pitroom 0.17.0 → 0.19.0

package/dist/pitroom.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/cli.ts
-import fs35 from "node:fs";
+import fs36 from "node:fs";
 
 // src/core/errors.ts
 var UserError = class extends Error {
@@ -555,16 +555,33 @@ var codex = {
 
 // src/backends/gemini/index.ts
 import { spawnSync as spawnSync3 } from "node:child_process";
-import fs5 from "node:fs";
+import fs6 from "node:fs";
 import os5 from "node:os";
 import path5 from "node:path";
 import { fileURLToPath } from "node:url";
 
 // src/core/store.ts
-import fs4 from "node:fs";
+import fs5 from "node:fs";
 import os4 from "node:os";
 import path4 from "node:path";
 import crypto from "node:crypto";
+
+// src/core/fs-atomic.ts
+import fs4 from "node:fs";
+var BUSY = /* @__PURE__ */ new Set(["EPERM", "EBUSY", "EACCES"]);
+function renameOver(tmp, file2) {
+  for (let attempt3 = 0; ; attempt3++) {
+    try {
+      fs4.renameSync(tmp, file2);
+      return;
+    } catch (e) {
+      if (process.platform !== "win32" || !BUSY.has(e.code ?? "") || attempt3 >= 40) throw e;
+      Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 25);
+    }
+  }
+}
+
+// src/core/store.ts
 var TERMINAL = ["done", "failed", "timeout", "stopped"];
 var isActive = (s) => !TERMINAL.includes(s);
 function home() {
@@ -591,11 +608,11 @@ function useArchive(hooks) {
   archive = { meta: hooks.meta, id: hooks.id };
 }
 function writeMeta(meta) {
-  fs4.mkdirSync(runDir(meta.id), { recursive: true });
+  fs5.mkdirSync(runDir(meta.id), { recursive: true });
   const file2 = runFile(meta.id, "meta.json");
   const tmp = `${file2}.${process.pid}.tmp`;
-  fs4.writeFileSync(tmp, JSON.stringify(meta, null, 2));
-  fs4.renameSync(tmp, file2);
+  fs5.writeFileSync(tmp, JSON.stringify(meta, null, 2));
+  renameOver(tmp, file2);
   if (TERMINAL.includes(meta.state)) {
     try {
       onFinished?.(meta);
@@ -605,11 +622,11 @@ function writeMeta(meta) {
 }
 function readMeta(id) {
   const file2 = runFile(id, "meta.json");
-  if (!fs4.existsSync(file2)) {
+  if (!fs5.existsSync(file2)) {
     const kept = archive?.meta(id);
     if (kept) return upgrade(kept);
   }
-  return upgrade(JSON.parse(fs4.readFileSync(file2, "utf8")));
+  return upgrade(JSON.parse(fs5.readFileSync(file2, "utf8")));
 }
 function upgrade(raw) {
   if (!raw.worker) raw.worker = raw.model ? { backend: "opencode", model: raw.model } : { backend: "opencode" };
@@ -622,8 +639,8 @@ function upgrade(raw) {
   return raw;
 }
 function listRunIds() {
-  if (!fs4.existsSync(runsDir())) return [];
-  return fs4.readdirSync(runsDir()).filter((d) => fs4.existsSync(runFile(d, "meta.json"))).sort();
+  if (!fs5.existsSync(runsDir())) return [];
+  return fs5.readdirSync(runsDir()).filter((d) => fs5.existsSync(runFile(d, "meta.json"))).sort();
 }
 function resolveRun(ref) {
   const ids = listRunIds();
@@ -649,13 +666,16 @@ function isAlive(pid) {
     return e.code === "EPERM";
   }
 }
+var STOP_FILE = "stop-requested";
+var requestStop = (id) => fs5.writeFileSync(runFile(id, STOP_FILE), "");
 function freshMeta(id) {
   const meta = readMeta(id);
   if (!TERMINAL.includes(meta.state) && meta.pid && !isAlive(meta.pid)) {
     const latest = readMeta(id);
     if (TERMINAL.includes(latest.state)) return latest;
-    latest.state = latest.stopRequested ? "stopped" : "failed";
-    if (!latest.stopRequested) latest.error ??= "worker process exited unexpectedly";
+    const stopped = latest.stopRequested || fs5.existsSync(runFile(id, STOP_FILE));
+    latest.state = stopped ? "stopped" : "failed";
+    if (!stopped) latest.error ??= "worker process exited unexpectedly";
     latest.endedAt ??= (/* @__PURE__ */ new Date()).toISOString();
     writeMeta(latest);
     return latest;
@@ -787,22 +807,22 @@ var policyDir = () => path5.resolve(path5.dirname(fileURLToPath(import.meta.url)
 function workerHome() {
   const root = path5.join(home(), "gemini-home");
   const dir = path5.join(root, ".gemini");
-  const base2 = JSON.parse(fs5.readFileSync(path5.join(policyDir(), "worker-settings.json"), "utf8"));
+  const base2 = JSON.parse(fs6.readFileSync(path5.join(policyDir(), "worker-settings.json"), "utf8"));
   const auth = settings().security?.auth;
   const body = `${JSON.stringify(auth ? { ...base2, security: { ...base2.security, auth } } : base2, null, 2)}
 `;
   const file2 = path5.join(dir, "settings.json");
   try {
-    if (fs5.readFileSync(file2, "utf8") === body) return root;
+    if (fs6.readFileSync(file2, "utf8") === body) return root;
   } catch {
   }
-  fs5.mkdirSync(dir, { recursive: true });
-  fs5.writeFileSync(file2, body);
+  fs6.mkdirSync(dir, { recursive: true });
+  fs6.writeFileSync(file2, body);
   for (const name of ["oauth_creds.json", "google_accounts.json"]) {
     const from = path5.join(geminiHome(), name);
     const to = path5.join(dir, name);
     try {
-      if (fs5.existsSync(from) && !fs5.existsSync(to)) fs5.symlinkSync(from, to);
+      if (fs6.existsSync(from) && !fs6.existsSync(to)) fs6.symlinkSync(from, to);
     } catch {
     }
   }
@@ -829,7 +849,7 @@ function invocation3(req) {
   const { command, prefix } = resolveCommand(binary3());
   const env = { GEMINI_CLI_HOME: workerHome() };
   const trusted = path5.join(geminiHome(), "trustedFolders.json");
-  if (fs5.existsSync(trusted)) env.GEMINI_CLI_TRUSTED_FOLDERS_PATH = trusted;
+  if (fs6.existsSync(trusted)) env.GEMINI_CLI_TRUSTED_FOLDERS_PATH = trusted;
   return { command, args: [...prefix, ...args], env };
 }
 function classify3(message) {
@@ -854,7 +874,7 @@ function geminiHome() {
 }
 function settings() {
   try {
-    return JSON.parse(fs5.readFileSync(path5.join(geminiHome(), "settings.json"), "utf8"));
+    return JSON.parse(fs6.readFileSync(path5.join(geminiHome(), "settings.json"), "utf8"));
   } catch {
     return {};
   }
@@ -873,7 +893,7 @@ function doctor3({ models, hasFallback }) {
   const checks = [{ level: "ok", message: `Gemini CLI ${version.out.trim()} at ${binary3()}` }];
   const key = process.env.GEMINI_API_KEY || process.env.GOOGLE_API_KEY;
   const vertex = process.env.GOOGLE_GENAI_USE_VERTEXAI === "true" || process.env.GOOGLE_GENAI_USE_VERTEXAI === "1";
-  const signedIn = fs5.existsSync(path5.join(geminiHome(), "oauth_creds.json"));
+  const signedIn = fs6.existsSync(path5.join(geminiHome(), "oauth_creds.json"));
   const type = settings().security?.auth?.selectedType;
   if (key || vertex) {
     checks.push({ level: "ok", message: `Gemini CLI: ${key ? "an API key is set" : "Vertex AI is set up"}` });
@@ -1032,7 +1052,7 @@ function describe2(input) {
 }
 
 // src/backends/opencode/profiles.ts
-import fs6 from "node:fs";
+import fs7 from "node:fs";
 import os6 from "node:os";
 import path6 from "node:path";
 var AGENT = { read: "pitroom-read", write: "pitroom-write" };
@@ -1143,7 +1163,7 @@ function scratchDirs() {
 }
 function realpath(p) {
   try {
-    return fs6.realpathSync(p);
+    return fs7.realpathSync(p);
   } catch {
     return p;
   }
@@ -1401,10 +1421,10 @@ function getBackend(id) {
 }
 
 // src/cli/args.ts
-import fs8 from "node:fs";
+import fs9 from "node:fs";
 
 // src/core/config.ts
-import fs7 from "node:fs";
+import fs8 from "node:fs";
 import os7 from "node:os";
 import path7 from "node:path";
 var SCHEMA = {
@@ -1434,10 +1454,10 @@ function loadConfig() {
   const file2 = configPath();
   const config = {};
   const warnings = [];
-  if (fs7.existsSync(file2)) {
+  if (fs8.existsSync(file2)) {
     let raw;
     try {
-      raw = JSON.parse(fs7.readFileSync(file2, "utf8"));
+      raw = JSON.parse(fs8.readFileSync(file2, "utf8"));
     } catch (e) {
       warnings.push(`${file2}: invalid JSON (${e.message}); ignored`);
     }
@@ -1644,9 +1664,9 @@ function exitCodeFor(meta) {
 }
 function readTask(p) {
   const file2 = flag(p, "task-file");
-  if (file2) return fs8.readFileSync(file2, "utf8");
+  if (file2) return fs9.readFileSync(file2, "utf8");
   const words = p.positional;
-  if (words.length === 1 && words[0] === "-") return fs8.readFileSync(0, "utf8");
+  if (words.length === 1 && words[0] === "-") return fs9.readFileSync(0, "utf8");
   return words.join(" ");
 }
 function runOptions(p, task) {
@@ -1695,13 +1715,13 @@ import readline from "node:readline";
 
 // src/core/run.ts
 import { spawn as spawn2, spawnSync as spawnSync6 } from "node:child_process";
-import fs24 from "node:fs";
+import fs25 from "node:fs";
 import path20 from "node:path";
 
 // src/vcs/git.ts
 import { spawnSync as spawnSync5 } from "node:child_process";
 import crypto2 from "node:crypto";
-import fs9 from "node:fs";
+import fs10 from "node:fs";
 import os8 from "node:os";
 import path8 from "node:path";
 var SAFE = [
@@ -1733,16 +1753,23 @@ function must(cwd, args, env) {
 function gitAvailable() {
   return git(process.cwd(), ["--version"]).code === 0;
 }
+function canonical(dir) {
+  try {
+    return fs10.realpathSync.native(dir);
+  } catch {
+    return dir;
+  }
+}
 function repoRoot(dir) {
   const r = git(dir, ["rev-parse", "--show-toplevel"]);
-  return r.code === 0 ? path8.resolve(r.stdout.trim()) : void 0;
+  return r.code === 0 ? canonical(path8.resolve(r.stdout.trim())) : void 0;
 }
 function snapshotTree(root, exclude = [], drop2 = []) {
   const tmp = path8.join(os8.tmpdir(), `pitroom-index-${process.pid}-${crypto2.randomBytes(4).toString("hex")}`);
   const real = path8.resolve(root, must(root, ["rev-parse", "--git-path", "index"]).trim());
   const env = { ...process.env, GIT_INDEX_FILE: tmp };
   try {
-    if (fs9.existsSync(real)) fs9.copyFileSync(real, tmp);
+    if (fs10.existsSync(real)) fs10.copyFileSync(real, tmp);
     else must(root, ["read-tree", "--empty"], env);
     must(root, ["add", "-A", "--", ":/", ...exclude.map((p) => `:(top,exclude)${p}`), ...drop2.map((p) => `:(top,literal,exclude)${p}`)], env);
     if (drop2.length) {
@@ -1751,8 +1778,8 @@ function snapshotTree(root, exclude = [], drop2 = []) {
     }
     return must(root, ["write-tree"], env).trim();
   } finally {
-    fs9.rmSync(tmp, { force: true });
-    fs9.rmSync(`${tmp}.lock`, { force: true });
+    fs10.rmSync(tmp, { force: true });
+    fs10.rmSync(`${tmp}.lock`, { force: true });
   }
 }
 var DIFF = ["diff", "--no-ext-diff", "--no-textconv", "--no-renames"];
@@ -1773,9 +1800,9 @@ function diffTrees(root, a, b) {
 }
 function createIsolatedCopy(root, tree, dest) {
   const objects = path8.join(path8.resolve(root, must(root, ["rev-parse", "--git-common-dir"]).trim()), "objects");
-  fs9.mkdirSync(path8.dirname(dest), { recursive: true });
+  fs10.mkdirSync(path8.dirname(dest), { recursive: true });
   must(path8.dirname(dest), ["init", "--quiet", dest]);
-  fs9.writeFileSync(path8.join(dest, ".git", "objects", "info", "alternates"), `${objects}
+  fs10.writeFileSync(path8.join(dest, ".git", "objects", "info", "alternates"), `${objects}
 `);
   must(dest, ["read-tree", tree]);
   must(dest, ["checkout-index", "--all", "--force"]);
@@ -1783,16 +1810,16 @@ function createIsolatedCopy(root, tree, dest) {
 function removeIsolatedCopy(dest, ownedBy) {
   const rel = path8.relative(ownedBy, dest);
   if (!rel || rel.startsWith("..") || path8.isAbsolute(rel)) throw new Error(`refusing to remove ${dest}`);
-  fs9.rmSync(dest, { recursive: true, force: true });
+  fs10.rmSync(dest, { recursive: true, force: true });
 }
 function linkIntoWorktree(root, worktree, rels) {
   const linked = [];
   for (const rel of rels) {
     const src = path8.join(root, rel);
     const dst = path8.join(worktree, rel);
-    if (!fs9.existsSync(src) || fs9.existsSync(dst)) continue;
-    fs9.mkdirSync(path8.dirname(dst), { recursive: true });
-    fs9.symlinkSync(src, dst, process.platform === "win32" ? "junction" : void 0);
+    if (!fs10.existsSync(src) || fs10.existsSync(dst)) continue;
+    fs10.mkdirSync(path8.dirname(dst), { recursive: true });
+    fs10.symlinkSync(src, dst, process.platform === "win32" ? "junction" : void 0);
     linked.push(rel);
   }
   return linked;
@@ -1898,10 +1925,10 @@ function resolveChain(flags = {}) {
 
