rterm-backend 3.7.5 → 3.7.7

package/bin/gybackend.cjs

@@ -11,10 +11,10 @@ var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __glob = (map3) => (path32) => {
-  var fn = map3[path32];
+var __glob = (map3) => (path33) => {
+  var fn = map3[path33];
   if (fn) return fn();
-  throw new Error("Module not found in bundle: " + path32);
+  throw new Error("Module not found in bundle: " + path33);
 };
 var __esm = (fn, res) => function __init() {
   return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
@@ -9040,7 +9040,7 @@ var require_eventemitter3 = __commonJS({
       if (listeners.fn) return 1;
       return listeners.length;
     };
-    EventEmitter4.prototype.emit = function emit10(event, a1, a2, a3, a4, a5) {
+    EventEmitter4.prototype.emit = function emit11(event, a1, a2, a3, a4, a5) {
       var evt = prefix ? prefix + event : event;
       if (!this._events[evt]) return false;
       var listeners = this._events[evt], len = arguments.length, args, i;
@@ -12024,8 +12024,8 @@ var init_parseUtil = __esm({
     init_errors();
     init_en();
     makeIssue = (params) => {
-      const { data, path: path32, errorMaps, issueData } = params;
-      const fullPath = [...path32, ...issueData.path || []];
+      const { data, path: path33, errorMaps, issueData } = params;
+      const fullPath = [...path33, ...issueData.path || []];
       const fullIssue = {
         ...issueData,
         path: fullPath
@@ -12333,11 +12333,11 @@ var init_types = __esm({
     init_parseUtil();
     init_util();
     ParseInputLazyPath = class {
-      constructor(parent, value, path32, key) {
+      constructor(parent, value, path33, key) {
         this._cachedPath = [];
         this.parent = parent;
         this.data = value;
-        this._path = path32;
+        this._path = path33;
         this._key = key;
       }
       get path() {
@@ -27268,11 +27268,11 @@ var require_pdf_worker = __commonJS({
                     var nameTree = new NameTree(nameTreeRef, xref);
                     var names = nameTree.getAll();
                     for (var name in names) {
-                      var fs23 = new FileSpec(names[name], xref);
+                      var fs24 = new FileSpec(names[name], xref);
                       if (!attachments) {
                         attachments = /* @__PURE__ */ Object.create(null);
                       }
-                      attachments[(0, _util.stringToPDFString)(name)] = fs23.serializable;
+                      attachments[(0, _util.stringToPDFString)(name)] = fs24.serializable;
                     }
                   }
                   return (0, _util.shadow)(this, "attachments", attachments);
@@ -32572,8 +32572,8 @@ var require_pdf_worker = __commonJS({
                   if (font.data && (isAddToPathSet || this.options.disableFontFace)) {
                     var buildPath = function buildPath2(fontChar) {
                       if (!font.renderer.hasBuiltPath(fontChar)) {
-                        var path32 = font.renderer.getPathJs(fontChar);
-                        _this5.handler.send("commonobj", [font.loadedName + "_path_" + fontChar, "FontPath", path32]);
+                        var path33 = font.renderer.getPathJs(fontChar);
+                        _this5.handler.send("commonobj", [font.loadedName + "_path_" + fontChar, "FontPath", path33]);
                       }
                     };
                     for (var i = 0, ii = glyphs.length; i < ii; i++) {
@@ -75261,10 +75261,10 @@ var require_pdf = __commonJS({
                   ctx.save();
                   ctx.beginPath();
                   for (var i = 0; i < paths.length; i++) {
-                    var path32 = paths[i];
-                    ctx.setTransform.apply(ctx, path32.transform);
-                    ctx.translate(path32.x, path32.y);
-                    path32.addToPath(ctx, path32.fontSize);
+                    var path33 = paths[i];
+                    ctx.setTransform.apply(ctx, path33.transform);
+                    ctx.translate(path33.x, path33.y);
+                    path33.addToPath(ctx, path33.fontSize);
                   }
                   ctx.restore();
                   ctx.clip();
@@ -77124,7 +77124,7 @@ var require_pdf = __commonJS({
                 throw new TypeError("Cannot call a class as a function");
               }
             }
-            var fs23 = require("fs");
+            var fs24 = require("fs");
             var http2 = require("http");
             var https2 = require("https");
             var url2 = require("url");
@@ -77457,8 +77457,8 @@ var require_pdf = __commonJS({
               function PDFNodeStreamFsFullReader2(stream) {
                 _classCallCheck(this, PDFNodeStreamFsFullReader2);
                 var _this7 = _possibleConstructorReturn(this, (PDFNodeStreamFsFullReader2.__proto__ || Object.getPrototypeOf(PDFNodeStreamFsFullReader2)).call(this, stream));
-                var path32 = decodeURI(_this7._url.path);
-                fs23.lstat(path32, function(error40, stat) {
+                var path33 = decodeURI(_this7._url.path);
+                fs24.lstat(path33, function(error40, stat) {
                   if (error40) {
                     _this7._errored = true;
                     _this7._reason = error40;
@@ -77466,7 +77466,7 @@ var require_pdf = __commonJS({
                     return;
                   }
                   _this7._contentLength = stat.size;
-                  _this7._setReadableStream(fs23.createReadStream(path32));
+                  _this7._setReadableStream(fs24.createReadStream(path33));
                   _this7._headersCapability.resolve();
                 });
                 return _this7;
@@ -77478,7 +77478,7 @@ var require_pdf = __commonJS({
               function PDFNodeStreamFsRangeReader2(stream, start, end) {
                 _classCallCheck(this, PDFNodeStreamFsRangeReader2);
                 var _this8 = _possibleConstructorReturn(this, (PDFNodeStreamFsRangeReader2.__proto__ || Object.getPrototypeOf(PDFNodeStreamFsRangeReader2)).call(this, stream));
-                _this8._setReadableStream(fs23.createReadStream(decodeURI(_this8._url.path), {
+                _this8._setReadableStream(fs24.createReadStream(decodeURI(_this8._url.path), {
                   start,
                   end: end - 1
                 }));
@@ -89472,11 +89472,11 @@ var require_pdf_worker2 = __commonJS({
                     var nameTree = new NameTree(nameTreeRef, xref);
                     var names = nameTree.getAll();
                     for (var name in names) {
-                      var fs23 = new FileSpec(names[name], xref);
+                      var fs24 = new FileSpec(names[name], xref);
                       if (!attachments) {
                         attachments = /* @__PURE__ */ Object.create(null);
                       }
-                      attachments[(0, _util.stringToPDFString)(name)] = fs23.serializable;
+                      attachments[(0, _util.stringToPDFString)(name)] = fs24.serializable;
                     }
                   }
                   return (0, _util.shadow)(this, "attachments", attachments);
@@ -94776,8 +94776,8 @@ var require_pdf_worker2 = __commonJS({
                   if (font.data && (isAddToPathSet || this.options.disableFontFace)) {
                     var buildPath = function buildPath2(fontChar) {
                       if (!font.renderer.hasBuiltPath(fontChar)) {
-                        var path32 = font.renderer.getPathJs(fontChar);
-                        _this5.handler.send("commonobj", [font.loadedName + "_path_" + fontChar, "FontPath", path32]);
+                        var path33 = font.renderer.getPathJs(fontChar);
+                        _this5.handler.send("commonobj", [font.loadedName + "_path_" + fontChar, "FontPath", path33]);
                       }
                     };
                     for (var i = 0, ii = glyphs.length; i < ii; i++) {
@@ -137573,10 +137573,10 @@ var require_pdf2 = __commonJS({
                   ctx.save();
                   ctx.beginPath();
                   for (var i = 0; i < paths.length; i++) {
-                    var path32 = paths[i];
-                    ctx.setTransform.apply(ctx, path32.transform);
-                    ctx.translate(path32.x, path32.y);
-                    path32.addToPath(ctx, path32.fontSize);
+                    var path33 = paths[i];
+                    ctx.setTransform.apply(ctx, path33.transform);
+                    ctx.translate(path33.x, path33.y);
+                    path33.addToPath(ctx, path33.fontSize);
                   }
                   ctx.restore();
                   ctx.clip();
@@ -138960,7 +138960,7 @@ var require_pdf2 = __commonJS({
                 throw new TypeError("Cannot call a class as a function");
               }
             }
-            var fs23 = require("fs");
+            var fs24 = require("fs");
             var http2 = require("http");
             var https2 = require("https");
             var url2 = require("url");
@@ -139293,8 +139293,8 @@ var require_pdf2 = __commonJS({
               function PDFNodeStreamFsFullReader2(stream) {
                 _classCallCheck(this, PDFNodeStreamFsFullReader2);
                 var _this7 = _possibleConstructorReturn(this, (PDFNodeStreamFsFullReader2.__proto__ || Object.getPrototypeOf(PDFNodeStreamFsFullReader2)).call(this, stream));
-                var path32 = decodeURI(_this7._url.path);
-                fs23.lstat(path32, function(error40, stat) {
+                var path33 = decodeURI(_this7._url.path);
+                fs24.lstat(path33, function(error40, stat) {
                   if (error40) {
                     _this7._errored = true;
                     _this7._reason = error40;
@@ -139302,7 +139302,7 @@ var require_pdf2 = __commonJS({
                     return;
                   }
                   _this7._contentLength = stat.size;
-                  _this7._setReadableStream(fs23.createReadStream(path32));
+                  _this7._setReadableStream(fs24.createReadStream(path33));
                   _this7._headersCapability.resolve();
                 });
                 return _this7;
@@ -139314,7 +139314,7 @@ var require_pdf2 = __commonJS({
               function PDFNodeStreamFsRangeReader2(stream, start, end) {
                 _classCallCheck(this, PDFNodeStreamFsRangeReader2);
                 var _this8 = _possibleConstructorReturn(this, (PDFNodeStreamFsRangeReader2.__proto__ || Object.getPrototypeOf(PDFNodeStreamFsRangeReader2)).call(this, stream));
-                _this8._setReadableStream(fs23.createReadStream(decodeURI(_this8._url.path), {
+                _this8._setReadableStream(fs24.createReadStream(decodeURI(_this8._url.path), {
                   start,
                   end: end - 1
                 }));
@@ -156879,8 +156879,8 @@ var require_pdf_worker3 = __commonJS({
                   if (font.data && (isAddToPathSet || this.options.disableFontFace)) {
                     var buildPath = function buildPath2(fontChar) {
                       if (!font.renderer.hasBuiltPath(fontChar)) {
-                        var path32 = font.renderer.getPathJs(fontChar);
-                        _this5.handler.send("commonobj", [font.loadedName + "_path_" + fontChar, "FontPath", path32]);
+                        var path33 = font.renderer.getPathJs(fontChar);
+                        _this5.handler.send("commonobj", [font.loadedName + "_path_" + fontChar, "FontPath", path33]);
                       }
                     };
                     for (var i = 0, ii = glyphs.length; i < ii; i++) {
@@ -161698,11 +161698,11 @@ var require_pdf_worker3 = __commonJS({
                     var nameTree = new NameTree(nameTreeRef, xref);
                     var names = nameTree.getAll();
                     for (var name in names) {
-                      var fs23 = new FileSpec(names[name], xref);
+                      var fs24 = new FileSpec(names[name], xref);
                       if (!attachments) {
                         attachments = /* @__PURE__ */ Object.create(null);
                       }
-                      attachments[(0, _util.stringToPDFString)(name)] = fs23.serializable;
+                      attachments[(0, _util.stringToPDFString)(name)] = fs24.serializable;
                     }
                   }
                   return (0, _util.shadow)(this, "attachments", attachments);
@@ -191335,10 +191335,10 @@ var require_pdf3 = __commonJS({
                   ctx.save();
                   ctx.beginPath();
                   for (var i = 0; i < paths.length; i++) {
-                    var path32 = paths[i];
-                    ctx.setTransform.apply(ctx, path32.transform);
-                    ctx.translate(path32.x, path32.y);
-                    path32.addToPath(ctx, path32.fontSize);
+                    var path33 = paths[i];
+                    ctx.setTransform.apply(ctx, path33.transform);
+                    ctx.translate(path33.x, path33.y);
+                    path33.addToPath(ctx, path33.fontSize);
                   }
                   ctx.restore();
                   ctx.clip();
@@ -203583,11 +203583,11 @@ var require_pdf_worker4 = __commonJS({
                     var nameTree = new NameTree(nameTreeRef, xref);
                     var names = nameTree.getAll();
                     for (var name in names) {
-                      var fs23 = new FileSpec(names[name], xref);
+                      var fs24 = new FileSpec(names[name], xref);
                       if (!attachments) {
                         attachments = /* @__PURE__ */ Object.create(null);
                       }
-                      attachments[(0, _util.stringToPDFString)(name)] = fs23.serializable;
+                      attachments[(0, _util.stringToPDFString)(name)] = fs24.serializable;
                     }
                   }
                   return (0, _util.shadow)(this, "attachments", attachments);
@@ -216733,8 +216733,8 @@ var require_pdf_worker4 = __commonJS({
                   if (font.data && (isAddToPathSet || this.options.disableFontFace || state.fillColorSpace.name === "Pattern")) {
                     var buildPath = function buildPath2(fontChar) {
                       if (!font.renderer.hasBuiltPath(fontChar)) {
-                        var path32 = font.renderer.getPathJs(fontChar);
-                        _this5.handler.send("commonobj", [font.loadedName + "_path_" + fontChar, "FontPath", path32]);
+                        var path33 = font.renderer.getPathJs(fontChar);
+                        _this5.handler.send("commonobj", [font.loadedName + "_path_" + fontChar, "FontPath", path33]);
                       }
                     };
                     for (var i = 0, ii = glyphs.length; i < ii; i++) {
@@ -248698,10 +248698,10 @@ var require_pdf4 = __commonJS({
                   ctx.save();
                   ctx.beginPath();
                   for (var i = 0; i < paths.length; i++) {
-                    var path32 = paths[i];
-                    ctx.setTransform.apply(ctx, path32.transform);
-                    ctx.translate(path32.x, path32.y);
-                    path32.addToPath(ctx, path32.fontSize);
+                    var path33 = paths[i];
+                    ctx.setTransform.apply(ctx, path33.transform);
+                    ctx.translate(path33.x, path33.y);
+                    path33.addToPath(ctx, path33.fontSize);
                   }
                   ctx.restore();
                   ctx.clip();
@@ -253970,7 +253970,7 @@ var require_pdf4 = __commonJS({
                 throw new TypeError("Cannot call a class as a function");
               }
             }
-            var fs23 = require("fs");
+            var fs24 = require("fs");
             var http2 = require("http");
             var https2 = require("https");
             var url2 = require("url");
@@ -254324,11 +254324,11 @@ var require_pdf4 = __commonJS({
               function PDFNodeStreamFsFullReader2(stream) {
                 _classCallCheck(this, PDFNodeStreamFsFullReader2);
                 var _this7 = _possibleConstructorReturn(this, (PDFNodeStreamFsFullReader2.__proto__ || Object.getPrototypeOf(PDFNodeStreamFsFullReader2)).call(this, stream));
-                var path32 = decodeURIComponent(_this7._url.path);
+                var path33 = decodeURIComponent(_this7._url.path);
                 if (fileUriRegex.test(_this7._url.href)) {
-                  path32 = path32.replace(/^\//, "");
+                  path33 = path33.replace(/^\//, "");
                 }
-                fs23.lstat(path32, function(error40, stat) {
+                fs24.lstat(path33, function(error40, stat) {
                   if (error40) {
                     _this7._errored = true;
                     _this7._reason = error40;
@@ -254336,7 +254336,7 @@ var require_pdf4 = __commonJS({
                     return;
                   }
                   _this7._contentLength = stat.size;
-                  _this7._setReadableStream(fs23.createReadStream(path32));
+                  _this7._setReadableStream(fs24.createReadStream(path33));
                   _this7._headersCapability.resolve();
                 });
                 return _this7;
@@ -254348,11 +254348,11 @@ var require_pdf4 = __commonJS({
               function PDFNodeStreamFsRangeReader2(stream, start, end) {
                 _classCallCheck(this, PDFNodeStreamFsRangeReader2);
                 var _this8 = _possibleConstructorReturn(this, (PDFNodeStreamFsRangeReader2.__proto__ || Object.getPrototypeOf(PDFNodeStreamFsRangeReader2)).call(this, stream));
-                var path32 = decodeURIComponent(_this8._url.path);
+                var path33 = decodeURIComponent(_this8._url.path);
                 if (fileUriRegex.test(_this8._url.href)) {
-                  path32 = path32.replace(/^\//, "");
+                  path33 = path33.replace(/^\//, "");
                 }
-                _this8._setReadableStream(fs23.createReadStream(path32, {
+                _this8._setReadableStream(fs24.createReadStream(path33, {
                   start,
                   end: end - 1
                 }));
@@ -255457,6 +255457,299 @@ var require_pdf_parse2 = __commonJS({
   }
 });
 
+// ../../packages/backend/src/services/learning/compoundingKnowledge.ts
+var compoundingKnowledge_exports = {};
+__export(compoundingKnowledge_exports, {
+  EXTRACTORS: () => EXTRACTORS,
+  GATED_MUTATIONS: () => GATED_MUTATIONS,
+  REVIEW_VERBS: () => REVIEW_VERBS,
+  appendLessonsToMemory: () => appendLessonsToMemory,
+  connectionIdentity: () => connectionIdentity,
+  extractLessons: () => extractLessons,
+  formatLessonMarkdown: () => formatLessonMarkdown,
+  isTrivialRun: () => isTrivialRun,
+  matchGatedMutation: () => matchGatedMutation,
+  matchReviewVerb: () => matchReviewVerb,
+  memoryHasFingerprint: () => memoryHasFingerprint
+});
+function isTrivialRun(inputPreview, error40) {
+  const input = (inputPreview || "").trim();
+  if (!input && !error40) return true;
+  if (error40 && error40.trim()) return false;
+  if (TRIVIAL_INPUT.test(input)) return true;
+  if (input.length > 0 && input.length < 8 && !/[\\/]/.test(input) && !/\b(error|fail|join|install|patch)\b/i.test(input)) {
+    return true;
+  }
+  return false;
+}
+function lesson(extractor, fingerprint, title, body, neverDo, instead, tags) {
+  return { extractor, fingerprint, title, body, neverDo, instead, tags };
+}
+function extractLessons(...parts) {
+  const haystack = parts.filter(Boolean).join("\n");
+  if (!haystack.trim()) return [];
+  const byFp = /* @__PURE__ */ new Map();
+  for (const ex of EXTRACTORS) {
+    const hit = ex.match(haystack);
+    if (hit && !byFp.has(hit.fingerprint)) byFp.set(hit.fingerprint, hit);
+  }
+  return [...byFp.values()];
+}
+function formatLessonMarkdown(item, meta) {
+  const at = meta.at || (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+  const occ = meta.occurrence && meta.occurrence > 1 ? ` (seen x${meta.occurrence})` : "";
+  const run = meta.runId ? ` run ${meta.runId}` : "";
+  return [
+    `## LESSON (auto, ${at},${run})${occ}`,
+    "",
+    `**${item.title}**`,
+    "",
+    item.body,
+    "",
+    `- NEVER: ${item.neverDo}`,
+    `- INSTEAD: ${item.instead}`,
+    `- fingerprint: \`${item.fingerprint}\``,
+    ""
+  ].join("\n");
+}
+function memoryHasFingerprint(memory, fingerprint) {
+  return memory.includes("`" + fingerprint + "`") || memory.includes("\n" + fingerprint + "\n");
+}
+function appendLessonsToMemory(current, lessons, meta) {
+  let next = current.endsWith("\n") || current === "" ? current : current + "\n";
+  if (!next.trim()) next = "# Memory\n\n- Add durable cross-session notes here.\n\n";
+  const added = [];
+  for (const item of lessons) {
+    if (memoryHasFingerprint(next, item.fingerprint)) continue;
+    next += formatLessonMarkdown(item, meta);
+    added.push(item.fingerprint);
+  }
+  return { next, added };
+}
+function matchGatedMutation(command) {
+  const c = command.trim();
+  for (const g of GATED_MUTATIONS) {
+    if (g.re.test(c)) return { id: g.id, requireProbeTag: g.requireProbeTag };
+  }
+  return null;
+}
+function matchReviewVerb(command) {
+  for (const v of REVIEW_VERBS) {
+    if (v.re.test(command)) return v.id;
+  }
+  return null;
+}
+function connectionIdentity(opts) {
+  if (opts.name && opts.name.trim()) return opts.name.trim();
+  const host = (opts.host || "").trim() || "unknown-host";
+  const rest = [opts.transport, opts.auth, opts.domain].filter(Boolean).join("/");
+  return rest ? `${host} (${rest})` : host;
+}
+var TRIVIAL_INPUT, EXTRACTORS, GATED_MUTATIONS, REVIEW_VERBS;
+var init_compoundingKnowledge = __esm({
+  "../../packages/backend/src/services/learning/compoundingKnowledge.ts"() {
+    "use strict";
+    TRIVIAL_INPUT = /^(1\s*\+\s*1|hello|hi|hey|ok|thanks|ping|pong)\s*[.!?]*$/i;
+    EXTRACTORS = [
+      {
+        name: "psrp-invalid-selectors",
+        match: (h) => {
+          if (!/invalidselectors/i.test(h)) return null;
+          return lesson(
+            "psrp-invalid-selectors",
+            "psrp.invalid-selectors.dest-and-init",
+            "PSRP Receive after Create returns w:InvalidSelectors",
+            "Windows accepts Create (ShellId returned) then fails runspace init silently. The SOAP envelope is usually fine \u2014 the bug is inside the base64 creationXml PSRP fragments.",
+            'Do not tweak SOAP headers / xmlns prefixes / SessionId / OptionSet / keep-alive to "fix" InvalidSelectors after a successful Create.',
+            "Decode creationXml: every client-to-server PSRP message Destination byte is 2 (server). INIT_RUNSPACEPOOL must send full PSThreadOptions/ApartmentState/HostInfo objects, not Nil. Byte-compare against a pypsrp 0.8.1 capture.",
+            ["psrp", "winrm"]
+          );
+        }
+      },
+      {
+        name: "netuseadd-64",
+        match: (h) => {
+          const netuse = /netuseadd/i.test(h) && (/64\b/.test(h) || /0x40/i.test(h) || /ipc\$/i.test(h));
+          const named = /network name is no longer available/i.test(h) && /add-computer|netlogon|ipc\$|domain join/i.test(h);
+          const err64 = /ERROR_NETNAME_DELETED/i.test(h);
+          if (!netuse && !named && !err64) return null;
+          return lesson(
+            "netuseadd-64",
+            "ad.join.netuseadd-64-use-djoin",
+            "Domain join fails at NetUseAdd \\\\DC\\IPC$ (error 64 / 0x40)",
+            "DNS, LDAP 389, Kerberos 88 and TCP 445 can all succeed while SMB IPC$/NETLOGON still fails from a workgroup host. Retrying Add-Computer will not fix it.",
+            'Do not retry Add-Computer after NetUseAdd 64 / "network name is no longer available". Do not keep flipping SMB signing as the next fix.',
+            "Use offline domain join: djoin /provision on the DC, copy the blob without SMB, djoin /requestODJ /localos on the member, reboot. Confirm with Get-ADComputer after.",
+            ["ad", "smb", "join"]
+          );
+        }
+      },
+      {
+        name: "cli-dropped-bearer",
+        match: (h) => {
+          if (/missing access token/i.test(h)) {
+            return lesson(
+              "cli-dropped-bearer",
+              "rterm-cli.native-ws.dropped-authorization",
+              "rterm-cli remote gateway closes with missing access token",
+              "On Node >= 21 the CLI used native WebSocket without the options object, so Authorization Bearer was never sent. Localhost (token-exempt) still worked, which looks like a server bug.",
+              "Do not debug the remote daemon first when localhost ping works and remote ping dies with Connection closed before response.",
+              "Send the token both as ?access_token= (query param) AND as the Authorization header on native WebSocket / ws.",
+              ["cli", "gateway"]
+            );
+          }
+          if (/connection closed before response/i.test(h) && /token|gateway|rterm-cli|websocket/i.test(h)) {
+            return lesson(
+              "cli-dropped-bearer",
+              "rterm-cli.native-ws.dropped-authorization",
+              "rterm-cli remote gateway closes with missing access token",
+              "On Node >= 21 the CLI used native WebSocket without the options object, so Authorization Bearer was never sent.",
+              "Do not debug the remote daemon first when localhost ping works and remote ping dies with Connection closed before response.",
+              "Send the token both as ?access_token= AND as the Authorization header.",
+              ["cli", "gateway"]
+            );
+          }
+          return null;
+        }
+      },
+      {
+        name: "duplicate-tools",
+        match: (h) => {
+          if (!/duplicate tool/i.test(h)) return null;
+          return lesson(
+            "duplicate-tools",
+            "agent.duplicate-tool-definitions",
+            "Provider HTTP 400: duplicate tool definitions",
+            "Plugin tool schemas were appended twice (session cache + bind-time). Strict providers (Grok, Fable) reject the request.",
+            "Do not append plugin tools both at session-bind cache time and again at bindTools() time.",
+            "Keep plugin schemas only at bind-time (freshest) and run dedupeToolsByName() on every bindTools() call.",
+            ["agent", "tools"]
+          );
+        }
+      },
+      {
+        name: "npm-eacces-root-cache",
+        match: (h) => {
+          if (!/eacces/i.test(h)) return null;
+          if (!/root-owned|cache folder|npm/i.test(h)) return null;
+          return lesson(
+            "npm-eacces-root-cache",
+            "npm.eacces.root-owned-cache",
+            "npm install -g fails with EACCES on a root-owned cache",
+            "A past sudo npm left root-owned files in ~/.npm-cache. Retrying with sudo is the wrong fix in an agent context.",
+            "Do not sudo npm install to fix EACCES when the cache is root-owned.",
+            "Retry once with npm install -g <pkg> --cache /tmp/npm-fresh (or the lifecycle script npmInstallG path).",
+            ["npm"]
+          );
+        }
+      },
+      {
+        name: "psrp-basic-401-after-dc",
+        match: (h) => {
+          const unauthorized = /\b401\b/.test(h) || /unauthorized/i.test(h);
+          if (!unauthorized) return null;
+          if (!/psrp|winrm|basic/i.test(h)) return null;
+          const afterDc = /domain.?controller|addsforest|dcpromo|corp\.local|promoted|after promotion/i.test(h);
+          if (!afterDc && !/basic/i.test(h)) return null;
+          if (!afterDc && !(/basic/i.test(h) && /401|unauthorized/i.test(h) && /psrp|winrm/i.test(h))) {
+            return null;
+          }
+          return lesson(
+            "psrp-basic-401-after-dc",
+            "ad.dc.basic-401-use-negotiate",
+            "PSRP/WinRM Basic 401 after promoting a DC",
+            "After Install-ADDSForest the machine is a DC. Basic auth to the same Administrator password often 401s; Negotiate/NTLMv2 with CORP\\Administrator still works.",
+            "Do not keep using auth:basic against a box you just promoted to a DC.",
+            "Switch the saved connection to transport:psrp auth:negotiate domain:CORP username:Administrator (as CORP-DC1).",
+            ["ad", "psrp", "auth"]
+          );
+        }
+      },
+      {
+        name: "winrm-dollar-mangle",
+        match: (h) => {
+          if (/was unexpected at this time/i.test(h)) {
+            return lesson(
+              "winrm-dollar-mangle",
+              "winrm.cmd-wrapping.dollar-mangle",
+              "WinRM cmd wrapping eats $variables in PowerShell",
+              "HTTP WinRM tabs often wrap through cmd.exe, so $env:FOO is expanded/eaten before PowerShell sees it.",
+              'Do not send $env: / $foo on an HTTP WinRM tab and treat empty output as "the box has no env".',
+              "Use PSRP (script in the message body) or Write-Output ((Get-CimInstance ...)) forms that avoid $.",
+              ["winrm"]
+            );
+          }
+          if (/\$env:COMPUTERNAME/.test(h) && /empty|undefined|mangle/i.test(h)) {
+            return lesson(
+              "winrm-dollar-mangle",
+              "winrm.cmd-wrapping.dollar-mangle",
+              "WinRM cmd wrapping eats $variables in PowerShell",
+              "HTTP WinRM tabs often wrap through cmd.exe.",
+              "Do not send $env: on an HTTP WinRM tab.",
+              "Use PSRP or CIM cmdlets without $env:.",
+              ["winrm"]
+            );
+          }
+          return null;
+        }
+      },
+      {
+        name: "soap-guess-loop",
+        match: (h) => {
+          if (!/invalidselectors/i.test(h)) return null;
+          if (!/optionset|xmlns:|sessionid|keep-alive|prefix/i.test(h)) return null;
+          if (!/still fail|same fault|another.*probe|tweak/i.test(h)) return null;
+          return lesson(
+            "soap-guess-loop",
+            "psrp.soap-guessing-vs-payload",
+            "SOAP header tweaks do not fix PSRP InvalidSelectors",
+            "When Create succeeds and Receive fails, the envelope is probably already fine. Further OptionSet/prefix/SessionId changes waste the session.",
+            "Do not run another uninstrumented live SOAP probe after 2+ identical InvalidSelectors.",
+            "Dump creationXml fragments (struct dest/type at bytes 0-8 of each PSRP message) and diff against pypsrp.",
+            ["psrp"]
+          );
+        }
+      },
+      {
+        name: "exec-command-multiline-poison",
+        match: (h) => {
+          if (/echo-mangled/i.test(h) || /only the first export/i.test(h) || /dquote prompt/i.test(h)) {
+            return lesson(
+              "exec-command-multiline-poison",
+              "agent.exec_command.multiline-export",
+              "Multi-line export/python -c in exec_command only runs the first line",
+              "GyShell exec_command with separate export lines or inline python3 -c heredocs gets echo-mangled or only the first statement runs.",
+              "Do not put multiple export X= lines on separate exec_command invocations expecting them to share a shell, and do not use inline python3 -c with nested quotes.",
+              "One line with semicolons, or write_file a script then exec it. Password via stdin, never argv.",
+              ["agent", "shell"]
+            );
+          }
+          return null;
+        }
+      }
+    ];
+    GATED_MUTATIONS = [
+      { id: "Add-Computer", re: /\bAdd-Computer\b/i, requireProbeTag: "ad-join" },
+      { id: "Install-ADDSForest", re: /\bInstall-ADDSForest\b/i, requireProbeTag: "ad-promo" },
+      { id: "djoin-provision", re: /\bdjoin(\.exe)?\s+\/provision\b/i, requireProbeTag: "ad-join" },
+      { id: "Set-SmbServerConfiguration", re: /\bSet-SmbServerConfiguration\b/i, requireProbeTag: "smb" },
+      { id: "sg-ingress", re: /\bauthorize-security-group-ingress\b/i, requireProbeTag: "aws-sg" },
+      { id: "Remove-ADComputer", re: /\bRemove-ADComputer\b/i, requireProbeTag: "ad-join" },
+      { id: "Format-Volume", re: /\bFormat-Volume\b/i, requireProbeTag: "disk" },
+      { id: "Uninstall-WindowsFeature", re: /\bUninstall-WindowsFeature\b/i, requireProbeTag: "windows-feature" }
+    ];
+    REVIEW_VERBS = [
+      { id: "Install-ADDSForest", re: /\bInstall-ADDSForest\b/i },
+      { id: "Add-Computer", re: /\bAdd-Computer\b/i },
+      { id: "djoin", re: /\bdjoin(\.exe)?\b/i },
+      { id: "Set-SmbServerConfiguration", re: /\bSet-SmbServerConfiguration\b/i },
+      { id: "authorize-security-group-ingress", re: /\bauthorize-security-group-ingress\b/i },
+      { id: "Remove-Item -Recurse", re: /\bRemove-Item\b.*(-Recurse|-Force)/i },
+      { id: "Format-Volume", re: /\bFormat-Volume\b/i }
+    ];
+  }
+});
+
 // ../../packages/backend/src/services/AgentHelper/utils/subAgent.ts
 var subAgent_exports = {};
 __export(subAgent_exports, {
@@ -257341,7 +257634,7 @@ function playbookNeedsOrchestration(playbook) {
     (s) => s.dependsOn !== void 0 || s.desiredState || s.captureVar
   );
 }
-function emit6(context2, toolName, input, output) {
+function emit7(context2, toolName, input, output) {
   context2.sendEvent(context2.sessionId, {
     messageId: context2.messageId,
     type: "tool_call",
@@ -257357,7 +257650,7 @@ async function managePlaybook(args, context2) {
   const m2 = context2.automationManager;
   if (!m2) {
     const msg2 = noStore2();
-    emit6(context2, "manage_playbook", args, msg2);
+    emit7(context2, "manage_playbook", args, msg2);
     return msg2;
   }
   const { action } = args;
@@ -257365,7 +257658,7 @@ async function managePlaybook(args, context2) {
     const all = m2.listPlaybooks();
     if (!all.length) {
       const msg3 = "No playbooks. Create one with manage_playbook action=create.";
-      emit6(context2, "manage_playbook", args, msg3);
+      emit7(context2, "manage_playbook", args, msg3);
       return msg3;
     }
     const body = all.map((p) => {
@@ -257374,20 +257667,20 @@ async function managePlaybook(args, context2) {
     }).join("\n");
     const msg2 = `Playbooks (${all.length}):
 ${body}`;
-    emit6(context2, "manage_playbook", args, msg2);
+    emit7(context2, "manage_playbook", args, msg2);
     return msg2;
   }
   if (action === "get") {
     const key = args.id ?? args.name;
     if (!key) {
       const msg3 = "get requires id or name.";
-      emit6(context2, "manage_playbook", args, msg3);
+      emit7(context2, "manage_playbook", args, msg3);
       return msg3;
     }
     const p = m2.getPlaybook(key);
     if (!p) {
       const msg3 = `No playbook "${key}".`;
-      emit6(context2, "manage_playbook", args, msg3);
+      emit7(context2, "manage_playbook", args, msg3);
       return msg3;
     }
     const steps = p.steps.map((s, i) => {
@@ -257401,13 +257694,13 @@ Scope: ${scope}
 Default onError: ${p.onError ?? "stop"}${p.requireApproval ? "\nMOP mode: requires an approved change record (manage_change) to run" : ""}
 Steps:
 ${steps}`;
-    emit6(context2, "manage_playbook", args, msg2);
+    emit7(context2, "manage_playbook", args, msg2);
     return msg2;
   }
   if (action === "create") {
     if (!args.name || !args.steps?.length) {
       const msg2 = "create requires name + at least one step.";
-      emit6(context2, "manage_playbook", args, msg2);
+      emit7(context2, "manage_playbook", args, msg2);
       return msg2;
     }
     try {
@@ -257422,18 +257715,18 @@ ${steps}`;
         requireApproval: args.requireApproval
       });
       const msg2 = `Created playbook "${p.name}" (id=${p.id}, ${p.steps.length} step(s)). ${p.requireApproval ? "MOP mode: run it via manage_change (plan \u2192 approve \u2192 run)." : "Run it with run_playbook."}`;
-      emit6(context2, "manage_playbook", args, msg2);
+      emit7(context2, "manage_playbook", args, msg2);
       return msg2;
     } catch (error40) {
       const msg2 = `Could not create playbook: ${error40 instanceof Error ? error40.message : error40}`;
-      emit6(context2, "manage_playbook", args, msg2);
+      emit7(context2, "manage_playbook", args, msg2);
       return msg2;
     }
   }
   if (action === "update") {
     if (!args.id) {
       const msg2 = "update requires id.";
-      emit6(context2, "manage_playbook", args, msg2);
+      emit7(context2, "manage_playbook", args, msg2);
       return msg2;
     }
     try {
@@ -257449,51 +257742,51 @@ ${steps}`;
         ...args.requireApproval !== void 0 ? { requireApproval: args.requireApproval } : {}
       });
       const msg2 = `Updated playbook "${p.name}" (${p.steps.length} step(s)).`;
-      emit6(context2, "manage_playbook", args, msg2);
+      emit7(context2, "manage_playbook", args, msg2);
       return msg2;
     } catch (error40) {
       const msg2 = `Could not update playbook: ${error40 instanceof Error ? error40.message : error40}`;
-      emit6(context2, "manage_playbook", args, msg2);
+      emit7(context2, "manage_playbook", args, msg2);
       return msg2;
     }
   }
   if (action === "delete") {
     if (!args.id) {
       const msg3 = "delete requires id.";
-      emit6(context2, "manage_playbook", args, msg3);
+      emit7(context2, "manage_playbook", args, msg3);
       return msg3;
     }
     const removed = m2.deletePlaybook(args.id);
     const msg2 = removed ? `Deleted playbook ${args.id}.` : `No playbook ${args.id}.`;
-    emit6(context2, "manage_playbook", args, msg2);
+    emit7(context2, "manage_playbook", args, msg2);
     return msg2;
   }
   const msg = `Unknown action "${action}".`;
-  emit6(context2, "manage_playbook", args, msg);
+  emit7(context2, "manage_playbook", args, msg);
   return msg;
 }
 async function runPlaybook(args, context2) {
   const m2 = context2.automationManager;
   if (!m2) {
     const msg2 = noStore2();
-    emit6(context2, "run_playbook", args, msg2);
+    emit7(context2, "run_playbook", args, msg2);
     return msg2;
   }
   const key = args.id ?? args.name;
   if (!key) {
     const msg2 = "run_playbook requires id or name.";
-    emit6(context2, "run_playbook", args, msg2);
+    emit7(context2, "run_playbook", args, msg2);
     return msg2;
   }
   const playbook = m2.getPlaybook(key);
   if (!playbook) {
     const msg2 = `No playbook "${key}". Use manage_playbook action=list to see valid playbooks.`;
-    emit6(context2, "run_playbook", args, msg2);
+    emit7(context2, "run_playbook", args, msg2);
     return msg2;
   }
   if (playbook.requireApproval) {
     const msg2 = `Playbook "${playbook.name}" is in MOP mode (requireApproval). Run it through a change record: manage_change action=plan name="${playbook.name}" \u2192 approve \u2192 run.`;
-    emit6(context2, "run_playbook", args, msg2);
+    emit7(context2, "run_playbook", args, msg2);
     return msg2;
   }
   if (args.dryRun) {
@@ -257521,7 +257814,7 @@ Targets (${plan.targets.length}): ${targetList}
 
