runwork 0.25.2 → 0.26.0

package/dist/index.js

@@ -61,7 +61,46 @@ import {
   createInflate,
   createInflateRaw
 } from "node:zlib";
-function pickTransport() {
+function firstEnv(names) {
+  const keys = Object.keys(process.env);
+  for (const candidate of names) {
+    const variable = keys.find((k) => k === candidate) ?? keys.find((k) => k.toLowerCase() === candidate.toLowerCase());
+    if (variable === undefined)
+      continue;
+    const value = process.env[variable];
+    if (value && value.trim() !== "")
+      return { variable, value: value.trim() };
+  }
+  return null;
+}
+function isProxyExempt(hostname) {
+  const raw = process.env.NO_PROXY ?? process.env.no_proxy ?? "";
+  const host = hostname.toLowerCase();
+  for (const entry of raw.split(",")) {
+    const rule = entry.trim().toLowerCase().replace(/:\d+$/, "");
+    if (!rule)
+      continue;
+    if (rule === "*")
+      return true;
+    const bare = rule.startsWith(".") ? rule.slice(1) : rule;
+    if (host === bare || host.endsWith(`.${bare}`))
+      return true;
+  }
+  return false;
+}
+function proxyForUrl(url) {
+  let parsed;
+  try {
+    parsed = new URL2(url);
+  } catch {
+    return null;
+  }
+  if (isProxyExempt(parsed.hostname))
+    return null;
+  const schemeVars = parsed.protocol === "http:" ? ["HTTP_PROXY", "http_proxy"] : ["HTTPS_PROXY", "https_proxy"];
+  return firstEnv([...schemeVars, "ALL_PROXY", "all_proxy"]);
+}
+function pickTransport(url) {
   if (transportOverride === "curl")
     return "curl";
   if (transportOverride === "node")
@@ -69,10 +108,14 @@ function pickTransport() {
   const env = (process.env.RUNWORK_HTTP_TRANSPORT || "").toLowerCase().trim();
   if (env === "curl")
     return "curl";
+  if (env === "node")
+    return "node";
+  if (url && proxyForUrl(url))
+    return "curl";
   return "node";
 }
 async function httpFetch(url, init = {}) {
-  const transport = pickTransport();
+  const transport = pickTransport(url);
   if (transport === "curl")
     return curlFetch(url, init);
   return doRequest(url, init, 0);
@@ -789,6 +832,10 @@ class ApiClient {
   async reportTelemetry(workspaceId, events) {
     await this.request(`/api/workspaces/${workspaceId}/team/telemetry`, { method: "POST", body: JSON.stringify({ events }) });
   }
+  async createDebugReport(workspaceId, body) {
+    const res = await this.request(`/api/workspaces/${workspaceId}/debug-reports`, { method: "POST", body: JSON.stringify(body) });
+    return res.data;
+  }
   async createSharedConversation(workspaceId, body) {
     const res = await this.request(`/api/workspaces/${workspaceId}/shared-conversations`, {
       method: "POST",
@@ -999,10 +1046,13 @@ var init_workspace_state = __esm(() => {
 // src/utils/subprocess.ts
 import {
   execFileSync as cpExecFileSync,
-  spawn as cpSpawn
+  spawn as cpSpawn,
+  spawnSync as cpSpawnSync
 } from "child_process";
 var execFileSync = (file, args, options) => {
   return cpExecFileSync(file, args, { windowsHide: true, ...options ?? {} });
+}, spawnSync = (file, args, options) => {
+  return cpSpawnSync(file, args, { windowsHide: true, ...options ?? {} });
 }, spawn2 = (command, args, options) => {
   return cpSpawn(command, args ?? [], { windowsHide: true, ...options ?? {} });
 };
@@ -3096,13 +3146,56 @@ function bufToStr2(val) {
     return val.toString("utf-8").trim();
   return "";
 }
+function pushSyncStash(cwd) {
+  execFileSync("git", ["stash", "push", "-m", SYNC_STASH_TAG], { cwd, stdio: "pipe" });
+  return findSyncStashSha(cwd);
+}
+function findSyncStashSha(cwd) {
+  try {
+    const line = execFileSync("git", ["stash", "list", "--format=%H %gs"], { cwd, encoding: "utf-8" }).split(`
+`).find((l) => l.includes(SYNC_STASH_TAG));
+    return line ? line.split(" ")[0] : null;
+  } catch {
+    return null;
+  }
+}
+function stashRefForSha(cwd, sha) {
+  try {
+    const line = execFileSync("git", ["stash", "list", "--format=%H %gd"], { cwd, encoding: "utf-8" }).split(`
+`).find((l) => l.startsWith(`${sha} `));
+    return line ? line.slice(sha.length + 1).trim() : null;
+  } catch {
+    return null;
+  }
+}
+function restoreSyncStash(cwd, sha) {
+  const resolved = sha ?? findSyncStashSha(cwd);
+  if (!resolved)
+    return "missing";
+  const ref = stashRefForSha(cwd, resolved);
+  if (!ref)
+    return "missing";
+  try {
+    execFileSync("git", ["stash", "apply", resolved], { cwd, stdio: "pipe" });
+  } catch {
+    return "conflict";
+  }
+  const dropRef = stashRefForSha(cwd, resolved);
+  if (dropRef) {
+    try {
+      execFileSync("git", ["stash", "drop", dropRef], { cwd, stdio: "pipe" });
+    } catch {}
+  }
+  return "restored";
+}
 function syncWithRemote(cwd) {
   if (!hasCommits(cwd)) {
     return { status: "skipped", pushed: false };
   }
   const dirty = hasTrackedChanges(cwd);
+  let stashSha = null;
   if (dirty) {
-    execFileSync("git", ["stash", "push", "-m", "runwork-dev-sync"], { cwd, stdio: "pipe" });
+    stashSha = pushSyncStash(cwd);
   }
   let status = "synced";
   let syncError;
@@ -3143,9 +3236,8 @@ function syncWithRemote(cwd) {
     syncError = extractGitError(fetchErr);
   }
   if (dirty) {
-    try {
-      execFileSync("git", ["stash", "pop"], { cwd, stdio: "pipe" });
-    } catch {
+    const restored = restoreSyncStash(cwd, stashSha);
+    if (restored !== "restored") {
       return { status, pushed: false, error: "stash-conflict", keptUntracked, remoteOverwrote };
     }
   }
@@ -3162,6 +3254,7 @@ function syncWithRemote(cwd) {
   }
   return { status, pushed, pushError, keptUntracked, remoteOverwrote };
 }
+var SYNC_STASH_TAG = "runwork-dev-sync";
 var init_sync = __esm(() => {
   init_subprocess();
   init_manifest();
@@ -5066,10 +5159,6 @@ export declare class FileStorageClient {
  */
 export declare function createFileStorageClient(env: Env): FileStorageClient;
 import type { Hono } from 'hono';
-/**
- * Mount file storage routes on the Hono app
- * Provides REST API for R2 bucket operations
- */
 export declare function fileStorageRoutes(app: Hono<{
     Bindings: Env;
 }>): void;
@@ -5246,6 +5335,46 @@ export declare function componentRoutes(app: Hono<{
 `,
     "workspace.d.ts": `export { WorkspaceContext, getWorkspaceContext, listWorkspaceEntity, getWorkspaceEntity, createWorkspaceEntity, updateWorkspaceEntity, deleteWorkspaceEntity, callAppEndpoint, initializeWorkspace, } from './core-workspace';
 export type { WorkspaceUser, ListUsersOptions, ListUsersResponse, NotifyUserParams, NotifyUserResult, ListEntityRequest, ListEntityResponse, GetEntityRequest, CreateEntityRequest, UpdateEntityRequest, DeleteEntityRequest, RegisterEntityRequest, RegisterAppRequest, RegisterComponentRequest, RegisterScheduleRequest, RegisterWorkflowRequest, RegisterEndpointRequest, RegisterIntegrationRequest, CallAppEndpointOptions, CallAppEndpointResult, RegisterAgentRequest as WorkspaceRegisterAgentRequest, } from './core-workspace';
+`,
+    "client.d.ts": `/**
+ * Framework client entry: browser-side helpers an app's frontend imports as
+ * \`@runworkai/framework/client\`, so app code never carries this plumbing
+ * itself.
+ *
+ * Analytics: what people do in the app, reported to the workspace.
+ *
+ * Envelope follows the Segment Spec (the de-facto standard Google Analytics,
+ * Mixpanel, PostHog and friends all map to), so nothing here needs to change
+ * if the workspace later forwards events to a real analytics tool.
+ *
+ * The app does not interpret events. \`/api/analytics\` stamps the app's
+ * identity and forwards to the workspace, which decides what each one means.
+ * Today a \`page\` counts as one USE of the app, the multiplier behind a
+ * standalone app's value in the workspace's reports. \`track\` events are kept
+ * for a later analytics surface.
+ *
+ * A page load is reported here because the document is served before the
+ * app's Worker runs, leaving no server-side trace otherwise. Once per
+ * document, not per route change: the workspace counts an opened tool, and a
+ * person navigating inside it is still one use.
+ *
+ * Fire-and-forget. Nothing here may ever affect the person using the app.
+ */
+/** Record a custom event. Use a flat Title Case name ("Report Exported") and put variables in properties. */
+export declare function track(event: string, properties?: Record<string, unknown>): void;
+/** Record a named screen or view inside the app. */
+export declare function screen(name: string, properties?: Record<string, unknown>): void;
+/**
+ * Tell the workspace who this browser belongs to, in the APP's own terms.
+ * A claim, recorded as data; the workspace never grants anything on it.
+ */
+export declare function identify(userId: string, traits?: Record<string, unknown>): void;
+/** Attach this person to a company, account or team the app knows about. */
+export declare function group(groupId: string, traits?: Record<string, unknown>): void;
+/** Link a past anonymous identity to a known one. */
+export declare function alias(userId: string, previousId?: string): void;
+/** Record that this app was opened. Called once automatically on load. */
+export declare function page(): void;
 `,
     "core-scheduler.d.ts": `/**
  * Core Scheduled Jobs Framework
@@ -5897,8 +6026,6 @@ export type Doc<T> = {
  * - Security validation on all field names
  */
 export declare class EntityDO extends DurableObject<Env> {
-    ctx: DurableObjectState;
-    env: Env;
     private _tableReady;
     private _migrationDone;
     constructor(ctx: DurableObjectState, env: Env);
@@ -6903,13 +7030,6 @@ export declare function toChannelName(appName: string): string;
  * these entries in the observability timeline.
  */
 export declare function flog(level: 'info' | 'warn' | 'error', system: string, message: string, data?: Record<string, unknown>): void;
-/**
- * Emit an event to the workspace unified event stream.
- * Fire-and-forget: uses ctx.waitUntil so it doesn't block the response.
- * Silently skips if workspace env vars are not configured (standalone mode).
- *
- * Automatically routes events to a channel derived from APP_NAME when available.
- */
 export declare function emitEvent(ctx: WaitUntilContext, env: EventEnv, event: EmitEventParams): void;
 export {};
 `,
@@ -6984,7 +7104,109 @@ export declare const isStr: (s: unknown) => s is string;
  * that would cause structured clone to fail in ctx.storage.put().
  */
 export declare function safeClone<T>(value: T, fallback?: T): T;
-export declare function platformFetch(env: Env, url: string | URL, init?: RequestInit): Promise<Response>;
+/**
+ * Platform fetch - routes requests through WorkspaceObject DO for production workers.
+ *
+ * Workers for Platforms (WfP) workers cannot reliably make HTTP requests back to their
+ * parent platform worker (they get 522 timeouts). This utility routes platform API calls
+ * through the WorkspaceObject Durable Object binding, which works across worker boundaries.
+ *
+ * Supported paths:
+ * - /api/proxy/integrations/* - Integration proxy (Nango)
+ * - /api/proxy/openai/* - AI Gateway proxy
+ * - /api/storage/presign - Storage presigned URLs
+ *
+ * For preview containers (DEPLOYMENT_MODE !== 'production'), uses standard fetch.
+ *
+ * @example
+ * \`\`\`typescript
+ * // Instead of:
+ * const response = await fetch('https://runwork.ai/api/proxy/integrations/proxy/contacts', options);
+ *
+ * // Use:
+ * const response = await platformFetch(env, 'https://runwork.ai/api/proxy/integrations/proxy/contacts', options);
+ * \`\`\`
+ */
+/**
+ * What the app was doing when it made a call.
+ *
+ * Internal plumbing, deliberately not exported from the package: app authors
+ * never set this, the framework establishes it at each entry point (schedule
+ * tick, workflow run, route handler, agent turn) and \`platformFetch\` below
+ * reads it. It lives beside \`platformFetch\` because that is its only consumer.
+ *
+ * WHY IT EXISTS: usage rows record \`appId\` and \`userId\` and nothing about what
+ * was executing, so a HubSpot call made by a nightly schedule cannot be told
+ * apart from one a person made from their own agent. \`runId\` is the field that
+ * cannot be reconstructed later: it links one run's AI calls and integration
+ * calls together, which is what per-run cost is built from.
+ *
+ * Design: docs/plans/2026-08-28-baselines-capture-redesign.md section 4.1.
+ */
+export interface RunContext {
+    /**
+     * WHAT was executing. Only constructs the framework itself runs, never
+     * "where the caller was" (a browser, MCP, the CLI): that is a different
+     * question and \`audit_logs.actor_type\` owns it.
+     */
+    kind: 'schedule' | 'workflow' | 'endpoint' | 'route' | 'agent';
+    /**
+     * Human-readable name, following the convention the audit rows already use:
+     * a schedule/workflow/agent slug, or \`METHOD /path\` for endpoints and routes.
+     *
+     * OMITTED rather than defaulted when genuinely unknown. A placeholder string
+     * like 'unknown' becomes a value every query has to filter out, and it is
+     * indistinguishable from an app that named something 'unknown'.
+     */
+    name?: string;
+    /**
+     * App-local registry key, so a usage row joins back to a registration. The
+     * app id is a column of its own, so this is the part after it: a slug for
+     * schedules, workflows and agents, \`METHOD /path\` for endpoints.
+     */
+    resourceKey?: string;
+    /** One id shared by everything emitted inside this execution. */
+    runId: string;
+    /** The enclosing run, for workflow steps, nested calls and sub-agents. */
+    parentRunId?: string;
+    trigger?: 'cron' | 'manual' | 'webhook' | 'chat' | 'api';
+    /**
+     * The person who started this run. Named to match the governance program's
+     * \`DelegationChain.triggererUserId\` (\`worker/types/permissions.ts\`), which is
+     * the same fact: one name for it across both programs.
+     *
+     * ATTRIBUTION, NEVER AUTHORITY. This travels on a header from the app, behind
+     * the shared WORKSPACE_API_KEY, so an app can put any user id here. The
+     * platform may RECORD it; nothing may ever AUTHORIZE on it. Whose authority a
+     * run borrows is resolved platform-side by PermissionService, not stated by
+     * the caller.
+     */
+    triggererUserId?: string;
+    attempt?: number;
+}
+/** Header carrying the context to the platform side, which writes the audit row. */
+export declare const RUN_CONTEXT_HEADER = "x-runwork-run-context";
+/**
+ * Run \`fn\` with \`ctx\` as the ambient execution context.
+ *
+ * Nesting is automatic: entering a context inside another records the outer
+ * \`runId\` as \`parentRunId\` unless the caller set one. That is what makes a
+ * sub-agent's calls point at the run that started it. Re-entering the SAME
+ * run id is not nesting (a workflow resumes into its own run across wake-ups)
+ * and must not make a run its own parent.
+ */
+export declare function withRunContext<T>(ctx: RunContext, fn: () => T): T;
+/** The current execution context, or undefined outside any entry point. */
+export declare function getRunContext(): RunContext | undefined;
+/**
+ * Merge the context header into request headers.
+ *
+ * One serialised header rather than several, so adding a field never needs a
+ * matching change in the platform's parsing. Never overwrites a header the
+ * caller set: a caller that knows its own context beats the ambient one.
+ */
+export declare function withRunContextHeader(init?: HeadersInit): HeadersInit | undefined;
+export declare function platformFetch(env: Env, url: string | URL, rawInit?: RequestInit): Promise<Response>;
 /**
  * Workspace API fetch - routes workspace service requests through WorkspaceObject DO
  * for production WfP workers, avoiding 522 recursive invocation errors.
@@ -6997,7 +7219,7 @@ export declare function platformFetch(env: Env, url: string | URL, init?: Reques
  * @param path - Workspace API sub-path (e.g., '/ingest-event')
  * @param init - Standard fetch options
  */
-export declare function workspaceApiFetch(env: Pick<Env, 'WORKSPACE_API_URL' | 'WORKSPACE_API_KEY' | 'WORKSPACE_ID' | 'DEPLOYMENT_MODE' | 'WorkspaceObject'>, path: string, init?: RequestInit): Promise<Response>;
+export declare function workspaceApiFetch(env: Pick<Env, 'WORKSPACE_API_URL' | 'WORKSPACE_API_KEY' | 'WORKSPACE_ID' | 'DEPLOYMENT_MODE' | 'WorkspaceObject'>, path: string, rawInit?: RequestInit): Promise<Response>;
 `,
     "workflows.d.ts": `import type { WorkflowDefinition } from './core-workflow-types';
 /**
@@ -7192,7 +7414,7 @@ export declare class BaseAgent extends AIChatAgent<Env> {
  * - Types are defined in core-workflow-types.ts
  * - Native DO-based implementation is in core-workflow-instance.ts and core-workflow-coordinator.ts
  */
-import type { Env } from './core-utils';
+import { type Env } from './core-utils';
 export type { WorkflowResult, WorkflowStatus, WorkflowInstanceInfo, WorkflowDefinition, WorkflowContext, WorkflowStepUtilities, StepOptions, WaitEventOptions, WorkflowLogger, WorkflowState, WorkflowStatusResponse, } from './core-workflow-types';
 import type { WorkflowInstanceInfo } from './core-workflow-types';
 /**
@@ -7741,8 +7963,8 @@ export declare const integrationApiSchema: z.ZodObject<{
     endpoint: z.ZodString;
     data: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
 }, "strip", z.ZodTypeAny, {
-    method: "POST" | "GET" | "PUT" | "PATCH" | "DELETE";
     endpoint: string;
+    method: "POST" | "GET" | "PUT" | "PATCH" | "DELETE";
     data?: Record<string, unknown> | undefined;
 }, {
     endpoint: string;
@@ -7983,7 +8205,7 @@ function createKeyboardListener() {
 }
 
