orkestrator 2.29.0-beta → 2.30.0-beta

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "orkestrator",
-  "version": "2.29.0-beta",
+  "version": "2.30.0-beta",
   "description": "Run the Orkestrator backend service without the desktop application",
   "homepage": "https://orkestrator.dev",
   "repository": {
@@ -31,7 +31,7 @@
     "smoke:pack": "bun scripts/smoke-packed.ts",
     "test": "bun run build && bun test --preload ../../tests/setup-node.ts tests --parallel",
     "test:workspace": "bun test --preload ../../tests/setup-node.ts tests --only-failures ${ORKESTRATOR_TEST_TIMINGS_DIR:+--timings=$ORKESTRATOR_TEST_TIMINGS_DIR/cli.json --update-timings} --parallel=${ORKESTRATOR_TEST_WORKERS:-2}",
-    "typecheck": "bunx tsc --noEmit -p tsconfig.json"
+    "typecheck": "bun check -p tsconfig.json"
   },
   "dependencies": {
     "@anthropic-ai/claude-agent-sdk": "0.3.309",
@@ -39,11 +39,11 @@
     "sharp": "0.35.5"
   },
   "devDependencies": {
-    "@orkestrator/protocol": "2.29.0-beta",
-    "@orkestrator/toolchain": "2.29.0-beta"
+    "@orkestrator/protocol": "2.30.0-beta",
+    "@orkestrator/toolchain": "2.30.0-beta"
   },
   "engines": {
-    "bun": ">=1.4.3"
+    "bun": ">=1.4.4"
   },
   "//dependencies": "Only modules scripts/build.ts leaves unbundled belong here; everything else is inlined into dist/ and resources/. tests/cli.test.ts derives this list from the built artifacts and fails if it drifts."
 }

package/resources/claude-bridge/dist/index.js

@@ -4349,7 +4349,8 @@ var NATIVE_AGENT_COMMAND_CATALOGUE_ERROR_CODES = [
   "rejected",
   "malformed",
   "too-large",
-  "provider-error"
+  "provider-error",
+  "outdated-bridge"
 ];
 var DEFAULT_NATIVE_AGENT_LIVE_WINDOW = {
   messages: 100,
@@ -4495,6 +4496,7 @@ var READ_ONLY_COMMANDS = Object.freeze(new Set([
 var MUTATING_ARGUMENTS = new Map([
   ["date", new Set(["-s", "--set"])],
   ["fd", new Set(["-x", "-X", "--exec", "--exec-batch"])],
+  ["file", new Set(["-C", "--compile"])],
   [
     "find",
     new Set([
@@ -4509,9 +4511,48 @@ var MUTATING_ARGUMENTS = new Map([
       "-okdir"
     ])
   ],
+  ["hostname", new Set(["-F", "--file", "-b", "--boot"])],
   ["rg", new Set(["--hostname-bin", "--pre"])],
-  ["sort", new Set(["-o", "--output"])],
-  ["yq", new Set(["-i", "--in-place", "--inplace"])]
+  ["sort", new Set(["-o", "--output", "-T", "--temporary-directory", "--compress-program"])],
+  ["yq", new Set(["-i", "--in-place", "--inplace", "-s", "--split-exp"])]
+]);
+var POSITIONAL_LIMITS = new Map([
+  ["hostname", { max: 0, valueOptions: new Set }],
+  ["uniq", { max: 1, valueOptions: new Set(["-f", "-s", "-w"]) }],
+  [
+    "xxd",
+    {
+      max: 1,
+      valueOptions: new Set([
+        "-c",
+        "-cols",
+        "-g",
+        "-groupsize",
+        "-l",
+        "-len",
+        "-n",
+        "-name",
+        "-o",
+        "-offset",
+        "-s",
+        "-seek"
+      ])
+    }
+  ]
+]);
+var OPTION_ALLOWLISTS = new Map([
+  ["awk", new Set(["-F", "-v", "--field-separator", "--assign"])]
+]);
+var GIT_MUTATING_ARGUMENTS = new Set([
+  "--config-env",
+  "--exec-path",
+  "--ext-diff",