 Steps (${plan.steps.length}):
 ${stepList}${notes}`;
-    emit6(context2, "run_playbook", args, msg2);
+    emit7(context2, "run_playbook", args, msg2);
     return msg2;
   }
   const settings = {
@@ -257561,7 +257854,7 @@ ${stepList}${notes}`;
     }
   } catch (error40) {
     const msg2 = `Playbook "${playbook.name}" could not run: ${error40 instanceof Error ? error40.message : error40}`;
-    emit6(context2, "run_playbook", args, msg2);
+    emit7(context2, "run_playbook", args, msg2);
     return msg2;
   }
   const lines = [];
@@ -257576,7 +257869,7 @@ ${stepList}${notes}`;
   const okTargets = record2.targets.filter((t) => t.ok).length;
   const msg = `Playbook "${record2.playbookName}" ${record2.ok ? "completed OK" : "FAILED"} (runId=${record2.runId}, ${okTargets}/${record2.targets.length} target(s) ok):
 ${lines.join("\n")}`;
-  emit6(context2, "run_playbook", args, msg);
+  emit7(context2, "run_playbook", args, msg);
   return msg;
 }
 var stepSchema, managePlaybookSchema, runPlaybookSchema;
@@ -258017,8 +258310,8 @@ function extractFields(message) {
   if (ip) fields.ip = ip[1];
   const port = message.match(/[Pp]ort[:\s]+(\d{1,5})/);
   if (port) fields.port = port[1];
-  const path32 = message.match(/([A-Za-z]:\\[^\s"',;]+)/);
-  if (path32) fields.path = path32[1];
+  const path33 = message.match(/([A-Za-z]:\\[^\s"',;]+)/);
+  if (path33) fields.path = path33[1];
   const key = message.match(/(HKLM|HKCU|HKCR|HKU)\\[^\s"',;]+/i);
   if (key) fields.key = key[0];
   const proc = message.match(/[Pp]rocess(?:Name)?[:\s]+([A-Za-z0-9_.-]+\.exe)/);
@@ -265576,8 +265869,8 @@ var require_utils2 = __commonJS({
       }
       return ind;
     }
-    function removeDotSegments(path32) {
-      let input = path32;
+    function removeDotSegments(path33) {
+      let input = path33;
       const output = [];
       let nextSlash = -1;
       let len = 0;
@@ -265776,8 +266069,8 @@ var require_schemes = __commonJS({
         wsComponent.secure = void 0;
       }
       if (wsComponent.resourceName) {
-        const [path32, query] = wsComponent.resourceName.split("?");
-        wsComponent.path = path32 && path32 !== "/" ? path32 : void 0;
+        const [path33, query] = wsComponent.resourceName.split("?");
+        wsComponent.path = path33 && path33 !== "/" ? path33 : void 0;
         wsComponent.query = query;
         wsComponent.resourceName = void 0;
       }
@@ -274816,12 +275109,12 @@ var require_dist2 = __commonJS({
         throw new Error(`Unknown format "${name}"`);
       return f;
     };
-    function addFormats(ajv, list, fs23, exportName) {
+    function addFormats(ajv, list, fs24, exportName) {
       var _a3;
       var _b;
       (_a3 = (_b = ajv.opts.code).formats) !== null && _a3 !== void 0 ? _a3 : _b.formats = (0, codegen_1._)`require("ajv-formats/dist/formats").${exportName}`;
       for (const f of list)
-        ajv.addFormat(f, fs23[f]);
+        ajv.addFormat(f, fs24[f]);
     }
     module2.exports = exports2 = formatsPlugin;
     Object.defineProperty(exports2, "__esModule", { value: true });
@@ -274834,8 +275127,8 @@ var require_windows = __commonJS({
   "../../node_modules/isexe/windows.js"(exports2, module2) {
     module2.exports = isexe;
     isexe.sync = sync;
-    var fs23 = require("fs");
-    function checkPathExt(path32, options) {
+    var fs24 = require("fs");
+    function checkPathExt(path33, options) {
       var pathext = options.pathExt !== void 0 ? options.pathExt : process.env.PATHEXT;
       if (!pathext) {
         return true;
@@ -274846,25 +275139,25 @@ var require_windows = __commonJS({
       }
       for (var i = 0; i < pathext.length; i++) {
         var p = pathext[i].toLowerCase();
-        if (p && path32.substr(-p.length).toLowerCase() === p) {
+        if (p && path33.substr(-p.length).toLowerCase() === p) {
           return true;
         }
       }
       return false;
     }
-    function checkStat(stat, path32, options) {
+    function checkStat(stat, path33, options) {
       if (!stat.isSymbolicLink() && !stat.isFile()) {
         return false;
       }
-      return checkPathExt(path32, options);
+      return checkPathExt(path33, options);
     }
-    function isexe(path32, options, cb) {
-      fs23.stat(path32, function(er, stat) {
-        cb(er, er ? false : checkStat(stat, path32, options));
+    function isexe(path33, options, cb) {
+      fs24.stat(path33, function(er, stat) {
+        cb(er, er ? false : checkStat(stat, path33, options));
       });
     }
-    function sync(path32, options) {
-      return checkStat(fs23.statSync(path32), path32, options);
+    function sync(path33, options) {
+      return checkStat(fs24.statSync(path33), path33, options);
     }
   }
 });
@@ -274874,14 +275167,14 @@ var require_mode = __commonJS({
   "../../node_modules/isexe/mode.js"(exports2, module2) {
     module2.exports = isexe;
     isexe.sync = sync;
-    var fs23 = require("fs");
-    function isexe(path32, options, cb) {
-      fs23.stat(path32, function(er, stat) {
+    var fs24 = require("fs");
+    function isexe(path33, options, cb) {
+      fs24.stat(path33, function(er, stat) {
         cb(er, er ? false : checkStat(stat, options));
       });
     }
-    function sync(path32, options) {
-      return checkStat(fs23.statSync(path32), options);
+    function sync(path33, options) {
+      return checkStat(fs24.statSync(path33), options);
     }
     function checkStat(stat, options) {
       return stat.isFile() && checkMode(stat, options);
@@ -274905,7 +275198,7 @@ var require_mode = __commonJS({
 // ../../node_modules/isexe/index.js
 var require_isexe = __commonJS({
   "../../node_modules/isexe/index.js"(exports2, module2) {
-    var fs23 = require("fs");
+    var fs24 = require("fs");
     var core2;
     if (process.platform === "win32" || global.TESTING_WINDOWS) {
       core2 = require_windows();
@@ -274914,7 +275207,7 @@ var require_isexe = __commonJS({
     }
     module2.exports = isexe;
     isexe.sync = sync;
-    function isexe(path32, options, cb) {
+    function isexe(path33, options, cb) {
       if (typeof options === "function") {
         cb = options;
         options = {};
@@ -274924,7 +275217,7 @@ var require_isexe = __commonJS({
           throw new TypeError("callback not provided");
         }
         return new Promise(function(resolve2, reject) {
-          isexe(path32, options || {}, function(er, is) {
+          isexe(path33, options || {}, function(er, is) {
             if (er) {
               reject(er);
             } else {
@@ -274933,7 +275226,7 @@ var require_isexe = __commonJS({
           });
         });
       }
-      core2(path32, options || {}, function(er, is) {
+      core2(path33, options || {}, function(er, is) {
         if (er) {
           if (er.code === "EACCES" || options && options.ignoreErrors) {
             er = null;
@@ -274943,9 +275236,9 @@ var require_isexe = __commonJS({
         cb(er, is);
       });
     }
-    function sync(path32, options) {
+    function sync(path33, options) {
       try {
-        return core2.sync(path32, options || {});
+        return core2.sync(path33, options || {});
       } catch (er) {
         if (options && options.ignoreErrors || er.code === "EACCES") {
           return false;
@@ -274961,7 +275254,7 @@ var require_isexe = __commonJS({
 var require_which = __commonJS({
   "../../node_modules/which/which.js"(exports2, module2) {
     var isWindows = process.platform === "win32" || process.env.OSTYPE === "cygwin" || process.env.OSTYPE === "msys";
-    var path32 = require("path");
+    var path33 = require("path");
     var COLON = isWindows ? ";" : ":";
     var isexe = require_isexe();
     var getNotFoundError = (cmd) => Object.assign(new Error(`not found: ${cmd}`), { code: "ENOENT" });
@@ -274999,7 +275292,7 @@ var require_which = __commonJS({
           return opt.all && found.length ? resolve2(found) : reject(getNotFoundError(cmd));
         const ppRaw = pathEnv[i];
         const pathPart = /^".*"$/.test(ppRaw) ? ppRaw.slice(1, -1) : ppRaw;
-        const pCmd = path32.join(pathPart, cmd);
+        const pCmd = path33.join(pathPart, cmd);
         const p = !pathPart && /^\.[\\\/]/.test(cmd) ? cmd.slice(0, 2) + pCmd : pCmd;
         resolve2(subStep(p, i, 0));
       });
@@ -275026,7 +275319,7 @@ var require_which = __commonJS({
       for (let i = 0; i < pathEnv.length; i++) {
         const ppRaw = pathEnv[i];
         const pathPart = /^".*"$/.test(ppRaw) ? ppRaw.slice(1, -1) : ppRaw;
-        const pCmd = path32.join(pathPart, cmd);
+        const pCmd = path33.join(pathPart, cmd);
         const p = !pathPart && /^\.[\\\/]/.test(cmd) ? cmd.slice(0, 2) + pCmd : pCmd;
         for (let j = 0; j < pathExt.length; j++) {
           const cur = p + pathExt[j];
@@ -275074,7 +275367,7 @@ var require_path_key = __commonJS({
 var require_resolveCommand = __commonJS({
   "../../node_modules/cross-spawn/lib/util/resolveCommand.js"(exports2, module2) {
     "use strict";
-    var path32 = require("path");
+    var path33 = require("path");
     var which = require_which();
     var getPathKey = require_path_key();
     function resolveCommandAttempt(parsed, withoutPathExt) {
@@ -275092,7 +275385,7 @@ var require_resolveCommand = __commonJS({
       try {
         resolved = which.sync(parsed.command, {
           path: env[getPathKey({ env })],
-          pathExt: withoutPathExt ? path32.delimiter : void 0
+          pathExt: withoutPathExt ? path33.delimiter : void 0
         });
       } catch (e) {
       } finally {
@@ -275101,7 +275394,7 @@ var require_resolveCommand = __commonJS({
         }
       }
       if (resolved) {
-        resolved = path32.resolve(hasCustomCwd ? parsed.options.cwd : "", resolved);
+        resolved = path33.resolve(hasCustomCwd ? parsed.options.cwd : "", resolved);
       }
       return resolved;
     }
@@ -275155,8 +275448,8 @@ var require_shebang_command = __commonJS({
       if (!match) {
         return null;
       }
-      const [path32, argument] = match[0].replace(/#! ?/, "").split(" ");
-      const binary2 = path32.split("/").pop();
+      const [path33, argument] = match[0].replace(/#! ?/, "").split(" ");
+      const binary2 = path33.split("/").pop();
       if (binary2 === "env") {
         return argument;
       }
@@ -275169,16 +275462,16 @@ var require_shebang_command = __commonJS({
 var require_readShebang = __commonJS({
   "../../node_modules/cross-spawn/lib/util/readShebang.js"(exports2, module2) {
     "use strict";
-    var fs23 = require("fs");
+    var fs24 = require("fs");
     var shebangCommand = require_shebang_command();
     function readShebang(command) {
       const size = 150;
       const buffer = Buffer.alloc(size);
       let fd;
       try {
-        fd = fs23.openSync(command, "r");
-        fs23.readSync(fd, buffer, 0, size, 0);
-        fs23.closeSync(fd);
+        fd = fs24.openSync(command, "r");
+        fs24.readSync(fd, buffer, 0, size, 0);
+        fs24.closeSync(fd);
       } catch (e) {
       }
       return shebangCommand(buffer.toString());
@@ -275191,7 +275484,7 @@ var require_readShebang = __commonJS({
 var require_parse2 = __commonJS({
   "../../node_modules/cross-spawn/lib/parse.js"(exports2, module2) {
     "use strict";
-    var path32 = require("path");
+    var path33 = require("path");
     var resolveCommand = require_resolveCommand();
     var escape2 = require_escape();
     var readShebang = require_readShebang();
@@ -275216,7 +275509,7 @@ var require_parse2 = __commonJS({
       const needsShell = !isExecutableRegExp.test(commandFile);
       if (parsed.options.forceShell || needsShell) {
         const needsDoubleEscapeMetaChars = isCmdShimRegExp.test(commandFile);
-        parsed.command = path32.normalize(parsed.command);
+        parsed.command = path33.normalize(parsed.command);
         parsed.command = escape2.command(parsed.command);
         parsed.args = parsed.args.map((arg) => escape2.argument(arg, needsDoubleEscapeMetaChars));
         const shellCommand = [parsed.command].concat(parsed.args).join(" ");
@@ -276089,6 +276382,308 @@ var require_src = __commonJS({
   }
 });
 
