelease}), ${facts.arch}; Bun ${facts.bunVersion}`,
+    `- Orkestrator CLI: ${facts.cliVersion} (run client commands as \`${facts.cliCommand} \u2026\`)`,
+    `- Desktop app: ${facts.desktopApp ?? "not found in /Applications (on Linux, or not installed)"}`,
+    `- Data directory: ${facts.dataDir}${facts.dataDirExists ? "" : " (does not exist)"}`,
+    `- Backend: ${describeBackend(facts)}`,
+    ...describeLogs(facts),
+    `- Managed agent binaries: ${facts.toolchainBinDir ?? "none installed"}`,
+    `- You: ${facts.agent.displayName} from ${facts.agent.source} (${facts.agent.executable})`,
+    `- Your working directory (scratch space for notes and the draft): ${facts.workDir}`,
+    "",
+    "## 1. Understand the problem",
+    "Start with a one- or two-sentence introduction, then ask me to describe the problem in my own words. Follow up a few questions at a time, not as one long questionnaire, until you know:",
+    "- what I was trying to do, what I expected, and what happened instead, with the exact error text (I can give you a screenshot path);",
+    "- the steps that reproduce it, and whether it happens every time;",
+    "- when it started, and whether it began after an Orkestrator update;",
+    "- where it happens: desktop app, web client, iOS app or CLI; a local-worktree, Docker or remote-host environment; and which agent and model.",
+    "",
+    "## 2. Collect diagnostics",
+    "Gather evidence yourself instead of asking me to copy it. Before each command, say in one sentence what it checks. Stay read-only: do not edit, delete, move, restart, reinstall or update anything, and do not change Orkestrator's data directory or settings. If something needs changing, explain it and let me do it.",
+    "Useful sources:",
+    "- Log files: `orkestrator-ai-YYYY-MM-DD.log` is the desktop app (it includes its backend's output), `orkestrator-backend-YYYY-MM-DD.log` a standalone backend; a busy day continues in `.1.log`, `.2.log`, and so on. Search around the time of the problem (errors, warnings, stack traces, the environment or session name) rather than reading whole files.",
+    "- If debug logging is off or the logs predate the problem, ask me to turn on Settings \u2192 Debug \u2192 Save Logs for Debugging, reproduce the problem, and tell you when I have.",
+    facts.diagnosticConnection ? `- Run \`${facts.cliCommand} host status --connection ${facts.diagnosticConnection}\` and \`${facts.cliCommand} connection check --connection ${facts.diagnosticConnection}\` for this installation; add \`--json\` for detail. They never start or change anything.` : "- No saved CLI connection was verified for this data directory. Use the local evidence above; do not run backend status commands against the saved default or change CLI configuration.",
+    "- Docker environments: `docker version`, `docker ps -a`, and `docker logs --tail 200 <container>` for the affected container.",
+    "- Versions: `<agent> --version` for the agents involved, `git --version`, `gh --version`; on macOS, `defaults read /Applications/OrkestratorV2.app/Contents/Info.plist CFBundleShortVersionString` for the desktop app.",
+    "- `config.json` in the data directory holds settings. Read only the keys that bear on the problem.",
+    "Never open credentials: `gateway-auth.json`, anything under `agent-accounts/`, the file an `authFile` field points to, `.env` files, keychains, or any other token or auth file.",
+    "",
+    "Then work out what is going on: tell me what you think the cause is, how confident you are, and what you ruled out. If it is clearly a problem with my setup (for example Docker is not running or an agent is not signed in), tell me how to fix it and ask whether I still want to file an issue. Name the part of Orkestrator that seems to be at fault if the evidence shows it, but do not guess source file names you have not seen.",
+    "",
+    "## 3. Draft the issue",
+    "GitHub issues on this repository are public. In everything you put in the issue:",
+    "- remove API keys, tokens, passwords, cookies, auth headers, URLs that carry credentials, and anything read from a credential file;",
+    "- replace my home directory with `~`, and my username, e-mail address, hostnames, Tailscale names, IP addresses, and private repository or project names with placeholders, unless I say they can stay;",
+    "- leave out my prompts, agent conversations and project source code unless I explicitly agree to include them;",
+    "- keep log excerpts to the lines that matter, with their timestamps: a few dozen lines in total.",
+    "",
+    `Write the issue body to ${issue}, using this structure:`,
+    "",
+    "```markdown",
+    "## Summary",
+    "## Steps to reproduce",
+    "## Expected behavior",
+    "## Actual behavior",
+    "## Environment",
+    "(Orkestrator desktop, backend and CLI versions; OS and architecture; desktop, web, iOS or CLI; local, Docker or remote host; agents, models and their versions; how often it happens; first seen; whether an update caused it)",
+    "## Diagnostics",
+    "(log excerpts and command output in fenced code blocks, each inside <details><summary>what it is</summary> \u2026 </details>)",
+    "## Analysis",
+    "(likely cause, confidence, what was ruled out)",
+    "## Additional context",
+    "",
+    `_Reported with \`orkestrator --fix ${facts.agent.name}\`._`,
+    "```",
+    "",
+    "Choose a specific title under 80 characters that says what fails and where. Show me the title and the complete body, and ask me to approve it or ask for changes. Do not file anything until I explicitly approve.",
+    "",
+    "## 4. File it",
+    `- If ${gh} is signed in (\`gh auth status\`), run \`gh issue create --repo ${FIX_ISSUE_REPOSITORY} --title "<title>" --body-file "${issue}"\` and give me the URL it prints. Do not add labels, assignees or milestones.`,
+    `- If \`gh\` is missing, not signed in, or the command fails, give me https://github.com/${FIX_ISSUE_REPOSITORY}/issues/new and tell me to paste in the title and the contents of ${issue}.`,
+    "- Screenshots and recordings cannot be attached from the command line. If I have any, tell me to drag them into the issue on GitHub once it exists.",
+    "",
+    "Finish by giving me the issue URL (or where the draft is saved) and telling me the maintainer may follow up on the issue."
+  ].join(`
+`);
+}
+var defaultSpawn = (command, options2) => {
+  const child = Bun.spawn(command, {
+    cwd: options2.cwd,
+    env: options2.env,
+    stdio: ["inherit", "inherit", "inherit"]
+  });
+  return {
+    exited: child.exited,
+    kill: (signal) => child.kill(signal)
+  };
+};
+function failure(io, code, message, exitCode) {
+  io.stderr(`error [${code}]: ${message}
+`);
+  return exitCode;
+}
+async function runFix(argv, options2) {
+  const { io } = options2;
+  const parsed = parseFixArguments(argv);
+  if (parsed.kind === "help") {
+    io.stdout(`${FIX_HELP}
+`);
+    return 0;
+  }
+  if (parsed.kind === "error") {
+    io.stderr(`${FIX_HELP}
+
+`);
+    return failure(io, "invalid-input", parsed.message, 2);
+  }
+  const dataDir = path5.resolve(parsed.dataDir ?? io.env.ORKESTRATOR_DATA_DIR ?? defaultDataDir(process.platform, io.env));
+  const resolved = resolveFixAgent(parsed.agent, { env: io.env, dataDir });
+  if (!resolved) {
+    const displayName = FIX_AGENTS.find((agent) => agent.name === parsed.agent).displayName;
+    return failure(io, "not-found", `${displayName} (\`${parsed.agent}\`) is not on PATH and Orkestrator has not installed it. Install it, or pick another agent: ${AGENT_LIST}`, 3);
+  }
+  let workDir;
+  try {
+    workDir = await mkdtemp(path5.join(options2.tmpDir ?? os3.tmpdir(), "orkestrator-fix-"));
+    const facts = await collectFixFacts({
+      resolved,
+      version: options2.version,
+      dataDir,
+      workDir,
+      env: io.env
+    });
+    const agent = resolved.agent;
+    const env = {
+      ...io.env,
+      ...agent.env,
+      ...resolved.source === "managed" ? agent.managedEnv : {}
+    };
+    io.stderr(`Starting ${agent.displayName} to help you report a problem with Orkestrator.
+` + `It works in ${workDir} and will ask before filing anything.
+
+`);
+    const child = (options2.spawn ?? defaultSpawn)([
+      resolved.executable,
+      ...agent.args(buildFixPrompt(facts), {
+        logsDir: existsSync2(facts.logsDir) ? facts.logsDir : null
+      })
+    ], { cwd: workDir, env });
+    const ignore = () => {};
+    const forward = (signal) => child.kill(signal);
+    process.on("SIGINT", ignore);
+    process.on("SIGTERM", forward);
+    process.on("SIGHUP", forward);
+    let exitCode;
+    try {
+      exitCode = await child.exited;
+    } finally {
+      process.off("SIGINT", ignore);
+      process.off("SIGTERM", forward);
+      process.off("SIGHUP", forward);
+    }
+    return exitCode;
+  } catch {
+    return failure(io, "agent-failed", "Unable to start or complete the reporting agent", 1);
+  } finally {
+    if (workDir) {
+      const remaining = await readdir(workDir).catch(() => []);
+      if (remaining.length === 0) {
+        await rmdir(workDir).catch(() => {});
+      } else {
+        io.stderr(`
+Notes and the issue draft are in ${workDir}
+`);
+      }
+    }
+  }
+}
+function runFixProcess(argv, version) {
+  return runFix(argv, {
+    version,
+    io: {
+      env: process.env,
+      stdout: (text) => process.stdout.write(text),
+      stderr: (text) => process.stderr.write(text)
+    }
+  });
+}
+
+// ../protocol/src/public-api-resources.ts
+var PUBLIC_CHANGE_SCOPES = Object.freeze(["environment"]);
+var AGENT_PLATFORM_KEYS = ["claude", "codex", "cursor", "grok", "opencode", "pi"];
+function agentSettingDescriptors(scope) {
+  const application = "next-session";
+  return [
+    {
+      key: "agent.defaultAgent",
+      scope,
+      type: "agent",
+      inherits: true,
+      application,
+      description: "Agent platform used when a launch does not name one."
