pitroom 0.23.0 → 0.24.1

package/dist/lib.mjs

@@ -6,56 +6,848 @@ var UserError = class extends Error {
   }
 };
 
-// src/backends/claude/index.ts
+// src/backends/antigravity/index.ts
+import crypto3 from "node:crypto";
 import { spawnSync } from "node:child_process";
-import fs2 from "node:fs";
-import os2 from "node:os";
-import path2 from "node:path";
+import fs6 from "node:fs";
+import os3 from "node:os";
+import path5 from "node:path";
 
-// src/backends/exec.ts
+// src/core/secrets.ts
+import { execFileSync } from "node:child_process";
 import fs from "node:fs";
-import os from "node:os";
 import path from "node:path";
+var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", "build", "out", ".next", "target", "vendor", ".venv", "venv", "__pycache__", "coverage", ".turbo", ".cache"]);
+var MAX_VISITED = 2e4;
+var MAX_DEPTH = 4;
+var TEMPLATE = /\.(example|sample|template|dist|defaults?|tpl)$/i;
+function looksSecret(file) {
+  const name = file.toLowerCase();
+  if (TEMPLATE.test(name)) return false;
+  if (name === ".env" || name.startsWith(".env.") || name.endsWith(".env")) return true;
+  return /\.(pem|p12|pfx|key|jks|keystore)$/.test(name) || /^id_(rsa|dsa|ecdsa|ed25519)$/.test(name) || name === ".netrc" || name === "credentials.json" || /^secrets?\.(json|ya?ml|toml)$/.test(name);
+}
+function findSecretFiles(dir) {
+  const found = [];
+  let visited = 0;
+  const walk = (d, depth) => {
+    if (depth > MAX_DEPTH || visited > MAX_VISITED) return;
+    let entries;
+    try {
+      entries = fs.readdirSync(d, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const e of entries) {
+      visited++;
+      if (e.isDirectory()) {
+        if (!SKIP_DIRS.has(e.name)) walk(path.join(d, e.name), depth + 1);
+      } else if (e.isFile() && looksSecret(e.name)) {
+        found.push(slash(path.relative(dir, path.join(d, e.name))));
+      }
+    }
+  };
+  walk(dir, 0);
+  return found.sort();
+}
+function findSecretFilesInTree(root, dir) {
+  try {
+    const out = execFileSync("git", ["-C", root, "ls-files", "-z", "--cached", "--others", "--exclude-standard"], { encoding: "utf8", maxBuffer: 256 * 1024 * 1024 });
+    return out.split("\0").filter((f) => f && looksSecret(path.basename(f)) && !path.relative(dir, path.join(root, f)).startsWith("..")).map((f) => slash(path.relative(dir, path.join(root, f)))).sort();
+  } catch {
+    return [];
+  }
+}
+function secretWarning(files, mode) {
+  if (!files.length) return void 0;
+  const shown = files.slice(0, 3).join(", ") + (files.length > 3 ? `, +${files.length - 3} more` : "");
+  const where = mode === "isolate" ? "would be copied into the isolated copy" : "sit in the directory the worker runs in";
+  const fix = mode === "isolate" ? "add them to .gitignore, or" : "use an isolated copy (-i, git-ignored files are left out) or a clean checkout, or";
+  return `secret-looking files ${where} (${shown}): the worker is told not to read them, but nothing stops it, and its model may be hosted by a third party; ${fix} set PITROOM_NO_SECRET_WARNING=1 to silence this`;
+}
+var slash = (p) => p.split(path.sep).join("/");
+
+// src/core/store.ts
+import fs3 from "node:fs";
+import os from "node:os";
+import path2 from "node:path";
+import crypto from "node:crypto";
+
+// src/core/fs-atomic.ts
+import fs2 from "node:fs";
+var BUSY = /* @__PURE__ */ new Set(["EPERM", "EBUSY", "EACCES"]);
+function renameOver(tmp, file) {
+  for (let attempt = 0; ; attempt++) {
+    try {
+      fs2.renameSync(tmp, file);
+      return;
+    } catch (e) {
+      if (process.platform !== "win32" || !BUSY.has(e.code ?? "") || attempt >= 40) throw e;
+      Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 25);
+    }
+  }
+}
+
+// src/core/store.ts
+var TERMINAL = ["done", "failed", "timeout", "stopped"];
+var isActive = (s) => !TERMINAL.includes(s);
+function home() {
+  if (process.env.PITROOM_HOME) return path2.resolve(process.env.PITROOM_HOME);
+  if (process.platform === "win32") {
+    return path2.join(process.env.LOCALAPPDATA ?? path2.join(os.homedir(), "AppData", "Local"), "pitroom");
+  }
+  return path2.join(process.env.XDG_STATE_HOME ?? path2.join(os.homedir(), ".local", "state"), "pitroom");
+}
+var runsDir = () => path2.join(home(), "runs");
+var ledgerFile = () => path2.join(home(), "ledger.jsonl");
+var runDir = (id2) => path2.join(runsDir(), id2);
+var runFile = (id2, name) => path2.join(runDir(id2), name);
+function newRunId(now = /* @__PURE__ */ new Date()) {
+  const p = (n) => String(n).padStart(2, "0");
+  const stamp2 = `${now.getFullYear()}${p(now.getMonth() + 1)}${p(now.getDate())}-${p(now.getHours())}${p(now.getMinutes())}${p(now.getSeconds())}`;
+  return `${stamp2}-${crypto.randomBytes(2).toString("hex")}`;
+}
+var onFinished;
+var archive;
+function writeMeta(meta) {
+  fs3.mkdirSync(runDir(meta.id), { recursive: true });
+  const file = runFile(meta.id, "meta.json");
+  const tmp = `${file}.${process.pid}.tmp`;
+  fs3.writeFileSync(tmp, JSON.stringify(meta, null, 2));
+  renameOver(tmp, file);
+  if (TERMINAL.includes(meta.state)) {
+    try {
+      onFinished?.(meta);
+    } catch {
+    }
+  }
+}
+function readMeta(id2) {
+  const file = runFile(id2, "meta.json");
+  if (!fs3.existsSync(file)) {
+    const kept = archive?.meta(id2);
+    if (kept) return upgrade(kept);
+  }
+  return upgrade(JSON.parse(fs3.readFileSync(file, "utf8")));
+}
+function upgrade(raw) {
+  if (!raw.worker) raw.worker = raw.model ? { backend: "opencode", model: raw.model } : { backend: "opencode" };
+  if (!Array.isArray(raw.fallback)) {
+    raw.fallback = (raw.fallbackModels ?? []).map((m) => ({ backend: "opencode", model: m }));
+  }
+  raw.warnings ??= [];
+  raw.files ??= [];
+  raw.link ??= [];
+  return raw;
+}
+function listRunIds() {
+  if (!fs3.existsSync(runsDir())) return [];
+  return fs3.readdirSync(runsDir()).filter((d) => fs3.existsSync(runFile(d, "meta.json"))).sort();
+}
+function resolveRun(ref) {
+  const ids = listRunIds();
+  if (!ref || ref === "latest" || ref === "last") {
+    if (!ids.length) throw new UserError("no runs yet");
+    return ids[ids.length - 1];
+  }
+  if (ids.includes(ref)) return ref;
+  const hits = ids.filter((id2) => id2.startsWith(ref) || id2.endsWith(ref));
+  if (hits.length === 1) return hits[0];
+  if (!hits.length) {
+    const kept = archive?.id(ref);
+    if (kept) return kept;
+  }
+  throw new UserError(hits.length ? `ambiguous run "${ref}": ${hits.join(", ")}` : ids.length ? `unknown run "${ref}"` : "no runs yet");
+}
+function isAlive(pid) {
+  if (!pid) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (e) {
+    return e.code === "EPERM";
+  }
+}
+var STOP_FILE = "stop-requested";
+var requestStop = (id2) => fs3.writeFileSync(runFile(id2, STOP_FILE), "");
+function freshMeta(id2) {
+  const meta = readMeta(id2);
+  if (!TERMINAL.includes(meta.state) && meta.pid && !isAlive(meta.pid)) {
+    const latest = readMeta(id2);
+    if (TERMINAL.includes(latest.state)) return latest;
+    const stopped = latest.stopRequested || fs3.existsSync(runFile(id2, STOP_FILE));
+    latest.state = stopped ? "stopped" : "failed";
+    if (!stopped) latest.error ??= "worker process exited unexpectedly";
+    latest.endedAt ??= (/* @__PURE__ */ new Date()).toISOString();
+    writeMeta(latest);
+    return latest;
+  }
+  return meta;
+}
+
+// src/backends/deny.ts
+var FORBIDDEN_COMMANDS = [
+  "git commit",
+  "git push",
+  "git pull",
+  "git reset",
+  "git checkout",
+  "git restore",
+  "git clean",
+  "git stash",
+  "git rebase",
+  "git merge",
+  "git switch",
+  "git branch",
+  "git tag",
+  "git rm",
+  "git worktree",
+  "git update-ref",
+  "git config",
+  "git remote",
+  "git cherry-pick",
+  "git revert",
+  "git am",
+  "git add",
+  "rm -rf",
+  "rm -fr",
+  "rm -r",
+  "rm -R",
+  "rm --recursive",
+  "sudo",
+  "chown",
+  "kill",
+  "pkill",
+  "killall",
+  "gh",
+  "npm publish",
+  "pitroom",
+  "opencode",
+  "claude",
+  "codex",
+  "gemini",
+  "qwen",
+  "kilo",
+  "kilocode",
+  "agy"
+];
+
+// src/backends/exec.ts
+import fs4 from "node:fs";
+import os2 from "node:os";
+import path3 from "node:path";
 function findBinary(name, envVar, known = []) {
   const override = process.env[envVar];
   if (override) return override;
   const exts = process.platform === "win32" ? [".exe", ".cmd", ""] : [""];
-  for (const dir of (process.env.PATH ?? "").split(path.delimiter).filter(Boolean)) {
+  for (const dir of (process.env.PATH ?? "").split(path3.delimiter).filter(Boolean)) {
     for (const ext of exts) {
-      const p = path.join(dir, `${name}${ext}`);
+      const p = path3.join(dir, `${name}${ext}`);
       if (isFile(p)) return p;
     }
   }
-  return known.map((k) => k.replace(/^~/, os.homedir())).find(isFile) ?? name;
+  return known.map((k) => k.replace(/^~/, os2.homedir())).find(isFile) ?? name;
+}
+function isFile(p) {
+  try {
+    return fs4.statSync(p).isFile();
+  } catch {
+    return false;
+  }
+}
+function resolveCommand(bin) {
+  try {
+    const real = fs4.realpathSync(bin);
+    const fd = fs4.openSync(real, "r");
+    const head = Buffer.alloc(128);
+    const n = fs4.readSync(fd, head, 0, 128, 0);
+    fs4.closeSync(fd);
+    const firstLine = head.subarray(0, n).toString("utf8").split("\n")[0] ?? "";
+    if (/^#!.*\bnode\b/.test(firstLine)) return { command: process.execPath, prefix: [real] };
+  } catch {
+  }
+  return { command: bin, prefix: [] };
+}
+
+// src/backends/home.ts
+import crypto2 from "node:crypto";
+import fs5 from "node:fs";
+import path4 from "node:path";
+function writeIfChanged(file, body) {
+  try {
+    if (fs5.readFileSync(file, "utf8") === body) return;
+  } catch {
+  }
+  fs5.mkdirSync(path4.dirname(file), { recursive: true });
+  const tmp = `${file}.${process.pid}-${crypto2.randomBytes(3).toString("hex")}.tmp`;
+  fs5.writeFileSync(tmp, body);
+  for (let tries = 0; ; tries++) {
+    try {
+      fs5.renameSync(tmp, file);
+      return;
+    } catch (e) {
+      const busy = ["EPERM", "EBUSY", "EACCES"].includes(e.code ?? "");
+      if (busy && tries < 10) {
+        Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 50);
+        continue;
+      }
+      fs5.rmSync(tmp, { force: true });
+      if (!busy) throw e;
+      fs5.writeFileSync(file, body);
+      return;
+    }
+  }
+}
+function linkInto(dir, from) {
+  const to = path4.join(dir, path4.basename(from));
+  try {
+    let st;
+    try {
+      st = fs5.lstatSync(to);
+    } catch {
+    }
+    if (st && !st.isSymbolicLink()) return;
+    if (st) {
+      if (fs5.readlinkSync(to) === from && fs5.existsSync(from)) return;
+      fs5.unlinkSync(to);
+    }
+    if (fs5.existsSync(from)) fs5.symlinkSync(from, to);
+  } catch {
+  }
+}
+
+// src/backends/text.ts
+var clip = (s, n) => s.length > n ? `${s.slice(0, n - 1)}\u2026` : s;
+function num(v) {
+  return typeof v === "number" && Number.isFinite(v) ? v : 0;
+}
+function oneLine(s, max = 80) {
+  return clip(s.replace(/\s+/g, " ").trim(), max);
+}
+function splitModel(model) {
+  if (!model) return {};
+  const [m, effort] = model.split("#");
+  return { model: m || void 0, effort: effort || void 0 };
+}
+
+// src/backends/types.ts
+var MAX_STEPS = 400;
+
+// src/backends/antigravity/events.ts
+var EDIT_TOOLS = /* @__PURE__ */ new Set(["write_to_file", "replace_file_content", "multi_replace_file_content", "edit_file", "write_file"]);
+var SHELL = "run_command";
+var DENIED = /soft-denied|permission|denied|not allowed|blocked|refus|requires approval/i;
+var FAILED = /error|fail|denied|cancel|reject/i;
+var OK = /^(success|succeeded|ok|done|completed?)$/i;
+function parseEvents(jsonl) {
+  const usage = { input: 0, output: 0, reasoning: 0, cacheRead: 0, cacheWrite: 0, total: 0, steps: 0, toolCalls: 0, denied: 0 };
+  const stepUsage = [];
+  const usageSeen = /* @__PURE__ */ new Set();
+  const tools = {};
+  const edits = [];
+  const timeline = [];
+  const said = /* @__PURE__ */ new Map();
+  const stepOf = /* @__PURE__ */ new Map();
+  const toolSeen = /* @__PURE__ */ new Set();
+  const done = /* @__PURE__ */ new Set();
+  let sessionId;
+  let model;
+  let lastText = "";
+  let response;
+  let lastActivity;
+  let error;
+  let streamError;
+  let resultSeen = false;
+  let haveResultUsage = false;
+  const open = /* @__PURE__ */ new Map();
+  let unnamed = 0;
+  let turns = 0;
+  let inTurn = false;
+  const startTurn = () => {
+    if (!inTurn) turns++;
+    inTurn = true;
+  };
+  for (const line of jsonl.split("\n")) {
+    if (!line.trim()) continue;
+    let e;
+    try {
+      e = JSON.parse(line);
+    } catch {
+      continue;
+    }
+    if (!e || typeof e !== "object") continue;
+    const type = String(e.event ?? e.type ?? "").toLowerCase();
+    const body = (name) => e[name] && typeof e[name] === "object" ? e[name] : e;
+    if (type === "init") {
+      sessionId ??= id(e.conversation_id ?? e.session_id ?? body("init").conversation_id);
+      model ??= id(body("init").model);
+    } else if (type === "step_update") {
+      const s = body("step_update");
+      sessionId ??= id(s.conversation_id);
+      const kind2 = String(s.step_type ?? "").toLowerCase();
+      const state = String(s.state ?? "").toUpperCase();
+      const failedStep = state === "ERROR";
+      const finished = state === "DONE" || failedStep;
+      let key = s.step_index ?? s.step_id;
+      if (key === void 0 || key === null) {
+        key = open.get(kind2) ?? `${kind2}#${unnamed++}`;
+        if (finished) open.delete(kind2);
+        else open.set(kind2, key);
+      }
+      key = String(key);
+      if (kind2 === "agent_response") {
+        startTurn();
+        const text = (said.get(key) ?? "") + str(s.text_delta);
+        said.set(key, text);
+        if (finished && !done.has(key)) {
+          done.add(key);
+          const t = text.trim();
+          if (t) {
+            lastText = t;
+            lastActivity = `says: ${oneLine(t)}`;
+            if (timeline.length < MAX_STEPS) timeline.push({ kind: "say", text: clip(t, 600) });
+          }
+        }
+      } else if (kind2 === "tool") {
+        const info = s.tool_info && typeof s.tool_info === "object" ? s.tool_info : {};
+        const name = String(info.name ?? info.tool_name ?? s.tool_name ?? "tool");
+        const p = info.parameters ?? info.args ?? info.arguments ?? s.parameters ?? {};
+        if (!toolSeen.has(key)) {
+          toolSeen.add(key);
+          startTurn();
+          lastText = "";
+          usage.toolCalls++;
+          tools[name] = (tools[name] ?? 0) + 1;
+          const target = p.CommandLine ?? p.command ?? p.TargetFile ?? p.AbsolutePath ?? p.file_path ?? p.path ?? p.SearchPath ?? p.Query ?? p.query ?? p.Url ?? p.url;
+          lastActivity = `${name} ${target ? oneLine(String(target), 60) : ""}`.trim();
+          if (timeline.length < MAX_STEPS) {
+            const step = { kind: EDIT_TOOLS.has(name) ? "edit" : name === SHELL ? "shell" : "tool", name, text: clip(String(target ?? ""), 240) };
+            timeline.push(step);
+            stepOf.set(key, step);
+          }
+        }
+        if (finished && !done.has(key)) {
+          done.add(key);
+          inTurn = false;
+          const problem = `${errText(info.error)} ${str(info.status ?? s.status)}`.trim();
+          const ok = !failedStep && (!problem || OK.test(problem) || !FAILED.test(problem));
+          const step = stepOf.get(key);
+          if (step) step.ok = ok;
+          if (!ok && DENIED.test(`${problem} ${str(info.output)}`)) usage.denied++;
+          const file = p.TargetFile ?? p.AbsolutePath ?? p.file_path ?? p.path;
+          if (ok && EDIT_TOOLS.has(name) && file) edits.push(String(file));
+        }
+      }
+      if (finished && s.usage && typeof s.usage === "object" && !usageSeen.has(`${kind2}:${key}`)) {
+        usageSeen.add(`${kind2}:${key}`);
+        stepUsage.push(s.usage);
+      }
+    } else if (type === "result") {
+      const r = body("result");
+      sessionId ??= id(r.conversation_id);
+      model ??= id(r.model);
+      if (typeof r.response === "string") response = r.response.trim();
+      if (r.usage && typeof r.usage === "object") {
+        add(usage, r.usage);
+        haveResultUsage = true;
+      }
+      if (Array.isArray(r.denied_actions)) usage.denied = Math.max(usage.denied, r.denied_actions.length);
+      resultSeen = true;
+      const status = str(r.status);
+      const message = errText(r.error);
+      if (status ? !OK.test(status) : !!message) {
+        error ??= message || (/^waiting$/i.test(status) ? "agy stopped waiting for an approval a headless run cannot give" : `agy ended with status ${status}`);
+      }
+    } else if (type === "error") {
+      streamError ??= typeof e.message === "string" && e.message || errText(e.error) || "Antigravity CLI error";
+    }
+  }
+  if (streamError && (!resultSeen || !response)) error ??= streamError;
+  if (!haveResultUsage) for (const u of stepUsage) add(usage, u);
+  usage.steps = turns;
+  const finalText = error ? "" : response || lastText;
+  return { sessionId, model, finalText, usage, tools, edits, lastActivity, timeline, error };
+}
+function add(u, r) {
+  const cached3 = num(r.cache_read_tokens ?? r.cached_tokens);
+  const input = num(r.input_tokens);
+  u.cacheRead += cached3;
+  u.input += Math.max(0, input - cached3);
+  u.output += num(r.output_tokens);
+  u.reasoning += num(r.thinking_tokens ?? r.reasoning_tokens);
+  u.total += num(r.total_tokens) || input + num(r.output_tokens) + num(r.thinking_tokens ?? r.reasoning_tokens);
+}
+var id = (v) => typeof v === "string" && v ? v : void 0;
+function errText(v) {
+  if (typeof v === "string") return v;