+// ../../packages/backend/src/services/learning/compoundingStore.ts
+var compoundingStore_exports = {};
+__export(compoundingStore_exports, {
+  COMPOUNDING_DB_FILE: () => COMPOUNDING_DB_FILE,
+  CompoundingStore: () => CompoundingStore
+});
+var import_node_fs12, import_node_path28, COMPOUNDING_DB_FILE, CompoundingStore;
+var init_compoundingStore = __esm({
+  "../../packages/backend/src/services/learning/compoundingStore.ts"() {
+    "use strict";
+    import_node_fs12 = __toESM(require("node:fs"), 1);
+    import_node_path28 = __toESM(require("node:path"), 1);
+    init_betterSqlite3Runtime();
+    init_historyStoragePaths();
+    COMPOUNDING_DB_FILE = "gyshell-compounding.sqlite";
+    CompoundingStore = class _CompoundingStore {
+      filePath;
+      db;
+      /** Avoid sync SQLite on every agent turn (desktop freeze). Invalidated on writes. */
+      promptCache = null;
+      static PROMPT_CACHE_MS = 2e3;
+      constructor(options) {
+        this.filePath = options?.filePath || import_node_path28.default.join(resolveHistoryStorageDir(), COMPOUNDING_DB_FILE);
+        import_node_fs12.default.mkdirSync(import_node_path28.default.dirname(this.filePath), { recursive: true });
+        this.db = openBetterSqlite3Database(this.filePath);
+        this.db.pragma("journal_mode = WAL");
+        this.db.exec(`
+      CREATE TABLE IF NOT EXISTS lessons (
+        fingerprint TEXT PRIMARY KEY,
+        title TEXT NOT NULL,
+        body TEXT NOT NULL,
+        never_do TEXT NOT NULL,
+        instead TEXT NOT NULL,
+        tags TEXT NOT NULL DEFAULT '',
+        extractor TEXT NOT NULL,
+        occurrences INTEGER NOT NULL DEFAULT 1,
+        first_seen_at INTEGER NOT NULL,
+        last_seen_at INTEGER NOT NULL,
+        last_run_id TEXT
+      );
+      CREATE TABLE IF NOT EXISTS estate_facts (
+        identity TEXT PRIMARY KEY,
+        host TEXT,
+        role TEXT,
+        domain TEXT,
+        transport TEXT,
+        auth TEXT,
+        facts_json TEXT NOT NULL DEFAULT '{}',
+        last_seen_at INTEGER NOT NULL
+      );
+      CREATE TABLE IF NOT EXISTS goals (
+        id TEXT PRIMARY KEY,
+        session_id TEXT NOT NULL,
+        text TEXT NOT NULL,
+        status TEXT NOT NULL,
+        blocked_by TEXT,
+        next_probe TEXT,
+        updated_at INTEGER NOT NULL
+      );
+      CREATE INDEX IF NOT EXISTS idx_goals_session ON goals(session_id);
+      CREATE TABLE IF NOT EXISTS probes (
+        session_id TEXT NOT NULL,
+        tag TEXT NOT NULL,
+        hypothesis TEXT NOT NULL,
+        command TEXT NOT NULL,
+        ok INTEGER NOT NULL,
+        at INTEGER NOT NULL,
+        PRIMARY KEY (session_id, tag)
+      );
+    `);
+      }
+      recordLessons(lessons, runId) {
+        const now = Date.now();
+        const out = [];
+        this.promptCache = null;
+        try {
+          const sel = this.db.prepare("SELECT * FROM lessons WHERE fingerprint = ?");
+          const ins = this.db.prepare(
+            `INSERT INTO lessons (fingerprint, title, body, never_do, instead, tags, extractor, occurrences, first_seen_at, last_seen_at, last_run_id)
+         VALUES (@fingerprint, @title, @body, @neverDo, @instead, @tags, @extractor, 1, @now, @now, @runId)`
+          );
+          const upd = this.db.prepare(
+            `UPDATE lessons SET occurrences = occurrences + 1, last_seen_at = @now, last_run_id = @runId,
+          title = @title, body = @body, never_do = @neverDo, instead = @instead WHERE fingerprint = @fingerprint`
+          );
+          for (const l of lessons) {
+            const existing = sel.get(l.fingerprint);
+            if (existing) {
+              upd.run({
+                fingerprint: l.fingerprint,
+                now,
+                runId: runId ?? null,
+                title: l.title,
+                body: l.body,
+                neverDo: l.neverDo,
+                instead: l.instead
+              });
+            } else {
+              ins.run({
+                fingerprint: l.fingerprint,
+                title: l.title,
+                body: l.body,
+                neverDo: l.neverDo,
+                instead: l.instead,
+                tags: l.tags.join(","),
+                extractor: l.extractor,
+                now,
+                runId: runId ?? null
+              });
+            }
+            const row = sel.get(l.fingerprint);
+            if (row) out.push(this.mapLesson(row));
+          }
+        } catch (err) {
+          console.warn("[CompoundingStore] recordLessons failed:", err);
+        }
+        return out;
+      }
+      listLessons(limit2 = 50) {
+        try {
+          const rows = this.db.prepare("SELECT * FROM lessons ORDER BY last_seen_at DESC LIMIT ?").all(limit2);
+          return rows.map((r) => this.mapLesson(r));
+        } catch (err) {
+          console.warn("[CompoundingStore] listLessons failed:", err);
+          return [];
+        }
+      }
+      upsertEstateFact(input) {
+        this.promptCache = null;
+        try {
+          const now = Date.now();
+          this.db.prepare(
+            `INSERT INTO estate_facts (identity, host, role, domain, transport, auth, facts_json, last_seen_at)
+           VALUES (@identity, @host, @role, @domain, @transport, @auth, @facts, @now)
+           ON CONFLICT(identity) DO UPDATE SET
+             host = COALESCE(@host, host),
+             role = COALESCE(@role, role),
+             domain = COALESCE(@domain, domain),
+             transport = COALESCE(@transport, transport),
+             auth = COALESCE(@auth, auth),
+             facts_json = CASE WHEN @facts = '{}' THEN facts_json ELSE @facts END,
+             last_seen_at = @now`
+          ).run({
+            identity: input.identity,
+            host: input.host ?? null,
+            role: input.role ?? null,
+            domain: input.domain ?? null,
+            transport: input.transport ?? null,
+            auth: input.auth ?? null,
+            facts: JSON.stringify(input.facts || {}),
+            now
+          });
+        } catch (err) {
+          console.warn("[CompoundingStore] upsertEstateFact failed:", err);
+        }
+      }
+      listEstateFacts() {
+        try {
+          const rows = this.db.prepare("SELECT * FROM estate_facts ORDER BY last_seen_at DESC").all();
+          return rows.map((r) => ({
+            identity: r.identity,
+            host: r.host ?? void 0,
+            role: r.role ?? void 0,
+            domain: r.domain ?? void 0,
+            transport: r.transport ?? void 0,
+            auth: r.auth ?? void 0,
+            factsJson: r.facts_json,
+            lastSeenAt: r.last_seen_at
+          }));
+        } catch (err) {
+          console.warn("[CompoundingStore] listEstateFacts failed:", err);
+          return [];
+        }
+      }
+      upsertGoal(input) {
+        this.promptCache = null;
+        try {
+          this.db.prepare(
+            `INSERT INTO goals (id, session_id, text, status, blocked_by, next_probe, updated_at)
+           VALUES (@id, @sessionId, @text, @status, @blockedBy, @nextProbe, @now)
+           ON CONFLICT(id) DO UPDATE SET
+             text = @text, status = @status, blocked_by = @blockedBy, next_probe = @nextProbe, updated_at = @now`
+          ).run({
+            id: input.id,
+            sessionId: input.sessionId,
+            text: input.text,
+            status: input.status,
+            blockedBy: input.blockedBy ?? null,
+            nextProbe: input.nextProbe ?? null,
+            now: Date.now()
+          });
+        } catch (err) {
+          console.warn("[CompoundingStore] upsertGoal failed:", err);
+        }
+      }
+      listGoals(sessionId) {
+        try {
+          const rows = this.db.prepare("SELECT * FROM goals WHERE session_id = ? ORDER BY updated_at DESC").all(sessionId);
+          return rows.map((r) => ({
+            id: r.id,
+            sessionId: r.session_id,
+            text: r.text,
+            status: r.status,
+            blockedBy: r.blocked_by ?? void 0,
+            nextProbe: r.next_probe ?? void 0,
+            updatedAt: r.updated_at
+          }));
+        } catch (err) {
+          console.warn("[CompoundingStore] listGoals failed:", err);
+          return [];
+        }
+      }
+      recordProbe(sessionId, tag, hypothesis, command, ok) {
+        this.promptCache = null;
+        try {
+          this.db.prepare(
+            `INSERT INTO probes (session_id, tag, hypothesis, command, ok, at)
+           VALUES (@sessionId, @tag, @hypothesis, @command, @ok, @at)
+           ON CONFLICT(session_id, tag) DO UPDATE SET hypothesis = @hypothesis, command = @command, ok = @ok, at = @at`
+          ).run({
+            sessionId,
+            tag,
+            hypothesis,
+            command,
+            ok: ok ? 1 : 0,
+            at: Date.now()
+          });
+        } catch (err) {
+          console.warn("[CompoundingStore] recordProbe failed:", err);
+        }
+      }
+      hasProbe(sessionId, tag) {
+        try {
+          const row = this.db.prepare("SELECT 1 FROM probes WHERE session_id = ? AND tag = ?").get(sessionId, tag);
+          return !!row;
+        } catch (err) {
+          console.warn("[CompoundingStore] hasProbe failed:", err);
+          return false;
+        }
+      }
+      /**
+       * Prompt block: estate snapshot + never-do list from lessons (capped).
+       */
+      promptBlock(maxChars = 4e3) {
+        try {
+          const now = Date.now();
+          if (this.promptCache && now - this.promptCache.at < _CompoundingStore.PROMPT_CACHE_MS) {
+            const cached2 = this.promptCache.text;
+            return cached2.length > maxChars ? cached2.slice(0, maxChars) + "\n\u2026" : cached2;
+          }
+          const lessons = this.listLessons(20);
+          const facts = this.listEstateFacts();
+          const lines = ["# Compounding knowledge (auto)"];
+          if (facts.length) {
+            lines.push("", "## Estate");
+            for (const f of facts.slice(0, 12)) {
+              const bits = [f.identity];
+              if (f.role) bits.push(f.role);
+              if (f.domain) bits.push(f.domain);
+              if (f.transport || f.auth) bits.push([f.transport, f.auth].filter(Boolean).join("/"));
+              lines.push(`- ${bits.join(" \xB7 ")}`);
+            }
+          }
+          if (lessons.length) {
+            lines.push("", "## Never-do (from prior failures)");
+            for (const l of lessons.slice(0, 12)) {
+              lines.push(`- [${l.fingerprint} \xD7${l.occurrences}] NEVER: ${l.neverDo}`);
+              lines.push(`  INSTEAD: ${l.instead}`);
+            }
+          }
+          const text = lines.join("\n");
+          this.promptCache = { at: now, text };
+          return text.length > maxChars ? text.slice(0, maxChars) + "\n\u2026" : text;
+        } catch {
+          return "";
+        }
+      }
+      close() {
+        try {
+          this.db.close();
+        } catch {
+        }
+      }
+      mapLesson(r) {
+        return {
+          fingerprint: r.fingerprint,
+          title: r.title,
+          body: r.body,
+          neverDo: r.never_do,
+          instead: r.instead,
+          tags: r.tags,
+          extractor: r.extractor,
+          occurrences: r.occurrences,
+          firstSeenAt: r.first_seen_at,
+          lastSeenAt: r.last_seen_at,
+          lastRunId: r.last_run_id ?? void 0
+        };
+      }
+    };
+  }
+});
+
 // ../../node_modules/@nats-io/nats-core/lib/encoders.js
 var require_encoders = __commonJS({
   "../../node_modules/@nats-io/nats-core/lib/encoders.js"(exports2) {
@@ -284840,7 +285435,7 @@ var require_ws_transport = __commonJS({
       let protocol;
       let port;
       const host = url2.hostname;
-      const path32 = url2.pathname;
+      const path33 = url2.pathname;
       const search = url2.search || "";
       switch (srcProto) {
         case "http:":
@@ -284860,7 +285455,7 @@ var require_ws_transport = __commonJS({
           protocol = encrypted === true ? "wss:" : "ws:";
           break;
       }
-      return `${protocol}//${host}:${port}${path32}${search}`;
+      return `${protocol}//${host}:${port}${path33}${search}`;
     }
     function wsconnect(opts = {}) {
       (0, transport_1.setTransportFactory)({
@@ -286705,11 +287300,11 @@ var require_jsmconsumer_api = __commonJS({
           consumerName = cfg.name ?? cfg.durable_name ?? "";
         }
         if (consumerName !== "") {
-          let fs23 = cfg.filter_subject ?? void 0;
-          if (fs23 === ">") {
-            fs23 = void 0;
+          let fs24 = cfg.filter_subject ?? void 0;
+          if (fs24 === ">") {
+            fs24 = void 0;
           }
-          subj = fs23 !== void 0 ? `${this.prefix}.CONSUMER.CREATE.${stream}.${consumerName}.${fs23}` : `${this.prefix}.CONSUMER.CREATE.${stream}.${consumerName}`;
+          subj = fs24 !== void 0 ? `${this.prefix}.CONSUMER.CREATE.${stream}.${consumerName}.${fs24}` : `${this.prefix}.CONSUMER.CREATE.${stream}.${consumerName}`;
         } else {
           subj = cfg.durable_name ? `${this.prefix}.CONSUMER.DURABLE.CREATE.${stream}.${cfg.durable_name}` : `${this.prefix}.CONSUMER.CREATE.${stream}`;
         }
@@ -291259,8 +291854,8 @@ var init_natsEventBus = __esm({
 });
 
 // ../../packages/backend/src/runtimes/gybackend/startGyBackend.ts
-var import_node_path28 = __toESM(require("node:path"), 1);
-var import_node_fs12 = __toESM(require("node:fs"), 1);
+var import_node_path29 = __toESM(require("node:path"), 1);
+var import_node_fs13 = __toESM(require("node:fs"), 1);
 var import_node_process2 = __toESM(require("node:process"), 1);
 
 // ../../packages/backend/src/services/TerminalService.ts
@@ -293293,18 +293888,18 @@ var SSHBackend = class _SSHBackend {
     });
     return info.socket;
   }
-  async buildConnectSocketIfNeeded(sshConfig, emit10) {
+  async buildConnectSocketIfNeeded(sshConfig, emit11) {
     if (sshConfig.jumpHost) {
       const jumpId = `[Jump:${sshConfig.jumpHost.host}]`;
       console.log(`${jumpId} Starting jump host connection flow...`);
-      emit10(
+      emit11(
         `\x1B[36m\u25B9 ${jumpId} Establishing tunnel via jump host ${sshConfig.jumpHost.host}...\x1B[0m\r
 `
       );
       const jumpClient = new (loadSsh2()).Client();
       const jumpSock = await this.buildConnectSocketIfNeeded(
         sshConfig.jumpHost,
-        emit10
+        emit11
       );
       if (jumpSock) {
         console.log(
@@ -293348,7 +293943,7 @@ var SSHBackend = class _SSHBackend {
         });
         jumpClient.connect(jumpConnectConfig);
       });
-      emit10(
+      emit11(
         `\x1B[32m\u2714 ${jumpId} Jump host ready. Requesting forward to target ${sshConfig.host}:${sshConfig.port}...\x1B[0m\r
 `
       );
@@ -293664,25 +294259,25 @@ var SSHBackend = class _SSHBackend {
     };
     this.sessions.set(config2.id, instance);
     (async () => {
-      const emit10 = (data) => {
+      const emit11 = (data) => {
         instance.dataCallbacks.forEach((cb) => cb(data));
       };
       const emitExit = (code) => {
         this.emitExitOnce(config2.id, instance, code);
       };
       client2.on("ready", async () => {
-        emit10("\x1B[2J\x1B[H\x1B[32m\u2714 Connection established.\x1B[0m\r\n");
+        emit11("\x1B[2J\x1B[H\x1B[32m\u2714 Connection established.\x1B[0m\r\n");
         console.log(
           `[SSH] Connection ready for ${sshConfig.host}:${sshConfig.port}`
         );
         const rawShell = isRawShellPreset(sshConfig.algorithmsPreset);
         try {
-          emit10("\x1B[36m\u25B9 Setting up port forwards...\x1B[0m\r\n");
+          emit11("\x1B[36m\u25B9 Setting up port forwards...\x1B[0m\r\n");
           console.log(`[SSH] Setting up port forwards...`);
           await this.setupPortForwards(instance, sshConfig);
         } catch (e) {
           console.error(`[SSH] Port forward setup failed:`, e);
-          emit10(`\x1B[31m\u2718 Port forward failed: ${e.message}\x1B[0m\r
+          emit11(`\x1B[31m\u2718 Port forward failed: ${e.message}\x1B[0m\r
 `);
         }
         if (rawShell) {
@@ -293692,7 +294287,7 @@ var SSHBackend = class _SSHBackend {
           );
         } else {
           try {
-            emit10("\x1B[36m\u25B9 Detecting remote OS...\x1B[0m\r\n");
+            emit11("\x1B[36m\u25B9 Detecting remote OS...\x1B[0m\r\n");
             console.log(`[SSH] Detecting remote OS...`);
             const uname = await this.execCollect(client2, "uname -s");
             const u = (uname.stdout || uname.stderr || "").toLowerCase();
@@ -293712,13 +294307,13 @@ var SSHBackend = class _SSHBackend {
           if (!instance.remoteOs) instance.remoteOs = "unix";
           console.log(`[SSH] Remote OS detected: ${instance.remoteOs}`);
           try {
-            emit10("\x1B[36m\u25B9 Initializing SFTP channel...\x1B[0m\r\n");
+            emit11("\x1B[36m\u25B9 Initializing SFTP channel...\x1B[0m\r\n");
             await this.initializeSftp(instance);
-            emit10("\x1B[32m\u2714 SFTP channel ready.\x1B[0m\r\n");
+            emit11("\x1B[32m\u2714 SFTP channel ready.\x1B[0m\r\n");
           } catch (error40) {
             const message = error40 instanceof Error ? error40.message : String(error40);
             instance.sftpInitError = message;
-            emit10(
+            emit11(
               `\x1B[33m\u26A0 SFTP unavailable: ${message}. File panel features may be limited.\x1B[0m\r
 `
             );
@@ -293731,7 +294326,7 @@ var SSHBackend = class _SSHBackend {
             }
           }
         }
-        emit10("\x1B[36m\u25B9 Opening interactive shell...\x1B[0m\r\n");
+        emit11("\x1B[36m\u25B9 Opening interactive shell...\x1B[0m\r\n");
         console.log(`[SSH] Opening interactive shell...`);
         const initialWindowSize = this.resolveRequestedWindowSize(instance, {
           cols: config2.cols,
@@ -293761,7 +294356,7 @@ var SSHBackend = class _SSHBackend {
               console.error(`[SSH] Failed to open shell:`, err);
               instance.initializationState = "failed";
               instance.isInitializing = false;
-              emit10(`\x1B[31m\u2718 Failed to open shell: ${err.message}\x1B[0m\r
+              emit11(`\x1B[31m\u2718 Failed to open shell: ${err.message}\x1B[0m\r
 `);
               emitExit(-1);
               return;
@@ -293771,7 +294366,7 @@ var SSHBackend = class _SSHBackend {
             if (rawShell) {
               instance.initializationState = "ready";
               instance.isInitializing = false;
-              emit10("\x1B[32m\u2714 Shell ready.\x1B[0m\r\n");
+              emit11("\x1B[32m\u2714 Shell ready.\x1B[0m\r\n");
               console.log(
                 `[SSH] Raw-shell mode: shell ready immediately (preset=${sshConfig.algorithmsPreset}).`
               );
@@ -293779,14 +294374,14 @@ var SSHBackend = class _SSHBackend {
                 const chunk2 = data.toString();
                 const sanitizedChunk = this.stripReadyMarker(chunk2);
                 this.consumeOscMarkers(instance, sanitizedChunk);
-                if (sanitizedChunk) emit10(sanitizedChunk);
+                if (sanitizedChunk) emit11(sanitizedChunk);
               });
               stream.on("close", async (code) => {
                 emitExit(typeof code === "number" ? code : 0);
               });
               return;
             }
-            emit10("\x1B[36m\u25B9 Initializing shell integration...\x1B[0m\r\n");
+            emit11("\x1B[36m\u25B9 Initializing shell integration...\x1B[0m\r\n");
             console.log(
               `[SSH] Shell stream opened. Starting robust initialization...`
             );
@@ -293832,7 +294427,7 @@ var SSHBackend = class _SSHBackend {
                 if (retryCount >= maxRetries) {
                   instance.initializationState = "failed";
                   instance.isInitializing = false;
-                  emit10(
+                  emit11(
                     "\x1B[31m\u2718 Initialization failed. Entering fallback mode.\x1B[0m\r\n"
                   );
                   console.error(
@@ -293841,7 +294436,7 @@ var SSHBackend = class _SSHBackend {
                   clearInterval(watchdogInterval);
                   return;
                 }
-                emit10(
+                emit11(
                   `\x1B[33m\u26A0 Initialization timeout, retrying (${retryCount}/${maxRetries})...\x1B[0m\r
 `
                 );
@@ -293855,7 +294450,7 @@ var SSHBackend = class _SSHBackend {
               if (instance.isInitializing) {
                 instance.buffer += chunk2;
                 if (instance.buffer.includes(GYSHELL_READY_MARKER2)) {
-                  emit10("\x1B[2J\x1B[H");
+                  emit11("\x1B[2J\x1B[H");
                   isReadySent = true;
                   clearInterval(watchdogInterval);
                   const sawContinuation = /(?:\r?\n)>>\s*\r?\n/.test(instance.buffer) || instance.buffer.trimEnd().endsWith("\n>>") || instance.buffer.trimEnd().endsWith("\r\n>>");
@@ -293866,7 +294461,7 @@ var SSHBackend = class _SSHBackend {
                     const realContent = this.stripReadyMarker(
                       parts.slice(1).join(GYSHELL_READY_MARKER2)
                     ).trimStart();
-                    if (realContent) emit10(realContent);
+                    if (realContent) emit11(realContent);
                   }
                   instance.buffer = "";
                   if (sawContinuation && instance.remoteOs === "windows" && instance.stream) {
@@ -293882,7 +294477,7 @@ var SSHBackend = class _SSHBackend {
                 const sanitizedChunk = this.stripReadyMarker(chunk2);
                 this.consumeOscMarkers(instance, sanitizedChunk);
                 if (sanitizedChunk) {
-                  emit10(sanitizedChunk);
+                  emit11(sanitizedChunk);
                 }
               }
             });
@@ -293896,7 +294491,7 @@ var SSHBackend = class _SSHBackend {
         console.error(`[SSH] Client error:`, err);
         instance.initializationState = "failed";
         instance.isInitializing = false;
-        emit10(`\x1B[31m\u2718 SSH Error: ${err.message}\x1B[0m\r
+        emit11(`\x1B[31m\u2718 SSH Error: ${err.message}\x1B[0m\r
 `);
         emitExit(-1);
       });
@@ -293919,7 +294514,7 @@ var SSHBackend = class _SSHBackend {
               sshConfig.privateKeyPath
             );
           } catch (e) {
-            emit10(
+            emit11(
               `\x1B[31m\u2718 Failed to read private key: ${e.message}\x1B[0m\r
 `
             );
@@ -293931,19 +294526,19 @@ var SSHBackend = class _SSHBackend {
       }
       try {
         await new Promise((r) => setTimeout(r, 50));
-        emit10(
+        emit11(
           `\x1B[36m\u25B9 Connecting to ${sshConfig.host}:${sshConfig.port}...\x1B[0m\r
 `
         );
         console.log(
           `[SSH] Attempting to connect to ${sshConfig.host}:${sshConfig.port}...`
         );
-        const sock = await this.buildConnectSocketIfNeeded(sshConfig, emit10);
+        const sock = await this.buildConnectSocketIfNeeded(sshConfig, emit11);
         if (sock) {
           console.log(
             `[SSH] SUCCESS: Connection to ${sshConfig.host} will be tunneled through sock (Jump Host/Proxy).`
           );
-          emit10(
+          emit11(
             "\x1B[36m\u25B9 [Final] Using tunnel socket for target connection...\x1B[0m\r\n"
           );
           connectConfig.sock = sock;
@@ -293957,7 +294552,7 @@ var SSHBackend = class _SSHBackend {
         const errMsg = e instanceof Error ? e.message : String(e);
         instance.initializationState = "failed";
         instance.isInitializing = false;
-        emit10(`\x1B[31m\u2718 Connection failed: ${errMsg}\x1B[0m\r
+        emit11(`\x1B[31m\u2718 Connection failed: ${errMsg}\x1B[0m\r
 `);
         emitExit(-1);
       }
@@ -296408,11 +297003,11 @@ Run commands with exec_command / run_fleet_command. Interactive TUI apps are not
 var import_node_crypto5 = require("node:crypto");
 var injectedSerial = null;
 var lazySerial;
-function constructPort(Ctor, path32, opts) {
+function constructPort(Ctor, path33, opts) {
   try {
-    return new Ctor(path32, opts);
+    return new Ctor(path33, opts);
   } catch (e) {
-    if (e instanceof TypeError) return new Ctor({ path: path32, ...opts });
+    if (e instanceof TypeError) return new Ctor({ path: path33, ...opts });
     throw e;
   }
 }
@@ -296430,7 +297025,7 @@ var SerialBackend = class {
     try {
       const mod = require("serialport");
       const Ctor = typeof mod?.SerialPort === "function" ? mod.SerialPort : mod;
-      lazySerial = ((path32, opts) => constructPort(Ctor, path32, opts));
+      lazySerial = ((path33, opts) => constructPort(Ctor, path33, opts));
     } catch {
       lazySerial = null;
     }
@@ -300884,8 +301479,8 @@ function shallowCopy(obj) {
 }
 function replaceSecrets(root, secretsMap) {
   const result = shallowCopy(root);
-  for (const [path32, secretId] of Object.entries(secretsMap)) {
-    const [last, ...partsReverse] = path32.split(".").reverse();
+  for (const [path33, secretId] of Object.entries(secretsMap)) {
+    const [last, ...partsReverse] = path33.split(".").reverse();
     let current = result;
     for (const part of partsReverse.reverse()) {
       if (current[part] === void 0) break;
@@ -305949,9 +306544,9 @@ var Client = class _Client {
     }
     return headers;
   }
-  _getPlatformEndpointPath(path32) {
+  _getPlatformEndpointPath(path33) {
     const needsV1Prefix = this.apiUrl.slice(-3) !== "/v1" && this.apiUrl.slice(-4) !== "/v1/";
-    return needsV1Prefix ? `/v1/platform/${path32}` : `/platform/${path32}`;
+    return needsV1Prefix ? `/v1/platform/${path33}` : `/platform/${path33}`;
   }
   async processInputs(inputs) {
     if (this.hideInputs === false) {
@@ -305987,9 +306582,9 @@ var Client = class _Client {
     }
     return runParams;
   }
-  async _getResponse(path32, queryParams) {
+  async _getResponse(path33, queryParams) {
     const paramsString = queryParams?.toString() ?? "";
-    const url2 = `${this.apiUrl}${path32}?${paramsString}`;
+    const url2 = `${this.apiUrl}${path33}?${paramsString}`;
     const response = await this.caller.call(async () => {
       const res = await this._fetch(url2, {
         method: "GET",
@@ -305997,22 +306592,22 @@ var Client = class _Client {
         signal: AbortSignal.timeout(this.timeout_ms),
         ...this.fetchOptions
       });
-      await raiseForStatus(res, `fetch ${path32}`);
+      await raiseForStatus(res, `fetch ${path33}`);
       return res;
     });
     return response;
   }
-  async _get(path32, queryParams) {
-    const response = await this._getResponse(path32, queryParams);
+  async _get(path33, queryParams) {
+    const response = await this._getResponse(path33, queryParams);
     return response.json();
   }
-  async *_getPaginated(path32, queryParams = new URLSearchParams(), transform2) {
+  async *_getPaginated(path33, queryParams = new URLSearchParams(), transform2) {
     let offset = Number(queryParams.get("offset")) || 0;
     const limit2 = Number(queryParams.get("limit")) || 100;
     while (true) {
       queryParams.set("offset", String(offset));
       queryParams.set("limit", String(limit2));
-      const url2 = `${this.apiUrl}${path32}?${queryParams}`;
+      const url2 = `${this.apiUrl}${path33}?${queryParams}`;
       const response = await this.caller.call(async () => {
         const res = await this._fetch(url2, {
           method: "GET",
@@ -306020,7 +306615,7 @@ var Client = class _Client {
           signal: AbortSignal.timeout(this.timeout_ms),
           ...this.fetchOptions
         });
-        await raiseForStatus(res, `fetch ${path32}`);
+        await raiseForStatus(res, `fetch ${path33}`);
         return res;
       });
       const items = transform2 ? transform2(await response.json()) : await response.json();
@@ -306034,19 +306629,19 @@ var Client = class _Client {
       offset += items.length;
     }
   }
-  async *_getCursorPaginatedList(path32, body = null, requestMethod = "POST", dataKey = "runs") {
+  async *_getCursorPaginatedList(path33, body = null, requestMethod = "POST", dataKey = "runs") {
     const bodyParams = body ? { ...body } : {};
     while (true) {
       const body2 = JSON.stringify(bodyParams);
       const response = await this.caller.call(async () => {
-        const res = await this._fetch(`${this.apiUrl}${path32}`, {
+        const res = await this._fetch(`${this.apiUrl}${path33}`, {
           method: requestMethod,
           headers: { ...this.headers, "Content-Type": "application/json" },
           signal: AbortSignal.timeout(this.timeout_ms),
           ...this.fetchOptions,
           body: body2
         });
-        await raiseForStatus(res, `fetch ${path32}`);
+        await raiseForStatus(res, `fetch ${path33}`);
         return res;
       });
       const responseBody = await response.json();
@@ -306975,8 +307570,8 @@ Context: ${context2}`);
       limit: Number(limit2) || 100
     };
     let currentOffset = Number(offset) || 0;
-    const path32 = "/runs/group";
-    const url2 = `${this.apiUrl}${path32}`;
+    const path33 = "/runs/group";
+    const url2 = `${this.apiUrl}${path33}`;
     while (true) {
       const currentBody = {
         ...baseBody,
@@ -306992,7 +307587,7 @@ Context: ${context2}`);
           ...this.fetchOptions,
           body
         });
-        await raiseForStatus(res, `Failed to fetch ${path32}`);
+        await raiseForStatus(res, `Failed to fetch ${path33}`);
         return res;
       });
       const items = await response.json();
@@ -307309,20 +307904,20 @@ Message: ${Array.isArray(result.detail) ? result.detail.join("\n") : "Unspecifie
     return result;
   }
   async hasProject({ projectId, projectName }) {
-    let path32 = "/sessions";
+    let path33 = "/sessions";
     const params = new URLSearchParams();
     if (projectId !== void 0 && projectName !== void 0) {
       throw new Error("Must provide either projectName or projectId, not both");
     } else if (projectId !== void 0) {
       assertUuid(projectId);
-      path32 += `/${projectId}`;
+      path33 += `/${projectId}`;
     } else if (projectName !== void 0) {
       params.append("name", projectName);
     } else {
       throw new Error("Must provide projectName or projectId");
     }
     const response = await this.caller.call(async () => {
-      const res = await this._fetch(`${this.apiUrl}${path32}?${params}`, {
+      const res = await this._fetch(`${this.apiUrl}${path33}?${params}`, {
         method: "GET",
         headers: this.headers,
         signal: AbortSignal.timeout(this.timeout_ms),
@@ -307345,13 +307940,13 @@ Message: ${Array.isArray(result.detail) ? result.detail.join("\n") : "Unspecifie
     }
   }
   async readProject({ projectId, projectName, includeStats }) {
-    let path32 = "/sessions";
+    let path33 = "/sessions";
     const params = new URLSearchParams();
     if (projectId !== void 0 && projectName !== void 0) {
       throw new Error("Must provide either projectName or projectId, not both");
     } else if (projectId !== void 0) {
       assertUuid(projectId);
-      path32 += `/${projectId}`;
+      path33 += `/${projectId}`;
     } else if (projectName !== void 0) {
       params.append("name", projectName);
     } else {
@@ -307360,7 +307955,7 @@ Message: ${Array.isArray(result.detail) ? result.detail.join("\n") : "Unspecifie
     if (includeStats !== void 0) {
       params.append("include_stats", includeStats.toString());
     }
-    const response = await this._get(path32, params);
+    const response = await this._get(path33, params);
     let result;
     if (Array.isArray(response)) {
       if (response.length === 0) {
@@ -307523,19 +308118,19 @@ Message: ${Array.isArray(result.detail) ? result.detail.join("\n") : "Unspecifie
     return result;
   }
   async readDataset({ datasetId, datasetName }) {
-    let path32 = "/datasets";
+    let path33 = "/datasets";
     const params = new URLSearchParams({ limit: "1" });
     if (datasetId && datasetName) {
       throw new Error("Must provide either datasetName or datasetId, not both");
     } else if (datasetId) {
       assertUuid(datasetId);
-      path32 += `/${datasetId}`;
+      path33 += `/${datasetId}`;
     } else if (datasetName) {
       params.append("name", datasetName);
     } else {
       throw new Error("Must provide datasetName or datasetId");
     }
-    const response = await this._get(path32, params);
+    const response = await this._get(path33, params);
     let result;
     if (Array.isArray(response)) {
       if (response.length === 0) {
@@ -307579,20 +308174,20 @@ Message: ${Array.isArray(result.detail) ? result.detail.join("\n") : "Unspecifie
     return response;
   }
   async readDatasetOpenaiFinetuning({ datasetId, datasetName }) {
-    const path32 = "/datasets";
+    const path33 = "/datasets";
     if (datasetId !== void 0) {
     } else if (datasetName !== void 0) {
       datasetId = (await this.readDataset({ datasetName })).id;
     } else {
       throw new Error("Must provide either datasetName or datasetId");
     }
-    const response = await this._getResponse(`${path32}/${datasetId}/openai_ft`);
+    const response = await this._getResponse(`${path33}/${datasetId}/openai_ft`);
     const datasetText = await response.text();
     const dataset = datasetText.trim().split("\n").map((line) => JSON.parse(line));
     return dataset;
   }
   async *listDatasets({ limit: limit2 = 100, offset = 0, datasetIds, datasetName, datasetNameContains, metadata } = {}) {
-    const path32 = "/datasets";
+    const path33 = "/datasets";
     const params = new URLSearchParams({
       limit: limit2.toString(),
       offset: offset.toString()
@@ -307611,7 +308206,7 @@ Message: ${Array.isArray(result.detail) ? result.detail.join("\n") : "Unspecifie
     if (metadata !== void 0) {
       params.append("metadata", JSON.stringify(metadata));
     }
-    for await (const datasets of this._getPaginated(path32, params)) {
+    for await (const datasets of this._getPaginated(path33, params)) {
       yield* datasets;
     }
   }
@@ -307680,7 +308275,7 @@ Message: ${Array.isArray(result.detail) ? result.detail.join("\n") : "Unspecifie
     });
   }
   async deleteDataset({ datasetId, datasetName }) {
-    let path32 = "/datasets";
+    let path33 = "/datasets";
     let datasetId_ = datasetId;
     if (datasetId !== void 0 && datasetName !== void 0) {
       throw new Error("Must provide either datasetName or datasetId, not both");
@@ -307690,18 +308285,18 @@ Message: ${Array.isArray(result.detail) ? result.detail.join("\n") : "Unspecifie
     }
     if (datasetId_ !== void 0) {
       assertUuid(datasetId_);
-      path32 += `/${datasetId_}`;
+      path33 += `/${datasetId_}`;
     } else {
       throw new Error("Must provide datasetName or datasetId");
     }
     await this.caller.call(async () => {
-      const res = await this._fetch(this.apiUrl + path32, {
+      const res = await this._fetch(this.apiUrl + path33, {
         method: "DELETE",
         headers: this.headers,
         signal: AbortSignal.timeout(this.timeout_ms),
         ...this.fetchOptions
       });
-      await raiseForStatus(res, `delete ${path32}`, true);
+      await raiseForStatus(res, `delete ${path33}`, true);
       return res;
     });
   }
@@ -307892,8 +308487,8 @@ Message: ${Array.isArray(result.detail) ? result.detail.join("\n") : "Unspecifie
   }
   async readExample(exampleId) {
     assertUuid(exampleId);
-    const path32 = `/examples/${exampleId}`;
-    const rawExample = await this._get(path32);
+    const path33 = `/examples/${exampleId}`;
+    const rawExample = await this._get(path33);
     const { attachment_urls, ...rest } = rawExample;
     const example = rest;
     if (attachment_urls) {
@@ -307976,15 +308571,15 @@ Message: ${Array.isArray(result.detail) ? result.detail.join("\n") : "Unspecifie
   }
   async deleteExample(exampleId) {
     assertUuid(exampleId);
-    const path32 = `/examples/${exampleId}`;
+    const path33 = `/examples/${exampleId}`;
     await this.caller.call(async () => {
-      const res = await this._fetch(this.apiUrl + path32, {
+      const res = await this._fetch(this.apiUrl + path33, {
         method: "DELETE",
         headers: this.headers,
         signal: AbortSignal.timeout(this.timeout_ms),
         ...this.fetchOptions
       });
-      await raiseForStatus(res, `delete ${path32}`, true);
+      await raiseForStatus(res, `delete ${path33}`, true);
       return res;
     });
   }
@@ -307997,9 +308592,9 @@ Message: ${Array.isArray(result.detail) ? result.detail.join("\n") : "Unspecifie
   async deleteExamples(exampleIds, options) {
     exampleIds.forEach((id) => assertUuid(id));
     if (options?.hardDelete) {
-      const path32 = this._getPlatformEndpointPath("datasets/examples/delete");
+      const path33 = this._getPlatformEndpointPath("datasets/examples/delete");
       await this.caller.call(async () => {
-        const res = await this._fetch(`${this.apiUrl}${path32}`, {
+        const res = await this._fetch(`${this.apiUrl}${path33}`, {
           method: "POST",
           headers: { ...this.headers, "Content-Type": "application/json" },
           body: JSON.stringify({
@@ -308233,21 +308828,21 @@ Message: ${Array.isArray(result.detail) ? result.detail.join("\n") : "Unspecifie
   }
   async readFeedback(feedbackId) {
     assertUuid(feedbackId);
-    const path32 = `/feedback/${feedbackId}`;
-    const response = await this._get(path32);
+    const path33 = `/feedback/${feedbackId}`;
+    const response = await this._get(path33);
     return response;
   }
   async deleteFeedback(feedbackId) {
     assertUuid(feedbackId);
-    const path32 = `/feedback/${feedbackId}`;
+    const path33 = `/feedback/${feedbackId}`;
     await this.caller.call(async () => {
-      const res = await this._fetch(this.apiUrl + path32, {
+      const res = await this._fetch(this.apiUrl + path33, {
         method: "DELETE",
         headers: this.headers,
         signal: AbortSignal.timeout(this.timeout_ms),
         ...this.fetchOptions
       });
-      await raiseForStatus(res, `delete ${path32}`, true);
+      await raiseForStatus(res, `delete ${path33}`, true);
       return res;
     });
   }
@@ -311843,12 +312438,12 @@ function isInteger(str3) {
   }
   return true;
 }
-function escapePathComponent(path32) {
-  if (path32.indexOf("/") === -1 && path32.indexOf("~") === -1) return path32;
-  return path32.replace(/~/g, "~0").replace(/\//g, "~1");
+function escapePathComponent(path33) {
+  if (path33.indexOf("/") === -1 && path33.indexOf("~") === -1) return path33;
+  return path33.replace(/~/g, "~0").replace(/\//g, "~1");
 }
-function unescapePathComponent(path32) {
-  return path32.replace(/~1/g, "/").replace(/~0/g, "~");
+function unescapePathComponent(path33) {
+  return path33.replace(/~1/g, "/").replace(/~0/g, "~");
 }
 function hasUndefined(obj) {
   if (obj === void 0) return true;
@@ -312042,8 +312637,8 @@ function applyOperation(document2, operation, validateOperation = false, mutateD
     else return returnValue;
   } else {
     if (!mutateDocument) document2 = _deepClone(document2);
-    const path32 = operation.path || "";
-    const keys = path32.split("/");
+    const path33 = operation.path || "";
+    const keys = path33.split("/");
     let obj = document2;
     let t = 1;
     let len = keys.length;
@@ -312166,7 +312761,7 @@ function _areEquals(a, b) {
 }
 