+  "--filters",
+  "--output",
+  "--textconv"
+]);
+var GIT_SUBCOMMAND_MUTATING_ARGUMENTS = new Map([
+  ["grep", new Set(["-O", "--open-files-in-pager"])]
 ]);
 var READ_ONLY_GIT_SUBCOMMANDS = Object.freeze(new Set([
   "blame",
@@ -4521,7 +4562,6 @@ var READ_ONLY_GIT_SUBCOMMANDS = Object.freeze(new Set([
   "grep",
   "log",
   "ls-files",
-  "ls-remote",
   "ls-tree",
   "merge-base",
   "name-rev",
@@ -4575,9 +4615,10 @@ var GIT_CONFIG_WRITE_FLAGS = Object.freeze(new Set([
 ]));
 var GIT_CONFIG_READ_SUBCOMMANDS = Object.freeze(new Set(["get", "list"]));
 var GIT_CONFIG_WRITE_SUBCOMMANDS = Object.freeze(new Set(["edit", "remove-section", "rename-section", "set", "unset"]));
-var GIT_REMOTE_READ_SUBCOMMANDS = Object.freeze(new Set(["get-url", "show"]));
+var GIT_REMOTE_READ_SUBCOMMANDS = Object.freeze(new Set(["get-url"]));
 function hasFlag(args, flags) {
-  return args.some((arg) => flags.has(arg) || flags.has(arg.split("=", 1)[0] ?? arg));
+  const letters = [...flags].flatMap((flag) => /^-[A-Za-z0-9]$/.test(flag) ? [flag[1]] : []);
+  return args.some((arg) => flags.has(arg) || flags.has(arg.split("=", 1)[0] ?? arg) || arg.startsWith("--") && [...flags].some((flag) => flag.startsWith("--") && flag.startsWith(arg.split("=", 1)[0])) || /^-[^-]/.test(arg) && letters.some((letter) => arg.slice(1).includes(letter)));
 }
 function listsRefsOnly(args) {
   if (hasFlag(args, GIT_REF_WRITE_FLAGS))
@@ -4610,8 +4651,9 @@ var CONDITIONAL_GIT_SUBCOMMANDS = new Map([
   ],
   ["tag", listsRefsOnly]
 ]);
-var READ_ONLY_GH_SUBCOMMANDS = Object.freeze(new Set(["api", "browse", "search", "status"]));
-var COMPOSITION_PATTERN = /[;&|><`$(){}\n\r]|\bsudo\b|\bexec\b/;
+var NETWORK_COMMANDS = new Set(["curl", "gh", "wget"]);
+var NETWORK_GIT_SUBCOMMANDS = new Set(["fetch", "ls-remote", "pull"]);
+var COMPOSITION_PATTERN = /[;&|><`$(){}\n\r'"\\*?[\]]|\bsudo\b|\bexec\b/;
 function isCoordinatorReadOnlyPolicy(policy) {
   return policy?.id === "coordinator-read-only";
 }
@@ -4640,13 +4682,14 @@ function claudeReadOnlyAllowedTools(options) {
     ...(options.researchMcpServerNames ?? []).map((name) => `${claudeMcpToolPrefix(name)}*`)
   ];
 }
-function claudeReadOnlySandbox(policy) {
+function claudeReadOnlySandbox(policy, options = {}) {
   return {
     enabled: true,
-    failIfUnavailable: true,
+    failIfUnavailable: options.commandSandbox !== "unavailable",
     autoAllowBashIfSandboxed: true,
     allowUnsandboxedCommands: false,
     excludedCommands: [],
+    filesystem: { denyWrite: [...new Set(options.workspaces ?? [])] },
     network: {
       allowLocalBinding: policy.networkAccess === "full",
       strictAllowlist: true,
@@ -4658,32 +4701,54 @@ function isReadOnlyShellCommand(command) {
   const trimmed = command.trim();
   if (!trimmed)
     return { allowed: true };
-  if (COMPOSITION_PATTERN.test(trimmed)) {
+  if (COMPOSITION_PATTERN.test(trimmed) || /(?:^|\s)~/.test(trimmed)) {
     return {
       allowed: false,
-      reason: "Coordinator shells cannot use pipes, redirection, substitution or command chaining, because the command that runs would not be the one checked."