 // src/core/process.ts
 import { spawn } from "node:child_process";
-import fs11 from "node:fs";
+import fs12 from "node:fs";
 
 // src/vcs/guard.ts
-import fs10 from "node:fs";
+import fs11 from "node:fs";
 import path9 from "node:path";
 var VERSION = 1;
 var SHIM = `#!/bin/sh
@@ -1984,8 +2011,8 @@ function findRealGit(skip) {
     if (path9.resolve(dir) === skip) continue;
     const p = path9.join(dir, "git");
     try {
-      fs10.accessSync(p, fs10.constants.X_OK);
-      if (fs10.statSync(p).isFile()) return p;
+      fs11.accessSync(p, fs11.constants.X_OK);
+      if (fs11.statSync(p).isFile()) return p;
     } catch {
     }
   }
@@ -2000,11 +2027,11 @@ exit 1
 `;
 var hooksDir = () => path9.join(home(), "git-hooks", `v${HOOK_VERSION}`);
 function writeIfChanged(file2, content) {
-  if (fs10.existsSync(file2) && fs10.readFileSync(file2, "utf8") === content) return;
-  fs10.mkdirSync(path9.dirname(file2), { recursive: true });
+  if (fs11.existsSync(file2) && fs11.readFileSync(file2, "utf8") === content) return;
+  fs11.mkdirSync(path9.dirname(file2), { recursive: true });
   const tmp = `${file2}.${process.pid}.tmp`;
-  fs10.writeFileSync(tmp, content, { mode: 493 });
-  fs10.renameSync(tmp, file2);
+  fs11.writeFileSync(tmp, content, { mode: 493 });
+  fs11.renameSync(tmp, file2);
 }
 function withGitConfig(env, entries) {
   const out = { ...env };
@@ -2040,8 +2067,8 @@ function guardEnv(env) {
 
 // src/core/process.ts
 async function spawnWorker(inv, opts) {
-  const out = fs11.openSync(opts.stdoutFile, "w");
-  const err = fs11.openSync(opts.stderrFile, "w");
+  const out = fs12.openSync(opts.stdoutFile, "w");
+  const err = fs12.openSync(opts.stderrFile, "w");
   const res = { code: null, timedOut: false, stopped: false };
   const child = spawn(inv.command, inv.args, {
     cwd: opts.cwd,
@@ -2064,7 +2091,7 @@ async function spawnWorker(inv, opts) {
   }, opts.timeoutSec * 1e3);
   res.code = await new Promise((resolve2) => {
     child.on("error", (e) => {
-      res.spawnError = e.code === "ENOENT" ? `${inv.command} not found` : e.message;
+      res.spawnError = e.code === "ENOENT" ? fs12.existsSync(opts.cwd) ? `${inv.command} not found` : `the working directory ${opts.cwd} does not exist` : e.message;
       resolve2(127);
     });
     child.on("close", (c) => resolve2(c));
@@ -2073,8 +2100,8 @@ async function spawnWorker(inv, opts) {
   if (killer) clearTimeout(killer);
   process.off("SIGINT", stop);
   process.off("SIGTERM", stop);
-  fs11.closeSync(out);
-  fs11.closeSync(err);
+  fs12.closeSync(out);
+  fs12.closeSync(err);
   return res;
 }
 
@@ -2106,7 +2133,7 @@ function parseAudit(text) {
 }
 
 // src/core/cooldown.ts
-import fs12 from "node:fs";
+import fs13 from "node:fs";
 import path10 from "node:path";
 var MAX_MS = 24 * 36e5;
 var OVERLOAD_MS = 20 * 6e4;
@@ -2134,18 +2161,18 @@ function cooldownMs(message) {
 }
 function read() {
   try {
-    const raw = JSON.parse(fs12.readFileSync(file(), "utf8"));
+    const raw = JSON.parse(fs13.readFileSync(file(), "utf8"));
     return raw && typeof raw === "object" && !Array.isArray(raw) ? raw : {};
   } catch {
     return {};
   }
 }
 function write(all) {
-  fs12.mkdirSync(path10.dirname(file()), { recursive: true });
+  fs13.mkdirSync(path10.dirname(file()), { recursive: true });
   const tmp = `${file()}.${process.pid}.tmp`;
-  fs12.writeFileSync(tmp, `${JSON.stringify(all, null, 2)}
+  fs13.writeFileSync(tmp, `${JSON.stringify(all, null, 2)}
 `);
-  fs12.renameSync(tmp, file());
+  renameOver(tmp, file());
 }
 function activeCooldowns(now = Date.now()) {
   return Object.fromEntries(Object.entries(read()).filter(([, c]) => Date.parse(c.until) > now));
@@ -2173,13 +2200,13 @@ function untilText(c, now = Date.now()) {
 }
 
 // src/core/snapshot.ts
-import fs14 from "node:fs";
+import fs15 from "node:fs";
 import path12 from "node:path";
 import crypto3 from "node:crypto";
 
 // src/core/secrets.ts
 import { execFileSync } from "node:child_process";
-import fs13 from "node:fs";
+import fs14 from "node:fs";
 import path11 from "node:path";
 var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", "build", "out", ".next", "target", "vendor", ".venv", "venv", "__pycache__", "coverage", ".turbo", ".cache"]);
 var MAX_VISITED = 2e4;
@@ -2197,7 +2224,7 @@ function findSecretFiles(dir) {
     if (depth > MAX_DEPTH || visited > MAX_VISITED) return;
     let entries;
     try {
-      entries = fs13.readdirSync(d, { withFileTypes: true });
+      entries = fs14.readdirSync(d, { withFileTypes: true });
     } catch {
       return;
     }
@@ -2206,7 +2233,7 @@ function findSecretFiles(dir) {
       if (e.isDirectory()) {
         if (!SKIP_DIRS.has(e.name)) walk(path11.join(d, e.name), depth + 1);
       } else if (e.isFile() && looksSecret(e.name)) {
-        found.push(path11.relative(dir, path11.join(d, e.name)));
+        found.push(slash(path11.relative(dir, path11.join(d, e.name))));
       }
     }
   };
@@ -2216,7 +2243,7 @@ function findSecretFiles(dir) {
 function findSecretFilesInTree(root, dir) {
   try {
     const out = execFileSync("git", ["-C", root, "ls-files", "-z", "--cached", "--others", "--exclude-standard"], { encoding: "utf8", maxBuffer: 256 * 1024 * 1024 });
-    return out.split("\0").filter((f) => f && looksSecret(path11.basename(f)) && !path11.relative(dir, path11.join(root, f)).startsWith("..")).map((f) => path11.relative(dir, path11.join(root, f))).sort();
+    return out.split("\0").filter((f) => f && looksSecret(path11.basename(f)) && !path11.relative(dir, path11.join(root, f)).startsWith("..")).map((f) => slash(path11.relative(dir, path11.join(root, f)))).sort();
   } catch {
     return [];
   }
@@ -2228,6 +2255,7 @@ function secretWarning(files, mode) {
   const fix = mode === "isolate" ? "add them to .gitignore, or" : "use an isolated copy (-i, git-ignored files are left out) or a clean checkout, or";
   return `secret-looking files ${where} (${shown}): the worker is told not to read them, but nothing stops it, and its model may be hosted by a third party; ${fix} set PITROOM_NO_SECRET_WARNING=1 to silence this`;
 }
+var slash = (p) => p.split(path11.sep).join("/");
 
 // src/core/snapshot.ts
 var READ_IN = ["auto", "snapshot", "project"];
@@ -2245,7 +2273,7 @@ function readSnapshot(root) {
   const drop2 = findSecretFilesInTree(root, root);
   const tree = snapshotTree(root, [], drop2);
   const dest = path12.join(snapshotsDir(), tree);
-  if (fs14.existsSync(path12.join(dest, ".git"))) {
+  if (fs15.existsSync(path12.join(dest, ".git"))) {
     touch(dest);
     return { dir: dest, tree, created: false };
   }
@@ -2254,9 +2282,9 @@ function readSnapshot(root) {
     createIsolatedCopy(root, tree, tmp);
     readOnly(tmp);
     try {
-      fs14.renameSync(tmp, dest);
+      fs15.renameSync(tmp, dest);
     } catch (e) {
-      if (!fs14.existsSync(path12.join(dest, ".git"))) throw e;
+      if (!fs15.existsSync(path12.join(dest, ".git"))) throw e;
       removeIsolatedCopy(tmp, snapshotsDir());
     }
   } catch (e) {
@@ -2272,17 +2300,17 @@ function readSnapshot(root) {
 function touch(dir) {
   try {
     const now = /* @__PURE__ */ new Date();
-    fs14.utimesSync(dir, now, now);
+    fs15.utimesSync(dir, now, now);
   } catch {
   }
 }
 function readOnly(dir) {
   const walk = (d) => {
-    for (const e of fs14.readdirSync(d, { withFileTypes: true })) {
+    for (const e of fs15.readdirSync(d, { withFileTypes: true })) {
       if (e.name === ".git") continue;
       const p = path12.join(d, e.name);
       if (e.isDirectory()) walk(p);
-      else if (e.isFile()) fs14.chmodSync(p, fs14.statSync(p).mode & ~146);
+      else if (e.isFile()) fs15.chmodSync(p, fs15.statSync(p).mode & ~146);
     }
   };
   try {
@@ -2293,7 +2321,7 @@ function readOnly(dir) {
 function prune(now = Date.now(), maxAgeMs = PRUNE_AGE_MS, keepNewest = KEEP_NEWEST) {
   let names;
   try {
-    names = fs14.readdirSync(snapshotsDir());
+    names = fs15.readdirSync(snapshotsDir());
   } catch {
     return 0;
   }
@@ -2308,7 +2336,7 @@ function prune(now = Date.now(), maxAgeMs = PRUNE_AGE_MS, keepNewest = KEEP_NEWE
   const entries = names.map((n) => {
     const dir = path12.join(snapshotsDir(), n);
     try {
-      return { n, dir, age: now - fs14.statSync(dir).mtimeMs };
+      return { n, dir, age: now - fs15.statSync(dir).mtimeMs };
     } catch {
       return void 0;
     }
@@ -2332,10 +2360,10 @@ function prune(now = Date.now(), maxAgeMs = PRUNE_AGE_MS, keepNewest = KEEP_NEWE
 }
 function makeWritable(dir) {
   const walk = (d) => {
-    for (const e of fs14.readdirSync(d, { withFileTypes: true })) {
+    for (const e of fs15.readdirSync(d, { withFileTypes: true })) {
       const p = path12.join(d, e.name);
       if (e.isDirectory()) walk(p);
-      else if (e.isFile()) fs14.chmodSync(p, fs14.statSync(p).mode | 128);
+      else if (e.isFile()) fs15.chmodSync(p, fs15.statSync(p).mode | 128);
     }
   };
   try {
@@ -2346,7 +2374,7 @@ function makeWritable(dir) {
 function backToProject(text, snapshotDir, root) {
   let real = snapshotDir;
   try {
-    real = fs14.realpathSync(snapshotDir);
+    real = fs15.realpathSync(snapshotDir);
   } catch {
   }
   let out = text;
@@ -2427,7 +2455,7 @@ function auditBadge(meta) {
 }
 
