overlord-cli 0.2607291136.0 → 0.2607301714.0

package/dist/index.js

@@ -1338,8 +1338,8 @@ function normalizeBackendUrl(value) {
 }
 function isLoopbackBackendUrl(backendUrl) {
   try {
-    const hostname3 = new URL(normalizeBackendUrl(backendUrl)).hostname;
-    return hostname3 === "127.0.0.1" || hostname3 === "localhost" || hostname3 === "::1";
+    const hostname5 = new URL(normalizeBackendUrl(backendUrl)).hostname;
+    return hostname5 === "127.0.0.1" || hostname5 === "localhost" || hostname5 === "::1";
   } catch {
     return false;
   }
@@ -3093,12 +3093,12 @@ function createBackendClient() {
   const clientDevice = clientDeviceIdentity();
   async function request({
     method,
-    path: path28,
+    path: path29,
     body,
     extraHeaders,
     rawBody
   }) {
-    const url = `${baseUrl}${path28.startsWith("/") ? path28 : `/${path28}`}`;
+    const url = `${baseUrl}${path29.startsWith("/") ? path29 : `/${path29}`}`;
     const auth = resolveAuthHeaders({ baseUrl });
     let response;
     try {
@@ -3125,14 +3125,14 @@ Start the Desktop/local backend or run \`ovld config set cloud <url>\`.
     const payload = await readResponseJson2(response);
     if (!response.ok) {
       if (response.status === 401 && auth.headers.Authorization) {
-        const detail = errorMessageFromJson2(payload) ?? `Backend request failed: ${method} ${path28} (${response.status})`;
+        const detail = errorMessageFromJson2(payload) ?? `Backend request failed: ${method} ${path29} (${response.status})`;
         throw new CliError({
           message: `${detail}
 ` + (auth.fromStored ? "Your saved credentials were rejected. Run `ovld auth login` to sign in again." : "Run `ovld auth login` or refresh your USER_TOKEN environment variable.")
         });
       }
       throw new CliError({
-        message: errorMessageFromJson2(payload) ?? `Backend request failed: ${method} ${path28} (${response.status})`
+        message: errorMessageFromJson2(payload) ?? `Backend request failed: ${method} ${path29} (${response.status})`
       });
     }
     return payload;
@@ -3140,13 +3140,13 @@ Start the Desktop/local backend or run \`ovld config set cloud <url>\`.
   return {
     baseUrl,
     health: () => request({ method: "GET", path: "/api/health" }),
-    get: (path28) => request({ method: "GET", path: path28 }),
-    post: ({ path: path28, body }) => request({ method: "POST", path: path28, body }),
-    patch: ({ path: path28, body }) => request({ method: "PATCH", path: path28, body }),
-    delete: (path28) => request({ method: "DELETE", path: path28 }),
-    postRaw: ({ path: path28, body, contentType, filename }) => request({
+    get: (path29) => request({ method: "GET", path: path29 }),
+    post: ({ path: path29, body }) => request({ method: "POST", path: path29, body }),
+    patch: ({ path: path29, body }) => request({ method: "PATCH", path: path29, body }),
+    delete: (path29) => request({ method: "DELETE", path: path29 }),
+    postRaw: ({ path: path29, body, contentType, filename }) => request({
       method: "POST",
-      path: path28,
+      path: path29,
       rawBody: body,
       extraHeaders: {
         "Content-Type": contentType || "application/octet-stream",
@@ -3349,6 +3349,7 @@ __export(setup_exports, {
   runAgentSetupCommand: () => runAgentSetupCommand,
   runSetupCommand: () => runSetupCommand
 });
+import { hostname as hostname3 } from "node:os";
 function printHumanResult(result) {
   const verb = result.dryRun ? "Would install" : "Installed";
   printLine(`${verb} connector "${result.agentKey}" \u2192 ${result.installPath}`);
@@ -3363,6 +3364,9 @@ function printHumanResult(result) {
 function isHttpUrl(value) {
   return /^https?:\/\//i.test(value.trim());
 }
+function asRecord(value) {
+  return value && typeof value === "object" ? value : {};
+}
 function shellQuote(value) {
   return `'${value.replace(/'/g, `'\\''`)}'`;
 }
@@ -3614,10 +3618,55 @@ async function resolveCurrentTerminalProfile({
     };
   }
 }
+async function configureExecutionTargetForSetup({
+  runtime
+}) {
+  printLine("");
+  printStepTitle("Step 4: Register this machine as an execution target.");
+  printLine("  Agents can only be launched on machines you have registered.");
+  if (!await promptYesNo("Register this machine", true)) {
+    printLine('  Skipped. Register it later with `ovld add-et --name "<name>"`.');
+    return { registered: false, reason: "declined" };
+  }
+  const name = await promptLine2({ message: "Target name", defaultValue: hostname3() });
+  let result;
+  try {
+    result = asRecord(
+      await runtime.backend.post({
+        path: "/api/protocol/register-target",
+        body: {
+          args: [],
+          positional: [],
+          flags: name ? { "--name": name } : {},
+          fileInputs: {}
+        }
+      })
+    );
+  } catch (error) {
+    printLine(`  Could not register: ${error instanceof Error ? error.message : String(error)}`);
+    printLine('  Retry later with `ovld add-et --name "<name>"`.');
+    return { registered: false, reason: "failed" };
+  }
+  if (result.status === "workspace_selection_required") {
+    const workspaces = Array.isArray(result.workspaces) ? result.workspaces : [];
+    printLine("  You belong to more than one workspace, so this needs an explicit choice:");
+    for (const entry of workspaces) {
+      const ws = asRecord(entry);
+      printLine(`    - ${String(ws.name ?? ws.id)} (${String(ws.slug ?? ws.id)})`);
+    }
+    printLine('  Run `ovld add-et --name "<name>" --workspace-id <id>` to finish.');
+    return { registered: false, reason: "workspace_selection_required" };
+  }
+  const target = asRecord(result.executionTarget);
+  const executionTargetId = String(target.executionTargetId ?? "");
+  const label = String(target.label ?? name);
+  printLine(`  Registered execution target ${label} (${executionTargetId}).`);
+  return { registered: true, executionTargetId, label };
+}
 async function configureTerminalForSetup({ runtime }) {
   const current = await resolveCurrentTerminalProfile({ runtime });
   printLine("");
-  printStepTitle("Step 4: Choose the default terminal for launched agents.");
+  printStepTitle("Step 5: Choose the default terminal for launched agents.");
   TERMINAL_OPTIONS.forEach((option, index) => {
     printLine(`  ${index + 1}. ${option.label}`);
   });
@@ -3686,7 +3735,14 @@ async function runFullSetupCommand({ json }) {
   const agents = await configureAgentsForSetup();
   const runtime = openCliRuntime();
   try {
-    const terminal = await configureTerminalForSetup({ runtime });
+    const executionTarget = await configureExecutionTargetForSetup({ runtime });
+    const terminal = executionTarget.registered ? await configureTerminalForSetup({ runtime }) : null;
+    if (!terminal) {
+      printLine("");
+      printLine(
+        'Skipping the terminal step: launch settings are stored per execution target, so register this machine first with `ovld add-et --name "<name>"`.'