+      reason: "Coordinator shells cannot use quotes, escapes, globs, pipes, redirection, substitution or command chaining, because the command that runs would not be the one checked."
     };
   }
   const tokens = trimmed.split(/\s+/).filter(Boolean);
-  const program = tokens[0]?.split("/").at(-1) ?? "";
-  if (!program)
+  const first = tokens[0] ?? "";
+  if (!first)
     return { allowed: true };
-  if (program === "git" || program === "gh") {
-    const subcommandIndex = tokens.findIndex((token, index) => index > 0 && !token.startsWith("-"));
-    const subcommand = subcommandIndex > 0 ? tokens[subcommandIndex] : undefined;
-    const args = subcommandIndex > 0 ? tokens.slice(subcommandIndex + 1) : [];
-    const permitted = program === "git" ? subcommand !== undefined && (READ_ONLY_GIT_SUBCOMMANDS.has(subcommand) || (CONDITIONAL_GIT_SUBCOMMANDS.get(subcommand)?.(args) ?? false)) : subcommand !== undefined && READ_ONLY_GH_SUBCOMMANDS.has(subcommand);
-    if (permitted)
-      return { allowed: true };
-    const described = [program, subcommand].filter(Boolean).join(" ");
+  if (first.includes("/") || first.includes("\\")) {
     return {
       allowed: false,
-      reason: `Coordinator is read-only, so \`${described}\` is not available here. Delegate it to a worker environment.`
+      reason: `Coordinator shells run reading programs by name only, so \`${first}\` is not available here. Use the program name, or delegate it to a worker environment.`
     };
   }
+  const program = first;
+  if (NETWORK_COMMANDS.has(program))
+    return networkRefusal(program);
+  if (program === "git") {
+    const subcommandIndex = tokens.findIndex((token, index) => index > 0 && !token.startsWith("-"));
+    const subcommand = subcommandIndex > 0 ? tokens[subcommandIndex] : undefined;
+    const args = subcommandIndex > 0 ? tokens.slice(subcommandIndex + 1) : [];
+    if (subcommand && (NETWORK_GIT_SUBCOMMANDS.has(subcommand) || subcommand === "remote" && args.some((arg) => arg === "show"))) {
+      return networkRefusal(`git ${subcommand}`);
+    }
+    const permitted = subcommand !== undefined && (READ_ONLY_GIT_SUBCOMMANDS.has(subcommand) || (CONDITIONAL_GIT_SUBCOMMANDS.get(subcommand)?.(args) ?? false));
+    const described = ["git", subcommand].filter(Boolean).join(" ");
+    if (!permitted) {
+      return {
+        allowed: false,
+        reason: `Coordinator is read-only, so \`${described}\` is not available here. Delegate it to a worker environment.`
+      };
+    }
+    if (hasFlag(tokens.slice(1), GIT_MUTATING_ARGUMENTS) || hasFlag(args, GIT_SUBCOMMAND_MUTATING_ARGUMENTS.get(subcommand) ?? new Set)) {
+      return {
+        allowed: false,
+        reason: `Coordinator is read-only, so \`${described}\` cannot be used with an argument that writes a file or runs another program. Delegate it to a worker environment.`
+      };
+    }
+    return { allowed: true };
+  }
   if (READ_ONLY_COMMANDS.has(program)) {
+    const args = tokens.slice(1);
     const mutating = MUTATING_ARGUMENTS.get(program);
-    if (mutating && hasFlag(tokens.slice(1), mutating)) {
+    const options = OPTION_ALLOWLISTS.get(program);
+    const limit = POSITIONAL_LIMITS.get(program);
+    if (mutating && hasFlag(args, mutating) || options && !optionsAllowed(args, options) || limit && positionalCount(args, limit.valueOptions) > limit.max) {
       return {
         allowed: false,