+    },
+    ...AGENT_PLATFORM_KEYS.flatMap((platform) => [
+      {
+        key: `agent.${platform}.mode`,
+        scope,
+        type: "agent-mode",
+        inherits: true,
+        application,
+        description: `Launch mode (native or terminal) for ${platform}.`
+      },
+      {
+        key: `agent.${platform}.model`,
+        scope,
+        type: "string",
+        inherits: true,
+        application,
+        description: `Default model for new ${platform} sessions.`
+      },
+      {
+        key: `agent.${platform}.reasoningEffort`,
+        scope,
+        type: "string",
+        inherits: true,
+        application,
+        description: `Default reasoning level for new ${platform} sessions.`
+      },
+      {
+        key: `agent.${platform}.fastMode`,
+        scope,
+        type: "boolean",
+        inherits: true,
+        application,
+        description: `Default speed for new ${platform} sessions (true is Fast).`
+      }
+    ])
   ];
 }
+var PUBLIC_PROJECT_SETTINGS = Object.freeze([
+  {
+    key: "defaultBranch",
+    scope: "project",
+    type: "string",
+    inherits: false,
+    application: "next-environment",
+    description: "Branch new environments are created from."
+  },
+  {
+    key: "prBaseBranch",
+    scope: "project",
+    type: "string",
+    inherits: false,
+    application: "applied",
+    description: "Base branch for pull requests and diff baselines."
+  },
+  {
+    key: "defaultPortMappings",
+    scope: "project",
+    type: "port-mappings",
+    inherits: false,
+    environmentTypes: ["container"],
+    application: "next-environment",
+    description: "Port mappings copied into new container environments."
+  },
+  {
+    key: "filesToCopy",
+    scope: "project",
+    type: "string-list",
+    inherits: false,
+    application: "next-environment",
+    description: "Untracked files copied into new environments."
+  },
+  {
+    key: "entryPort",
+    scope: "project",
+    type: "port",
+    inherits: false,
+    application: "next-environment",
+    description: "Default preview entry port for new environments."
+  },
+  ...agentSettingDescriptors("project")
+]);
+var PUBLIC_ENVIRONMENT_SETTINGS = Object.freeze([
+  {
+    key: "portMappings",
+    scope: "environment",
+    type: "port-mappings",
+    inherits: false,
+    environmentTypes: ["container"],
+    application: "next-start",
+    description: "Container port mappings; a running container adopts them on recreate."
+  },
+  {
+    key: "allowedDomains",
+    scope: "environment",
+    type: "domain-list",
+    inherits: true,
+    environmentTypes: ["container"],
+    application: "next-start",
+    description: "Restricted-network allowlist; unset inherits the global list. A running container whose image supports it applies the change immediately (reported as applied)."
+  },
+  ...agentSettingDescriptors("environment")
+]);
+
+// src/client/format.ts
+function table(headers, rows) {
+  if (rows.length === 0)
+    return ["(none)"];
+  const widths = headers.map((header, index) => Math.min(60, Math.max(header.length, ...rows.map((row) => (row[index] ?? "").length))));
+  const line = (cells) => cells.map((cell, index) => {
+    const text = cell.length > widths[index] ? `${cell.slice(0, widths[index] - 1)}\u2026` : cell;
+    return text.padEnd(widths[index]);
+  }).join("  ").trimEnd();
+  return [line(headers), ...rows.map(line)];
+}
+function keyValues(entries) {
+  const width = Math.max(...entries.map(([key]) => key.length));
+  return entries.filter(([, value]) => value !== undefined).map(([key, value]) => {
+    const text = value === null ? "-" : typeof value === "object" ? JSON.stringify(value) : String(value);
+    return `${key.padEnd(width)}  ${text}`;
+  });
+}
+function projectLines(project) {
+  return keyValues([
+    ["id", project.id],
+    ["name", project.name],
+    ["remote", project.gitUrl],
+    ["path", project.localPath],
+    ["folder", project.folder],
+    ["environments", project.environmentCount],
+    ["revision", project.revision]
+  ]);
+}
+function projectRows(projects) {
+  return table(["ID", "NAME", "ENVS", "PATH"], projects.map((project) => [
+    project.id,
+    project.name,
+    String(project.environmentCount),
+    project.localPath ?? "-"
+  ]));
+}
+function environmentLines(environment) {
+  return keyValues([
+    ["id", environment.id],
+    ["project", environment.projectId],
+    ["name", environment.name],
+    ["branch", environment.branch],
+    ["type", environment.environmentType],
+    ["status", environment.status],
+    ["ready", environment.ready],
+    ["setup", `${environment.setup.phase}${environment.setup.overridden ? " (overridden)" : ""}`],
+    ["activity", environment.activity.state],
+    ["lifecycle error", environment.lifecycle.error],
+    ["workspace", environment.workspacePath],
+    ["base", environment.base.commit ?? environment.base.branch],
+    ["startup session", environment.startupSession?.sessionId]
+  ]);
+}
+function environmentRows(environments) {
+  return table(["ID", "NAME", "TYPE", "STATUS", "READY"], environments.map((environment) => [
+    environment.id,
+    environment.name,
+    environment.environmentType,
+    environment.status,
+    environment.ready ? "yes" : "no"
+  ]));
+}
+function sessionRows(sessions) {
+  return table(["SESSION", "AGENT", "TAB", "ACTIVITY", "TITLE"], sessions.map((session) => [
+    session.id,
+    session.agent,
+    session.tabId,
+    session.activity,
+    session.title ?? ""
+  ]));
+}
+function sessionLines(session) {
+  return keyValues([
+    ["id", session.id],
+    ["environment", session.environmentId],
+    ["tab", session.tabId],
+    ["agent", session.agent],
+    ["title", session.title],
+    ["activity", session.activity],
+    ["latest request", session.latestRequestId],
+    ["pending interactions", session.pendingInteractionCount],
+    ["recoverable dispatch", session.recoverableDispatch]
+  ]);
+}
+function receiptLines(receipt) {
+  return keyValues([
+    ["operation", receipt.operationId],
+    ["action", receipt.action],
+    ["state", receipt.state],
+    ["stage", receipt.stage],
+    ["request", `${receipt.requestId} (${receipt.namespace})`],
+    ["replayed", receipt.replayed],
+    ["resources", receipt.resources],
+    ["dispatch", receipt.dispatch?.state],
+    ["execution", receipt.execution?.state],
+    ["evidence", receipt.execution?.evidence],
+    ["exit code", receipt.execution?.exitCode],
+    ["error", receipt.error ? `${receipt.error.code}: ${receipt.error.message}` : undefined],
+    ["updated", receipt.updatedAt],
+    ["retained until", receipt.retainedUntil]
+  ]);
+}
+function settingsLines(snapshot) {
+  return [
+    `revision ${snapshot.revision}`,
+    ...table(["KEY", "VALUE", "EFFECTIVE", "SOURCE", "APPLIES"], snapshot.settings.map((setting) => [
+      setting.key,
+      setting.value === null || setting.value === undefined ? "-" : JSON.stringify(setting.value),
+      setting.effective === null || setting.effective === undefined ? "-" : JSON.stringify(setting.effective),
+      setting.source,
+      setting.application
+    ]))
+  ];
+}
+
+// src/client/wait.ts
+class ObservationStopped extends Error {
+  reason;
+  signalName;
+  constructor(reason, signalName) {
+    super(reason === "deadline" ? "Observation deadline passed" : "Observation interrupted");
+    this.reason = reason;
+    this.signalName = signalName;
+  }
+}
+function defaultSleep(ms, signal) {
+  return new Promise((resolve) => {
+    if (signal?.aborted) {
+      resolve();
+      return;
+    }
+    const timer = setTimeout(done, ms);
+    function done() {
+      clearTimeout(timer);
+      signal?.removeEventListener("abort", done);
+      resolve();
+    }
+    signal?.addEventListener("abort", done, { once: true });
+  });
+}
+function signalName(signal) {
+  return signal?.reason === "SIGTERM" ? "SIGTERM" : "SIGINT";
+}
+async function observe(check, options2) {
+  if (options2.timeoutMs > PUBLIC_API_LIMITS.waitMaxMs) {
+    throw new CliError("invalid-input", "--timeout may be at most 24h");
+  }
+  const now = options2.now ?? Date.now;
+  const sleep = options2.sleep ?? defaultSleep;
+  const deadline = now() + options2.timeoutMs;
+  let delay = 250;
+  for (;; ) {
+    if (options2.signal?.aborted)
+      throw new ObservationStopped("signal", signalName(options2.signal));
+    const step = await check();
+    if (step.done)
+      return step.value;
+    const remaining = deadline - now();
+    if (remaining <= 0)
+      throw new ObservationStopped("deadline");
+    await sleep(Math.min(delay, remaining), options2.signal);
+    delay = Math.min(delay * 2, 2000);
+  }
+}
+
+// src/client/commands/common.ts
+var REQUEST_ID_OPTION = {
+  name: "request-id",
+  kind: "string",
+  valueName: "KEY",
+  description: "Idempotency key. Reusing it returns the original operation; reusing it with a different intent conflicts. Generated and saved locally when omitted."