 // src/core/plan.ts
-import fs15 from "node:fs";
+import fs16 from "node:fs";
 import path13 from "node:path";
 var FENCE = /^ {0,3}(`{3,}|~{3,})(.*)$/;
 var RULE = /^ {0,3}([-*_])(\s*\1){2,}\s*$/;
@@ -2476,8 +2504,8 @@ function parsePlan(text, file2 = "") {
 }
 function loadPlan(file2) {
   const abs = path13.resolve(file2);
-  if (!fs15.existsSync(abs) || !fs15.statSync(abs).isFile()) throw new UserError(`plan not found: ${file2}`);
-  const plan = parsePlan(fs15.readFileSync(abs, "utf8"), fs15.realpathSync(abs));
+  if (!fs16.existsSync(abs) || !fs16.statSync(abs).isFile()) throw new UserError(`plan not found: ${file2}`);
+  const plan = parsePlan(fs16.readFileSync(abs, "utf8"), fs16.realpathSync(abs));
   if (!plan.tasks.length) throw new UserError(`${file2} has no "Task N" headings (see pitroom-writing-plans)`);
   return plan;
 }
@@ -2499,11 +2527,11 @@ function brief(plan, task) {
 var planName = (file2) => path13.basename(file2).replace(/\.md$/i, "");
 
 // src/core/templates.ts
-import fs17 from "node:fs";
+import fs18 from "node:fs";
 import path15 from "node:path";
 
 // src/core/install.ts
-import fs16 from "node:fs";
+import fs17 from "node:fs";
 import os9 from "node:os";
 import path14 from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
@@ -2513,18 +2541,30 @@ function packageRoot() {
 }
 function skillNames(root = packageRoot()) {
   const dir = path14.join(root, "skills");
-  if (!fs16.existsSync(dir)) return [];
-  return fs16.readdirSync(dir).filter((d) => fs16.existsSync(path14.join(dir, d, "SKILL.md"))).sort();
+  if (!fs17.existsSync(dir)) return [];
+  return fs17.readdirSync(dir).filter((d) => fs17.existsSync(path14.join(dir, d, "SKILL.md"))).sort();
 }
 function skillTargets() {
   const home3 = os9.homedir();
   const targets = [path14.join(home3, ".agents", "skills")];
-  if (fs16.existsSync(path14.join(home3, ".claude"))) targets.push(path14.join(home3, ".claude", "skills"));
+  if (fs17.existsSync(path14.join(home3, ".claude"))) targets.push(path14.join(home3, ".claude", "skills"));
   return targets;
 }
-var launcherPath = () => path14.join(os9.homedir(), ".local", "bin", "pitroom");
+var launcherPath = () => path14.join(os9.homedir(), ".local", "bin", process.platform === "win32" ? "pitroom.cmd" : "pitroom");
 var LAUNCHER_MARK = "# pitroom launcher";
 function launcherScript(bundle) {
+  if (process.platform === "win32") {
+    const q2 = (v) => v.replace(/%/g, "%%");
+    return `@echo off\r
+rem ${LAUNCHER_MARK} (created by \`pitroom install\`; \`pitroom uninstall\` removes it)\r
+if defined PITROOM_NODE (\r
+  "%PITROOM_NODE%" "${q2(bundle)}" %*\r
+) else (\r
+  "${q2(process.execPath)}" "${q2(bundle)}" %*\r
+)\r
+exit /b %ERRORLEVEL%\r
+`;
+  }
   const q = (s) => `'${s.replace(/'/g, `'\\''`)}'`;
   return `#!/bin/sh
 ${LAUNCHER_MARK} (created by \`pitroom install\`; \`pitroom uninstall\` removes it)
@@ -2540,7 +2580,7 @@ exit 127
 function isOurLauncher(file2, root) {
   if (linksInto(file2, root)) return true;
   try {
-    const s = fs16.readFileSync(file2, "utf8");
+    const s = fs17.readFileSync(file2, "utf8");
     return s.includes(LAUNCHER_MARK) && s.includes(root);
   } catch {
     return false;
@@ -2548,42 +2588,42 @@ function isOurLauncher(file2, root) {
 }
 function isPitroomLauncher(file2) {
   try {
-    return fs16.readFileSync(file2, "utf8").includes(LAUNCHER_MARK);
+    return fs17.readFileSync(file2, "utf8").includes(LAUNCHER_MARK);
   } catch {
     return false;
   }
 }
 function placeLauncher(bundle, root, force) {
   const dest = launcherPath();
-  fs16.mkdirSync(path14.dirname(dest), { recursive: true });
-  const exists = fs16.lstatSync(dest, { throwIfNoEntry: false });
+  fs17.mkdirSync(path14.dirname(dest), { recursive: true });
+  const exists = fs17.lstatSync(dest, { throwIfNoEntry: false });
   if (exists && !isOurLauncher(dest, root)) {
     if (!force) return `! ${dest} exists and is not Pitroom's launcher; kept (use --force to back it up and replace)`;
-    fs16.renameSync(dest, `${dest}.bak-${Date.now()}`);
+    fs17.renameSync(dest, `${dest}.bak-${Date.now()}`);
   } else if (exists) {
-    fs16.rmSync(dest, { force: true });
+    fs17.rmSync(dest, { force: true });
   }
-  fs16.writeFileSync(dest, launcherScript(bundle), { mode: 493 });
+  fs17.writeFileSync(dest, launcherScript(bundle), { mode: 493 });
   return `\u2714 ${dest} \u2192 launcher for ${bundle} (Node 22.13+)`;
 }
 function linksInto(link, dir) {
-  const st = fs16.lstatSync(link, { throwIfNoEntry: false });
+  const st = fs17.lstatSync(link, { throwIfNoEntry: false });
   if (!st?.isSymbolicLink()) return false;
-  const target = path14.resolve(path14.dirname(link), fs16.readlinkSync(link));
+  const target = path14.resolve(path14.dirname(link), fs17.readlinkSync(link));
   const rel = path14.relative(dir, target);
   return !rel.startsWith("..") && !path14.isAbsolute(rel);
 }
 function place(src, dest, opts) {
-  fs16.mkdirSync(path14.dirname(dest), { recursive: true });
-  const st = fs16.lstatSync(dest, { throwIfNoEntry: false });
+  fs17.mkdirSync(path14.dirname(dest), { recursive: true });
+  const st = fs17.lstatSync(dest, { throwIfNoEntry: false });
   if (st && !st.isSymbolicLink()) {
     if (!opts.force) return `! ${dest} exists and is not a link; kept (use --force to back it up and replace)`;
-    fs16.renameSync(dest, `${dest}.bak-${Date.now()}`);
+    fs17.renameSync(dest, `${dest}.bak-${Date.now()}`);
   } else if (st) {
-    fs16.unlinkSync(dest);
+    fs17.unlinkSync(dest);
   }
-  if (opts.copy) fs16.cpSync(src, dest, { recursive: true });
-  else fs16.symlinkSync(src, dest, process.platform === "win32" ? "junction" : fs16.statSync(src).isDirectory() ? "dir" : "file");
+  if (opts.copy) fs17.cpSync(src, dest, { recursive: true });
+  else fs17.symlinkSync(src, dest, process.platform === "win32" ? "junction" : fs17.statSync(src).isDirectory() ? "dir" : "file");
   return `\u2714 ${dest} \u2192 ${opts.copy ? "copied" : src}`;
 }
 function install(opts) {
@@ -2595,14 +2635,14 @@ function install(opts) {
     for (const legacy of LEGACY) {
       const l = path14.join(base2, legacy);
       if (!skills2.includes(legacy) && linksInto(l, root)) {
-        fs16.unlinkSync(l);
+        fs17.unlinkSync(l);
         out.push(`\u2714 removed old link ${l}`);
       }
     }
     for (const name of skills2) out.push(place(path14.join(root, "skills", name), path14.join(base2, name), opts));
   }
   const bundle = path14.join(root, "dist", "pitroom.mjs");
-  if (fs16.existsSync(bundle)) {
+  if (fs17.existsSync(bundle)) {
     out.push(placeLauncher(bundle, root, opts.force));
     const onPath = (process.env.PATH ?? "").split(path14.delimiter).some((d) => path14.resolve(d) === path14.dirname(launcherPath()));
     if (!onPath) out.push(`! ${path14.dirname(launcherPath())} is not on PATH; add it, or run ${launcherPath()} directly`);
@@ -2613,24 +2653,24 @@ function uninstall() {
   const root = packageRoot();
   const out = [];
   for (const base2 of skillTargets()) {
-    if (!fs16.existsSync(base2)) continue;
-    for (const name of fs16.readdirSync(base2)) {
+    if (!fs17.existsSync(base2)) continue;
+    for (const name of fs17.readdirSync(base2)) {
       const l = path14.join(base2, name);
       if (linksInto(l, root)) {
-        fs16.unlinkSync(l);
+        fs17.unlinkSync(l);
         out.push(`\u2714 removed ${l}`);
       }
     }
   }
   if (isOurLauncher(launcherPath(), root)) {
-    fs16.rmSync(launcherPath(), { force: true });
+    fs17.rmSync(launcherPath(), { force: true });
     out.push(`\u2714 removed ${launcherPath()}`);
   }
   return out.length ? out : ["nothing to remove"];
 }
 function installedSkills() {
   const names = skillNames();
-  return skillTargets().map((base2) => ({ base: base2, names: names.filter((n) => fs16.existsSync(path14.join(base2, n, "SKILL.md"))) }));
+  return skillTargets().map((base2) => ({ base: base2, names: names.filter((n) => fs17.existsSync(path14.join(base2, n, "SKILL.md"))) }));
 }
 
 // src/core/templates.ts
@@ -2642,8 +2682,8 @@ var FILES = {
 };
 function loadTemplate(name, root = packageRoot()) {
   const file2 = path15.join(root, "skills", FILES[name]);
-  if (!fs17.existsSync(file2)) throw new UserError(`template missing: ${file2} (broken install? run pitroom doctor)`, 3);
-  return fs17.readFileSync(file2, "utf8").replace(/^\s*<!--[\s\S]*?-->\s*/, "");
+  if (!fs18.existsSync(file2)) throw new UserError(`template missing: ${file2} (broken install? run pitroom doctor)`, 3);
+  return fs18.readFileSync(file2, "utf8").replace(/^\s*<!--[\s\S]*?-->\s*/, "");
 }
 function fill(template, values) {
   const missing = [...template.matchAll(/\{\{([A-Z_]+)\}\}/g)].map((m) => m[1]).filter((k) => !(k in values));
@@ -2653,7 +2693,7 @@ function fill(template, values) {
 
 // src/core/slots.ts
 import crypto5 from "node:crypto";
-import fs18 from "node:fs";
+import fs19 from "node:fs";
 import path16 from "node:path";
 var slotsDir = () => path16.join(home(), "slots");
 var locksDir = () => path16.join(home(), "locks");
@@ -2670,23 +2710,23 @@ function holderActive(runId, self) {
   }
 }
 function tryClaim(file2, runId) {
-  fs18.mkdirSync(path16.dirname(file2), { recursive: true });
+  fs19.mkdirSync(path16.dirname(file2), { recursive: true });
   try {
-    fs18.writeFileSync(file2, runId, { flag: "wx" });
+    fs19.writeFileSync(file2, runId, { flag: "wx" });
     return true;
   } catch (e) {
     if (e.code !== "EEXIST") throw e;
   }
   let owner = "";
   try {
-    owner = fs18.readFileSync(file2, "utf8").trim();
+    owner = fs19.readFileSync(file2, "utf8").trim();
   } catch {
   }
   if (owner === runId) return true;
   if (holderActive(owner, runId)) return false;
-  fs18.rmSync(file2, { force: true });
+  fs19.rmSync(file2, { force: true });
   try {
-    fs18.writeFileSync(file2, runId, { flag: "wx" });
+    fs19.writeFileSync(file2, runId, { flag: "wx" });
     return true;
   } catch {
     return false;
@@ -2695,7 +2735,7 @@ function tryClaim(file2, runId) {
 function releaseIfOwner(file2, runId) {
   if (!file2) return;
   try {
-    if (fs18.readFileSync(file2, "utf8").trim() === runId) fs18.rmSync(file2, { force: true });
+    if (fs19.readFileSync(file2, "utf8").trim() === runId) fs19.rmSync(file2, { force: true });
   } catch {
   }
 }
@@ -2713,7 +2753,7 @@ function acquireWriteLock(repoRoot2, runId) {
   if (tryClaim(file2, runId)) return;
   let owner = "";
   try {
-    owner = fs18.readFileSync(file2, "utf8").trim();
+    owner = fs19.readFileSync(file2, "utf8").trim();
   } catch {
   }
   throw new UserError(`another --write run (${owner}) is active in this repo; use --isolate for parallel changes`, 3);
@@ -2760,7 +2800,7 @@ ${task}`;
 }
 