         reason: `Coordinator is read-only, so \`${program}\` cannot be used with an argument that writes or runs another program. Delegate it to a worker environment.`
@@ -4696,6 +4761,48 @@ function isReadOnlyShellCommand(command) {
     reason: `Coordinator is read-only, so \`${program}\` is not available here. Delegate commands that change the checkout to a worker environment.`
   };
 }
+function networkRefusal(described) {
+  return {
+    allowed: false,
+    reason: `Coordinator commands have no network access, so \`${described}\` is not available here. Delegate it to a worker environment.`
+  };
+}
+function optionsAllowed(args, allowed) {
+  for (let index = 0;index < args.length; index += 1) {
+    const arg = args[index];
+    if (arg === "--")
+      return true;
+    if (!arg.startsWith("-") || arg === "-")
+      continue;
+    if (allowed.has(arg)) {
+      index += 1;
+      continue;
+    }
+    const long = arg.startsWith("--") ? arg.split("=", 1)[0] : undefined;
+    const attached = long ?? arg.slice(0, 2);
+    if (!allowed.has(attached))
+      return false;
+  }
+  return true;
+}
+function positionalCount(args, valueOptions) {
+  let count = 0;
+  let optionsEnded = false;
+  for (let index = 0;index < args.length; index += 1) {
+    const arg = args[index];
+    if (!optionsEnded && arg === "--") {
+      optionsEnded = true;
+      continue;
+    }
+    if (!optionsEnded && arg.startsWith("-") && arg !== "-") {
+      if (valueOptions.has(arg))
+        index += 1;
+      continue;
+    }
+    count += 1;
+  }
+  return count;
+}
 function deny(reason) {
   return {
     hookSpecificOutput: {
@@ -12585,7 +12692,7 @@ var AUTH_CACHE_TTL_MS = 30000;
 var FAILED_AUTH_CACHE_TTL_MS = 5000;
 var CLAUDE_SIGN_IN = {
   kind: "terminal",
-  hint: "Open a Claude terminal tab and run /login."
+  hint: "Sign in to Claude from the sign-in card in this tab or from Settings → Claude."
 };
 var CLAUDE_SIGN_IN_REQUIRED_MESSAGE = "Claude isn't signed in. Sign in to Claude to keep working.";
 var authCache;
@@ -13852,9 +13959,86 @@ function backgroundCommandInstruction(env) {
 }
 
 // ../../bridges/claude-bridge/src/services/claude-execution-sandbox.ts
-function claudeExecutionSandbox(policy, asksForApproval) {
-  if (policy && isCoordinatorReadOnlyPolicy(policy))
-    return claudeReadOnlySandbox(policy);
+import { realpathSync } from "node:fs";
+
+// ../protocol/src/coordinator.ts
+var COORDINATOR_COMMAND_SANDBOX_ENV = "ORKESTRATOR_COORDINATOR_COMMAND_SANDBOX";
+function coordinatorCommandSandboxFromEnv(env) {
+  return env[COORDINATOR_COMMAND_SANDBOX_ENV] === "unavailable" ? "unavailable" : "required";
+}
+var COORDINATOR_CONTROL_TOOL_NAMES = Object.freeze([
+  "ack_message",
+  "add_ticket_comment",
+  "address_multi_review",
+  "adopt_workflow",
+  "cancel_build_pipeline",
+  "cancel_multi_review",
+  "compare_project_files",
+  "create_ticket",
+  "get_build_pipeline",
+  "get_environment",
+  "get_launch_options",
+  "get_message",
+  "get_message_status",
+  "get_multi_review",
+  "get_repository_context",
+  "get_tab_state",
+  "get_tab_transcript",
+  "get_ticket",
+  "launch_environment",
+  "launch_job",
+  "launch_multi_review",
+  "launch_node_environment",
+  "list_agents",
+  "list_environments",
+  "list_mailboxes",
+  "list_node_environments",
+  "list_nodes",
+  "list_projects",
+  "list_tabs",
+  "list_tickets",
+  "list_workflows",
+  "open_multi_review",
+  "open_multi_review_fix",
+  "pause_build_pipeline",
+  "read_messages",
+  "read_node_environment",
+  "request_env_value_reveal",