+      );
+    }
     if (json) {
       printJson({
         ok: true,
@@ -3698,6 +3754,7 @@ async function runFullSetupCommand({ json }) {
           credentialsPath: auth.credentialsPath
         },
         agents: agents.map((result) => result.agentKey),
+        executionTarget,
         terminal
       });
     } else {
@@ -4748,17 +4805,17 @@ var require_visit = __commonJS({
     visit.BREAK = BREAK;
     visit.SKIP = SKIP;
     visit.REMOVE = REMOVE;
-    function visit_(key, node, visitor, path28) {
-      const ctrl = callVisitor(key, node, visitor, path28);
+    function visit_(key, node, visitor, path29) {
+      const ctrl = callVisitor(key, node, visitor, path29);
       if (identity.isNode(ctrl) || identity.isPair(ctrl)) {
-        replaceNode(key, path28, ctrl);
-        return visit_(key, ctrl, visitor, path28);
+        replaceNode(key, path29, ctrl);
+        return visit_(key, ctrl, visitor, path29);
       }
       if (typeof ctrl !== "symbol") {
         if (identity.isCollection(node)) {
-          path28 = Object.freeze(path28.concat(node));
+          path29 = Object.freeze(path29.concat(node));
           for (let i = 0; i < node.items.length; ++i) {
-            const ci = visit_(i, node.items[i], visitor, path28);
+            const ci = visit_(i, node.items[i], visitor, path29);
             if (typeof ci === "number")
               i = ci - 1;
             else if (ci === BREAK)
@@ -4769,13 +4826,13 @@ var require_visit = __commonJS({
             }
           }
         } else if (identity.isPair(node)) {
-          path28 = Object.freeze(path28.concat(node));
-          const ck = visit_("key", node.key, visitor, path28);
+          path29 = Object.freeze(path29.concat(node));
+          const ck = visit_("key", node.key, visitor, path29);
           if (ck === BREAK)
             return BREAK;
           else if (ck === REMOVE)
             node.key = null;
-          const cv = visit_("value", node.value, visitor, path28);
+          const cv = visit_("value", node.value, visitor, path29);
           if (cv === BREAK)
             return BREAK;
           else if (cv === REMOVE)
@@ -4796,17 +4853,17 @@ var require_visit = __commonJS({
     visitAsync.BREAK = BREAK;
     visitAsync.SKIP = SKIP;
     visitAsync.REMOVE = REMOVE;
-    async function visitAsync_(key, node, visitor, path28) {
-      const ctrl = await callVisitor(key, node, visitor, path28);
+    async function visitAsync_(key, node, visitor, path29) {
+      const ctrl = await callVisitor(key, node, visitor, path29);
       if (identity.isNode(ctrl) || identity.isPair(ctrl)) {
-        replaceNode(key, path28, ctrl);
-        return visitAsync_(key, ctrl, visitor, path28);
+        replaceNode(key, path29, ctrl);
+        return visitAsync_(key, ctrl, visitor, path29);
       }
       if (typeof ctrl !== "symbol") {
         if (identity.isCollection(node)) {
-          path28 = Object.freeze(path28.concat(node));
+          path29 = Object.freeze(path29.concat(node));
           for (let i = 0; i < node.items.length; ++i) {
-            const ci = await visitAsync_(i, node.items[i], visitor, path28);
+            const ci = await visitAsync_(i, node.items[i], visitor, path29);
             if (typeof ci === "number")
               i = ci - 1;
             else if (ci === BREAK)
@@ -4817,13 +4874,13 @@ var require_visit = __commonJS({
             }
           }
         } else if (identity.isPair(node)) {
-          path28 = Object.freeze(path28.concat(node));
-          const ck = await visitAsync_("key", node.key, visitor, path28);
+          path29 = Object.freeze(path29.concat(node));
+          const ck = await visitAsync_("key", node.key, visitor, path29);
           if (ck === BREAK)
             return BREAK;
           else if (ck === REMOVE)
             node.key = null;
-          const cv = await visitAsync_("value", node.value, visitor, path28);
+          const cv = await visitAsync_("value", node.value, visitor, path29);
           if (cv === BREAK)
             return BREAK;
           else if (cv === REMOVE)
@@ -4850,23 +4907,23 @@ var require_visit = __commonJS({
       }
       return visitor;
     }
-    function callVisitor(key, node, visitor, path28) {
+    function callVisitor(key, node, visitor, path29) {
       if (typeof visitor === "function")
-        return visitor(key, node, path28);
+        return visitor(key, node, path29);
       if (identity.isMap(node))
-        return visitor.Map?.(key, node, path28);
+        return visitor.Map?.(key, node, path29);
       if (identity.isSeq(node))
-        return visitor.Seq?.(key, node, path28);
+        return visitor.Seq?.(key, node, path29);
       if (identity.isPair(node))
-        return visitor.Pair?.(key, node, path28);
+        return visitor.Pair?.(key, node, path29);
       if (identity.isScalar(node))
-        return visitor.Scalar?.(key, node, path28);
+        return visitor.Scalar?.(key, node, path29);
       if (identity.isAlias(node))
-        return visitor.Alias?.(key, node, path28);
+        return visitor.Alias?.(key, node, path29);
       return void 0;
     }
-    function replaceNode(key, path28, node) {
-      const parent = path28[path28.length - 1];
+    function replaceNode(key, path29, node) {
+      const parent = path29[path29.length - 1];
       if (identity.isCollection(parent)) {
         parent.items[key] = node;
       } else if (identity.isPair(parent)) {
@@ -5476,10 +5533,10 @@ var require_Collection = __commonJS({
     var createNode = require_createNode();
     var identity = require_identity();
     var Node = require_Node();
-    function collectionFromPath(schema, path28, value) {
+    function collectionFromPath(schema, path29, value) {
       let v = value;
-      for (let i = path28.length - 1; i >= 0; --i) {
-        const k = path28[i];
+      for (let i = path29.length - 1; i >= 0; --i) {
+        const k = path29[i];
         if (typeof k === "number" && Number.isInteger(k) && k >= 0) {
           const a = [];
           a[k] = v;
@@ -5498,7 +5555,7 @@ var require_Collection = __commonJS({
         sourceObjects: /* @__PURE__ */ new Map()
       });
     }
-    var isEmptyPath = (path28) => path28 == null || typeof path28 === "object" && !!path28[Symbol.iterator]().next().done;
+    var isEmptyPath = (path29) => path29 == null || typeof path29 === "object" && !!path29[Symbol.iterator]().next().done;
     var Collection = class extends Node.NodeBase {
       constructor(type, schema) {
         super(type);
@@ -5528,11 +5585,11 @@ var require_Collection = __commonJS({
        * be a Pair instance or a `{ key, value }` object, which may not have a key
        * that already exists in the map.
        */
-      addIn(path28, value) {
-        if (isEmptyPath(path28))
+      addIn(path29, value) {
+        if (isEmptyPath(path29))
           this.add(value);
         else {
-          const [key, ...rest] = path28;
+          const [key, ...rest] = path29;
           const node = this.get(key, true);
           if (identity.isCollection(node))
             node.addIn(rest, value);
@@ -5546,8 +5603,8 @@ var require_Collection = __commonJS({
        * Removes a value from the collection.
        * @returns `true` if the item was found and removed.
        */
-      deleteIn(path28) {
-        const [key, ...rest] = path28;
+      deleteIn(path29) {
+        const [key, ...rest] = path29;
         if (rest.length === 0)
           return this.delete(key);
         const node = this.get(key, true);
@@ -5561,8 +5618,8 @@ var require_Collection = __commonJS({
        * scalar values from their surrounding node; to disable set `keepScalar` to
        * `true` (collections are always returned intact).
        */
-      getIn(path28, keepScalar) {
-        const [key, ...rest] = path28;
+      getIn(path29, keepScalar) {
+        const [key, ...rest] = path29;
         const node = this.get(key, true);
         if (rest.length === 0)
           return !keepScalar && identity.isScalar(node) ? node.value : node;
@@ -5580,8 +5637,8 @@ var require_Collection = __commonJS({
       /**
        * Checks if the collection includes a value with the key `key`.
        */
-      hasIn(path28) {
-        const [key, ...rest] = path28;
+      hasIn(path29) {
+        const [key, ...rest] = path29;
         if (rest.length === 0)
           return this.has(key);
         const node = this.get(key, true);
@@ -5591,8 +5648,8 @@ var require_Collection = __commonJS({
        * Sets a value in this collection. For `!!set`, `value` needs to be a
        * boolean to add/remove the item from the set.
        */
-      setIn(path28, value) {
-        const [key, ...rest] = path28;
+      setIn(path29, value) {
+        const [key, ...rest] = path29;
         if (rest.length === 0) {
           this.set(key, value);
         } else {
@@ -8107,9 +8164,9 @@ var require_Document = __commonJS({
           this.contents.add(value);
       }
       /** Adds a value to the document. */
-      addIn(path28, value) {
+      addIn(path29, value) {
         if (assertCollection(this.contents))
-          this.contents.addIn(path28, value);
+          this.contents.addIn(path29, value);
       }
       /**
        * Create a new `Alias` node, ensuring that the target `node` has the required anchor.
@@ -8184,14 +8241,14 @@ var require_Document = __commonJS({
        * Removes a value from the document.
        * @returns `true` if the item was found and removed.
        */
-      deleteIn(path28) {
-        if (Collection.isEmptyPath(path28)) {
+      deleteIn(path29) {
+        if (Collection.isEmptyPath(path29)) {
           if (this.contents == null)
             return false;
           this.contents = null;
           return true;
         }
-        return assertCollection(this.contents) ? this.contents.deleteIn(path28) : false;
+        return assertCollection(this.contents) ? this.contents.deleteIn(path29) : false;
       }
       /**
        * Returns item at `key`, or `undefined` if not found. By default unwraps
@@ -8206,10 +8263,10 @@ var require_Document = __commonJS({
        * scalar values from their surrounding node; to disable set `keepScalar` to
        * `true` (collections are always returned intact).
        */
-      getIn(path28, keepScalar) {
-        if (Collection.isEmptyPath(path28))
+      getIn(path29, keepScalar) {
+        if (Collection.isEmptyPath(path29))
           return !keepScalar && identity.isScalar(this.contents) ? this.contents.value : this.contents;
-        return identity.isCollection(this.contents) ? this.contents.getIn(path28, keepScalar) : void 0;
+        return identity.isCollection(this.contents) ? this.contents.getIn(path29, keepScalar) : void 0;
       }
       /**
        * Checks if the document includes a value with the key `key`.
@@ -8220,10 +8277,10 @@ var require_Document = __commonJS({
       /**
        * Checks if the document includes a value at `path`.
        */
-      hasIn(path28) {
-        if (Collection.isEmptyPath(path28))
+      hasIn(path29) {
+        if (Collection.isEmptyPath(path29))
           return this.contents !== void 0;
-        return identity.isCollection(this.contents) ? this.contents.hasIn(path28) : false;
+        return identity.isCollection(this.contents) ? this.contents.hasIn(path29) : false;
       }
       /**
        * Sets a value in this document. For `!!set`, `value` needs to be a
@@ -8240,13 +8297,13 @@ var require_Document = __commonJS({
        * Sets a value in this document. For `!!set`, `value` needs to be a
        * boolean to add/remove the item from the set.