+};
+var TIMEOUT_OPTION = {
+  name: "timeout",
+  kind: "duration",
+  valueName: "DURATION",
+  description: "How long to observe before exiting 5 (the operation keeps running). Default 10m."
+};
+var PROMPT_OPTIONS = [
+  {
+    name: "prompt-file",
+    kind: "string",
+    valueName: "PATH",
+    description: "Read the prompt from a local file."
+  },
+  { name: "prompt-stdin", kind: "boolean", description: "Read the prompt from stdin." },
+  {
+    name: "prompt",
+    kind: "string",
+    valueName: "TEXT",
+    description: "Inline prompt (prefer a file for long text)."
+  }
+];
+var DEFAULT_WAIT_MS = 10 * 60 * 1000;
+function stringOption(options2, name) {
+  const value = options2[name];
+  return typeof value === "string" ? value : undefined;
+}
+function oneOf(value, allowed, label) {
+  if (typeof value !== "string" || !allowed.includes(value)) {
+    throw new CliError("invalid-input", `${label} must be one of: ${allowed.join(", ")}`);
+  }
+  return value;
+}
+function optionalBoolean(options2, name) {
+  const value = options2[name];
+  return typeof value === "boolean" ? value : undefined;
+}
+async function submit(context, action, input, options2) {
+  const session = await context.session();
+  const outcome = await session.mutate(action, input, stringOption(options2, "request-id"));
+  return { session, ...outcome };
+}
+async function readOperation(session, operationId) {
+  const { receipt } = await session.readWithReceipt("run.get", { operationId });
+  if (!receipt)
+    throw new CliError("response-invalid", "run.get returned no receipt");
+  return receipt;
+}
+function isTerminalReceipt(receipt) {
+  return !["admitted", "running", "unknown"].includes(receipt.state);
+}
+function stoppedError(error, action, receipt, what) {
+  if (error.reason === "signal") {
+    return new CliError("observation-interrupted", `Stopped observing ${what}; it continues in the backend`, {
+      action,
+      ...receipt ? { receipt } : {},
+      details: { signal: error.signalName ?? "SIGINT" }
+    });
+  }
+  return new CliError("deadline-exceeded", `Timed out observing ${what}; it continues in the backend`, {
+    action,
+    ...receipt ? { receipt } : {}
+  });
+}
+function receiptFailure(receipt) {
+  if (receipt.state === "succeeded")
+    return;
+  const message = receipt.error?.message ?? `Operation ended ${receipt.state}`;
+  const code = receipt.state === "partial" ? "partial-failure" : receipt.state === "cancelled" ? "run-cancelled" : receipt.state === "interrupted" ? "run-interrupted" : receipt.state === "unknown" ? "run-unknown" : receipt.error?.code ?? "operation-failed";
+  return new CliError(code, message, { receipt, action: receipt.action });
+}
+async function waitForOperation(context, session, initial, timeoutMs, options2 = {}) {
+  let latest = initial;
+  try {
+    return await observe(async () => {
+      latest = await readOperation(session, initial.operationId);
+      if (isTerminalReceipt(latest))
+        return { done: true, value: latest };
+      const execution = latest.execution;
+      if (execution?.state === "waiting-for-input" && !options2.continueOnInteraction) {
+        throw new CliError("interaction-required", "The run is waiting for an answer to a pending interaction", {
+          receipt: latest,
+          action: latest.action,
+          details: { interactions: execution.interactions ?? [] }
+        });
+      }
+      if (latest.state === "unknown" && latest.dispatch?.state === "unknown") {
+        throw new CliError("dispatch-unknown", "The provider may or may not have received the prompt; use `run retry` (same key) or `run discard`", { receipt: latest, action: latest.action, retryable: true });
+      }
+      if (latest.state === "unknown") {
+        throw new CliError("run-unknown", latest.error?.message ?? "The outcome of this run is not known", {
+          receipt: latest,
+          action: latest.action
+        });
+      }
+      if (execution?.state === "unsupported") {
+        throw new CliError("capability-unavailable", execution.reason ?? "Completion of this run cannot be observed for its provider", { receipt: latest, action: latest.action });
+      }
+      return { done: false };
+    }, { timeoutMs, signal: context.signal });
+  } catch (error) {
+    if (error instanceof ObservationStopped) {
+      throw stoppedError(error, latest.action, latest, "the operation");
+    }
+    throw error;
+  }
+}
+async function waitForEnvironment(context, session, environmentId, condition, receipt, timeoutMs) {
+  let latestReceipt = receipt;
+  const conditionMet = (environment) => {
+    if (condition === "deleted")
+      return environment === null;
+    if (!environment)
+      return false;
+    if (condition === "running")
+      return environment.status === "running";
+    if (condition === "stopped")
+      return environment.status === "stopped";
+    return environment.ready;
+  };
+  try {
+    return await observe(async () => {
+      if (latestReceipt && !isTerminalReceipt(latestReceipt)) {
+        latestReceipt = await readOperation(session, latestReceipt.operationId);
+      }
+      if (latestReceipt && isTerminalReceipt(latestReceipt)) {
+        const failure = receiptFailure(latestReceipt);
+        if (failure)
+          throw failure;
+      }
+      let environment;
+      try {
+        environment = await session.read("environment.get", {
+          environmentId
+        });
+      } catch (error) {
+        if (error instanceof CliError && error.code === "not-found")
+          environment = null;
+        else
+          throw error;
+      }
+      if (condition !== "deleted" && !environment) {
+        throw new CliError("not-found", "The environment no longer exists", latestReceipt ? { receipt: latestReceipt } : {});
+      }
+      if (environment && (condition === "ready" || condition === "running")) {
+        if (environment.setup.phase === "failed" || environment.status === "error") {
+          throw new CliError("setup-failed", environment.lifecycle.error ?? "Environment setup failed", { ...latestReceipt ? { receipt: latestReceipt } : {}, details: { environmentId } });
+        }
+      }
+      const operationSettled = !latestReceipt || isTerminalReceipt(latestReceipt) || condition === "running" && latestReceipt.stage === "setup";
+      if (operationSettled && conditionMet(environment)) {
+        return {
+          done: true,
+          value: { environment, ...latestReceipt ? { receipt: latestReceipt } : {} }
+        };
+      }
+      return { done: false };
+    }, { timeoutMs, signal: context.signal });
+  } catch (error) {
+    if (error instanceof ObservationStopped) {
+      throw stoppedError(error, latestReceipt?.action ?? "environment.get", latestReceipt, `the environment (${condition})`);
+    }
+    throw error;
+  }
+}
+
+// src/client/commands/changes.ts
+var SCOPE_LABELS = {
+  "changes.scope.environment-net": "Environment changes",
+  "changes.scope.turn-net": "Turn changes",
+  "changes.scope.provider-turn-diff": "Provider-reported turn changes",
+  "changes.scope.thread-net": "Thread changes"
+};
+var PROVENANCE_LABELS = {
+  "changes.provenance.observed": "observed in the workspace",
+  "changes.provenance.observed-fresh": "measured in the workspace",
+  "changes.provenance.provider-reported": "reported by the provider",
+  "changes.provenance.unknown": "unknown"
+};
+function label(key, labels) {
+  return labels[key] ?? key.replace(/^changes\.[a-z-]+\./, "").replaceAll("-", " ");
+}
+function formatLineCount(sign, count) {
+  if (count.quality === "not-applicable")
+    return "";
+  if (count.value === null)
+    return `${sign}?`;
+  const value = `${sign}${count.value}`;
+  if (count.bound === "lower")
+    return `\u2265${value}`;
+  if (count.bound === "upper")
+    return `\u2264${value}`;
+  return count.quality === "complete" ? value : `~${value}`;
+}
+function fileCount(count) {
+  if (count === null)
+    return "? files";
+  return `${count} file${count === 1 ? "" : "s"}`;
+}
+function countsSummary(projection) {
+  if (projection.measurementId === null) {
+    return projection.state === "unavailable" ? "unavailable" : "not measured yet";
+  }
+  const { additions, deletions, changedFiles } = projection.counters;
+  const lines = [formatLineCount("+", additions), formatLineCount("-", deletions)].filter(Boolean).join(" ");
+  return [fileCount(changedFiles), lines].filter(Boolean).join("  ");
+}
+function rowPath(row) {
+  if (row.oldPathDisplay && row.newPathDisplay && row.oldPathDisplay !== row.newPathDisplay) {
+    return `${row.oldPathDisplay} \u2192 ${row.newPathDisplay}`;
+  }
+  return row.newPathDisplay ?? row.oldPathDisplay ?? row.pathId;