+  "request_environment_deletion",
+  "request_project_file_update",
+  "request_project_on_node",
+  "resume_build_pipeline",
+  "send_message",
+  "send_node_message",
+  "send_prompt_to_node_tab",
+  "send_prompt_to_tab",
+  "start_build_pipeline",
+  "start_environment",
+  "start_multi_review",
+  "start_node_environment",
+  "stop_environment",
+  "stop_node_environment",
+  "transfer_files",
+  "update_ticket"
+]);
+
+// ../../bridges/claude-bridge/src/services/claude-execution-sandbox.ts
+function claudeReadOnlyWorkspaces(cwd) {
+  let resolved;
+  try {
+    resolved = realpathSync(cwd);
+  } catch {
+    resolved = undefined;
+  }
+  return [...new Set([cwd, ...resolved ? [resolved] : []])];
+}
+function claudeExecutionSandbox(policy, asksForApproval, readOnly = {}) {
+  if (policy && isCoordinatorReadOnlyPolicy(policy)) {
+    return claudeReadOnlySandbox(policy, {
+      workspaces: claudeReadOnlyWorkspaces(readOnly.cwd ?? claudeWorkspaceCwd()),
+      commandSandbox: readOnly.commandSandbox ?? coordinatorCommandSandboxFromEnv(process.env)
+    });
+  }
   if (policy?.sandbox !== "provider")
     return;
   return {
@@ -14789,7 +14973,9 @@ function claudeQueryOptions(turn, plan, turnFor, mcp) {
     forwardSubagentText: true,
     allowedTools,
     ...disallowedTools?.length ? { disallowedTools } : {},
-    ...policy?.sandbox === "provider" || coordinatorReadOnly ? { sandbox: claudeExecutionSandbox(policy, claudeAsksForApproval(policy, options)) } : {},
+    ...policy?.sandbox === "provider" || coordinatorReadOnly ? {
+      sandbox: claudeExecutionSandbox(policy, claudeAsksForApproval(policy, options), { cwd })
+    } : {},
     abortController,
     ...session.sdkSessionId ? { resume: session.sdkSessionId } : {
       sessionId: sdkSessionIdFromBridgeId(session.id) ?? crypto.randomUUID()
@@ -14801,7 +14987,7 @@ function claudeQueryOptions(turn, plan, turnFor, mcp) {
     systemPrompt: {
       type: "preset",
       preset: "claude_code",
-      append: [
+      append: coordinatorReadOnly ? "You are a read-only coordinator. Inspect the checkout with reading tools and use the trusted research tools available for this turn. Delegate all mutations and artifact creation to worker environments through Orkestrator tools. Present findings directly in your response." : [
         "IMPORTANT: You MUST read a file before editing or writing to it. The Edit and Write tools will fail if you have not first used the Read tool to read the file in this conversation. Always read files before attempting to modify them.",
         backgroundCommandInstruction(queryEnvironment),
         "When the user asks for a document (a report, design doc, plan, analysis, guide, or other writing to keep), prefer writing it as a Markdown file in a `docs/` folder at the root of the working directory over creating a Claude Doc or claude.ai artifact, and tell the user the file's path. Project instructions (such as CLAUDE.md or AGENTS.md), local skills, and the user's own request take priority over this default when they say where or how to write documents.",
@@ -14866,6 +15052,34 @@ function observeClaudeMessage(diagnostics, message) {
   }
 }
 
+// ../../bridges/claude-bridge/src/services/session-auth-notice.ts
+var CLAUDE_LOGIN_REFUSED_MESSAGE = "Claude's login was refused. Sign in to Claude again to keep working.";
+var MAX_NOTICE_LENGTH = 500;
+function setSessionAuthNotice(session, sessionId, notice) {
+  const previous = session.authNotice;