 // src/generated/version.ts
-var VERSION = "0.25.2";
+var VERSION = "0.26.0";
 
 // src/commands/dev.ts
 var exports_dev = {};
@@ -8064,6 +8286,7 @@ async function execDev(options) {
     await ensureGitCredentialHelper(creds.baseUrl);
   }
   ensureRunworkRemote(cwd, client.getGitRemoteUrl(config.workspaceId, config.appId));
+  let editsUnprotected = false;
   const oldManifest = await loadManifest(cwd);
   if (oldManifest) {
     const userEdits = await detectUserEdits(cwd, oldManifest);
@@ -8087,9 +8310,22 @@ async function execDev(options) {
         execFileSync("git", ["add", "--", ...userEdits], { stdio: "pipe" });
         execFileSync("git", ["commit", "-m", "sync: user edits"], { stdio: "pipe" });
       } catch {}
+      editsUnprotected = hasTrackedChanges(cwd);
+      if (editsUnprotected) {
+        if (useJson) {
+          jsonLine({
+            event: "startup",
+            phase: "user_edits_unprotected",
+            timestamp: ts(),
+            warning: "Could not commit your edits (a commit hook or lock may be interfering). Skipping the template update so they are not lost."
+          });
+        } else {
+          console.warn(yellow("Could not commit your edits (a commit hook or lock may be interfering). Skipping the template update so they are not lost."));
+        }
+      }
     }
   }
-  if (!noSync) {
+  if (!noSync && !editsUnprotected) {
     if (useJson) {
       jsonLine({ event: "startup", phase: "template_update", timestamp: ts() });
     } else {
@@ -8912,6 +9148,53 @@ var init_dev = __esm(() => {
   devCommand.addCommand(devAttachCommand);
 });
 