+}
+function rowCounts(row) {
+  if (row.additions.quality === "not-applicable" && row.deletions.quality === "not-applicable") {
+    return row.fileKind;
+  }
+  return [formatLineCount("+", row.additions), formatLineCount("-", row.deletions)].filter(Boolean).join(" ");
+}
+function changesViewLines(view) {
+  const { projection, files } = view;
+  const states = [
+    projection.state,
+    `observation ${projection.observationState}`,
+    `coverage ${projection.coverageState}`
+  ].join(", ");
+  const lines = [
+    `${label(projection.labelKey, SCOPE_LABELS)} (environment ${view.environmentId})`,
+    ...keyValues([
+      ["state", states],
+      ["changes", countsSummary(projection)],
+      ["provenance", label(projection.provenanceLabelKey, PROVENANCE_LABELS)],
+      ["checked", projection.freshness.lastSuccessfulCheckAt],
+      [
+        "reasons",
+        projection.reasonKeys.length > 0 ? projection.reasonKeys.map((key) => label(key, {})).join("; ") : undefined
+      ]
+    ])
+  ];
+  if (files.rows.length > 0) {
+    lines.push("", ...table(["FILE", "STATUS", "LINES", "NOTE"], files.rows.map((row) => [
+      rowPath(row),
+      row.status,
+      rowCounts(row),
+      row.reasonKey ? label(row.reasonKey, {}) : ""
+    ])));
+  }
+  if (files.nextCursor) {
+    lines.push("", `${files.rows.length} of ${files.totalRows ?? "?"} files shown; next page: --cursor ${files.nextCursor}`);
+  }
+  return lines;
+}
+function changesHistoryLines(history) {
+  const lines = table(["TURN", "LIFECYCLE", "FINISHED", "CHANGES"], history.entries.map((entry) => {
+    const projection = entry.projections[entry.turnResourceKey];
+    return [
+      entry.turnId,
+      entry.lifecycle,
+      entry.finishedAt ?? "-",
+      projection ? countsSummary(projection) : "unavailable"
+    ];
+  }));
+  if (history.nextCursor)
+    lines.push("", `newer turns: --cursor ${history.nextCursor}`);
+  return lines;
+}
+var changesCommands = [
+  {
+    path: ["changes", "view"],
+    summary: "Show an environment's file and line changes as the backend measures them.",
+    description: "Read-only: prints the backend's change projection for the environment \u2014 the numbers the desktop shows \u2014 and one page of changed files. Counts carry their quality: ~ partial or estimated, ? unknown, \u2265/\u2264 a bound; binary files and submodules have no line counts. Nothing is ever shown as zero unless the backend measured zero. Pass the printed cursor as --cursor for the next page; a cursor stops working once the changes move on. --json prints the action result verbatim ({projection, files}).",
+    positionals: [{ name: "environment", required: true, description: "Environment ID." }],
+    options: [
+      {
+        name: "scope",
+        kind: "string",
+        valueName: PUBLIC_CHANGE_SCOPES.join("|"),
+        description: "What to compare (default environment: its baseline to its workspace now)."
+      },
+      {
+        name: "page-size",
+        kind: "integer",
+        valueName: "N",
+        description: "Files per page (1-200, default 200)."
+      },
+      {
+        name: "cursor",
+        kind: "string",
+        valueName: "CURSOR",
+        description: "Next-page cursor from a previous read."
+      }
+    ],
+    examples: [
+      'orkestrator changes view "$ENV"',
+      `orkestrator changes view "$ENV" --page-size 20 --json | jq '.result.projection.counters'`
+    ],
+    async run(context, parsed) {
+      const input = { environmentId: parsed.positionals.environment };
+      const scope = stringOption(parsed.options, "scope");
+      if (scope !== undefined)
+        input.scope = oneOf(scope, PUBLIC_CHANGE_SCOPES, "--scope");
+      if (parsed.options["page-size"] !== undefined)
+        input.pageSize = parsed.options["page-size"];
+      const cursor = stringOption(parsed.options, "cursor");
+      if (cursor !== undefined)
+        input.cursor = cursor;
+      const session = await context.session();
+      const view = await session.read("changes.view", input);
+      return {
+        action: "changes.view",
+        result: view,
+        connection: session.identity,
+        human: changesViewLines(view)
+      };
+    }
+  },
+  {
+    path: ["changes", "history"],
+    summary: "List a session's turns, oldest first, with the changes each one made.",
+    description: "Read-only: each turn's backend measurement from its start to its end, with the same count qualities as `changes view`. No workspace scan, transcript or provider read. Pass the printed cursor as --cursor for newer turns.",
+    positionals: [{ name: "session", required: true, description: "Session ID (ses_\u2026)." }],
+    options: [
+      {
+        name: "limit",
+        kind: "integer",
+        valueName: "N",
+        description: "Turns per page (1-200, default 50)."
+      },
+      {
+        name: "cursor",
+        kind: "string",
+        valueName: "CURSOR",
+        description: "Cursor from a previous page."
+      }
+    ],
+    async run(context, parsed) {
+      const input = { sessionId: parsed.positionals.session };
+      if (parsed.options.limit !== undefined)
+        input.limit = parsed.options.limit;
+      const cursor = stringOption(parsed.options, "cursor");
+      if (cursor !== undefined)
+        input.cursor = cursor;
+      const session = await context.session();
+      const history = await session.read("changes.history", input);
+      return {
+        action: "changes.history",
+        result: history,
+        connection: session.identity,
+        human: changesHistoryLines(history)
+      };
+    }
+  }
+];
+
+// src/client/commands/connection.ts
+import path9 from "path";
+import { randomUUID as randomUUID3 } from "crypto";
+import { promises as fs4 } from "fs";
+
+// ../protocol/src/backend-instance.ts
+var BACKEND_INSTANCE_DESCRIPTOR_FILE = "backend-instance.json";
+var BACKEND_INSTANCE_DESCRIPTOR_TYPE = "orkestrator-backend-instance";
+var BACKEND_INSTANCE_DESCRIPTOR_MAX_BYTES = 16 * 1024;
+var BACKEND_INSTANCE_MAX_ENDPOINTS = 8;
+function isRecord3(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function isHttpUrl(value) {
+  if (typeof value !== "string" || value.length > 2048)
+    return false;
+  try {
+    const url = new URL(value);
+    return (url.protocol === "http:" || url.protocol === "https:") && url.username === "" && url.password === "" && url.search === "" && url.hash === "";
+  } catch {
+    return false;
+  }
+}
+function parseEndpoints(value) {
+  if (!Array.isArray(value) || value.length > BACKEND_INSTANCE_MAX_ENDPOINTS) {
+    throw new Error("Backend instance descriptor field is invalid: endpoints");
+  }
+  return value.map((entry) => {
+    if (!isRecord3(entry) || entry.role !== "control" && entry.role !== "client" || !isHttpUrl(entry.url)) {
+      throw new Error("Backend instance descriptor field is invalid: endpoints");
+    }
+    return { role: entry.role, url: entry.url };
+  });
+}
+function parseBackendInstanceDescriptor(value) {
+  if (!isRecord3(value))
+    throw new Error("Backend instance descriptor must be an object");
+  if (value.version !== 1 || value.type !== BACKEND_INSTANCE_DESCRIPTOR_TYPE) {
+    throw new Error("Backend instance descriptor has an unsupported version");
+  }
+  const text = (key, max = 512) => {
+    const field = value[key];
+    if (typeof field !== "string" || field.length === 0 || field.length > max) {
+      throw new Error(`Backend instance descriptor field is invalid: ${key}`);
+    }
+    return field;
+  };
+  if (!Number.isSafeInteger(value.pid) || value.pid <= 0) {
+    throw new Error("Backend instance descriptor field is invalid: pid");
+  }
+  if (!isHttpUrl(value.url))
+    throw new Error("Backend instance descriptor field is invalid: url");
+  if (value.browserUrl !== undefined && !isHttpUrl(value.browserUrl)) {
+    throw new Error("Backend instance descriptor field is invalid: browserUrl");
+  }
+  const endpoints = value.endpoints === undefined ? undefined : parseEndpoints(value.endpoints);
+  if (!Number.isSafeInteger(value.publicApiSchemaVersion) || value.publicApiSchemaVersion < 1) {
+    throw new Error("Backend instance descriptor field is invalid: publicApiSchemaVersion");
+  }
+  const authFile = text("authFile", 4096);
+  const dataDir = text("dataDir", 4096);
+  if (!authFile.startsWith("/") || !dataDir.startsWith("/")) {
+    throw new Error("Backend instance descriptor paths must be absolute");
+  }
+  return {
+    version: 1,
+    type: BACKEND_INSTANCE_DESCRIPTOR_TYPE,
+    installationId: text("installationId", 200),
+    generation: text("generation", 200),
+    pid: value.pid,
+    startedAt: text("startedAt", 64),