+  if (!v || typeof v !== "object" || !Object.keys(v).length) return "";
+  const code = typeof v.code === "string" || typeof v.code === "number" ? String(v.code) : "";
+  const message = typeof v.message === "string" ? v.message : typeof v.reason === "string" ? v.reason : "";
+  return [code, message].filter(Boolean).join(": ") || JSON.stringify(v);
+}
+var str = (v) => typeof v === "string" ? v : v === void 0 || v === null ? "" : typeof v === "object" ? JSON.stringify(v) : String(v);
+
+// src/backends/antigravity/index.ts
+var binary = () => findBinary("agy", "PITROOM_ANTIGRAVITY_BIN", ["~/.local/bin/agy", "~/.antigravity/bin/agy"]);
+function agy(args, timeout = 3e4) {
+  const { command, prefix } = resolveCommand(binary());
+  const r = spawnSync(command, [...prefix, ...args], { encoding: "utf8", timeout, stdio: ["ignore", "pipe", "pipe"] });
+  return { ok: r.status === 0, out: r.stdout ?? "", err: r.stderr ?? "", missing: !!r.error };
+}
+var dataDir = (h) => path5.join(h, ".gemini", "antigravity-cli");
+var userDir = () => dataDir(os3.homedir());
+var TOKEN = "antigravity-oauth-token";
+var HOME_SECRETS = [".ssh", ".aws", ".gnupg", ".netrc", ".docker", ".kube", ".config/gcloud", ".config/gh", ".gemini", "Library/Keychains"];
+function denyCommandRules() {
+  const subcommands = FORBIDDEN_COMMANDS.filter((c) => c.startsWith("git ")).map((c) => c.slice(4));
+  const anywhere = (cmd, option) => [0, 1, 2, 3, 4, 5].map((n) => `${cmd} ${".* ".repeat(n)}${option}`);
+  return [
+    ...FORBIDDEN_COMMANDS.map((c) => `command(${c})`),
+    ...FORBIDDEN_COMMANDS.filter((c) => !c.startsWith("git ")).map((c) => `command(regex:.*/${c})`),
+    // git by path would bypass the git guard's PATH shim; -C, -c, --git-dir and --work-tree point it elsewhere
+    "command(regex:.*/git)",
+    "command(regex:git (-C|-c|--git-dir.*|--work-tree.*))",
+    `command(regex:git -.* (${subcommands.join("|")}))`,
+    `command(regex:git -.* -.* (${subcommands.join("|")}))`,
+    // a recursive delete however its options are spelled or placed (rm -Rf, rm -r -f, rm dir -rf, rm --recursive)
+    ...["rm", ".*/rm"].flatMap((rm) => [...anywhere(rm, "-[a-zA-Z]*[rR][a-zA-Z]*"), ...anywhere(rm, "--recursive")]).map((r) => `command(regex:${r})`),
+    // find runs what follows -exec itself, and agy does not take it apart; such a rule only holds when it spans the
+    // whole command (a prefix of it was seen not to match), so find with -exec, -ok or -delete is refused outright,
+    // up to six words before and after (grep -r does what find -exec grep did)
+    ...["find", ".*/find"].flatMap((find) => [0, 1, 2, 3, 4, 5, 6].flatMap((before) => [0, 1, 2, 3, 4, 5, 6].flatMap((after) => {
+      const words = (n) => " .*".repeat(n);
+      return [
+        ...after ? [`${find}${words(before)} -(exec|execdir|ok|okdir)${words(after)}`] : [],
+        `${find}${words(before)} -delete${words(after)}`
+      ];
+    }))).map((r) => `command(regex:${r})`),
+    // xargs runs its arguments as a command, and agy does not take it apart either; with a `{}` in it a rule has
+    // to span the whole command again, so the words after the command are spelled out too
+    ...["xargs", ".*/xargs"].flatMap((xargs) => [0, 1, 2, 3].flatMap((n) => [0, 1, 2, 3].flatMap((after) => [
+      `${xargs}${" .*".repeat(n)} (.*/)?(${FORBIDDEN_COMMANDS.filter((c) => !c.includes(" ")).join("|")})${" .*".repeat(after)}`,
+      `${xargs}${" .*".repeat(n)} (.*/)?git (${subcommands.join("|")})${" .*".repeat(after)}`,
+      `${xargs}${" .*".repeat(n)} (.*/)?rm -[a-zA-Z]*[rR][a-zA-Z]*${" .*".repeat(after)}`
+    ]))).map((r) => `command(regex:${r})`),
+    // a command line with a `{}` in it is not split into commands: a rule is then matched against the whole line,
+    // so these find xargs and find wherever they stand in it
+    `command(regex:.*git (${subcommands.join("|")}).*)`,
+    "command(regex:.*rm -[a-zA-Z]*[rR].*)",
+    `command(regex:.*xargs .*rm -[a-zA-Z]*[rR].*)`,
+    `command(regex:.*xargs .*git .*(${subcommands.join("|")}).*)`,
+    "command(regex:.*find .*-(exec|execdir|ok|okdir) .*)",
+    "command(regex:.*find .*-delete.*)",
+    // a command inside a string is not matched above
+    "command(regex:(ba|z|da|k)?sh -[a-zA-Z]*c[a-zA-Z]*)",
+    "command(regex:.*/(ba|z|da|k)?sh -[a-zA-Z]*c[a-zA-Z]*)",
+    "command(eval)"
+  ];
+}
+function workerSettings(workspace, workerHome3, reads = []) {
+  const real = (p) => {
+    try {
+      return fs6.realpathSync.native(p);
+    } catch {
+      return p;
+    }
+  };
+  const both = (p) => [.../* @__PURE__ */ new Set([p, real(p)])];
+  const secrets = [
+    ...findSecretFiles(workspace).map((f) => path5.join(workspace, f)),
+    ...reads.flatMap((r) => r.secrets),
+    ...HOME_SECRETS.map((f) => path5.join(os3.homedir(), f)).filter((p) => fs6.existsSync(p)),
+    // the keychain link of the worker's own home
+    path5.join(workerHome3, "Library")
+  ];
+  return {
+    ...baseSettings(),
+    permissions: {
+      // plan mode writes its plan into agy's own data folder, which is outside the workspace; the user's toolchains
+      // under their home stay usable in the sandbox (read-only), which sees only what is granted besides the system
+      allow: [
+        "command(*)",
+        ...both(path5.join(dataDir(workerHome3), "brain")).map((p) => `write_file(${rulePath(p)})`),
+        ...toolchains().flatMap(both).map((p) => `read_file(${rulePath(p)})`),
+        // what the task names outside the workspace: a headless agy cannot ask, and would end the turn unanswered
+        ...reads.map((r) => r.path).flatMap(both).map((p) => `read_file(${rulePath(p)})`)
+      ],
+      deny: [
+        ...secrets.flatMap(both).map((p) => `read_file(${rulePath(p)})`),
+        ...denyCommandRules(),
+        "mcp(*)",
+        // No web for agy workers: the rule is in the settings file, so --web cannot switch it on per run.
+        "read_url(*)",
+        "execute_url(*)"
+      ]
+    }
+  };
+}
+function toolchains() {
+  const homeDir = os3.homedir();
+  const inHome = (d) => {
+    const rel = path5.relative(homeDir, d);
+    return !!rel && !rel.startsWith("..") && !path5.isAbsolute(rel);
+  };
+  const dirs = (process.env.PATH ?? "").split(path5.delimiter).filter((d) => d && path5.isAbsolute(d) && inHome(d) && fs6.existsSync(d));
+  const install = (d) => path5.basename(d) === "bin" && /[\\/](versions|toolchains)[\\/]/.test(d) ? path5.dirname(d) : d;
+  return [...new Set(dirs.map(install))].filter((d) => !inHome(home()) || path5.relative(home(), d).startsWith(".."));
+}
+var isDir = (p) => {
+  try {
+    return fs6.statSync(p).isDirectory();
+  } catch {
+    return false;
+  }
+};
+var MAX_READS = 20;
+function pathsIn(prompt) {
+  const out = [];
+  for (const m of prompt.matchAll(/(^|[\s"'`(\[<{=])((?:~|[A-Za-z]:)?[\\/][^\s"'`)\]>}]*)/g)) {
+    const raw = m[2].replace(/[.,;:!?]+$/, "");
+    const abs = raw.startsWith("~") ? path5.join(os3.homedir(), raw.slice(1)) : raw;
+    if (raw && path5.isAbsolute(abs)) out.push({ raw, at: m.index + m[1].length, abs });
+  }
+  return out;
+}
+var realOf = (p) => {
+  try {
+    return fs6.realpathSync.native(p);
+  } catch {
+    return void 0;
+  }
+};
+function resolved(p) {
+  let dir = path5.resolve(p);
+  const rest = [];
+  for (; ; ) {
+    const r = realOf(dir);
+    if (r) return path5.join(r, ...rest);
+    const up = path5.dirname(dir);
+    if (up === dir) return path5.resolve(p);
+    rest.unshift(path5.basename(dir));
+    dir = up;
+  }
+}
+var inside = (p, dir) => {
+  const rel = path5.relative(dir, p);
+  return !rel || !rel.startsWith("..") && !path5.isAbsolute(rel);
+};
+var MAX_SCANNED = 2e4;
+function allSecrets(dir) {
+  const root = realOf(dir) ?? dir;
+  const found = [];
+  let seen = 0;
+  const stack = [dir];
+  while (stack.length) {
+    const d = stack.pop();
+    let entries;
+    try {
+      entries = fs6.readdirSync(d, { withFileTypes: true });
+    } catch {
+      return void 0;
+    }
+    for (const e of entries) {
+      if (++seen > MAX_SCANNED) return void 0;
+      const p = path5.join(d, e.name);
+      if (e.isSymbolicLink()) {
+        const target = realOf(p);
+        if (!target || !inside(target, root)) return void 0;
+        if (looksSecret(e.name)) found.push(p);
+      } else if (e.isDirectory()) stack.push(p);
+      else if (looksSecret(e.name)) found.push(p);
+    }
+  }
+  return found;
+}
+function outsideReads(prompt, workspace, project) {
+  if (process.platform === "win32") return [];
+  const homeDir = realOf(os3.homedir()) ?? os3.homedir();
+  const ws = realOf(workspace) ?? path5.resolve(workspace);
+  const proj = project ? resolved(project) : void 0;
+  const own = realOf(home()) ?? home();
+  const found = /* @__PURE__ */ new Map();
+  for (const { abs } of pathsIn(prompt)) {
+    const p = realOf(abs);
+    if (!p || found.has(p) || inside(p, ws) || inside(p, own)) continue;
+    if (inside(homeDir, p) || inside(ws, p) || proj && inside(proj, p)) continue;
+    if (p.split(/[\\/]/).filter(Boolean).length < 2) continue;
+    if (inside(p, homeDir) && /^(\.|Library([\\/]|$))/.test(path5.relative(homeDir, p))) continue;
+    if (!isDir(p)) {
+      if (!looksSecret(path5.basename(p))) found.set(p, { path: p, secrets: [] });
+    } else {
+      const secrets = allSecrets(p);
+      if (secrets) found.set(p, { path: p, secrets });
+    }
+    if (found.size >= MAX_READS) break;
+  }
+  return [...found.values()];
+}
+function baseSettings() {
+  return {
+    enableTerminalSandbox: true,
+    toolPermission: "proceed-in-sandbox",
+    artifactReviewPolicy: "always-proceed",
+    allowNonWorkspaceAccess: false
+  };
+}
+var rulePath = (p) => p.replace(/^[A-Za-z]:(?=[\\/])/, "").replace(/\\/g, "/");
+var HOMES_KEPT_DAYS = 14;
+function workerHome(workspace, reads = []) {
+  const root = path5.join(home(), "antigravity-home");
+  const id2 = crypto3.createHash("sha256").update(path5.resolve(workspace)).digest("hex").slice(0, 16);
+  const dir = path5.join(root, id2);
+  fs6.mkdirSync(dataDir(dir), { recursive: true });
+  writeIfChanged(path5.join(dataDir(dir), "settings.json"), `${JSON.stringify(workerSettings(workspace, dir, reads), null, 2)}
+`);
+  if (process.platform === "darwin") {
+    fs6.mkdirSync(path5.join(dir, "Library"), { recursive: true });
+    linkInto(path5.join(dir, "Library"), path5.join(os3.homedir(), "Library", "Keychains"));
+  } else {
+    linkInto(dataDir(dir), path5.join(userDir(), TOKEN));
+  }
+  const now = /* @__PURE__ */ new Date();
+  fs6.utimesSync(dir, now, now);
+  pruneHomes(root, dir);
+  return dir;
+}
+function pruneHomes(root, keep) {
+  const cutoff = Date.now() - HOMES_KEPT_DAYS * 864e5;
+  try {
+    for (const name of fs6.readdirSync(root)) {
+      const dir = path5.join(root, name);
+      if (dir === keep || !/^[0-9a-f]{16}$/.test(name)) continue;
+      if (fs6.statSync(dir).mtimeMs < cutoff) fs6.rmSync(dir, { recursive: true, force: true });
+    }
+  } catch {
+  }
+}
+function inCopy(prompt, project) {
+  if (!project || project.root === project.copy) return prompt;
+  const root = resolved(project.root);
+  let out = "";
+  let from = 0;
+  for (const { raw, at, abs } of pathsIn(prompt)) {
+    const p = resolved(abs);
+    if (!inside(p, root)) continue;
+    out += prompt.slice(from, at) + path5.join(project.copy, path5.relative(root, p));
+    from = at + raw.length;
+  }
+  return out + prompt.slice(from);
+}
+function invocation(req) {
+  const prompt = inCopy(req.prompt, req.project);
+  const args = [
+    // -p takes the prompt as its value; one that starts with "-" would be read as an option: a leading space keeps it a value.
+    "-p",
+    prompt.startsWith("-") ? ` ${prompt}` : prompt,
+    "--output-format",
+    "stream-json",
+    "--mode",
+    req.mode === "read" ? "plan" : "accept-edits",
+    "--sandbox",
+    // agy's own limit (5m by default) would end a long run with partial output and exit 0; Pitroom's timeout governs.
+    "--print-timeout",
+    "24h"
+  ];
+  if (req.sessionId) args.push("--conversation", req.sessionId);
+  const { model, effort } = splitModel(req.model);
+  if (model) args.push("--model", model);
+  if (effort) args.push("--effort", effort);
+  const { command, prefix } = resolveCommand(binary());
+  const workerDir = workerHome(req.cwd, outsideReads(prompt, req.cwd, req.project?.root));
+  const env = { HOME: workerDir };
+  if (process.platform === "win32") env.USERPROFILE = workerDir;
+  return { command, args: [...prefix, ...args], env };
+}
+function classify(message) {
+  if (/RESOURCE_EXHAUSTED|\b429\b|quota|rate.?limit|too many requests|overloaded|\b503\b|capacity/i.test(message)) return "rate-limited";
+  if (/not (signed|logged) in|\bsign.?in\b|\blog ?in\b|authenticat|PERMISSION_DENIED|oauth|credential|keyring|keychain|\b401\b|unauthori[sz]ed/i.test(message)) {
+    return "auth";
+  }
+  if (/model.{0,80}(not found|not available|no longer available|does not exist|unknown|unsupported|invalid)|unknown model|invalid model|NOT_FOUND|\b404\b/i.test(message)) {
+    return "model-unavailable";
+  }
+  return "other";
 }
-function isFile(p) {
+var TIMED_OUT = /print timeout after/i;
+var BLOCKED = /^This request was blocked by \S+ filters\b/;
+function failure(run, stderr, exitCode) {
+  const lines = stderr.trim().split("\n").map((l) => l.trim()).filter(Boolean);
+  const envelope = lines.find((l) => l.startsWith("AGY_ERROR"));
+  const detail = (envelope && fromEnvelope(envelope)) ?? lines.find((l) => /RESOURCE_EXHAUSTED|error|failed|quota|exhausted|denied|not found|\bsign.?in\b/i.test(l) && !TIMED_OUT.test(l));
+  if (exitCode === 0 && !run.error) {
+    if (BLOCKED.test(run.finalText)) return { kind: "other", message: `the model's filter blocked the request: ${run.finalText.split("\n")[0]}` };
+    if (run.finalText) return void 0;
+    if (detail) return { kind: classify(detail), message: detail };
+    if (lines.some((l) => TIMED_OUT.test(l))) return { kind: "other", message: "agy stopped at its own --print-timeout before answering" };
+    if (run.usage.denied) return { kind: "other", message: "agy ended its turn without an answer when a tool call was refused" };
+    if (!run.sessionId && !stderr.trim()) return { kind: "other", message: "agy printed nothing (some agy versions write no output to a pipe); update agy" };
+    return { kind: "other", message: "agy ended without an answer (a refused tool call ends its turn with no other sign)" };
+  }
+  const message = run.error ?? detail ?? lines.at(-1) ?? `agy exited with code ${exitCode}`;
+  return { kind: classify(`${message} ${detail ?? ""}`), message };
+}
+function warnings(_run, stderr) {
+  const lost = /conversation "([^"]+)" not found/i.exec(stderr);
+  return lost ? [`agy did not find the earlier conversation (${lost[1]}) and started a new one: this answer does not know the earlier turns`] : [];
+}
+function fromEnvelope(line) {
   try {
-    return fs.statSync(p).isFile();
+    const e = JSON.parse(line.slice(line.indexOf("{")));
+    if (typeof e.short_error === "string" && e.short_error) return e.short_error;
+    const text = [e.status ?? e.code, e.message ?? e.error].filter((v) => typeof v === "string" && v).join(": ");
+    return text || void 0;
   } catch {
-    return false;
+    return line.replace(/^AGY_ERROR:?\s*/, "") || void 0;
   }
 }
-function resolveCommand(bin) {
-  try {
-    const real = fs.realpathSync(bin);
-    const fd = fs.openSync(real, "r");
-    const head = Buffer.alloc(128);
-    const n = fs.readSync(fd, head, 0, 128, 0);
-    fs.closeSync(fd);
-    const firstLine = head.subarray(0, n).toString("utf8").split("\n")[0] ?? "";
-    if (/^#!.*\bnode\b/.test(firstLine)) return { command: process.execPath, prefix: [real] };
-  } catch {
+function doctor({ models, hasFallback }) {
+  const version = agy(["--version"]);
+  if (version.missing || !version.ok) {
+    return [{
+      level: "fail",
+      message: `agy not runnable (${binary()}). Install the Antigravity CLI (curl -fsSL https://antigravity.google/cli/install.sh | bash), or set PITROOM_ANTIGRAVITY_BIN`
+    }];
+  }
+  const checks = [
+    { level: "ok", message: `Antigravity CLI ${version.out.trim().split("\n")[0]} at ${binary()}` },
+    {
+      level: "warn",
+      message: "the Antigravity worker is in beta (checked against agy 1.3.5). agy has no read-only mode for headless runs, so its read runs always read a snapshot of the project; prefer -i for changes"
+    }
+  ];
+  if (process.platform === "win32") {
+    checks.push({ level: "warn", message: "agy's permission rules and terminal sandbox are for macOS and Linux; on Windows run the Antigravity worker only with -i (an isolated copy)" });
   }
-  return { command: bin, prefix: [] };
+  if (process.platform === "linux" && !fs6.existsSync(path5.join(userDir(), TOKEN))) {
+    checks.push({ level: "warn", message: "no Antigravity sign-in file found: if a run fails to sign in, run `agy` once and sign in with your Google account" });
+  }
+  for (const m of models) checks.push({ level: "ok", message: m ? `Antigravity model: ${m}` : "Antigravity model: agy's own choice (`agy models` lists yours)" });
+  checks.push({ level: "ok", message: "Antigravity workers have no web access (--web does not apply to them)" });
+  if (!hasFallback) checks.push({ level: "warn", message: "no fallback workers configured for Antigravity runs (its quota is per account and can run out for hours)" });
+  return checks;
 }
+var antigravity = {
+  id: "antigravity",
+  name: "Antigravity CLI",
+  capabilities: { readOnly: "snapshot", resume: "by-id", reportsCost: false, attachFiles: false },
+  binary,
+  invocation,
+  parse: parseEvents,
+  failure,
+  warnings,
+  doctor
+};
 