        */
-      setIn(path28, value) {
-        if (Collection.isEmptyPath(path28)) {
+      setIn(path29, value) {
+        if (Collection.isEmptyPath(path29)) {
           this.contents = value;
         } else if (this.contents == null) {
-          this.contents = Collection.collectionFromPath(this.schema, Array.from(path28), value);
+          this.contents = Collection.collectionFromPath(this.schema, Array.from(path29), value);
         } else if (assertCollection(this.contents)) {
-          this.contents.setIn(path28, value);
+          this.contents.setIn(path29, value);
         }
       }
       /**
@@ -10206,9 +10263,9 @@ var require_cst_visit = __commonJS({
     visit.BREAK = BREAK;
     visit.SKIP = SKIP;
     visit.REMOVE = REMOVE;
-    visit.itemAtPath = (cst, path28) => {
+    visit.itemAtPath = (cst, path29) => {
       let item = cst;
-      for (const [field, index] of path28) {
+      for (const [field, index] of path29) {
         const tok = item?.[field];
         if (tok && "items" in tok) {
           item = tok.items[index];
@@ -10217,23 +10274,23 @@ var require_cst_visit = __commonJS({
       }
       return item;
     };
-    visit.parentCollection = (cst, path28) => {
-      const parent = visit.itemAtPath(cst, path28.slice(0, -1));
-      const field = path28[path28.length - 1][0];
+    visit.parentCollection = (cst, path29) => {
+      const parent = visit.itemAtPath(cst, path29.slice(0, -1));
+      const field = path29[path29.length - 1][0];
       const coll = parent?.[field];
       if (coll && "items" in coll)
         return coll;
       throw new Error("Parent collection not found");
     };
-    function _visit(path28, item, visitor) {
-      let ctrl = visitor(item, path28);
+    function _visit(path29, item, visitor) {
+      let ctrl = visitor(item, path29);
       if (typeof ctrl === "symbol")
         return ctrl;
       for (const field of ["key", "value"]) {
         const token = item[field];
         if (token && "items" in token) {
           for (let i = 0; i < token.items.length; ++i) {
-            const ci = _visit(Object.freeze(path28.concat([[field, i]])), token.items[i], visitor);
+            const ci = _visit(Object.freeze(path29.concat([[field, i]])), token.items[i], visitor);
             if (typeof ci === "number")
               i = ci - 1;
             else if (ci === BREAK)
@@ -10244,10 +10301,10 @@ var require_cst_visit = __commonJS({
             }
           }
           if (typeof ctrl === "function" && field === "key")
-            ctrl = ctrl(item, path28);
+            ctrl = ctrl(item, path29);
         }
       }
-      return typeof ctrl === "function" ? ctrl(item, path28) : ctrl;
+      return typeof ctrl === "function" ? ctrl(item, path29) : ctrl;
     }
     exports.visit = visit;
   }
@@ -12323,8 +12380,8 @@ function accessModeToResourcePathPermission({ accessMode, isPrimary = false }) {
     return "rw";
   return accessMode === "read" ? "ro" : "rw";
 }
-function formatResourcePathWithPermission({ path: path28, accessMode, isPrimary = false }) {
-  const trimmed = path28.trim();
+function formatResourcePathWithPermission({ path: path29, accessMode, isPrimary = false }) {
+  const trimmed = path29.trim();
   if (!trimmed)
     return "";
   const permission = accessModeToResourcePathPermission({ accessMode, isPrimary });
@@ -12338,11 +12395,11 @@ function formatProjectResourcePathsFromManifest(projectResources) {
     if (!entry || typeof entry !== "object")
       continue;
     const record = entry;
-    const path28 = typeof record.path === "string" ? record.path.trim() : "";
-    if (!path28)
+    const path29 = typeof record.path === "string" ? record.path.trim() : "";
+    if (!path29)
       continue;
     paths.push(formatResourcePathWithPermission({
-      path: path28,
+      path: path29,
       accessMode: typeof record.accessMode === "string" ? record.accessMode : null,
       isPrimary: record.isPrimary === true
     }));
@@ -12380,8 +12437,102 @@ var init_util2 = __esm({
 });
 
 // ../packages/core/dist/service/local-target/project-metadata.js
-import { existsSync as existsSync11, mkdirSync as mkdirSync5, readFileSync as readFileSync9, writeFileSync as writeFileSync4 } from "node:fs";
+import { execFileSync } from "node:child_process";
+import { chmodSync as chmodSync3, existsSync as existsSync11, mkdirSync as mkdirSync5, readFileSync as readFileSync9, writeFileSync as writeFileSync4 } from "node:fs";
 import path11 from "node:path";
+function writeIfChanged(filePath, content) {
+  if (!existsSync11(filePath) || readFileSync9(filePath, "utf8") !== content) {
+    writeFileSync4(filePath, content);
+  }
+}
+function replaceManagedBlock(content, block) {
+  const blockPattern = new RegExp(`${INSTRUCTION_BLOCK_START}[\\s\\S]*?${INSTRUCTION_BLOCK_END}\\n?`, "g");
+  const withoutExisting = content.replace(blockPattern, "").trimEnd();
+  return `${withoutExisting}${withoutExisting ? "\n\n" : ""}${block}
+`;
+}
+function ensureAgentInstructions(checkoutPath) {
+  for (const filename of ["AGENTS.md", "CLAUDE.md"]) {
+    const instructionPath = path11.join(checkoutPath, filename);
+    const existing = existsSync11(instructionPath) ? readFileSync9(instructionPath, "utf8") : "";
+    writeIfChanged(instructionPath, replaceManagedBlock(existing, PROJECT_METADATA_INSTRUCTION));
+  }
+}
+function ensureGitignore(checkoutPath) {
+  const gitignorePath = path11.join(checkoutPath, ".gitignore");
+  const existing = existsSync11(gitignorePath) ? readFileSync9(gitignorePath, "utf8") : "";
+  const existingPatterns = new Set(existing.split(/\r?\n/).map((line) => line.trim().replace(/^\//, "")).filter(Boolean));
+  const additions = [".overlord/tmp/", ".overlord/logs/"].filter((pattern) => !existingPatterns.has(pattern));
+  if (additions.length === 0)
+    return;
+  const separator = existing.length === 0 || existing.endsWith("\n") ? "" : "\n";
+  writeFileSync4(gitignorePath, `${existing}${separator}${additions.join("\n")}
+`);
+}
+function resolveGitRoot(directoryPath) {
+  try {
+    return execFileSync("git", ["-C", directoryPath, "rev-parse", "--show-toplevel"], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+  } catch {
+    return null;
+  }
+}
+function resolveGitHooksDirectory(gitRoot) {
+  try {
+    const gitPath2 = execFileSync("git", ["-C", gitRoot, "rev-parse", "--git-path", "hooks"], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+    return path11.isAbsolute(gitPath2) ? gitPath2 : path11.resolve(gitRoot, gitPath2);
+  } catch {
+    return null;
+  }
+}
+function ensurePreCommitGuard(gitRoot) {
+  const hooksDirectory = resolveGitHooksDirectory(gitRoot);
+  if (!hooksDirectory)
+    return;
+  mkdirSync5(hooksDirectory, { recursive: true });
+  const guardPath = path11.join(hooksDirectory, HOOK_GUARD_FILENAME);
+  writeIfChanged(guardPath, `#!/bin/sh
+# Managed by Overlord: reject any staged project-link metadata change.
+if git diff --cached --quiet -- .overlord/project.json; then
+  exit 0
+fi
+echo "Overlord blocked this commit: .overlord/project.json is managed metadata and must not be changed." >&2
+exit 1
+`);
+  chmodSync3(guardPath, 493);
+  const preCommitPath = path11.join(hooksDirectory, "pre-commit");
+  const hookBlock = `${HOOK_BLOCK_START}
+"$(dirname "$0")/${HOOK_GUARD_FILENAME}" || exit $?