+    url: value.url,
+    ...value.browserUrl !== undefined ? { browserUrl: value.browserUrl } : {},
+    ...endpoints !== undefined ? { endpoints } : {},
+    authFile,
+    dataDir,
+    appVersion: text("appVersion", 64),
+    publicApiSchemaVersion: value.publicApiSchemaVersion
+  };
+}
 
 // src/client/receipts.ts
 import { createHash } from "crypto";
 import { promises as fs2 } from "fs";
-import path2 from "path";
+import path6 from "path";
 var MAX_LOCAL_RECEIPTS_PER_INSTALLATION = 1000;
 var MAX_RECEIPT_BYTES = 8 * 1024;
 function receiptKey(action, requestId) {
@@ -7502,10 +8718,10 @@ class LocalReceiptStore {
     this.root = root;
   }
   directory(installationId) {
-    return path2.join(this.root, safeSegment(installationId));
+    return path6.join(this.root, safeSegment(installationId));
   }
   file(installationId, action, requestId) {
-    return path2.join(this.directory(installationId), `${receiptKey(action, requestId)}.json`);
+    return path6.join(this.directory(installationId), `${receiptKey(action, requestId)}.json`);
   }
   async find(installationId, action, requestId) {
     return this.readFile(this.file(installationId, action, requestId));
@@ -7529,14 +8745,14 @@ class LocalReceiptStore {
     });
   }
   async list(installationId, limit = 50) {
-    const directories = installationId ? [this.directory(installationId)] : (await fs2.readdir(this.root).catch(() => [])).map((name) => path2.join(this.root, name));
+    const directories = installationId ? [this.directory(installationId)] : (await fs2.readdir(this.root).catch(() => [])).map((name) => path6.join(this.root, name));
     const receipts = [];
     for (const directory of directories) {
       const names = await fs2.readdir(directory).catch(() => []);
       for (const name of names) {
         if (!name.endsWith(".json"))
           continue;
-        const receipt = await this.readFile(path2.join(directory, name));
+        const receipt = await this.readFile(path6.join(directory, name));
         if (receipt)
           receipts.push(receipt);
       }
@@ -7564,7 +8780,7 @@ class LocalReceiptStore {
     if (names.length <= MAX_LOCAL_RECEIPTS_PER_INSTALLATION)
       return;
     const entries = await Promise.all(names.map(async (name) => {
-      const file = path2.join(directory, name);
+      const file = path6.join(directory, name);
       const stat = await fs2.stat(file).catch(() => null);
       return { file, mtime: stat?.mtimeMs ?? 0 };
     }));
@@ -7859,12 +9075,12 @@ function envelopeError(response) {
 
 // src/client/targets.ts
 import { promises as fs3 } from "fs";
-import path4 from "path";
+import path8 from "path";
 import { isIPv4 } from "net";
 
 // ../protocol/src/node/runtime-profile-status.ts
-import os2 from "os";
-import path3 from "path";
+import os4 from "os";
+import path7 from "path";
 var RUNTIME_APP_SLUG = "orkestrator-v2";
 var RUNTIME_STATUS_KEYS = new Set([
   "version",
@@ -7906,29 +9122,29 @@ function normalizeRuntimeProfileId(value) {
   }
   return normalized;
 }
-function defaultRuntimeProfileRoots(platform = process.platform, env = process.env, homeDir = os2.homedir()) {
+function defaultRuntimeProfileRoots(platform = process.platform, env = process.env, homeDir = os4.homedir()) {
   if (platform === "darwin") {
-    const appSupport = path3.join(homeDir, "Library", "Application Support");
+    const appSupport = path7.join(homeDir, "Library", "Application Support");
     return {
-      developmentRoot: path3.join(appSupport, `${RUNTIME_APP_SLUG}-dev`),
-      productionDataDir: path3.join(appSupport, RUNTIME_APP_SLUG),
+      developmentRoot: path7.join(appSupport, `${RUNTIME_APP_SLUG}-dev`),
+      productionDataDir: path7.join(appSupport, RUNTIME_APP_SLUG),
       homeDir
     };
   }
   if (platform === "win32") {
     throw new Error("Orkestrator development profiles support macOS and Linux only");
   }
-  const configRoot = env.XDG_CONFIG_HOME ?? path3.join(homeDir, ".config");
+  const configRoot = env.XDG_CONFIG_HOME ?? path7.join(homeDir, ".config");
   return {
-    developmentRoot: path3.join(configRoot, `${RUNTIME_APP_SLUG}-dev`),
-    productionDataDir: path3.join(configRoot, RUNTIME_APP_SLUG),
+    developmentRoot: path7.join(configRoot, `${RUNTIME_APP_SLUG}-dev`),
+    productionDataDir: path7.join(configRoot, RUNTIME_APP_SLUG),
     homeDir
   };
 }
 function runtimeProfileStatusPath(developmentRoot, profileName) {
   const id = normalizeRuntimeProfileId(profileName);
-  const profileRoot = path3.resolve(developmentRoot, "profiles", id);
-  return { id, profileRoot, statusPath: path3.join(profileRoot, "runtime", "status.json") };
+  const profileRoot = path7.resolve(developmentRoot, "profiles", id);
+  return { id, profileRoot, statusPath: path7.join(profileRoot, "runtime", "status.json") };
 }
 
 // src/client/targets.ts
@@ -8005,7 +9221,7 @@ async function readDescriptor(file) {
       throw new Error("too large");
     text = await fs3.readFile(file, "utf8");
   } catch {
-    throw new CliError("connection-failed", `No running backend published ${path4.basename(file)} at the selected location`);
+    throw new CliError("connection-failed", `No running backend published ${path8.basename(file)} at the selected location`);
   }
   try {
     return parseBackendInstanceDescriptor(JSON.parse(text));
@@ -8102,7 +9318,7 @@ async function resolveProfile(profileName, env) {
   }
   const refresh = () => resolveProfile(profileName, env);
   if (manifest.dataDir) {
-    const descriptorFile = path4.join(manifest.dataDir, BACKEND_INSTANCE_DESCRIPTOR_FILE);
+    const descriptorFile = path8.join(manifest.dataDir, BACKEND_INSTANCE_DESCRIPTOR_FILE);
     const descriptor = await readDescriptor(descriptorFile).catch(() => null);
     if (descriptor) {
       if (descriptor.pid !== backendPid) {
@@ -8115,235 +9331,13 @@ async function resolveProfile(profileName, env) {
     throw new CliError("profile-unavailable", `Profile '${located.id}' does not publish a gateway endpoint`);
   }
   const baseUrl = normalizeBaseUrl(manifest.browserUrl);
-  const authFile = manifest.authFile;
-  return {
-    identity: { name: located.id, kind: "profile", endpoint: redactEndpoint(baseUrl) },
-    baseUrl,
-    readToken: () => readTokenFile(authFile, true),
-    refresh
-  };
-}
-
-// src/client/wait.ts
-class ObservationStopped extends Error {
-  reason;
-  signalName;
-  constructor(reason, signalName) {
-    super(reason === "deadline" ? "Observation deadline passed" : "Observation interrupted");
-    this.reason = reason;
-    this.signalName = signalName;
-  }
-}
-function defaultSleep(ms, signal) {
-  return new Promise((resolve) => {
-    if (signal?.aborted) {
-      resolve();
-      return;
-    }
-    const timer = setTimeout(done, ms);
-    function done() {
-      clearTimeout(timer);
-      signal?.removeEventListener("abort", done);
-      resolve();
-    }
-    signal?.addEventListener("abort", done, { once: true });
-  });
-}
-function signalName(signal) {
-  return signal?.reason === "SIGTERM" ? "SIGTERM" : "SIGINT";
-}
-async function observe(check, options2) {
-  if (options2.timeoutMs > PUBLIC_API_LIMITS.waitMaxMs) {
-    throw new CliError("invalid-input", "--timeout may be at most 24h");
-  }
-  const now = options2.now ?? Date.now;
-  const sleep = options2.sleep ?? defaultSleep;
-  const deadline = now() + options2.timeoutMs;
-  let delay = 250;
-  for (;; ) {
-    if (options2.signal?.aborted)
-      throw new ObservationStopped("signal", signalName(options2.signal));
-    const step = await check();
-    if (step.done)
-      return step.value;
-    const remaining = deadline - now();
-    if (remaining <= 0)
-      throw new ObservationStopped("deadline");
-    await sleep(Math.min(delay, remaining), options2.signal);
-    delay = Math.min(delay * 2, 2000);
-  }
-}
-
-// src/client/commands/common.ts
-var REQUEST_ID_OPTION = {
-  name: "request-id",
-  kind: "string",
-  valueName: "KEY",
-  description: "Idempotency key. Reusing it returns the original operation; reusing it with a different intent conflicts. Generated and saved locally when omitted."
-};
-var TIMEOUT_OPTION = {
-  name: "timeout",
-  kind: "duration",
-  valueName: "DURATION",
-  description: "How long to observe before exiting 5 (the operation keeps running). Default 10m."
-};
-var PROMPT_OPTIONS = [
-  {
-    name: "prompt-file",
-    kind: "string",
-    valueName: "PATH",
-    description: "Read the prompt from a local file."
-  },
-  { name: "prompt-stdin", kind: "boolean", description: "Read the prompt from stdin." },
-  {
-    name: "prompt",
-    kind: "string",
-    valueName: "TEXT",
-    description: "Inline prompt (prefer a file for long text)."