-// src/backends/types.ts
-var MAX_STEPS = 400;
+// src/backends/claude/index.ts
+import { spawnSync as spawnSync2 } from "node:child_process";
+import fs7 from "node:fs";
+import os4 from "node:os";
+import path6 from "node:path";
 
 // src/backends/claude/events.ts
-var EDIT_TOOLS = /* @__PURE__ */ new Set(["Edit", "Write", "MultiEdit", "NotebookEdit"]);
-var DENIED = /permission|not allowed|denied|blocked|disallowed/i;
-function parseEvents(jsonl) {
+var EDIT_TOOLS2 = /* @__PURE__ */ new Set(["Edit", "Write", "MultiEdit", "NotebookEdit"]);
+var DENIED2 = /permission|not allowed|denied|blocked|disallowed/i;
+function parseEvents2(jsonl) {
   const usage = {
     input: 0,
     output: 0,
@@ -108,9 +900,9 @@ function parseEvents(jsonl) {
           tools[c.name] = (tools[c.name] ?? 0) + 1;
           const target = c.input?.file_path ?? c.input?.path ?? c.input?.pattern ?? c.input?.command ?? c.input?.url;
           lastActivity = `${c.name} ${target ? oneLine(String(target), 60) : ""}`.trim();
-          if (EDIT_TOOLS.has(c.name) && c.input?.file_path) pendingEdits.set(c.id, String(c.input.file_path));
+          if (EDIT_TOOLS2.has(c.name) && c.input?.file_path) pendingEdits.set(c.id, String(c.input.file_path));
           if (timeline.length < MAX_STEPS) {
-            const step = { kind: EDIT_TOOLS.has(c.name) ? "edit" : c.name === "Bash" ? "shell" : "tool", name: c.name, text: clip(String(target ?? ""), 240) };
+            const step = { kind: EDIT_TOOLS2.has(c.name) ? "edit" : c.name === "Bash" ? "shell" : "tool", name: c.name, text: clip(String(target ?? ""), 240) };
             timeline.push(step);
             stepOf.set(String(c.id), step);
           }
@@ -123,7 +915,7 @@ function parseEvents(jsonl) {
         const step = stepOf.get(String(c.tool_use_id));
         if (step) step.ok = !c.is_error;
         if (c.is_error) {
-          if (DENIED.test(text)) usage.denied++;
+          if (DENIED2.test(text)) usage.denied++;
         } else if (pendingEdits.has(c.tool_use_id)) {
           edits.push(pendingEdits.get(c.tool_use_id));
         }
@@ -149,20 +941,12 @@ function parseEvents(jsonl) {
   usage.steps = steps.size;
   return { sessionId, model, finalText: finalText ?? (error ? "" : lastText), usage, tools, edits, lastActivity, timeline, error };
 }
-var clip = (s, n) => s.length > n ? `${s.slice(0, n - 1)}\u2026` : s;
-function num(v) {
-  return typeof v === "number" && Number.isFinite(v) ? v : 0;
-}
-function oneLine(s, max = 80) {
-  const t = s.replace(/\s+/g, " ").trim();
-  return t.length > max ? `${t.slice(0, max - 1)}\u2026` : t;
-}
 
 // src/backends/claude/index.ts
-var binary = () => findBinary("claude", "PITROOM_CLAUDE_BIN", ["~/.local/bin/claude", "~/.claude/local/claude"]);
+var binary2 = () => findBinary("claude", "PITROOM_CLAUDE_BIN", ["~/.local/bin/claude", "~/.claude/local/claude"]);
 function cl(args, timeout = 6e4) {
-  const { command, prefix } = resolveCommand(binary());
-  const r = spawnSync(command, [...prefix, ...args], {
+  const { command, prefix } = resolveCommand(binary2());
+  const r = spawnSync2(command, [...prefix, ...args], {
     encoding: "utf8",
     timeout,
     stdio: ["ignore", "pipe", "pipe"],
@@ -173,52 +957,12 @@ function cl(args, timeout = 6e4) {
 var READ_TOOLS = ["Read", "Grep", "Glob"];
 var WRITE_TOOLS = [...READ_TOOLS, "Edit", "Write", "Bash"];
 var WEB_TOOLS = ["WebFetch", "WebSearch"];
-var DENY_BASH = [
-  "git commit",
-  "git push",
-  "git pull",
-  "git reset",
-  "git checkout",
-  "git restore",
-  "git clean",
-  "git stash",
-  "git rebase",
-  "git merge",
-  "git switch",
-  "git branch",
-  "git tag",
-  "git rm",
-  "git worktree",
-  "git update-ref",
-  "git config",
-  "git remote",
-  "git cherry-pick",
-  "git revert",
-  "git am",
-  "git add",
-  "rm -rf",
-  "rm -fr",
-  "sudo",
-  "chown",
-  "kill",
-  "pkill",
-  "killall",
-  "gh",
-  "npm publish",
-  "pitroom",
-  "opencode",
-  "claude",
-  "codex",
-  "gemini",
-  "qwen",
-  "kilo",
-  "kilocode"
-].map((c) => `Bash(${c}:*)`);
+var DENY_BASH = FORBIDDEN_COMMANDS.map((c) => `Bash(${c}:*)`);
 var SECRETS = ["**/.env", "**/.env.*", "**/*.pem", "**/id_rsa*", "**/id_ed25519*"].map((p) => `Read(${p})`);
 function toolsFor(mode, web2) {
   return [...mode === "read" ? READ_TOOLS : WRITE_TOOLS, ...web2 ? WEB_TOOLS : []];
 }
-function invocation(req) {
+function invocation2(req) {
   const tools = toolsFor(req.mode, req.web).join(",");
   const args = [
     "-p",
@@ -246,10 +990,10 @@ function invocation(req) {
   if (effort) args.push("--effort", effort);
   if (req.sessionId) args.push("--resume", req.sessionId);
   args.push("--", req.prompt);
-  const { command, prefix } = resolveCommand(binary());
+  const { command, prefix } = resolveCommand(binary2());
   return { command, args: [...prefix, ...args], env: { DISABLE_AUTOUPDATER: "1" } };
 }
-function classify(message) {
+function classify2(message) {
   if (/authentication_failed|failed to authenticate|oauth|not logged in|\/login|invalid api key|\b40[13]\b|unauthori[sz]ed/i.test(message)) {
     return "auth";
   }
@@ -257,26 +1001,26 @@ function classify(message) {
   if (/model[^.]*(not found|does not exist|invalid|not available)|invalid model|not_found_error/i.test(message)) return "model-unavailable";
   return "other";
 }
-function failure(run, stderr, exitCode) {
+function failure2(run, stderr, exitCode) {
   if (exitCode === 0 && !run.error) return void 0;
   const detail = stderr.trim().split("\n").filter(Boolean).pop();
   const message = run.error ?? detail ?? `claude exited with code ${exitCode}`;
-  return { kind: classify(message), message };
+  return { kind: classify2(message), message };
 }
 function defaultModel() {
   try {
-    const settings2 = JSON.parse(fs2.readFileSync(path2.join(os2.homedir(), ".claude", "settings.json"), "utf8"));
+    const settings2 = JSON.parse(fs7.readFileSync(path6.join(os4.homedir(), ".claude", "settings.json"), "utf8"));
     return typeof settings2.model === "string" ? settings2.model : void 0;
   } catch {
     return void 0;
   }
 }
-function doctor({ models, hasFallback }) {
+function doctor2({ models, hasFallback }) {
   const version = cl(["--version"]);
   if (version.missing || !version.ok) {
-    return [{ level: "fail", message: `claude not runnable (${binary()}). Install Claude Code, or set PITROOM_CLAUDE_BIN` }];
+    return [{ level: "fail", message: `claude not runnable (${binary2()}). Install Claude Code, or set PITROOM_CLAUDE_BIN` }];
   }
-  const checks = [{ level: "ok", message: `Claude Code ${version.out.trim()} at ${binary()}` }];
+  const checks = [{ level: "ok", message: `Claude Code ${version.out.trim()} at ${binary2()}` }];
   let loggedIn = false;
   try {
     loggedIn = JSON.parse(cl(["auth", "status"]).out).loggedIn === true;
@@ -299,7 +1043,7 @@ function doctor({ models, hasFallback }) {
 var CLAUDE_EFFORTS = ["low", "medium", "high", "xhigh", "max"];
 function catalog() {
   const def = defaultModel();
-  const models = ["haiku", "sonnet", "opus"].map((id) => ({ id, efforts: CLAUDE_EFFORTS }));
+  const models = ["haiku", "sonnet", "opus"].map((id2) => ({ id: id2, efforts: CLAUDE_EFFORTS }));
   if (def && !models.some((m) => m.id === def)) models.push({ id: def, efforts: CLAUDE_EFFORTS });
   return { models, source: "Claude Code aliases (latest of each size) and --effort levels from `claude --help`" };
 }
@@ -307,25 +1051,25 @@ var claude = {
   id: "claude",
   name: "Claude Code",
   capabilities: { readOnly: "tool-allowlist", resume: "by-id", reportsCost: true, attachFiles: false },
-  binary,
+  binary: binary2,
   catalog,
-  invocation,
-  parse: parseEvents,
-  failure,
+  invocation: invocation2,
+  parse: parseEvents2,
+  failure: failure2,
   defaultModel,
-  doctor
+  doctor: doctor2
 };
 
 // src/backends/codex/index.ts
-import { spawnSync as spawnSync2 } from "node:child_process";
-import fs3 from "node:fs";
-import os3 from "node:os";
-import path3 from "node:path";
+import { spawnSync as spawnSync3 } from "node:child_process";
+import fs8 from "node:fs";
+import os5 from "node:os";
+import path7 from "node:path";
 
 // src/backends/codex/events.ts
 var WORK = /* @__PURE__ */ new Set(["agent_message", "reasoning", "command_execution", "file_change", "mcp_tool_call", "web_search", "todo_list"]);
 var TOOLS = /* @__PURE__ */ new Set(["command_execution", "file_change", "mcp_tool_call", "web_search"]);
-function parseEvents2(jsonl) {
+function parseEvents3(jsonl) {
   const usage = {
     input: 0,
     output: 0,
@@ -366,31 +1110,31 @@ function parseEvents2(jsonl) {
         }
         if (it.type === "agent_message" && String(it.text ?? "").trim()) {
           finalText = String(it.text).trim();
-          lastActivity = `says: ${oneLine2(finalText)}`;
-          if (timeline.length < MAX_STEPS) timeline.push({ kind: "say", text: clip2(finalText, 600) });
+          lastActivity = `says: ${oneLine(finalText)}`;
+          if (timeline.length < MAX_STEPS) timeline.push({ kind: "say", text: clip(finalText, 600) });
         } else if (it.type === "command_execution") {
           if (it.status === "declined" || /operation not permitted|sandbox/i.test(String(it.aggregated_output ?? ""))) usage.denied++;
-          lastActivity = `shell ${oneLine2(String(it.command ?? ""), 60)}`;
-          if (timeline.length < MAX_STEPS) timeline.push({ kind: "shell", name: "shell", text: clip2(String(it.command ?? "").replace(/^\/bin\/\w+ -lc /, ""), 240), ok: it.exit_code === 0 });
+          lastActivity = `shell ${oneLine(String(it.command ?? ""), 60)}`;
+          if (timeline.length < MAX_STEPS) timeline.push({ kind: "shell", name: "shell", text: clip(String(it.command ?? "").replace(/^\/bin\/\w+ -lc /, ""), 240), ok: it.exit_code === 0 });
         } else if (it.type === "file_change") {
           const paths = (it.changes ?? []).map((c) => String(c.path));
           if (it.status !== "failed" && it.status !== "declined") edits.push(...paths);
           else usage.denied++;
-          lastActivity = `edit ${oneLine2(paths.join(", "), 60)}`;
-          if (timeline.length < MAX_STEPS) timeline.push({ kind: "edit", name: "edit", text: clip2(paths.join(", "), 240), ok: it.status !== "failed" && it.status !== "declined" });
+          lastActivity = `edit ${oneLine(paths.join(", "), 60)}`;
+          if (timeline.length < MAX_STEPS) timeline.push({ kind: "edit", name: "edit", text: clip(paths.join(", "), 240), ok: it.status !== "failed" && it.status !== "declined" });
         }
         break;
       }
       case "turn.completed": {
         const u = e.usage ?? {};
-        const cached3 = num2(u.cached_input_tokens);
-        const reasoning = num2(u.reasoning_output_tokens);
-        usage.input += Math.max(0, num2(u.input_tokens) - cached3);
+        const cached3 = num(u.cached_input_tokens);
+        const reasoning = num(u.reasoning_output_tokens);
+        usage.input += Math.max(0, num(u.input_tokens) - cached3);
         usage.cacheRead += cached3;
-        usage.cacheWrite += num2(u.cache_write_input_tokens);
-        usage.output += Math.max(0, num2(u.output_tokens) - reasoning);
+        usage.cacheWrite += num(u.cache_write_input_tokens);
+        usage.output += Math.max(0, num(u.output_tokens) - reasoning);
         usage.reasoning += reasoning;
-        usage.total += num2(u.input_tokens) + num2(u.output_tokens);
+        usage.total += num(u.input_tokens) + num(u.output_tokens);
         break;
       }
       case "error":
@@ -414,21 +1158,13 @@ function describe(raw) {
     return s;
   }
 }
-function num2(v) {
-  return typeof v === "number" && Number.isFinite(v) ? v : 0;
-}
-function oneLine2(s, max = 80) {
-  const t = s.replace(/\s+/g, " ").trim();
-  return t.length > max ? `${t.slice(0, max - 1)}\u2026` : t;
-}
-var clip2 = (s, n) => s.length > n ? `${s.slice(0, n - 1)}\u2026` : s;
 