 // src/core/receipt.ts
-import fs19 from "node:fs";
+import fs20 from "node:fs";
 import path17 from "node:path";
 var PRESETS = {
   sonnet: { name: "Claude Sonnet", input: 3, output: 15, cachedInput: 0.3 },
@@ -2797,13 +2837,13 @@ function record(meta) {
     saved: meta.savedUsd ?? 0,
     price: primaryPrice().name
   };
-  fs19.mkdirSync(path17.dirname(ledgerFile()), { recursive: true });
-  fs19.appendFileSync(ledgerFile(), `${JSON.stringify(entry)}
+  fs20.mkdirSync(path17.dirname(ledgerFile()), { recursive: true });
+  fs20.appendFileSync(ledgerFile(), `${JSON.stringify(entry)}
 `);
 }
 function readLedger(sinceMs2) {
-  if (!fs19.existsSync(ledgerFile())) return [];
-  return fs19.readFileSync(ledgerFile(), "utf8").split("\n").filter(Boolean).flatMap((l) => {
+  if (!fs20.existsSync(ledgerFile())) return [];
+  return fs20.readFileSync(ledgerFile(), "utf8").split("\n").filter(Boolean).flatMap((l) => {
     try {
       return [JSON.parse(l)];
     } catch {
@@ -2878,7 +2918,7 @@ ${tile(0, compact(t.tokens), "Tokens offloaded")}${tile(1, t.ratio ? `${Math.rou
 }
 
 // src/core/refs.ts
-import fs20 from "node:fs";
+import fs21 from "node:fs";
 import path18 from "node:path";
 var FILE_EXTENSIONS = new Set(
   "ts tsx mts cts js jsx mjs cjs json jsonc json5 md mdx txt rst py pyi rb go rs java kt kts swift c h cc cpp cxx hpp hh cs fs php lua r jl sh bash zsh fish ps1 bat yml yaml toml ini cfg conf env html htm css scss sass less vue svelte astro sql graphql gql proto lock xml svg csv tsv gradle tf hcl dart ex exs erl hs ml scala clj vim el mk cmake dockerfile gitignore gitattributes editorconfig npmrc nvmrc".split(" ")
@@ -2935,8 +2975,8 @@ function verifyRefs(refs, dirs) {
   const lineCache = /* @__PURE__ */ new Map();
   const load = (file2) => {
     if (!lineCache.has(file2)) {
-      const size = fs20.statSync(file2).size;
-      const lines = size > MAX_BYTES ? null : fs20.readFileSync(file2, "utf8").split("\n");
+      const size = fs21.statSync(file2).size;
+      const lines = size > MAX_BYTES ? null : fs21.readFileSync(file2, "utf8").split("\n");
       if (lines && lines[lines.length - 1] === "") lines.pop();
       lineCache.set(file2, lines);
     }
@@ -2949,7 +2989,7 @@ function verifyRefs(refs, dirs) {
     if (direct) return [direct];
     if (path18.isAbsolute(ref.file)) return [];
     const wanted = ref.file.replace(/^(\.{1,2}\/)+/, "");
-    return (byName().get(path18.basename(wanted)) ?? []).filter((f) => f.endsWith(`/${wanted}`) || path18.basename(f) === wanted).slice(0, 20);
+    return (byName().get(path18.basename(wanted)) ?? []).filter((f) => f.split(path18.sep).join("/").endsWith(`/${wanted}`) || path18.basename(f) === wanted).slice(0, 20);
   };
   const check = (file2, ref) => {
     const lines = load(file2);
@@ -2994,7 +3034,7 @@ function indexFiles(roots) {
   const walk = (dir) => {
     let entries;
     try {
-      entries = fs20.readdirSync(dir, { withFileTypes: true });
+      entries = fs21.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -3017,7 +3057,7 @@ function resolve(ref, roots) {
   const candidates = path18.isAbsolute(ref) ? inside(ref, roots) ? [ref] : [] : roots.map((r) => path18.join(r, ref));
   return candidates.find((c) => {
     try {
-      return fs20.statSync(c).isFile() && inside(c, roots);
+      return fs21.statSync(c).isFile() && inside(c, roots);
     } catch {
       return false;
     }
@@ -3032,13 +3072,13 @@ function inside(file2, roots) {
 var escape = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 
 // src/core/history.ts
-import fs22 from "node:fs";
+import fs23 from "node:fs";
 import { createRequire } from "node:module";
 import path19 from "node:path";
 import zlib from "node:zlib";
 
 // src/core/ui.ts
-import fs21 from "node:fs";
+import fs22 from "node:fs";
 var WEEK_MS = 7 * 24 * 3600 * 1e3;
 var RECENT = 40;
 var RECENT_HOURS = 1;
@@ -3129,9 +3169,9 @@ function cardsFor(m) {
   const out = [];
   for (const [phase, text] of phases) {
     const marker = runFile(m.id, `card-${phase}`);
-    if (fs21.existsSync(marker)) continue;
+    if (fs22.existsSync(marker)) continue;
     if (!(phase === "started" && !isActive(m.state))) out.push(text());
-    fs21.writeFileSync(marker, "");
+    fs22.writeFileSync(marker, "");
   }
   return out;
 }
@@ -3142,10 +3182,10 @@ function hookCards(input) {
   const response = event.tool_response;
   const output = typeof response === "string" ? response : [response?.stdout, response?.stderr].filter(Boolean).join("\n");
   const ids = [...new Set(`${command}
-${output}`.match(RUN_ID) ?? [])].filter((id) => fs21.existsSync(`${runsDir()}/${id}`));
+${output}`.match(RUN_ID) ?? [])].filter((id) => fs22.existsSync(`${runsDir()}/${id}`));
   const since2 = Date.now() - RECENT_HOURS * 36e5;
   for (const id of listRunIds().slice(-RECENT)) {
-    if (ids.includes(id) || fs21.existsSync(runFile(id, "card-ended"))) continue;
+    if (ids.includes(id) || fs22.existsSync(runFile(id, "card-ended"))) continue;
     try {
       const m = readMeta(id);
       if (!isActive(m.state) && Date.parse(m.endedAt ?? m.startedAt) > since2) ids.push(id);
@@ -3181,7 +3221,7 @@ function openDb() {
     } finally {
       process.emitWarning = emit;
     }
-    fs22.mkdirSync(path19.dirname(file2), { recursive: true });
+    fs23.mkdirSync(path19.dirname(file2), { recursive: true });
     db = new DatabaseSync(file2);
     db.exec("PRAGMA journal_mode=WAL; PRAGMA busy_timeout=5000; PRAGMA synchronous=NORMAL;");
     migrate(db);
@@ -3216,30 +3256,30 @@ function migrate(db) {
 function readRunFile(id, name) {
   const f = runFile(id, name);
   try {
-    if (fs22.existsSync(f)) return fs22.readFileSync(f, "utf8");
-    if (fs22.existsSync(`${f}.gz`)) return zlib.gunzipSync(fs22.readFileSync(`${f}.gz`)).toString("utf8");
+    if (fs23.existsSync(f)) return fs23.readFileSync(f, "utf8");
+    if (fs23.existsSync(`${f}.gz`)) return zlib.gunzipSync(fs23.readFileSync(`${f}.gz`)).toString("utf8");
   } catch {
   }
   return void 0;
 }
 function gzipFile(f) {
-  if (!fs22.existsSync(f)) return;
-  fs22.writeFileSync(`${f}.gz`, zlib.gzipSync(fs22.readFileSync(f)));
-  fs22.rmSync(f);
+  if (!fs23.existsSync(f)) return;
+  fs23.writeFileSync(`${f}.gz`, zlib.gzipSync(fs23.readFileSync(f)));
+  fs23.rmSync(f);
 }
 function compactRun(meta) {
   if (!TERMINAL.includes(meta.state)) return;
   const dir = path19.dirname(runFile(meta.id, "meta.json"));
   let names;
   try {
-    names = fs22.readdirSync(dir);
+    names = fs23.readdirSync(dir);
   } catch {
     return;
   }
   for (const n of names) {
     if (/^events(\.attempt-\d+)?\.jsonl$/.test(n)) gzipFile(path19.join(dir, n));
     else if (/^stderr(\.attempt-\d+)?\.log$/.test(n)) {
-      if (meta.state === "done" && !/attempt/.test(n)) fs22.rmSync(path19.join(dir, n), { force: true });
+      if (meta.state === "done" && !/attempt/.test(n)) fs23.rmSync(path19.join(dir, n), { force: true });
       else gzipFile(path19.join(dir, n));
     }
   }
@@ -3395,8 +3435,8 @@ function listHistory(q = {}) {
   const base2 = where.length ? `WHERE ${where.join(" AND ")}` : "";
   try {
     const total = db.prepare(`SELECT COUNT(*) AS n FROM runs r ${base2}`).get(...args).n;
-    const page = q.beforeId ? `${base2 ? `${base2} AND` : "WHERE"} r.id < ?` : base2;
-    const rows = db.prepare(`SELECT r.*, json_extract(r.meta_json, '$.audit.state') AS audit_state, json_extract(r.meta_json, '$.audit.verdict') AS audit_verdict, ${VERIFY_FAILED} AS verify_failed FROM runs r ${page} ORDER BY r.id DESC LIMIT ?`).all(...args, ...q.beforeId ? [q.beforeId] : [], Math.min(Math.max(q.limit ?? 30, 1), 200));
+    const page2 = q.beforeId ? `${base2 ? `${base2} AND` : "WHERE"} r.id < ?` : base2;
+    const rows = db.prepare(`SELECT r.*, json_extract(r.meta_json, '$.audit.state') AS audit_state, json_extract(r.meta_json, '$.audit.verdict') AS audit_verdict, ${VERIFY_FAILED} AS verify_failed FROM runs r ${page2} ORDER BY r.id DESC LIMIT ?`).all(...args, ...q.beforeId ? [q.beforeId] : [], Math.min(Math.max(q.limit ?? 30, 1), 200));
     return {
       total,
       rows: rows.map((r) => ({
@@ -3493,7 +3533,7 @@ function historyStats(sinceMs2) {
 }
 
 // src/core/report.ts
-import fs23 from "node:fs";
+import fs24 from "node:fs";
 
 // src/core/style.ts
 var enabled = () => {
@@ -3553,7 +3593,7 @@ function duration(meta) {
 }
 function readSummary(meta) {
   const f = runFile(meta.id, "summary.md");
-  return fs23.existsSync(f) ? fs23.readFileSync(f, "utf8").trim() : archivedRun(meta.id)?.answer ?? "";
+  return fs24.existsSync(f) ? fs24.readFileSync(f, "utf8").trim() : archivedRun(meta.id)?.answer ?? "";
 }
 function formatReport(meta, finalText = readSummary(meta), maxLines = 400) {
   const out = [];
@@ -3625,7 +3665,7 @@ function formatReport(meta, finalText = readSummary(meta), maxLines = 400) {
   }
   if (meta.verifyResult) {
     const v = meta.verifyResult;
-    const notFound = !v.ok && v.code === 127 && /not found|no such file/i.test(v.tail);
+    const notFound = !v.ok && v.code === 127 && /not found|no such file|is not recognized as an internal or external command/i.test(v.tail);
     out.push(`\u2500\u2500 verify: \`${meta.verify}\` ${v.ok ? "\u2714 passed" : notFound ? "\u2718 could not run (exit 127: command not found)" : `\u2718 failed (exit ${v.code})`}`);
     if (notFound) out.push("   the command is not on the PATH Pitroom runs with (an app such as an MCP client may start it without your shell's PATH): give its full path, or set PATH in the command");
     if (!v.ok && v.tail) out.push(...v.tail.split("\n").map((l) => `   ${l}`));
@@ -3639,8 +3679,8 @@ function formatReport(meta, finalText = readSummary(meta), maxLines = 400) {
 }
 function live(meta) {
   const f = runFile(meta.id, "events.jsonl");
-  if (!fs23.existsSync(f)) return { steps: 0, toolCalls: 0 };
-  const p = getBackend((meta.ran ?? meta.worker).backend).parse(fs23.readFileSync(f, "utf8"));
+  if (!fs24.existsSync(f)) return { steps: 0, toolCalls: 0 };
+  const p = getBackend((meta.ran ?? meta.worker).backend).parse(fs24.readFileSync(f, "utf8"));
   return { steps: p.usage.steps, toolCalls: p.usage.toolCalls, last: p.lastActivity };
 }
 function progress(meta) {
@@ -3651,7 +3691,7 @@ function progress(meta) {
 }
 