 // ../../node_modules/@langchain/core/dist/utils/fast-json-patch/src/duplex.js
-function _generate(mirror, obj, patches, path32, invertible) {
+function _generate(mirror, obj, patches, path33, invertible) {
   if (obj === mirror) return;
   if (typeof obj.toJSON === "function") obj = obj.toJSON();
   var newKeys = _objectKeys(obj);
@@ -312178,40 +312773,40 @@ function _generate(mirror, obj, patches, path32, invertible) {
     var oldVal = mirror[key];
     if (hasOwnProperty(obj, key) && !(obj[key] === void 0 && oldVal !== void 0 && Array.isArray(obj) === false)) {
       var newVal = obj[key];
-      if (typeof oldVal == "object" && oldVal != null && typeof newVal == "object" && newVal != null && Array.isArray(oldVal) === Array.isArray(newVal)) _generate(oldVal, newVal, patches, path32 + "/" + escapePathComponent(key), invertible);
+      if (typeof oldVal == "object" && oldVal != null && typeof newVal == "object" && newVal != null && Array.isArray(oldVal) === Array.isArray(newVal)) _generate(oldVal, newVal, patches, path33 + "/" + escapePathComponent(key), invertible);
       else if (oldVal !== newVal) {
         changed = true;
         if (invertible) patches.push({
           op: "test",
-          path: path32 + "/" + escapePathComponent(key),
+          path: path33 + "/" + escapePathComponent(key),
           value: _deepClone(oldVal)
         });
         patches.push({
           op: "replace",
-          path: path32 + "/" + escapePathComponent(key),
+          path: path33 + "/" + escapePathComponent(key),
           value: _deepClone(newVal)
         });
       }
     } else if (Array.isArray(mirror) === Array.isArray(obj)) {
       if (invertible) patches.push({
         op: "test",
-        path: path32 + "/" + escapePathComponent(key),
+        path: path33 + "/" + escapePathComponent(key),
         value: _deepClone(oldVal)
       });
       patches.push({
         op: "remove",
-        path: path32 + "/" + escapePathComponent(key)
+        path: path33 + "/" + escapePathComponent(key)
       });
       deleted = true;
     } else {
       if (invertible) patches.push({
         op: "test",
-        path: path32,
+        path: path33,
         value: mirror
       });
       patches.push({
         op: "replace",
-        path: path32,
+        path: path33,
         value: obj
       });
       changed = true;
@@ -312222,7 +312817,7 @@ function _generate(mirror, obj, patches, path32, invertible) {
     var key = newKeys[t];
     if (!hasOwnProperty(mirror, key) && obj[key] !== void 0) patches.push({
       op: "add",
-      path: path32 + "/" + escapePathComponent(key),
+      path: path33 + "/" + escapePathComponent(key),
       value: _deepClone(obj[key])
     });
   }
@@ -313608,10 +314203,10 @@ function assignProp(target, prop, value) {
     configurable: true
   });
 }
-function getElementAtPath(obj, path32) {
-  if (!path32)
+function getElementAtPath(obj, path33) {
+  if (!path33)
     return obj;
-  return path32.reduce((acc, key) => acc?.[key], obj);
+  return path33.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -313931,11 +314526,11 @@ function aborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path32, issues) {
+function prefixIssues(path33, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path32);
+    iss.path.unshift(path33);
     return iss;
   });
 }
@@ -314072,7 +314667,7 @@ function treeifyError(error40, _mapper) {
     return issue2.message;
   };
   const result = { errors: [] };
-  const processError = (error41, path32 = []) => {
+  const processError = (error41, path33 = []) => {
     var _a3, _b;
     for (const issue2 of error41.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
@@ -314082,7 +314677,7 @@ function treeifyError(error40, _mapper) {
       } else if (issue2.code === "invalid_element") {
         processError({ issues: issue2.issues }, issue2.path);
       } else {
-        const fullpath = [...path32, ...issue2.path];
+        const fullpath = [...path33, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -314112,9 +314707,9 @@ function treeifyError(error40, _mapper) {
   processError(error40);
   return result;
 }
-function toDotPath(path32) {
+function toDotPath(path33) {
   const segs = [];
-  for (const seg of path32) {
+  for (const seg of path33) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -326362,10 +326957,10 @@ var Runnable = class extends Serializable {
       }
       const paths = log.ops.filter((op) => op.path.startsWith("/logs/")).map((op) => op.path.split("/")[2]);
       const dedupedPaths = [...new Set(paths)];
-      for (const path32 of dedupedPaths) {
+      for (const path33 of dedupedPaths) {
         let eventType;
         let data = {};
-        const logEntry = runLog.state.logs[path32];
+        const logEntry = runLog.state.logs[path33];
         if (logEntry.end_time === void 0) if (logEntry.streamed_output.length > 0) eventType = "stream";
         else eventType = "start";
         else eventType = "end";
@@ -332058,7 +332653,7 @@ var initializeSax = function() {
     if (parser.opt.xmlns) parser.ns = Object.create(rootNS);
     parser.trackPosition = parser.opt.position !== false;
     if (parser.trackPosition) parser.position = parser.line = parser.column = 0;
-    emit10(parser, "onready");
+    emit11(parser, "onready");
   }
   if (!Object.create) Object.create = function(o) {
     function F2() {
@@ -332524,16 +333119,16 @@ var initializeSax = function() {
   });
   for (var s in sax$1.STATE) sax$1.STATE[sax$1.STATE[s]] = s;
   S2 = sax$1.STATE;
-  function emit10(parser, event, data) {
+  function emit11(parser, event, data) {
     parser[event] && parser[event](data);
   }
   function emitNode(parser, nodeType, data) {
     if (parser.textNode) closeText(parser);
-    emit10(parser, nodeType, data);
+    emit11(parser, nodeType, data);
   }
   function closeText(parser) {
     parser.textNode = textopts(parser.opt, parser.textNode);
-    if (parser.textNode) emit10(parser, "ontext", parser.textNode);
+    if (parser.textNode) emit11(parser, "ontext", parser.textNode);
     parser.textNode = "";
   }
   function textopts(opt, text) {
@@ -332546,7 +333141,7 @@ var initializeSax = function() {
     if (parser.trackPosition) er += "\nLine: " + parser.line + "\nColumn: " + parser.column + "\nChar: " + parser.c;
     er = new Error(er);
     parser.error = er;
-    emit10(parser, "onerror", er);
+    emit11(parser, "onerror", er);
     return parser;
   }
   function end(parser) {
@@ -332555,7 +333150,7 @@ var initializeSax = function() {
     closeText(parser);
     parser.c = "";
     parser.closed = true;
-    emit10(parser, "onend");
+    emit11(parser, "onend");
     SAXParser.call(parser, parser.strict, parser.opt);
     return parser;
   }
@@ -338430,13 +339025,13 @@ function combineAliasesAndInvert(constructor) {
   }, {});
 }
 async function reviver(value) {
-  const { optionalImportsMap, optionalImportEntrypoints: optionalImportEntrypoints$1, importMap, secretsMap, secretsFromEnv, path: path32, depth, maxDepth } = this;
-  const pathStr = path32.join(".");
+  const { optionalImportsMap, optionalImportEntrypoints: optionalImportEntrypoints$1, importMap, secretsMap, secretsFromEnv, path: path33, depth, maxDepth } = this;
+  const pathStr = path33.join(".");
   if (depth > maxDepth) throw new Error(`Maximum recursion depth (${maxDepth}) exceeded during deserialization. This may indicate a malicious payload or you may need to increase maxDepth.`);
   if (typeof value !== "object" || value == null) return value;
   if (Array.isArray(value)) return Promise.all(value.map((v, i) => reviver.call({
     ...this,
-    path: [...path32, `${i}`],
+    path: [...path33, `${i}`],
     depth: depth + 1
   }, v)));
   const record2 = value;
@@ -338491,7 +339086,7 @@ async function reviver(value) {
     if (typeof builder !== "function") throw new Error(`Invalid identifer: ${pathStr} -> ${str3}`);
     const kwargs = await reviver.call({
       ...this,
-      path: [...path32, "kwargs"],
+      path: [...path33, "kwargs"],
       depth: depth + 1
     }, serialized.kwargs);
     const instance = new builder(mapKeys(kwargs, keyFromJson, combineAliasesAndInvert(builder)));
@@ -338501,7 +339096,7 @@ async function reviver(value) {
   const result = {};
   for (const [key, val] of Object.entries(record2)) result[key] = await reviver.call({
     ...this,
-    path: [...path32, key],
+    path: [...path33, key],
     depth: depth + 1
   }, val);
   return result;
@@ -343629,10 +344224,10 @@ var Graph$1 = class {
     this.edges.add([startKey, endKey]);
     return this;
   }
-  addConditionalEdges(source, path32, pathMap) {
+  addConditionalEdges(source, path33, pathMap) {
     const options = typeof source === "object" ? source : {
       source,
-      path: path32,
+      path: path33,
       pathMap
     };
     this.warnIfCompiled("Adding an edge to a graph that has already been compiled. This will not be reflected in the compiled graph.");
@@ -345164,16 +345759,16 @@ var Diff = class {
       }
     }
   }
-  addToPath(path32, added, removed, oldPosInc, options) {
-    const last = path32.lastComponent;
+  addToPath(path33, added, removed, oldPosInc, options) {
+    const last = path33.lastComponent;
     if (last && !options.oneChangePerToken && last.added === added && last.removed === removed) {
       return {
-        oldPos: path32.oldPos + oldPosInc,
+        oldPos: path33.oldPos + oldPosInc,
         lastComponent: { count: last.count + 1, added, removed, previousComponent: last.previousComponent }
       };
     } else {
       return {
-        oldPos: path32.oldPos + oldPosInc,
+        oldPos: path33.oldPos + oldPosInc,
         lastComponent: { count: 1, added, removed, previousComponent: last }
       };
     }
@@ -346690,6 +347285,143 @@ function recallForPrompt(content, opts = {}) {
   return picked.join("\n");
 }
 
+// ../../packages/backend/src/services/AgentHelper/tools/learning_tools.ts
+init_zod();
+var import_node_crypto16 = require("node:crypto");
+init_compoundingKnowledge();
+function emit(context2, toolName, input, output) {
+  context2.sendEvent(context2.sessionId, {
+    messageId: context2.messageId,
+    type: "tool_call",
+    toolName,
+    input: typeof input === "string" ? input : JSON.stringify(input),
+    output
+  });
+}
+var opsExperimentSchema = external_exports.object({
+  hypothesis: external_exports.string().min(1).describe('What you think is true, e.g. "SMB IPC$ is blocked (NetUseAdd 64)".'),
+  probe: external_exports.string().min(1).describe("One cheap command that would confirm or reject the hypothesis."),
+  tag: external_exports.enum(["ad-join", "ad-promo", "smb", "aws-sg", "disk", "windows-feature", "psrp", "dns", "other"]).describe("Probe family. Gated mutations require a matching tag in this session (e.g. Add-Computer needs ad-join)."),
+  expect: external_exports.string().optional().describe("Optional substring the probe output must contain to count as ok."),
+  tabIdOrName: external_exports.string().optional().describe("Optional tab to run the probe on. If omitted, the experiment is recorded as a plan only.")
+});
+var manageGoalSchema = external_exports.object({
+  action: external_exports.enum(["upsert", "list", "done", "abandon"]).describe("upsert a goal, list session goals, mark done, or abandon."),
+  id: external_exports.string().optional().describe("Goal id (upsert/done/abandon). Generated if omitted on upsert."),
+  text: external_exports.string().optional().describe("Goal text (upsert)."),
+  status: external_exports.enum(["open", "blocked", "done", "abandoned"]).optional(),
+  blockedBy: external_exports.string().optional(),
+  nextProbe: external_exports.string().optional()
+});
+var estateFactsSchema = external_exports.object({
+  action: external_exports.enum(["upsert", "list"]).describe("upsert a fact for a connection identity, or list the estate snapshot."),
+  name: external_exports.string().optional().describe("Saved connection name (preferred identity)."),
+  host: external_exports.string().optional(),
+  role: external_exports.string().optional().describe("dc | member | workgroup | other"),
+  domain: external_exports.string().optional(),
+  transport: external_exports.string().optional(),
+  auth: external_exports.string().optional(),
+  facts: external_exports.record(external_exports.unknown()).optional()
+});
+async function opsExperiment(args, context2) {
+  const store = context2.compoundingStore;
+  if (!store) {
+    const msg2 = "Compounding store is not wired in this runtime.";
+    emit(context2, "ops_experiment", args, msg2);
+    return msg2;
+  }
+  store.recordProbe(context2.sessionId, args.tag, args.hypothesis, args.probe, false);
+  const msg = `Recorded experiment tag=${args.tag}
+hypothesis: ${args.hypothesis}
+probe: ${args.probe}
+` + (args.expect ? `expect: ${args.expect}
+` : "") + (args.tabIdOrName ? `Run the probe on tab "${args.tabIdOrName}" with exec_command, then treat a match of expect as confirmation. Do not retry the original mutation until the probe has been run.` : `Run the probe next. Gated mutations that require tag "${args.tag}" are now allowed in this session only AFTER you actually run the probe command.`);
+  emit(context2, "ops_experiment", args, msg);
+  return msg;
+}
+async function manageGoal(args, context2) {
+  const store = context2.compoundingStore;
+  if (!store) {
+    const msg2 = "Compounding store is not wired in this runtime.";
+    emit(context2, "manage_goal", args, msg2);
+    return msg2;
+  }
+  if (args.action === "list") {
+    const goals = store.listGoals(context2.sessionId);
+    const msg2 = goals.length ? goals.map((g) => `- ${g.id} [${g.status}] ${g.text}${g.blockedBy ? ` blocked_by=${g.blockedBy}` : ""}`).join("\n") : "No goals in this session.";
+    emit(context2, "manage_goal", args, msg2);
+    return msg2;
+  }
+  const id = args.id || `goal-${(0, import_node_crypto16.randomUUID)().slice(0, 8)}`;
+  if (args.action === "done" || args.action === "abandon") {
+    const existing = store.listGoals(context2.sessionId).find((g) => g.id === id);
+    store.upsertGoal({
+      id,
+      sessionId: context2.sessionId,
+      text: existing?.text || args.text || id,
+      status: args.action === "done" ? "done" : "abandoned"
+    });
+    const msg2 = `Goal ${id} marked ${args.action}.`;
+    emit(context2, "manage_goal", args, msg2);
+    return msg2;
+  }
+  if (!args.text) {
+    const msg2 = "upsert requires text";
+    emit(context2, "manage_goal", args, msg2);
+    return msg2;
+  }
+  store.upsertGoal({
+    id,
+    sessionId: context2.sessionId,
+    text: args.text,
+    status: args.status || "open",
+    blockedBy: args.blockedBy,
+    nextProbe: args.nextProbe
+  });
+  const msg = `Goal ${id} [${args.status || "open"}] ${args.text}`;
+  emit(context2, "manage_goal", args, msg);
+  return msg;
+}
+async function estateFacts(args, context2) {
+  const store = context2.compoundingStore;
+  if (!store) {
+    const msg2 = "Compounding store is not wired in this runtime.";
+    emit(context2, "estate_facts", args, msg2);
+    return msg2;
+  }
+  if (args.action === "list") {
+    const facts = store.listEstateFacts();
+    const msg2 = facts.length ? facts.map((f) => {
+      const bits = [f.identity, f.role, f.domain, [f.transport, f.auth].filter(Boolean).join("/")].filter(Boolean);
+      return `- ${bits.join(" \xB7 ")}`;
+    }).join("\n") : "No estate facts recorded yet. Upsert after collect_facts / AD probes.";
+    emit(context2, "estate_facts", args, msg2);
+    return msg2;
+  }
+  const identity = connectionIdentity({
+    name: args.name,
+    host: args.host,
+    transport: args.transport,
+    auth: args.auth,
+    domain: args.domain
+  });
+  store.upsertEstateFact({
+    identity,
+    host: args.host,
+    role: args.role,
+    domain: args.domain,
+    transport: args.transport,
+    auth: args.auth,
+    facts: args.facts
+  });
+  const msg = `Upserted estate fact identity=${identity}`;
+  emit(context2, "estate_facts", args, msg);
+  return msg;
+}
+var OPS_EXPERIMENT_DESCRIPTION = "Record a named hypothesis + cheap probe BEFORE a destructive mutation (Add-Computer, Install-ADDSForest, djoin /provision, Set-SmbServerConfiguration, SG ingress). Gated commands refuse to run in this session until ops_experiment has been called with the matching tag (ad-join, ad-promo, smb, aws-sg, \u2026). If the probe fails, do NOT retry the original mutation \u2014 pick the INSTEAD from compounding lessons (e.g. djoin instead of Add-Computer).";
+var MANAGE_GOAL_DESCRIPTION = "Persistent operator intent for this chat session: upsert/list/done/abandon goals so a multi-step job (join server-2, wait for reboot) survives tool loops. Call upsert when the user states a job; list at the start of a turn if you might have forgotten.";
+var ESTATE_FACTS_DESCRIPTION = "Queryable snapshot of THIS estate keyed by connection NAME not IP (CORP-DC1 psrp+negotiate is not neuralos-win1 psrp+basic even on the same host). Upsert after collect_facts / Get-ADDomain; list to see dc vs member vs workgroup.";
+
 // ../../packages/backend/src/services/AgentHelper/prompts.ts
 var SYS_INFO_MARKER = "CURRENT_SYSTEM_INFO_MSG:\n";
 var GYSHELL_BASE_SYSTEM_MARKER = "# Role: GyShell Assistant";
@@ -347089,6 +347821,21 @@ var BUILTIN_TOOL_INFO = [
     description: GET_RUN_LEDGER_DESCRIPTION,
     shortDescription: "Query agent run audit ledger"
   },
+  {
+    name: "ops_experiment",
+    description: OPS_EXPERIMENT_DESCRIPTION,
+    shortDescription: "Hypothesis + probe before mutations"
+  },
+  {
+    name: "manage_goal",
+    description: MANAGE_GOAL_DESCRIPTION,
+    shortDescription: "Persistent session goals"
+  },
+  {
+    name: "estate_facts",
+    description: ESTATE_FACTS_DESCRIPTION,
+    shortDescription: "Estate snapshot by connection name"
+  },
   {
     name: "run_fleet_command",
     description: RUN_FLEET_COMMAND_DESCRIPTION,
@@ -347656,7 +348403,7 @@ function buildUnfinishedFileTransferContinueInstruction(transfers) {
 }
 