 // src/backends/codex/index.ts
-var binary2 = () => findBinary("codex", "PITROOM_CODEX_BIN");
-var codexHome = () => process.env.CODEX_HOME ?? path3.join(os3.homedir(), ".codex");
+var binary3 = () => findBinary("codex", "PITROOM_CODEX_BIN");
+var codexHome = () => process.env.CODEX_HOME ?? path7.join(os5.homedir(), ".codex");
 function cx(args, timeout = 6e4) {
-  const { command, prefix } = resolveCommand(binary2());
-  const r = spawnSync2(command, [...prefix, ...args], {
+  const { command, prefix } = resolveCommand(binary3());
+  const r = spawnSync3(command, [...prefix, ...args], {
     encoding: "utf8",
     timeout,
     stdio: ["ignore", "pipe", "pipe"],
@@ -438,12 +1174,7 @@ function cx(args, timeout = 6e4) {
 }
 var SANDBOX = { read: "read-only", write: "workspace-write", isolate: "workspace-write" };
 var toml = (s) => JSON.stringify(s);
-function splitModel(model) {
-  if (!model) return {};
-  const [m, effort] = model.split("#");
-  return { model: m || void 0, effort: effort || void 0 };
-}
-function invocation2(req) {
+function invocation3(req) {
   const { model, effort } = splitModel(req.model);
   const args = ["exec"];
   if (req.sessionId) args.push("resume", req.sessionId);
@@ -460,10 +1191,10 @@ function invocation2(req) {
   if (model) args.push("--model", model);
   if (effort) args.push("-c", `model_reasoning_effort=${toml(effort)}`);
   args.push(req.prompt);
-  const { command, prefix } = resolveCommand(binary2());
+  const { command, prefix } = resolveCommand(binary3());
   return { command, args: [...prefix, ...args], env: {} };
 }
-function classify2(message) {
+function classify3(message) {
   if (/not supported|model[^.]*(not found|does not exist|unknown|unavailable)|unsupported model|no such model/i.test(message)) {
     return "model-unavailable";
   }
@@ -471,37 +1202,37 @@ function classify2(message) {
   if (/unauthori[sz]ed|\b40[13]\b|not logged in|log ?in|api.?key|credits?\b|billing|subscription/i.test(message)) return "auth";
   return "other";
 }
-function failure2(run, stderr, exitCode) {
+function failure3(run, stderr, exitCode) {
   if (exitCode === 0 && !run.error) return void 0;
   const detail = stderr.split("\n").find((l) => /^Error[: ]|ERROR/.test(l) && !/rmcp|models cache/.test(l));
   let message = run.error ?? (detail ? detail.trim() : `codex exited with code ${exitCode}`);
   if (/not supported when using Codex/i.test(message)) message += " (an outdated Codex CLI says this too: npm i -g @openai/codex@latest)";
-  return { kind: classify2(message), message };
+  return { kind: classify3(message), message };
 }
 function resolveModel(sessionId) {
-  const root = path3.join(codexHome(), "sessions");
-  const day = (d) => path3.join(root, String(d.getFullYear()), String(d.getMonth() + 1).padStart(2, "0"), String(d.getDate()).padStart(2, "0"));
+  const root = path7.join(codexHome(), "sessions");
+  const day = (d) => path7.join(root, String(d.getFullYear()), String(d.getMonth() + 1).padStart(2, "0"), String(d.getDate()).padStart(2, "0"));
   const now = /* @__PURE__ */ new Date();
   for (const dir of [day(now), day(new Date(now.getTime() - 864e5))]) {
     let files = [];
     try {
-      files = fs3.readdirSync(dir).filter((f) => f.includes(sessionId));
+      files = fs8.readdirSync(dir).filter((f) => f.includes(sessionId));
     } catch {
       continue;
     }
     for (const f of files) {
-      const m = /"model":"([^"]+)"/.exec(fs3.readFileSync(path3.join(dir, f), "utf8"));
+      const m = /"model":"([^"]+)"/.exec(fs8.readFileSync(path7.join(dir, f), "utf8"));
       if (m) return m[1];
     }
   }
   return void 0;
 }
-function doctor2({ models, hasFallback }) {
+function doctor3({ models, hasFallback }) {
   const version = cx(["--version"]);
   if (version.missing || !version.ok) {
-    return [{ level: "fail", message: `codex not runnable (${binary2()}). Install: npm i -g @openai/codex, or set PITROOM_CODEX_BIN` }];
+    return [{ level: "fail", message: `codex not runnable (${binary3()}). Install: npm i -g @openai/codex, or set PITROOM_CODEX_BIN` }];
   }
-  const checks = [{ level: "ok", message: `${version.out.trim()} at ${binary2()}` }];
+  const checks = [{ level: "ok", message: `${version.out.trim()} at ${binary3()}` }];
   const login = cx(["login", "status"]);
   checks.push(
     login.ok && /logged in/i.test(login.out) ? { level: "ok", message: `Codex: ${login.out.trim().split("\n")[0]}` } : { level: "fail", message: "Codex is not logged in: run `codex login`" }
@@ -517,9 +1248,9 @@ function doctor2({ models, hasFallback }) {
   return checks;
 }
 function catalog2() {
-  const file = path3.join(codexHome(), "models_cache.json");
+  const file = path7.join(codexHome(), "models_cache.json");
   try {
-    const raw = JSON.parse(fs3.readFileSync(file, "utf8"));
+    const raw = JSON.parse(fs8.readFileSync(file, "utf8"));
     const models = (raw.models ?? []).filter((m) => m.visibility !== "hide" && typeof m.slug === "string").map((m) => ({
       id: m.slug,
       efforts: (m.supported_reasoning_levels ?? []).map(
@@ -537,143 +1268,25 @@ var codex = {
   name: "Codex",
   catalog: catalog2,
   capabilities: { readOnly: "os-sandbox", resume: "by-id", reportsCost: false, attachFiles: false },
-  binary: binary2,
-  invocation: invocation2,
-  parse: parseEvents2,
-  failure: failure2,
-  resolveModel,
-  doctor: doctor2
-};
-
-// src/backends/gemini/index.ts
-import { spawnSync as spawnSync3 } from "node:child_process";
-import fs6 from "node:fs";
-import os5 from "node:os";
-import path5 from "node:path";
-import { fileURLToPath } from "node:url";
-
-// src/core/store.ts
-import fs5 from "node:fs";
-import os4 from "node:os";
-import path4 from "node:path";
-import crypto from "node:crypto";
-
-// src/core/fs-atomic.ts
-import fs4 from "node:fs";
-var BUSY = /* @__PURE__ */ new Set(["EPERM", "EBUSY", "EACCES"]);
-function renameOver(tmp, file) {
-  for (let attempt = 0; ; attempt++) {
-    try {
-      fs4.renameSync(tmp, file);
-      return;
-    } catch (e) {
-      if (process.platform !== "win32" || !BUSY.has(e.code ?? "") || attempt >= 40) throw e;
-      Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 25);
-    }
-  }
-}
-
-// src/core/store.ts
-var TERMINAL = ["done", "failed", "timeout", "stopped"];
-var isActive = (s) => !TERMINAL.includes(s);
-function home() {
-  if (process.env.PITROOM_HOME) return path4.resolve(process.env.PITROOM_HOME);
-  if (process.platform === "win32") {
-    return path4.join(process.env.LOCALAPPDATA ?? path4.join(os4.homedir(), "AppData", "Local"), "pitroom");
-  }
-  return path4.join(process.env.XDG_STATE_HOME ?? path4.join(os4.homedir(), ".local", "state"), "pitroom");
-}
-var runsDir = () => path4.join(home(), "runs");
-var ledgerFile = () => path4.join(home(), "ledger.jsonl");
-var runDir = (id) => path4.join(runsDir(), id);
-var runFile = (id, name) => path4.join(runDir(id), name);
-function newRunId(now = /* @__PURE__ */ new Date()) {
-  const p = (n) => String(n).padStart(2, "0");
-  const stamp2 = `${now.getFullYear()}${p(now.getMonth() + 1)}${p(now.getDate())}-${p(now.getHours())}${p(now.getMinutes())}${p(now.getSeconds())}`;
-  return `${stamp2}-${crypto.randomBytes(2).toString("hex")}`;
-}
-var onFinished;
-var archive;
-function writeMeta(meta) {
-  fs5.mkdirSync(runDir(meta.id), { recursive: true });
-  const file = runFile(meta.id, "meta.json");
-  const tmp = `${file}.${process.pid}.tmp`;
-  fs5.writeFileSync(tmp, JSON.stringify(meta, null, 2));
-  renameOver(tmp, file);
-  if (TERMINAL.includes(meta.state)) {
-    try {
-      onFinished?.(meta);
-    } catch {
-    }
-  }
-}
-function readMeta(id) {
-  const file = runFile(id, "meta.json");
-  if (!fs5.existsSync(file)) {
-    const kept = archive?.meta(id);
-    if (kept) return upgrade(kept);
-  }
-  return upgrade(JSON.parse(fs5.readFileSync(file, "utf8")));
-}
-function upgrade(raw) {
-  if (!raw.worker) raw.worker = raw.model ? { backend: "opencode", model: raw.model } : { backend: "opencode" };
-  if (!Array.isArray(raw.fallback)) {
-    raw.fallback = (raw.fallbackModels ?? []).map((m) => ({ backend: "opencode", model: m }));
-  }
-  raw.warnings ??= [];
-  raw.files ??= [];
-  raw.link ??= [];
-  return raw;
-}
-function listRunIds() {
-  if (!fs5.existsSync(runsDir())) return [];
-  return fs5.readdirSync(runsDir()).filter((d) => fs5.existsSync(runFile(d, "meta.json"))).sort();
-}
-function resolveRun(ref) {
-  const ids = listRunIds();
-  if (!ref || ref === "latest" || ref === "last") {
-    if (!ids.length) throw new UserError("no runs yet");
-    return ids[ids.length - 1];
-  }
-  if (ids.includes(ref)) return ref;
-  const hits = ids.filter((id) => id.startsWith(ref) || id.endsWith(ref));
-  if (hits.length === 1) return hits[0];
-  if (!hits.length) {
-    const kept = archive?.id(ref);
-    if (kept) return kept;
-  }
-  throw new UserError(hits.length ? `ambiguous run "${ref}": ${hits.join(", ")}` : ids.length ? `unknown run "${ref}"` : "no runs yet");
-}
-function isAlive(pid) {
-  if (!pid) return false;
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch (e) {
-    return e.code === "EPERM";
-  }
-}
-var STOP_FILE = "stop-requested";
-var requestStop = (id) => fs5.writeFileSync(runFile(id, STOP_FILE), "");
-function freshMeta(id) {
-  const meta = readMeta(id);
-  if (!TERMINAL.includes(meta.state) && meta.pid && !isAlive(meta.pid)) {
-    const latest = readMeta(id);
-    if (TERMINAL.includes(latest.state)) return latest;
-    const stopped = latest.stopRequested || fs5.existsSync(runFile(id, STOP_FILE));
-    latest.state = stopped ? "stopped" : "failed";
-    if (!stopped) latest.error ??= "worker process exited unexpectedly";
-    latest.endedAt ??= (/* @__PURE__ */ new Date()).toISOString();
-    writeMeta(latest);
-    return latest;
-  }
-  return meta;
-}
+  binary: binary3,
+  invocation: invocation3,
+  parse: parseEvents3,
+  failure: failure3,
+  resolveModel,
+  doctor: doctor3
+};
+
+// src/backends/gemini/index.ts
+import { spawnSync as spawnSync4 } from "node:child_process";
+import fs9 from "node:fs";
+import os6 from "node:os";
+import path8 from "node:path";
+import { fileURLToPath } from "node:url";
 
 // src/backends/gemini/events.ts
-var EDIT_TOOLS2 = /* @__PURE__ */ new Set(["replace", "write_file", "edit"]);
-var DENIED2 = /policy|permission|not allowed|denied|blocked|disallowed|refus/i;
-function parseEvents3(jsonl) {
+var EDIT_TOOLS3 = /* @__PURE__ */ new Set(["replace", "write_file", "edit"]);
+var DENIED3 = /policy|permission|not allowed|denied|blocked|disallowed|refus/i;
+function parseEvents4(jsonl) {
   const usage = {
     input: 0,
     output: 0,
@@ -703,8 +1316,8 @@ function parseEvents3(jsonl) {
     text = "";
     if (!said) return;
     lastText = said;
-    lastActivity = `says: ${oneLine3(said)}`;
-    if (timeline.length < MAX_STEPS) timeline.push({ kind: "say", text: clip3(said, 600) });
+    lastActivity = `says: ${oneLine(said)}`;
+    if (timeline.length < MAX_STEPS) timeline.push({ kind: "say", text: clip(said, 600) });
   };
   const startTurn = () => {
     if (!inTurn) turns++;
@@ -736,11 +1349,11 @@ function parseEvents3(jsonl) {
       usage.toolCalls++;
       tools[name] = (tools[name] ?? 0) + 1;
       const target = p.file_path ?? p.absolute_path ?? p.path ?? p.dir_path ?? p.pattern ?? p.command ?? p.query ?? p.url ?? p.prompt;
-      lastActivity = `${name} ${target ? oneLine3(String(target), 60) : ""}`.trim();
+      lastActivity = `${name} ${target ? oneLine(String(target), 60) : ""}`.trim();
       const file = p.file_path ?? p.absolute_path ?? p.path;
-      if (EDIT_TOOLS2.has(name) && file) pendingEdits.set(String(e.tool_id), String(file));
+      if (EDIT_TOOLS3.has(name) && file) pendingEdits.set(String(e.tool_id), String(file));
       if (timeline.length < MAX_STEPS) {
-        const step = { kind: EDIT_TOOLS2.has(name) ? "edit" : name === "run_shell_command" ? "shell" : "tool", name, text: clip3(String(target ?? ""), 240) };
+        const step = { kind: EDIT_TOOLS3.has(name) ? "edit" : name === "run_shell_command" ? "shell" : "tool", name, text: clip(String(target ?? ""), 240) };
         timeline.push(step);
         stepOf.set(String(e.tool_id), step);
       }
@@ -749,18 +1362,18 @@ function parseEvents3(jsonl) {
       const ok = e.status === "success";
       const step = stepOf.get(String(e.tool_id));
       if (step) step.ok = ok;
-      if (!ok && DENIED2.test(`${e.error?.type ?? ""} ${e.error?.message ?? ""}`)) usage.denied++;
+      if (!ok && DENIED3.test(`${e.error?.type ?? ""} ${e.error?.message ?? ""}`)) usage.denied++;
       if (ok && pendingEdits.has(String(e.tool_id))) edits.push(pendingEdits.get(String(e.tool_id)));
     } else if (e.type === "error") {
       if (e.severity === "error") error ??= String(e.message ?? "Gemini CLI error");
     } else if (e.type === "result") {
       const s = e.stats ?? {};
-      const cached3 = num3(s.cached);
+      const cached3 = num(s.cached);
       usage.cacheRead += cached3;
-      usage.input += s.input !== void 0 ? num3(s.input) : Math.max(0, num3(s.input_tokens) - cached3);
-      usage.output += num3(s.output_tokens);
-      usage.total += num3(s.total_tokens) || num3(s.input_tokens) + num3(s.output_tokens);
-      usage.toolCalls = Math.max(usage.toolCalls, num3(s.tool_calls));
+      usage.input += s.input !== void 0 ? num(s.input) : Math.max(0, num(s.input_tokens) - cached3);
+      usage.output += num(s.output_tokens);
+      usage.total += num(s.total_tokens) || num(s.input_tokens) + num(s.output_tokens);
+      usage.toolCalls = Math.max(usage.toolCalls, num(s.tool_calls));
       model ??= Object.keys(s.models ?? {})[0];
       if (e.status === "error") error ??= String(e.error?.message ?? e.error?.type ?? "Gemini CLI error");
     }
@@ -769,20 +1382,12 @@ function parseEvents3(jsonl) {
   usage.steps = turns;
   return { sessionId, model, finalText: error ? "" : lastText, usage, tools, edits, lastActivity, timeline, error };
 }
-var clip3 = (s, n) => s.length > n ? `${s.slice(0, n - 1)}\u2026` : s;
-function num3(v) {
-  return typeof v === "number" && Number.isFinite(v) ? v : 0;
-}
-function oneLine3(s, max = 80) {
-  const t = s.replace(/\s+/g, " ").trim();
-  return t.length > max ? `${t.slice(0, max - 1)}\u2026` : t;
-}
 