 // src/core/run.ts
-var VERSION2 = true ? "0.17.0" : "0.0.0-dev";
+var VERSION2 = true ? "0.19.0" : "0.0.0-dev";
 function planWork(o) {
   if (!o.plan) return { task: o.task.trim(), tier: o.tier };
   if (o.continueFrom) throw new UserError("a follow-up continues its parent's task; drop --plan/--step");
@@ -3683,7 +3723,7 @@ function prepareRun(o) {
     parent = readMeta(o.continueFrom);
     if (o.worker || o.tier || o.effort) throw new UserError("a follow-up runs on the same worker as its parent; drop --worker/--tier/--effort");
     if (!parent.sessionId) throw new UserError(`run ${parent.id} has no worker session to continue`, 3);
-    if (parent.mode === "isolate" && (!parent.worktree || !fs24.existsSync(parent.worktree))) {
+    if (parent.mode === "isolate" && (!parent.worktree || !fs25.existsSync(parent.worktree))) {
       throw new UserError(`the isolated copy of run ${parent.id} is gone (applied or discarded)`, 3);
     }
     const ran = parent.ran ?? parent.worker;
@@ -3702,18 +3742,18 @@ function prepareRun(o) {
     throw new UserError(`the ${backend.name} worker cannot attach files; put the content in the task`);
   }
   const mode = parent?.mode ?? o.mode;
-  const dir = path20.resolve(parent?.dir ?? o.dir);
-  if (!fs24.existsSync(dir) || !fs24.statSync(dir).isDirectory()) throw new UserError(`not a directory: ${dir}`);
+  const dir = canonical(path20.resolve(parent?.dir ?? o.dir));
+  if (!fs25.existsSync(dir) || !fs25.statSync(dir).isDirectory()) throw new UserError(`not a directory: ${dir}`);
   const root = repoRoot(dir);
   if (mode === "isolate" && !root) throw new UserError("--isolate needs a git repository", 3);
   if (mode === "write" && !root && !o.allowNonGit) {
     throw new UserError("--write outside a git repo cannot be tracked or reverted; pass --allow-non-git to accept that", 3);
   }
   const files = o.files.map((f) => path20.resolve(f));
-  for (const f of files) if (!fs24.existsSync(f)) throw new UserError(`file not found: ${f}`);
+  for (const f of files) if (!fs25.existsSync(f)) throw new UserError(`file not found: ${f}`);
   const readIn2 = READ_IN.includes(effective().readIn.value) ? effective().readIn.value : "auto";
   const snap = mode === "read" && !o.review && !o.inPlace && !parent ? wantSnapshot(readIn2, root, dir) : void 0;
-  if (parent?.snapshot?.dir && !fs24.existsSync(parent.snapshot.dir)) {
+  if (parent?.snapshot?.dir && !fs25.existsSync(parent.snapshot.dir)) {
     throw new UserError(`the read snapshot of run ${parent.id} is gone (cleaned up); ask the question again as a new run`, 3);
   }
   if (!parent && !snap && !process.env.PITROOM_NO_SECRET_WARNING) {
@@ -3760,13 +3800,13 @@ function prepareRun(o) {
     try {
       acquireWriteLock(root, meta.id);
     } catch (e) {
-      fs24.rmSync(runDir(meta.id), { recursive: true, force: true });
+      fs25.rmSync(runDir(meta.id), { recursive: true, force: true });
       throw e;
     }
   }
-  fs24.writeFileSync(runFile(meta.id, "task.md"), `${meta.task}
+  fs25.writeFileSync(runFile(meta.id, "task.md"), `${meta.task}
 `);
-  if (work.brief) fs24.writeFileSync(runFile(meta.id, "brief.md"), work.brief);
+  if (work.brief) fs25.writeFileSync(runFile(meta.id, "brief.md"), work.brief);
   return meta;
 }
 var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
@@ -3846,7 +3886,7 @@ async function execute(meta) {
       (meta.attempts ??= []).push({ target: describeTarget(target), error: why.message });
       for (const f of ["events.jsonl", "stderr.log"]) {
         const from = runFile(meta.id, f);
-        if (fs24.existsSync(from)) fs24.renameSync(from, runFile(meta.id, f.replace(".", `.attempt-${i + 1}.`)));
+        if (fs25.existsSync(from)) fs25.renameSync(from, runFile(meta.id, f.replace(".", `.attempt-${i + 1}.`)));
       }
       writeMeta(meta);
     }
@@ -3911,7 +3951,7 @@ function prepareTree(meta) {
       meta.snapshot.dir = s.dir;
       meta.snapshot.tree = s.tree;
       meta.cwd = path20.join(s.dir, path20.relative(root, meta.dir));
-      if (!fs24.existsSync(meta.cwd)) meta.cwd = s.dir;
+      if (!fs25.existsSync(meta.cwd)) meta.cwd = s.dir;
       if (shown) meta.warnings.push(`read in a clean snapshot of your project: the secret-looking files (${shown}) and git-ignored files are not in it; --in-place reads the directory itself`);
     } catch (e) {
       meta.snapshot = void 0;
@@ -3946,7 +3986,7 @@ function attempt(meta, backend, target) {
     timeoutSec: meta.timeoutSec
   });
 }
-var read2 = (f) => fs24.existsSync(f) ? fs24.readFileSync(f, "utf8") : "";
+var read2 = (f) => fs25.existsSync(f) ? fs25.readFileSync(f, "utf8") : "";
 function retryableFailure(meta, backend, res) {
   const run2 = backend.parse(read2(runFile(meta.id, "events.jsonl")));
   if (run2.usage.steps > 0) return void 0;
@@ -3966,12 +4006,12 @@ function finalize(meta, res) {
   if (meta.snapshot?.dir && meta.repoRoot) run2.finalText = backToProject(run2.finalText, meta.snapshot.dir, meta.repoRoot);
   meta.sessionId = run2.sessionId ?? meta.sessionId;
   meta.usage = run2.usage;
-  fs24.writeFileSync(runFile(meta.id, "summary.md"), `${run2.finalText}
+  fs25.writeFileSync(runFile(meta.id, "summary.md"), `${run2.finalText}
 `);
   if (meta.plan && !meta.reviewOf) meta.taskStatus = parseStatus(run2.finalText);
   if (meta.reviewOf) {
     meta.verdict = parseVerdict(run2.finalText);
-    if (meta.packageFile) fs24.rmSync(meta.packageFile, { force: true });
+    if (meta.packageFile) fs25.rmSync(meta.packageFile, { force: true });
   }
   if (!res.timedOut && !res.stopped && !meta.error) {
     const f = backend.failure(run2, read2(runFile(meta.id, "stderr.log")), res.code);
@@ -4019,7 +4059,7 @@ function captureChanges(meta) {
   const d = diffTrees(target, meta.baseTree, meta.afterTree);
   meta.changes = d.changes;
   meta.stats = d.stats;
-  fs24.writeFileSync(runFile(meta.id, "changes.patch"), d.patch);
+  fs25.writeFileSync(runFile(meta.id, "changes.patch"), d.patch);
 }
 function verifyPath() {
   const extra = [path20.dirname(process.execPath), "/opt/homebrew/bin", "/usr/local/bin", "/usr/bin", "/bin"];
@@ -4038,8 +4078,9 @@ function runVerify(meta) {
     env: { ...process.env, PATH: verifyPath(), PWD: meta.cwd, PITROOM_ACTIVE: "1" }
   });
   const output = `${r.stdout ?? ""}${r.stderr ?? ""}`;
-  fs24.writeFileSync(runFile(meta.id, "verify.log"), output);
-  return { ok: r.status === 0, code: r.status, tail: output.trimEnd().split("\n").slice(-25).join("\n") };
+  fs25.writeFileSync(runFile(meta.id, "verify.log"), output);
+  const notFound = process.platform === "win32" && r.status === 1 && /is not recognized as an internal or external command/.test(output);
+  return { ok: r.status === 0, code: notFound ? 127 : r.status, tail: output.trimEnd().split("\n").slice(-25).join("\n") };
 }
 function applyRun(meta, allowDelete = false) {
   if (meta.mode !== "isolate") throw new UserError(`run ${meta.id} edited your tree directly (${meta.mode}); nothing to apply`);
@@ -4075,6 +4116,15 @@ ${res.message}`, 1);
   writeMeta(meta);
   return `reverted ${meta.changes.length} file(s) changed by ${meta.id}`;
 }
+function stopRun(id) {
+  const meta = freshMeta(id);
+  if (!isActive(meta.state) || !isAlive(meta.pid)) return void 0;
+  requestStop(meta.id);
+  meta.stopRequested = true;
+  writeMeta(meta);
+  process.kill(meta.pid, "SIGTERM");
+  return meta;
+}
 function discardRun(meta) {
   if (meta.mode !== "isolate") throw new UserError("only --isolate runs have an isolated copy to discard");
   cleanupWorktree(meta);
@@ -4083,11 +4133,11 @@ function discardRun(meta) {
   return `discarded the isolated copy of ${meta.id}; the patch stays in ${runFile(meta.id, "changes.patch")}`;
 }
 function cleanupWorktree(meta) {
-  if (meta.worktree && fs24.existsSync(meta.worktree)) removeIsolatedCopy(meta.worktree, worktreesDir());
+  if (meta.worktree && fs25.existsSync(meta.worktree)) removeIsolatedCopy(meta.worktree, worktreesDir());
 }
 
 // src/cli/mcp-extras.ts
-import fs25 from "node:fs";
+import fs26 from "node:fs";
 import path21 from "node:path";
 
 // src/cli/mcp-support.ts
@@ -4447,7 +4497,7 @@ function skillPrompts() {
   const root = packageRoot();
   for (const name of skillNames(root)) {
     try {
-      const text = fs25.readFileSync(path21.join(root, "skills", name, "SKILL.md"), "utf8");
+      const text = fs26.readFileSync(path21.join(root, "skills", name, "SKILL.md"), "utf8");
       const front = /^---\n([\s\S]*?)\n---\n/.exec(text);
       const body = (front ? text.slice(front[0].length) : text).trim();
       const description = /^description:\s*(.+)$/m.exec(front?.[1] ?? "")?.[1]?.trim() ?? `The ${name} skill.`;
@@ -4964,14 +5014,14 @@ async function serveMcp() {
 
 // src/cli/mcp-http.ts
 import crypto7 from "node:crypto";
-import fs27 from "node:fs";
+import fs28 from "node:fs";
 import http2 from "node:http";
 import path23 from "node:path";
 