-  }
-];
-var DEFAULT_WAIT_MS = 10 * 60 * 1000;
-function stringOption(options2, name) {
-  const value = options2[name];
-  return typeof value === "string" ? value : undefined;
-}
-function oneOf(value, allowed, label) {
-  if (typeof value !== "string" || !allowed.includes(value)) {
-    throw new CliError("invalid-input", `${label} must be one of: ${allowed.join(", ")}`);
-  }
-  return value;
-}
-function optionalBoolean(options2, name) {
-  const value = options2[name];
-  return typeof value === "boolean" ? value : undefined;
-}
-async function submit(context, action, input, options2) {
-  const session = await context.session();
-  const outcome = await session.mutate(action, input, stringOption(options2, "request-id"));
-  return { session, ...outcome };
-}
-async function readOperation(session, operationId) {
-  const { receipt } = await session.readWithReceipt("run.get", { operationId });
-  if (!receipt)
-    throw new CliError("response-invalid", "run.get returned no receipt");
-  return receipt;
-}
-function isTerminalReceipt(receipt) {
-  return !["admitted", "running", "unknown"].includes(receipt.state);
-}
-function stoppedError(error, action, receipt, what) {
-  if (error.reason === "signal") {
-    return new CliError("observation-interrupted", `Stopped observing ${what}; it continues in the backend`, {
-      action,
-      ...receipt ? { receipt } : {},
-      details: { signal: error.signalName ?? "SIGINT" }
-    });
-  }
-  return new CliError("deadline-exceeded", `Timed out observing ${what}; it continues in the backend`, {
-    action,
-    ...receipt ? { receipt } : {}
-  });
-}
-function receiptFailure(receipt) {
-  if (receipt.state === "succeeded")
-    return;
-  const message = receipt.error?.message ?? `Operation ended ${receipt.state}`;
-  const code = receipt.state === "partial" ? "partial-failure" : receipt.state === "cancelled" ? "run-cancelled" : receipt.state === "interrupted" ? "run-interrupted" : receipt.state === "unknown" ? "run-unknown" : receipt.error?.code ?? "operation-failed";
-  return new CliError(code, message, { receipt, action: receipt.action });
-}
-async function waitForOperation(context, session, initial, timeoutMs, options2 = {}) {
-  let latest = initial;
-  try {
-    return await observe(async () => {
-      latest = await readOperation(session, initial.operationId);
-      if (isTerminalReceipt(latest))
-        return { done: true, value: latest };
-      const execution = latest.execution;
-      if (execution?.state === "waiting-for-input" && !options2.continueOnInteraction) {
-        throw new CliError("interaction-required", "The run is waiting for an answer to a pending interaction", {
-          receipt: latest,
-          action: latest.action,
-          details: { interactions: execution.interactions ?? [] }
-        });
-      }
-      if (latest.state === "unknown" && latest.dispatch?.state === "unknown") {
-        throw new CliError("dispatch-unknown", "The provider may or may not have received the prompt; use `run retry` (same key) or `run discard`", { receipt: latest, action: latest.action, retryable: true });
-      }
-      if (latest.state === "unknown") {
-        throw new CliError("run-unknown", latest.error?.message ?? "The outcome of this run is not known", {
-          receipt: latest,
-          action: latest.action
-        });
-      }
-      if (execution?.state === "unsupported") {
-        throw new CliError("capability-unavailable", execution.reason ?? "Completion of this run cannot be observed for its provider", { receipt: latest, action: latest.action });
-      }
-      return { done: false };
-    }, { timeoutMs, signal: context.signal });
-  } catch (error) {
-    if (error instanceof ObservationStopped) {
-      throw stoppedError(error, latest.action, latest, "the operation");
-    }
-    throw error;
-  }
-}
-async function waitForEnvironment(context, session, environmentId, condition, receipt, timeoutMs) {
-  let latestReceipt = receipt;
-  const conditionMet = (environment) => {
-    if (condition === "deleted")
-      return environment === null;
-    if (!environment)
-      return false;
-    if (condition === "running")
-      return environment.status === "running";
-    if (condition === "stopped")
-      return environment.status === "stopped";
-    return environment.ready;
-  };
-  try {
-    return await observe(async () => {
-      if (latestReceipt && !isTerminalReceipt(latestReceipt)) {
-        latestReceipt = await readOperation(session, latestReceipt.operationId);
-      }
-      if (latestReceipt && isTerminalReceipt(latestReceipt)) {
-        const failure = receiptFailure(latestReceipt);
-        if (failure)
-          throw failure;
-      }
-      let environment;
-      try {
-        environment = await session.read("environment.get", {
-          environmentId
-        });
-      } catch (error) {
-        if (error instanceof CliError && error.code === "not-found")
-          environment = null;
-        else
-          throw error;
-      }
-      if (condition !== "deleted" && !environment) {
-        throw new CliError("not-found", "The environment no longer exists", latestReceipt ? { receipt: latestReceipt } : {});
-      }
-      if (environment && (condition === "ready" || condition === "running")) {
-        if (environment.setup.phase === "failed" || environment.status === "error") {
-          throw new CliError("setup-failed", environment.lifecycle.error ?? "Environment setup failed", { ...latestReceipt ? { receipt: latestReceipt } : {}, details: { environmentId } });
-        }
-      }
-      const operationSettled = !latestReceipt || isTerminalReceipt(latestReceipt) || condition === "running" && latestReceipt.stage === "setup";
-      if (operationSettled && conditionMet(environment)) {
-        return {
-          done: true,
-          value: { environment, ...latestReceipt ? { receipt: latestReceipt } : {} }
-        };
-      }
-      return { done: false };
-    }, { timeoutMs, signal: context.signal });
-  } catch (error) {
-    if (error instanceof ObservationStopped) {
-      throw stoppedError(error, latestReceipt?.action ?? "environment.get", latestReceipt, `the environment (${condition})`);
-    }
-    throw error;
-  }
+  const authFile = manifest.authFile;
+  return {
+    identity: { name: located.id, kind: "profile", endpoint: redactEndpoint(baseUrl) },
+    baseUrl,
+    readToken: () => readTokenFile(authFile, true),
+    refresh
+  };
 }
 
 // src/client/commands/connection.ts
@@ -8353,7 +9347,7 @@ function store(context) {
 async function removeManagedCredential(configStore, name, saved) {
   if (saved?.kind !== "endpoint")
     return;
-  const legacyFile = path5.join(configStore.credentialsDirectory, `${name}.json`);
+  const legacyFile = path9.join(configStore.credentialsDirectory, `${name}.json`);
   if (saved.managedCredential !== true && saved.credentialFile !== legacyFile)
     return;
   await configStore.removeOwnedCredential(saved.credentialFile).catch(() => {
@@ -8513,7 +9507,7 @@ var connectionCommands = [
         const normalizedUrl = normalizeBaseUrl(url);
         let file;
         if (credentialFile) {
-          file = path5.resolve(context.io.cwd, credentialFile);
+          file = path9.resolve(context.io.cwd, credentialFile);
           await readTokenFile(file, true);
         } else {
           const bytes = await context.io.readStdin(16 * 1024);
@@ -8532,7 +9526,7 @@ var connectionCommands = [
           addedAt: now
         };
       } else {
-        const descriptorPath = path5.resolve(context.io.cwd, descriptorOption ?? path5.join(dataDir, BACKEND_INSTANCE_DESCRIPTOR_FILE));
+        const descriptorPath = path9.resolve(context.io.cwd, descriptorOption ?? path9.join(dataDir, BACKEND_INSTANCE_DESCRIPTOR_FILE));
         saved = { kind: "descriptor", descriptorPath, addedAt: now };
       }
       let checked = null;
@@ -8656,7 +9650,7 @@ var connectionCommands = [
 
 // src/client/inputs.ts
 import { promises as fs5 } from "fs";
-import path6 from "path";
+import path10 from "path";
 function decodeUtf8(bytes, label) {
   try {
     return new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(bytes);
@@ -8665,7 +9659,7 @@ function decodeUtf8(bytes, label) {
   }
 }
 async function readFileBounded(io, file, label, maxBytes) {
-  const resolved = path6.resolve(io.cwd, file);
+  const resolved = path10.resolve(io.cwd, file);
   let handle;
   try {
     handle = await fs5.open(resolved, "r");
@@ -8774,121 +9768,6 @@ async function readPatch(io, options2) {
   return parsed;
 }
 
-// ../protocol/src/public-api-resources.ts
-var AGENT_PLATFORM_KEYS = ["claude", "codex", "cursor", "grok", "opencode", "pi"];
-function agentSettingDescriptors(scope) {
-  const application = "next-session";
-  return [
-    {
-      key: "agent.defaultAgent",
-      scope,
-      type: "agent",
-      inherits: true,
-      application,
-      description: "Agent platform used when a launch does not name one."