 // src/backends/gemini/index.ts
-var binary3 = () => findBinary("gemini", "PITROOM_GEMINI_BIN", ["~/.local/bin/gemini"]);
+var binary4 = () => findBinary("gemini", "PITROOM_GEMINI_BIN", ["~/.local/bin/gemini"]);
 function gem(args, timeout = 6e4) {
-  const { command, prefix } = resolveCommand(binary3());
-  const r = spawnSync3(command, [...prefix, ...args], {
+  const { command, prefix } = resolveCommand(binary4());
+  const r = spawnSync4(command, [...prefix, ...args], {
     encoding: "utf8",
     timeout,
     stdio: ["ignore", "pipe", "pipe"],
@@ -790,32 +1395,19 @@ function gem(args, timeout = 6e4) {
   });
   return { ok: r.status === 0, out: r.stdout ?? "", err: r.stderr ?? "", missing: !!r.error };
 }
-var policyDir = () => path5.resolve(path5.dirname(fileURLToPath(import.meta.url)), "..", "policies", "gemini");
-function workerHome() {
-  const root = path5.join(home(), "gemini-home");
-  const dir = path5.join(root, ".gemini");
-  const base = JSON.parse(fs6.readFileSync(path5.join(policyDir(), "worker-settings.json"), "utf8"));
+var policyDir = () => path8.resolve(path8.dirname(fileURLToPath(import.meta.url)), "..", "policies", "gemini");
+function workerHome2() {
+  const root = path8.join(home(), "gemini-home");
+  const dir = path8.join(root, ".gemini");
+  const base = JSON.parse(fs9.readFileSync(path8.join(policyDir(), "worker-settings.json"), "utf8"));
   const auth = settings().security?.auth;
   const body = `${JSON.stringify(auth ? { ...base, security: { ...base.security, auth } } : base, null, 2)}
 `;
-  const file = path5.join(dir, "settings.json");
-  try {
-    if (fs6.readFileSync(file, "utf8") === body) return root;
-  } catch {
-  }
-  fs6.mkdirSync(dir, { recursive: true });
-  fs6.writeFileSync(file, body);
-  for (const name of ["oauth_creds.json", "google_accounts.json"]) {
-    const from = path5.join(geminiHome(), name);
-    const to = path5.join(dir, name);
-    try {
-      if (fs6.existsSync(from) && !fs6.existsSync(to)) fs6.symlinkSync(from, to);
-    } catch {
-    }
-  }
+  writeIfChanged(path8.join(dir, "settings.json"), body);
+  for (const name of ["oauth_creds.json", "google_accounts.json"]) linkInto(dir, path8.join(geminiHome(), name));
   return root;
 }
-function invocation3(req) {
+function invocation4(req) {
   const dir = policyDir();
   const policies = ["base.toml", ...req.web ? [] : ["no-web.toml"], ...req.mode === "read" ? [] : ["shell.toml"]];
   const args = [
@@ -829,18 +1421,18 @@ function invocation3(req) {
     "-e",
     "none"
   ];
-  for (const p of policies) args.push("--policy", path5.join(dir, p));
+  for (const p of policies) args.push("--policy", path8.join(dir, p));
   if (req.sessionId) args.push("--resume", req.sessionId);
   if (process.env.PITROOM_GEMINI_TRUST === "1") args.push("--skip-trust");
   const [model] = (req.model ?? "").split("#");
   if (model) args.push("--model", model);
-  const { command, prefix } = resolveCommand(binary3());
-  const env = { GEMINI_CLI_HOME: workerHome() };
-  const trusted = path5.join(geminiHome(), "trustedFolders.json");
-  if (fs6.existsSync(trusted)) env.GEMINI_CLI_TRUSTED_FOLDERS_PATH = trusted;
+  const { command, prefix } = resolveCommand(binary4());
+  const env = { GEMINI_CLI_HOME: workerHome2() };
+  const trusted = path8.join(geminiHome(), "trustedFolders.json");
+  if (fs9.existsSync(trusted)) env.GEMINI_CLI_TRUSTED_FOLDERS_PATH = trusted;
   return { command, args: [...prefix, ...args], env };
 }
-function classify3(message) {
+function classify4(message) {
   if (/IneligibleTier|no longer supported for Gemini|error authenticating|not logged in|please (log ?in|sign in)|credentials|api key|UNAUTHENTICATED|PERMISSION_DENIED|\b40[13]\b|unauthori[sz]ed/i.test(message)) {
     return "auth";
   }
@@ -849,20 +1441,20 @@ function classify3(message) {
   return "other";
 }
 var UNTRUSTED = "Gemini CLI does not trust this folder: open `gemini` in it once and trust it, or set PITROOM_GEMINI_TRUST=1 (the folder's own Gemini settings, hooks included, then load)";
-function failure3(run, stderr, exitCode) {
+function failure4(run, stderr, exitCode) {
   if (exitCode === 0 && !run.error) return void 0;
   const lines = stderr.trim().split("\n").map((l) => l.trim()).filter(Boolean);
   const detail = lines.find((l) => /error|failed|exceeded|quota|exhausted|unsupported/i.test(l) && !/^at /.test(l)) ?? lines.at(-1);
   const raw = run.error ?? detail ?? `gemini exited with code ${exitCode}`;
   const message = /not running in a trusted directory/i.test(`${stderr} ${raw}`) ? UNTRUSTED : raw;
-  return { kind: classify3(message), message };
+  return { kind: classify4(message), message };
 }
 function geminiHome() {
-  return path5.join(process.env.GEMINI_CLI_HOME ?? os5.homedir(), ".gemini");
+  return path8.join(process.env.GEMINI_CLI_HOME ?? os6.homedir(), ".gemini");
 }
 function settings() {
   try {
-    return JSON.parse(fs6.readFileSync(path5.join(geminiHome(), "settings.json"), "utf8"));
+    return JSON.parse(fs9.readFileSync(path8.join(geminiHome(), "settings.json"), "utf8"));
   } catch {
     return {};
   }
@@ -873,15 +1465,15 @@ function defaultModel2() {
   const name = typeof m === "string" ? m : m?.name;
   return typeof name === "string" ? name : void 0;
 }
-function doctor3({ models, hasFallback }) {
+function doctor4({ models, hasFallback }) {
   const version = gem(["--version"]);
   if (version.missing || !version.ok) {
-    return [{ level: "fail", message: `gemini not runnable (${binary3()}). Install Gemini CLI (npm i -g @google/gemini-cli), or set PITROOM_GEMINI_BIN` }];
+    return [{ level: "fail", message: `gemini not runnable (${binary4()}). Install Gemini CLI (npm i -g @google/gemini-cli), or set PITROOM_GEMINI_BIN` }];
   }
-  const checks = [{ level: "ok", message: `Gemini CLI ${version.out.trim()} at ${binary3()}` }];
+  const checks = [{ level: "ok", message: `Gemini CLI ${version.out.trim()} at ${binary4()}` }];
   const key = process.env.GEMINI_API_KEY || process.env.GOOGLE_API_KEY;
   const vertex = process.env.GOOGLE_GENAI_USE_VERTEXAI === "true" || process.env.GOOGLE_GENAI_USE_VERTEXAI === "1";
-  const signedIn = fs6.existsSync(path5.join(geminiHome(), "oauth_creds.json"));
+  const signedIn = fs9.existsSync(path8.join(geminiHome(), "oauth_creds.json"));
   const type = settings().security?.auth?.selectedType;
   if (key || vertex) {
     checks.push({ level: "ok", message: `Gemini CLI: ${key ? "an API key is set" : "Vertex AI is set up"}` });
@@ -910,7 +1502,7 @@ function doctor3({ models, hasFallback }) {
 }
 function catalog3() {
   const def = defaultModel2();
-  const models = ["gemini-3.8-flash", "gemini-3.5-flash", "gemini-3.5-flash-lite", "gemini-3.1-pro-preview", "gemini-3-flash-preview"].map((id) => ({ id }));
+  const models = ["gemini-3.8-flash", "gemini-3.5-flash", "gemini-3.5-flash-lite", "gemini-3.1-pro-preview", "gemini-3-flash-preview"].map((id2) => ({ id: id2 }));
   if (def && !models.some((m) => m.id === def)) models.push({ id: def });
   return { models, source: "Gemini CLI's built-in model names (it cannot list models); the effort suffix is not used" };
 }
@@ -918,26 +1510,26 @@ var gemini = {
   id: "gemini",
   name: "Gemini CLI",
   capabilities: { readOnly: "approval-mode", resume: "by-id", reportsCost: false, attachFiles: false },
-  binary: binary3,
+  binary: binary4,
   catalog: catalog3,
-  invocation: invocation3,
-  parse: parseEvents3,
-  failure: failure3,
+  invocation: invocation4,
+  parse: parseEvents4,
+  failure: failure4,
   defaultModel: defaultModel2,
-  doctor: doctor3
+  doctor: doctor4
 };
 
 // src/backends/kilo/index.ts
-import { spawnSync as spawnSync5 } from "node:child_process";
-import path7 from "node:path";
+import { spawnSync as spawnSync6 } from "node:child_process";
+import path10 from "node:path";
 
 // src/backends/opencode/index.ts
-import { spawnSync as spawnSync4 } from "node:child_process";
+import { spawnSync as spawnSync5 } from "node:child_process";
 
 // src/backends/opencode/events.ts
-var EDIT_TOOLS3 = /* @__PURE__ */ new Set(["edit", "write", "patch", "multiedit", "apply_patch"]);
-var DENIED3 = /rule which prevents you|permission denied|permission\.rejected/i;
-function parseEvents4(ndjson) {
+var EDIT_TOOLS4 = /* @__PURE__ */ new Set(["edit", "write", "patch", "multiedit", "apply_patch"]);
+var DENIED4 = /rule which prevents you|permission denied|permission\.rejected/i;
+function parseEvents5(ndjson) {
   const usage = {
     input: 0,
     output: 0,
@@ -974,8 +1566,8 @@ function parseEvents4(ndjson) {
         const key = String(p.messageID ?? "");
         if (!textByMessage.has(key)) textByMessage.set(key, []);
         textByMessage.get(key).push(text);
-        lastActivity = `says: ${oneLine4(text)}`;
-        if (timeline.length < MAX_STEPS) timeline.push({ kind: "say", text: clip4(text.trim(), 600), at: stamp(e.timestamp) });
+        lastActivity = `says: ${oneLine(text)}`;
+        if (timeline.length < MAX_STEPS) timeline.push({ kind: "say", text: clip(text.trim(), 600), at: stamp(e.timestamp) });
         break;
       }
       case "tool_use": {
@@ -983,28 +1575,28 @@ function parseEvents4(ndjson) {
         const st = p.state ?? {};
         usage.toolCalls++;
         tools[name] = (tools[name] ?? 0) + 1;
-        if (st.status === "error" && DENIED3.test(String(st.error ?? ""))) usage.denied++;
-        if (st.status === "completed" && EDIT_TOOLS3.has(name)) {
+        if (st.status === "error" && DENIED4.test(String(st.error ?? ""))) usage.denied++;
+        if (st.status === "completed" && EDIT_TOOLS4.has(name)) {
           edits.push(String(st.input?.filePath ?? st.input?.path ?? name));
         }
         lastActivity = `${name} ${describe2(st.input)}`.trim();
         if (timeline.length < MAX_STEPS) {
-          const kind2 = EDIT_TOOLS3.has(name) ? "edit" : /^(bash|shell)$/.test(name) ? "shell" : "tool";
+          const kind2 = EDIT_TOOLS4.has(name) ? "edit" : /^(bash|shell)$/.test(name) ? "shell" : "tool";
           const text = kind2 === "shell" ? String(st.input?.command ?? "") : String(st.input?.filePath ?? st.input?.path ?? st.input?.pattern ?? st.input?.url ?? "") || describe2(st.input);
-          timeline.push({ kind: kind2, name, text: clip4(text, 240), ok: st.status === "completed" ? true : st.status === "error" ? false : void 0, at: stamp(e.timestamp) });
+          timeline.push({ kind: kind2, name, text: clip(text, 240), ok: st.status === "completed" ? true : st.status === "error" ? false : void 0, at: stamp(e.timestamp) });
         }
         break;
       }
       case "step_finish": {
         const t = p.tokens ?? {};
         usage.steps++;
-        usage.input += num4(t.input);
-        usage.output += num4(t.output);
-        usage.reasoning += num4(t.reasoning);
-        usage.cacheRead += num4(t.cache?.read);
-        usage.cacheWrite += num4(t.cache?.write);
-        usage.total += num4(t.total) || num4(t.input) + num4(t.output) + num4(t.reasoning) + num4(t.cache?.read);
-        usage.cost = (usage.cost ?? 0) + num4(p.cost);
+        usage.input += num(t.input);
+        usage.output += num(t.output);
+        usage.reasoning += num(t.reasoning);
+        usage.cacheRead += num(t.cache?.read);
+        usage.cacheWrite += num(t.cache?.write);
+        usage.total += num(t.total) || num(t.input) + num(t.output) + num(t.reasoning) + num(t.cache?.read);
+        usage.cost = (usage.cost ?? 0) + num(p.cost);
         break;
       }
       case "error": {
@@ -1028,25 +1620,17 @@ function describeError(err) {
   const tags = [err.type, inner, err.status && `HTTP ${err.status}`].filter(Boolean);
   return tags.length ? `${message} [${tags.join(", ")}]` : message;
 }
-var clip4 = (s, n) => s.length > n ? `${s.slice(0, n - 1)}\u2026` : s;
 var stamp = (v) => typeof v === "number" && Number.isFinite(v) ? v : void 0;
-function num4(v) {
-  return typeof v === "number" && Number.isFinite(v) ? v : 0;
-}
-function oneLine4(s, max = 80) {
-  const t = s.replace(/\s+/g, " ").trim();
-  return t.length > max ? `${t.slice(0, max - 1)}\u2026` : t;
-}
 function describe2(input) {
   if (!input || typeof input !== "object") return "";
   const v = input.filePath ?? input.path ?? input.pattern ?? input.command ?? input.url ?? input.query;
-  return v ? oneLine4(String(v), 60) : "";
+  return v ? oneLine(String(v), 60) : "";
 }
 
 // src/backends/opencode/profiles.ts
-import fs7 from "node:fs";
-import os6 from "node:os";
-import path6 from "node:path";
+import fs10 from "node:fs";
+import os7 from "node:os";
+import path9 from "node:path";
 var AGENT = { read: "pitroom-read", write: "pitroom-write" };
 var READ_FILES = {
   "*": "allow",
@@ -1142,22 +1726,23 @@ var FORBIDDEN_BASH = [
   "opencode*",
   "kilo *",
   "kilocode*",
+  "agy *",
   "pitroom *",
   "*pitroom*"
 ];
 function scratchDirs(app) {
-  const data = process.env.XDG_DATA_HOME ?? path6.join(os6.homedir(), ".local", "share");
+  const data = process.env.XDG_DATA_HOME ?? path9.join(os7.homedir(), ".local", "share");
   const rules = {
     "*": "deny",
-    [path6.join(data, app, "tool-output", "*")]: "allow",
-    [path6.join(data, app, "shell", "*", "*")]: "allow"
+    [path9.join(data, app, "tool-output", "*")]: "allow",
+    [path9.join(data, app, "shell", "*", "*")]: "allow"
   };
-  for (const tmp of /* @__PURE__ */ new Set([os6.tmpdir(), realpath(os6.tmpdir())])) rules[path6.join(tmp, app, "*")] = "allow";
+  for (const tmp of /* @__PURE__ */ new Set([os7.tmpdir(), realpath(os7.tmpdir())])) rules[path9.join(tmp, app, "*")] = "allow";
   return rules;
 }
 function realpath(p) {
   try {
-    return fs7.realpathSync(p);
+    return fs10.realpathSync(p);
   } catch {
     return p;
   }
@@ -1246,10 +1831,10 @@ function isObject(v) {
 }
 
 // src/backends/opencode/index.ts
-var binary4 = () => findBinary("opencode", "PITROOM_OPENCODE_BIN", ["~/.opencode/bin/opencode"]);
+var binary5 = () => findBinary("opencode", "PITROOM_OPENCODE_BIN", ["~/.opencode/bin/opencode"]);
 function oc(args, opts = {}) {
-  const { command, prefix } = resolveCommand(binary4());
-  const r = spawnSync4(command, [...prefix, ...args], {
+  const { command, prefix } = resolveCommand(binary5());
+  const r = spawnSync5(command, [...prefix, ...args], {
     encoding: "utf8",
     timeout: opts.timeout ?? 6e4,
     env: opts.env ?? process.env,
@@ -1259,7 +1844,7 @@ function oc(args, opts = {}) {
   return { ok: r.status === 0, out: r.stdout ?? "", err: r.stderr ?? "", missing: !!r.error };
 }
 var jsonIn = (s) => JSON.parse(s.slice(s.indexOf("{")));
-function invocation4(req) {
+function invocation5(req) {
   const args = [
     "run",
     "--standalone",
@@ -1278,7 +1863,7 @@ function invocation4(req) {
   if (req.sessionId) args.push("--session", req.sessionId);
   for (const f of req.files) args.push("--file", f);
   args.push(req.prompt);
-  const { command, prefix } = resolveCommand(binary4());
+  const { command, prefix } = resolveCommand(binary5());
   return {
     command,
     args: [...prefix, ...args],
@@ -1293,7 +1878,7 @@ function majorVersion(output) {
   const m = /(\d+)\.\d+\.\d+/.exec(output);
   return m ? Number(m[1]) : void 0;
 }
-function classify4(message) {
+function classify5(message) {
   if (/model not found|ModelNotFound|unknown model|no such model|deprecated/i.test(message)) return "model-unavailable";
   if (/rate.?limit|too many requests|\b429\b|quota|overloaded|\b50[23]\b|unavailable|capacity/i.test(message)) return "rate-limited";
   if (/provider\.auth|FreeTierError|free tier|unauthori[sz]ed|\b40[13]\b|api.?key|insufficient|credits?\b|billing|payment/i.test(message)) {
@@ -1301,17 +1886,17 @@ function classify4(message) {
   }
   return "other";
 }
-function failure4(run, stderr, exitCode) {
+function failure5(run, stderr, exitCode) {
   if (exitCode === 0 && !run.error) return void 0;
   const detail = stderr.match(/error="([^"]+)"/g)?.pop()?.slice(7, -1);
   const raw = run.error ?? `opencode exited with code ${exitCode}`;
   const message = detail && !raw.includes(detail) ? `${raw}: ${detail}` : raw;
-  return { kind: classify4(message), message };
+  return { kind: classify5(message), message };
 }
 function modelId(m) {
   if (typeof m === "string") return m;
-  const id = m?.model ?? m?.id;
-  return m?.providerID && id ? `${m.providerID}/${id}` : void 0;
+  const id2 = m?.model ?? m?.id;
+  return m?.providerID && id2 ? `${m.providerID}/${id2}` : void 0;
 }
 function defaultModel3() {
   try {
@@ -1341,25 +1926,25 @@ function resolveModel2(sessionId) {
 function catalog4() {
   const ids = listModels();
   return {
-    models: (ids.length ? ids : listModels()).map((id) => ({ id })),
+    models: (ids.length ? ids : listModels()).map((id2) => ({ id: id2 })),
     source: "`opencode models` (reasoning variants are provider-specific: provider/model#variant)"
   };
 }
 function listModels() {
   return oc(["models"]).out.split("\n").map((s) => s.trim()).filter(Boolean);
 }
-function doctor4({ models, hasFallback }) {
+function doctor5({ models, hasFallback }) {
   const checks = [];
   const version = oc(["--version"]);
   if (version.missing || !version.ok) {
-    return [{ level: "fail", message: `opencode not runnable (${binary4()}). Install: https://opencode.ai or set PITROOM_OPENCODE_BIN` }];
+    return [{ level: "fail", message: `opencode not runnable (${binary5()}). Install: https://opencode.ai or set PITROOM_OPENCODE_BIN` }];
   }
   const v = version.out.trim().replace(/^opencode\s+/i, "");
   const major = majorVersion(v);
   if (major !== void 0 && major < 2) {
     return [{ level: "fail", message: `OpenCode ${v} is too old: Pitroom needs OpenCode v2 or newer (run \`opencode upgrade\`)` }];
   }
-  checks.push({ level: "ok", message: `opencode ${v} at ${binary4()} (private --standalone server per run)` });
+  checks.push({ level: "ok", message: `opencode ${v} at ${binary5()} (private --standalone server per run)` });
   const known = new Set(listModels());
   const def = defaultModel3();
   for (const m of models) {
@@ -1387,25 +1972,25 @@ var opencode = {
   id: "opencode",
   name: "OpenCode",
   capabilities: { readOnly: "permission-rules", resume: "by-id", reportsCost: true, attachFiles: true },
-  binary: binary4,
-  invocation: invocation4,
-  parse: parseEvents4,
-  failure: failure4,
+  binary: binary5,
+  invocation: invocation5,
+  parse: parseEvents5,
+  failure: failure5,
   defaultModel: defaultModel3,
   resolveModel: resolveModel2,
   listModels,
   catalog: catalog4,
-  doctor: doctor4
+  doctor: doctor5
 };
 