+${HOOK_BLOCK_END}`;
+  if (!existsSync11(preCommitPath)) {
+    writeFileSync4(preCommitPath, `#!/bin/sh
+${hookBlock}
+`);
+    chmodSync3(preCommitPath, 493);
+    return;
+  }
+  const existing = readFileSync9(preCommitPath, "utf8");
+  const blockPattern = new RegExp(`${HOOK_BLOCK_START}[\\s\\S]*?${HOOK_BLOCK_END}\\n?`, "g");
+  const updated = `${existing.replace(blockPattern, "").trimEnd()}
+
+${hookBlock}
+`;
+  writeIfChanged(preCommitPath, updated);
+  chmodSync3(preCommitPath, 493);
+}
+function protectProjectMetadata(directoryPath) {
+  const gitRoot = resolveGitRoot(directoryPath);
+  const checkoutPath = gitRoot ?? directoryPath;
+  ensureAgentInstructions(checkoutPath);
+  ensureGitignore(checkoutPath);
+  if (gitRoot)
+    ensurePreCommitGuard(gitRoot);
+}
 function parseProjectJson(projectJsonPath) {
   if (!existsSync11(projectJsonPath))
     return null;
@@ -12389,12 +12540,13 @@ function parseProjectJson(projectJsonPath) {
   if (typeof parsed.projectId !== "string" || typeof parsed.resourceId !== "string")
     return null;
   const resourceIdsByExecutionTarget = parsed.resourceIdsByExecutionTarget && typeof parsed.resourceIdsByExecutionTarget === "object" && !Array.isArray(parsed.resourceIdsByExecutionTarget) ? Object.fromEntries(Object.entries(parsed.resourceIdsByExecutionTarget).filter((entry) => typeof entry[0] === "string" && entry[0].trim().length > 0 && typeof entry[1] === "string" && entry[1].trim().length > 0)) : {};
+  const resourceKey = typeof parsed.resourceKey === "string" && parsed.resourceKey.trim().length > 0 ? parsed.resourceKey.trim() : void 0;
   return {
-    _warning: typeof parsed._warning === "string" ? parsed._warning : "This file is managed by Overlord and is regenerated automatically when this folder is linked as a project resource. Do not edit it manually \u2014 manual changes will be overwritten.",
+    _warning: typeof parsed._warning === "string" ? parsed._warning : PROJECT_JSON_WARNING,
     version: typeof parsed.version === "number" ? parsed.version : 1,
     projectId: parsed.projectId,
     resourceId: parsed.resourceId,
-    resourceKey: typeof parsed.resourceKey === "string" && parsed.resourceKey.trim().length > 0 ? parsed.resourceKey.trim() : void 0,
+    ...resourceKey ? { resourceKey } : {},
     resourceIdsByExecutionTarget,
     isPrimary: parsed.isPrimary === true,
     linkedAt: typeof parsed.linkedAt === "string" ? parsed.linkedAt : nowIso()
@@ -12419,6 +12571,7 @@ function writeProjectJson({ directoryPath, projectId, resourceId, resourceKey, e
   mkdirSync5(overlordDir, { recursive: true });
   mkdirSync5(path11.join(overlordDir, "tmp"), { recursive: true });
   mkdirSync5(path11.join(overlordDir, "logs"), { recursive: true });
+  protectProjectMetadata(directoryPath);
   const projectJsonPath = path11.join(overlordDir, "project.json");
   const existing = readProjectJsonLink(projectJsonPath);
   const resourceIdsByExecutionTarget = {
@@ -12428,7 +12581,7 @@ function writeProjectJson({ directoryPath, projectId, resourceId, resourceKey, e
     resourceIdsByExecutionTarget[executionTargetId.trim()] = resourceId;
   }
   writeFileSync4(projectJsonPath, `${JSON.stringify({
-    _warning: "This file is managed by Overlord and is regenerated automatically when this folder is linked as a project resource. Do not edit it manually \u2014 manual changes will be overwritten.",
+    _warning: PROJECT_JSON_WARNING,
     version: PROJECT_JSON_VERSION,
     projectId,
     resourceId,
@@ -12440,21 +12593,34 @@ function writeProjectJson({ directoryPath, projectId, resourceId, resourceKey, e
 `);
   return projectJsonPath;
 }
-var PROJECT_JSON_VERSION;
+var PROJECT_JSON_VERSION, PROJECT_JSON_WARNING, INSTRUCTION_BLOCK_START, INSTRUCTION_BLOCK_END, PROJECT_METADATA_INSTRUCTION, HOOK_GUARD_FILENAME, HOOK_BLOCK_START, HOOK_BLOCK_END;
 var init_project_metadata = __esm({
   "../packages/core/dist/service/local-target/project-metadata.js"() {
     "use strict";
     init_util2();
     PROJECT_JSON_VERSION = 2;
+    PROJECT_JSON_WARNING = "STRICTLY PROTECTED: This file is managed exclusively by Overlord. Agents and users must not edit, replace, stage, commit, or delete it. Re-link the resource with Overlord to change it.";
+    INSTRUCTION_BLOCK_START = "<!-- OVERLORD PROJECT METADATA PROTECTION: START -->";
+    INSTRUCTION_BLOCK_END = "<!-- OVERLORD PROJECT METADATA PROTECTION: END -->";
+    PROJECT_METADATA_INSTRUCTION = `${INSTRUCTION_BLOCK_START}
+## Overlord project metadata \u2014 do not edit
+
+\`.overlord/project.json\` is exclusively managed by Overlord. Do not edit,
+replace, stage, commit, delete, or revert it. If its link metadata needs to
+change, use Overlord's resource-linking command instead.
+${INSTRUCTION_BLOCK_END}`;
+    HOOK_GUARD_FILENAME = "overlord-project-json-guard";
+    HOOK_BLOCK_START = "# >>> Overlord project metadata guard >>>";
+    HOOK_BLOCK_END = "# <<< Overlord project metadata guard <<<";
   }
 });
 
 // ../packages/core/dist/repository/git-tree.js
-import { execFileSync } from "node:child_process";
+import { execFileSync as execFileSync2 } from "node:child_process";
 import path12 from "node:path";
 function runGit(cwd, args) {
   try {
-    return execFileSync("git", args, {
+    return execFileSync2("git", args, {
       cwd,
       encoding: "utf8",
       maxBuffer: 10 * 1024 * 1024,
@@ -12542,10 +12708,10 @@ var init_git_tree = __esm({
 });
 
 // ../packages/core/dist/service/local-target/git-run.js
-import { execFileSync as execFileSync2 } from "node:child_process";
+import { execFileSync as execFileSync3 } from "node:child_process";
 function runGit2(cwd, args) {
   try {
-    return execFileSync2("git", args, {
+    return execFileSync3("git", args, {
       cwd,
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"],
@@ -12557,7 +12723,7 @@ function runGit2(cwd, args) {
 }
 function runGitResult(cwd, args) {
   try {
-    const stdout = execFileSync2("git", args, {
+    const stdout = execFileSync3("git", args, {
       cwd,
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"],
@@ -12944,10 +13110,10 @@ var init_commit_message_diff_git = __esm({
 });
 
 // ../packages/core/dist/service/local-target/doctor-checks.js
-import { execFileSync as execFileSync3 } from "node:child_process";
+import { execFileSync as execFileSync4 } from "node:child_process";
 function commandOnPath(command, args) {
   try {
-    const detail = execFileSync3(command, args, {
+    const detail = execFileSync4(command, args, {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"]
     }).trim();
@@ -13441,13 +13607,13 @@ var init_branch_planning = __esm({
 });
 
 // src/branch-preparation.ts
-import { execFileSync as execFileSync4 } from "node:child_process";
+import { execFileSync as execFileSync5 } from "node:child_process";
 import { existsSync as existsSync17, mkdirSync as mkdirSync7, statSync as statSync3 } from "node:fs";
 import os3 from "node:os";
 import path17 from "node:path";
 function runGit3(cwd, args, options = {}) {
   try {
-    return execFileSync4("git", args, {
+    return execFileSync5("git", args, {
       cwd,
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"],
@@ -13462,7 +13628,7 @@ function runGit3(cwd, args, options = {}) {
 function lines(value) {
   return value.split("\n").map((line) => line.trim()).filter(Boolean);
 }
-function resolveGitRoot(workingDirectory) {
+function resolveGitRoot2(workingDirectory) {
   const root = runGit3(workingDirectory, ["rev-parse", "--show-toplevel"]);
   if (!root) throw new Error(`${workingDirectory} is not inside a git repository.`);
   return path17.resolve(root);
@@ -13687,7 +13853,7 @@ async function prepareMissionBranch({
   if (options.dryRun) {
     return { workingDirectory: options.workingDirectory, branchAutomation: null };
   }
-  const gitRoot = resolveGitRoot(options.workingDirectory);
+  const gitRoot = resolveGitRoot2(options.workingDirectory);
   const mission = await runtime.backend.get(
     `/api/missions/${encodeURIComponent(options.missionId)}`
   );
@@ -13891,10 +14057,10 @@ function primaryResourcePath(projectResources) {
   for (const entry of projectResources) {
     if (!entry || typeof entry !== "object") continue;
     const record = entry;
-    const path28 = typeof record.path === "string" ? record.path.trim() : "";
-    if (!path28) continue;
-    if (record.isPrimary === true) return path28;
-    if (record.isCurrent === true && !currentPath) currentPath = path28;
+    const path29 = typeof record.path === "string" ? record.path.trim() : "";
+    if (!path29) continue;
+    if (record.isPrimary === true) return path29;
+    if (record.isCurrent === true && !currentPath) currentPath = path29;
   }
   return currentPath;
 }
@@ -14316,7 +14482,7 @@ var init_terminal_launcher = __esm({
 
 // src/launch.ts
 import { spawnSync as spawnSync2 } from "node:child_process";
-import { chmodSync as chmodSync3, writeFileSync as writeFileSync6 } from "node:fs";
+import { chmodSync as chmodSync4, writeFileSync as writeFileSync6 } from "node:fs";
 import path19 from "node:path";
 function overlordLaunchEnv({
   backendUrl,
@@ -14332,21 +14498,21 @@ function overlordLaunchEnv({
     ...projectResources && projectResources.length > 0 ? { OVERLORD_PROJECT_RESOURCES: JSON.stringify(projectResources) } : {}
   };
 }
-function asRecord(value) {
+function asRecord2(value) {
   return value && typeof value === "object" ? value : {};
 }
 async function loadMissionContext({
   runtime,
   missionId
 }) {
-  const mission = asRecord(
+  const mission = asRecord2(
     await runtime.backend.get(`/api/missions/${encodeURIComponent(missionId)}`)
   );
   const events = await runtime.backend.get(`/api/missions/${encodeURIComponent(missionId)}/events`).catch(() => []);
   const artifacts = await runtime.backend.get(`/api/missions/${encodeURIComponent(missionId)}/artifacts`).catch(() => []);
   const displayId = String(mission.displayId ?? mission.id ?? missionId);
   const title = String(mission.title ?? "(untitled)");
-  const objectives = Array.isArray(mission.objectives) ? mission.objectives.map(asRecord) : [];
+  const objectives = Array.isArray(mission.objectives) ? mission.objectives.map(asRecord2) : [];
   const attachmentLines = [];
   await Promise.all(
     objectives.map(async (objective, index) => {
@@ -14354,7 +14520,7 @@ async function loadMissionContext({
       if (typeof objectiveId !== "string" || objectiveId.length === 0) return;
       const attachments = await runtime.backend.get(`/api/objectives/${encodeURIComponent(objectiveId)}/attachments`).catch(() => []);
       for (const attachment of attachments) {
-        const record = asRecord(attachment);
+        const record = asRecord2(attachment);
         const filename = String(record.filename ?? "attachment");
         const contentType = record.contentType ? ` (${String(record.contentType)})` : "";
         attachmentLines.push(`- [objective ${index + 1}] ${filename}${contentType}`);
@@ -14381,11 +14547,11 @@ async function loadMissionContext({
       ""
     ] : [],
     "## Recent Activity",
-    ...events.filter((event) => !AGENT_HISTORY_EXCLUDED_EVENT_TYPES.has(String(asRecord(event).type))).slice(-20).map((event) => `- ${asRecord(event).summary ?? JSON.stringify(event)}`),
+    ...events.filter((event) => !AGENT_HISTORY_EXCLUDED_EVENT_TYPES.has(String(asRecord2(event).type))).slice(-20).map((event) => `- ${asRecord2(event).summary ?? JSON.stringify(event)}`),
     "",
     "## Artifacts",
     ...artifacts.map(
-      (artifact) => `- ${asRecord(artifact).label ?? asRecord(artifact).type ?? "artifact"}`
+      (artifact) => `- ${asRecord2(artifact).label ?? asRecord2(artifact).type ?? "artifact"}`
     ),
     "",
     "Use `ovld protocol attach --mission-id <id>` before making changes, update during work, and ALWAYS deliver last."