+// src/agents/detection-probes.ts
+function powershellQuote(value) {
+  return `'${value.replace(/'/g, "''")}'`;
+}
+function isValidBundleId(id) {
+  return /^[A-Za-z0-9][A-Za-z0-9.-]*$/.test(id);
+}
+function macosBundleIdProbeScript(id) {
+  return `p=$(mdfind "kMDItemCFBundleIdentifier == '${id}'" 2>/dev/null | head -1); ` + `if [ -n "$p" ]; then exit 0; fi; ` + `for a in /Applications/*.app "$HOME"/Applications/*.app; do ` + `[ -e "$a" ] || continue; ` + `if [ "$(/usr/libexec/PlistBuddy -c 'Print :CFBundleIdentifier' "$a/Contents/Info.plist" 2>/dev/null)" = "${id}" ]; then exit 0; fi; ` + `done; exit 1`;
+}
+function appxPackageProbeScript(pkg) {
+  return `$p = Get-AppxPackage -Name ${powershellQuote(pkg)} -ErrorAction SilentlyContinue; if ($null -ne $p) { exit 0 } exit 1`;
+}
+function startAppProbeScript(pattern) {
+  const p = powershellQuote(pattern);
+  return `$a = Get-StartApps -ErrorAction SilentlyContinue | Where-Object { $_.Name -like ${p} -or $_.AppID -like ${p} } | Select-Object -First 1; if ($null -ne $a) { exit 0 } exit 1`;
+}
+function isCommandNotFoundExit(code) {
+  return typeof code === "number" && COMMAND_NOT_FOUND_EXIT_CODES.includes(code);
+}
+function expandWindowsPathTemplate(path2, resolved) {
+  for (const [placeholder, defaults] of Object.entries(WINDOWS_PATH_PLACEHOLDERS)) {
+    if (!path2.startsWith(placeholder))
+      continue;
+    const rest = path2.slice(placeholder.length).replace(/^[/\\]/, "");
+    const fromEnv = resolved[placeholder];
+    if (fromEnv) {
+      return { path: `${fromEnv.replace(/[/\\]+$/, "")}\\${rest.replace(/\//g, "\\")}`, needsHomeJoin: false };
+    }
+    if ("absoluteDefault" in defaults) {
+      return { path: `${defaults.absoluteDefault}\\${rest.replace(/\//g, "\\")}`, needsHomeJoin: false };
+    }
+    return { path: `${defaults.homeRelativeDefault}/${rest}`, needsHomeJoin: true };
+  }
+  return { path: path2, needsHomeJoin: !/^([A-Za-z]:[\\/]|\\\\|\/)/.test(path2) };
+}
+var PATH_REFRESH_FAILED_MARKER = "__runwork_path_refresh_failed__", WINDOWS_PATH_REFRESH, COMMAND_NOT_FOUND_EXIT_CODES, WINDOWS_PATH_PLACEHOLDERS;
+var init_detection_probes = __esm(() => {
+  WINDOWS_PATH_REFRESH = "try { $env:Path = [Environment]::GetEnvironmentVariable('Path','Machine') + ';' + " + "[Environment]::GetEnvironmentVariable('Path','User') + ';' + $env:Path } " + `catch { Write-Output '${PATH_REFRESH_FAILED_MARKER}' }; `;
+  COMMAND_NOT_FOUND_EXIT_CODES = [127, 9009];
+  WINDOWS_PATH_PLACEHOLDERS = {
+    "%APPDATA%": { homeRelativeDefault: "AppData/Roaming" },
+    "%LOCALAPPDATA%": { homeRelativeDefault: "AppData/Local" },
+    "%ProgramFiles%": { absoluteDefault: "C:\\Program Files" }
+  };
+});
+
 // src/utils/which.ts
 import { platform } from "os";
 import { isAbsolute } from "path";
@@ -8932,11 +9215,25 @@ function whichAllLines(name) {
     return [];
   }
 }
-function isBinaryRunnable(binary) {
+function classifyProbeError(err) {
+  const e = err;
+  if (!e || typeof e !== "object")
+    return "spawn-error";
+  if (e.signal || e.code === "ETIMEDOUT")
+    return "timeout";
+  if (e.code === "ENOENT")
+    return "not-found";
+  if (isCommandNotFoundExit(e.status))
+    return "not-found";
+  if (typeof e.status === "number")
+    return "exit-nonzero";
+  return "spawn-error";
+}
+function probeBinaryRunnable(binary) {
   const cached = runnableCache.get(binary);
   if (cached !== undefined)
     return cached;
-  let ok = false;
+  let probe;
   try {
     const spec = toSpawnSpec(binary, ["--version"]);
     execFileSync(spec.command, spec.args, {
@@ -8944,12 +9241,16 @@ function isBinaryRunnable(binary) {
       timeout: RUNNABLE_PROBE_TIMEOUT_MS,
       ...spec.windowsVerbatimArguments ? { windowsVerbatimArguments: true } : {}
     });
-    ok = true;
-  } catch {
-    ok = false;
+    probe = { runnable: true, reason: "ran" };
+  } catch (err) {
+    probe = { runnable: false, reason: classifyProbeError(err) };
   }
-  runnableCache.set(binary, ok);
-  return ok;
+  if (probe.reason !== "timeout")
+    runnableCache.set(binary, probe);
+  return probe;
+}
+function isBinaryRunnable(binary) {
+  return probeBinaryRunnable(binary).runnable;
 }
 function toSpawnSpec(binary, args) {
   if (isAbsolute(binary)) {
@@ -8997,6 +9298,7 @@ function isAppRunning(appName) {
 var RUNNABLE_PROBE_TIMEOUT_MS = 1e4, runnableCache;
 var init_which = __esm(() => {
   init_subprocess();
+  init_detection_probes();
   runnableCache = new Map;
 });
 
@@ -9393,7 +9695,7 @@ var init_registry_data = __esm(() => {
           {
             method: "path",
             target: {
-              windows: "AppData/Roaming/Claude/claude_desktop_config.json",
+              windows: "%APPDATA%/Claude/claude_desktop_config.json",
               linux: ".config/Claude/claude_desktop_config.json"
             }
           }
@@ -9406,7 +9708,7 @@ var init_registry_data = __esm(() => {
       skillsPaths: { global: ".claude/skills", project: ".claude/skills" },
       mcpConfigPath: {
         macos: "Library/Application Support/Claude/claude_desktop_config.json",
-        windows: "AppData/Roaming/Claude/claude_desktop_config.json",
+        windows: "%APPDATA%/Claude/claude_desktop_config.json",
         linux: ".config/Claude/claude_desktop_config.json"
       },
       mcpConfigKey: "mcpServers",
@@ -9716,8 +10018,8 @@ var init_registry_data = __esm(() => {
         target: [
           { method: "binary", target: "windsurf" },
           { method: "path", target: { macos: "/Applications/Windsurf.app" } },
-          { method: "path", target: { windows: "AppData/Local/Programs/Windsurf" } },
-          { method: "path", target: { windows: "C:\\Program Files\\Windsurf" } }
+          { method: "path", target: { windows: "%LOCALAPPDATA%/Programs/Windsurf" } },
+          { method: "path", target: { windows: "%ProgramFiles%/Windsurf" } }
         ]
       },
       launch: { app: { macos: "Windsurf", windows: "Windsurf" } },
@@ -9797,7 +10099,14 @@ var init_registry_data = __esm(() => {
       name: "GitHub Copilot (VS Code)",
       description: "GitHub's AI pair programmer in VS Code",
       category: "extension",
-      detection: { method: "binary", target: "code" },
+      detection: {
+        method: "path",
+        target: {
+          macos: "Library/Application Support/Code/User/globalStorage/github.copilot",
+          windows: "%APPDATA%/Code/User/globalStorage/github.copilot",
+          linux: ".config/Code/User/globalStorage/github.copilot"
+        }
+      },
       launch: { app: { macos: "Visual Studio Code", windows: "Code" }, cli: "code" },
       logo: "vscode",
       downloadUrl: "https://marketplace.visualstudio.com/items?itemName=GitHub.copilot",
@@ -9820,7 +10129,7 @@ var init_registry_data = __esm(() => {
       name: "GitHub Copilot CLI",
       description: "GitHub Copilot in the terminal",
       category: "cli",
-      detection: { method: "binary", target: "gh" },
+      detection: { method: "binary", target: "copilot" },
       logo: "vscode",
       skillsPaths: { global: ".copilot/skills", project: ".github/skills" },
       mcpConfigPath: ".copilot/mcp-config.json",
@@ -9841,7 +10150,7 @@ var init_registry_data = __esm(() => {
     { slug: "droid", name: "Droid", aliases: ["Droid (Factory AI)"], description: "Factory AI's coding agent", category: "cli", detection: { method: "binary", target: "droid" }, skillsPaths: { global: ".factory/skills", project: ".factory/skills" } },
     { slug: "firebender", name: "Firebender", description: "AI coding agent", category: "cli", detection: { method: "binary", target: "firebender" }, skillsPaths: { global: ".firebender/skills", project: ".firebender/skills" } },
     { slug: "goose", name: "Goose", description: "AI coding agent by Block", category: "cli", detection: { method: "binary", target: "goose" }, skillsPaths: { global: ".config/goose/skills", project: ".goose/skills" } },
-    { slug: "hermes", name: "Hermes", aliases: ["hermes-agent"], description: "AI coding agent", category: "cli", detection: { method: "binary", target: "hermes" }, skillsPaths: { global: ".hermes/skills", project: ".hermes/skills" } },
+    { slug: "hermes", name: "Hermes", aliases: ["hermes-agent"], description: "AI coding agent", category: "cli", detection: { method: "binary", target: "hermes" }, launch: { cli: "hermes" }, skillsPaths: { global: ".hermes/skills", project: ".hermes/skills" } },
     { slug: "iflow", name: "iFlow CLI", aliases: ["iflow-cli"], description: "AI coding agent", category: "cli", detection: { method: "binary", target: "iflow" }, skillsPaths: { global: ".iflow/skills", project: ".iflow/skills" } },
     { slug: "junie", name: "Junie", description: "JetBrains AI coding agent", category: "ide", detection: { method: "binary", target: "junie" }, skillsPaths: { global: ".junie/skills", project: ".junie/skills" } },
     { slug: "kilocode", name: "Kilo Code", aliases: ["kilo"], description: "AI coding agent", category: "extension", detection: { method: "binary", target: "kilocode" }, skillsPaths: { global: ".kilocode/skills", project: ".kilocode/skills" } },
@@ -11034,11 +11343,33 @@ function readJsonConfig(filePath) {
     return {};
   try {
     return JSON.parse(readFileSync23(filePath, "utf-8"));
-  } catch {
+  } catch (err) {
+    console.warn(`  [config] ${filePath} is not valid JSON: ${err instanceof Error ? err.message : err}`);
     return {};
   }
 }
+function existingContentIsUnparseable(filePath) {
+  if (!existsSync28(filePath))
+    return { bad: false };
+  let raw;
+  try {
+    raw = readFileSync23(filePath, "utf-8");
+  } catch {
+    return { bad: false };
+  }
+  if (raw.trim() === "")
+    return { bad: false };
+  try {
+    JSON.parse(raw);
+    return { bad: false };
+  } catch (cause) {
+    return { bad: true, cause };
+  }
+}
 function writeJsonConfig(filePath, config) {
+  const { bad, cause } = existingContentIsUnparseable(filePath);
+  if (bad)
+    throw new ConfigParseError(filePath, cause);
   mkdirSync14(dirname7(filePath), { recursive: true });
   writeFileSync14(filePath, JSON.stringify(config, null, 2) + `
 `);
@@ -11082,9 +11413,20 @@ function mergeJsonMcpServers(filePath, servers, topKey) {
   writeJsonConfig(filePath, config);
   return true;
 }
+var ConfigParseError;
 var init_json_config = __esm(() => {
   init_types();
   init_hash();
+  ConfigParseError = class ConfigParseError extends Error {
+    filePath;
+    cause;
+    constructor(filePath, cause) {
+      super(`${filePath} is not valid JSON, so Runwork left it untouched. ` + `Fix the file (or move it aside) and run the command again.`);
+      this.filePath = filePath;
+      this.cause = cause;
+      this.name = "ConfigParseError";
+    }
+  };
 });
 
 // src/agents/utils/skill-removal.ts
@@ -11639,29 +11981,11 @@ function vlog(...args) {
 }
 var verbose = false;
 