 // ../../packages/backend/src/services/AgentHelper/tools/terminal_tools.ts
-var import_node_crypto16 = require("node:crypto");
+var import_node_crypto17 = require("node:crypto");
 var execCommandSchema = external_exports.object({
   tabIdOrName: external_exports.string().describe("The ID or Name of the terminal tab"),
   command: external_exports.string().describe("The shell command to execute"),
@@ -347708,7 +348455,7 @@ function sshEntryToTerminalConfig(entry, opts) {
   const jumpHost = entry.jumpHost;
   return {
     type: "ssh",
-    id: `ssh-${(0, import_node_crypto16.randomUUID)()}`,
+    id: `ssh-${(0, import_node_crypto17.randomUUID)()}`,
     title: opts.title,
     cols: 80,
     rows: 24,
@@ -347738,7 +348485,7 @@ function resolveSavedWinrmConnection(context2, nameOrId) {
 function winrmEntryToTerminalConfig(entry, opts) {
   return {
     type: "winrm",
-    id: `winrm-${(0, import_node_crypto16.randomUUID)()}`,
+    id: `winrm-${(0, import_node_crypto17.randomUUID)()}`,
     title: opts.title,
     cols: 80,
     rows: 24,
@@ -347763,7 +348510,7 @@ function resolveSavedSerialConnection(context2, nameOrId) {
 function serialEntryToTerminalConfig(entry, opts) {
   return {
     type: "serial",
-    id: `serial-${(0, import_node_crypto16.randomUUID)()}`,
+    id: `serial-${(0, import_node_crypto17.randomUUID)()}`,
     title: opts.title,
     cols: 80,
     rows: 24,
@@ -347889,6 +348636,30 @@ async function runCommand(args, context2, options) {
       "run commands in this terminal"
     );
   }
+  const { matchGatedMutation: matchGatedMutation2 } = await Promise.resolve().then(() => (init_compoundingKnowledge(), compoundingKnowledge_exports)).catch(() => ({ matchGatedMutation: () => null }));
+  const gated = matchGatedMutation2(command);
+  if (gated && context2.compoundingStore && !context2.compoundingStore.hasProbe(context2.sessionId, gated.requireProbeTag)) {
+    const block = `Blocked gated mutation "${gated.id}" until ops_experiment runs with tag="${gated.requireProbeTag}" in this session. Call ops_experiment (hypothesis + cheap probe) first. If that probe already failed, do NOT retry ${gated.id} \u2014 use the INSTEAD from compounding lessons.`;
+    abortIfNeeded(context2.signal);
+    context2.sendEvent(sessionId, {
+      messageId,
+      type: "command_started",
+      command,
+      commandId: messageId,
+      tabName: bestMatch.title || bestMatch.id,
+      isNowait: false
+    });
+    context2.sendEvent(sessionId, {
+      messageId,
+      type: "command_finished",
+      command,
+      commandId: messageId,
+      tabName: bestMatch.title || bestMatch.id,
+      exitCode: -1,
+      outputDelta: block
+    });
+    return block;
+  }
   const allowed = await checkCommandPolicy(command, "run_command", context2);
   if (!allowed.allowed) {
     abortIfNeeded(context2.signal);
@@ -349304,7 +350075,7 @@ var manageWinrmConnectionSchema = external_exports.object({
   id: external_exports.string().optional().describe("ID for update/delete."),
   connection: winrmConnectionFieldsSchema.optional()
 });
-function emit(context2, input, output) {
+function emit2(context2, input, output) {
   context2.sendEvent(context2.sessionId, {
     messageId: context2.messageId,
     type: "tool_call",
@@ -349342,7 +350113,7 @@ async function manageWinrmConnection(args, context2) {
   const cm = context2.connectionManager;
   if (!cm) {
     const msg2 = "Connection management is not available in this runtime (no connection manager wired).";
-    emit(context2, args, msg2);
+    emit2(context2, args, msg2);
     return msg2;
   }
   const { action } = args;
@@ -349350,61 +350121,61 @@ async function manageWinrmConnection(args, context2) {
     const entries = cm.listWinrm();
     if (entries.length === 0) {
       const msg3 = 'No saved WinRM connections configured. Use action="create" to add one.';
-      emit(context2, args, msg3);
+      emit2(context2, args, msg3);
       return msg3;
     }
     const msg2 = `Saved WinRM connections (${entries.length}):
 ${entries.map(summarize2).join("\n")}`;
-    emit(context2, args, msg2);
+    emit2(context2, args, msg2);
     return msg2;
   }
   if (action === "create") {
     if (!args.connection) {
       const msg3 = "create requires a `connection` object with name, host, username, and password.";
-      emit(context2, args, msg3);
+      emit2(context2, args, msg3);
       return msg3;
     }
     if (cm.listWinrm().some((e) => e.name === args.connection.name)) {
       const msg3 = `A saved WinRM connection named "${args.connection.name}" already exists. Choose a unique name or use action="update".`;
-      emit(context2, args, msg3);
+      emit2(context2, args, msg3);
       return msg3;
     }
     const stored = cm.createWinrm(toEntry2(args.connection, randomId2()));
     const msg2 = `Created saved WinRM connection: ${summarize2(stored)}. Open a tab with open_terminal_tab using Name "${stored.name}", then run commands with exec_command (command/response mode).`;
-    emit(context2, args, msg2);
+    emit2(context2, args, msg2);
     return msg2;
   }
   if (action === "update") {
     if (!args.id || !args.connection) {
       const msg3 = "update requires an `id` and a `connection` object with the fields to change.";
-      emit(context2, args, msg3);
+      emit2(context2, args, msg3);
       return msg3;
     }
     const current = cm.listWinrm().find((e) => e.id === args.id);
     if (!current) {
       const msg3 = `No saved WinRM connection with id "${args.id}". Use action="list" to see valid ids.`;
-      emit(context2, args, msg3);
+      emit2(context2, args, msg3);
       return msg3;
     }
     const merged = { ...current, ...toEntry2({ ...current, ...args.connection }, args.id) };
     const stored = cm.updateWinrm(merged);
     const msg2 = `Updated saved WinRM connection: ${summarize2(stored)}.`;
-    emit(context2, args, msg2);
+    emit2(context2, args, msg2);
     return msg2;
   }
   if (action === "delete") {
     if (!args.id) {
       const msg3 = "delete requires an `id`.";
-      emit(context2, args, msg3);
+      emit2(context2, args, msg3);
       return msg3;
     }
     const removed = cm.deleteWinrm(args.id);
     const msg2 = removed ? `Deleted saved WinRM connection id="${args.id}".` : `No saved WinRM connection with id="${args.id}" (nothing deleted).`;
-    emit(context2, args, msg2);
+    emit2(context2, args, msg2);
     return msg2;
   }
   const msg = `Unknown action "${action}".`;
-  emit(context2, args, msg);
+  emit2(context2, args, msg);
   return msg;
 }
 
@@ -349426,7 +350197,7 @@ var manageSerialConnectionSchema = external_exports.object({
   id: external_exports.string().optional(),
   connection: serialConnectionFieldsSchema.optional()
 });
-function emit2(context2, input, output) {
+function emit3(context2, input, output) {
   context2.sendEvent(context2.sessionId, {
     messageId: context2.messageId,
     type: "tool_call",
@@ -349459,7 +350230,7 @@ async function manageSerialConnection(args, context2) {
   const cm = context2.connectionManager;
   if (!cm) {
     const msg2 = "Connection management is not available in this runtime (no connection manager wired).";
-    emit2(context2, args, msg2);
+    emit3(context2, args, msg2);
     return msg2;
   }
   const { action } = args;
@@ -349467,61 +350238,61 @@ async function manageSerialConnection(args, context2) {
     const entries = cm.listSerial();
     if (!entries.length) {
       const msg3 = 'No saved serial connections configured. Use action="create" to add one.';
-      emit2(context2, args, msg3);
+      emit3(context2, args, msg3);
       return msg3;
     }
     const msg2 = `Saved serial connections (${entries.length}):
 ${entries.map(summarize3).join("\n")}`;
-    emit2(context2, args, msg2);
+    emit3(context2, args, msg2);
     return msg2;
   }
   if (action === "create") {
     if (!args.connection) {
       const msg3 = "create requires a `connection` object with name and path.";
-      emit2(context2, args, msg3);
+      emit3(context2, args, msg3);
       return msg3;
     }
     if (cm.listSerial().some((e) => e.name === args.connection.name)) {
       const msg3 = `A saved serial connection named "${args.connection.name}" already exists. Choose a unique name or use action="update".`;
-      emit2(context2, args, msg3);
+      emit3(context2, args, msg3);
       return msg3;
     }
     const stored = cm.createSerial(toEntry3(args.connection, randomId3()));
     const msg2 = `Created saved serial connection: ${summarize3(stored)}. Open a tab with open_terminal_tab using Name "${stored.name}", then interact with write_stdin / read_terminal_tab.`;
-    emit2(context2, args, msg2);
+    emit3(context2, args, msg2);
     return msg2;
   }
   if (action === "update") {
     if (!args.id || !args.connection) {
       const msg3 = "update requires an `id` and a `connection` object with the fields to change.";
-      emit2(context2, args, msg3);
+      emit3(context2, args, msg3);
       return msg3;
     }
     const current = cm.listSerial().find((e) => e.id === args.id);
     if (!current) {
       const msg3 = `No saved serial connection with id "${args.id}". Use action="list" to see valid ids.`;
-      emit2(context2, args, msg3);
+      emit3(context2, args, msg3);
       return msg3;
     }
     const merged = { ...current, ...toEntry3({ ...current, ...args.connection }, args.id) };
     const stored = cm.updateSerial(merged);
     const msg2 = `Updated saved serial connection: ${summarize3(stored)}.`;
-    emit2(context2, args, msg2);
+    emit3(context2, args, msg2);
     return msg2;
   }
   if (action === "delete") {
     if (!args.id) {
       const msg3 = "delete requires an `id`.";
-      emit2(context2, args, msg3);
+      emit3(context2, args, msg3);
       return msg3;
     }
     const removed = cm.deleteSerial(args.id);
     const msg2 = removed ? `Deleted saved serial connection id="${args.id}".` : `No saved serial connection with id="${args.id}" (nothing deleted).`;
-    emit2(context2, args, msg2);
+    emit3(context2, args, msg2);
     return msg2;
   }
   const msg = `Unknown action "${action}".`;
-  emit2(context2, args, msg);
+  emit3(context2, args, msg);
   return msg;
 }
 
@@ -349542,7 +350313,7 @@ var searchSessionLogsSchema = external_exports.object({
   maxMatches: external_exports.number().int().min(1).max(500).optional().describe("Max matching lines to return (default 50)."),
   contextLines: external_exports.number().int().min(0).max(20).optional().describe("Lines of surrounding context per match (default 0).")
 });
-function emit3(context2, toolName, input, output) {
+function emit4(context2, toolName, input, output) {
   context2.sendEvent(context2.sessionId, {
     messageId: context2.messageId,
     type: "tool_call",
@@ -349555,32 +350326,32 @@ async function listSessionLogs(args, context2) {
   const logger = context2.sessionLogger;
   if (!logger) {
     const msg2 = "Session logging is not available in this runtime (no session logger wired; enable sessionLogging.enabled in settings).";
-    emit3(context2, "list_session_logs", args, msg2);
+    emit4(context2, "list_session_logs", args, msg2);
     return msg2;
   }
   const list = logger.list();
   if (!list.length) {
     const msg2 = "No recorded sessions yet. Sessions are recorded when sessionLogging is enabled and you open a terminal tab.";
-    emit3(context2, "list_session_logs", args, msg2);
+    emit4(context2, "list_session_logs", args, msg2);
     return msg2;
   }
   const body = list.map((l) => `- ${l.title} (sessionId=${l.sessionId}, type=${l.type}, started=${l.startedAt}${l.endedAt ? `, ended=${l.endedAt}` : ""}, ${l.bytes} bytes)`).join("\n");
   const msg = `Recorded sessions (${list.length}):
 ${body}`;
-  emit3(context2, "list_session_logs", args, msg);
+  emit4(context2, "list_session_logs", args, msg);
   return msg;
 }
 async function readSessionLog(args, context2) {
   const logger = context2.sessionLogger;
   if (!logger) {
     const msg2 = "Session logging is not available in this runtime (no session logger wired; enable sessionLogging.enabled in settings).";
-    emit3(context2, "read_session_log", args, msg2);
+    emit4(context2, "read_session_log", args, msg2);
     return msg2;
   }
   const content = logger.read(args.sessionId);
   if (!content) {
     const msg2 = `No recorded log for sessionId="${args.sessionId}". Use list_session_logs to see valid ids.`;
-    emit3(context2, "read_session_log", args, msg2);
+    emit4(context2, "read_session_log", args, msg2);
     return msg2;
   }
   const truncated = content.length > 8e3 ? `${content.slice(0, 4e3)}
@@ -349590,14 +350361,14 @@ ${content.slice(-4e3)}` : content;
 <session_log>
 ${truncated}
 </session_log>`;
-  emit3(context2, "read_session_log", args, msg);
+  emit4(context2, "read_session_log", args, msg);
   return msg;
 }
 async function searchSessionLogs(args, context2) {
   const logger = context2.sessionLogger;
   if (!logger || typeof logger.search !== "function") {
     const msg2 = "Session logging is not available in this runtime (no session logger wired; enable sessionLogging.enabled in settings).";
-    emit3(context2, "search_session_logs", args, msg2);
+    emit4(context2, "search_session_logs", args, msg2);
     return msg2;
   }
   const result = logger.search(args.query, {
@@ -349612,7 +350383,7 @@ async function searchSessionLogs(args, context2) {
   });
   if (result.totalMatches === 0) {
     const msg2 = `No matches for "${args.query}" across ${result.sessionsSearched} recorded session(s).`;
-    emit3(context2, "search_session_logs", args, msg2);
+    emit4(context2, "search_session_logs", args, msg2);
     return msg2;
   }
   const lines = result.matches.map((m2) => {
@@ -349626,7 +350397,7 @@ ${ctx}`;
   });
   const msg = `Found ${result.totalMatches} match(es) for "${args.query}" across ${result.sessionsSearched} session(s):
 ${lines.join("\n")}`;
-  emit3(context2, "search_session_logs", args, msg);
+  emit4(context2, "search_session_logs", args, msg);
   return msg;
 }
 
@@ -349640,7 +350411,7 @@ var getRunLedgerSchema = external_exports.object({
   limit: external_exports.number().int().min(1).max(200).optional().describe("Max runs for 'list' (default 20)."),
   sinceDays: external_exports.number().min(0).max(365).optional().describe("Optional: 'summary' only counts runs started within the last N days (default: all time).")
 });
-function emit4(context2, toolName, input, output) {
+function emit5(context2, toolName, input, output) {
   context2.sendEvent(context2.sessionId, {
     messageId: context2.messageId,
     type: "tool_call",
@@ -349664,19 +350435,19 @@ async function getRunLedger(args, context2) {
   const ledger = context2.agentRunLedger;
   if (!ledger) {
     const msg2 = "Run ledger is not available in this runtime (no agent run ledger wired).";
-    emit4(context2, "get_run_ledger", args, msg2);
+    emit5(context2, "get_run_ledger", args, msg2);
     return msg2;
   }
   if (args.action === "list") {
     const runs = ledger.listRuns({ limit: args.limit ?? 20, sessionId: args.sessionId, status: args.status });
     if (!runs.length) {
       const msg3 = "No agent runs recorded yet in the ledger.";
-      emit4(context2, "get_run_ledger", args, msg3);
+      emit5(context2, "get_run_ledger", args, msg3);
       return msg3;
     }
     const msg2 = `Agent run ledger \u2014 ${runs.length} most recent run(s):
 ${runs.map(fmtRun).join("\n")}`;
-    emit4(context2, "get_run_ledger", args, msg2);
+    emit5(context2, "get_run_ledger", args, msg2);
     return msg2;
   }
   if (args.action === "summary") {
@@ -349691,18 +350462,18 @@ ${runs.map(fmtRun).join("\n")}`;
       `  by model:`,
       models
     ].join("\n");
-    emit4(context2, "get_run_ledger", args, msg2);
+    emit5(context2, "get_run_ledger", args, msg2);
     return msg2;
   }
   if (!args.runId) {
     const msg2 = "runId is required for action='get'. Use action='list' to find run ids.";
-    emit4(context2, "get_run_ledger", args, msg2);
+    emit5(context2, "get_run_ledger", args, msg2);
     return msg2;
   }
   const got = ledger.getRun(args.runId);
   if (!got) {
     const msg2 = `No run with id "${args.runId}" in the ledger.`;
-    emit4(context2, "get_run_ledger", args, msg2);
+    emit5(context2, "get_run_ledger", args, msg2);
     return msg2;
   }
   const usage = got.usage.length ? got.usage.map((u) => `  - ${new Date(u.at).toISOString()} model=${u.model ?? "?"} ${u.promptTokens} in / ${u.completionTokens} out${u.totalTokens ? ` (context=${u.totalTokens})` : ""}`).join("\n") : "  (no usage events)";
@@ -349710,7 +350481,7 @@ ${runs.map(fmtRun).join("\n")}`;
 ${fmtRun(got.run)}
   usage events:
 ${usage}`;
-  emit4(context2, "get_run_ledger", args, msg);
+  emit5(context2, "get_run_ledger", args, msg);
   return msg;
 }
 