@@ -14407,7 +14573,7 @@ async function loadProjectResourcesForLaunch({
         }
       }
     });
-    const record = asRecord(context);
+    const record = asRecord2(context);
     return Array.isArray(record.projectResources) ? record.projectResources : null;
   } catch {
     return null;
@@ -14524,7 +14690,7 @@ Execution request: ${options.executionRequestId}` : context.launchContext;
         missionLink: { displayId: context.displayId, title: context.title }
       })
     );
-    chmodSync3(terminalScriptPath, 448);
+    chmodSync4(terminalScriptPath, 448);
   }
   const execution = resolveLaunchExecution({
     command: command.command,
@@ -15333,7 +15499,7 @@ var init_vcs_sessions = __esm({
 });
 
 // src/vcs.ts
-import { execFileSync as execFileSync5 } from "node:child_process";
+import { execFileSync as execFileSync6 } from "node:child_process";
 import { createHash as createHash6 } from "node:crypto";
 import {
   existsSync as existsSync20,
@@ -15369,7 +15535,7 @@ function hashWorktreeFile({
   filePath
 }) {
   try {
-    return execFileSync5("git", ["hash-object", filePath], {
+    return execFileSync6("git", ["hash-object", filePath], {
       cwd: workingDirectory,
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"]
@@ -15380,7 +15546,7 @@ function hashWorktreeFile({
 }
 function readChangedFiles(workingDirectory) {
   try {
-    const output = execFileSync5("git", ["status", "--porcelain"], {
+    const output = execFileSync6("git", ["status", "--porcelain"], {
       cwd: workingDirectory,
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"],
@@ -15521,7 +15687,7 @@ function normalizeAbsolute(filePath) {
 }
 function gitRepoRoot(workingDirectory) {
   try {
-    const root = execFileSync5("git", ["rev-parse", "--show-toplevel"], {
+    const root = execFileSync6("git", ["rev-parse", "--show-toplevel"], {
       cwd: workingDirectory,
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"]
@@ -16174,15 +16340,83 @@ var init_resource_observations = __esm({
   }
 });
 
+// src/runner-identity.ts
+import { randomUUID } from "node:crypto";
+import { existsSync as existsSync21, mkdirSync as mkdirSync10, readFileSync as readFileSync16, writeFileSync as writeFileSync9 } from "node:fs";
+import { hostname as hostname4 } from "node:os";
+import path25 from "node:path";
+function envValue(name) {
+  const value = process.env[name]?.trim();
+  return value && value.length > 0 ? value : null;
+}
+function runnerInstanceStatePath(dataDir = resolveGlobalDataDir()) {
+  return path25.join(dataDir, RUNNER_INSTANCE_STATE_FILENAME);
+}
+function resolveRunnerInstanceId(dataDir = resolveGlobalDataDir()) {
+  const pinned = envValue("OVERLORD_RUNNER_INSTANCE_ID");
+  if (pinned) return pinned;
+  const statePath = runnerInstanceStatePath(dataDir);
+  if (existsSync21(statePath)) {
+    try {
+      const parsed = JSON.parse(readFileSync16(statePath, "utf8"));
+      if (typeof parsed.runnerInstanceId === "string" && parsed.runnerInstanceId.trim()) {
+        return parsed.runnerInstanceId.trim();
+      }
+    } catch {
+    }
+  }
+  const runnerInstanceId = randomUUID();
+  try {
+    mkdirSync10(path25.dirname(statePath), { recursive: true });
+    writeFileSync9(statePath, `${JSON.stringify({ runnerInstanceId }, null, 2)}
+`, { mode: 384 });
+  } catch {
+  }
+  return runnerInstanceId;
+}
+function runnerRegistrationPayload(dataDir = resolveGlobalDataDir()) {
+  const executionTargetId = envValue("OVERLORD_EXECUTION_TARGET_ID");
+  const relationEnv = envValue("OVERLORD_RUNNER_RELATION");
+  if (relationEnv && relationEnv !== "native" && relationEnv !== "adopted") {
+    throw new CliError({
+      message: `OVERLORD_RUNNER_RELATION must be "native" or "adopted" (got "${relationEnv}").`
+    });
+  }
+  if (relationEnv === "adopted" && !executionTargetId) {
+    throw new CliError({
+      message: "OVERLORD_RUNNER_RELATION=adopted requires OVERLORD_EXECUTION_TARGET_ID naming the host execution target this runner adopts."
+    });
+  }
+  return {
+    ...executionTargetId ? { executionTargetId } : {},
+    runnerInstanceId: resolveRunnerInstanceId(dataDir),
+    // Left unset unless declared: the backend knows whether the named target is
+    // this machine's own and derives native/adopted from that.