-// src/agents/detection-probes.ts
-function powershellQuote(value) {
-  return `'${value.replace(/'/g, "''")}'`;
-}
-function isValidBundleId(id) {
-  return /^[A-Za-z0-9][A-Za-z0-9.-]*$/.test(id);
-}
-function macosBundleIdProbeScript(id) {
-  return `p=$(mdfind "kMDItemCFBundleIdentifier == '${id}'" 2>/dev/null | head -1); ` + `if [ -n "$p" ]; then exit 0; fi; ` + `for a in /Applications/*.app "$HOME"/Applications/*.app; do ` + `[ -e "$a" ] || continue; ` + `if [ "$(/usr/libexec/PlistBuddy -c 'Print :CFBundleIdentifier' "$a/Contents/Info.plist" 2>/dev/null)" = "${id}" ]; then exit 0; fi; ` + `done; exit 1`;
-}
-function appxPackageProbeScript(pkg) {
-  return `$p = Get-AppxPackage -Name ${powershellQuote(pkg)} -ErrorAction SilentlyContinue; if ($null -ne $p) { exit 0 } exit 1`;
-}
-function startAppProbeScript(pattern) {
-  const p = powershellQuote(pattern);
-  return `$a = Get-StartApps -ErrorAction SilentlyContinue | Where-Object { $_.Name -like ${p} -or $_.AppID -like ${p} } | Select-Object -First 1; if ($null -ne $a) { exit 0 } exit 1`;
-}
-
 // src/agents/detection.ts
 import { execFile } from "child_process";
 import { existsSync as existsSync31 } from "fs";
 import { homedir as homedir8, platform as platform3 } from "os";
-import { isAbsolute as isAbsolute3, join as join25 } from "path";
+import { join as join25 } from "path";
 import { promisify } from "util";
 function isWindows() {
   return platform3() === "win32";
@@ -11682,7 +12006,12 @@ function resolveDetectionPath(target) {
   const resolved = resolvePlatformString(target);
   if (!resolved)
     return null;
-  return isAbsolute3(resolved) ? resolved : join25(homedir8(), resolved);
+  const expanded = expandWindowsPathTemplate(resolved, {
+    "%APPDATA%": process.env.APPDATA,
+    "%LOCALAPPDATA%": process.env.LOCALAPPDATA,
+    "%ProgramFiles%": process.env.ProgramFiles
+  });
+  return expanded.needsHomeJoin ? join25(homedir8(), expanded.path) : expanded.path;
 }
 function checkPath(target) {
   const absolute = resolveDetectionPath(target);
@@ -11762,11 +12091,74 @@ var init_detection = __esm(() => {
   init_which();
   init_registry_data();
   init_registry();
+  init_detection_probes();
   NOT_DETECTED = { detected: false };
 });
 
+// src/agents/transcript-sources.ts
+import { accessSync, constants, statSync as statSync4 } from "fs";
+function classifyFsErrorCode(code) {
+  if (code === "ENOENT" || code === "ENOTDIR")
+    return "missing-dir";
+  if (code === "EACCES" || code === "EPERM")
+    return "permission-denied";
+  return "error";
+}
+function errorCode(err) {
+  const e = err;
+  return e && typeof e === "object" && typeof e.code === "string" ? e.code : undefined;
+}
+function probeTranscriptSource(source) {
+  if (source.available && !source.available()) {
+    return { status: "missing-tool", path: source.path, detail: source.tool ?? "unknown tool" };
+  }
+  try {
+    statSync4(source.path);
+  } catch (err) {
+    return { status: classifyFsErrorCode(errorCode(err)), path: source.path, detail: errorCode(err) };
+  }
+  try {
+    accessSync(source.path, source.kind === "dir" ? constants.R_OK | constants.X_OK : constants.R_OK);
+  } catch (err) {
+    return { status: classifyFsErrorCode(errorCode(err)), path: source.path, detail: errorCode(err) };
+  }
+  return { status: "ok", path: source.path };
+}
+function diagnoseTranscriptRead(agent, thrown) {
+  const probe = summarizeTranscriptSources(agent.transcriptSources?.() ?? []);
+  const base = { agentSlug: agent.slug, sessions: null };
+  if (probe.status !== "ok" && probe.status !== "no-reader") {
+    return {
+      ...base,
+      status: probe.status,
+      path: probe.path,
+      ...probe.detail ? { detail: probe.detail } : {}
+    };
+  }
+  if (thrown !== undefined) {
+    return { ...base, status: "error", detail: thrown instanceof Error ? thrown.message : String(thrown) };
+  }
+  return probe.status === "ok" ? { ...base, status: "error", path: probe.path, detail: "read returned no result" } : { ...base, status: "no-reader" };
+}
+function transcriptSourcesReadable(sources) {
+  return summarizeTranscriptSources(sources).status === "ok";
+}
+function summarizeTranscriptSources(sources) {
+  if (sources.length === 0)
+    return { status: "no-reader", path: "" };
+  const probes = sources.map(probeTranscriptSource);
+  const rank = ["permission-denied", "missing-tool", "error", "ok", "missing-dir"];
+  for (const status of rank) {
+    const hit = probes.find((p) => p.status === status);
+    if (hit)
+      return hit;
+  }
+  return probes[0];
+}
+var init_transcript_sources = () => {};
+
 // src/agents/claude-code.ts
-import { chmodSync, existsSync as existsSync32, mkdirSync as mkdirSync16, readFileSync as readFileSync25, readdirSync as readdirSync7, rmSync as rmSync5, statSync as statSync4, writeFileSync as writeFileSync16 } from "fs";
+import { chmodSync, existsSync as existsSync32, mkdirSync as mkdirSync16, readFileSync as readFileSync25, readdirSync as readdirSync7, rmSync as rmSync5, statSync as statSync5, writeFileSync as writeFileSync16 } from "fs";
 import { join as join26 } from "path";
 import { homedir as homedir9 } from "os";
 function getPluginJson() {
@@ -11810,6 +12202,7 @@ var init_claude_code = __esm(() => {
   init_instruction_hint();
   init_session_start_hook();
   init_detection();
+  init_transcript_sources();
   ClaudeCodeAdapter = class ClaudeCodeAdapter extends RegistryDetectedAdapter {
     name = "Claude Code";
     slug = "claude-code";
@@ -11986,8 +12379,7 @@ ${instructions}`;
       }
       if (!hadFile && !config.modelPreference && !config.permissionRules)
         return;
-      mkdirSync16(join26(settingsPath, ".."), { recursive: true });
-      writeFileSync16(settingsPath, JSON.stringify(settings, null, 2));
+      writeJsonConfig(settingsPath, settings);
     }
     async readManagedBlock(_scope) {
       return;
@@ -12034,7 +12426,7 @@ ${instructions}`;
                   delete settings.enabledPlugins[key];
               }
             }
-            writeFileSync16(settingsPath, JSON.stringify(settings, null, 2));
+            writeJsonConfig(settingsPath, settings);
           } catch {}
         }
         const pluginDir = this.getPluginDir();
@@ -12108,7 +12500,7 @@ ${instructions}`;
             const filePath = join26(cwdPath, file);
             let stat;
             try {
-              stat = statSync4(filePath);
+              stat = statSync5(filePath);
             } catch {
               continue;
             }
@@ -12200,9 +12592,15 @@ ${instructions}`;
         return null;
       }
     }
+    transcriptRoot() {
+      return join26(homedir9(), ".claude", "projects");
+    }
+    transcriptSources() {
+      return [{ path: this.transcriptRoot(), kind: "dir" }];
+    }
     async readSessionDigests(sinceISO) {
       try {
-        const projectsDir = join26(homedir9(), ".claude", "projects");
+        const projectsDir = this.transcriptRoot();
         if (!existsSync32(projectsDir))
           return null;
         const sinceMs = sinceISO ? new Date(sinceISO).getTime() : 0;
@@ -12227,7 +12625,7 @@ ${instructions}`;
             const filePath = join26(cwdPath, file);
             let stat;
             try {
-              stat = statSync4(filePath);
+              stat = statSync5(filePath);
             } catch {
               continue;
             }
@@ -12251,8 +12649,8 @@ ${instructions}`;
     }
     async listSessions(sinceISO) {
       try {
-        const projectsDir = join26(homedir9(), ".claude", "projects");
-        if (!existsSync32(projectsDir))
+        const projectsDir = this.transcriptRoot();
+        if (!transcriptSourcesReadable(this.transcriptSources()))
           return null;
         const sinceMs = sinceISO ? new Date(sinceISO).getTime() : 0;
         let cwdEntries;
@@ -12276,7 +12674,7 @@ ${instructions}`;
             const filePath = join26(cwdPath, file);
             let stat;
             try {
-              stat = statSync4(filePath);
+              stat = statSync5(filePath);
             } catch {
               continue;
             }
@@ -12314,7 +12712,7 @@ ${instructions}`;
     }
     async readSkillUsage(lastSyncAt) {
       try {
-        const projectsDir = join26(homedir9(), ".claude", "projects");
+        const projectsDir = this.transcriptRoot();
         if (!existsSync32(projectsDir))
           return null;
         const sinceMs = lastSyncAt ? new Date(lastSyncAt).getTime() : 0;
@@ -12349,7 +12747,7 @@ ${instructions}`;
             const filePath = join26(cwdPath, file);
             let fileStat;
             try {
-              fileStat = statSync4(filePath);
+              fileStat = statSync5(filePath);
             } catch {
               continue;
             }
@@ -12605,7 +13003,7 @@ var init_claude_desktop_plugin_tree = __esm(() => {
 });
 
 // src/agents/claude-desktop.ts
-import { existsSync as existsSync34, mkdtempSync as mkdtempSync3, readdirSync as readdirSync8, readFileSync as readFileSync26, rmSync as rmSync7, statSync as statSync5, writeFileSync as writeFileSync18, mkdirSync as mkdirSync18 } from "fs";
+import { existsSync as existsSync34, mkdtempSync as mkdtempSync3, readdirSync as readdirSync8, readFileSync as readFileSync26, rmSync as rmSync7, statSync as statSync6, writeFileSync as writeFileSync18, mkdirSync as mkdirSync18 } from "fs";
 import { dirname as dirname9, join as join28 } from "path";
 import { homedir as homedir10, platform as platform4, tmpdir as tmpdir3 } from "os";
 function isRunworkRpmPluginName(name) {
@@ -12764,6 +13162,7 @@ function setCoworkPluginEnabled(pluginsDir, enabled) {
 var PLUGIN_NAME2 = "runwork", PLUGIN_VERSION2 = "1.0.0", PLUGIN_DESCRIPTION = "Skills and tools from your Runwork workspace", PLUGIN_AUTHOR_NAME = "Runwork", ClaudeDesktopAdapter;
 var init_claude_desktop = __esm(() => {
   init_types();
+  init_transcript_sources();
   init_session_digest();
   init_json_config();
   init_instruction_hint();
@@ -12926,7 +13325,7 @@ var init_claude_desktop = __esm(() => {
           prefs.ccdScheduledTasksEnabled = false;
         }
       }
-      writeFileSync18(configPath, JSON.stringify(desktopConfig, null, 2));
+      writeJsonConfig(configPath, desktopConfig);
     }
     async cleanup(_scope, _manifest) {
       removeRunworkMcpServers(getMcpConfigPath(), "mcpServers");
@@ -13037,7 +13436,7 @@ var init_claude_desktop = __esm(() => {
                   const filePath = join28(projPath, file);
                   let stat;
                   try {
-                    stat = statSync5(filePath);
+                    stat = statSync6(filePath);
                   } catch {
                     continue;
                   }
@@ -13062,10 +13461,13 @@ var init_claude_desktop = __esm(() => {
         return null;
       }
     }
+    transcriptSources() {
+      return [{ path: getCoworkBaseDir(), kind: "dir" }];
+    }
     async listSessions(sinceISO) {
       try {
         const baseDir = getCoworkBaseDir();
-        if (!existsSync34(baseDir))
+        if (!transcriptSourcesReadable(this.transcriptSources()))
           return null;
         const sinceMs = sinceISO ? new Date(sinceISO).getTime() : 0;
         let accounts;
@@ -13101,7 +13503,7 @@ var init_claude_desktop = __esm(() => {
                   const filePath = join28(projPath, file);
                   let stat;
                   try {
-                    stat = statSync5(filePath);
+                    stat = statSync6(filePath);
                   } catch {
                     continue;
                   }
@@ -13242,7 +13644,7 @@ var init_claude_desktop = __esm(() => {
             continue;
           const orgPath = join28(baseDir, orgDir);
           try {
-            if (!statSync5(orgPath).isDirectory())
+            if (!statSync6(orgPath).isDirectory())
               continue;
           } catch {
             continue;
@@ -13252,7 +13654,7 @@ var init_claude_desktop = __esm(() => {
               continue;
             const userPath = join28(orgPath, userDir);
             try {
-              if (!statSync5(userPath).isDirectory())
+              if (!statSync6(userPath).isDirectory())
                 continue;
             } catch {
               continue;
@@ -13380,6 +13782,7 @@ var init_cursor = __esm(async () => {
   init_skill_removal();
   init_json_config();
   init_detection();
+  init_transcript_sources();
   await init_sqlite();
   CursorAdapter = class CursorAdapter extends RegistryDetectedAdapter {
     name = "Cursor";
@@ -13638,6 +14041,16 @@ ${instructions}`;
         return null;
       }
     }
+    transcriptSources() {
+      return [
+        {
+          path: this.globalStorageDbPath(),
+          kind: "file",
+          tool: "sqlite",
+          available: sqliteAvailable
+        }
+      ];
+    }
     globalStorageDbPath() {
       const os2 = platform5();
       if (os2 === "darwin") {
@@ -13665,7 +14078,7 @@ ${instructions}`;
     async listSessions(sinceISO) {
       try {
         const dbPath = this.globalStorageDbPath();
-        if (!existsSync35(dbPath) || !sqliteAvailable())
+        if (!transcriptSourcesReadable(this.transcriptSources()))
           return null;
         const rows = queryReadonlySqlite(dbPath, `SELECT json_object('id', json_extract(value,'$.composerId'), 'name', json_extract(value,'$.name'), 'createdAt', json_extract(value,'$.createdAt'), 'lastUpdatedAt', json_extract(value,'$.lastUpdatedAt')) FROM cursorDiskKV WHERE key LIKE 'composerData:%'`);
         const sinceMs = sinceISO ? new Date(sinceISO).getTime() : 0;
@@ -13794,7 +14207,7 @@ ${hint}`;
 });
 