 // src/backends/kilo/index.ts
-var binary5 = () => findBinary("kilo", "PITROOM_KILO_BIN", ["~/.kilo/bin/kilo"]);
+var binary6 = () => findBinary("kilo", "PITROOM_KILO_BIN", ["~/.kilo/bin/kilo"]);
 function kilo(args, timeout = 6e4) {
-  const { command, prefix } = resolveCommand(binary5());
-  const r = spawnSync5(command, [...prefix, ...args], { encoding: "utf8", timeout, stdio: ["ignore", "pipe", "pipe"], maxBuffer: 64 * 1024 * 1024 });
+  const { command, prefix } = resolveCommand(binary6());
+  const r = spawnSync6(command, [...prefix, ...args], { encoding: "utf8", timeout, stdio: ["ignore", "pipe", "pipe"], maxBuffer: 64 * 1024 * 1024 });
   return { ok: r.status === 0, out: r.stdout ?? "", err: r.stderr ?? "", missing: !!r.error };
 }
-function invocation5(req) {
+function invocation6(req) {
   const args = [
     "run",
     "--agent",
@@ -1423,7 +2008,7 @@ function invocation5(req) {
   if (req.sessionId) args.push("--session", req.sessionId);
   for (const f of req.files) args.push("--file", f);
   args.push(req.prompt);
-  const { command, prefix } = resolveCommand(binary5());
+  const { command, prefix } = resolveCommand(binary6());
   return {
     command,
     args: [...prefix, ...args],
@@ -1431,16 +2016,16 @@ function invocation5(req) {
       // A worker run must not upgrade Kilo underneath the user.
       KILO_CONFIG_CONTENT: configContent(process.env.KILO_CONFIG_CONTENT, req.web, "kilo", { autoupdate: false }),
       // No daemon to attach to: a private server per run (see above).
-      XDG_STATE_HOME: path7.join(home(), "kilo-state")
+      XDG_STATE_HOME: path10.join(home(), "kilo-state")
     }
   };
 }
-function failure5(run, stderr, exitCode) {
+function failure6(run, stderr, exitCode) {
   if (exitCode === 0 && !run.error) return void 0;
   const detail = stderr.match(/error="([^"]+)"/g)?.pop()?.slice(7, -1);
   const raw = run.error ?? `kilo exited with code ${exitCode}`;
   const message = detail && !raw.includes(detail) ? `${raw}: ${detail}` : raw;
-  return { kind: classify4(message), message };
+  return { kind: classify5(message), message };
 }
 function listModels2() {
   return kilo(["models"]).out.split("\n").map((s) => s.trim()).filter((s) => /^[\w.-]+\/\S+$/.test(s));
@@ -1455,14 +2040,14 @@ function defaultModel4() {
   }
 }
 function catalog5() {
-  return { models: listModels2().map((id) => ({ id })), source: "`kilo models` (reasoning variants are provider-specific: provider/model#variant)" };
+  return { models: listModels2().map((id2) => ({ id: id2 })), source: "`kilo models` (reasoning variants are provider-specific: provider/model#variant)" };
 }
-function doctor5({ models, hasFallback }) {
+function doctor6({ models, hasFallback }) {
   const version = kilo(["--version"]);
   if (version.missing || !version.ok) {
-    return [{ level: "fail", message: `kilo not runnable (${binary5()}). Install Kilo Code's CLI (npm i -g @kilocode/cli), or set PITROOM_KILO_BIN` }];
+    return [{ level: "fail", message: `kilo not runnable (${binary6()}). Install Kilo Code's CLI (npm i -g @kilocode/cli), or set PITROOM_KILO_BIN` }];
   }
-  const checks = [{ level: "ok", message: `Kilo Code ${version.out.trim().split("\n").pop()} at ${binary5()} (beta worker: checked against 7.8)` }];
+  const checks = [{ level: "ok", message: `Kilo Code ${version.out.trim().split("\n").pop()} at ${binary6()} (beta worker: checked against 7.8)` }];
   const def = defaultModel4();
   for (const m of models) {
     const model = m ?? def;
@@ -1476,29 +2061,29 @@ var kiloBackend = {
   id: "kilo",
   name: "Kilo Code",
   capabilities: { readOnly: "permission-rules", resume: "by-id", reportsCost: true, attachFiles: true },
-  binary: binary5,
-  invocation: invocation5,
-  parse: parseEvents4,
-  failure: failure5,
+  binary: binary6,
+  invocation: invocation6,
+  parse: parseEvents5,
+  failure: failure6,
   defaultModel: defaultModel4,
   listModels: listModels2,
   catalog: catalog5,
-  doctor: doctor5
+  doctor: doctor6
 };
 
 // src/backends/qwen/index.ts
-import { spawnSync as spawnSync6 } from "node:child_process";
-import fs8 from "node:fs";
-import os7 from "node:os";
-import path8 from "node:path";
+import { spawnSync as spawnSync7 } from "node:child_process";
+import fs11 from "node:fs";
+import os8 from "node:os";
+import path11 from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 
 // src/backends/qwen/events.ts
-var EDIT_TOOLS4 = /* @__PURE__ */ new Set(["write_file", "edit", "notebook_edit"]);
-var SHELL = "run_shell_command";
-var DENIED4 = /permission was declined|denied by permission rules|requires permission|not allowed/i;
+var EDIT_TOOLS5 = /* @__PURE__ */ new Set(["write_file", "edit", "notebook_edit"]);
+var SHELL2 = "run_shell_command";
+var DENIED5 = /permission was declined|denied by permission rules|requires permission|not allowed/i;
 var API_ERROR = /^\[API Error: /;
-function parseEvents5(jsonl) {
+function parseEvents6(jsonl) {
   const usage = { input: 0, output: 0, reasoning: 0, cacheRead: 0, cacheWrite: 0, total: 0, steps: 0, toolCalls: 0, denied: 0 };
   const tools = {};
   const edits = [];
@@ -1535,16 +2120,16 @@ function parseEvents5(jsonl) {
       for (const c of content) {
         if (c.type === "text" && String(c.text ?? "").trim()) {
           lastText = String(c.text).trim();
-          lastActivity = `says: ${oneLine5(lastText)}`;
-          if (timeline.length < MAX_STEPS) timeline.push({ kind: "say", text: clip5(lastText, 600) });
+          lastActivity = `says: ${oneLine(lastText)}`;
+          if (timeline.length < MAX_STEPS) timeline.push({ kind: "say", text: clip(lastText, 600) });
         } else if (c.type === "tool_use") {
           usage.toolCalls++;
           tools[c.name] = (tools[c.name] ?? 0) + 1;
           const target = c.input?.file_path ?? c.input?.path ?? c.input?.pattern ?? c.input?.command ?? c.input?.url;
-          lastActivity = `${c.name} ${target ? oneLine5(String(target), 60) : ""}`.trim();
-          if (EDIT_TOOLS4.has(c.name) && c.input?.file_path) pendingEdits.set(String(c.id), String(c.input.file_path));
+          lastActivity = `${c.name} ${target ? oneLine(String(target), 60) : ""}`.trim();
+          if (EDIT_TOOLS5.has(c.name) && c.input?.file_path) pendingEdits.set(String(c.id), String(c.input.file_path));
           if (timeline.length < MAX_STEPS) {
-            const step = { kind: EDIT_TOOLS4.has(c.name) ? "edit" : c.name === SHELL ? "shell" : "tool", name: c.name, text: clip5(String(target ?? ""), 240) };
+            const step = { kind: EDIT_TOOLS5.has(c.name) ? "edit" : c.name === SHELL2 ? "shell" : "tool", name: c.name, text: clip(String(target ?? ""), 240) };
             timeline.push(step);
             stepOf.set(String(c.id), step);
           }
@@ -1557,17 +2142,17 @@ function parseEvents5(jsonl) {
         const step = stepOf.get(String(c.tool_use_id));
         if (step) step.ok = !c.is_error;
         if (c.is_error) {
-          if (DENIED4.test(text)) usage.denied++;
+          if (DENIED5.test(text)) usage.denied++;
         } else if (pendingEdits.has(String(c.tool_use_id))) {
           edits.push(pendingEdits.get(String(c.tool_use_id)));
         }
       }
     } else if (e.type === "result") {
       const u = e.usage ?? {};
-      usage.input += Math.max(0, num5(u.input_tokens) - num5(u.cache_read_input_tokens));
-      usage.cacheRead += num5(u.cache_read_input_tokens);
-      usage.output += num5(u.output_tokens);
-      usage.total += num5(u.total_tokens) || num5(u.input_tokens) + num5(u.output_tokens);
+      usage.input += Math.max(0, num(u.input_tokens) - num(u.cache_read_input_tokens));
+      usage.cacheRead += num(u.cache_read_input_tokens);
+      usage.output += num(u.output_tokens);
+      usage.total += num(u.total_tokens) || num(u.input_tokens) + num(u.output_tokens);
       usage.denied = Math.max(usage.denied, Array.isArray(e.permission_denials) ? e.permission_denials.length : 0);
       if (e.is_error) {
         error ??= apiError(String(e.error?.message ?? e.result ?? e.subtype ?? "Qwen Code error"));
@@ -1579,16 +2164,10 @@ function parseEvents5(jsonl) {
   return { sessionId, model, finalText: finalText ?? (error ? "" : lastText), usage, tools, edits, lastActivity, timeline, error };
 }
 var apiError = (text) => text.replace(API_ERROR, "").replace(/\](?=\s*(\n|$))/, "").replace(/\s+/g, " ").trim() || text;
-var clip5 = (s, n) => s.length > n ? `${s.slice(0, n - 1)}\u2026` : s;
-var num5 = (v) => typeof v === "number" && Number.isFinite(v) ? v : 0;
-var oneLine5 = (s, max = 80) => {
-  const t = s.replace(/\s+/g, " ").trim();
-  return t.length > max ? `${t.slice(0, max - 1)}\u2026` : t;
-};
 
 // src/backends/qwen/index.ts
-var binary6 = () => findBinary("qwen", "PITROOM_QWEN_BIN", ["~/.local/bin/qwen", "~/.npm-global/bin/qwen"]);
-var policyDir2 = () => path8.resolve(path8.dirname(fileURLToPath2(import.meta.url)), "..", "policies", "qwen");
+var binary7 = () => findBinary("qwen", "PITROOM_QWEN_BIN", ["~/.local/bin/qwen", "~/.npm-global/bin/qwen"]);
+var policyDir2 = () => path11.resolve(path11.dirname(fileURLToPath2(import.meta.url)), "..", "policies", "qwen");
 var EXCLUDED = [
   "agent",
   "send_message",
@@ -1613,48 +2192,8 @@ var EXCLUDED = [
 ];
 var WEB = ["web_fetch", "web_search"];
 var EDITS_HERE = ["Edit(./**)", "write_file(./**)", "notebook_edit(./**)"];
-var DENY_SHELL = [
-  "git commit",
-  "git push",
-  "git pull",
-  "git reset",
-  "git checkout",
-  "git restore",
-  "git clean",
-  "git stash",
-  "git rebase",
-  "git merge",
-  "git switch",
-  "git branch",
-  "git tag",
-  "git rm",
-  "git worktree",
-  "git update-ref",
-  "git config",
-  "git remote",
-  "git cherry-pick",
-  "git revert",
-  "git am",
-  "git add",
-  "rm -rf",
-  "rm -fr",
-  "sudo",
-  "chown",
-  "kill",
-  "pkill",
-  "killall",
-  "gh",
-  "npm publish",
-  "pitroom",
-  "opencode",
-  "claude",
-  "codex",
-  "gemini",
-  "qwen",
-  "kilo",
-  "kilocode"
-].map((c) => `run_shell_command(${c})`);
-function invocation6(req) {
+var DENY_SHELL = FORBIDDEN_COMMANDS.map((c) => `run_shell_command(${c})`);
+function invocation7(req) {
   const read = req.mode === "read";
   const exclude = [...EXCLUDED, ...req.web ? [] : WEB, ...read ? [] : DENY_SHELL];
   const args = [
@@ -1673,32 +2212,32 @@ function invocation6(req) {
   const model = (req.model ?? "").split("#")[0];
   if (model) args.push("--model", model);
   if (req.sessionId) args.push("--resume", req.sessionId);
-  const { command, prefix } = resolveCommand(binary6());
+  const { command, prefix } = resolveCommand(binary7());
   return {
     command,
     args: [...prefix, ...args],
     env: {
-      QWEN_CODE_SYSTEM_DEFAULTS_PATH: path8.join(policyDir2(), "worker-defaults.json"),
+      QWEN_CODE_SYSTEM_DEFAULTS_PATH: path11.join(policyDir2(), "worker-defaults.json"),
       QWEN_CODE_DISABLE_CRON: "1",
       QWEN_DISABLE_AUTO_TITLE: "1"
     }
   };
 }
-function classify5(message) {
+function classify6(message) {
   if (/\b40[13]\b|incorrect api key|invalid api key|unauthori[sz]ed|authenticat|not logged in|no auth/i.test(message)) return "auth";
   if (/\b429\b|rate.?limit|too many requests|quota|capacity|overloaded|\b529\b/i.test(message)) return "rate-limited";
   if (/model[^.]*(not found|does not exist|not available|not supported)|invalid model|model_not_found|\b404\b/i.test(message)) return "model-unavailable";
   return "other";
 }
-function failure6(run, stderr, exitCode) {
+function failure7(run, stderr, exitCode) {
   if (exitCode === 0 && !run.error) return void 0;
   const detail = stderr.trim().split("\n").filter((l) => l.trim() && !/SAFE MODE/.test(l)).pop();
   const message = run.error ?? detail ?? `qwen exited with code ${exitCode}`;
-  return { kind: classify5(message), message };
+  return { kind: classify6(message), message };
 }
 function userSettings() {
   try {
-    return JSON.parse(fs8.readFileSync(path8.join(process.env.QWEN_HOME ?? path8.join(os7.homedir(), ".qwen"), "settings.json"), "utf8"));
+    return JSON.parse(fs11.readFileSync(path11.join(process.env.QWEN_HOME ?? path11.join(os8.homedir(), ".qwen"), "settings.json"), "utf8"));
   } catch {
     return {};
   }
@@ -1707,11 +2246,11 @@ function defaultModel5() {
   const name = userSettings().model?.name;
   return typeof name === "string" && name ? name : void 0;
 }
-function doctor6({ models, hasFallback }) {
-  const { command, prefix } = resolveCommand(binary6());
-  const r = spawnSync6(command, [...prefix, "--version"], { encoding: "utf8", timeout: 6e4, stdio: ["ignore", "pipe", "pipe"] });
-  if (r.error || r.status !== 0) return [{ level: "fail", message: `qwen not runnable (${binary6()}). Install Qwen Code (npm i -g @qwen-code/qwen-code), or set PITROOM_QWEN_BIN` }];
-  const checks = [{ level: "ok", message: `Qwen Code ${r.stdout.trim()} at ${binary6()} (beta worker: checked against Qwen Code 0.25)` }];
+function doctor7({ models, hasFallback }) {
+  const { command, prefix } = resolveCommand(binary7());
+  const r = spawnSync7(command, [...prefix, "--version"], { encoding: "utf8", timeout: 6e4, stdio: ["ignore", "pipe", "pipe"] });
+  if (r.error || r.status !== 0) return [{ level: "fail", message: `qwen not runnable (${binary7()}). Install Qwen Code (npm i -g @qwen-code/qwen-code), or set PITROOM_QWEN_BIN` }];
+  const checks = [{ level: "ok", message: `Qwen Code ${r.stdout.trim()} at ${binary7()} (beta worker: checked against Qwen Code 0.25)` }];
   const auth = userSettings().security?.auth?.selectedType;
   const key = process.env.OPENAI_API_KEY || process.env.DASHSCOPE_API_KEY || process.env.ANTHROPIC_API_KEY || process.env.GEMINI_API_KEY;
   checks.push(
@@ -1728,27 +2267,27 @@ var qwen = {
   id: "qwen",
   name: "Qwen Code",
   capabilities: { readOnly: "approval-mode", resume: "by-id", reportsCost: false, attachFiles: false },
-  binary: binary6,
-  invocation: invocation6,
-  parse: parseEvents5,
-  failure: failure6,
+  binary: binary7,
+  invocation: invocation7,
+  parse: parseEvents6,
+  failure: failure7,
   defaultModel: defaultModel5,
-  doctor: doctor6
+  doctor: doctor7
 };
 