+    ...relationEnv ? { runnerRelation: relationEnv } : {},
+    runnerLabel: envValue("OVERLORD_DEVICE_LABEL") ?? hostname4(),
+    runnerVersion: getCliVersion()
+  };
+}
+var RUNNER_INSTANCE_STATE_FILENAME;
+var init_runner_identity = __esm({
+  "src/runner-identity.ts"() {
+    "use strict";
+    init_config();
+    init_errors();
+    init_version();
+    RUNNER_INSTANCE_STATE_FILENAME = "runner-instance.json";
+  }
+});
+
 // src/runner-service.ts
 import { execFile } from "node:child_process";
-import { chmodSync as chmodSync4, existsSync as existsSync21, mkdirSync as mkdirSync10, readFileSync as readFileSync16, rmSync as rmSync5, writeFileSync as writeFileSync9 } from "node:fs";
+import { chmodSync as chmodSync5, existsSync as existsSync22, mkdirSync as mkdirSync11, readFileSync as readFileSync17, rmSync as rmSync5, writeFileSync as writeFileSync10 } from "node:fs";
 import os4 from "node:os";
-import path25 from "node:path";
+import path26 from "node:path";
 import { promisify } from "node:util";
 function writeServiceFile(filePath, contents) {
-  writeFileSync9(filePath, contents, { mode: 384 });
-  chmodSync4(filePath, 384);
+  writeFileSync10(filePath, contents, { mode: 384 });
+  chmodSync5(filePath, 384);
 }
 function emptyRunnerServiceState() {
   return {
@@ -16200,21 +16434,21 @@ function emptyRunnerServiceState() {
   };
 }
 function runnerServiceStatePath(dataDir = resolveGlobalDataDir()) {
-  return path25.join(dataDir, RUNNER_SERVICE_STATE_FILENAME);
+  return path26.join(dataDir, RUNNER_SERVICE_STATE_FILENAME);
 }
 function readRunnerServiceState(dataDir = resolveGlobalDataDir()) {
   const filePath = runnerServiceStatePath(dataDir);
-  if (!existsSync21(filePath)) return emptyRunnerServiceState();
+  if (!existsSync22(filePath)) return emptyRunnerServiceState();
   try {
-    const parsed = JSON.parse(readFileSync16(filePath, "utf8"));
+    const parsed = JSON.parse(readFileSync17(filePath, "utf8"));
     return { ...emptyRunnerServiceState(), ...parsed };
   } catch {
     return emptyRunnerServiceState();
   }
 }
 function writeRunnerServiceState(state, dataDir = resolveGlobalDataDir()) {
-  mkdirSync10(dataDir, { recursive: true });
-  writeFileSync9(runnerServiceStatePath(dataDir), `${JSON.stringify(state, null, 2)}
+  mkdirSync11(dataDir, { recursive: true });
+  writeFileSync10(runnerServiceStatePath(dataDir), `${JSON.stringify(state, null, 2)}
 `, "utf8");
 }
 function patchRunnerServiceState(patch, dataDir = resolveGlobalDataDir()) {
@@ -16223,13 +16457,13 @@ function patchRunnerServiceState(patch, dataDir = resolveGlobalDataDir()) {
   return next;
 }
 function runnerFocusStatePath(dataDir = resolveGlobalDataDir()) {
-  return path25.join(dataDir, RUNNER_FOCUS_STATE_FILENAME);
+  return path26.join(dataDir, RUNNER_FOCUS_STATE_FILENAME);
 }
 function readDesktopFocusState(dataDir = resolveGlobalDataDir()) {
   const filePath = runnerFocusStatePath(dataDir);
-  if (!existsSync21(filePath)) return { lastFocusedAt: null };
+  if (!existsSync22(filePath)) return { lastFocusedAt: null };
   try {
-    const parsed = JSON.parse(readFileSync16(filePath, "utf8"));
+    const parsed = JSON.parse(readFileSync17(filePath, "utf8"));
     return { lastFocusedAt: parsed.lastFocusedAt ?? null };
   } catch {
     return { lastFocusedAt: null };
@@ -16260,16 +16494,16 @@ function nextRunnerLastError(pollError) {
 function resolveOverlordAppInvocation({
   platform: platform2 = process.platform,
   homedir: homedir2 = os4.homedir(),
-  exists = existsSync21
+  exists = existsSync22
 } = {}) {
   if (platform2 !== "darwin") return null;
   const appDirs = [
     "/Applications/Overlord.app",
-    path25.join(homedir2, "Applications", "Overlord.app")
+    path26.join(homedir2, "Applications", "Overlord.app")
   ];
   for (const appDir of appDirs) {
-    const program = path25.join(appDir, "Contents", "MacOS", "Overlord");
-    const script = path25.join(appDir, "Contents", "Resources", "cli", "bin", "ovld.mjs");
+    const program = path26.join(appDir, "Contents", "MacOS", "Overlord");
+    const script = path26.join(appDir, "Contents", "Resources", "cli", "bin", "ovld.mjs");
     if (exists(program) && exists(script)) {
       return { program, args: [script, "runner", "supervise"], runAsElectronNode: true };
     }
@@ -16281,7 +16515,7 @@ function resolveOvldInvocation(argv = process.argv, execPath = process.execPath)
   if (override) {
     return { program: override, args: ["runner", "supervise"] };
   }
-  const scriptPath = argv[1] ? path25.resolve(argv[1]) : "";
+  const scriptPath = argv[1] ? path26.resolve(argv[1]) : "";
   if (process.env.ELECTRON_RUN_AS_NODE) {
     return scriptPath ? { program: execPath, args: [scriptPath, "runner", "supervise"], runAsElectronNode: true } : { program: execPath, args: ["runner", "supervise"], runAsElectronNode: true };
   }
@@ -16314,7 +16548,7 @@ function buildRunnerServiceEnv({
     PATH: process.env.PATH?.trim() || "/usr/local/bin:/usr/bin:/bin"
   };
   const home = overlordHome?.trim() || process.env.OVLD_HOME?.trim();
-  if (home) env.OVLD_HOME = path25.resolve(home);
+  if (home) env.OVLD_HOME = path26.resolve(home);
   const token = process.env.OVERLORD_USER_TOKEN?.trim() || process.env.OVLD_USER_TOKEN?.trim();
   if (token) env.OVERLORD_USER_TOKEN = token;
   if (runAsElectronNode || process.env.ELECTRON_RUN_AS_NODE) env.ELECTRON_RUN_AS_NODE = "1";
@@ -16353,9 +16587,9 @@ ${envEntries}
   <key>KeepAlive</key>
   <true/>
   <key>StandardOutPath</key>
-  <string>${xmlEscape(path25.join(logDir, "runner-service.out.log"))}</string>
+  <string>${xmlEscape(path26.join(logDir, "runner-service.out.log"))}</string>
   <key>StandardErrorPath</key>
-  <string>${xmlEscape(path25.join(logDir, "runner-service.err.log"))}</string>
+  <string>${xmlEscape(path26.join(logDir, "runner-service.err.log"))}</string>
   <key>ProcessType</key>
   <string>Background</string>
 </dict>
@@ -16386,12 +16620,12 @@ WantedBy=default.target
 `;
 }
 function launchAgentsDir() {
-  return path25.join(os4.homedir(), "Library", "LaunchAgents");
+  return path26.join(os4.homedir(), "Library", "LaunchAgents");
 }
 function systemdUserDir() {
   const xdg = process.env.XDG_CONFIG_HOME?.trim();
-  const base = xdg ? path25.resolve(xdg) : path25.join(os4.homedir(), ".config");
-  return path25.join(base, "systemd", "user");
+  const base = xdg ? path26.resolve(xdg) : path26.join(os4.homedir(), ".config");
+  return path26.join(base, "systemd", "user");
 }
 async function runCommand(program, args) {
   const { stdout } = await execFileAsync(program, args);
@@ -16420,19 +16654,19 @@ var init_runner_service = __esm({
       kind = "launchd";
       identifier = LAUNCHD_LABEL;
       unitPath() {
-        return path25.join(launchAgentsDir(), `${LAUNCHD_LABEL}.plist`);
+        return path26.join(launchAgentsDir(), `${LAUNCHD_LABEL}.plist`);
       }
       render(opts) {
         return renderLaunchdPlist({
           label: LAUNCHD_LABEL,
           invocation: opts.invocation,
           env: opts.env,
-          logDir: path25.join(resolveGlobalDataDir(), "logs")
+          logDir: path26.join(resolveGlobalDataDir(), "logs")
         });
       }
       async install(opts) {
-        mkdirSync10(launchAgentsDir(), { recursive: true });
-        mkdirSync10(path25.join(resolveGlobalDataDir(), "logs"), { recursive: true });
+        mkdirSync11(launchAgentsDir(), { recursive: true });
+        mkdirSync11(path26.join(resolveGlobalDataDir(), "logs"), { recursive: true });
         writeServiceFile(this.unitPath(), this.render(opts));
         if (opts.autoStart) await this.start();
       }
@@ -16462,10 +16696,10 @@ var init_runner_service = __esm({
           await this.stop();
         } catch {
         }
-        if (existsSync21(this.unitPath())) rmSync5(this.unitPath());
+        if (existsSync22(this.unitPath())) rmSync5(this.unitPath());
       }
       async status() {
-        const installed = existsSync21(this.unitPath());
+        const installed = existsSync22(this.unitPath());
         try {
           const { stdout } = await runCommand("launchctl", ["list"]);
           const line = stdout.split("\n").find((row) => row.includes(LAUNCHD_LABEL));
@@ -16481,13 +16715,13 @@ var init_runner_service = __esm({
       kind = "systemd";
       identifier = `${SYSTEMD_UNIT_NAME}.service`;
       unitPath() {
-        return path25.join(systemdUserDir(), `${SYSTEMD_UNIT_NAME}.service`);
+        return path26.join(systemdUserDir(), `${SYSTEMD_UNIT_NAME}.service`);
       }
       render(opts) {
         return renderSystemdUnit(opts);
       }
       async install(opts) {
-        mkdirSync10(systemdUserDir(), { recursive: true });
+        mkdirSync11(systemdUserDir(), { recursive: true });
         writeServiceFile(this.unitPath(), this.render(opts));
         await runCommand("systemctl", ["--user", "daemon-reload"]);
         await runCommand("systemctl", ["--user", "enable", this.identifier]);
@@ -16508,14 +16742,14 @@ var init_runner_service = __esm({
           await runCommand("systemctl", ["--user", "disable", this.identifier]);
         } catch {
         }
-        if (existsSync21(this.unitPath())) rmSync5(this.unitPath());
+        if (existsSync22(this.unitPath())) rmSync5(this.unitPath());
         try {
           await runCommand("systemctl", ["--user", "daemon-reload"]);
         } catch {
         }
       }
       async status() {
-        const installed = existsSync21(this.unitPath());
+        const installed = existsSync22(this.unitPath());