@@ -350562,7 +351333,7 @@ function importPuttyReg(content, opts) {
 }
 
 // ../../packages/backend/src/services/AgentHelper/tools/automation_tools.ts
-function emit5(context2, _toolName, input, output) {
+function emit6(context2, _toolName, input, output) {
   context2.sendEvent(context2.sessionId, {
     messageId: context2.messageId,
     type: "tool_call",
@@ -350589,7 +351360,7 @@ async function manageDeviceMemory(args, context2) {
   const m2 = context2.automationManager;
   if (!m2) {
     const msg2 = noStore();
-    emit5(context2, "manage_device_memory", args, msg2);
+    emit6(context2, "manage_device_memory", args, msg2);
     return msg2;
   }
   const { action } = args;
@@ -350597,25 +351368,25 @@ async function manageDeviceMemory(args, context2) {
     const all = m2.listDeviceMemory();
     if (!all.length) {
       const msg3 = "No device memory entries.";
-      emit5(context2, "manage_device_memory", args, msg3);
+      emit6(context2, "manage_device_memory", args, msg3);
       return msg3;
     }
     const body = all.map((e) => `${e.host} (role=${e.role || "unspecified"}, ${e.incidents.length} incident(s))`).join("\n");
     const msg2 = `Device memory (${all.length}):
 ${body}`;
-    emit5(context2, "manage_device_memory", args, msg2);
+    emit6(context2, "manage_device_memory", args, msg2);
     return msg2;
   }
   if (!args.host) {
     const msg2 = `action="${action}" requires a host.`;
-    emit5(context2, "manage_device_memory", args, msg2);
+    emit6(context2, "manage_device_memory", args, msg2);
     return msg2;
   }
   if (action === "get") {
     const mem = m2.getDeviceMemory(args.host);
     if (!mem) {
       const msg3 = `No device memory for host "${args.host}".`;
-      emit5(context2, "manage_device_memory", args, msg3);
+      emit6(context2, "manage_device_memory", args, msg3);
       return msg3;
     }
     const msg2 = `Device memory for ${args.host}:
@@ -350623,18 +351394,18 @@ role: ${mem.role || "unspecified"}
 standing instructions: ${mem.standingInstructions || "(none)"}
 incidents (${mem.incidents.length}):
 ${mem.incidents.map((i) => `- [${i.at}] ${i.summary}${i.ticketId ? ` (ticket: ${i.ticketId})` : ""}${i.resolution ? ` \u2014 ${i.resolution}` : ""}`).join("\n")}`;
-    emit5(context2, "manage_device_memory", args, msg2);
+    emit6(context2, "manage_device_memory", args, msg2);
     return msg2;
   }
   if (action === "add_incident") {
     if (!args.incident) {
       const msg3 = "add_incident requires an `incident` object.";
-      emit5(context2, "manage_device_memory", args, msg3);
+      emit6(context2, "manage_device_memory", args, msg3);
       return msg3;
     }
     const inc = m2.addIncident(args.host, args.incident);
     const msg2 = `Recorded incident for ${args.host} at ${inc.at}: ${inc.summary}.`;
-    emit5(context2, "manage_device_memory", args, msg2);
+    emit6(context2, "manage_device_memory", args, msg2);
     return msg2;
   }
   if (action === "upsert") {
@@ -350645,17 +351416,17 @@ ${mem.incidents.map((i) => `- [${i.at}] ${i.summary}${i.ticketId ? ` (ticket: ${
       incidents: []
     });
     const msg2 = `Saved device memory for ${mem.host} (role=${mem.role || "unspecified"}).`;
-    emit5(context2, "manage_device_memory", args, msg2);
+    emit6(context2, "manage_device_memory", args, msg2);
     return msg2;
   }
   if (action === "delete") {
     const removed = m2.deleteDeviceMemory(args.host);
     const msg2 = removed ? `Deleted device memory for ${args.host}.` : `No device memory for ${args.host}.`;
-    emit5(context2, "manage_device_memory", args, msg2);
+    emit6(context2, "manage_device_memory", args, msg2);
     return msg2;
   }
   const msg = `Unknown action "${action}".`;
-  emit5(context2, "manage_device_memory", args, msg);
+  emit6(context2, "manage_device_memory", args, msg);
   return msg;
 }
 var manageScriptSchema = external_exports.object({
@@ -350671,7 +351442,7 @@ async function manageScript(args, context2) {
   const m2 = context2.automationManager;
   if (!m2) {
     const msg2 = noStore();
-    emit5(context2, "manage_script", args, msg2);
+    emit6(context2, "manage_script", args, msg2);
     return msg2;
   }
   const { action } = args;
@@ -350679,56 +351450,56 @@ async function manageScript(args, context2) {
     const all = m2.listScripts();
     if (!all.length) {
       const msg3 = "No saved scripts.";
-      emit5(context2, "manage_script", args, msg3);
+      emit6(context2, "manage_script", args, msg3);
       return msg3;
     }
     const body = all.map((s) => `- ${s.name} (id=${s.id}): ${s.command.split("\n")[0].slice(0, 60)}${s.command.length > 60 ? "\u2026" : ""}`).join("\n");
     const msg2 = `Saved scripts (${all.length}):
 ${body}`;
-    emit5(context2, "manage_script", args, msg2);
+    emit6(context2, "manage_script", args, msg2);
     return msg2;
   }
   if (action === "create") {
     if (!args.name || !args.command) {
       const msg3 = "create requires name + command.";
-      emit5(context2, "manage_script", args, msg3);
+      emit6(context2, "manage_script", args, msg3);
       return msg3;
     }
     const s = m2.createScript({ name: args.name, command: args.command, description: args.description, targets: args.targets, tags: args.tags });
     const msg2 = `Created script "${s.name}" (id=${s.id}). Run it on open tabs with run_fleet_command or exec_command using its command body.`;
-    emit5(context2, "manage_script", args, msg2);
+    emit6(context2, "manage_script", args, msg2);
     return msg2;
   }
   if (action === "update") {
     if (!args.id) {
       const msg3 = "update requires id.";
-      emit5(context2, "manage_script", args, msg3);
+      emit6(context2, "manage_script", args, msg3);
       return msg3;
     }
     const existing = m2.listScripts().find((s2) => s2.id === args.id);
     if (!existing) {
       const msg3 = `No script with id="${args.id}".`;
-      emit5(context2, "manage_script", args, msg3);
+      emit6(context2, "manage_script", args, msg3);
       return msg3;
     }
     const s = m2.updateScript({ ...existing, name: args.name ?? existing.name, command: args.command ?? existing.command, description: args.description ?? existing.description, targets: args.targets ?? existing.targets, tags: args.tags ?? existing.tags });
     const msg2 = `Updated script "${s.name}".`;
-    emit5(context2, "manage_script", args, msg2);
+    emit6(context2, "manage_script", args, msg2);
     return msg2;
   }
   if (action === "delete") {
     if (!args.id) {
       const msg3 = "delete requires id.";
-      emit5(context2, "manage_script", args, msg3);
+      emit6(context2, "manage_script", args, msg3);
       return msg3;
     }
     const removed = m2.deleteScript(args.id);
     const msg2 = removed ? `Deleted script ${args.id}.` : `No script ${args.id}.`;
-    emit5(context2, "manage_script", args, msg2);
+    emit6(context2, "manage_script", args, msg2);
     return msg2;
   }
   const msg = `Unknown action "${action}".`;
-  emit5(context2, "manage_script", args, msg);
+  emit6(context2, "manage_script", args, msg);
   return msg;
 }
 var manageGroupSchema = external_exports.object({
@@ -350741,7 +351512,7 @@ async function manageGroup(args, context2) {
   const m2 = context2.automationManager;
   if (!m2) {
     const msg2 = noStore();
-    emit5(context2, "manage_group", args, msg2);
+    emit6(context2, "manage_group", args, msg2);
     return msg2;
   }
   const { action } = args;
@@ -350749,49 +351520,49 @@ async function manageGroup(args, context2) {
     const all = m2.listGroups();
     if (!all.length) {
       const msg3 = "No groups.";
-      emit5(context2, "manage_group", args, msg3);
+      emit6(context2, "manage_group", args, msg3);
       return msg3;
     }
     const msg2 = `Groups (${all.length}):
 ${all.map((g) => `- ${g.name} (id=${g.id}${g.parentId ? `, parent=${g.parentId}` : ""})`).join("\n")}`;
-    emit5(context2, "manage_group", args, msg2);
+    emit6(context2, "manage_group", args, msg2);
     return msg2;
   }
   if (action === "create") {
     if (!args.name) {
       const msg3 = "create requires name.";
-      emit5(context2, "manage_group", args, msg3);
+      emit6(context2, "manage_group", args, msg3);
       return msg3;
     }
     const g = m2.createGroup(args.name, args.parentId ?? null);
     const msg2 = `Created group "${g.name}" (id=${g.id}). Assign a connection by setting its groupId via manage_ssh_connection.update or the Connections panel.`;
-    emit5(context2, "manage_group", args, msg2);
+    emit6(context2, "manage_group", args, msg2);
     return msg2;
   }
   if (action === "update") {
     if (!args.id) {
       const msg3 = "update requires id.";
-      emit5(context2, "manage_group", args, msg3);
+      emit6(context2, "manage_group", args, msg3);
       return msg3;
     }
     const g = m2.updateGroup({ id: args.id, name: args.name ?? "", parentId: args.parentId });
     const msg2 = `Updated group "${g.name}".`;
-    emit5(context2, "manage_group", args, msg2);
+    emit6(context2, "manage_group", args, msg2);
     return msg2;
   }
   if (action === "delete") {
     if (!args.id) {
       const msg3 = "delete requires id.";
-      emit5(context2, "manage_group", args, msg3);
+      emit6(context2, "manage_group", args, msg3);
       return msg3;
     }
     const removed = m2.deleteGroup(args.id);
     const msg2 = removed ? `Deleted group ${args.id} (children reparented to root).` : `No group ${args.id}.`;
-    emit5(context2, "manage_group", args, msg2);
+    emit6(context2, "manage_group", args, msg2);
     return msg2;
   }
   const msg = `Unknown action "${action}".`;
-  emit5(context2, "manage_group", args, msg);
+  emit6(context2, "manage_group", args, msg);
   return msg;
 }
 var manageScheduledTaskSchema = external_exports.object({
@@ -350821,7 +351592,7 @@ async function manageScheduledTask(args, context2) {
   const m2 = context2.automationManager;
   if (!m2) {
     const msg2 = noStore();
-    emit5(context2, "manage_scheduled_task", args, msg2);
+    emit6(context2, "manage_scheduled_task", args, msg2);
     return msg2;
   }
   const { action } = args;
@@ -350829,30 +351600,30 @@ async function manageScheduledTask(args, context2) {
     const all = m2.listScheduledTasks();
     if (!all.length) {
       const msg3 = "No scheduled tasks.";
-      emit5(context2, "manage_scheduled_task", args, msg3);
+      emit6(context2, "manage_scheduled_task", args, msg3);
       return msg3;
     }
     const msg2 = `Scheduled tasks (${all.length}):
 ${all.map((t) => `- ${t.name} (id=${t.id}, cron="${t.cron}", enabled=${t.enabled}${t.lastRunAt ? `, lastRun=${t.lastRunAt}` : ""})`).join("\n")}`;
-    emit5(context2, "manage_scheduled_task", args, msg2);
+    emit6(context2, "manage_scheduled_task", args, msg2);
     return msg2;
   }
   if (action === "create") {
     if (!args.name || !args.cron) {
       const msg3 = "create requires name + cron.";
-      emit5(context2, "manage_scheduled_task", args, msg3);
+      emit6(context2, "manage_scheduled_task", args, msg3);
       return msg3;
     }
     if (!args.scriptId && !args.command && !args.playbookId) {
       const msg3 = "create requires scriptId, command, or playbookId.";
-      emit5(context2, "manage_scheduled_task", args, msg3);
+      emit6(context2, "manage_scheduled_task", args, msg3);
       return msg3;
     }
     const { validateCron: validateCron2 } = await Promise.resolve().then(() => (init_schedulerService(), schedulerService_exports));
     const v = validateCron2(args.cron);
     if (!v.ok) {
       const msg3 = `Invalid cron "${args.cron}": ${v.reason}`;
-      emit5(context2, "manage_scheduled_task", args, msg3);
+      emit6(context2, "manage_scheduled_task", args, msg3);
       return msg3;
     }
     const t = m2.createScheduledTask({
@@ -350876,47 +351647,47 @@ ${all.map((t) => `- ${t.name} (id=${t.id}, cron="${t.cron}", enabled=${t.enabled
       alertAfterFailures: args.alertAfterFailures
     });
     const msg2 = `Created scheduled task "${t.name}" (id=${t.id}, cron="${t.cron}"${args.timezone ? ` @ ${args.timezone}` : ""}). It will be evaluated by the local scheduler.`;
-    emit5(context2, "manage_scheduled_task", args, msg2);
+    emit6(context2, "manage_scheduled_task", args, msg2);
     return msg2;
   }
   if (action === "update") {
     if (!args.id) {
       const msg3 = "update requires id.";
-      emit5(context2, "manage_scheduled_task", args, msg3);
+      emit6(context2, "manage_scheduled_task", args, msg3);
       return msg3;
     }
     const existing = m2.listScheduledTasks().find((t2) => t2.id === args.id);
     if (!existing) {
       const msg3 = `No task ${args.id}.`;
-      emit5(context2, "manage_scheduled_task", args, msg3);
+      emit6(context2, "manage_scheduled_task", args, msg3);
       return msg3;
     }
     const t = m2.updateScheduledTask({ ...existing, name: args.name ?? existing.name, cron: args.cron ?? existing.cron, scriptId: args.scriptId ?? existing.scriptId, command: args.command ?? existing.command, enabled: args.enabled ?? existing.enabled, groupId: args.groupId, tags: args.tags, targets: args.targets });
     const msg2 = `Updated task "${t.name}".`;
-    emit5(context2, "manage_scheduled_task", args, msg2);
+    emit6(context2, "manage_scheduled_task", args, msg2);
     return msg2;
   }
   if (action === "delete") {
     if (!args.id) {
       const msg3 = "delete requires id.";
-      emit5(context2, "manage_scheduled_task", args, msg3);
+      emit6(context2, "manage_scheduled_task", args, msg3);
       return msg3;
     }
     const removed = m2.deleteScheduledTask(args.id);
     const msg2 = removed ? `Deleted task ${args.id}.` : `No task ${args.id}.`;
-    emit5(context2, "manage_scheduled_task", args, msg2);
+    emit6(context2, "manage_scheduled_task", args, msg2);
     return msg2;
   }
   if (action === "validate") {
     if (!args.cron) {
       const msg3 = "validate requires cron.";
-      emit5(context2, "manage_scheduled_task", args, msg3);
+      emit6(context2, "manage_scheduled_task", args, msg3);
       return msg3;
     }
     const { validateCron: validateCron2 } = await Promise.resolve().then(() => (init_schedulerService(), schedulerService_exports));
     const v = validateCron2(args.cron);
     const msg2 = v.ok ? `Cron "${args.cron}" is valid.` : `Invalid cron "${args.cron}": ${v.reason}`;
-    emit5(context2, "manage_scheduled_task", args, msg2);
+    emit6(context2, "manage_scheduled_task", args, msg2);
     return msg2;
   }
   if (action === "drift") {
@@ -350925,20 +351696,20 @@ ${all.map((t) => `- ${t.name} (id=${t.id}, cron="${t.cron}", enabled=${t.enabled
     const flagged = drift.filter((d) => d.drifted);
     const msg2 = flagged.length === 0 ? `No drift detected across ${drift.length} enabled task(s).` : `Drifted task(s) (${flagged.length}):
 ${flagged.map((d) => `- ${d.taskName} (id=${d.taskId}): ${Number.isFinite(d.minutesSinceLastRun) ? `${Math.round(d.minutesSinceLastRun)} min since last run` : "never ran"} vs expected \u2264${d.expectedIntervalMinutes} min`).join("\n")}`;
-    emit5(context2, "manage_scheduled_task", args, msg2);
+    emit6(context2, "manage_scheduled_task", args, msg2);
     return msg2;
   }
   if (action === "history") {
     const sched = context2.scheduledTaskHistory;
     if (!sched) {
       const msg3 = "Run history is not available in this runtime (headless daemon exposes it via the gateway).";
-      emit5(context2, "manage_scheduled_task", args, msg3);
+      emit6(context2, "manage_scheduled_task", args, msg3);
       return msg3;
     }
     const tasks = args.id ? m2.listScheduledTasks().filter((t) => t.id === args.id) : m2.listScheduledTasks();
     if (tasks.length === 0) {
       const msg3 = args.id ? `No task ${args.id}.` : "No scheduled tasks.";
-      emit5(context2, "manage_scheduled_task", args, msg3);
+      emit6(context2, "manage_scheduled_task", args, msg3);
       return msg3;
     }
     const lines = tasks.map((t) => {
@@ -350951,34 +351722,34 @@ ${flagged.map((d) => `- ${d.taskName} (id=${d.taskId}): ${Number.isFinite(d.minu
     });
     const msg2 = `Scheduled task history:
 ${lines.join("\n")}`;
-    emit5(context2, "manage_scheduled_task", args, msg2);
+    emit6(context2, "manage_scheduled_task", args, msg2);
     return msg2;
   }
   if (action === "runNow") {
     if (!args.id) {
       const msg3 = "runNow requires id.";
-      emit5(context2, "manage_scheduled_task", args, msg3);
+      emit6(context2, "manage_scheduled_task", args, msg3);
       return msg3;
     }
     const task2 = m2.listScheduledTasks().find((t) => t.id === args.id);
     if (!task2) {
       const msg3 = `No task ${args.id}.`;
-      emit5(context2, "manage_scheduled_task", args, msg3);
+      emit6(context2, "manage_scheduled_task", args, msg3);
       return msg3;
     }
     const sched = context2.scheduledTaskRunner;
     if (!sched) {
       const msg3 = "Run-now is not available in this runtime.";
-      emit5(context2, "manage_scheduled_task", args, msg3);
+      emit6(context2, "manage_scheduled_task", args, msg3);
       return msg3;
     }
     const r = await sched(task2);
     const msg2 = r.ran ? `Task "${task2.name}" executed now.` : `Task "${task2.name}" not run: ${r.reason}.`;
-    emit5(context2, "manage_scheduled_task", args, msg2);
+    emit6(context2, "manage_scheduled_task", args, msg2);
     return msg2;
   }
   const msg = `Unknown action "${action}".`;
-  emit5(context2, "manage_scheduled_task", args, msg);
+  emit6(context2, "manage_scheduled_task", args, msg);
   return msg;
 }
 var manageTemplateSchema = external_exports.object({
@@ -350994,7 +351765,7 @@ async function manageTemplate(args, context2) {
   const m2 = context2.automationManager;
   if (!m2) {
     const msg2 = noStore();
-    emit5(context2, "manage_template", args, msg2);
+    emit6(context2, "manage_template", args, msg2);
     return msg2;
   }
   const { action } = args;
@@ -351002,57 +351773,57 @@ async function manageTemplate(args, context2) {
     const all = m2.listTemplates();
     if (!all.length) {
       const msg3 = "No templates.";
-      emit5(context2, "manage_template", args, msg3);
+      emit6(context2, "manage_template", args, msg3);
       return msg3;
     }
     const msg2 = `Templates (${all.length}):
 ${all.map((t) => `- ${t.name} (id=${t.id}, ${t.versions.length} version(s))`).join("\n")}`;
-    emit5(context2, "manage_template", args, msg2);
+    emit6(context2, "manage_template", args, msg2);
     return msg2;
   }
   if (action === "create") {
     if (!args.name || !args.body) {
       const msg3 = "create requires name + body.";
-      emit5(context2, "manage_template", args, msg3);
+      emit6(context2, "manage_template", args, msg3);
       return msg3;
     }
     const t = m2.createTemplate({ name: args.name, body: args.body, variables: args.variables ?? [] });
     const msg2 = `Created template "${t.name}" (id=${t.id}). Use action="render" to preview, action="version" to save a rendered version.`;
-    emit5(context2, "manage_template", args, msg2);
+    emit6(context2, "manage_template", args, msg2);
     return msg2;
   }
   if (action === "update") {
     if (!args.id) {
       const msg3 = "update requires id.";
-      emit5(context2, "manage_template", args, msg3);
+      emit6(context2, "manage_template", args, msg3);
       return msg3;
     }
     const t = m2.updateTemplate({ id: args.id, name: args.name, body: args.body, variables: args.variables });
     const msg2 = `Updated template "${t.name}".`;
-    emit5(context2, "manage_template", args, msg2);
+    emit6(context2, "manage_template", args, msg2);
     return msg2;
   }
   if (action === "delete") {
     if (!args.id) {
       const msg3 = "delete requires id.";
-      emit5(context2, "manage_template", args, msg3);
+      emit6(context2, "manage_template", args, msg3);
       return msg3;
     }
     const removed = m2.deleteTemplate(args.id);
     const msg2 = removed ? `Deleted template ${args.id}.` : `No template ${args.id}.`;
-    emit5(context2, "manage_template", args, msg2);
+    emit6(context2, "manage_template", args, msg2);
     return msg2;
   }
   if (action === "render") {
     if (!args.id) {
       const msg3 = "render requires id.";
-      emit5(context2, "manage_template", args, msg3);
+      emit6(context2, "manage_template", args, msg3);
       return msg3;
     }
     const t = m2.listTemplates().find((x) => x.id === args.id);
     if (!t) {
       const msg3 = `No template ${args.id}.`;
-      emit5(context2, "manage_template", args, msg3);
+      emit6(context2, "manage_template", args, msg3);
       return msg3;
     }
     const defaults2 = {};
@@ -351063,19 +351834,19 @@ ${all.map((t) => `- ${t.name} (id=${t.id}, ${t.versions.length} version(s))`).jo
 <rendered>
 ${rendered}
 </rendered>`;
-    emit5(context2, "manage_template", args, msg2);
+    emit6(context2, "manage_template", args, msg2);
     return msg2;
   }
   if (action === "version") {
     if (!args.id) {
       const msg3 = "version requires id.";
-      emit5(context2, "manage_template", args, msg3);
+      emit6(context2, "manage_template", args, msg3);
       return msg3;
     }
     const t = m2.listTemplates().find((x) => x.id === args.id);
     if (!t) {
       const msg3 = `No template ${args.id}.`;
-      emit5(context2, "manage_template", args, msg3);
+      emit6(context2, "manage_template", args, msg3);
       return msg3;
     }
     const defaults2 = {};
@@ -351089,11 +351860,11 @@ ${rendered}
 Diff vs previous version:
 ${diffStrings(prev.rendered, rendered)}` : "\n\n(first version)";
     const msg2 = `Saved version ${t.versions.length + 1} of "${t.name}" at ${v.at}.${diff}`;
-    emit5(context2, "manage_template", args, msg2);
+    emit6(context2, "manage_template", args, msg2);
     return msg2;
   }
   const msg = `Unknown action "${action}".`;
-  emit5(context2, "manage_template", args, msg);
+  emit6(context2, "manage_template", args, msg);
   return msg;
 }
 var importPuttySchema = external_exports.object({
@@ -351103,13 +351874,13 @@ async function importPutty(args, context2) {
   const cm = context2.connectionManager;
   if (!cm) {
     const msg2 = "Connection management is not available in this runtime.";
-    emit5(context2, "import_putty", args, msg2);
+    emit6(context2, "import_putty", args, msg2);
     return msg2;
   }
   const entries = importPuttyReg(args.regContent);
   if (!entries.length) {
     const msg2 = "No SSH sessions found in the provided PuTTY export (only ssh-protocol sessions with a HostName are imported).";
-    emit5(context2, "import_putty", args, msg2);
+    emit6(context2, "import_putty", args, msg2);
     return msg2;
   }
   let created = 0;
@@ -351120,7 +351891,7 @@ async function importPutty(args, context2) {
     created++;
   }
   const msg = `Imported ${created} SSH connection(s) from PuTTY${entries.length !== created ? ` (${entries.length - created} skipped as duplicates or non-ssh)` : ""}. Imported: ${entries.map((e) => e.name).join(", ")}. Open them with open_terminal_tab by Name.`;
-  emit5(context2, "import_putty", args, msg);
+  emit6(context2, "import_putty", args, msg);
   return msg;
 }
 
@@ -351131,7 +351902,7 @@ init_playbook_tools();
 init_zod();
 init_playbookRunner();
 init_scheduledTaskRunner();
-function emit7(context2, toolName, input, output) {
+function emit8(context2, toolName, input, output) {
   context2.sendEvent(context2.sessionId, {
     messageId: context2.messageId,
     type: "tool_call",
@@ -351171,12 +351942,12 @@ async function manageChange(args, context2) {
   const ledger = context2.changeLedger;
   if (!m2) {
     const msg2 = "Automation store is not available in this runtime.";
-    emit7(context2, "manage_change", args, msg2);
+    emit8(context2, "manage_change", args, msg2);
     return msg2;
   }
   if (!ledger) {
     const msg2 = "Change ledger is not available in this runtime.";
-    emit7(context2, "manage_change", args, msg2);
+    emit8(context2, "manage_change", args, msg2);
     return msg2;
   }
   const { action } = args;
@@ -351184,13 +351955,13 @@ async function manageChange(args, context2) {
     const key = args.playbookId ?? args.name;
     if (!key) {
       const msg3 = "plan requires playbookId or name.";
-      emit7(context2, "manage_change", args, msg3);
+      emit8(context2, "manage_change", args, msg3);
       return msg3;
     }
     const playbook = m2.getPlaybook(key);
     if (!playbook) {
       const msg3 = `No playbook "${key}".`;
-      emit7(context2, "manage_change", args, msg3);
+      emit8(context2, "manage_change", args, msg3);
       return msg3;
     }
     const settings = settingsFromContext(context2);
@@ -351210,58 +351981,58 @@ Targets (${targets.length || 1}): ${targets.length ? targets.map((t) => t.name).
 Steps:
 ${steps}
 Next: manage_change action=approve changeId=${changeId}, then action=run.`;
-    emit7(context2, "manage_change", args, msg2);
+    emit8(context2, "manage_change", args, msg2);
     return msg2;
   }
   if (action === "approve") {
     if (!args.changeId) {
       const msg3 = "approve requires changeId.";
-      emit7(context2, "manage_change", args, msg3);
+      emit8(context2, "manage_change", args, msg3);
       return msg3;
     }
     const existing = ledger.getChange(args.changeId);
     if (!existing) {
       const msg3 = `No change "${args.changeId}".`;
-      emit7(context2, "manage_change", args, msg3);
+      emit8(context2, "manage_change", args, msg3);
       return msg3;
     }
     if (existing.change.status !== "planned") {
       const msg3 = `Change ${args.changeId} is ${existing.change.status} \u2014 only planned changes can be approved.`;
-      emit7(context2, "manage_change", args, msg3);
+      emit8(context2, "manage_change", args, msg3);
       return msg3;
     }
     ledger.approveChange(args.changeId, args.approvedBy);
     const msg2 = `Change ${args.changeId} approved${args.approvedBy ? ` by ${args.approvedBy}` : ""}. Execute with manage_change action=run changeId=${args.changeId}.`;
-    emit7(context2, "manage_change", args, msg2);
+    emit8(context2, "manage_change", args, msg2);
     return msg2;
   }
   if (action === "run") {
     if (!args.changeId) {
       const msg3 = "run requires changeId.";
-      emit7(context2, "manage_change", args, msg3);
+      emit8(context2, "manage_change", args, msg3);
       return msg3;
     }
     const existing = ledger.getChange(args.changeId);
     if (!existing) {
       const msg3 = `No change "${args.changeId}". Plan one first with manage_change action=plan.`;
-      emit7(context2, "manage_change", args, msg3);
+      emit8(context2, "manage_change", args, msg3);
       return msg3;
     }
     if (existing.change.status !== "approved") {
       const msg3 = `Change ${args.changeId} is ${existing.change.status} \u2014 it must be approved before execution (manage_change action=approve).`;
-      emit7(context2, "manage_change", args, msg3);
+      emit8(context2, "manage_change", args, msg3);
       return msg3;
     }
     const playbook = m2.getPlaybook(existing.change.playbookId);
     if (!playbook) {
       ledger.finishChange(args.changeId, "failed", "playbook no longer exists");
       const msg3 = `Playbook ${existing.change.playbookId} no longer exists; change marked failed.`;
-      emit7(context2, "manage_change", args, msg3);
+      emit8(context2, "manage_change", args, msg3);
       return msg3;
     }
     if (!ledger.markExecuting(args.changeId)) {
       const msg3 = `Change ${args.changeId} could not transition to executing (status=${existing.change.status}).`;
-      emit7(context2, "manage_change", args, msg3);
+      emit8(context2, "manage_change", args, msg3);
       return msg3;
     }
     const settings = settingsFromContext(context2);
@@ -351283,7 +352054,7 @@ Next: manage_change action=approve changeId=${changeId}, then action=run.`;
       const errMsg = error40 instanceof Error ? error40.message : String(error40);
       ledger.finishChange(args.changeId, "failed", errMsg);
       const msg3 = `Change ${args.changeId} failed to execute: ${errMsg}`;
-      emit7(context2, "manage_change", args, msg3);
+      emit8(context2, "manage_change", args, msg3);
       return msg3;
     }
     const finalStatus = deriveFinalStatus(record2);
@@ -351301,19 +352072,19 @@ Next: manage_change action=approve changeId=${changeId}, then action=run.`;
     }
     const msg2 = `Change ${args.changeId} finished with status=${finalStatus} (runId=${record2.runId}).
 ${lines.join("\n")}`;
-    emit7(context2, "manage_change", args, msg2);
+    emit8(context2, "manage_change", args, msg2);
     return msg2;
   }
   if (action === "status") {
     if (!args.changeId) {
       const msg3 = "status requires changeId.";
-      emit7(context2, "manage_change", args, msg3);
+      emit8(context2, "manage_change", args, msg3);
       return msg3;
     }
     const got = ledger.getChange(args.changeId);
     if (!got) {
       const msg3 = `No change "${args.changeId}".`;
-      emit7(context2, "manage_change", args, msg3);
+      emit8(context2, "manage_change", args, msg3);
       return msg3;
     }
     const { change, steps } = got;
@@ -351332,14 +352103,14 @@ ${meta}
 Targets: ${change.targetsSnapshot ?? "n/a"}
 Events:
 ${body}`;
-    emit7(context2, "manage_change", args, msg2);
+    emit8(context2, "manage_change", args, msg2);
     return msg2;
   }
   if (action === "list") {
     const rows = ledger.listChanges({ status: args.status, limit: args.limit ?? 20 });
     if (!rows.length) {
       const msg3 = "No changes recorded yet. Plan one with manage_change action=plan.";
-      emit7(context2, "manage_change", args, msg3);
+      emit8(context2, "manage_change", args, msg3);
       return msg3;
     }
     const body = rows.map(
@@ -351347,18 +352118,18 @@ ${body}`;
     ).join("\n");
     const msg2 = `Changes (${rows.length}):
 ${body}`;
-    emit7(context2, "manage_change", args, msg2);
+    emit8(context2, "manage_change", args, msg2);
     return msg2;
   }
   const msg = `Unknown action "${action}".`;
-  emit7(context2, "manage_change", args, msg);
+  emit8(context2, "manage_change", args, msg);
   return msg;
 }
 
 // ../../packages/backend/src/services/AgentHelper/tools/trigger_tools.ts
 init_zod();
 var import_crypto6 = require("crypto");
-function emit8(context2, name, input, output) {
+function emit9(context2, name, input, output) {
   context2.sendEvent(context2.sessionId, {
     messageId: context2.messageId,
     type: "tool_call",
@@ -351387,7 +352158,7 @@ async function manageTrigger(args, context2) {
   const m2 = context2.automationManager;
   if (!m2 || typeof m2.listTriggers !== "function") {
     const msg2 = "Automation store with trigger support is not available in this runtime.";
-    emit8(context2, "manage_trigger", args, msg2);
+    emit9(context2, "manage_trigger", args, msg2);
     return msg2;
   }
   const engine = context2.triggerEngine;
@@ -351396,7 +352167,7 @@ async function manageTrigger(args, context2) {
     const all = m2.listTriggers();
     if (!all.length) {
       const msg3 = "No triggers configured.";
-      emit8(context2, "manage_trigger", args, msg3);
+      emit9(context2, "manage_trigger", args, msg3);
       return msg3;
     }
     const body = all.map((t) => {
@@ -351405,14 +352176,14 @@ async function manageTrigger(args, context2) {
     }).join("\n");
     const msg2 = `Triggers (${all.length}):
 ${body}`;
-    emit8(context2, "manage_trigger", args, msg2);
+    emit9(context2, "manage_trigger", args, msg2);
     return msg2;
   }
   if (action === "fires") {
     const fires = engine?.listFires?.() ?? [];
     if (!fires.length) {
       const msg3 = "No trigger firings recorded yet.";
-      emit8(context2, "manage_trigger", args, msg3);
+      emit9(context2, "manage_trigger", args, msg3);
       return msg3;
     }
     const limit2 = args.limit ?? 20;
@@ -351421,23 +352192,23 @@ ${body}`;
     ).join("\n");
     const msg2 = `Recent trigger firings (${Math.min(limit2, fires.length)} of ${fires.length}):
 ${body}`;
-    emit8(context2, "manage_trigger", args, msg2);
+    emit9(context2, "manage_trigger", args, msg2);
     return msg2;
   }
   if (action === "create") {
     if (!args.name) {
       const msg3 = "create requires a name.";
-      emit8(context2, "manage_trigger", args, msg3);
+      emit9(context2, "manage_trigger", args, msg3);
       return msg3;
     }
     if (!args.kind) {
       const msg3 = "create requires a kind (pattern|threshold|webhook|schedule).";
-      emit8(context2, "manage_trigger", args, msg3);
+      emit9(context2, "manage_trigger", args, msg3);
       return msg3;
     }
     if (!args.playbookId) {
       const msg3 = "create requires playbookId.";
-      emit8(context2, "manage_trigger", args, msg3);
+      emit9(context2, "manage_trigger", args, msg3);
       return msg3;
     }
     const entry = {
@@ -351463,20 +352234,20 @@ ${body}`;
     } catch {
     }
     const msg2 = `Created trigger "${entry.name}" (${entry.id}) [${entry.kind}] \u2192 ${entry.action} ${entry.playbookId}.`;
-    emit8(context2, "manage_trigger", args, msg2);
+    emit9(context2, "manage_trigger", args, msg2);
     return msg2;
   }
   if (action === "update") {
     const key = args.id ?? args.name;
     if (!key) {
       const msg3 = "update requires id or name.";
-      emit8(context2, "manage_trigger", args, msg3);
+      emit9(context2, "manage_trigger", args, msg3);
       return msg3;
     }
     const existing = m2.listTriggers().find((t) => t.id === key || t.name.trim().toLowerCase() === key.trim().toLowerCase());
     if (!existing) {
       const msg3 = `No trigger "${key}".`;
-      emit8(context2, "manage_trigger", args, msg3);
+      emit9(context2, "manage_trigger", args, msg3);
       return msg3;
     }
     const merged = {
@@ -351499,14 +352270,14 @@ ${body}`;
     } catch {
     }
     const msg2 = `Updated trigger "${merged.name}" (${merged.id}).`;
-    emit8(context2, "manage_trigger", args, msg2);
+    emit9(context2, "manage_trigger", args, msg2);
     return msg2;
   }
   if (action === "delete") {
     const key = args.id ?? args.name;
     if (!key) {
       const msg3 = "delete requires id or name.";
-      emit8(context2, "manage_trigger", args, msg3);
+      emit9(context2, "manage_trigger", args, msg3);
       return msg3;
     }
     const ok = m2.deleteTrigger(key);
@@ -351517,14 +352288,14 @@ ${body}`;
       }
     }
     const msg2 = ok ? `Deleted trigger "${key}".` : `No trigger "${key}".`;
-    emit8(context2, "manage_trigger", args, msg2);
+    emit9(context2, "manage_trigger", args, msg2);
     return msg2;
   }
   if (action === "enable" || action === "disable") {
     const key = args.id ?? args.name;
     if (!key) {
       const msg3 = `${action} requires id or name.`;
-      emit8(context2, "manage_trigger", args, msg3);
+      emit9(context2, "manage_trigger", args, msg3);
       return msg3;
     }
     const ok = m2.setTriggerEnabled(key, action === "enable");
@@ -351536,11 +352307,11 @@ ${body}`;
       }
     }
     const msg2 = ok ? `Trigger "${key}" ${action}d.` : `No trigger "${key}".`;
-    emit8(context2, "manage_trigger", args, msg2);
+    emit9(context2, "manage_trigger", args, msg2);
     return msg2;
   }
   const msg = `Unknown action "${action}".`;
-  emit8(context2, "manage_trigger", args, msg);
+  emit9(context2, "manage_trigger", args, msg);
   return msg;
 }
 