 // src/backends/index.ts
-var REGISTRY = new Map([opencode, codex, claude, gemini, qwen, kiloBackend].map((b) => [b.id, b]));
+var REGISTRY = new Map([opencode, codex, claude, gemini, qwen, kiloBackend, antigravity].map((b) => [b.id, b]));
 var DEFAULT_BACKEND = opencode.id;
 var PLANNED = ["hermes"];
 var backendIds = () => [...REGISTRY.keys()];
 var allBackends = () => [...REGISTRY.values()];
-var isBackendId = (id) => REGISTRY.has(id) || PLANNED.includes(id);
-function getBackend(id) {
-  const backend = REGISTRY.get(id);
+var isBackendId = (id2) => REGISTRY.has(id2) || PLANNED.includes(id2);
+function getBackend(id2) {
+  const backend = REGISTRY.get(id2);
   if (backend) return backend;
   const available = backendIds().join(", ");
   throw new UserError(
-    PLANNED.includes(id) ? `the "${id}" worker is not supported yet (available: ${available})` : `unknown worker "${id}" (available: ${available})`,
+    PLANNED.includes(id2) ? `the "${id2}" worker is not supported yet (available: ${available})` : `unknown worker "${id2}" (available: ${available})`,
     3
   );
 }
@@ -1769,12 +2308,12 @@ var formatTarget = (t) => t.model ? `${t.backend}:${t.model}` : t.backend;
 var describeTarget = (t) => t.model ? formatTarget(t) : `${t.backend} (default model)`;
 
 // src/core/refs.ts
-import fs9 from "node:fs";
-import path9 from "node:path";
+import fs12 from "node:fs";
+import path12 from "node:path";
 var FILE_EXTENSIONS = new Set(
   "ts tsx mts cts js jsx mjs cjs json jsonc json5 md mdx txt rst py pyi rb go rs java kt kts swift c h cc cpp cxx hpp hh cs fs php lua r jl sh bash zsh fish ps1 bat yml yaml toml ini cfg conf env html htm css scss sass less vue svelte astro sql graphql gql proto lock xml svg csv tsv gradle tf hcl dart ex exs erl hs ml scala clj vim el mk cmake dockerfile gitignore gitattributes editorconfig npmrc nvmrc".split(" ")
 );
-var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", "build", "out", ".next", ".nuxt", "target", "vendor", ".venv", "venv", "__pycache__", "coverage", ".turbo", ".cache"]);
+var SKIP_DIRS2 = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", "build", "out", ".next", ".nuxt", "target", "vendor", ".venv", "venv", "__pycache__", "coverage", ".turbo", ".cache"]);
 var MAX_INDEXED = 6e4;
 var EXTENSIONLESS = "Makefile|Dockerfile|Containerfile|Gemfile|Rakefile|Procfile|Justfile|Vagrantfile|BUILD|WORKSPACE";
 var REF = new RegExp(
@@ -1821,13 +2360,13 @@ function extractRefs(answer) {
   return [...seen.values()];
 }
 function verifyRefs(refs, dirs) {
-  const roots = [...new Set(dirs.filter(Boolean).map((d) => path9.resolve(d)))];
+  const roots = [...new Set(dirs.filter(Boolean).map((d) => path12.resolve(d)))];
   const invalid = [];
   const lineCache = /* @__PURE__ */ new Map();
   const load = (file) => {
     if (!lineCache.has(file)) {
-      const size = fs9.statSync(file).size;
-      const lines = size > MAX_BYTES ? null : fs9.readFileSync(file, "utf8").split("\n");
+      const size = fs12.statSync(file).size;
+      const lines = size > MAX_BYTES ? null : fs12.readFileSync(file, "utf8").split("\n");
       if (lines && lines[lines.length - 1] === "") lines.pop();
       lineCache.set(file, lines);
     }
@@ -1838,9 +2377,9 @@ function verifyRefs(refs, dirs) {
   const candidates = (ref) => {
     const direct = resolve(ref.file, roots);
     if (direct) return [direct];
-    if (path9.isAbsolute(ref.file)) return [];
+    if (path12.isAbsolute(ref.file)) return [];
     const wanted = ref.file.replace(/^(\.{1,2}\/)+/, "");
-    return (byName().get(path9.basename(wanted)) ?? []).filter((f) => f.split(path9.sep).join("/").endsWith(`/${wanted}`) || path9.basename(f) === wanted).slice(0, 20);
+    return (byName().get(path12.basename(wanted)) ?? []).filter((f) => f.split(path12.sep).join("/").endsWith(`/${wanted}`) || path12.basename(f) === wanted).slice(0, 20);
   };
   const check = (file, ref) => {
     const lines = load(file);
@@ -1855,7 +2394,7 @@ function verifyRefs(refs, dirs) {
     if (!files.length) {
       if (!ref.file.includes("/") && !isFileName(ref.file)) continue;
       total++;
-      invalid.push({ ref: ref.text, reason: path9.isAbsolute(ref.file) && !inside(ref.file, roots) ? "outside the project" : "file not found" });
+      invalid.push({ ref: ref.text, reason: path12.isAbsolute(ref.file) && !inside2(ref.file, roots) ? "outside the project" : "file not found" });
       continue;
     }
     total++;
@@ -1876,7 +2415,7 @@ function enclosedBy(lines, ref) {
   return lines.slice(Math.max(0, ref.start - 1 - DEFINITION_LOOKBACK), ref.start).some((l) => def.test(l));
 }
 var isFileName = (name) => {
-  const base = path9.basename(name);
+  const base = path12.basename(name);
   return !base.includes(".") || new RegExp(`^(${EXTENSIONLESS})$`).test(base) || FILE_EXTENSIONS.has(base.split(".").pop().toLowerCase());
 };
 function indexFiles(roots) {
@@ -1885,19 +2424,19 @@ function indexFiles(roots) {
   const walk = (dir) => {
     let entries;
     try {
-      entries = fs9.readdirSync(dir, { withFileTypes: true });
+      entries = fs12.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
     for (const e of entries) {
       if (count >= MAX_INDEXED) return;
       if (e.isDirectory()) {
-        if (!SKIP_DIRS.has(e.name)) walk(path9.join(dir, e.name));
+        if (!SKIP_DIRS2.has(e.name)) walk(path12.join(dir, e.name));
       } else if (e.isFile()) {
         count++;
         const list2 = index.get(e.name);
-        if (list2) list2.push(path9.join(dir, e.name));
-        else index.set(e.name, [path9.join(dir, e.name)]);
+        if (list2) list2.push(path12.join(dir, e.name));
+        else index.set(e.name, [path12.join(dir, e.name)]);
       }
     }
   };
@@ -1905,32 +2444,32 @@ function indexFiles(roots) {
   return index;
 }
 function resolve(ref, roots) {
-  const candidates = path9.isAbsolute(ref) ? inside(ref, roots) ? [ref] : [] : roots.map((r) => path9.join(r, ref));
+  const candidates = path12.isAbsolute(ref) ? inside2(ref, roots) ? [ref] : [] : roots.map((r) => path12.join(r, ref));
   return candidates.find((c) => {
     try {
-      return fs9.statSync(c).isFile() && inside(c, roots);
+      return fs12.statSync(c).isFile() && inside2(c, roots);
     } catch {
       return false;
     }
   });
 }
-function inside(file, roots) {
+function inside2(file, roots) {
   return roots.some((r) => {
-    const rel = path9.relative(r, path9.resolve(file));
-    return rel !== "" && !rel.startsWith("..") && !path9.isAbsolute(rel);
+    const rel = path12.relative(r, path12.resolve(file));
+    return rel !== "" && !rel.startsWith("..") && !path12.isAbsolute(rel);
   });
 }
 var escape = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 
 // src/core/templates.ts
-import fs10 from "node:fs";
-import path11 from "node:path";
+import fs13 from "node:fs";
+import path14 from "node:path";
 
 // src/core/install.ts
-import path10 from "node:path";
+import path13 from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 function packageRoot() {
-  return path10.resolve(path10.dirname(fileURLToPath3(import.meta.url)), "..");
+  return path13.resolve(path13.dirname(fileURLToPath3(import.meta.url)), "..");
 }
 
 // src/core/templates.ts
@@ -1941,9 +2480,9 @@ var FILES = {
   "code-reviewer": "pitroom-review/code-reviewer.md"
 };
 function loadTemplate(name, root = packageRoot()) {
-  const file = path11.join(root, "skills", FILES[name]);
-  if (!fs10.existsSync(file)) throw new UserError(`template missing: ${file} (broken install? run pitroom doctor)`, 3);
-  return fs10.readFileSync(file, "utf8").replace(/^\s*<!--[\s\S]*?-->\s*/, "");
+  const file = path14.join(root, "skills", FILES[name]);
+  if (!fs13.existsSync(file)) throw new UserError(`template missing: ${file} (broken install? run pitroom doctor)`, 3);
+  return fs13.readFileSync(file, "utf8").replace(/^\s*<!--[\s\S]*?-->\s*/, "");
 }
 function fill(template, values) {
   const missing = [...template.matchAll(/\{\{([A-Z_]+)\}\}/g)].map((m) => m[1]).filter((k) => !(k in values));
@@ -2000,9 +2539,9 @@ function parseAudit(text) {
 }
 
 // src/core/config.ts
-import fs11 from "node:fs";
-import os8 from "node:os";
-import path12 from "node:path";
+import fs14 from "node:fs";
+import os9 from "node:os";
+import path15 from "node:path";
 var SCHEMA = {
   worker: "string",
   fallback: "string[]",
@@ -2033,37 +2572,37 @@ var SCHEMA = {
   rankWorkers: "boolean"
 };
 function configPath() {
-  if (process.env.PITROOM_CONFIG) return path12.resolve(process.env.PITROOM_CONFIG);
-  const base = process.platform === "win32" ? process.env.APPDATA ?? path12.join(os8.homedir(), "AppData", "Roaming") : process.env.XDG_CONFIG_HOME ?? path12.join(os8.homedir(), ".config");
-  return path12.join(base, "pitroom", "config.json");
+  if (process.env.PITROOM_CONFIG) return path15.resolve(process.env.PITROOM_CONFIG);
+  const base = process.platform === "win32" ? process.env.APPDATA ?? path15.join(os9.homedir(), "AppData", "Roaming") : process.env.XDG_CONFIG_HOME ?? path15.join(os9.homedir(), ".config");
+  return path15.join(base, "pitroom", "config.json");
 }
 var cached;
 function loadConfig() {
   if (cached) return cached;
   const file = configPath();
   const config = {};
-  const warnings = [];
-  if (fs11.existsSync(file)) {
+  const warnings2 = [];
+  if (fs14.existsSync(file)) {
     let raw;
     try {
-      raw = JSON.parse(fs11.readFileSync(file, "utf8"));
+      raw = JSON.parse(fs14.readFileSync(file, "utf8"));
     } catch (e) {
-      warnings.push(`${file}: invalid JSON (${e.message}); ignored`);
+      warnings2.push(`${file}: invalid JSON (${e.message}); ignored`);
     }
     if (raw && typeof raw === "object" && !Array.isArray(raw)) {
       for (const [key, value] of Object.entries(raw)) {
         const type = SCHEMA[key];
         if (!type) {
-          warnings.push(`${file}: unknown key "${key}" ignored`);
+          warnings2.push(`${file}: unknown key "${key}" ignored`);
         } else if (matches(value, type)) {
           config[key] = value;
         } else {
-          warnings.push(`${file}: "${key}" must be ${type}; ignored`);
+          warnings2.push(`${file}: "${key}" must be ${type}; ignored`);
         }
       }
     }
   }
-  cached = { config, warnings };
+  cached = { config, warnings: warnings2 };
   return cached;
 }
 function matches(v, type) {
@@ -2199,22 +2738,22 @@ function rankChain(chain, recordOf) {
 }
 
 // src/core/receipt.ts
-import fs13 from "node:fs";
+import fs16 from "node:fs";
 
 // src/core/prices.ts
-import fs12 from "node:fs";
-import path13 from "node:path";
+import fs15 from "node:fs";
+import path16 from "node:path";
 var RETRY_AFTER_FAILURE_MS = 60 * 6e4;
-var catalogFile = () => path13.join(home(), "prices.json");
+var catalogFile = () => path16.join(home(), "prices.json");
 function trim(raw) {
   const out = {};
   if (!raw || typeof raw !== "object") return out;
   for (const [provider, p] of Object.entries(raw)) {
-    for (const [id, m] of Object.entries(p?.models ?? {})) {
+    for (const [id2, m] of Object.entries(p?.models ?? {})) {
       const c = m?.cost;
       const ok = (n) => typeof n === "number" && Number.isFinite(n) && n >= 0;
       if (!c || !ok(c.input) || !ok(c.output)) continue;
-      out[`${provider}/${id}`] = [c.input, c.output, ok(c.cache_read) ? c.cache_read : c.input / 10];
+      out[`${provider}/${id2}`] = [c.input, c.output, ok(c.cache_read) ? c.cache_read : c.input / 10];
     }
   }
   return out;
@@ -2223,9 +2762,9 @@ var cached2;
 function readCatalog() {
   const file = catalogFile();
   try {
-    const { mtimeMs } = fs12.statSync(file);
+    const { mtimeMs } = fs15.statSync(file);
     if (cached2?.file === file && cached2.mtimeMs === mtimeMs) return cached2.catalog;
-    const parsed = JSON.parse(fs12.readFileSync(file, "utf8"));
+    const parsed = JSON.parse(fs15.readFileSync(file, "utf8"));
     const catalog6 = parsed && typeof parsed.models === "object" && parsed.models && Number.isFinite(Date.parse(parsed.fetchedAt)) ? parsed : void 0;
     cached2 = { file, mtimeMs, catalog: catalog6 };
     return catalog6;
@@ -2238,10 +2777,10 @@ function catalogPrice(backend, ...models) {
   const catalog6 = readCatalog();
   if (!catalog6) return void 0;
   for (const raw of models) {
-    const id = raw?.split("#")[0];
-    if (!id) continue;
-    const keys = [id, ...[...OWN[backend] ?? [], "anthropic", "openai", "google"].map((p) => `${p}/${id}`)];
-    const any = keys.find((k) => catalog6.models[k]) ?? Object.keys(catalog6.models).filter((k) => k.endsWith(`/${id}`)).sort()[0];
+    const id2 = raw?.split("#")[0];
+    if (!id2) continue;
+    const keys = [id2, ...[...OWN[backend] ?? [], "anthropic", "openai", "google"].map((p) => `${p}/${id2}`)];
+    const any = keys.find((k) => catalog6.models[k]) ?? Object.keys(catalog6.models).filter((k) => k.endsWith(`/${id2}`)).sort()[0];
     const triple = any ? catalog6.models[any] : void 0;
     if (any && triple && triple.length === 3 && triple.every((n) => Number.isFinite(n) && n >= 0)) {
       const [input, output, cachedInput] = triple;
@@ -2283,8 +2822,8 @@ function savedUsd(usage, returnedTokens, price = primaryPrice()) {
   return Math.max(0, costAt(usage, price) - (workerCostOf(usage) ?? 0) - readingTheReport);
 }
 function readLedger(sinceMs) {
-  if (!fs13.existsSync(ledgerFile())) return [];
-  return fs13.readFileSync(ledgerFile(), "utf8").split("\n").filter(Boolean).flatMap((l) => {
+  if (!fs16.existsSync(ledgerFile())) return [];
+  return fs16.readFileSync(ledgerFile(), "utf8").split("\n").filter(Boolean).flatMap((l) => {
     try {
       return [JSON.parse(l)];
     } catch {
@@ -2362,8 +2901,8 @@ ${tile(0, compact(t.tokens), "Tokens offloaded")}${tile(1, t.ratio ? `${Math.rou
 var WEEK_MS = 7 * 24 * 3600 * 1e3;
 
 // src/core/plan.ts
-import fs14 from "node:fs";
-import path14 from "node:path";
+import fs17 from "node:fs";
+import path17 from "node:path";
 var FENCE = /^ {0,3}(`{3,}|~{3,})(.*)$/;
 var RULE = /^ {0,3}([-*_])(\s*\1){2,}\s*$/;
 function structure(lines) {
@@ -2410,9 +2949,9 @@ function parsePlan(text, file = "") {
   return { file, title: titleHeading?.text ?? "", header, constraints, tasks };
 }
 function loadPlan(file) {
-  const abs = path14.resolve(file);
-  if (!fs14.existsSync(abs) || !fs14.statSync(abs).isFile()) throw new UserError(`plan not found: ${file}`);
-  const plan = parsePlan(fs14.readFileSync(abs, "utf8"), fs14.realpathSync(abs));
+  const abs = path17.resolve(file);
+  if (!fs17.existsSync(abs) || !fs17.statSync(abs).isFile()) throw new UserError(`plan not found: ${file}`);
+  const plan = parsePlan(fs17.readFileSync(abs, "utf8"), fs17.realpathSync(abs));
   if (!plan.tasks.length) throw new UserError(`${file} has no "Task N" headings (see pitroom-writing-plans)`);
   return plan;
 }
@@ -2431,7 +2970,7 @@ function brief(plan, task) {
   ].filter(Boolean).join("\n\n")}
 `;
 }
-var planName = (file) => path14.basename(file).replace(/\.md$/i, "");
+var planName = (file) => path17.basename(file).replace(/\.md$/i, "");
 
 // src/core/style.ts
 var enabled = () => {
@@ -2463,13 +3002,13 @@ function retryCommands(metas, shell = retryShell()) {
 }
 