+  if (!previous && !notice)
+    return;
+  if (previous && notice && previous.state === notice.state && previous.message === notice.message && previous.occurrenceId === notice.occurrenceId) {
+    return;
+  }
+  session.authNotice = notice ? { ...notice, message: notice.message.slice(0, MAX_NOTICE_LENGTH) } : undefined;
+  eventEmitter.emit({
+    type: "session.updated",
+    sessionId,
+    data: { authNotice: session.authNotice ?? null }
+  });
+}
+function noteSessionLoginRefused(session, sessionId, occurrenceId) {
+  const current = session.authNotice;
+  if (current?.state === "expired" && current.message === CLAUDE_LOGIN_REFUSED_MESSAGE)
+    return;
+  setSessionAuthNotice(session, sessionId, {
+    state: "expired",
+    message: CLAUDE_LOGIN_REFUSED_MESSAGE,
+    occurrenceId
+  });
+}
+
 // ../../bridges/claude-bridge/src/services/session-manager-prompt-handlers/assistant.ts
 function applyClaudeUsageReport(session, report) {
   const previous = session.inProgressUsage ?? session.usage;
@@ -14924,10 +15138,13 @@ function handleAssistantMessage(turn, message) {
   const receivedAt = new Date().toISOString();
   const recordUnknownContentBlock = (blockType) => sessionHealth(session).recordUnknown(`block:${blockType}`);
   const assistantError = message.error;
-  if (assistantError === "authentication_failed")
+  if (assistantError === "authentication_failed") {
     noteClaudeAuthenticationFailure();
-  else if (!assistantError)
+    noteSessionLoginRefused(session, sessionId, typeof message.uuid === "string" ? message.uuid : crypto.randomUUID());
+  } else if (!assistantError) {
     noteClaudeAuthenticationWorked();
+    setSessionAuthNotice(session, sessionId, undefined);
+  }
   const usageReport = message.usage_report;
   if (usageReport) {
     const usage = applyClaudeUsageReport(session, usageReport);
@@ -15212,6 +15429,16 @@ function handleAuthStatus(turn, message) {
     severity: auth.error ? "error" : "info",
     createdAt: new Date().toISOString()
   });
+  const occurrenceId = typeof auth.uuid === "string" && auth.uuid ? auth.uuid : crypto.randomUUID();
+  setSessionAuthNotice(session, sessionId, auth.error ? {
+    state: "expired",
+    message: `${content.slice(0, 300)}. Sign in to Claude again to keep working.`,
+    occurrenceId
+  } : auth.isAuthenticating ? {
+    state: "needs-auth",
+    message: "Claude is signing in again. Finish any sign-in it opened to continue.",
+    occurrenceId
+  } : undefined);
 }
 function handleStreamEvent(turn, message) {
   if (message.event?.type !== "ping") {
@@ -18014,7 +18241,8 @@ session.get("/:id", async (c) => {
     completionBlockedByBackgroundTasks: sessionData.completionBlockedByBackgroundTasks === true,
     rewindInProgress: sessionData.rewindInProgress === true,
     ...sessionData.commandInventoryState ? { commandRevision: sessionData.commandInventoryState.revision } : {},
-    ...readinessField()
+    ...readinessField(),
+    ...sessionData.authNotice ? { authNotice: sessionData.authNotice } : {}
   });
 });
 function readinessField() {
@@ -19303,156 +19531,6 @@ mcp.get("/servers", async (c) => {
 });
 var mcp_default = mcp;
 
-// ../../bridges/claude-bridge/src/services/slash-commands.ts
-import { open as open3, readdir as readdir2, stat as stat4 } from "node:fs/promises";
-import { StringDecoder } from "node:string_decoder";
-import { join as join11, basename, dirname as dirname2 } from "node:path";
-var commandDescriptions = new Map;