 // src/core/dash.ts
 import { spawn as spawn4 } from "node:child_process";
 import crypto6 from "node:crypto";
-import fs26 from "node:fs";
+import fs27 from "node:fs";
 import http from "node:http";
 import path22 from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
@@ -5091,9 +5141,9 @@ function fileDiffs(patch, changes, sourceTruncated = false) {
 // src/core/dash-page.ts
 var THEME_SCRIPT = "(function(){try{var t=localStorage.getItem('pitroom-theme');var d=t?t==='dark':matchMedia('(prefers-color-scheme: dark)').matches;document.documentElement.classList.toggle('dark',d)}catch(e){}})()";
 var ICON3 = "data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'%3E%3Crect width='32' height='32' rx='8' fill='%23ff6a2b'/%3E%3Cpath d='M9 8h4v4H9zm8 0h4v4h-4zm-4 4h4v4h-4zm8 0h4v4h-4zM9 16h4v4H9zm8 0h4v4h-4zm-4 4h4v4h-4zm8 0h4v4h-4z' fill='%23fff'/%3E%3C/svg%3E";
-var PAGE = `<!doctype html>
+var page = (token) => `<!doctype html>
 <html lang="en" class="dark"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
-<meta name="color-scheme" content="dark light"><title>Pitroom</title><link rel="icon" href="${ICON3}">
+<meta name="color-scheme" content="dark light"><meta name="pitroom-token" content="${token}"><title>Pitroom</title><link rel="icon" href="${ICON3}">
 <script>${THEME_SCRIPT}</script><link rel="stylesheet" href="/assets/app.css"></head>
 <body><div id="root"></div><script type="module" src="/assets/app.js"></script></body></html>`;
 var MISSING = `<!doctype html><meta charset="utf-8"><title>Pitroom</title><body style="font:15px system-ui;padding:3rem;max-width:40rem;margin:auto"><h1>Pitroom dash</h1><p>The dashboard files are missing (dist/ui). Run <code>npm run build</code> in the Pitroom repository, or reinstall the package.</p></body>`;
@@ -5114,6 +5164,7 @@ function findings(m) {
   const parts = [v.critical && `${v.critical} critical`, v.important && `${v.important} important`, v.minor && `${v.minor} minor`].filter(Boolean);
   return parts.length ? parts.join(" \xB7 ") : "no findings";
 }
+var canDiscard = (m) => m.mode === "isolate" && !isActive(m.state) && !m.applied && !m.discarded;
 function toRun(m) {
   const l = m.state === "running" ? live(m) : void 0;
   return {
@@ -5134,6 +5185,7 @@ function toRun(m) {
     audit: auditBadge(m),
     changes: m.changes?.length || void 0,
     applied: m.applied || void 0,
+    discardable: canDiscard(m) || void 0,
     note: l?.last ? oneLine7(String(l.last), 140) : isActive(m.state) ? "" : m.verifyResult && !m.verifyResult.ok ? `verify failed: ${m.verify ?? ""}` : m.verdict ? findings(m) : m.auditOf && m.state === "done" ? m.auditDisputed?.length ? `${m.auditDisputed.length} disputed` : "nothing disputed" : headline(m, 200) || oneLine7(m.error ?? "", 200)
   };
 }
@@ -5239,28 +5291,54 @@ var assetCache = /* @__PURE__ */ new Map();
 function readAsset(route) {
   try {
     const file2 = path22.join(assetsDir(), path22.basename(route));
-    const { mtimeMs } = fs26.statSync(file2);
+    const { mtimeMs } = fs27.statSync(file2);
     const hit = assetCache.get(route);
     if (hit && hit.mtimeMs === mtimeMs) return hit.data;
-    const data = fs26.readFileSync(file2);
+    const data = fs27.readFileSync(file2);
     assetCache.set(route, { mtimeMs, data });
     return data;
   } catch {
     return void 0;
   }
 }
-function handler(touch2) {
+function handler(touch2, token) {
   const send = (res, code, type, body) => {
     res.writeHead(code, { ...HEADERS, "content-type": type });
     res.end(body);
   };
   const json = (res, code, value) => send(res, code, "application/json; charset=utf-8", JSON.stringify(value));
+  const tokenBuf = Buffer.from(token);
+  const act = (req, res, pathname) => {
+    req.resume();
+    const given = Buffer.from(String(req.headers["x-pitroom-token"] ?? ""));
+    if (given.length !== tokenBuf.length || !crypto6.timingSafeEqual(given, tokenBuf)) return json(res, 403, { error: "forbidden" });
+    if (req.headers.origin !== `http://${req.headers.host}`) return json(res, 403, { error: "forbidden origin" });
+    const m = /^\/api\/run\/([^/]+)\/(stop|discard)$/.exec(pathname);
+    if (!m) return json(res, 404, { error: "not found" });
+    let meta;
+    try {
+      if (!RUN_ID3.test(m[1])) throw new Error("bad id");
+      meta = freshMeta(m[1]);
+    } catch {
+      return json(res, 404, { error: "no such run" });
+    }
+    try {
+      if (m[2] === "stop") {
+        return stopRun(meta.id) ? json(res, 200, { ok: true, message: `stopping ${meta.id}` }) : json(res, 409, { error: "run is not active" });
+      }
+      if (!canDiscard(meta)) return json(res, 409, { error: "only a finished, not yet applied isolate run can be discarded" });
+      return json(res, 200, { ok: true, message: discardRun(meta) });
+    } catch (e) {
+      return json(res, 409, { error: e.message });
+    }
+  };
   return (req, res) => {
     touch2();
     if (!LOCAL_HOST.test(req.headers.host ?? "")) return json(res, 403, { error: "forbidden host" });
-    if (req.method !== "GET" && req.method !== "HEAD") return json(res, 405, { error: "read-only" });
     const url = new URL(req.url ?? "/", "http://127.0.0.1");
-    if (url.pathname === "/") return send(res, 200, "text/html; charset=utf-8", readAsset("/assets/app.js") ? PAGE : MISSING);
+    if (req.method === "POST") return act(req, res, url.pathname);
+    if (req.method !== "GET" && req.method !== "HEAD") return json(res, 405, { error: "read-only" });
+    if (url.pathname === "/") return send(res, 200, "text/html; charset=utf-8", readAsset("/assets/app.js") ? page(token) : MISSING);
     const type = ASSETS[url.pathname];
     if (type) {
       const data = readAsset(url.pathname);
@@ -5301,7 +5379,7 @@ function handler(touch2) {
 }
 function startDash(opts) {
   let lastRequest = Date.now();
-  const server = http.createServer(handler(() => lastRequest = Date.now()));
+  const server = http.createServer(handler(() => lastRequest = Date.now(), crypto6.randomBytes(24).toString("hex")));
   return new Promise((resolve2, reject) => {
     server.once("error", reject);
     server.listen(opts.port, "127.0.0.1", () => {
@@ -5332,13 +5410,17 @@ async function ping(port) {
   }
 }
 async function runningDash() {
+  let r;
   try {
-    const r = JSON.parse(fs26.readFileSync(registryFile(), "utf8"));
-    if (isAlive(r.pid) && await ping(r.port)) return { ...r, url: `http://127.0.0.1:${r.port}/` };
+    r = JSON.parse(fs27.readFileSync(registryFile(), "utf8"));
   } catch {
+    return void 0;
   }
-  fs26.rmSync(registryFile(), { force: true });
-  return void 0;
+  if (!isAlive(r.pid)) {
+    fs27.rmSync(registryFile(), { force: true });
+    return void 0;
+  }
+  return await ping(r.port) ? { ...r, url: `http://127.0.0.1:${r.port}/` } : void 0;
 }
 function openBrowser(url) {
   const [cmd, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["cmd", ["/c", "start", "", url]] : ["xdg-open", [url]];
@@ -5352,7 +5434,7 @@ async function dashCommand(o) {
   if (o.stop) {
     if (!existing) throw new UserError("pitroom dash is not running");
     process.kill(existing.pid, "SIGTERM");
-    fs26.rmSync(registryFile(), { force: true });
+    fs27.rmSync(registryFile(), { force: true });
     o.log(`stopped pitroom dash (${existing.url})`);
     return 0;
   }
@@ -5369,7 +5451,7 @@ async function dashCommand(o) {
     });
     child.on("error", () => void 0);
     child.unref();
-    for (let i = 0; i < 60; i++) {
+    for (let i = 0; i < 200; i++) {
       await new Promise((r2) => setTimeout(r2, 100));
       const r = await runningDash();
       if (r && r.pid === child.pid) {
@@ -5389,8 +5471,10 @@ async function dashCommand(o) {
     if (explicit || e.code !== "EADDRINUSE") throw new UserError(`pitroom dash: ${e.message}`);
     dash = await startDash({ port: 0, idleMs: o.idleMs });
   }
-  fs26.mkdirSync(home(), { recursive: true });
-  fs26.writeFileSync(registryFile(), JSON.stringify({ pid: process.pid, port: dash.port }));
+  fs27.mkdirSync(home(), { recursive: true });
+  const tmp = `${registryFile()}.${process.pid}.tmp`;
+  fs27.writeFileSync(tmp, JSON.stringify({ pid: process.pid, port: dash.port }));
+  renameOver(tmp, registryFile());
   const stop = () => void dash.close();
   process.once("SIGINT", stop);
   process.once("SIGTERM", stop);
@@ -5399,7 +5483,7 @@ async function dashCommand(o) {
   if (o.open) openBrowser(dash.url);
   await dash.closed;
   try {
-    if (JSON.parse(fs26.readFileSync(registryFile(), "utf8")).pid === process.pid) fs26.rmSync(registryFile(), { force: true });
+    if (JSON.parse(fs27.readFileSync(registryFile(), "utf8")).pid === process.pid) fs27.rmSync(registryFile(), { force: true });
   } catch {
   }
   return 0;
@@ -5414,7 +5498,7 @@ var PATH = "/mcp";
 var tokenFile = () => path23.join(home(), "mcp-token");
 var readToken = (file2) => {
   try {
-    const kept = fs27.readFileSync(file2, "utf8").trim();
+    const kept = fs28.readFileSync(file2, "utf8").trim();
     return kept.length >= 16 ? kept : void 0;
   } catch {
     return void 0;
@@ -5429,10 +5513,10 @@ function mcpToken() {
   const file2 = tokenFile();
   let token = readToken(file2);
   if (!token) {
-    fs27.mkdirSync(path23.dirname(file2), { recursive: true });
+    fs28.mkdirSync(path23.dirname(file2), { recursive: true });
     token = crypto7.randomBytes(32).toString("hex");
     try {
-      fs27.writeFileSync(file2, `${token}
+      fs28.writeFileSync(file2, `${token}
 `, { mode: 384, flag: "wx" });
     } catch (e) {
       if (e.code !== "EEXIST") throw e;
@@ -5441,7 +5525,7 @@ function mcpToken() {
     }
   }
   try {
-    fs27.chmodSync(file2, 384);
+    fs28.chmodSync(file2, 384);
   } catch {
   }
   return { token, from: file2 };
@@ -5623,16 +5707,16 @@ async function serveMcpHttp(opts) {
 
 // src/cli/commands.ts
 import { spawnSync as spawnSync8 } from "node:child_process";
-import fs33 from "node:fs";
+import fs34 from "node:fs";
 import path29 from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 
 // src/core/init.ts
-import fs28 from "node:fs";
+import fs29 from "node:fs";
 import path24 from "node:path";
 var FREE = /-free$/;
 var TIER_ORDER = [["cheap", "opencode"], ["standard", "codex"], ["capable", "claude"]];
-var isFound = (binary5) => path24.isAbsolute(binary5) && fs28.existsSync(binary5);
+var isFound = (binary5) => path24.isAbsolute(binary5) && fs29.existsSync(binary5);
 function planInit(opts = {}) {
   const file2 = configPath();
   const workers = backendIds().map((id) => {
@@ -5678,15 +5762,15 @@ function planInit(opts = {}) {
   if (Object.keys(tiers).length > 1) config.tiers = tiers;
   if (!workers.some((w) => w.found)) blocked = "no worker CLI found: install OpenCode (https://opencode.ai), Codex CLI, Claude Code or Gemini CLI first";
   else if (!blocked && !Object.keys(config).length) notes.push("nothing to propose: the default model and the single worker need no config");
-  return { path: file2, exists: fs28.existsSync(file2), workers, opencode: opencode2, config, blocked, notes };
+  return { path: file2, exists: fs29.existsSync(file2), workers, opencode: opencode2, config, blocked, notes };
 }
 function writeInit(plan, force) {
   if (plan.blocked) throw new UserError(plan.blocked);
   if (!Object.keys(plan.config).length) throw new UserError("nothing to write: the proposal is empty");
   if (plan.exists && !force) throw new UserError(`${plan.path} already exists: pass --force to replace it (the old file is kept as ${path24.basename(plan.path)}.bak)`);
-  fs28.mkdirSync(path24.dirname(plan.path), { recursive: true });
-  if (plan.exists) fs28.copyFileSync(plan.path, `${plan.path}.bak`);
-  fs28.writeFileSync(plan.path, `${JSON.stringify(plan.config, null, 2)}
+  fs29.mkdirSync(path24.dirname(plan.path), { recursive: true });
+  if (plan.exists) fs29.copyFileSync(plan.path, `${plan.path}.bak`);
+  fs29.writeFileSync(plan.path, `${JSON.stringify(plan.config, null, 2)}
 `);
   return plan.path;
 }
@@ -5707,7 +5791,7 @@ function formatInit(plan, written) {
 