         try {
           const { stdout } = await runCommand("systemctl", ["--user", "is-active", this.identifier]);
           return { installed, running: stdout.trim() === "active" ? "running" : "stopped" };
@@ -16582,14 +16816,14 @@ var init_select_prompt = __esm({
 
 // src/session-key.ts
 import { createHash as createHash7 } from "node:crypto";
-import { existsSync as existsSync22, mkdirSync as mkdirSync11, readFileSync as readFileSync17, rmSync as rmSync6, writeFileSync as writeFileSync10 } from "node:fs";
-import path26 from "node:path";
+import { existsSync as existsSync23, mkdirSync as mkdirSync12, readFileSync as readFileSync18, rmSync as rmSync6, writeFileSync as writeFileSync11 } from "node:fs";
+import path27 from "node:path";
 function sessionKeyCachePath({
   missionId,
   workingDirectory
 }) {
-  const key = createHash7("sha256").update(`${path26.resolve(workingDirectory)}\0${missionId}`).digest("hex");
-  return path26.join(resolveGlobalDataDir(), "protocol-session-keys", key);
+  const key = createHash7("sha256").update(`${path27.resolve(workingDirectory)}\0${missionId}`).digest("hex");
+  return path27.join(resolveGlobalDataDir(), "protocol-session-keys", key);
 }
 function readCachedSessionKey({
   missionId,
@@ -16597,8 +16831,8 @@ function readCachedSessionKey({
 }) {
   try {
     const filePath = sessionKeyCachePath({ missionId, workingDirectory });
-    if (!existsSync22(filePath)) return void 0;
-    const raw = JSON.parse(readFileSync17(filePath, "utf8"));
+    if (!existsSync23(filePath)) return void 0;
+    const raw = JSON.parse(readFileSync18(filePath, "utf8"));
     return typeof raw.sessionKey === "string" && raw.sessionKey.trim() ? raw.sessionKey.trim() : void 0;
   } catch {
     return void 0;
@@ -16613,8 +16847,8 @@ function writeCachedSessionKey({
     const trimmed = sessionKey.trim();
     if (!trimmed) return;
     const filePath = sessionKeyCachePath({ missionId, workingDirectory });
-    mkdirSync11(path26.dirname(filePath), { recursive: true });
-    writeFileSync10(
+    mkdirSync12(path27.dirname(filePath), { recursive: true });
+    writeFileSync11(
       filePath,
       JSON.stringify({ sessionKey: trimmed, updatedAt: (/* @__PURE__ */ new Date()).toISOString() }),
       { mode: 384 }
@@ -16628,7 +16862,7 @@ function clearCachedSessionKey({
 }) {
   try {
     const filePath = sessionKeyCachePath({ missionId, workingDirectory });
-    if (existsSync22(filePath)) rmSync6(filePath);
+    if (existsSync23(filePath)) rmSync6(filePath);
   } catch {
   }
 }
@@ -16646,9 +16880,9 @@ __export(commands_exports, {
   runManagementCommand: () => runManagementCommand,
   runProtocolCommand: () => runProtocolCommand
 });
-import { existsSync as existsSync23, readFileSync as readFileSync18 } from "node:fs";
+import { existsSync as existsSync24, readFileSync as readFileSync19 } from "node:fs";
 import os5 from "node:os";
-import path27 from "node:path";
+import path28 from "node:path";
 function resourceAccessModeBody(value) {
   if (typeof value !== "string") return {};
   const normalized = value.trim().toLowerCase();
@@ -16665,7 +16899,7 @@ function writeProjectJsonFromResource({
   projectId,
   resource
 }) {
-  const record = asRecord2(resource);
+  const record = asRecord3(resource);
   if (typeof record.id !== "string") return;
   if (record.accessMode === "read") return;
   writeProjectJson({
@@ -16694,7 +16928,7 @@ function readChangedFilesFromFlags(flags, stdin) {
   if (typeof fileFlag === "string") {
     const raw = fileFlag === "-" ? stdin ?? "" : (() => {
       try {
-        return readFileSync18(fileFlag, "utf8");
+        return readFileSync19(fileFlag, "utf8");
       } catch {
         return "";
       }
@@ -16746,7 +16980,7 @@ function readJsonFlagContent({
   if (typeof filePath === "string") {
     if (fileInputs[fileFlag] !== void 0) return fileInputs[fileFlag];
     try {
-      return readFileSync18(filePath, "utf8");
+      return readFileSync19(filePath, "utf8");
     } catch {
       return void 0;
     }
@@ -16969,7 +17203,7 @@ async function resolveTerminalLaunchSettings({
     return { terminalLauncher: null };
   }
 }
-function asRecord2(value) {
+function asRecord3(value) {
   return value && typeof value === "object" ? value : {};
 }
 function parsePreLaunchCommandsValue(value) {
@@ -17004,32 +17238,32 @@ async function recordBranchPrepared({
   });
 }
 function firstObjectiveId(mission) {
-  const objectives = asRecord2(mission).objectives;
+  const objectives = asRecord3(mission).objectives;
   if (!Array.isArray(objectives)) return void 0;
   const first = objectives[0];
-  const id = asRecord2(first).id;
+  const id = asRecord3(first).id;
   return typeof id === "string" ? id : void 0;
 }
 function launchableObjectiveId(mission) {
-  const objectives = asRecord2(mission).objectives;
+  const objectives = asRecord3(mission).objectives;
   if (!Array.isArray(objectives)) return void 0;
   const launchableStates = ["executing", "submitted", "launching", "draft"];
   for (const state of launchableStates) {
-    const match = objectives.find((objective) => asRecord2(objective).state === state);
-    const id = asRecord2(match).id;
+    const match = objectives.find((objective) => asRecord3(objective).state === state);
+    const id = asRecord3(match).id;
     if (typeof id === "string") return id;
   }
   return firstObjectiveId(mission);
 }
 function objectiveAssignedAgent(mission, objectiveId) {
-  const objectives = asRecord2(mission).objectives;
+  const objectives = asRecord3(mission).objectives;
   if (!Array.isArray(objectives)) return void 0;
-  const match = objectives.find((objective) => asRecord2(objective).id === objectiveId);
-  const agent = asRecord2(match).assignedAgent;
+  const match = objectives.find((objective) => asRecord3(objective).id === objectiveId);
+  const agent = asRecord3(match).assignedAgent;
   return typeof agent === "string" && agent.trim() ? agent.trim() : void 0;
 }
 function missionDisplayId(mission) {
-  const record = asRecord2(mission);
+  const record = asRecord3(mission);
   return typeof record.displayId === "string" ? record.displayId : typeof record.id === "string" ? record.id : "unknown";
 }
 async function resolveProtocolFileInputs({
@@ -17050,7 +17284,7 @@ async function resolveProtocolFileInputs({
     } else if (process.stdin.isTTY) {
       stdinContent = "";
     } else {
-      stdinContent = readFileSync18(0, "utf8");
+      stdinContent = readFileSync19(0, "utf8");
     }
     return stdinContent;
   };
@@ -17064,7 +17298,7 @@ async function resolveProtocolFileInputs({
       fileInputs[flagName] = content;
       stdinPayload = content;
     } else {
-      fileInputs[flagName] = readFileSync18(filePath, "utf8");
+      fileInputs[flagName] = readFileSync19(filePath, "utf8");
     }
   }
   if (stdinPayload === void 0 && stdin !== void 0 && Object.keys(fileInputs).length === 0) {
@@ -17076,7 +17310,7 @@ async function discoverProjectId(runtime, explicit) {
   if (explicit) return explicit;
   const projects = await listAccessibleProjects({ backend: runtime.backend });
   const first = projects[0];
-  const id = asRecord2(first).id;
+  const id = asRecord3(first).id;
   if (typeof id !== "string") {
     throw new CliError({ message: "No project found. Create one with `ovld create-project`." });
   }
@@ -17107,7 +17341,7 @@ async function runProtocolCommand({
   });
   if (subcommand === "record-touched") {
     const missionOverride = flagValue(parsed.flags, "--mission-id") ?? process.env.MISSION_ID ?? process.env.OVERLORD_MISSION_ID;
-    const rawPayload = stdin ?? (process.stdin.isTTY ? "" : readFileSync18(0, "utf8"));
+    const rawPayload = stdin ?? (process.stdin.isTTY ? "" : readFileSync19(0, "utf8"));
     const result2 = recordTouchedFromPayload({
       rawPayload,
       missionOverride,
@@ -17218,7 +17452,7 @@ async function runProtocolCommand({
     resetTouchedFiles({ workingDirectory, missionId });
     resetRationaleNotes({ workingDirectory, missionId });
   }
-  const resultRecord = asRecord2(result);
+  const resultRecord = asRecord3(result);
   if (typeof resultRecord.sessionKey === "string") {
     printKeyValue({ SESSION_KEY: resultRecord.sessionKey });
     if (missionId) {
@@ -17233,7 +17467,7 @@ async function runProtocolCommand({
     }
   }
   if (subcommand === "attach" || subcommand === "connect" || subcommand === "resume-follow-up") {
-    const missionRecord = asRecord2(resultRecord.mission);
+    const missionRecord = asRecord3(resultRecord.mission);
     const displayId = typeof missionRecord.displayId === "string" && missionRecord.displayId.trim() || typeof missionId === "string" && missionId.trim() || typeof resultRecord.missionId === "string" && resultRecord.missionId.trim() || "";
     const title = typeof missionRecord.title === "string" ? missionRecord.title : void 0;
     const pointerMissionId = typeof missionRecord.id === "string" && missionRecord.id.trim() || typeof resultRecord.missionId === "string" && resultRecord.missionId.trim() || displayId;
@@ -17253,8 +17487,8 @@ async function runProtocolCommand({
     clearCachedSessionKey({ missionId, workingDirectory });
     removeActiveSession({ workingDirectory, missionId });
     clearActiveMissionPointer(workingDirectory);
-    const connectorInstallsEditHook = existsSync23(path27.join(os5.homedir(), ".claude")) || existsSync23(
-      path27.join(
+    const connectorInstallsEditHook = existsSync24(path28.join(os5.homedir(), ".claude")) || existsSync24(