@@ -351898,10 +352669,10 @@ async function listGatewayMethods(args, context2) {
   const lines = methods.map((mm) => `- ${mm.name} [${mm.category}] ${mm.description}${mm.params ? " (params: " + Object.entries(mm.params).map(([k, v]) => `${k}${v.optional ? "?" : ""}:${v.type}`).join(", ") + ")" : ""}`);
   const out = `Gateway methods (${methods.length} of ${payload.count}, registry v${payload.version}):
 ${lines.join("\n")}`;
-  emit9(context2, "list_gateway_methods", args, out);
+  emit10(context2, "list_gateway_methods", args, out);
   return out;
 }
-function emit9(context2, toolName, input, output) {
+function emit10(context2, toolName, input, output) {
   context2.sendEvent(context2.sessionId, {
     messageId: context2.messageId,
     type: "tool_call",
@@ -351914,7 +352685,7 @@ function obs(context2, toolName, args) {
   const o = context2.observability;
   if (!o) {
     const msg = `${toolName} is not available in this runtime (observability not wired).`;
-    emit9(context2, toolName, args, msg);
+    emit10(context2, toolName, args, msg);
     return { o: null, msg };
   }
   return { o, msg: null };
@@ -351926,7 +352697,7 @@ async function getMetrics(args, context2) {
   const { o, msg } = obs(context2, "get_metrics", args);
   if (!o) return msg;
   const out = args.format === "prometheus" ? o.metricsExport.renderPrometheus() || "# no host metrics recorded yet" : await o.dashboard.summary();
-  emit9(context2, "get_metrics", args, out);
+  emit10(context2, "get_metrics", args, out);
   return out;
 }
 var manageSecretSchema = external_exports.object({
@@ -351941,7 +352712,7 @@ async function manageSecret(args, context2) {
   const v = o.secrets;
   if (!v.unlocked()) {
     const m2 = "Secrets vault is locked \u2014 start RTerm with RTERM_SECRETS_MASTER_KEY set.";
-    emit9(context2, "manage_secret", args, m2);
+    emit10(context2, "manage_secret", args, m2);
     return m2;
   }
   let out;
@@ -351968,7 +352739,7 @@ async function manageSecret(args, context2) {
       out = v.has(args.key) ? `'${args.key}' exists.` : `'${args.key}' does not exist.`;
     }
   }
-  emit9(context2, "manage_secret", args, out);
+  emit10(context2, "manage_secret", args, out);
   return out;
 }
 var manageOncallSchema = external_exports.object({
@@ -352020,7 +352791,7 @@ async function manageOncall(args, context2) {
   } catch (e) {
     out = `on-call error: ${e instanceof Error ? e.message : String(e)}`;
   }
-  emit9(context2, "manage_oncall", args, out);
+  emit10(context2, "manage_oncall", args, out);
   return out;
 }
 var getCostSchema = external_exports.object({
@@ -352044,7 +352815,7 @@ async function getCost(args, context2) {
     const b = o.cost.listBudgets();
     out = b.length ? b.map((x) => `- ${x.id}: ${x.model ?? "*"}/${x.profileId ?? "*"} ${x.period} cap $${x.capUsd}`).join("\n") : "No budgets configured.";
   }
-  emit9(context2, "get_cost", args, out);
+  emit10(context2, "get_cost", args, out);
   return out;
 }
 var manageRecordingSchema = external_exports.object({
@@ -352110,7 +352881,7 @@ async function manageRecording(args, context2) {
   } catch (e) {
     out = `recording error: ${e instanceof Error ? e.message : String(e)}`;
   }
-  emit9(context2, "manage_recording", args, out);
+  emit10(context2, "manage_recording", args, out);
   return out;
 }
 var manageGitopsSchema = external_exports.object({
@@ -352142,7 +352913,7 @@ async function manageGitops(args, context2) {
   } catch (e) {
     out = `gitops error: ${e instanceof Error ? e.message : String(e)}`;
   }
-  emit9(context2, "manage_gitops", args, out);
+  emit10(context2, "manage_gitops", args, out);
   return out;
 }
 var managePlaybookVersionSchema = external_exports.object({
@@ -352189,7 +352960,7 @@ async function managePlaybookVersion(args, context2) {
   } catch (e) {
     out = `playbook error: ${e instanceof Error ? e.message : String(e)}`;
   }
-  emit9(context2, "manage_playbook_version", args, out);
+  emit10(context2, "manage_playbook_version", args, out);
   return out;
 }
 var getCloudInventorySchema = external_exports.object({
@@ -352216,7 +352987,7 @@ async function getCloudInventory(args, context2) {
   } catch (e) {
     out = `cloud error: ${e instanceof Error ? e.message : String(e)}`;
   }
-  emit9(context2, "get_cloud_inventory", args, out);
+  emit10(context2, "get_cloud_inventory", args, out);
   return out;
 }
 var getMonitorStatusSchema = external_exports.object({
@@ -352231,7 +353002,7 @@ async function getMonitorStatus(args, context2) {
   } else {
     out = o.monitorStatus.summary();
   }
-  emit9(context2, "get_monitor_status", args, out);
+  emit10(context2, "get_monitor_status", args, out);
   return out;
 }
 var getLiveDashboardSchema = external_exports.object({
@@ -352247,7 +353018,7 @@ async function getLiveDashboard(args, context2) {
     const s = await o.dashboard.summary();
     out = s;
   }
-  emit9(context2, "get_live_dashboard", args, out);
+  emit10(context2, "get_live_dashboard", args, out);
   return out;
 }
 var ingestApmSpansSchema = external_exports.object({
@@ -352260,7 +353031,7 @@ async function ingestApmSpans(args, context2) {
   const { ingestOtlp: ingestOtlp2 } = await Promise.resolve().then(() => (init_spanLedger(), spanLedger_exports));
   const n2 = ingestOtlp2(o.spanLedger, args.payload, args.defaultService);
   const out = `Ingested ${n2} APM span(s) into the trace store.`;
-  emit9(context2, "ingest_apm_spans", args, out);
+  emit10(context2, "ingest_apm_spans", args, out);
   return out;
 }
 var getApmSummarySchema = external_exports.object({});
@@ -352269,7 +353040,7 @@ async function getApmSummary(_args, context2) {
   if (!o) return msg;
   const stats = o.spanLedger.serviceStats();
   const out = stats.length ? `APM: ${o.spanLedger.size()} spans across ${stats.length} service(s). ` + stats.map((x) => `${x.service}(${x.spans}${x.errors ? ", " + x.errors + " err" : ""})`).join(", ") : "APM: no spans ingested yet.";
-  emit9(context2, "get_apm_summary", _args, out);
+  emit10(context2, "get_apm_summary", _args, out);
   return out;
 }
 var ingestDemBeaconSchema = external_exports.object({
@@ -352280,7 +353051,7 @@ async function ingestDemBeacon(args, context2) {
   if (!o) return msg;
   const s = o.rumLedger.ingestBeacon(args.payload);
   const out = s ? `Ingested RUM beacon for ${s.page}${s.lcpMs ? ` (LCP ${s.lcpMs}ms)` : ""}.` : "Beacon ignored \u2014 needs a `page` field.";
-  emit9(context2, "ingest_dem_beacon", args, out);
+  emit10(context2, "ingest_dem_beacon", args, out);
   return out;
 }
 var getDemSummarySchema = external_exports.object({});
@@ -352289,7 +353060,7 @@ async function getDemSummary(_args, context2) {
   if (!o) return msg;
   const pages = o.rumLedger.pageStats();
   const out = pages.length ? `DEM: ${o.rumLedger.size()} sessions across ${pages.length} page(s). ` + pages.map((p) => `${p.page}(${p.sessions}${p.errorRate ? `, ${(p.errorRate * 100).toFixed(0)}% err` : ""})`).join(", ") : "DEM: no RUM sessions ingested yet.";
-  emit9(context2, "get_dem_summary", _args, out);
+  emit10(context2, "get_dem_summary", _args, out);
   return out;
 }
 var collectInfraSchema = external_exports.object({
@@ -352334,7 +353105,7 @@ async function collectInfra(args, context2) {
   } catch (e) {
     out = `infra collect failed (kubectl or cluster unavailable): ${e instanceof Error ? e.message : String(e)}`;
   }
-  emit9(context2, "collect_infra", args, out);
+  emit10(context2, "collect_infra", args, out);
   return out;
 }
 var manageEtwSchema = external_exports.object({
@@ -352393,7 +353164,7 @@ ${buildStopCommands2(s).join("\n")}`;
   } catch (e) {
     out = `etw error: ${e instanceof Error ? e.message : String(e)}`;
   }
-  emit9(context2, "manage_etw", args, out);
+  emit10(context2, "manage_etw", args, out);
   return out;
 }
 
@@ -352612,6 +353383,21 @@ function buildToolsForModel(readFileSupport) {
       description: BUILTIN_TOOL_INFO.find((t) => t.name === "get_run_ledger")?.description ?? "",
       schema: getRunLedgerSchema
     },
+    {
+      name: "ops_experiment",
+      description: BUILTIN_TOOL_INFO.find((t) => t.name === "ops_experiment")?.description ?? "",
+      schema: opsExperimentSchema
+    },
+    {
+      name: "manage_goal",
+      description: BUILTIN_TOOL_INFO.find((t) => t.name === "manage_goal")?.description ?? "",
+      schema: manageGoalSchema
+    },
+    {
+      name: "estate_facts",
+      description: BUILTIN_TOOL_INFO.find((t) => t.name === "estate_facts")?.description ?? "",
+      schema: estateFactsSchema
+    },
     {
       name: "run_fleet_command",
       description: BUILTIN_TOOL_INFO.find((t) => t.name === "run_fleet_command")?.description ?? "",
@@ -352796,6 +353582,9 @@ var toolImplementations = {
   readSessionLog,
   searchSessionLogs,
   getRunLedger,
+  opsExperiment,
+  manageGoal,
+  estateFacts,
   runFleetCommand,
   collectFacts,
   probeConnectivity,
@@ -354538,12 +355327,12 @@ function encodeURIPath(str3) {
   return str3.replace(/[^A-Za-z0-9\-._~!$&'()*+,;=:@]+/g, encodeURIComponent);
 }
 var EMPTY = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.create(null));
-var createPathTagFunction = (pathEncoder = encodeURIPath) => function path32(statics, ...params) {
+var createPathTagFunction = (pathEncoder = encodeURIPath) => function path33(statics, ...params) {
   if (statics.length === 1)
     return statics[0];
   let postPath = false;
   const invalidSegments = [];
-  const path33 = statics.reduce((previousValue, currentValue, index2) => {
+  const path34 = statics.reduce((previousValue, currentValue, index2) => {
     if (/[?#]/.test(currentValue)) {
       postPath = true;
     }
@@ -354560,7 +355349,7 @@ var createPathTagFunction = (pathEncoder = encodeURIPath) => function path32(sta
     }
     return previousValue + currentValue + (index2 === params.length ? "" : encoded);
   }, "");
-  const pathOnly = path33.split(/[?#]/, 1)[0];
+  const pathOnly = path34.split(/[?#]/, 1)[0];
   const invalidSegmentPattern = /(?<=^|\/)(?:\.|%2e){1,2}(?=\/|$)/gi;
   let match;
   while ((match = invalidSegmentPattern.exec(pathOnly)) !== null) {
@@ -354581,10 +355370,10 @@ var createPathTagFunction = (pathEncoder = encodeURIPath) => function path32(sta
     }, "");
     throw new OpenAIError(`Path parameters result in path with invalid segments:
 ${invalidSegments.map((e) => e.error).join("\n")}
-${path33}
+${path34}
 ${underline}`);
   }
-  return path33;
+  return path34;
 };
 var path8 = /* @__PURE__ */ createPathTagFunction(encodeURIPath);
 
@@ -354957,11 +355746,11 @@ var AbstractChatCompletionRunner = class extends EventStream {
       this._addMessage(message);
     return chatCompletion;
   }
-  _addMessage(message, emit10 = true) {
+  _addMessage(message, emit11 = true) {
     if (!("content" in message))
       message.content = null;
     this.messages.push(message);
-    if (emit10) {
+    if (emit11) {
       this._emit("message", message);
       if (isToolMessage2(message) && message.content) {
         this._emit("functionToolCallResult", message.content);
@@ -355213,8 +356002,8 @@ var ChatCompletionRunner = class _ChatCompletionRunner extends AbstractChatCompl
     runner._run(() => runner._runTools(client2, params, opts));
     return runner;
   }
-  _addMessage(message, emit10 = true) {
-    super._addMessage(message, emit10);
+  _addMessage(message, emit11 = true) {
+    super._addMessage(message, emit11);
     if (isAssistantMessage(message) && message.content) {
       this._emit("content", message.content);
     }
@@ -359401,9 +360190,9 @@ var OpenAI = class {
     this.apiKey = token;
     return true;
   }
-  buildURL(path32, query, defaultBaseURL) {
+  buildURL(path33, query, defaultBaseURL) {
     const baseURL = !__classPrivateFieldGet(this, _OpenAI_instances, "m", _OpenAI_baseURLOverridden).call(this) && defaultBaseURL || this.baseURL;
-    const url2 = isAbsoluteURL(path32) ? new URL(path32) : new URL(baseURL + (baseURL.endsWith("/") && path32.startsWith("/") ? path32.slice(1) : path32));
+    const url2 = isAbsoluteURL(path33) ? new URL(path33) : new URL(baseURL + (baseURL.endsWith("/") && path33.startsWith("/") ? path33.slice(1) : path33));
     const defaultQuery = this.defaultQuery();
     if (!isEmptyObj(defaultQuery)) {
       query = { ...defaultQuery, ...query };
@@ -359427,24 +360216,24 @@ var OpenAI = class {
    */
   async prepareRequest(request, { url: url2, options }) {
   }
-  get(path32, opts) {
-    return this.methodRequest("get", path32, opts);
+  get(path33, opts) {
+    return this.methodRequest("get", path33, opts);
   }
-  post(path32, opts) {
-    return this.methodRequest("post", path32, opts);
+  post(path33, opts) {
+    return this.methodRequest("post", path33, opts);
   }
-  patch(path32, opts) {
-    return this.methodRequest("patch", path32, opts);
+  patch(path33, opts) {
+    return this.methodRequest("patch", path33, opts);
   }
-  put(path32, opts) {
-    return this.methodRequest("put", path32, opts);
+  put(path33, opts) {
+    return this.methodRequest("put", path33, opts);
   }
-  delete(path32, opts) {
-    return this.methodRequest("delete", path32, opts);
+  delete(path33, opts) {
+    return this.methodRequest("delete", path33, opts);
   }
-  methodRequest(method, path32, opts) {
+  methodRequest(method, path33, opts) {
     return this.request(Promise.resolve(opts).then((opts2) => {
-      return { method, path: path32, ...opts2 };
+      return { method, path: path33, ...opts2 };
     }));
   }
   request(options, remainingRetries = null) {
@@ -359548,8 +360337,8 @@ var OpenAI = class {
     }));
     return { response, options, controller, requestLogID, retryOfRequestLogID, startTime };
   }
-  getAPIList(path32, Page2, opts) {
-    return this.requestAPIList(Page2, { method: "get", path: path32, ...opts });
+  getAPIList(path33, Page2, opts) {
+    return this.requestAPIList(Page2, { method: "get", path: path33, ...opts });
   }
   requestAPIList(Page2, options) {
     const request = this.makeRequest(options, null, void 0);
@@ -359627,8 +360416,8 @@ var OpenAI = class {
   }
   async buildRequest(inputOptions, { retryCount = 0 } = {}) {
     const options = { ...inputOptions };
-    const { method, path: path32, query, defaultBaseURL } = options;
-    const url2 = this.buildURL(path32, query, defaultBaseURL);
+    const { method, path: path33, query, defaultBaseURL } = options;
+    const url2 = this.buildURL(path33, query, defaultBaseURL);
     if ("timeout" in options)
       validatePositiveInteger("timeout", options.timeout);
     options.timeout = options.timeout ?? this.timeout;
@@ -361244,23 +362033,23 @@ function isNullable(schema2) {
   }
   return false;
 }
-function ensureStrictJsonSchema(jsonSchema, path32, root) {
+function ensureStrictJsonSchema(jsonSchema, path33, root) {
   if (typeof jsonSchema === "boolean") {
-    throw new TypeError(`Expected object schema but got boolean; path=${path32.join("/")}`);
+    throw new TypeError(`Expected object schema but got boolean; path=${path33.join("/")}`);
   }
   if (!isObject4(jsonSchema)) {
-    throw new TypeError(`Expected ${JSON.stringify(jsonSchema)} to be an object; path=${path32.join("/")}`);
+    throw new TypeError(`Expected ${JSON.stringify(jsonSchema)} to be an object; path=${path33.join("/")}`);
   }
   const defs = jsonSchema.$defs;
   if (isObject4(defs)) {
     for (const [defName, defSchema] of Object.entries(defs)) {
-      ensureStrictJsonSchema(defSchema, [...path32, "$defs", defName], root);
+      ensureStrictJsonSchema(defSchema, [...path33, "$defs", defName], root);
     }
   }
   const definitions = jsonSchema.definitions;
   if (isObject4(definitions)) {
     for (const [definitionName, definitionSchema] of Object.entries(definitions)) {
-      ensureStrictJsonSchema(definitionSchema, [...path32, "definitions", definitionName], root);
+      ensureStrictJsonSchema(definitionSchema, [...path33, "definitions", definitionName], root);
     }
   }
   const typ = jsonSchema.type;
@@ -361272,31 +362061,31 @@ function ensureStrictJsonSchema(jsonSchema, path32, root) {
   if (isObject4(properties)) {
     for (const [key, value] of Object.entries(properties)) {
       if (!isNullable(value) && !required2.includes(key)) {
-        throw new Error(`Zod field at \`${[...path32, "properties", key].join("/")}\` uses \`.optional()\` without \`.nullable()\` which is not supported by the API. See: https://platform.openai.com/docs/guides/structured-outputs?api-mode=responses#all-fields-must-be-required`);
+        throw new Error(`Zod field at \`${[...path33, "properties", key].join("/")}\` uses \`.optional()\` without \`.nullable()\` which is not supported by the API. See: https://platform.openai.com/docs/guides/structured-outputs?api-mode=responses#all-fields-must-be-required`);
       }
     }
     jsonSchema.required = Object.keys(properties);
     jsonSchema.properties = Object.fromEntries(Object.entries(properties).map(([key, propSchema]) => [
       key,
-      ensureStrictJsonSchema(propSchema, [...path32, "properties", key], root)
+      ensureStrictJsonSchema(propSchema, [...path33, "properties", key], root)
     ]));
   }
   const items = jsonSchema.items;
   if (isObject4(items)) {
-    jsonSchema.items = ensureStrictJsonSchema(items, [...path32, "items"], root);
+    jsonSchema.items = ensureStrictJsonSchema(items, [...path33, "items"], root);
   }
   const anyOf = jsonSchema.anyOf;
   if (Array.isArray(anyOf)) {
-    jsonSchema.anyOf = anyOf.map((variant, i) => ensureStrictJsonSchema(variant, [...path32, "anyOf", String(i)], root));
+    jsonSchema.anyOf = anyOf.map((variant, i) => ensureStrictJsonSchema(variant, [...path33, "anyOf", String(i)], root));
   }
   const allOf = jsonSchema.allOf;
   if (Array.isArray(allOf)) {
     if (allOf.length === 1) {
-      const resolved = ensureStrictJsonSchema(allOf[0], [...path32, "allOf", "0"], root);
+      const resolved = ensureStrictJsonSchema(allOf[0], [...path33, "allOf", "0"], root);
       Object.assign(jsonSchema, resolved);
       delete jsonSchema.allOf;
     } else {
-      jsonSchema.allOf = allOf.map((entry, i) => ensureStrictJsonSchema(entry, [...path32, "allOf", String(i)], root));
+      jsonSchema.allOf = allOf.map((entry, i) => ensureStrictJsonSchema(entry, [...path33, "allOf", String(i)], root));
     }
   }
   if (jsonSchema.default === null) {
@@ -361305,7 +362094,7 @@ function ensureStrictJsonSchema(jsonSchema, path32, root) {
   const ref = jsonSchema.$ref;
   if (ref && hasMoreThanNKeys(jsonSchema, 1)) {
     if (typeof ref !== "string") {
-      throw new TypeError(`Received non-string $ref - ${ref}; path=${path32.join("/")}`);
+      throw new TypeError(`Received non-string $ref - ${ref}; path=${path33.join("/")}`);
     }
     const resolved = resolveRef(root, ref);
     if (typeof resolved === "boolean") {
@@ -361316,7 +362105,7 @@ function ensureStrictJsonSchema(jsonSchema, path32, root) {
     }
     Object.assign(jsonSchema, { ...resolved, ...jsonSchema });
     delete jsonSchema.$ref;
-    return ensureStrictJsonSchema(jsonSchema, path32, root);
+    return ensureStrictJsonSchema(jsonSchema, path33, root);
   }
   return jsonSchema;
 }
@@ -365722,7 +366511,7 @@ var import_node_fs4 = __toESM(require("node:fs"), 1);
 var import_promises6 = __toESM(require("node:fs/promises"), 1);
 var import_node_os2 = __toESM(require("node:os"), 1);
 var import_node_path6 = __toESM(require("node:path"), 1);
-var import_node_crypto17 = __toESM(require("node:crypto"), 1);
+var import_node_crypto18 = __toESM(require("node:crypto"), 1);
 var DEFAULT_MAX_FILES = 50;
 var PassChatTempExportService = class {
   baseDir;
@@ -365849,7 +366638,7 @@ ${input.markdown}`
     return import_node_path6.default.join(this.baseDir, `pass-chat_${sessionHash}_${hash2}.md`);
   }
   hashText(input) {
-    return import_node_crypto17.default.createHash("sha256").update(input).digest("hex");
+    return import_node_crypto18.default.createHash("sha256").update(input).digest("hex");
   }
   async ensurePrivateBaseDir() {
     await import_promises6.default.mkdir(this.baseDir, { recursive: true, mode: 448 });
@@ -366175,6 +366964,11 @@ function reconcileToolCalls(toolCalls) {
   }
   return result;
 }
+var TOOL_RESULT_MAX_CHARS = 32768;
+function stringifyToolResult(result) {
+  const raw = typeof result === "string" ? result : JSON.stringify(result);
+  return clipTextMiddle(raw, TOOL_RESULT_MAX_CHARS);
+}
 function clipTextMiddle(input, maxChars) {
   if (maxChars <= 0) return "";
   if (input.length <= maxChars) return input;
@@ -366218,6 +367012,7 @@ var AgentService_v2 = class {
   /** Optional run ledger — persisted audit + token-cost record of every
    * agent run (start/finish lifecycle + per-call token usage). */
   agentRunLedger;
+  compoundingStore;
   changeLedger;
   mcpToolService;
   skillService;
@@ -366352,6 +367147,9 @@ var AgentService_v2 = class {
   setAgentRunLedger(ledger) {
     this.agentRunLedger = ledger ?? void 0;
   }
+  setCompoundingStore(store) {
+    this.compoundingStore = store ?? void 0;
+  }
   setFeedbackWaiter(waiter) {
     this.waitForFeedback = waiter;
   }
@@ -366767,7 +367565,21 @@ var AgentService_v2 = class {
           );
         }
       }
-      const baseSystemText = createBaseSystemPromptText(memoryPrompt);
+      let baseSystemText = createBaseSystemPromptText(memoryPrompt);
+      if (this.compoundingStore) {
+        const block = this.compoundingStore.promptBlock(3500);
+        const goals = this.compoundingStore.listGoals(sessionId).filter((g) => g.status === "open" || g.status === "blocked");
+        const extra = [];
+        if (block) extra.push(block);
+        if (goals.length) {
+          extra.push(
+            "# Open goals this session\n" + goals.map((g) => `- [${g.status}] ${g.text}${g.blockedBy ? ` (${g.blockedBy})` : ""}`).join("\n")
+          );
+        }
+        if (extra.length) baseSystemText = `${baseSystemText}
+
+${extra.join("\n\n")}`;
+      }
       const newMessages = upsertSingleSystemMessageByText(
         [...messages, humanMessage],
         baseSystemText
@@ -367701,6 +368513,33 @@ Actually, your intention might be different. Please re-read the description of t
           }
           break;
         }
+        case "ops_experiment": {
+          try {
+            const validatedArgs = opsExperimentSchema.parse(toolCall.args || {});
+            result = await toolImplementations.opsExperiment(validatedArgs, executionContext);
+          } catch (err) {
+            result = `Parameter validation error for ops_experiment: ${err.message}`;
+          }
+          break;
+        }
+        case "manage_goal": {
+          try {
+            const validatedArgs = manageGoalSchema.parse(toolCall.args || {});
+            result = await toolImplementations.manageGoal(validatedArgs, executionContext);
+          } catch (err) {
+            result = `Parameter validation error for manage_goal: ${err.message}`;
+          }
+          break;
+        }
+        case "estate_facts": {
+          try {
+            const validatedArgs = estateFactsSchema.parse(toolCall.args || {});
+            result = await toolImplementations.estateFacts(validatedArgs, executionContext);
+          } catch (err) {
+            result = `Parameter validation error for estate_facts: ${err.message}`;
+          }
+          break;
+        }
         case "get_metrics": {
           try {
             const validatedArgs = getMetricsSchema.parse(toolCall.args || {});
@@ -368052,7 +368891,7 @@ Actually, your intention might be different. Please re-read the description of t
             try {
               const pluginArgs = typeof toolCall.args === "string" ? JSON.parse(toolCall.args) : toolCall.args || {};
               const pluginResult = await pluginHandler(pluginArgs);
-              result = typeof pluginResult === "string" ? pluginResult : JSON.stringify(pluginResult);
+              result = stringifyToolResult(pluginResult);
             } catch (err) {
               result = `Plugin tool "${toolCall.name}" error: ${err.message}`;
             }
@@ -368307,6 +369146,12 @@ Actually, your intention might be different. Please re-read the description of t
         return ti.getCost(args, executionContext);
       case "get_run_ledger":
         return ti.getRunLedger(args, executionContext);
+      case "ops_experiment":
+        return ti.opsExperiment(args, executionContext);
+      case "manage_goal":
+        return ti.manageGoal(args, executionContext);
+      case "estate_facts":
+        return ti.estateFacts(args, executionContext);
       case "list_gateway_methods":
         return ti.listGatewayMethods(args, executionContext);
       case "collect_facts":
@@ -368334,7 +369179,7 @@ Actually, your intention might be different. Please re-read the description of t
         const pluginHandler = this.pluginTools.get(name);
         if (pluginHandler) {
           const result = await pluginHandler(args);
-          return typeof result === "string" ? result : JSON.stringify(result);
+          return stringifyToolResult(result);
         }
         return `Tool "${name}" is not supported in parallel execution mode.`;
       }
@@ -368415,7 +369260,7 @@ Actually, your intention might be different. Please re-read the description of t
           args,
           signal
         );
-        resultText = typeof result === "string" ? result : JSON.stringify(result, null, 2);
+        resultText = stringifyToolResult(result);
       } catch (err) {
         if (this.helpers.isAbortError(err)) throw err;
         resultText = err instanceof Error ? err.message : String(err);
@@ -368764,6 +369609,7 @@ ${reminder}`;
       automationManager: this.automationManager,
       sessionLogger: this.sessionLogger,
       agentRunLedger: this.agentRunLedger,
+      compoundingStore: this.compoundingStore,
       changeLedger: this.changeLedger,
       triggerEngine: this.triggerEngine,
       observability: this.observability,
@@ -369724,9 +370570,50 @@ ${reminder}`;
       }
       this.currentRunIdBySession.delete(sessionId);
       this.agentRunLedger?.finishRun(ledgerRunId, ledgerExitStatus, ledgerExitError);
+      void this.recordCompoundingLessons(sessionId, ledgerRunId, ledgerExitStatus, ledgerExitError);
       await this.clearCheckpoint(sessionId);
     }
   }
+  /**
+   * After every run, extract durable lessons from the error + input preview
+   * and append them to memory.md (deduped by fingerprint). Best-effort: a
+   * failure here must never throw out of the agent finally block.
+   */
+  async recordCompoundingLessons(_sessionId, ledgerRunId, status, error40) {
+    try {
+      if (!this.compoundingStore) return;
+      const { extractLessons: extractLessons2, isTrivialRun: isTrivialRun2, appendLessonsToMemory: appendLessonsToMemory2, formatLessonMarkdown: formatLessonMarkdown2 } = await Promise.resolve().then(() => (init_compoundingKnowledge(), compoundingKnowledge_exports));
+      const run = ledgerRunId ? this.agentRunLedger?.getRun(ledgerRunId) : null;
+      const inputPreview = run?.run.inputPreview;
+      if (isTrivialRun2(inputPreview, error40)) return;
+      const lessons = extractLessons2(error40, inputPreview, status === "failed" ? status : "");
+      if (!lessons.length) return;
+      const rows = this.compoundingStore.recordLessons(lessons, ledgerRunId);
+      const snapshot = await this.memoryService.getMemorySnapshot(this.getActiveMemoryProfileId());
+      const { next, added } = appendLessonsToMemory2(snapshot.content, lessons, {
+        runId: ledgerRunId,
+        at: (/* @__PURE__ */ new Date()).toISOString().slice(0, 10)
+      });
+      if (added.length && this.memoryService.appendMemory) {
+        const chunk2 = added.map((fp) => {
+          const lesson2 = lessons.find((l) => l.fingerprint === fp);
+          const row = rows.find((r) => r.fingerprint === fp);
+          return lesson2 ? formatLessonMarkdown2(lesson2, {
+            runId: ledgerRunId,
+            at: (/* @__PURE__ */ new Date()).toISOString().slice(0, 10),
+            occurrence: row?.occurrences
+          }) : "";
+        }).join("");
+        if (chunk2) {
+          await this.memoryService.appendMemory(chunk2, this.getActiveMemoryProfileId());
+        }
+      } else if (added.length) {
+        await this.memoryService.writeMemory(next, this.getActiveMemoryProfileId());
+      }
+    } catch (err) {
+      console.warn("[AgentService_v2] compounding lesson write failed:", err);
+    }
+  }
   async clearCheckpoint(sessionId) {
     try {
       await this.checkpointer.deleteThread(sessionId);
@@ -372152,6 +373039,22 @@ var WebSocketRpcError = class extends Error {
     this.code = code;
   }
 };
+function httpRouteMatches(pattern, pathname) {
+  if (pattern === pathname) return true;
+  if (pattern.endsWith("/*")) {
+    const prefix = pattern.slice(0, -1);
+    const base = pattern.slice(0, -2);
+    return pathname === base || pathname.startsWith(prefix) || pathname.startsWith(base + "/");
+  }
+  const a = pattern.split("/").filter(Boolean);
+  const b = pathname.split("/").filter(Boolean);
+  if (a.length !== b.length) return false;
+  for (let i = 0; i < a.length; i++) {
+    if (a[i].startsWith(":")) continue;
+    if (a[i] !== b[i]) return false;
+  }
+  return true;
+}
 function createDefaultWebSocketServerFactory(httpRoutes) {
   return ({ host, port }) => {
     if (!httpRoutes || httpRoutes.length === 0) {
@@ -372174,7 +373077,7 @@ function createDefaultWebSocketServerFactory(httpRoutes) {
             ).pathname;
           } catch {
           }
-          const route = routes.find((r) => r.path === pathname);
+          const route = routes.find((r) => httpRouteMatches(r.path, pathname));
           if (!route) {
             res.writeHead(404, { "content-type": "text/plain; charset=utf-8" });
             res.end("not found");
@@ -381848,6 +382751,14 @@ var FileMemoryStore = class {
       content
     };
   }
+  /** Append text to memory.md (used by auto-lesson writer). */
+  async appendMemory(chunk2) {
+    const filePath = await this.ensureMemoryFile();
+    const current = await import_promises10.default.readFile(filePath, "utf8");
+    const next = current.endsWith("\n") || current === "" ? current + chunk2 : current + "\n" + chunk2;
+    await import_promises10.default.writeFile(filePath, next, "utf8");
+    return { filePath, content: next };
+  }
   async getMemorySnapshot() {
     const filePath = await this.ensureMemoryFile();
     const content = await import_promises10.default.readFile(filePath, "utf8");
@@ -381895,6 +382806,9 @@ var NodeMemoryService = class {
   async writeMemory(content, profileId) {
     return await this.createStore(profileId).writeMemory(content);
   }
+  async appendMemory(chunk2, profileId) {
+    return await this.createStore(profileId).appendMemory(chunk2);
+  }
   async copyMemory(sourceProfileId, targetProfileId) {
     const content = await this.readMemory(sourceProfileId);
     return await this.writeMemory(content, targetProfileId);
@@ -381908,8 +382822,8 @@ var import_node_path20 = __toESM(require("node:path"), 1);
 var import_promises11 = __toESM(require("node:fs/promises"), 1);
 var import_node_path19 = __toESM(require("node:path"), 1);
 var import_node_util = require("node:util");
-var import_node_crypto18 = require("node:crypto");
-var scrypt = (0, import_node_util.promisify)(import_node_crypto18.scrypt);
+var import_node_crypto19 = require("node:crypto");
+var scrypt = (0, import_node_util.promisify)(import_node_crypto19.scrypt);
 var FILE_SCHEMA_VERSION = 1;
 var HASH_KEY_LENGTH = 32;
 var TOKEN_NAME_MAX_LENGTH = 64;
@@ -381923,10 +382837,10 @@ function makeDefaultPayload() {
   };
 }
 function randomTokenId() {
-  return `atk_${(0, import_node_crypto18.randomBytes)(12).toString("base64url")}`;
+  return `atk_${(0, import_node_crypto19.randomBytes)(12).toString("base64url")}`;
 }
 function randomAccessTokenValue() {
-  return `gys_at_${(0, import_node_crypto18.randomBytes)(24).toString("base64url")}`;
+  return `gys_at_${(0, import_node_crypto19.randomBytes)(24).toString("base64url")}`;
 }
 async function deriveTokenHash(token, tokenSaltBase64) {
   const tokenSalt = Buffer.from(tokenSaltBase64, "base64");
@@ -381988,7 +382902,7 @@ var FileAccessTokenStore = class {
         throw new Error(`Token name already exists: ${normalizedName}`);
       }
       const token = randomAccessTokenValue();
-      const tokenSalt = (0, import_node_crypto18.randomBytes)(16).toString("base64");
+      const tokenSalt = (0, import_node_crypto19.randomBytes)(16).toString("base64");
       const tokenHash = (await deriveTokenHash(token, tokenSalt)).toString("base64");
       const createdAt = Date.now();
       const record2 = {
@@ -382035,7 +382949,7 @@ var FileAccessTokenStore = class {
       try {
         const expected = Buffer.from(record2.tokenHash, "base64");
         const actual = await deriveTokenHash(token, record2.tokenSalt);
-        if (expected.length === actual.length && (0, import_node_crypto18.timingSafeEqual)(expected, actual)) {
+        if (expected.length === actual.length && (0, import_node_crypto19.timingSafeEqual)(expected, actual)) {
           return true;
         }
       } catch {
@@ -382537,7 +383451,7 @@ function buildBuiltInToolStatusSummary(enabledMap) {
 // ../../packages/backend/src/services/ImageAttachmentService.ts
 var import_promises12 = __toESM(require("node:fs/promises"), 1);
 var import_node_path21 = __toESM(require("node:path"), 1);
-var import_node_crypto19 = __toESM(require("node:crypto"), 1);
+var import_node_crypto20 = __toESM(require("node:crypto"), 1);
 var DEFAULT_INDEX = {
   records: {}
 };
@@ -382561,7 +383475,7 @@ var ImageAttachmentService = class {
     const normalizedMimeType = this.resolveMimeType(payload.mimeType, image.mimeType);
     const extension = this.resolveImageExtension(payload.fileName, normalizedMimeType);
     const safeName = this.safeFileName(payload.fileName);
-    const sha2562 = import_node_crypto19.default.createHash("sha256").update(bytes).digest("hex");
+    const sha2562 = import_node_crypto20.default.createHash("sha256").update(bytes).digest("hex");
     const attachmentId = `img_${sha2562.slice(0, 24)}`;
     const filePath = import_node_path21.default.join(this.attachmentsDir, `${attachmentId}${extension}`);
     const existing = this.records[attachmentId];
@@ -384072,10 +384986,11 @@ var IdleTimeoutService = class {
 };
 