 // src/agents/codex.ts
-import { existsSync as existsSync37, mkdirSync as mkdirSync21, readdirSync as readdirSync11, readFileSync as readFileSync27, statSync as statSync6, writeFileSync as writeFileSync21 } from "fs";
+import { existsSync as existsSync37, mkdirSync as mkdirSync21, readdirSync as readdirSync11, readFileSync as readFileSync27, statSync as statSync7, writeFileSync as writeFileSync21 } from "fs";
 import { basename as basename3, join as join31 } from "path";
 import { homedir as homedir13 } from "os";
 import { parse, stringify } from "smol-toml";
@@ -13804,6 +14217,7 @@ function isRunworkManagedCodexKey(key) {
 var CodexAdapter, CodexDesktopAdapter;
 var init_codex = __esm(async () => {
   init_types();
+  init_transcript_sources();
   init_session_digest();
   init_session_listing();
   init_skill_removal();
@@ -14022,6 +14436,12 @@ var init_codex = __esm(async () => {
         return null;
       }
     }
+    transcriptRoot() {
+      return join31(homedir13(), ".codex", "sessions");
+    }
+    transcriptSources() {
+      return [{ path: this.transcriptRoot(), kind: "dir" }];
+    }
     scanRolloutActivity(sinceMs) {
       const days = new Set;
       const result = {
@@ -14032,7 +14452,7 @@ var init_codex = __esm(async () => {
         latestMs: 0,
         activeDays: []
       };
-      const sessionsDir = join31(homedir13(), ".codex", "sessions");
+      const sessionsDir = this.transcriptRoot();
       if (!existsSync37(sessionsDir))
         return result;
       const files = [];
@@ -14055,7 +14475,7 @@ var init_codex = __esm(async () => {
       for (const file of files) {
         let stat;
         try {
-          stat = statSync6(file);
+          stat = statSync7(file);
         } catch {
           continue;
         }
@@ -14122,8 +14542,8 @@ var init_codex = __esm(async () => {
     }
     async readSessionDigests(sinceISO) {
       try {
-        const sessionsDir = join31(homedir13(), ".codex", "sessions");
-        if (!existsSync37(sessionsDir))
+        const sessionsDir = this.transcriptRoot();
+        if (!transcriptSourcesReadable(this.transcriptSources()))
           return null;
         const sinceMs = sinceISO ? new Date(sinceISO).getTime() : 0;
         const files = [];
@@ -14147,7 +14567,7 @@ var init_codex = __esm(async () => {
         for (const file of files) {
           let stat;
           try {
-            stat = statSync6(file);
+            stat = statSync7(file);
           } catch {
             continue;
           }
@@ -14170,8 +14590,8 @@ var init_codex = __esm(async () => {
     }
     async listSessions(sinceISO) {
       try {
-        const sessionsDir = join31(homedir13(), ".codex", "sessions");
-        if (!existsSync37(sessionsDir))
+        const sessionsDir = this.transcriptRoot();
+        if (!transcriptSourcesReadable(this.transcriptSources()))
           return null;
         const sinceMs = sinceISO ? new Date(sinceISO).getTime() : 0;
         const files = [];
@@ -14195,7 +14615,7 @@ var init_codex = __esm(async () => {
         for (const file of files) {
           let stat;
           try {
-            stat = statSync6(file);
+            stat = statSync7(file);
           } catch {
             continue;
           }
@@ -14234,7 +14654,7 @@ var init_codex = __esm(async () => {
     }
     async readSkillUsage(lastSyncAt) {
       try {
-        const sessionsDir = join31(homedir13(), ".codex", "sessions");
+        const sessionsDir = this.transcriptRoot();
         if (!existsSync37(sessionsDir))
           return null;
         const sinceMs = lastSyncAt ? new Date(lastSyncAt).getTime() : 0;
@@ -14251,7 +14671,7 @@ var init_codex = __esm(async () => {
             if (entry.endsWith(".jsonl")) {
               let fileStat;
               try {
-                fileStat = statSync6(fullPath);
+                fileStat = statSync7(fullPath);
               } catch {
                 continue;
               }
@@ -14260,7 +14680,7 @@ var init_codex = __esm(async () => {
               this.parseRolloutForSkills(fullPath, sinceMs, skillCounts);
             } else {
               try {
-                if (statSync6(fullPath).isDirectory())
+                if (statSync7(fullPath).isDirectory())
                   walkDir2(fullPath);
               } catch {
                 continue;
@@ -14381,6 +14801,12 @@ var init_codex = __esm(async () => {
     async listSessions() {
       return null;
     }
+    async readSessionDigests() {
+      return null;
+    }
+    transcriptSources() {
+      return [];
+    }
   };
 });
 
@@ -14468,7 +14894,7 @@ var init_cline = __esm(() => {
         }
       }
       mkdirSync22(join32(globalStatePath, ".."), { recursive: true });
-      writeFileSync22(globalStatePath, JSON.stringify(state, null, 2));
+      writeJsonConfig(globalStatePath, state);
     }
     async removeSkills(skillFilenames, scope) {
       if (scope !== "project")
@@ -14503,7 +14929,7 @@ var init_cline = __esm(() => {
 });
 
 // src/agents/gemini.ts
-import { existsSync as existsSync39, mkdirSync as mkdirSync23, readdirSync as readdirSync13, readFileSync as readFileSync29, statSync as statSync7, writeFileSync as writeFileSync23 } from "fs";
+import { existsSync as existsSync39, mkdirSync as mkdirSync23, readdirSync as readdirSync13, readFileSync as readFileSync29, statSync as statSync8, writeFileSync as writeFileSync23 } from "fs";
 import { basename as basename4, join as join33 } from "path";
 import { homedir as homedir15 } from "os";
 var GeminiAdapter;
@@ -14513,6 +14939,7 @@ var init_gemini = __esm(() => {
   init_skill_removal();
   init_trash();
   init_types();
+  init_transcript_sources();
   init_instruction_hint();
   init_json_config();
   init_detection();
@@ -14581,11 +15008,11 @@ var init_gemini = __esm(() => {
         settings.tools.exclude = config.permissionRules.deny;
       }
       mkdirSync23(join33(settingsPath, ".."), { recursive: true });
-      writeFileSync23(settingsPath, JSON.stringify(settings, null, 2));
+      writeJsonConfig(settingsPath, settings);
     }
     async readUsageStats(lastSyncAt) {
       try {
-        const tmpDir = join33(homedir15(), ".gemini", "tmp");
+        const tmpDir = this.transcriptRoot();
         if (!existsSync39(tmpDir))
           return null;
         const sinceMs = lastSyncAt ? new Date(lastSyncAt).getTime() : 0;
@@ -14615,7 +15042,7 @@ var init_gemini = __esm(() => {
             const filePath = join33(chatsDir, file.name);
             let stat;
             try {
-              stat = statSync7(filePath);
+              stat = statSync8(filePath);
             } catch {
               continue;
             }
@@ -14663,8 +15090,14 @@ var init_gemini = __esm(() => {
         return null;
       }
     }
+    transcriptRoot() {
+      return join33(homedir15(), ".gemini", "tmp");
+    }
+    transcriptSources() {
+      return [{ path: this.transcriptRoot(), kind: "dir" }];
+    }
     *chatFiles(sinceMs) {
-      const tmpDir = join33(homedir15(), ".gemini", "tmp");
+      const tmpDir = this.transcriptRoot();
       if (!existsSync39(tmpDir))
         return;
       let projects;
@@ -14689,7 +15122,7 @@ var init_gemini = __esm(() => {
           const filePath = join33(chatsDir, file);
           let stat;
           try {
-            stat = statSync7(filePath);
+            stat = statSync8(filePath);
           } catch {
             continue;
           }
@@ -14701,6 +15134,8 @@ var init_gemini = __esm(() => {
     }
     async listSessions(sinceISO) {
       try {
+        if (!transcriptSourcesReadable(this.transcriptSources()))
+          return null;
         const sinceMs = sinceISO ? new Date(sinceISO).getTime() : 0;
         const sessions = [];
         for (const { filePath, project, mtimeMs } of this.chatFiles(sinceMs)) {
@@ -14740,6 +15175,8 @@ var init_gemini = __esm(() => {
     }
     async readSessionDigests(sinceISO) {
       try {
+        if (!transcriptSourcesReadable(this.transcriptSources()))
+          return null;
         const sinceMs = sinceISO ? new Date(sinceISO).getTime() : 0;
         const digests = [];
         for (const { filePath, project } of this.chatFiles(sinceMs)) {
@@ -14775,7 +15212,7 @@ var init_gemini = __esm(() => {
 });
 