 // src/core/mcp-install.ts
 import { spawnSync as spawnSync7 } from "node:child_process";
-import fs29 from "node:fs";
+import fs30 from "node:fs";
 import os10 from "node:os";
 import path25 from "node:path";
 var CLIENT_IDS = ["claude-code", "codex", "gemini", "cursor", "claude-desktop"];
@@ -5717,7 +5801,7 @@ function mcpCommand() {
   if (isPitroomLauncher(launcher)) return { command: launcher, args: ["mcp"] };
   for (const dir of (process.env.PATH ?? "").split(path25.delimiter).filter(Boolean)) {
     const p = path25.join(dir, process.platform === "win32" ? "pitroom.cmd" : "pitroom");
-    if (fs29.existsSync(p)) return { command: path25.resolve(p), args: ["mcp"] };
+    if (fs30.existsSync(p)) return { command: path25.resolve(p), args: ["mcp"] };
   }
   return { command: process.execPath, args: [process.argv[1] ?? "pitroom", "mcp"] };
 }
@@ -5733,7 +5817,7 @@ function run(backendId, args) {
 var runnable = (backendId) => run(backendId, ["--version"]).ok;
 var readJson = (file2) => {
   try {
-    return JSON.parse(fs29.readFileSync(file2, "utf8"));
+    return JSON.parse(fs30.readFileSync(file2, "utf8"));
   } catch {
     return void 0;
   }
@@ -5766,29 +5850,29 @@ function jsonClient(id, name, file2, dir) {
   return {
     id,
     name,
-    found: () => fs29.existsSync(dir()),
+    found: () => fs30.existsSync(dir()),
     state: (c) => jsonState(file2(), c),
     add: (c) => {
       let config = {};
-      if (fs29.existsSync(file2())) {
+      if (fs30.existsSync(file2())) {
         config = readJson(file2());
         if (!config || typeof config !== "object" || Array.isArray(config)) return { ok: false, message: `${rel()} is not valid JSON: left alone` };
         const backup = `${file2()}.bak-pitroom`;
-        if (!fs29.existsSync(backup)) fs29.copyFileSync(file2(), backup);
+        if (!fs30.existsSync(backup)) fs30.copyFileSync(file2(), backup);
       }
       config.mcpServers = { ...config.mcpServers ?? {}, [NAME]: { command: c.command, args: c.args } };
-      fs29.mkdirSync(path25.dirname(file2()), { recursive: true });
+      fs30.mkdirSync(path25.dirname(file2()), { recursive: true });
       const tmp = `${file2()}.${process.pid}.tmp`;
-      fs29.writeFileSync(tmp, `${JSON.stringify(config, null, 2)}
+      fs30.writeFileSync(tmp, `${JSON.stringify(config, null, 2)}
 `);
-      fs29.renameSync(tmp, file2());
+      fs30.renameSync(tmp, file2());
       return { ok: true, message: rel() };
     },
     remove: () => {
       const config = readJson(file2());
       if (!config?.mcpServers?.[NAME]) return { ok: true, message: rel() };
       delete config.mcpServers[NAME];
-      fs29.writeFileSync(file2(), `${JSON.stringify(config, null, 2)}
+      fs30.writeFileSync(file2(), `${JSON.stringify(config, null, 2)}
 `);
       return { ok: true, message: rel() };
     }
@@ -5802,7 +5886,7 @@ function desktopFile() {
 function codexState(c) {
   let text;
   try {
-    text = fs29.readFileSync(path25.join(process.env.CODEX_HOME ?? path25.join(home2(), ".codex"), "config.toml"), "utf8");
+    text = fs30.readFileSync(path25.join(process.env.CODEX_HOME ?? path25.join(home2(), ".codex"), "config.toml"), "utf8");
   } catch {
     return "absent";
   }
@@ -5906,7 +5990,7 @@ var parseClients = (value) => {
 
 // src/core/plan-status.ts
 import crypto8 from "node:crypto";
-import fs30 from "node:fs";
+import fs31 from "node:fs";
 import path26 from "node:path";
 function notesFile(plan) {
   const id = crypto8.createHash("sha1").update(plan.file).digest("hex").slice(0, 12);
@@ -5914,8 +5998,8 @@ function notesFile(plan) {
 }
 function readNotes(plan) {
   const f = notesFile(plan);
-  if (!fs30.existsSync(f)) return [];
-  return fs30.readFileSync(f, "utf8").split("\n").slice(1).filter(Boolean).map((l) => {
+  if (!fs31.existsSync(f)) return [];
+  return fs31.readFileSync(f, "utf8").split("\n").slice(1).filter(Boolean).map((l) => {
     const m = /^(\d{4}-\d\d-\d\d \d\d:\d\d) (.*)$/.exec(l);
     return m ? { at: m[1], text: m[2] } : { at: "", text: l };
   });
@@ -5923,11 +6007,11 @@ function readNotes(plan) {
 function addNote(planFile, text) {
   const plan = loadPlan(planFile);
   const f = notesFile(plan);
-  fs30.mkdirSync(path26.dirname(f), { recursive: true });
-  if (!fs30.existsSync(f)) fs30.writeFileSync(f, `# plan: ${plan.file}
+  fs31.mkdirSync(path26.dirname(f), { recursive: true });
+  if (!fs31.existsSync(f)) fs31.writeFileSync(f, `# plan: ${plan.file}
 `);
   const at = (/* @__PURE__ */ new Date()).toISOString().slice(0, 16).replace("T", " ");
-  fs30.appendFileSync(f, `${at} ${text.replace(/\s+/g, " ").trim()}
+  fs31.appendFileSync(f, `${at} ${text.replace(/\s+/g, " ").trim()}
 `);
   return f;
 }
@@ -5995,13 +6079,13 @@ ${rulings}`,
 
 // src/core/cache.ts
 import crypto9 from "node:crypto";
-import fs31 from "node:fs";
+import fs32 from "node:fs";
 import path27 from "node:path";
 var SCAN2 = 500;
 function cacheKey(o) {
   if (o.verify || o.mode !== "read" || o.continueFrom || o.web || o.plan || o.review || o.audit || o.auditRate === 1) return void 0;
   if (!(effective().cacheDays.value > 0)) return void 0;
-  const dir = path27.resolve(o.dir);
+  const dir = canonical(path27.resolve(o.dir));
   const root = repoRoot(dir);
   if (!root) return void 0;
   try {
@@ -6009,7 +6093,7 @@ function cacheKey(o) {
     const head = commitOf(root, "HEAD") ?? "";
     const files = o.files.map((f) => {
       const abs = path27.resolve(f);
-      return [abs, crypto9.createHash("sha256").update(fs31.readFileSync(abs)).digest("hex")];
+      return [abs, crypto9.createHash("sha256").update(fs32.readFileSync(abs)).digest("hex")];
     });
     const question = o.task.replace(/\s+/g, " ").trim();
     const readIn2 = READ_IN.includes(effective().readIn.value) ? effective().readIn.value : "auto";
@@ -6058,7 +6142,7 @@ var cachedNote = (m) => `pitroom \u27F2 cached answer \xB7 the same question on
 
 // src/core/review.ts
 import crypto10 from "node:crypto";
-import fs32 from "node:fs";
+import fs33 from "node:fs";
 import path28 from "node:path";
 var TEMPLATE2 = { task: "task-reviewer", fix: "re-review", range: "code-reviewer" };
 var section = (title, body) => `## ${title}
@@ -6077,7 +6161,7 @@ function ancestors(m) {
 function briefOf(m) {
   const root = [m, ...ancestors(m)].at(-1);
   const f = runFile(root.id, "brief.md");
-  return fs32.existsSync(f) ? fs32.readFileSync(f, "utf8") : root.task;
+  return fs33.existsSync(f) ? fs33.readFileSync(f, "utf8") : root.task;
 }
 function latestReview(ids) {
   for (const id of listRunIds().reverse()) {
@@ -6091,7 +6175,7 @@ function latestReview(ids) {
 }
 function diffOf(m, from = m.baseTree) {
   const where = m.mode === "isolate" ? m.worktree : m.repoRoot;
-  if (where && fs32.existsSync(where) && from && m.afterTree) return reviewDiff(where, from, m.afterTree);
+  if (where && fs33.existsSync(where) && from && m.afterTree) return reviewDiff(where, from, m.afterTree);
   if (from !== m.baseTree) {
     throw new UserError(`the isolated copy of ${m.id} is gone, so its fix round cannot be shown on its own; review a run that is not applied yet`, 3);
   }
@@ -6105,7 +6189,7 @@ function runReview(id) {
   if (!m.changes?.length) throw new UserError(`run ${m.id} made no changes; nothing to review`);
   const chain = ancestors(m);
   const previous = latestReview(chain.map((a) => a.id));
-  const dir = m.mode === "isolate" && m.worktree && fs32.existsSync(m.worktree) ? m.cwd : m.dir;
+  const dir = m.mode === "isolate" && m.worktree && fs33.existsSync(m.worktree) ? m.cwd : m.dir;
   const job = { of: m.id, dir, implementer: m.ran ?? m.worker, group: m.group, plan: m.plan };
   const title = m.plan ? `Task ${m.plan.step}: ${m.plan.title}` : `run ${m.id}`;
   if (!previous) {
@@ -6181,19 +6265,19 @@ function writePackage(job) {
   const root = repoRoot(job.dir);
   if (!g || !root) throw new UserError(`not a git repository: ${job.dir}`);
   const name = `review-${crypto10.randomBytes(4).toString("hex")}.md`;
-  const inside2 = !path28.relative(fs32.realpathSync(root), fs32.realpathSync(g)).startsWith("..");
+  const inside2 = !path28.relative(fs33.realpathSync(root), fs33.realpathSync(g)).startsWith("..");
   const file2 = inside2 ? path28.join(g, "pitroom", name) : path28.join(root, ".pitroom", name);
   if (!inside2) ignoreInGit(root, "/.pitroom/");
-  fs32.mkdirSync(path28.dirname(file2), { recursive: true });
-  fs32.writeFileSync(file2, job.package);
+  fs33.mkdirSync(path28.dirname(file2), { recursive: true });
+  fs33.writeFileSync(file2, job.package);
   return file2;
 }
 function ignoreInGit(root, pattern) {
   const exclude = path28.resolve(root, git(root, ["rev-parse", "--git-path", "info/exclude"]).stdout.trim());
-  const text = fs32.existsSync(exclude) ? fs32.readFileSync(exclude, "utf8") : "";
+  const text = fs33.existsSync(exclude) ? fs33.readFileSync(exclude, "utf8") : "";
   if (text.split(/\r?\n/).includes(pattern)) return;
-  fs32.mkdirSync(path28.dirname(exclude), { recursive: true });
-  fs32.appendFileSync(exclude, `${text && !text.endsWith("\n") ? "\n" : ""}# Pitroom review packages in worktrees (removed after each review)
+  fs33.mkdirSync(path28.dirname(exclude), { recursive: true });
+  fs33.appendFileSync(exclude, `${text && !text.endsWith("\n") ? "\n" : ""}# Pitroom review packages in worktrees (removed after each review)
 ${pattern}
 `);
 }
@@ -6349,10 +6433,10 @@ async function cmdReview(p) {
       writeMeta(meta);
     }
   } catch (e) {
-    fs33.rmSync(packageFile, { force: true });
+    fs34.rmSync(packageFile, { force: true });
     throw e;
   }
-  fs33.writeFileSync(runFile(meta.id, "package.md"), job.package);
+  fs34.writeFileSync(runFile(meta.id, "package.md"), job.package);
   return launch(p, meta);
 }
 async function cmdAudit(p) {
@@ -6420,7 +6504,7 @@ function cmdPlan(p) {
 }
 function cmdCrew(p) {
   const file2 = flag(p, "task-file");
-  const tasks = (file2 ? fs33.readFileSync(file2, "utf8").split(/^\s*---\s*$/m) : p.positional).map((t) => t.trim()).filter(Boolean);
+  const tasks = (file2 ? fs34.readFileSync(file2, "utf8").split(/^\s*---\s*$/m) : p.positional).map((t) => t.trim()).filter(Boolean);
   if (!tasks.length) throw new UserError('crew needs tasks: pitroom crew -g NAME "task 1" "task 2" (or --task-file with --- separators)');
   if (has(p, "write") && tasks.length > 1) {
     throw new UserError("parallel --write runs would edit the same tree; use --isolate (each worker gets its own isolated copy)");
@@ -6606,11 +6690,8 @@ function cmdStop(p) {
   const ids = selectIds(p, () => [resolveRun(void 0)]);
   let stopped = 0;
   for (const id of ids) {
-    const meta = freshMeta(id);
-    if (!isActive(meta.state) || !isAlive(meta.pid)) continue;
-    meta.stopRequested = true;
-    writeMeta(meta);
-    process.kill(meta.pid, "SIGTERM");
+    const meta = stopRun(id);
+    if (!meta) continue;
     console.log(`stopping ${meta.id} (${meta.state})`);
     stopped++;
   }
@@ -6623,13 +6704,13 @@ function sinceMs(s) {
   if (!m) throw new UserError("--since takes 7d, 30d, \u2026 or all");
   return Date.now() - Number(m[1]) * 864e5;
 }
-var readStdin = () => process.stdin.isTTY ? "" : fs33.readFileSync(0, "utf8");
+var readStdin = () => process.stdin.isTTY ? "" : fs34.readFileSync(0, "utf8");
 function cmdStatusline(p) {
   const input = readStdin();
   const lines = [];
   const then = flag(p, "then");
   if (then) {
-    const r = spawnSync8("/bin/sh", ["-c", then], { input, encoding: "utf8", timeout: 5e3 });
+    const r = process.platform === "win32" ? spawnSync8(then, { shell: true, input, encoding: "utf8", timeout: 5e3 }) : spawnSync8("/bin/sh", ["-c", then], { input, encoding: "utf8", timeout: 5e3 });
     if (r.stdout?.trimEnd()) lines.push(r.stdout.trimEnd());
   }
   try {
@@ -6664,7 +6745,7 @@ function cmdModels(p) {
 }
 function cmdHookStart() {
   const script = path29.join(path29.dirname(path29.dirname(fileURLToPath4(import.meta.url))), "hooks", "session-start.mjs");
-  if (fs33.existsSync(script)) spawnSync8(process.execPath, [script], { stdio: ["ignore", "inherit", "ignore"], env: process.env });
+  if (fs34.existsSync(script)) spawnSync8(process.execPath, [script], { stdio: ["ignore", "inherit", "ignore"], env: process.env });
   return 0;
 }
 function cmdInit(p) {
@@ -6704,7 +6785,7 @@ function cmdSavings(p) {
   est. saved          ${usd(t.saved)}  (vs ${primaryPrice().name} list prices)`);
   const out = flag(p, "card");
   if (out) {
-    fs33.writeFileSync(out, card(t, period));
+    fs34.writeFileSync(out, card(t, period));
     console.log(`card written to ${path29.resolve(out)}`);
   }
   if (has(p, "badge")) console.log(`![pitroom](${badgeUrl(t)})`);
@@ -6747,7 +6828,7 @@ function cmdConfig(p) {
     console.log(JSON.stringify({ path: configPath(), settings: eff, warnings }, null, 2));
     return 0;
   }
-  console.log(`config file: ${configPath()}${fs33.existsSync(configPath()) ? "" : " (not present)"}`);
+  console.log(`config file: ${configPath()}${fs34.existsSync(configPath()) ? "" : " (not present)"}`);
   for (const [key, s] of Object.entries(eff)) {
     const v = Array.isArray(s.value) ? s.value.join(", ") || "\u2014" : s.value && typeof s.value === "object" ? Object.entries(s.value).map(([k, m]) => `${k}=${m}`).join(", ") || "\u2014" : s.value === void 0 ? key === "model" ? "the worker's default" : "\u2014" : String(s.value);
     console.log(`  ${key.padEnd(15)} ${v}  (${s.source})`);
@@ -6771,7 +6852,7 @@ function cmdClean(p) {
     const m = readMeta(id);
     if (m.mode === "isolate" && !m.discarded && !m.applied) discardRun(m);
     recordRun(m);
-    fs33.rmSync(runDir(id), { recursive: true, force: true });
+    fs34.rmSync(runDir(id), { recursive: true, force: true });
   }
   const snapshots = prune(Date.now(), 0);
   console.log(`removed ${old.length} run(s)${snapshots ? ` and ${snapshots} read snapshot${snapshots === 1 ? "" : "s"}` : ""}; the history and the savings ledger are kept`);
@@ -6782,7 +6863,7 @@ var cmdDiscard = (p) => (console.log(discardRun(freshMeta(resolveRun(p.positiona
 