-    },
-    ...AGENT_PLATFORM_KEYS.flatMap((platform) => [
-      {
-        key: `agent.${platform}.mode`,
-        scope,
-        type: "agent-mode",
-        inherits: true,
-        application,
-        description: `Launch mode (native or terminal) for ${platform}.`
-      },
-      {
-        key: `agent.${platform}.model`,
-        scope,
-        type: "string",
-        inherits: true,
-        application,
-        description: `Default model for new ${platform} sessions.`
-      },
-      {
-        key: `agent.${platform}.reasoningEffort`,
-        scope,
-        type: "string",
-        inherits: true,
-        application,
-        description: `Default reasoning level for new ${platform} sessions.`
-      },
-      {
-        key: `agent.${platform}.fastMode`,
-        scope,
-        type: "boolean",
-        inherits: true,
-        application,
-        description: `Default speed for new ${platform} sessions (true is Fast).`
-      }
-    ])
-  ];
-}
-var PUBLIC_PROJECT_SETTINGS = Object.freeze([
-  {
-    key: "defaultBranch",
-    scope: "project",
-    type: "string",
-    inherits: false,
-    application: "next-environment",
-    description: "Branch new environments are created from."
-  },
-  {
-    key: "prBaseBranch",
-    scope: "project",
-    type: "string",
-    inherits: false,
-    application: "applied",
-    description: "Base branch for pull requests and diff baselines."
-  },
-  {
-    key: "defaultPortMappings",
-    scope: "project",
-    type: "port-mappings",
-    inherits: false,
-    environmentTypes: ["container"],
-    application: "next-environment",
-    description: "Port mappings copied into new container environments."
-  },
-  {
-    key: "filesToCopy",
-    scope: "project",
-    type: "string-list",
-    inherits: false,
-    application: "next-environment",
-    description: "Untracked files copied into new environments."
-  },
-  {
-    key: "entryPort",
-    scope: "project",
-    type: "port",
-    inherits: false,
-    application: "next-environment",
-    description: "Default preview entry port for new environments."
-  },
-  ...agentSettingDescriptors("project")
-]);
-var PUBLIC_ENVIRONMENT_SETTINGS = Object.freeze([
-  {
-    key: "portMappings",
-    scope: "environment",
-    type: "port-mappings",
-    inherits: false,
-    environmentTypes: ["container"],
-    application: "next-start",
-    description: "Container port mappings; a running container adopts them on recreate."
-  },
-  {
-    key: "allowedDomains",
-    scope: "environment",
-    type: "domain-list",
-    inherits: true,
-    environmentTypes: ["container"],
-    application: "next-start",
-    description: "Restricted-network allowlist; unset inherits the global list. A running container whose image supports it applies the change immediately (reported as applied)."
-  },
-  ...agentSettingDescriptors("environment")
-]);
-
 // src/client/commands/settings.ts
 function parseAssignment(raw) {
   const equals = raw.indexOf("=");
@@ -9567,36 +10446,6 @@ var environmentCommands = [
   ...settingsCommands("environment")
 ];
 
-// ../protocol/src/host-maintenance.ts
-var HOST_UPDATE_IDLE_WAIT = Object.freeze({
-  defaultSeconds: 3600,
-  minSeconds: 60,
-  maxSeconds: 86400
-});
-var HOST_UPDATE_CHANNELS = ["stable", "beta", "unstable"];
-var HOST_UPDATE_CHANNEL_TAGS = Object.freeze({ stable: "latest", beta: "beta", unstable: "alpha" });
-function isHostUpdateChannel(value) {
-  return HOST_UPDATE_CHANNELS.includes(value);
-}
-var ACTIVE_HOST_UPDATE_JOB_STATES = new Set([
-  "requested",
-  "downloading",
-  "waiting-for-idle",
-  "awaiting-restart",
-  "restarting"
-]);
-var CANCELLABLE_HOST_UPDATE_JOB_STATES = new Set([
-  "requested",
-  "downloading",
-  "waiting-for-idle",
-  "awaiting-restart"
-]);
-var HOST_MAINTENANCE_LIMITS = Object.freeze({
-  idMaxChars: 100,
-  versionMaxChars: 64,
-  errorMaxChars: 500
-});
-
 // src/client/commands/host.ts
 var WAIT_OPTION = {
   name: "wait",
@@ -9908,117 +10757,18 @@ var hostCommands = [
 
 // src/client/commands/service.ts
 import { spawnSync } from "child_process";
-import { existsSync as existsSync2 } from "fs";
+import { existsSync as existsSync4 } from "fs";
 import { mkdir as mkdir2, rm as rm2, writeFile as writeFile2 } from "fs/promises";
-import path10 from "path";
-
-// ../../apps/backend/src/data-dir.ts
-import os3 from "os";
-import path7 from "path";
-// ../../apps/backend/package.json
-var package_default = {
-  name: "@orkestrator/backend",
-  version: "2.23.0",
-  private: true,
-  type: "module",
-  exports: {
-    "./gateway": "./src/gateway.ts"
-  },
-  scripts: {
-    build: "bun scripts/build.ts",
-    dev: "bun --watch src/main.ts",
-    "dev:web": "bun --watch src/main.ts --port 34121 --fallback-host 127.0.0.1 --renderer-dev-server-url http://127.0.0.1:1420",
-    start: "bun dist/main.js",
-    "start:web": "bun dist/main.js --fallback-host 127.0.0.1",
-    "start:web-public": "bun dist/main.js --tailscale-serve --allowed-origins https://orkestrator.dev,https://www.orkestrator.dev",
-    test: "bun test --preload ../../tests/setup-node.ts src tests --parallel",
-    "test:workspace": "bun test --preload ../../tests/setup-node.ts src tests --only-failures ${ORKESTRATOR_TEST_TIMINGS_DIR:+--timings=$ORKESTRATOR_TEST_TIMINGS_DIR/backend.json --update-timings} --parallel=${ORKESTRATOR_TEST_WORKERS:-2}",
-    typecheck: "bunx tsc --noEmit -p tsconfig.json && bunx tsc --noEmit -p tsconfig.test.json"
-  },
-  dependencies: {
-    "@modelcontextprotocol/node": "2.1.1",
-    "@modelcontextprotocol/server": "2.3.1",
-    "@opencode-ai/sdk": "1.19.0",
-    "@orkestrator/protocol": "workspace:*",
-    "@orkestrator/toolchain": "workspace:*",
-    "@xterm/addon-serialize": "0.14.0",
-    "@xterm/headless": "6.0.0",
-    "playwright-core": "1.64.0",
-    sharp: "^0.35.5",
-    ws: "8.22.0",
-    zod: "4.6.7"
-  },
-  devDependencies: {
-    "@modelcontextprotocol/client": "2.3.1",
-    "@types/ws": "8.18.2"
-  }
-};
-
-// ../../apps/backend/src/core/constants.ts
-var APP_SLUG = "orkestrator-v2";
-var AGENT_NETWORK_DOMAINS_BY_PLATFORM = Object.freeze({
-  codex: Object.freeze(["chatgpt.com", "auth.openai.com"]),
-  cursor: Object.freeze([
-    "api2.cursor.sh",
-    "api3.cursor.sh",
-    "api4.cursor.sh",
-    "api5.cursor.sh",
-    "repo42.cursor.sh",
-    "authenticator.cursor.sh",
-    "marketplace.cursorapi.com",
-    "cursor-cdn.com",
-    "cursor.com"
-  ]),
-  grok: Object.freeze([
-    "x.ai",
-    "auth.x.ai",
-    "api.x.ai",
-    "cli-chat-proxy.grok.com"
-  ]),
-  pi: Object.freeze([
-    "pi.dev",
-    "radius.pi.dev",
-    "api.anthropic.com",
-    "api.openai.com",
-    "generativelanguage.googleapis.com",
-    "api.x.ai",
-    "api.mistral.ai",
-    "api.groq.com",
-    "api.deepseek.com",
-    "api.cerebras.ai",
-    "api.together.ai",
-    "openrouter.ai"
-  ])
-});
-var MAX_CODEX_CONCURRENT_THREADS = Number.MAX_SAFE_INTEGER - 1;
-function sanitizeAppVersion(raw) {
-  const trimmed = raw?.trim() ?? "";
-  return /^[A-Za-z0-9._+-]{1,64}$/.test(trimmed) ? trimmed : "0.0.0";
-}
-var BACKEND_PACKAGE_VERSION = sanitizeAppVersion(package_default.version);
-var APP_VERSION = sanitizeAppVersion(process.env.ORKESTRATOR_VERSION?.trim() || BACKEND_PACKAGE_VERSION);
-
-// ../../apps/backend/src/data-dir.ts
-function assertSupportedPlatform(platform = process.platform) {
-  if (platform === "win32") {
-    throw new Error("Orkestrator does not support Windows. Use macOS or Linux.");
-  }
-}
-function defaultDataDir(platform = process.platform, env = process.env, home = os3.homedir()) {
-  assertSupportedPlatform(platform);
-  if (platform === "darwin")
-    return path7.join(home, "Library", "Application Support", APP_SLUG);
-  return path7.join(env.XDG_CONFIG_HOME ?? path7.join(home, ".config"), APP_SLUG);
-}
+import path13 from "path";
 
 // src/client/service-units.ts
 import { createHash as createHash3 } from "crypto";
-import os4 from "os";
-import path8 from "path";
+import os5 from "os";
+import path11 from "path";
 function suffix(dataDir, defaultDataDir) {
-  if (path8.resolve(dataDir) === path8.resolve(defaultDataDir))
+  if (path11.resolve(dataDir) === path11.resolve(defaultDataDir))
     return "";
-  return `-${createHash3("sha256").update(path8.resolve(dataDir)).digest("hex").slice(0, 8)}`;
+  return `-${createHash3("sha256").update(path11.resolve(dataDir)).digest("hex").slice(0, 8)}`;