+      path28.join(
         os5.homedir(),
         ".cursor",
         "plugins",
@@ -17303,7 +17537,7 @@ async function runProtocolCommand({
   if (subcommand === "attachment-list" && Array.isArray(result)) {
     const baseUrl = runtime.backend.baseUrl;
     const enhanced = result.map((entry) => {
-      const rec = asRecord2(entry);
+      const rec = asRecord3(entry);
       const relUrl = rec.url;
       return typeof relUrl === "string" && relUrl.startsWith("/") ? { ...rec, url: `${baseUrl}${relUrl}` } : rec;
     });
@@ -17328,7 +17562,7 @@ async function runManagementCommand({
         path: "/api/projects",
         body: { name }
       });
-      const projectId = asRecord2(project).id;
+      const projectId = asRecord3(project).id;
       if (!flagBoolean(parsed.flags, "--no-directory") && typeof projectId === "string") {
         const directory = flagValue(parsed.flags, "--directory") ?? process.cwd();
         const resource = await runtime.backend.post({
@@ -17343,7 +17577,7 @@ async function runManagementCommand({
       if (json) printJson({ project });
       else
         console.log(
-          `Created project ${asRecord2(project).name ?? name} (${projectId ?? "unknown"})`
+          `Created project ${asRecord3(project).name ?? name} (${projectId ?? "unknown"})`
         );
       return;
     }
@@ -17354,7 +17588,7 @@ async function runManagementCommand({
     case "add-cwd": {
       const directory = flagValue(parsed.flags, "--directory") ?? process.cwd();
       const existingProjectJson = readProjectJsonLink(
-        path27.join(directory, ".overlord", "project.json")
+        path28.join(directory, ".overlord", "project.json")
       );
       const resourceKey = flagValue(parsed.flags, "--key") ?? existingProjectJson?.resourceKey;
       let projectId = flagValue(parsed.flags, "--project-id");
@@ -17420,7 +17654,7 @@ async function runManagementCommand({
         path: "/api/protocol/register-target",
         body: { args: rest, positional: parsed.positional, flags: protocolFlags, fileInputs: {} }
       });
-      const record = asRecord2(result);
+      const record = asRecord3(result);
       if (record.status === "workspace_selection_required") {
         if (json) {
           printJson({ result });
@@ -17430,7 +17664,7 @@ async function runManagementCommand({
             "You belong to more than one workspace. Re-run with --workspace-id set to one of:"
           );
           for (const entry of workspaces) {
-            const ws = asRecord2(entry);
+            const ws = asRecord3(entry);
             console.log(`  - ${ws.name ?? ws.id} (${ws.slug ?? ws.id})`);
           }
         }
@@ -17439,8 +17673,8 @@ async function runManagementCommand({
       if (json) {
         printJson({ result });
       } else {
-        const target = asRecord2(record.executionTarget);
-        const ws = asRecord2(record.workspace);
+        const target = asRecord3(record.executionTarget);
+        const ws = asRecord3(record.workspace);
         console.log(
           `Registered execution target ${target.label ?? name ?? ""} (${target.executionTargetId ?? "unknown"}) in workspace ${ws.name ?? ws.id ?? ""}`
         );
@@ -17475,7 +17709,7 @@ async function runManagementCommand({
         }
       });
       if (objectivesJson) {
-        const missionObjectives = asRecord2(mission).objectives;
+        const missionObjectives = asRecord3(mission).objectives;
         if (Array.isArray(missionObjectives) && missionObjectives.length !== objectives.length) {
           throw new CliError({
             message: `Backend created ${missionObjectives.length} objective(s), expected ${objectives.length}`
@@ -17543,10 +17777,10 @@ async function runManagementCommand({
       const executionTargetId = await resolvePreferredExecutionTargetId({
         backend: scopedRuntime.backend
       });
-      const missionProjectId = asRecord2(mission).projectId;
+      const missionProjectId = asRecord3(mission).projectId;
       const projectLaunchSettings = typeof missionProjectId === "string" ? await scopedRuntime.backend.get(`/api/projects/${encodeURIComponent(missionProjectId)}`).then((project) => ({
-        preLaunchCommands: parsePreLaunchCommandsValue(asRecord2(project).preLaunchCommands),
-        launchEnvVars: parseLaunchEnvVarsValue(asRecord2(project).launchEnvVars)
+        preLaunchCommands: parsePreLaunchCommandsValue(asRecord3(project).preLaunchCommands),
+        launchEnvVars: parseLaunchEnvVarsValue(asRecord3(project).launchEnvVars)
       })).catch(() => ({
         preLaunchCommands: [],
         launchEnvVars: {}
@@ -17621,7 +17855,7 @@ async function runManagementCommand({
       if (json) printJson({ missions });
       else {
         for (const mission of missions) {
-          const record = asRecord2(mission);
+          const record = asRecord3(mission);
           console.log(
             `${record.displayId ?? record.id}	${record.statusType ?? ""}	${record.title ?? ""}`
           );
@@ -17644,13 +17878,13 @@ async function runManagementCommand({
         rationales: `/api/missions/${encodeURIComponent(missionId)}/file-changes`,
         deliveries: `/api/missions/${encodeURIComponent(missionId)}/deliveries`
       };
-      const path28 = sub ? pathBySub[sub] : void 0;
-      if (!path28) {
+      const path29 = sub ? pathBySub[sub] : void 0;
+      if (!path29) {
         throw new CliError({
           message: "Usage: ovld mission context|events|deliveries|artifacts|rationales <missionId> [--json]"
         });
       }
-      const result = await runtime.backend.get(path28);
+      const result = await runtime.backend.get(path29);
       if (json || sub === "context") printJson(result);
       else if (Array.isArray(result)) for (const row of result) console.log(JSON.stringify(row));
       else printJson(result);
@@ -17673,6 +17907,10 @@ async function runManagementCommand({
       throw new CliError({ message: `Unknown command: ${command}` });
   }
 }
+function isNoExecutionTargetRegisteredError(error) {
+  const message = error instanceof Error ? error.message : String(error);
+  return message.includes("(no_execution_target_registered)");
+}
 async function runRunnerCommand({
   runtime,
   parsed,
@@ -17694,7 +17932,7 @@ async function runRunnerCommand({
       }
     });
     if (json) printJson(result);
-    else console.log(`Cleared ${asRecord2(result).cleared ?? 0} execution request(s).`);
+    else console.log(`Cleared ${asRecord3(result).cleared ?? 0} execution request(s).`);
     return;
   }
   if (sub === "service") {
@@ -17707,17 +17945,32 @@ async function runRunnerCommand({
     });
   }
   const runOnce = async () => {
-    const claim = await runtime.backend.post({
-      path: "/api/runner/claim",
-      body: {
-        projectId: flagValue(parsed.flags, "--project-id"),
-        ...clientDeviceIdentity()
+    let claim;
+    try {
+      claim = await runtime.backend.post({
+        path: "/api/runner/claim",
+        body: {
+          projectId: flagValue(parsed.flags, "--project-id"),
+          ...clientDeviceIdentity(),
+          // Contract v40: the claim poll doubles as this runner instance's
+          // heartbeat, so local target liveness reflects a runner that can
+          // actually take work rather than any CLI traffic from the machine.
+          ...runnerRegistrationPayload()
+        }
+      });
+    } catch (error) {
+      if (isNoExecutionTargetRegisteredError(error)) {
+        throw new CliError({
+          message: `${error instanceof Error ? error.message : String(error)}
+The runner will not register a target for you \u2014 declare this machine first, then start it again.`
+        });
       }
-    });
-    const request = asRecord2(claim).request;
-    const longPoll = asRecord2(claim).longPoll === true;
+      throw error;
+    }
+    const request = asRecord3(claim).request;
+    const longPoll = asRecord3(claim).longPoll === true;
     if (!request) return { launched: false, longPoll };
-    const requestRecord = asRecord2(request);
+    const requestRecord = asRecord3(request);
     const requestId = String(requestRecord.id);
     const projectId = String(requestRecord.projectId ?? "");
     const executionTargetId = typeof requestRecord.executionTargetId === "string" ? requestRecord.executionTargetId.trim() : "";
@@ -17757,7 +18010,7 @@ async function runRunnerCommand({
           message: `Execution request ${requestId} has no agent; the objective must specify one before it can be launched.`
         });
       }
-      const launchConfig = asRecord2(requestRecord.launchConfig);
+      const launchConfig = asRecord3(requestRecord.launchConfig);
       const terminal = await resolveTerminalLaunchSettings({ runtime, flags: parsed.flags });
       const missionId = String(requestRecord.missionId);
       const dryRun = flagBoolean(parsed.flags, "--dry-run");
@@ -17848,6 +18101,7 @@ async function runRunnerSupervisor({
     try {
       result = await runOnce();
     } catch (error) {
+      if (isNoExecutionTargetRegisteredError(error)) throw error;
       lastError = error instanceof Error ? error.message : String(error);
     }
     const state = readRunnerServiceState();
@@ -17998,6 +18252,7 @@ var init_commands = __esm({
     init_protocol_help();
     init_record_touched();
     init_resource_observations();
+    init_runner_identity();
     init_runner_service();
     init_select_prompt();
     init_session_key();