 // src/agents/generic-adapter.ts
-import { existsSync as existsSync40, mkdirSync as mkdirSync24, rmSync as rmSync12, writeFileSync as writeFileSync24 } from "fs";
+import { mkdirSync as mkdirSync24, writeFileSync as writeFileSync24 } from "fs";
 import { join as join34 } from "path";
 import { homedir as homedir16 } from "os";
 var GenericAgentAdapter;
@@ -14785,7 +15222,9 @@ var init_generic_adapter = __esm(() => {
   init_json_config();
   init_instruction_hint();
   init_registry();
+  init_detection_probes();
   init_detection();
+  init_trash();
   GenericAgentAdapter = class GenericAgentAdapter extends RegistryDetectedAdapter {
     name;
     slug;
@@ -14808,7 +15247,13 @@ var init_generic_adapter = __esm(() => {
     async writeMcpServers(servers, _scope) {
       if (!this.def.mcpConfigPath)
         return;
-      const filePath = join34(homedir16(), resolvePlatformString(this.def.mcpConfigPath) || "");
+      const resolved = resolvePlatformString(this.def.mcpConfigPath) || "";
+      const expanded = expandWindowsPathTemplate(resolved, {
+        "%APPDATA%": process.env.APPDATA,
+        "%LOCALAPPDATA%": process.env.LOCALAPPDATA,
+        "%ProgramFiles%": process.env.ProgramFiles
+      });
+      const filePath = expanded.needsHomeJoin ? join34(homedir16(), expanded.path) : expanded.path;
       if (!filePath)
         return;
       const entries = {};
@@ -14832,12 +15277,7 @@ var init_generic_adapter = __esm(() => {
         return 0;
       for (const skill of skills) {
         if (skill.name !== skill.filename) {
-          const oldDir = join34(baseDir, skill.name);
-          if (existsSync40(oldDir)) {
-            try {
-              rmSync12(oldDir, { recursive: true, force: true });
-            } catch {}
-          }
+          moveToTrash(join34(baseDir, skill.name), `skill renamed to ${skill.filename}`);
         }
         const skillDir = join34(baseDir, skill.filename);
         mkdirSync24(skillDir, { recursive: true });
@@ -14966,6 +15406,26 @@ var init_detect = __esm(async () => {
   ALL_ADAPTERS = buildAllAdapters();
 });
 
+// ../../shared/types/local-conversations.ts
+function describeScanOutcome(outcome) {
+  switch (outcome.status) {
+    case "ok":
+    case "no-reader":
+      return null;
+    case "missing-dir":
+      return `no conversation history found${outcome.path ? ` at ${outcome.path}` : ""}`;
+    case "permission-denied":
+      return `access denied${outcome.path ? ` to ${outcome.path}` : ""}`;
+    case "missing-tool":
+      return `needs ${outcome.detail ?? "a tool that is not installed"}`;
+    case "error":
+      return `could not be read${outcome.detail ? `: ${outcome.detail}` : ""}`;
+  }
+}
+function scanOutcomeNeedsAttention(outcome) {
+  return outcome.status === "permission-denied" || outcome.status === "error";
+}
+
 // src/utils/insight-id.ts
 import { createHash as createHash3 } from "node:crypto";
 function computeInsightId(userSeed, localKey) {
@@ -15116,7 +15576,7 @@ __export(exports_run_log, {
   RUN_LOG_CAP: () => RUN_LOG_CAP,
   ANALYST_ERROR_MAX_CHARS: () => ANALYST_ERROR_MAX_CHARS
 });
-import { existsSync as existsSync43, mkdirSync as mkdirSync25, readFileSync as readFileSync32, readdirSync as readdirSync15, statSync as statSync8, unlinkSync as unlinkSync7, writeFileSync as writeFileSync25 } from "fs";
+import { existsSync as existsSync43, mkdirSync as mkdirSync25, readFileSync as readFileSync32, readdirSync as readdirSync15, statSync as statSync9, unlinkSync as unlinkSync7, writeFileSync as writeFileSync25 } from "fs";
 import { dirname as dirname10, join as join37 } from "path";
 import { homedir as homedir19 } from "os";
 function runLogPath() {
@@ -15260,7 +15720,7 @@ function acquireRunLock(nowMs = Date.now()) {
       return true;
     } catch {
       try {
-        if (nowMs - statSync8(p).mtimeMs < RUN_STALE_MS)
+        if (nowMs - statSync9(p).mtimeMs < RUN_STALE_MS)
           return false;
         unlinkSync7(p);
       } catch {
@@ -15594,10 +16054,12 @@ function selectAnalyst(requestedSlug) {
     const resolved = resolve3(requested);
     if (!resolved)
       return { candidates: [], broken };
-    if (isBinaryRunnable(resolved.command)) {
+    const probe = probeBinaryRunnable(resolved.command);
+    if (probe.runnable) {
       return { chosen: resolved, candidates: [resolved], broken };
     }
-    broken.push(requested.binary);
+    if (probe.reason !== "timeout")
+      broken.push(requested.binary);
     return { candidates: [], broken };
   }
   const candidates = [];
@@ -15605,9 +16067,10 @@ function selectAnalyst(requestedSlug) {
     const resolved = resolve3(a);
     if (!resolved)
       continue;
-    if (isBinaryRunnable(resolved.command))
+    const probe = probeBinaryRunnable(resolved.command);
+    if (probe.runnable)
       candidates.push(resolved);
-    else
+    else if (probe.reason !== "timeout")
       broken.push(a.binary);
   }
   return { chosen: candidates[0], candidates, broken };
@@ -15945,6 +16408,7 @@ var init_reflect = __esm(async () => {
   init_store();
   init_client();
   init_resolve();
+  init_transcript_sources();
   init_session_digest();
   init_insight_id();
   init_insight_store();
@@ -16009,13 +16473,13 @@ var init_reflect = __esm(async () => {
     const seen = new Set;
     for (const adapter2 of adapters) {
       if (!adapter2.readSessionDigests) {
-        perAgent.push({ slug: adapter2.slug, sessions: "unsupported" });
+        perAgent.push({ agentSlug: adapter2.slug, status: "no-reader", sessions: null });
         continue;
       }
       try {
         const sessions = await adapter2.readSessionDigests(sinceISO);
         if (sessions === null) {
-          perAgent.push({ slug: adapter2.slug, sessions: "unsupported" });
+          perAgent.push(diagnoseTranscriptRead(adapter2));
           continue;
         }
         let added = 0;
@@ -16027,20 +16491,26 @@ var init_reflect = __esm(async () => {
           digests.push(s);
           added++;
         }
-        perAgent.push({ slug: adapter2.slug, sessions: added });
-      } catch {
-        perAgent.push({ slug: adapter2.slug, sessions: "error" });
+        perAgent.push({ agentSlug: adapter2.slug, status: "ok", sessions: added });
+      } catch (err) {
+        perAgent.push(diagnoseTranscriptRead(adapter2, err));
       }
     }
     if (!json) {
       console.error(bold(`
 Reflection over the last ${days} days`));
-      for (const a of perAgent)
-        console.error(`  ${cyan(a.slug)}: ${a.sessions === "unsupported" ? gray("no transcript reader") : a.sessions === "error" ? red("read error") : `${a.sessions} session(s)`}`);
+      for (const a of perAgent) {
+        const reason = describeScanOutcome(a);
+        if (reason === null) {
+          console.error(`  ${cyan(a.agentSlug)}: ${a.status === "no-reader" ? gray("no transcript reader") : `${a.sessions} session(s)`}`);
+        } else {
+          console.error(`  ${cyan(a.agentSlug)}: ${scanOutcomeNeedsAttention(a) ? red(reason) : gray(reason)}`);
+        }
+      }
     }
     if (digests.length === 0) {
       if (json) {
-        jsonOut({ insights: [], reason: "no-sessions" });
+        jsonOut({ insights: [], reason: "no-sessions", perAgent });
         return;
       }
       console.error(yellow(`
@@ -16405,19 +16875,19 @@ async function listLocalConversations(opts = {}) {
   const perAgent = [];
   for (const adapter2 of adapters) {
     if (!adapter2.listSessions) {
-      perAgent.push({ slug: adapter2.slug, sessions: "unsupported" });
+      perAgent.push({ agentSlug: adapter2.slug, status: "no-reader", sessions: null });
       continue;
     }
     try {
       const sessions = await adapter2.listSessions(sinceISO);
       if (sessions === null) {
-        perAgent.push({ slug: adapter2.slug, sessions: "unsupported" });
+        perAgent.push(diagnoseTranscriptRead(adapter2));
         continue;
       }
       listings.push(sessions);
-      perAgent.push({ slug: adapter2.slug, sessions: sessions.length });
-    } catch {
-      perAgent.push({ slug: adapter2.slug, sessions: "error" });
+      perAgent.push({ agentSlug: adapter2.slug, status: "ok", sessions: sessions.length });
+    } catch (err) {
+      perAgent.push(diagnoseTranscriptRead(adapter2, err));
     }
   }
   const conversations = mergeSessionListings(listings, {
@@ -16428,6 +16898,7 @@ async function listLocalConversations(opts = {}) {
 }
 var DEFAULT_IDLE_MINUTES = 10;
 var init_conversation_registry = __esm(async () => {
+  init_transcript_sources();
   await init_detect();
 });
 
@@ -17824,7 +18295,7 @@ var init_welcome = __esm(() => {
 });
 
 // src/index.ts
-import { Command as Command39 } from "commander";
+import { Command as Command40 } from "commander";
 