 }
 function xml(text) {
   return text.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;");
@@ -10027,7 +10777,7 @@ function systemdWord(text) {
   return `"${text.replaceAll("\\", "\\\\").replaceAll('"', "\\\"").replaceAll("%", "%%")}"`;
 }
 function serviceUnit(options2) {
-  const home = options2.home ?? os4.homedir();
+  const home = options2.home ?? os5.homedir();
   const tag = suffix(options2.dataDir, options2.defaultDataDir);
   const pathValue = options2.env.PATH ?? "/usr/local/bin:/usr/bin:/bin";
   if (options2.platform === "darwin") {
@@ -10037,7 +10787,7 @@ function serviceUnit(options2) {
     return {
       manager: "launchd",
       name,
-      file: path8.join(home, "Library", "LaunchAgents", `${name}.plist`),
+      file: path11.join(home, "Library", "LaunchAgents", `${name}.plist`),
       contents: `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
@@ -10071,11 +10821,11 @@ ${args}
     };
   }
   const name = `orkestrator-backend${tag}.service`;
-  const configHome = options2.env.XDG_CONFIG_HOME ?? path8.join(home, ".config");
+  const configHome = options2.env.XDG_CONFIG_HOME ?? path11.join(home, ".config");
   return {
     manager: "systemd",
     name,
-    file: path8.join(configHome, "systemd", "user", name),
+    file: path11.join(configHome, "systemd", "user", name),
     contents: `[Unit]
 Description=Orkestrator backend (${options2.dataDir})
 After=network-online.target
@@ -10130,7 +10880,7 @@ var DATA_DIR_OPTION = {
 };
 var RESERVED_SERVE_FLAGS = new Set(["--data-dir", "--standalone-updater", "--desktop-updater"]);
 function dataDirectory(context, parsed) {
-  return path10.resolve(stringOption(parsed.options, "data-dir") ?? context.io.env.ORKESTRATOR_DATA_DIR ?? defaultDataDir(process.platform, context.io.env));
+  return path13.resolve(stringOption(parsed.options, "data-dir") ?? context.io.env.ORKESTRATOR_DATA_DIR ?? defaultDataDir(process.platform, context.io.env));
 }
 function unitFor(context, dataDir, bun) {
   if (process.platform !== "darwin" && process.platform !== "linux") {
@@ -10147,7 +10897,7 @@ function unitFor(context, dataDir, bun) {
         defaultDataDir: defaultDataDir(process.platform, context.io.env),
         bun,
         launcher: layout.launcher,
-        logFile: path10.join(layout.logs, "service.log"),
+        logFile: path13.join(layout.logs, "service.log"),
         env: context.io.env
       })
     };
@@ -10262,7 +11012,7 @@ var serviceCommands = [
         installedAt: new Date().toISOString()
       });
       await mkdir2(layout.logs, { recursive: true });
-      await mkdir2(path10.dirname(unit.file), { recursive: true });
+      await mkdir2(path13.dirname(unit.file), { recursive: true });
       await writeFile2(unit.file, unit.contents);
       const started = parsed.options["skip-start"] !== true;
       if (started) {
@@ -10276,7 +11026,7 @@ var serviceCommands = [
           ...keyValues([
             ["release", `${version} (${releaseDir})`],
             ["unit", `${unit.manager} ${unit.name}`],
-            ["logs", path10.join(layout.logs, "service.log")]
+            ["logs", path13.join(layout.logs, "service.log")]
           ]),
           "",
           started ? "The service is running. Remote clients can update it from Settings \u2192 Updates or `orkestrator host update`." : `The unit is written but not loaded; load it with: ${serviceManagerCommands(unit).load.at(-1).join(" ")}`,
@@ -10302,7 +11052,7 @@ var serviceCommands = [
       const dataDir = dataDirectory(context, parsed);
       const { service, layout, unit } = await unitFor(context, dataDir, process.execPath);
       const config = service.readServiceConfig(layout);
-      if (existsSync2(unit.file)) {
+      if (existsSync4(unit.file)) {
         for (const argv of serviceManagerCommands(unit).unload)
           runManager(argv, true);
         await rm2(unit.file, { force: true });
@@ -10330,7 +11080,7 @@ var serviceCommands = [
       const { service, layout, unit } = await unitFor(context, dataDir, process.execPath);
       const config = service.readServiceConfig(layout);
       const state = service.readLauncherState(layout);
-      const installed = existsSync2(unit.file);
+      const installed = existsSync4(unit.file);
       const running = installed ? runManager(serviceManagerCommands(unit).status, true).ok : false;
       const result = {
         dataDir,
@@ -11506,9 +12256,9 @@ var sessionCommands = [
 ];
 
 // src/client/commands/toolchain.ts
-import path14 from "path";
+import path17 from "path";
 function dataDirectory2(context, parsed) {
-  return path14.resolve(stringOption(parsed.options, "data-dir") ?? context.io.env.ORKESTRATOR_DATA_DIR ?? defaultDataDir(process.platform, context.io.env));
+  return path17.resolve(stringOption(parsed.options, "data-dir") ?? context.io.env.ORKESTRATOR_DATA_DIR ?? defaultDataDir(process.platform, context.io.env));
 }
 function requestedTools(parsed) {
   const raw = parsed.options.tool;
@@ -11611,7 +12361,7 @@ var toolchainCommands = [
       const rows = installed.tools.map((tool) => ({
         tool,
         version: installed.versions[tool] ?? "",
-        executable: path14.join(installed.currentBinDir, path14.basename(installed.executables[tool]))
+        executable: path17.join(installed.currentBinDir, path17.basename(installed.executables[tool]))
       }));
       return {
         action: "toolchain.install",
@@ -11648,6 +12398,7 @@ var GROUP_SUMMARIES = {
   environment: "Create, start, stop, configure, launch and delete environments.",
   agent: "Discover agents, models and controls.",
   session: "Start, prompt, control and inspect native-agent conversations.",
+  changes: "Read the file and line changes the backend measures (read-only).",
   run: "Inspect, wait for and recover individual operations."
 };
 function optionLine(option) {
@@ -11697,6 +12448,7 @@ function rootHelp(tree) {
     "Usage:",
     "  orkestrator [serve] [service options]     Run the backend service in the foreground",
     "  orkestrator <group> <command> [options]   Talk to an already-running backend",
+    "  orkestrator --fix AGENT                   Get an agent's help reporting a problem",
     "",
     "Client commands never start a backend. Select the backend explicitly with",
     "--profile NAME (an isolated dev profile) or --connection NAME, or save a",
@@ -11707,6 +12459,8 @@ function rootHelp(tree) {
     "",
     "Other:",
     "  serve          Run the backend service (same as passing only service options)",
+    "  --fix AGENT    Open claude, codex or opencode to diagnose an Orkestrator",
+    "                 problem and file a GitHub issue (`orkestrator --fix --help`)",
     "  help [COMMAND] Show help for a group or command",
     "  version        Print the client version",
     "",
@@ -11872,6 +12626,7 @@ var CLIENT_COMMANDS = [
   ...projectCommands,
   ...environmentCommands,
   ...sessionCommands,
+  ...changesCommands,
   ...runCommands,
   ...toolchainCommands,
   ...hostCommands,
@@ -12016,7 +12771,7 @@ var CLIENT_FLAGS = new Set(GLOBAL_OPTIONS.flatMap((option) => [
   ...option.short ? [`-${option.short}`] : []
 ]));
 var CLIENT_VALUE_FLAGS = new Set(GLOBAL_OPTIONS.filter((option) => option.kind !== "boolean").map((option) => `--${option.name}`));
-var SAFE_WORD2 = /^[a-z][a-z0-9-]{0,39}$/;
+var SAFE_WORD3 = /^[a-z][a-z0-9-]{0,39}$/;
 function flagName(token) {
   const equals = token.indexOf("=");
   return equals < 0 ? token : token.slice(0, equals);
@@ -12024,6 +12779,8 @@ function flagName(token) {
 function classifyInvocation(argv) {
   if (argv.length === 0)
     return { mode: "serve", args: [] };
+  if (isFixInvocation(argv))
+    return { mode: "fix", argv: [...argv] };
   const first = argv[0];
   if (first === "serve") {
     const rest = argv.slice(1);
@@ -12069,7 +12826,7 @@ function classifyInvocation(argv) {
     return { mode: "client", argv: [...argv] };
   return {
     mode: "error",
-    message: `Unknown command ${SAFE_WORD2.test(first) ? `'${first}'` : "argument"}; run \`orkestrator help\``
+    message: `Unknown command ${SAFE_WORD3.test(first) ? `'${first}'` : "argument"}; run \`orkestrator help\``
   };
 }
 function renderInvocationError(argv, message) {
@@ -12094,5 +12851,6 @@ export {
   classifyInvocation,
   renderInvocationError,
   runClient,
-  runClientProcess
+  runClientProcess,
+  runFixProcess
 };