 // src/core/eval.ts
-import { spawnSync as spawnSync7 } from "node:child_process";
-import fs15 from "node:fs";
+import { spawnSync as spawnSync8 } from "node:child_process";
+import fs18 from "node:fs";
 var KINDS = ["definition", "count", "set"];
 function loadEval(file) {
   let raw;
   try {
-    raw = JSON.parse(fs15.readFileSync(file, "utf8"));
+    raw = JSON.parse(fs18.readFileSync(file, "utf8"));
   } catch (e) {
     throw new UserError(`cannot read ${file}: ${e.message}`);
   }
@@ -2479,24 +3018,24 @@ function loadEval(file) {
   return list2.map((q, i) => {
     const where = `${file}: question ${i + 1}`;
     if (!q || typeof q !== "object") throw new UserError(`${where} is not an object`);
-    const id = typeof q.id === "string" && q.id.trim() ? q.id.trim() : `q${i + 1}`;
-    if (ids.has(id)) throw new UserError(`${where}: the id "${id}" is used twice`);
-    ids.add(id);
-    if (typeof q.task !== "string" || !q.task.trim()) throw new UserError(`${where} (${id}) has no task`);
-    if (!KINDS.includes(q.kind)) throw new UserError(`${where} (${id}): kind must be one of ${KINDS.join(", ")}`);
+    const id2 = typeof q.id === "string" && q.id.trim() ? q.id.trim() : `q${i + 1}`;
+    if (ids.has(id2)) throw new UserError(`${where}: the id "${id2}" is used twice`);
+    ids.add(id2);
+    if (typeof q.task !== "string" || !q.task.trim()) throw new UserError(`${where} (${id2}) has no task`);
+    if (!KINDS.includes(q.kind)) throw new UserError(`${where} (${id2}): kind must be one of ${KINDS.join(", ")}`);
     const t = q.truth;
     const grep = t && typeof t === "object" && !Array.isArray(t) && typeof t.grep === "string" && t.grep;
     const literal = q.kind === "definition" && typeof t === "string" && /:\d+$/.test(t) || q.kind === "count" && typeof t === "number" && Number.isInteger(t) && t >= 0 || q.kind === "set" && Array.isArray(t) && t.every((s) => typeof s === "string");
     if (!grep && !literal) {
       const want = { definition: '"path:line"', count: "a whole number", set: "a list of paths" }[q.kind];
-      throw new UserError(`${where} (${id}): truth must be ${want} or {"grep": "pattern", \u2026}`);
+      throw new UserError(`${where} (${id2}): truth must be ${want} or {"grep": "pattern", \u2026}`);
     }
-    return { id, task: q.task.trim(), kind: q.kind, truth: t };
+    return { id: id2, task: q.task.trim(), kind: q.kind, truth: t };
   });
 }
 var clean = (p) => p.replace(/\\/g, "/").replace(/^\.?\//, "");
 function gitGrep(root, flags, t) {
-  const r = spawnSync7("git", ["-C", root, "grep", ...flags, t.regex ? "-E" : "-F", ...t.word ? ["-w"] : [], "-e", t.grep, "--", t.dir ?? "."], {
+  const r = spawnSync8("git", ["-C", root, "grep", ...flags, t.regex ? "-E" : "-F", ...t.word ? ["-w"] : [], "-e", t.grep, "--", t.dir ?? "."], {
     encoding: "utf8",
     maxBuffer: 64 * 1024 * 1024
   });
@@ -2531,7 +3070,7 @@ function answerParts(answer) {
   const summary = s ? s[1] : text.split(/^\s*(?:DETAILS|FILES CHANGED|VERIFICATION|OPEN ISSUES):/m)[0];
   return { summary: summary.trim(), details: (d?.[1] ?? "").trim() };
 }
-function pathsIn(text) {
+function pathsIn2(text) {
   const found = text.replace(/\\/g, "/").match(/[A-Za-z0-9_.@\-/]+\.[A-Za-z0-9]{1,8}(?::\d+)?/g) ?? [];
   return [...new Set(found.map((p) => clean(p.replace(/:\d+$/, ""))))];
 }
@@ -2543,7 +3082,7 @@ function scoreAnswer(q, truth, answer, root) {
   if ("line" in truth) {
     const flat = summary.replace(/\s+/g, " ");
     if (new RegExp(`(^|[^\\w./-])\\.?/?${escape2(truth.path)}:${truth.line}(?!\\d)`).test(flat)) return { score: 1, got: `${truth.path}:${truth.line}` };
-    const named = pathsIn(flat).includes(truth.path);
+    const named = pathsIn2(flat).includes(truth.path);
     return { score: named ? 0.5 : 0, got: flat.slice(0, 120) };
   }
   if ("count" in truth) {
@@ -2551,8 +3090,8 @@ function scoreAnswer(q, truth, answer, root) {
     const got2 = n ? Number(n[0].replace(/,/g, "")) : void 0;
     return { score: got2 === truth.count ? 1 : 0, got: got2 === void 0 ? "(no number)" : String(got2) };
   }
-  let got = pathsIn(summary);
-  if (!got.length) got = pathsIn(details);
+  let got = pathsIn2(summary);
+  if (!got.length) got = pathsIn2(details);
   const hit = got.filter((p) => truth.files.includes(p)).length;
   const precision = got.length ? hit / got.length : 0;
   const recall = truth.files.length ? hit / truth.files.length : got.length ? 0 : 1;
@@ -2580,8 +3119,8 @@ function summarize(rows) {
 }
 
 // src/vcs/guard.ts
-import fs16 from "node:fs";
-import path15 from "node:path";
+import fs19 from "node:fs";
+import path18 from "node:path";
 var VERSION = 2;
 var WINDOWS = process.platform === "win32";
 var fwd = (p) => WINDOWS ? p.replace(/\\/g, "/") : p;
@@ -2658,29 +3197,29 @@ esac
 exec "$real" "$@"
 `;
 function shimDir() {
-  return path15.join(home(), "shim", `v${VERSION}`);
+  return path18.join(home(), "shim", `v${VERSION}`);
 }
 function findRealGit(skip) {
   const same = (a, b) => WINDOWS ? a.toLowerCase() === b.toLowerCase() : a === b;
-  for (const dir of (process.env.PATH ?? "").split(path15.delimiter).filter(Boolean)) {
-    if (same(path15.resolve(dir), skip)) continue;
-    const p = path15.join(dir, WINDOWS ? "git.exe" : "git");
+  for (const dir of (process.env.PATH ?? "").split(path18.delimiter).filter(Boolean)) {
+    if (same(path18.resolve(dir), skip)) continue;
+    const p = path18.join(dir, WINDOWS ? "git.exe" : "git");
     try {
-      fs16.accessSync(p, fs16.constants.X_OK);
-      if (fs16.statSync(p).isFile()) return p;
+      fs19.accessSync(p, fs19.constants.X_OK);
+      if (fs19.statSync(p).isFile()) return p;
     } catch {
     }
   }
   return void 0;
 }
 function findGitSh(realGit) {
-  let dir = path15.dirname(realGit);
+  let dir = path18.dirname(realGit);
   for (let i = 0; i < 4; i++) {
     for (const rel of ["bin/sh.exe", "usr/bin/sh.exe"]) {
-      const p = path15.join(dir, rel);
-      if (fs16.existsSync(p)) return p;
+      const p = path18.join(dir, rel);
+      if (fs19.existsSync(p)) return p;
     }
-    const up = path15.dirname(dir);
+    const up = path18.dirname(dir);
     if (up === dir) break;
     dir = up;
   }
@@ -2698,12 +3237,12 @@ var REF_HOOK = `#!/bin/sh
 echo "pitroom: git ref updates (commit, reset, branch, tag, stash, rebase, merge) are blocked for workers" >&2
 exit 1
 `;
-var hooksDir = () => path15.join(home(), "git-hooks", `v${HOOK_VERSION}`);
-function writeIfChanged(file, content) {
-  if (fs16.existsSync(file) && fs16.readFileSync(file, "utf8") === content) return;
-  fs16.mkdirSync(path15.dirname(file), { recursive: true });
+var hooksDir = () => path18.join(home(), "git-hooks", `v${HOOK_VERSION}`);
+function writeIfChanged2(file, content) {
+  if (fs19.existsSync(file) && fs19.readFileSync(file, "utf8") === content) return;
+  fs19.mkdirSync(path18.dirname(file), { recursive: true });
   const tmp = `${file}.${process.pid}.tmp`;
-  fs16.writeFileSync(tmp, content, { mode: 493 });
+  fs19.writeFileSync(tmp, content, { mode: 493 });
   renameOver(tmp, file);
 }
 function pathKey(env) {
@@ -2735,7 +3274,7 @@ function guardEnv(env) {
     GIT_PAGER: "cat",
     PAGER: "cat"
   };
-  writeIfChanged(path15.join(hooksDir(), "reference-transaction"), REF_HOOK);
+  writeIfChanged2(path18.join(hooksDir(), "reference-transaction"), REF_HOOK);
   env = withGitConfig(onePath(env), [
     ["core.hooksPath", fwd(hooksDir())],
     ["url.pitroom-push-blocked://.pushInsteadOf", ""]
@@ -2747,11 +3286,11 @@ function guardEnv(env) {
   if (WINDOWS) {
     sh = findGitSh(real);
     if (!sh) return { ...env, ...quiet };
-    writeIfChanged(path15.join(dir, "git.cmd"), cmdShim(sh));
+    writeIfChanged2(path18.join(dir, "git.cmd"), cmdShim(sh));
   }
-  writeIfChanged(path15.join(dir, "git"), SHIM);
+  writeIfChanged2(path18.join(dir, "git"), SHIM);
   const key = pathKey(env);
-  return { ...env, ...quiet, PITROOM_REAL_GIT: fwd(real), [key]: `${dir}${path15.delimiter}${env[key] ?? ""}` };
+  return { ...env, ...quiet, PITROOM_REAL_GIT: fwd(real), [key]: `${dir}${path18.delimiter}${env[key] ?? ""}` };
 }
 function shimReady() {
   const env = guardEnv({ ...process.env });
@@ -2759,11 +3298,11 @@ function shimReady() {
 }
 
 // src/core/slots.ts
-import crypto2 from "node:crypto";
-import fs17 from "node:fs";
-import path16 from "node:path";
-var slotsDir = () => path16.join(home(), "slots");
-var locksDir = () => path16.join(home(), "locks");
+import crypto4 from "node:crypto";
+import fs20 from "node:fs";
+import path19 from "node:path";
+var slotsDir = () => path19.join(home(), "slots");
+var locksDir = () => path19.join(home(), "locks");
 var STARTUP_GRACE_MS = 3e4;
 function holderActive(runId, self) {
   if (!runId || runId === self) return false;
@@ -2777,23 +3316,23 @@ function holderActive(runId, self) {
   }
 }
 function tryClaim(file, runId) {
-  fs17.mkdirSync(path16.dirname(file), { recursive: true });
+  fs20.mkdirSync(path19.dirname(file), { recursive: true });
   try {
-    fs17.writeFileSync(file, runId, { flag: "wx" });
+    fs20.writeFileSync(file, runId, { flag: "wx" });
     return true;
   } catch (e) {
     if (e.code !== "EEXIST") throw e;
   }
   let owner = "";
   try {
-    owner = fs17.readFileSync(file, "utf8").trim();
+    owner = fs20.readFileSync(file, "utf8").trim();
   } catch {
   }
   if (owner === runId) return true;
   if (holderActive(owner, runId)) return false;
-  fs17.rmSync(file, { force: true });
+  fs20.rmSync(file, { force: true });
   try {
-    fs17.writeFileSync(file, runId, { flag: "wx" });
+    fs20.writeFileSync(file, runId, { flag: "wx" });
     return true;
   } catch {
     return false;
@@ -2802,101 +3341,47 @@ function tryClaim(file, runId) {
 function releaseIfOwner(file, runId) {
   if (!file) return;
   try {
-    if (fs17.readFileSync(file, "utf8").trim() === runId) fs17.rmSync(file, { force: true });
+    if (fs20.readFileSync(file, "utf8").trim() === runId) fs20.rmSync(file, { force: true });
   } catch {
   }
 }
 function tryAcquireSlot(runId, maxParallel) {
   for (let n = 0; n < Math.max(1, maxParallel); n++) {
-    const file = path16.join(slotsDir(), `slot-${n}`);
+    const file = path19.join(slotsDir(), `slot-${n}`);
     if (tryClaim(file, runId)) return file;
   }
   return void 0;
 }
 var releaseSlot = (file, runId) => releaseIfOwner(file, runId);
 function slotHolders() {
-  if (!fs17.existsSync(slotsDir())) return [];
-  return fs17.readdirSync(slotsDir()).map((f) => {
+  if (!fs20.existsSync(slotsDir())) return [];
+  return fs20.readdirSync(slotsDir()).map((f) => {
     try {
-      return fs17.readFileSync(path16.join(slotsDir(), f), "utf8").trim();
+      return fs20.readFileSync(path19.join(slotsDir(), f), "utf8").trim();
     } catch {
       return "";
     }
-  }).filter((id) => holderActive(id, ""));
+  }).filter((id2) => holderActive(id2, ""));
 }
-var lockFile = (repoRoot) => path16.join(locksDir(), `write-${crypto2.createHash("sha1").update(path16.resolve(repoRoot)).digest("hex").slice(0, 16)}`);
+var lockFile = (repoRoot) => path19.join(locksDir(), `write-${crypto4.createHash("sha1").update(path19.resolve(repoRoot)).digest("hex").slice(0, 16)}`);
 function acquireWriteLock(repoRoot, runId) {
   const file = lockFile(repoRoot);
   if (tryClaim(file, runId)) return;
   let owner = "";
   try {
-    owner = fs17.readFileSync(file, "utf8").trim();
+    owner = fs20.readFileSync(file, "utf8").trim();
   } catch {
   }
   throw new UserError(`another --write run (${owner}) is active in this repo; use --isolate for parallel changes`, 3);
 }
 var releaseWriteLock = (repoRoot, runId) => releaseIfOwner(lockFile(repoRoot), runId);
 
-// src/core/secrets.ts
-import { execFileSync } from "node:child_process";
-import fs18 from "node:fs";
-import path17 from "node:path";
-var SKIP_DIRS2 = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", "build", "out", ".next", "target", "vendor", ".venv", "venv", "__pycache__", "coverage", ".turbo", ".cache"]);
-var MAX_VISITED = 2e4;
-var MAX_DEPTH = 4;
-var TEMPLATE = /\.(example|sample|template|dist|defaults?|tpl)$/i;
-function looksSecret(file) {
-  const name = file.toLowerCase();
-  if (TEMPLATE.test(name)) return false;
-  if (name === ".env" || name.startsWith(".env.") || name.endsWith(".env")) return true;
-  return /\.(pem|p12|pfx|key|jks|keystore)$/.test(name) || /^id_(rsa|dsa|ecdsa|ed25519)$/.test(name) || name === ".netrc" || name === "credentials.json" || /^secrets?\.(json|ya?ml|toml)$/.test(name);
-}
-function findSecretFiles(dir) {
-  const found = [];
-  let visited = 0;
-  const walk = (d, depth) => {
-    if (depth > MAX_DEPTH || visited > MAX_VISITED) return;
-    let entries;
-    try {
-      entries = fs18.readdirSync(d, { withFileTypes: true });
-    } catch {
-      return;
-    }
-    for (const e of entries) {
-      visited++;
-      if (e.isDirectory()) {
-        if (!SKIP_DIRS2.has(e.name)) walk(path17.join(d, e.name), depth + 1);
-      } else if (e.isFile() && looksSecret(e.name)) {
-        found.push(slash(path17.relative(dir, path17.join(d, e.name))));
-      }
-    }
-  };
-  walk(dir, 0);
-  return found.sort();
-}
-function findSecretFilesInTree(root, dir) {
-  try {
-    const out = execFileSync("git", ["-C", root, "ls-files", "-z", "--cached", "--others", "--exclude-standard"], { encoding: "utf8", maxBuffer: 256 * 1024 * 1024 });
-    return out.split("\0").filter((f) => f && looksSecret(path17.basename(f)) && !path17.relative(dir, path17.join(root, f)).startsWith("..")).map((f) => slash(path17.relative(dir, path17.join(root, f)))).sort();
-  } catch {
-    return [];
-  }
-}
-function secretWarning(files, mode) {
-  if (!files.length) return void 0;
-  const shown = files.slice(0, 3).join(", ") + (files.length > 3 ? `, +${files.length - 3} more` : "");
-  const where = mode === "isolate" ? "would be copied into the isolated copy" : "sit in the directory the worker runs in";
-  const fix = mode === "isolate" ? "add them to .gitignore, or" : "use an isolated copy (-i, git-ignored files are left out) or a clean checkout, or";
-  return `secret-looking files ${where} (${shown}): the worker is told not to read them, but nothing stops it, and its model may be hosted by a third party; ${fix} set PITROOM_NO_SECRET_WARNING=1 to silence this`;
-}
-var slash = (p) => p.split(path17.sep).join("/");
-
 // src/core/process.ts
 import { spawn } from "node:child_process";
-import fs19 from "node:fs";
+import fs21 from "node:fs";
 async function spawnWorker(inv, opts) {
-  const out = fs19.openSync(opts.stdoutFile, "w");
-  const err = fs19.openSync(opts.stderrFile, "w");
+  const out = fs21.openSync(opts.stdoutFile, "w");
+  const err = fs21.openSync(opts.stderrFile, "w");
   const res = { code: null, timedOut: false, stopped: false };
   const child = spawn(inv.command, inv.args, {
     cwd: opts.cwd,
@@ -2919,7 +3404,7 @@ async function spawnWorker(inv, opts) {
   }, opts.timeoutSec * 1e3);
   res.code = await new Promise((resolve2) => {
     child.on("error", (e) => {
-      res.spawnError = e.code === "ENOENT" ? fs19.existsSync(opts.cwd) ? `${inv.command} not found` : `the working directory ${opts.cwd} does not exist` : e.message;
+      res.spawnError = e.code === "ENOENT" ? fs21.existsSync(opts.cwd) ? `${inv.command} not found` : `the working directory ${opts.cwd} does not exist` : e.message;
       resolve2(127);
     });
     child.on("close", (c) => resolve2(c));
@@ -2928,13 +3413,14 @@ async function spawnWorker(inv, opts) {
   if (killer) clearTimeout(killer);
   process.off("SIGINT", stop);
   process.off("SIGTERM", stop);
-  fs19.closeSync(out);
-  fs19.closeSync(err);
+  fs21.closeSync(out);
+  fs21.closeSync(err);
   return res;
 }
 export {
   ASKS_FOR_LIST,
   DEFAULT_BACKEND,
+  FORBIDDEN_COMMANDS,
   STOP_FILE,
   TERMINAL,
   acquireWriteLock,
@@ -2963,6 +3449,7 @@ export {
   home,
   isActive,
   isAlive,
+  linkInto,
   listRunIds,
   loadEval,
   loadPlan,
@@ -2975,7 +3462,7 @@ export {
   parseStatus,
   parseTarget,
   parseVerdict,
-  pathsIn,
+  pathsIn2 as pathsIn,
   planName,
   planTask,
   primaryPrice,
@@ -3008,5 +3495,6 @@ export {
   usd,
   verifyRefs,
   workerCostOf,
+  writeIfChanged,
   writeMeta
 };