-var MAX_COMMAND_DESCRIPTION_CACHE_ENTRIES = 512;
-function rememberCommandDescription(filePath, entry) {
-  commandDescriptions.delete(filePath);
-  commandDescriptions.set(filePath, entry);
-  while (commandDescriptions.size > MAX_COMMAND_DESCRIPTION_CACHE_ENTRIES) {
-    const oldest = commandDescriptions.keys().next();
-    if (oldest.done)
-      break;
-    commandDescriptions.delete(oldest.value);
-  }
-}
-var FRONTMATTER_READ_CHUNK_BYTES = 8 * 1024;
-var MAX_FRONTMATTER_READ_BYTES = 256 * 1024;
-function fingerprintOf2(stats) {
-  return `${stats.dev}:${stats.ino}:${stats.size}:${stats.mtimeMs}`;
-}
-function hasCompleteFrontmatter(content) {
-  return /^---\r?\n[\s\S]*?\r?\n---(?:\r?\n|$)/.test(content);
-}
-async function readFileFrontmatter(filePath) {
-  const handle = await open3(filePath, "r");
-  try {
-    const decoder = new StringDecoder("utf8");
-    let content = "";
-    let position = 0;
-    while (position < MAX_FRONTMATTER_READ_BYTES) {
-      const readLength = Math.min(FRONTMATTER_READ_CHUNK_BYTES, MAX_FRONTMATTER_READ_BYTES - position);
-      const buffer = Buffer.allocUnsafe(readLength);
-      const { bytesRead } = await handle.read(buffer, 0, readLength, position);
-      if (bytesRead === 0)
-        break;
-      position += bytesRead;
-      content += decoder.write(buffer.subarray(0, bytesRead));
-      if (position >= FRONTMATTER_READ_CHUNK_BYTES && !content.startsWith(`---
-`) && !content.startsWith(`---\r
-`) || hasCompleteFrontmatter(content)) {
-        break;
-      }
-    }
-    return content + decoder.end();
-  } finally {
-    await handle.close();
-  }
-}
-async function readCommandDescription(filePath) {
-  const fingerprint = fingerprintOf2(await stat4(filePath));
-  const cached = commandDescriptions.get(filePath);
-  if (cached && cached.fingerprint === fingerprint) {
-    return cached.description;
-  }
-  const description = parseDescription(await readFileFrontmatter(filePath));
-  rememberCommandDescription(filePath, { fingerprint, description });
-  return description;
-}
-function pruneCommandDescriptionCache(commandsDir, livePaths) {
-  for (const cachedPath of commandDescriptions.keys()) {
-    if (dirname2(cachedPath) === commandsDir && !livePaths.has(cachedPath)) {
-      commandDescriptions.delete(cachedPath);
-    }
-  }
-}
-var BUILTIN_COMMANDS = [
-  "/clear - Clear conversation history",
-  "/compact - Compact conversation to reduce tokens",
-  "/context - Show current context",
-  "/cost - Show token usage and cost",
-  "/doctor - Check system health",
-  "/goal - Set, view, or clear a completion goal",
-  "/help - Show available commands",
-  "/init - Re-initialize the session",
-  "/logout - Log out of Claude",
-  "/memory - Show memory usage",
-  "/model - Show or change model",
-  "/permissions - Manage permissions",
-  "/review - Review recent changes",
-  "/status - Show session status",
-  "/vim - Toggle vim mode"
-];
-function parseDescription(content) {
-  const match = content.match(/^---\r?\n([\s\S]*?)\r?\n---/);
-  if (!match?.[1])
-    return;
-  const frontmatter = match[1];
-  const descMatch = frontmatter.match(/^description:\s*(?:"([^"]*?)"|'([^']*?)'|(.+?))\s*$/m);
-  if (!descMatch)
-    return;
-  return (descMatch[1] ?? descMatch[2] ?? descMatch[3])?.trim();
-}
-async function scanCommandsDir(commandsDir, prefix) {
-  let entries;
-  try {
-    entries = await readdir2(commandsDir);
-  } catch {
-    pruneCommandDescriptionCache(commandsDir, new Set);