 // src/commands/login.ts
 init_login_flow();
@@ -18133,7 +18604,18 @@ var deployCommand = new Command5("deploy").description("Deploy the current app t
     console.log("Syncing...");
   try {
     commitWorkingTree(cwd, `deploy: ${new Date().toISOString().replace("T", " ").slice(0, 19)}`);
-  } catch {}
+  } catch (err) {
+    if (hasTrackedChanges(cwd)) {
+      const detail = err instanceof Error ? err.message : String(err);
+      if (useJson) {
+        jsonOut(buildErrorResponse("deploy", "Could not commit your changes", `Your working tree has uncommitted changes that could not be committed (${detail.slice(0, 300)}). Deploying now would ship the PREVIOUS commit while reporting success.`, ["Check for a failing pre-commit hook or a stale .git/index.lock", "Commit the changes yourself with git commit", "Then re-run runwork deploy"]));
+        process.exit(1);
+      }
+      console.error("Could not commit your changes, so nothing new would be deployed.");
+      console.error("A pre-commit hook or a stale .git/index.lock may be interfering. Commit manually, then re-run `runwork deploy`.");
+      process.exit(1);
+    }
+  }
   if (!hasCommits(cwd)) {
     if (useJson) {
       jsonOut(buildErrorResponse("deploy", "Nothing to deploy", "No commits exist and the working tree has no changes to commit, so there is nothing to sync or deploy.", ["Make changes to your app first", "Run runwork dev to develop and verify changes", "Then run runwork deploy"]));
@@ -20274,9 +20756,14 @@ conversationsCommand.command("list").description("List local conversations acros
 Local conversations, last ${days} day(s)` : `
 Local conversations (all)`));
   for (const a of result.perAgent) {
-    if (a.sessions === "unsupported")
+    if (a.status === "no-reader")
       continue;
-    console.log(dim(`  ${a.slug}: ${a.sessions === "error" ? "read error" : `${a.sessions} session(s)`}`));
+    const reason = describeScanOutcome(a);
+    if (reason === null) {
+      console.log(dim(`  ${a.agentSlug}: ${a.sessions} session(s)`));
+    } else {
+      console.log(`  ${a.agentSlug}: ${scanOutcomeNeedsAttention(a) ? yellow(reason) : dim(reason)}`);
+    }
   }
   console.log("");
   const width = process.stdout.columns || 120;
@@ -20293,6 +20780,26 @@ Local conversations (all)`));
   if (result.conversations.length === 0)
     console.log(dim("  none"));
 });
+conversationsCommand.command("status").description("Why each agent did or did not contribute conversations (no conversation data)").option("--days <n>", "Look back this many days (0 = no limit)", String(DEFAULT_LOOKBACK_DAYS)).action(async (opts, command) => {
+  const json = command.optsWithGlobals().json === true || !process.stdout.isTTY;
+  const days = parseDays(opts.days);
+  const { perAgent } = await listLocalConversations({ sinceISO: sinceFromDays(days) });
+  if (json) {
+    jsonOut({ perAgent });
+    return;
+  }
+  console.log(bold(days > 0 ? `
+Conversation sources, last ${days} day(s)` : `
+Conversation sources`));
+  for (const a of perAgent) {
+    const reason = describeScanOutcome(a);
+    if (reason === null) {
+      console.log(`  ${cyan(a.agentSlug)}: ${a.status === "no-reader" ? dim("no transcript reader") : `${a.sessions} conversation(s)`}`);
+    } else {
+      console.log(`  ${cyan(a.agentSlug)}: ${scanOutcomeNeedsAttention(a) ? yellow(reason) : dim(reason)}`);
+    }
+  }
+});
 conversationsCommand.command("scan").description("Detect finished conversations (idle threshold) and queue them for reflection").option("--days <n>", "Look back this many days (0 = no limit)", String(DEFAULT_LOOKBACK_DAYS)).option("--idle-minutes <n>", "Idle threshold that marks a conversation finished", String(DEFAULT_IDLE_MINUTES)).action(async (opts, command) => {
   const json = command.optsWithGlobals().json === true || !process.stdout.isTTY;
   const days = parseDays(opts.days);
@@ -20356,11 +20863,12 @@ conversationsCommand.command("scan").description("Detect finished conversations
   const snapshot = {
     generatedAt: new Date().toISOString(),
     idleMinutes,
-    conversations: [...listed, ...rescued].sort((a, b) => b.lastActivityAt.localeCompare(a.lastActivityAt))
+    conversations: [...listed, ...rescued].sort((a, b) => b.lastActivityAt.localeCompare(a.lastActivityAt)),
+    perAgent: result.perAgent
   };
   writeJsonAtomic(join43(homedir24(), ".runwork", "conversations.json"), snapshot);
   if (json) {
-    jsonOut({ queued: scan.queued, reopened: scan.reopened, pruned: scan.pruned, pending, finished: finished.length });
+    jsonOut({ queued: scan.queued, reopened: scan.reopened, pruned: scan.pruned, pending, finished: finished.length, perAgent: result.perAgent });
     return;
   }
   console.log(green(`Scanned ${result.conversations.length} conversation(s): ${scan.queued} newly queued, ${scan.reopened} reopened, ${pending} pending analysis.`));
@@ -23335,7 +23843,11 @@ async function executeSyncPlan(plan, resolvedConflicts, ctx) {
     if (!action.remoteContent)
       continue;
     const skillFile = makeSkillFile(action.name, action.remoteContent);
-    await writeSkillToAgents(skillFile, action.source, ctx);
+    const outcome = await writeSkillToAgents(skillFile, action.source, ctx);
+    if (!writeLanded(outcome)) {
+      vlog(`  Pull FAILED for ${action.name} (${outcome.succeeded}/${outcome.attempted} agent writes); will retry next sync`);
+      continue;
+    }
     newHashes[action.name] = {
       localHash: contentHash(buildSkillMd2(skillFile)),
       remoteHash: contentHash(action.remoteContent),
@@ -23377,7 +23889,11 @@ async function executeSyncPlan(plan, resolvedConflicts, ctx) {
       vlog(`  Pushed (conflict resolved): ${action.name}`);
     } else if (resolution === "remote" && action.remoteContent) {
       const skillFile = makeSkillFile(action.name, action.remoteContent);
-      await writeSkillToAgents(skillFile, action.source, ctx);
+      const outcome = await writeSkillToAgents(skillFile, action.source, ctx);
+      if (!writeLanded(outcome)) {
+        vlog(`  Conflict pull FAILED for ${action.name} (${outcome.succeeded}/${outcome.attempted} agent writes); will retry next sync`);
+        continue;
+      }
       newHashes[action.name] = {
         localHash: contentHash(buildSkillMd2(skillFile)),
         remoteHash: contentHash(action.remoteContent),
@@ -23389,6 +23905,7 @@ async function executeSyncPlan(plan, resolvedConflicts, ctx) {
   }
   for (const _action of plan.skips) {}
   const deletionSlugs = plan.deletions.map((action) => toSlug(action.name));
+  let removalsFailed = false;
   if (deletionSlugs.length) {
     for (const adapter2 of ctx.adapters) {
       if (!adapter2.supportsSkills() || !adapter2.removeSkills)
@@ -23396,15 +23913,20 @@ async function executeSyncPlan(plan, resolvedConflicts, ctx) {
       for (const scope of ctx.scopes) {
         try {
           await adapter2.removeSkills(deletionSlugs, scope);
-        } catch {}
+        } catch {
+          removalsFailed = true;
+        }
       }
     }
     for (const action of plan.deletions) {
-      vlog(`  Deleted locally: ${action.name}`);
+      vlog(removalsFailed ? `  Deletion of ${action.name} incomplete; will retry next sync` : `  Deleted locally: ${action.name}`);
     }
   }
-  return newHashes;
-}
+  return {
+    newHashes,
+    failedDeletions: removalsFailed ? plan.deletions.map((action) => action.name) : []
+  };
+}
 function makeSkillFile(name, content) {
   return {
     name,
@@ -23414,17 +23936,25 @@ function makeSkillFile(name, content) {
   };
 }
 async function writeSkillToAgents(skillFile, source, ctx) {
+  let attempted = 0;
+  let succeeded = 0;
   for (const adapter2 of ctx.adapters) {
     if (source === "app" && ctx.hasMcp && adapter2.mcpProvidesSkills)
       continue;
     for (const scope of ctx.scopes) {
       if (!adapter2.supportsSkills())
         continue;
+      attempted++;
       try {
         await adapter2.writeSkills([skillFile], scope);
+        succeeded++;
       } catch {}
     }
   }
+  return { attempted, succeeded };
+}
+function writeLanded(outcome) {
+  return outcome.attempted === 0 || outcome.succeeded > 0;
 }
 function extractDescription(content) {
   const match = content.match(/^---\n[\s\S]*?description:\s*(.+)\n[\s\S]*?---/);
@@ -23839,7 +24369,7 @@ This account is not a member of "${state.workspaceName || state.workspaceId}".`)
   if (adapters.length > 0) {
     console.log(`  Syncing to: ${adapters.map((a) => a.name).join(", ")}`);
   }
-  const newHashes = await executeSyncPlan(plan, resolvedConflicts, {
+  const { newHashes, failedDeletions } = await executeSyncPlan(plan, resolvedConflicts, {
     client,
     workspaceId: state.workspaceId,
     adapters,
@@ -23896,9 +24426,15 @@ This account is not a member of "${state.workspaceName || state.workspaceId}".`)
   };
   const mcpFailedAdapters = new Set;
   const skillFailedAdapters = new Set;
+  const instructionFailedAdapters = new Set;
+  const configFailedAdapters = new Set;
+  const hookFailedAdapters = new Set;
+  const agentOutcomes = {};
+  const syncStartedAt = new Date().toISOString();
   for (const adapter2 of adapters) {
     if (isConnectOnlyAgent(getRegistryAgent(adapter2.slug))) {
       vlog(`  [${adapter2.name}] Connect-only agent: no local files to sync`);
+      agentOutcomes[adapter2.slug] = { at: syncStartedAt, ok: true, skipped: true };
       summary.adaptersProcessed++;
       continue;
     }
@@ -23960,15 +24496,32 @@ This account is not a member of "${state.workspaceName || state.workspaceId}".`)
         await adapter2.writeInstructionHint(instructionHint, scope);
         summary.instructionHintWrites++;
         vlog(`  [${adapter2.name}] Updated instruction hints (${scope})`);
-        if (adapter2.writeBuiltInHooks) {
+      } catch (err) {
+        adapterFailedAnyScope = true;
+        instructionFailedAdapters.add(adapter2.slug);
+        console.warn(`  [${adapter2.name}] Failed instructions (${scope}): ${err instanceof Error ? err.message : err}`);
+      }
+      if (adapter2.writeBuiltInHooks) {
+        try {
           await adapter2.writeBuiltInHooks(scope);
           summary.hookInstallCalls++;
+        } catch (err) {
+          adapterFailedAnyScope = true;
+          hookFailedAdapters.add(adapter2.slug);
+          console.warn(`  [${adapter2.name}] Failed hooks (${scope}): ${err instanceof Error ? err.message : err}`);
         }
-      } catch (err) {
-        adapterFailedAnyScope = true;
-        console.warn(`  [${adapter2.name}] Failed (${scope}): ${err instanceof Error ? err.message : err}`);
       }
     }
+    const failedDimensions = [];
+    if (skillFailedAdapters.has(adapter2.slug))
+      failedDimensions.push("skills");
+    if (mcpFailedAdapters.has(adapter2.slug))
+      failedDimensions.push("mcp");
+    if (instructionFailedAdapters.has(adapter2.slug))
+      failedDimensions.push("instructions");
+    if (hookFailedAdapters.has(adapter2.slug))
+      failedDimensions.push("hooks");
+    agentOutcomes[adapter2.slug] = failedDimensions.length > 0 ? { at: syncStartedAt, ok: false, failed: failedDimensions } : { at: syncStartedAt, ok: true };
     summary.adaptersProcessed++;
     if (adapterFailedAnyScope)
       summary.adaptersFailed++;
@@ -23999,7 +24552,10 @@ This account is not a member of "${state.workspaceName || state.workspaceId}".`)
         await adapter2.writeTeamInstructions(fullInstructions, scope);
         teamInstructionsApplied = true;
         vlog(`  [${adapter2.name}] Updated team instructions (${scope})`);
-      } catch {}
+      } catch (err) {
+        instructionFailedAdapters.add(adapter2.slug);
+        console.warn(`  [${adapter2.name}] Failed team instructions (${scope}): ${err instanceof Error ? err.message : err}`);
+      }
     }
   }
   if (agentConfigs) {
@@ -24020,7 +24576,10 @@ This account is not a member of "${state.workspaceName || state.workspaceId}".`)
           agentConfigsApplied++;
           const configKeys = Object.keys(configWithoutInstructions).join(", ");
           vlog(`  [${adapter2.name}] Updated agent config: ${configKeys} (${scope})`);
-        } catch {}
+        } catch (err) {
+          configFailedAdapters.add(adapter2.slug);
+          console.warn(`  [${adapter2.name}] Failed agent config (${scope}): ${err instanceof Error ? err.message : err}`);
+        }
       }
     }
   }
@@ -24102,7 +24661,10 @@ This account is not a member of "${state.workspaceName || state.workspaceId}".`)
         }
         if (team)
           agentConfigsApplied++;
-      } catch {}
+      } catch (err) {
+        configFailedAdapters.add(adapter2.slug);
+        console.warn(`  [${adapter2.name}] Failed agent config: ${err instanceof Error ? err.message : err}`);
+      }
     }
     state.agentDefaultsVersion = AGENT_DEFAULTS_SCHEMA_VERSION;
   }
@@ -24118,6 +24680,21 @@ This account is not a member of "${state.workspaceName || state.workspaceId}".`)
   }
   const prevMcpNames = state.mcpServers ?? [];
   state.lastSyncAt = new Date().toISOString();
+  const lateFailures = [
+    [configFailedAdapters, "config"],
+    [instructionFailedAdapters, "instructions"],
+    [hookFailedAdapters, "hooks"]
+  ];
+  for (const [slugs, dimension] of lateFailures) {
+    for (const slug of slugs) {
+      const existing = agentOutcomes[slug];
+      if (existing?.failed?.includes(dimension))
+        continue;
+      const failed = [...existing?.failed ?? [], dimension];
+      agentOutcomes[slug] = { at: existing?.at ?? syncStartedAt, ok: false, failed };
+    }
+  }
+  state.lastSyncAgents = agentOutcomes;
   state.mcpServers = mcpEntries.map((e) => e.name);
   state.skills = remoteSkills.map((s) => s.name);
   state.skillFilenames = [
@@ -24179,7 +24756,10 @@ This account is not a member of "${state.workspaceName || state.workspaceId}".`)
   for (const [name, hash] of Object.entries(newHashes)) {
     mergedHashes[name] = hash;
   }
+  const retryDeletions = new Set(failedDeletions);
   for (const del of plan.deletions) {
+    if (retryDeletions.has(del.name))
+      continue;
     delete mergedHashes[del.name];
   }
   state.skillHashes = mergedHashes;
@@ -24700,10 +25280,11 @@ var buildPluginCommand = new Command29("build-plugin").description("Build an ins
 