 // ../../packages/backend/src/services/Gateway/restApi.ts
-function matchRestRoute(routes, method, path32) {
-  const normalized = path32.replace(/\/+$/, "") || "/";
+function matchRestRoute(routes, method, path33) {
+  const normalized = path33.replace(/\/+$/, "") || "/";
+  const verb = method.toUpperCase();
   for (const route of routes) {
-    if (route.method !== method.toUpperCase()) continue;
+    if (route.method !== verb) continue;
     const patternParts = route.path.split("/").filter(Boolean);
     const pathParts = normalized.split("/").filter(Boolean);
     if (patternParts.length !== pathParts.length) continue;
@@ -384096,36 +385011,18 @@ function matchRestRoute(routes, method, path32) {
 }
 function defaultRestRoutes() {
   return [
+    { method: "GET", path: "/api/v1/health", gatewayMethod: "gateway:ping", description: "Liveness check" },
+    { method: "GET", path: "/api/v1/methods", gatewayMethod: "gateway:describe", description: "List all gateway RPC methods" },
+    { method: "GET", path: "/api/v1/openapi.json", gatewayMethod: "__openapi", description: "OpenAPI 3 document for this REST overlay + RPC escape hatch" },
+    { method: "GET", path: "/api/v1/terminals", gatewayMethod: "terminal:list", description: "List terminal tabs" },
+    { method: "GET", path: "/api/v1/sessions", gatewayMethod: "session:list", description: "List chat sessions" },
     {
-      method: "GET",
-      path: "/api/v1/health",
-      gatewayMethod: "gateway:ping",
-      description: "Liveness check"
-    },
-    {
-      method: "GET",
-      path: "/api/v1/methods",
-      gatewayMethod: "gateway:describe",
-      description: "List all gateway methods (self-describing)"
-    },
-    {
-      method: "GET",
-      path: "/api/v1/terminals",
-      gatewayMethod: "terminal:list",
-      description: "List terminal tabs"
-    },
-    {
-      method: "GET",
+      method: "POST",
       path: "/api/v1/sessions",
-      gatewayMethod: "session:list",
-      description: "List chat sessions"
-    },
-    {
-      method: "GET",
-      path: "/api/v1/skills",
-      gatewayMethod: "skills:getAll",
-      description: "List loaded skills"
+      gatewayMethod: "gateway:createSession",
+      description: "Create a chat/agent session"
     },
+    { method: "GET", path: "/api/v1/skills", gatewayMethod: "skills:getAll", description: "List loaded skills" },
     {
       method: "GET",
       path: "/api/v1/observability/metrics",
@@ -384142,13 +385039,13 @@ function defaultRestRoutes() {
       method: "GET",
       path: "/api/v1/observability/apm",
       gatewayMethod: "observability:apmSummary",
-      description: "APM summary (LLM + app traces)"
+      description: "APM summary"
     },
     {
       method: "GET",
       path: "/api/v1/history/search",
       gatewayMethod: "history:search",
-      description: "Cross-session history search (?q=...)",
+      description: "Cross-session history search (?q=)",
       buildParams: (_p, body) => {
         const b = body ?? {};
         return { query: b.q ?? b.query ?? "" };
@@ -384168,17 +385065,18 @@ function defaultRestRoutes() {
       method: "GET",
       path: "/api/v1/terminals/:id/buffer",
       gatewayMethod: "terminal:getBufferDelta",
-      description: "Read a terminal tab output delta",
+      description: "Read terminal output delta (?fromOffset=)",
       buildParams: (p, body) => {
         const b = body ?? {};
-        return { terminalId: p.id, fromOffset: b.fromOffset ?? 0 };
+        const n2 = Number(b.fromOffset ?? 0);
+        return { terminalId: p.id, fromOffset: Number.isFinite(n2) ? n2 : 0 };
       }
     },
     {
       method: "POST",
       path: "/api/v1/sessions/:id/chat",
       gatewayMethod: "agent:startTask",
-      description: "Send a message to the agent (blocking)",
+      description: "Send a message (blocking until the run finishes \u2014 prefer chat-async)",
       buildParams: (p, body) => {
         const b = body ?? {};
         return { sessionId: p.id, userInput: b.message ?? b.userInput ?? "" };
@@ -384186,17 +385084,66 @@ function defaultRestRoutes() {
     },
     {
       method: "POST",
-      path: "/api/v1/rpc",
-      gatewayMethod: "",
-      description: "Escape hatch: dispatch any gateway method",
-      buildParams: (_p, body) => {
+      path: "/api/v1/sessions/:id/chat-async",
+      gatewayMethod: "agent:startTaskAsync",
+      description: "Start an agent turn without waiting; subscribe to WS gateway:event for tokens",
+      buildParams: (p, body) => {
         const b = body ?? {};
-        return { __rpcMethod: b.method ?? "", ...b.params ?? {} };
+        return { sessionId: p.id, userInput: b.message ?? b.userInput ?? "" };
       }
+    },
+    {
+      method: "POST",
+      path: "/api/v1/rpc",
+      gatewayMethod: "",
+      description: "Escape hatch: any gateway method {method, params}"
     }
   ];
 }
+function buildOpenApiDocument() {
+  const routes = defaultRestRoutes();
+  const paths = {};
+  for (const r of routes) {
+    if (r.gatewayMethod === "__openapi") continue;
+    const item = paths[r.path] || {};
+    item[r.method.toLowerCase()] = {
+      summary: r.description,
+      operationId: `${r.method}_${r.path.replace(/[^a-zA-Z0-9]+/g, "_")}`,
+      tags: ["rest"],
+      ...r.method === "POST" ? {
+        requestBody: {
+          content: { "application/json": { schema: { type: "object" } } }
+        }
+      } : {},
+      responses: { "200": { description: "OK" }, "401": { description: "Unauthorized" } }
+    };
+    paths[r.path] = item;
+  }
+  const rpcMethods = [...CORE_METHODS, DESCRIBE_METHOD].map((m2) => m2.name);
+  return {
+    openapi: "3.0.3",
+    info: {
+      title: "RTerm HTTP overlay",
+      version: "1.0.0",
+      description: `Thin REST on the same port as the WebSocket JSON-RPC gateway. Streaming agent/PTY traffic stays on ws://. POST /api/v1/rpc reaches every RPC method. Core RPC methods: ${rpcMethods.length}. Categories: ${METHOD_CATEGORIES.join(", ")}.`
+    },
+    paths,
+    "x-gateway-rpc-methods": rpcMethods
+  };
+}
 async function handleRestRequest(routes, dispatch, req) {
+  const verb = req.method.toUpperCase();
+  if (verb === "OPTIONS") {
+    return {
+      status: 204,
+      body: "",
+      headers: {
+        "access-control-allow-origin": "*",
+        "access-control-allow-methods": "GET, POST, OPTIONS",
+        "access-control-allow-headers": "Authorization, Content-Type"
+      }
+    };
+  }
   const match = matchRestRoute(routes, req.method, req.path);
   if (!match) {
     return {
@@ -384204,12 +385151,18 @@ async function handleRestRequest(routes, dispatch, req) {
       body: { error: "not_found", message: `No REST route for ${req.method} ${req.path}` }
     };
   }
+  if (match.route.gatewayMethod === "__openapi") {
+    return { status: 200, body: buildOpenApiDocument() };
+  }
   let gatewayMethod = match.route.gatewayMethod;
   let params;
   if (gatewayMethod === "") {
     const raw = req.body ?? {};
     if (!raw.method) {
-      return { status: 400, body: { error: "bad_request", message: 'POST /api/v1/rpc needs {"method": "...", "params": {...}}' } };
+      return {
+        status: 400,
+        body: { error: "bad_request", message: 'POST /api/v1/rpc needs {"method": "...", "params": {...}}' }
+      };
     }
     gatewayMethod = raw.method;
     params = raw.params ?? {};
@@ -384225,6 +385178,52 @@ async function handleRestRequest(routes, dispatch, req) {
     return { status, body: { error: "gateway_error", message } };
   }
 }
+var JSON_HEADERS = { "content-type": "application/json; charset=utf-8" };
+function readJsonBody(req) {
+  return new Promise((resolve2) => {
+    let data = "";
+    req.on?.("data", (d) => {
+      data += String(d ?? "");
+      if (data.length > 2e6) {
+        resolve2({});
+      }
+    });
+    req.on?.("end", () => {
+      try {
+        resolve2(data ? JSON.parse(data) : {});
+      } catch {
+        resolve2({});
+      }
+    });
+  });
+}
+function makeRestCatchAllHandler(opts) {
+  const routes = defaultRestRoutes();
+  return async (req, res) => {
+    const r = req;
+    const s = res;
+    try {
+      if (!await opts.isAuthorized(r)) {
+        s.writeHead?.(401, JSON_HEADERS);
+        s.end?.(JSON.stringify({ error: "unauthorized" }));
+        return;
+      }
+      const url2 = new URL(r.url ?? "/", "http://localhost");
+      const body = r.method === "POST" || r.method === "PUT" ? await readJsonBody(r) : Object.fromEntries(url2.searchParams.entries());
+      const result = await handleRestRequest(routes, opts.dispatch, {
+        method: r.method ?? "GET",
+        path: url2.pathname,
+        body
+      });
+      s.writeHead?.(result.status, { ...JSON_HEADERS, ...result.headers ?? {} });
+      if (result.body === "" || result.body === void 0) s.end?.();
+      else s.end?.(typeof result.body === "string" ? result.body : JSON.stringify(result.body));
+    } catch (e) {
+      s.writeHead?.(500, JSON_HEADERS);
+      s.end?.(JSON.stringify({ error: "internal", message: e instanceof Error ? e.message : String(e) }));
+    }
+  };
+}
 
 // ../../packages/backend/src/services/Gateway/gatewayRateLimit.ts
 var GatewayRateLimiter = class {
@@ -392117,11 +393116,11 @@ function createObservability(deps) {
   const policyEngine = new AgtPolicyEngine({
     loadPolicy: async () => {
       const req = (0, import_node_module5.createRequire)(typeof __filename !== "undefined" ? __filename : import_meta8.url);
-      const fs23 = req("node:fs");
-      const path32 = req("node:path");
-      const policyPath = path32.join(".", "policy.yaml");
-      if (fs23.existsSync(policyPath)) {
-        return parsePolicyYaml(fs23.readFileSync(policyPath, "utf8"));
+      const fs24 = req("node:fs");
+      const path33 = req("node:path");
+      const policyPath = path33.join(".", "policy.yaml");
+      if (fs24.existsSync(policyPath)) {
+        return parsePolicyYaml(fs24.readFileSync(policyPath, "utf8"));
       }
       return {
         name: "rterm-default",
@@ -392163,18 +393162,18 @@ function createObservability(deps) {
   const scanRoots = [pluginScanRoot, "./plugins"];
   try {
     const req = (0, import_node_module5.createRequire)(typeof __filename !== "undefined" ? __filename : import_meta8.url);
-    const fs23 = req("node:fs");
-    if (fs23.existsSync(bundlePluginRoot)) scanRoots.push(bundlePluginRoot);
+    const fs24 = req("node:fs");
+    if (fs24.existsSync(bundlePluginRoot)) scanRoots.push(bundlePluginRoot);
   } catch {
   }
   try {
     const req = (0, import_node_module5.createRequire)(typeof __filename !== "undefined" ? __filename : import_meta8.url);
-    const fs23 = req("node:fs");
-    const path32 = req("node:path");
+    const fs24 = req("node:fs");
+    const path33 = req("node:path");
     const resourcesPath = process.resourcesPath;
     if (resourcesPath) {
-      const resourcesPlugins = path32.join(resourcesPath, "plugins");
-      if (fs23.existsSync(resourcesPlugins)) scanRoots.push(resourcesPlugins);
+      const resourcesPlugins = path33.join(resourcesPath, "plugins");
+      if (fs24.existsSync(resourcesPlugins)) scanRoots.push(resourcesPlugins);
     }
   } catch {
   }
@@ -394861,9 +395860,9 @@ function numberFromEnv(name, fallback) {
 function resolveDataDir() {
   const custom3 = (import_node_process2.default.env.GYBACKEND_DATA_DIR || "").trim();
   if (custom3) {
-    return import_node_path28.default.resolve(custom3);
+    return import_node_path29.default.resolve(custom3);
   }
-  return import_node_path28.default.join(import_node_process2.default.cwd(), ".gybackend-data");
+  return import_node_path29.default.join(import_node_process2.default.cwd(), ".gybackend-data");
 }
 async function startGyBackend() {
   const dataDir = resolveDataDir();
@@ -394896,7 +395895,7 @@ async function startGyBackend() {
   const modelCapabilityService = new ModelCapabilityService();
   const imageAttachmentService = new ImageAttachmentService(dataDir);
   const terminalStateStore = new TerminalStateStore(
-    import_node_path28.default.join(dataDir, "terminal-tabs-state.json")
+    import_node_path29.default.join(dataDir, "terminal-tabs-state.json")
   );
   const terminalService = new TerminalService({
     terminalStateStore
@@ -394984,6 +395983,31 @@ async function startGyBackend() {
   const agentRunLedger = new AgentRunLedger();
   agentRunLedger.markStaleRunsAborted(Date.now());
   agentService.setAgentRunLedger(agentRunLedger);
+  const { CompoundingStore: CompoundingStore2 } = await Promise.resolve().then(() => (init_compoundingStore(), compoundingStore_exports));
+  const compoundingStore = new CompoundingStore2();
+  agentService.setCompoundingStore(compoundingStore);
+  try {
+    const { connectionIdentity: connectionIdentity2 } = await Promise.resolve().then(() => (init_compoundingKnowledge(), compoundingKnowledge_exports));
+    const winrm = settingsService.getSettings()?.connections?.winrm ?? [];
+    for (const c of winrm) {
+      compoundingStore.upsertEstateFact({
+        identity: connectionIdentity2({
+          name: c.name,
+          host: c.host,
+          transport: c.transport,
+          auth: c.auth,
+          domain: c.domain
+        }),
+        host: c.host,
+        role: /dc/i.test(c.name || "") ? "dc" : void 0,
+        domain: c.domain,
+        transport: c.transport,
+        auth: c.auth
+      });
+    }
+  } catch (e) {
+    console.warn(`[gybackend] compounding estate seed skipped: ${e instanceof Error ? e.message : String(e)}`);
+  }
   const changeLedger = new ChangeLedger();
   changeLedger.markStaleChangesAborted(Date.now());
   agentService.setChangeLedger(changeLedger);
@@ -395087,7 +396111,7 @@ async function startGyBackend() {
     console.warn("[gybackend] Plugin tool wiring skipped:", e instanceof Error ? e.message : String(e));
   });
   if (settingsService.getSettings().sessionLogging?.enabled) {
-    const logDir = import_node_path28.default.join(
+    const logDir = import_node_path29.default.join(
       import_node_process2.default.env.GYSHELL_STORE_DIR || "",
       "session-logs"
     );
@@ -395205,21 +396229,21 @@ async function startGyBackend() {
     authFailureLimit: 5,
     authLockoutMs: 6e4
   });
-  const settingsDir = import_node_path28.default.dirname(settingsService.getSettingsPath?.() ?? "");
-  const backupsDir = settingsDir ? import_node_path28.default.join(settingsDir, "backups") : "";
+  const settingsDir = import_node_path29.default.dirname(settingsService.getSettingsPath?.() ?? "");
+  const backupsDir = settingsDir ? import_node_path29.default.join(settingsDir, "backups") : "";
   const settingsBackupService = new SettingsBackupService(
     backupsDir ? {
-      read: () => import_node_fs12.default.readFileSync(settingsService.getSettingsPath(), "utf8"),
-      write: (c) => import_node_fs12.default.writeFileSync(settingsService.getSettingsPath(), c),
-      listBackups: () => import_node_fs12.default.existsSync(backupsDir) ? import_node_fs12.default.readdirSync(backupsDir) : [],
-      readBackup: (n2) => import_node_fs12.default.readFileSync(import_node_path28.default.join(backupsDir, n2), "utf8"),
+      read: () => import_node_fs13.default.readFileSync(settingsService.getSettingsPath(), "utf8"),
+      write: (c) => import_node_fs13.default.writeFileSync(settingsService.getSettingsPath(), c),
+      listBackups: () => import_node_fs13.default.existsSync(backupsDir) ? import_node_fs13.default.readdirSync(backupsDir) : [],
+      readBackup: (n2) => import_node_fs13.default.readFileSync(import_node_path29.default.join(backupsDir, n2), "utf8"),
       writeBackup: (n2, c) => {
-        import_node_fs12.default.mkdirSync(backupsDir, { recursive: true });
-        import_node_fs12.default.writeFileSync(import_node_path28.default.join(backupsDir, n2), c);
+        import_node_fs13.default.mkdirSync(backupsDir, { recursive: true });
+        import_node_fs13.default.writeFileSync(import_node_path29.default.join(backupsDir, n2), c);
       },
       deleteBackup: (n2) => {
-        const p = import_node_path28.default.join(backupsDir, n2);
-        if (import_node_fs12.default.existsSync(p)) import_node_fs12.default.unlinkSync(p);
+        const p = import_node_path29.default.join(backupsDir, n2);
+        if (import_node_fs13.default.existsSync(p)) import_node_fs13.default.unlinkSync(p);
       }
     } : { read: () => "", write: () => {
     }, listBackups: () => [], readBackup: () => "", writeBackup: () => {
@@ -395267,51 +396291,8 @@ async function startGyBackend() {
     return await target.handleRequest(method, params);
   };
   const buildRestHttpRoutesSync = (opts) => {
-    const routes = defaultRestRoutes();
-    const staticRoutes = routes.filter((r) => !r.path.includes(":")).map((route) => ({
-      path: route.path,
-      handler: makeRestHandler(routes, opts)
-    }));
-    return staticRoutes;
+    return [{ path: "/api/v1/*", handler: makeRestCatchAllHandler(opts) }];
   };
-  const makeRestHandler = (routes, opts) => {
-    return async (req, res) => {
-      const r = req;
-      const s = res;
-      try {
-        if (!await opts.isAuthorized(r)) {
-          s.writeHead?.(401, { "content-type": "application/json" });
-          s.end?.(JSON.stringify({ error: "unauthorized" }));
-          return;
-        }
-        const url2 = new URL(r.url ?? "/", "http://localhost");
-        const body = r.method === "POST" ? await readJsonBody(r) : Object.fromEntries(url2.searchParams.entries());
-        const result = await handleRestRequest(routes, opts.dispatch, {
-          method: r.method ?? "GET",
-          path: url2.pathname,
-          body
-        });
-        s.writeHead?.(result.status, { "content-type": "application/json" });
-        s.end?.(JSON.stringify(result.body));
-      } catch (e) {
-        s.writeHead?.(500, { "content-type": "application/json" });
-        s.end?.(JSON.stringify({ error: "internal", message: e instanceof Error ? e.message : String(e) }));
-      }
-    };
-  };
-  const readJsonBody = (req) => new Promise((resolve2) => {
-    let data = "";
-    req.on?.("data", (d) => {
-      data += String(d ?? "");
-    });
-    req.on?.("end", () => {
-      try {
-        resolve2(data ? JSON.parse(data) : {});
-      } catch {
-        resolve2({});
-      }
-    });
-  });
   const wsGatewayControlService = new WebSocketGatewayControlService({
     createAdapter: (host, port, ipFilter) => {
       const adapter = new WebSocketGatewayAdapter(gatewayService, {
@@ -395807,6 +396788,9 @@ async function startGyBackend() {
     console.log(
       `[gybackend] Live dashboard: http://${wsState.host}:${wsState.port}/dashboard`
     );
+    console.log(
+      `[gybackend] REST API: http://${wsState.host}:${wsState.port}/api/v1/health  (OpenAPI /api/v1/openapi.json)`
+    );
   } else {
     console.log("[gybackend] WebSocket RPC endpoint: disabled");
   }