-    return [];
-  }
-  const commands = [];
-  const livePaths = new Set;
-  for (const entry of entries) {
-    if (!entry.endsWith(".md"))
-      continue;
-    const name = basename(entry, ".md");
-    const fullName = prefix ? `/${prefix}${name}` : `/${name}`;
-    const commandPath = join11(commandsDir, entry);
-    livePaths.add(commandPath);
-    let description;
-    try {
-      description = await readCommandDescription(commandPath);
-    } catch {}
-    commands.push(description ? `${fullName} - ${description}` : fullName);
-  }
-  pruneCommandDescriptionCache(commandsDir, livePaths);
-  return commands;
-}
-async function discoverSlashCommands(cwd) {
-  const seen = new Set;
-  const result = [];
-  const addCommand = (cmd) => {
-    const name = cmd.split(" - ")[0].trim().toLowerCase();
-    if (!seen.has(name)) {
-      seen.add(name);
-      result.push(cmd);
-    }
-  };
-  const repoCommands = await scanCommandsDir(join11(cwd, ".claude", "commands"), "");
-  for (const cmd of repoCommands)
-    addCommand(cmd);
-  try {
-    const plugins = await getMergedPlugins(cwd);
-    for (const plugin of plugins) {
-      const manifest = await readPluginManifest(plugin.path);
-      const pluginName = manifest?.name || plugin.path.split("/").pop() || "unknown";
-      const commandsDir = join11(plugin.path, "commands");
-      const pluginCommands = await scanCommandsDir(commandsDir, `${pluginName}:`);
-      for (const cmd of pluginCommands)
-        addCommand(cmd);
-    }
-  } catch (error) {
-    console.warn("[slash-commands] Failed to scan plugin commands:", error);
-  }
-  for (const cmd of BUILTIN_COMMANDS)
-    addCommand(cmd);
-  return result.sort((a, b) => a.localeCompare(b));
-}
-
 // ../../bridges/claude-bridge/src/routes/plugins.ts
 var plugins = new Hono2;
 plugins.get("/", async (c) => {
@@ -19468,21 +19546,12 @@ plugins.get("/", async (c) => {
     return c.json({ error: error instanceof Error ? error.message : "Failed to get plugins" }, 500);
   }
 });
-plugins.get("/commands", async (c) => {
-  try {
-    const cwd = process.env.CWD || process.cwd();
-    const commands = await discoverSlashCommands(cwd);
-    return c.json({ commands });
-  } catch (error) {
-    console.error("[plugins] Error discovering slash commands:", error);
-    return c.json({ error: error instanceof Error ? error.message : "Failed to discover slash commands" }, 500);
-  }
-});
 var plugins_default = plugins;
 
 // ../protocol/src/parent-watchdog.ts
 var PARENT_PID_ENV = "ORKESTRATOR_PARENT_PID";
-var DEFAULT_POLL_INTERVAL_MS = 15000;
+var PARENT_WATCH_INTERVAL_MS = 1000;
+var DEFAULT_POLL_INTERVAL_MS = PARENT_WATCH_INTERVAL_MS;
 function parseParentPid(value) {
   if (!value)
     return null;
@@ -21133,7 +21202,7 @@ compressTranscriptReads(app);
 app.get("/global/auth-check", (c) => c.json({ status: "ok" }));
 app.get("/global/auth", async (c) => c.json(await readClaudeAuthStatus()));
 app.get("/global/usage", async (c) => c.json({ account: await readClaudePlanUsage() }));
-app.post("/global/auth/login", (c) => c.json({ error: "Open a Claude terminal tab and run /login." }, 405));
+app.post("/global/auth/login", (c) => c.json({ error: "Claude signs in from the sign-in card in its tab or from Settings → Claude." }, 405));
 app.post("/global/auth/logout", (c) => c.json({ error: "Claude sign-out is available from a terminal tab." }, 405));
 app.post("/global/refresh-catalog", async (c) => {
   await refreshClaudeCatalogs();