 // src/core/doctor.ts
 import { spawnSync as spawnSync9 } from "node:child_process";
-import fs34 from "node:fs";
+import fs35 from "node:fs";
 import os11 from "node:os";
 import path30 from "node:path";
 var MARK = { ok: () => green("\u2714"), warn: () => yellow("!"), fail: () => red("\u2718") };
@@ -6793,11 +6874,24 @@ var NEXT = [
   { when: /not logged in/, command: "claude auth login", why: "sign in the Claude Code worker (Codex: codex login)" },
   { when: /Gemini CLI is not signed in|IneligibleTierError/, command: "export GEMINI_API_KEY=\u2026", why: "a Google AI Studio key for the Gemini worker" }
 ];
+function usageLine() {
+  const ids = listRunIds();
+  if (!ids.length) {
+    return 'no runs yet. Ask your agent to use Pitroom (for example "have a worker find where X is defined"), or try it yourself: pitroom run "where is <something> defined?"';
+  }
+  let when2 = "";
+  try {
+    const hours = Math.max(0, Math.round((Date.now() - Date.parse(readMeta(ids[ids.length - 1]).startedAt)) / 36e5));
+    when2 = hours < 1 ? ", the last one within the hour" : hours < 48 ? `, the last one ${hours} h ago` : `, the last one ${Math.round(hours / 24)} days ago`;
+  } catch {
+  }
+  return `${ids.length} run${ids.length === 1 ? "" : "s"} so far${when2} (pitroom savings shows what they saved)`;
+}
 function firstNodeOnPath() {
   for (const dir of (process.env.PATH ?? "").split(path30.delimiter).filter(Boolean)) {
     const file2 = path30.join(dir, process.platform === "win32" ? "node.exe" : "node");
     try {
-      if (!fs34.statSync(file2).isFile()) continue;
+      if (!fs35.statSync(file2).isFile()) continue;
     } catch {
       continue;
     }
@@ -6829,9 +6923,11 @@ function doctor5(probe) {
   }
   add(gitAvailable() ? "ok" : "warn", gitAvailable() ? "git available" : "git not found: --write/--isolate tracking disabled");
   const cfg = loadConfig();
-  add(cfg.warnings.length ? "warn" : "ok", `config: ${configPath()}${fs34.existsSync(configPath()) ? "" : " (not present, defaults in use)"}`);
+  add(cfg.warnings.length ? "warn" : "ok", `config: ${configPath()}${fs35.existsSync(configPath()) ? "" : " (not present, defaults in use)"}`);
   for (const w of cfg.warnings) add("warn", w);
-  if (process.platform !== "win32") {
+  if (process.platform === "win32") {
+    add("warn", "git guard: not available on Windows yet, so Pitroom does not block a worker's git history changes or pushes there (read-only runs are still limited by each worker CLI's own rules, and --isolate keeps edits in a copy); prefer --isolate and check the patch before apply");
+  } else {
     const guarded = guardEnv(process.env).PATH?.startsWith(shimDir());
     add(guarded ? "ok" : "warn", guarded ? "git guard shim ready" : "git guard unavailable (git not on PATH)");
   }
@@ -6908,6 +7004,8 @@ function doctor5(probe) {
   for (const m of stale) add("warn", `${m.name} runs a different command for pitroom mcp than this install's: \`pitroom install --mcp --no-skills\` updates it`);
   section2("Skills and agents");
   addAll(skillChecks());
+  section2("Use");
+  add("ok", usageLine());
   if (probe && chain[0]) {
     section2("Live probe");
     const p = liveProbe(chain[0]);
@@ -6994,8 +7092,8 @@ function skillChecks() {
     );
   }
   const launcher = launcherPath();
-  if (fs34.existsSync(launcher)) {
-    const r = spawnSync9(launcher, ["--version"], { encoding: "utf8", timeout: 3e4, stdio: ["ignore", "pipe", "pipe"] });
+  if (fs35.existsSync(launcher)) {
+    const r = spawnSync9(launcher, ["--version"], { encoding: "utf8", timeout: 3e4, stdio: ["ignore", "pipe", "pipe"], shell: process.platform === "win32" });
     checks.push(
       r.status === 0 ? { level: "ok", message: `launcher ${launcher} \u2192 pitroom ${r.stdout.trim()}` } : { level: "fail", message: `launcher ${launcher} does not start: ${(r.stderr || r.stdout).trim().slice(0, 200)}` }
     );
@@ -7006,12 +7104,12 @@ function skillChecks() {
 }
 function geminiExtensionInstalled() {
   const home3 = process.env.GEMINI_CLI_HOME ?? os11.homedir();
-  return fs34.existsSync(path30.join(home3, ".gemini", "extensions", "pitroom"));
+  return fs35.existsSync(path30.join(home3, ".gemini", "extensions", "pitroom"));
 }
 function pluginInstalled() {
   try {
     const f = path30.join(os11.homedir(), ".claude", "plugins", "installed_plugins.json");
-    const plugins = JSON.parse(fs34.readFileSync(f, "utf8")).plugins ?? {};
+    const plugins = JSON.parse(fs35.readFileSync(f, "utf8")).plugins ?? {};
     return Object.keys(plugins).some((k) => k.startsWith("pitroom@"));
   } catch {
     return false;
@@ -7030,14 +7128,14 @@ function superpowersActive() {
   }
   for (const base2 of [path30.join(os11.homedir(), ".agents", "skills"), path30.join(os11.homedir(), ".claude", "skills")]) {
     const dir = path30.join(base2, "using-superpowers");
-    if (fs34.existsSync(path30.join(dir, "SKILL.md"))) found.push(dir);
+    if (fs35.existsSync(path30.join(dir, "SKILL.md"))) found.push(dir);
   }
   return found;
 }
 function claudePlugins() {
   try {
     const f = path30.join(os11.homedir(), ".claude", "plugins", "installed_plugins.json");
-    return Object.keys(JSON.parse(fs34.readFileSync(f, "utf8")).plugins ?? {});
+    return Object.keys(JSON.parse(fs35.readFileSync(f, "utf8")).plugins ?? {});
   } catch {
     return [];
   }
@@ -7045,7 +7143,7 @@ function claudePlugins() {
 function claudePluginEnabled(key) {
   try {
     const f = path30.join(os11.homedir(), ".claude", "settings.json");
-    return JSON.parse(fs34.readFileSync(f, "utf8")).enabledPlugins?.[key] !== false;
+    return JSON.parse(fs35.readFileSync(f, "utf8")).enabledPlugins?.[key] !== false;
   } catch {
     return true;
   }
@@ -7054,7 +7152,7 @@ function codexPlugins() {
   const plugins = /* @__PURE__ */ new Map();
   let text;
   try {
-    text = fs34.readFileSync(path30.join(process.env.CODEX_HOME ?? path30.join(os11.homedir(), ".codex"), "config.toml"), "utf8");
+    text = fs35.readFileSync(path30.join(process.env.CODEX_HOME ?? path30.join(os11.homedir(), ".codex"), "config.toml"), "utf8");
   } catch {
     return plugins;
   }
@@ -7076,7 +7174,7 @@ function openCodePlugins() {
   const plugins = [];
   for (const name of ["opencode.json", "opencode.jsonc"]) {
     try {
-      const text = fs34.readFileSync(path30.join(dir, name), "utf8").replace(/\/\*[\s\S]*?\*\/|^\s*\/\/.*$/gm, "");
+      const text = fs35.readFileSync(path30.join(dir, name), "utf8").replace(/\/\*[\s\S]*?\*\/|^\s*\/\/.*$/gm, "");
       const list2 = JSON.parse(text).plugin;
       if (Array.isArray(list2)) plugins.push(...list2.filter((p) => typeof p === "string"));
     } catch {
@@ -7084,7 +7182,7 @@ function openCodePlugins() {
   }
   for (const folder of ["plugin", "plugins"]) {
     try {
-      for (const f of fs34.readdirSync(path30.join(dir, folder))) plugins.push(path30.join(dir, folder, f));
+      for (const f of fs35.readdirSync(path30.join(dir, folder))) plugins.push(path30.join(dir, folder, f));
     } catch {
     }
   }
@@ -7201,7 +7299,7 @@ var COMMANDS = {
     if (port !== void 0 && !(/^\d+$/.test(port) && Number(port) <= 65535)) throw new UserError("--port takes a number from 0 to 65535 (0 picks a free one)");
     const dir = flag(p, "dir");
     if (dir !== void 0) {
-      if (!fs35.statSync(dir, { throwIfNoEntry: false })?.isDirectory()) throw new UserError(`-d ${dir}: no such directory`);
+      if (!fs36.statSync(dir, { throwIfNoEntry: false })?.isDirectory()) throw new UserError(`-d ${dir}: no such directory`);
       process.chdir(dir);
       process.env.PWD = process.cwd();
     }