 // src/commands/uninstall.ts
 init_prompt();
+init_subprocess();
 await init_detect();
 import { Command as Command30 } from "commander";
-import { existsSync as existsSync55, readFileSync as readFileSync44, rmSync as rmSync13, unlinkSync as unlinkSync9 } from "fs";
-import { join as join52 } from "path";
+import { existsSync as existsSync55, readFileSync as readFileSync44, writeFileSync as writeFileSync32, readdirSync as readdirSync16, rmSync as rmSync12, unlinkSync as unlinkSync9, lstatSync, readlinkSync } from "fs";
+import { join as join52, resolve as resolve4, relative as relative5, isAbsolute as isAbsolute5 } from "path";
 import { homedir as homedir31 } from "os";
 function loadSetupState4(filePath) {
   if (!existsSync55(filePath))
@@ -24714,6 +25295,125 @@ function loadSetupState4(filePath) {
     return null;
   }
 }
+var PRESERVED_ENTRIES = ["bin", "apps", "trash"];
+function removeRunworkState(stateDir, opts) {
+  const result = { removed: [], preserved: [], errors: [] };
+  if (!existsSync55(stateDir))
+    return result;
+  const preserve = new Set(PRESERVED_ENTRIES);
+  if (opts.keepAuth)
+    preserve.add(".credentials");
+  let entries;
+  try {
+    entries = readdirSync16(stateDir);
+  } catch (err) {
+    result.errors.push(`${stateDir}: ${err instanceof Error ? err.message : err}`);
+    return result;
+  }
+  for (const entry of entries) {
+    const target = join52(stateDir, entry);
+    if (preserve.has(entry)) {
+      if (existsSync55(target))
+        result.preserved.push(target);
+      continue;
+    }
+    try {
+      rmSync12(target, { recursive: true, force: true });
+      result.removed.push(target);
+    } catch (err) {
+      result.errors.push(`${target}: ${err instanceof Error ? err.message : err}`);
+    }
+  }
+  return result;
+}
+var SHELL_PROFILES = [".zshrc", ".zprofile", ".bashrc", ".bash_profile", ".profile"];
+var BIN_DIR_PATTERN = /\.runwork[\\/]bin/;
+function stripRunworkPathLines(file) {
+  if (!existsSync55(file))
+    return false;
+  let content;
+  try {
+    content = readFileSync44(file, "utf-8");
+  } catch {
+    return false;
+  }
+  if (!content.includes("Added by Runwork"))
+    return false;
+  const lines = content.split(`
+`);
+  const kept = [];
+  for (let i = 0;i < lines.length; i++) {
+    if (/^\s*#\s*Added by Runwork\b/.test(lines[i])) {
+      if (i + 1 < lines.length && BIN_DIR_PATTERN.test(lines[i + 1]))
+        i++;
+      continue;
+    }
+    kept.push(lines[i]);
+  }
+  const next = kept.join(`
+`);
+  if (next === content)
+    return false;
+  try {
+    writeFileSync32(file, next);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function cleanShellProfilePathEntries() {
+  return SHELL_PROFILES.map((name) => join52(homedir31(), name)).filter(stripRunworkPathLines);
+}
+function cleanPowerShellProfilePathEntries() {
+  if (process.platform !== "win32")
+    return [];
+  const touched = [];
+  const seen = new Set;
+  for (const host of ["powershell", "pwsh"]) {
+    let profilePath;
+    try {
+      profilePath = execFileSync(host, ["-NoProfile", "-Command", "$PROFILE.CurrentUserCurrentHost"], {
+        encoding: "utf-8",
+        stdio: "pipe"
+      }).trim();
+    } catch {
+      continue;
+    }
+    if (!profilePath || seen.has(profilePath))
+      continue;
+    seen.add(profilePath);
+    if (stripRunworkPathLines(profilePath))
+      touched.push(profilePath);
+  }
+  return touched;
+}
+function removeRunworkSymlink(linkPath) {
+  let stat;
+  try {
+    stat = lstatSync(linkPath);
+  } catch {
+    return false;
+  }
+  if (!stat.isSymbolicLink())
+    return false;
+  let target;
+  try {
+    target = resolve4(linkPath, "..", readlinkSync(linkPath));
+  } catch {
+    return false;
+  }
+  const ours = resolve4(join52(homedir31(), ".runwork", "bin"));
+  const rel = relative5(ours, resolve4(target));
+  const insideOurs = rel === "" || !rel.startsWith("..") && !isAbsolute5(rel);
+  if (!insideOurs)
+    return false;
+  try {
+    unlinkSync9(linkPath);
+    return true;
+  } catch {
+    return false;
+  }
+}
 var uninstallCommand = new Command30("uninstall").description("Remove all Runwork configuration from local agents (MCP servers, skills, instructions)").option("-y, --yes", "Skip confirmation prompt").option("--keep-auth", "Keep authentication credentials (only remove agent configs)").action(async (opts) => {
   const projectStatePath = join52(process.cwd(), ".runwork", "setup.json");
   const userStatePath = join52(homedir31(), ".runwork", "setup.json");
@@ -24754,6 +25454,13 @@ This will remove all Runwork configuration from your local agents:
   } else {
     console.log("    - Setup state and auth credentials (~/.runwork/)");
   }
+  console.log("    - The PATH line we added to your shell profiles");
+  console.log("    - Symlinks that point at our own binary");
+  console.log(`
+  What will be KEPT:`);
+  console.log("    - ~/.runwork/bin       the CLI binary itself");
+  console.log("    - ~/.runwork/apps      your own app source");
+  console.log("    - ~/.runwork/trash     recoverable copies of removed files");
   console.log("");
   if (!opts.yes) {
     const confirmed = await promptConfirm("Proceed with uninstall?");
@@ -24772,7 +25479,7 @@ This will remove all Runwork configuration from your local agents:
   for (const { state, label } of entries) {
     const scopes = state.scope === "both" ? ["project", "user"] : [state.scope];
     const manifest = {
-      skillFilenames: state.skillFilenames ?? state.skills.map((s) => s.toLowerCase().replace(/[^a-z0-9]+/g, "-")),
+      skillFilenames: state.skillFilenames ?? (state.skills ?? []).map((s) => s.toLowerCase().replace(/[^a-z0-9]+/g, "-")),
       mcpServerNames: state.mcpServers ?? []
     };
     for (const slug of state.configuredAgents) {
@@ -24797,27 +25504,50 @@ This will remove all Runwork configuration from your local agents:
       }
     }
     const stateDir = label === "project" ? join52(process.cwd(), ".runwork") : join52(homedir31(), ".runwork");
-    if (opts.keepAuth && label === "user") {
-      const setupFile = join52(stateDir, "setup.json");
-      if (existsSync55(setupFile)) {
-        try {
-          unlinkSync9(setupFile);
-          console.log(`  Removed ${setupFile} (kept credentials)`);
-        } catch (err) {
-          console.warn(`  Failed to remove ${setupFile}: ${err instanceof Error ? err.message : err}`);
-          errors++;
-        }
+    if (existsSync55(stateDir)) {
+      const outcome = removeRunworkState(stateDir, {
+        keepAuth: Boolean(opts.keepAuth) && label === "user"
+      });
+      if (outcome.removed.length > 0) {
+        console.log(`  Removed Runwork state from ${stateDir}`);
       }
-    } else if (existsSync55(stateDir)) {
-      try {
-        rmSync13(stateDir, { recursive: true, force: true });
-        console.log(`  Removed ${stateDir}`);
-      } catch (err) {
-        console.warn(`  Failed to remove ${stateDir}: ${err instanceof Error ? err.message : err}`);
+      for (const problem of outcome.errors) {
+        console.warn(`  Failed to remove ${problem}`);
         errors++;
       }
+      if (outcome.preserved.length > 0) {
+        console.log("");
+        console.log("  Kept (not Runwork's to delete):");
+        for (const kept of outcome.preserved)
+          console.log(`    - ${kept}`);
+      }
     }
   }
+  const touchedProfiles = [
+    ...cleanShellProfilePathEntries(),
+    ...cleanPowerShellProfilePathEntries()
+  ];
+  if (touchedProfiles.length > 0) {
+    console.log("");
+    console.log("  Removed the Runwork PATH line from:");
+    for (const file of touchedProfiles)
+      console.log(`    - ${file}`);
+  }
+  const removedLinks = [
+    join52(homedir31(), ".local", "bin", "runwork"),
+    "/usr/local/bin/runwork"
+  ].filter(removeRunworkSymlink);
+  if (removedLinks.length > 0) {
+    console.log("");
+    console.log("  Removed symlinks:");
+    for (const link of removedLinks)
+      console.log(`    - ${link}`);
+  }
+  if (process.platform === "win32") {
+    console.log("");
+    console.log("  Still on your PATH (remove by hand if you want it gone):");
+    console.log(`    ${join52(homedir31(), ".runwork", "bin")} in your user PATH`);
+  }
   console.log("");
   if (errors > 0) {
     console.log(`Uninstall completed with ${errors} warning${errors > 1 ? "s" : ""}. ${cleanedAgents} agent${cleanedAgents > 1 ? "s" : ""} cleaned.`);
@@ -25041,6 +25771,7 @@ import { Command as Command34 } from "commander";
 
 // src/health/checks.ts
 init_subprocess();
+init_http();
 init_store();
 init_client();
 init_http();
@@ -25242,9 +25973,20 @@ async function checkAuthAndNetwork(ctx) {
         network: { name: "network", status: "pass", message: `API reachable (${elapsed}ms)` }
       };
     }
+    const proxy = proxyForUrl(ctx.credentials.baseUrl || BASE_URL2);
+    const network = proxy ? {
+      name: "network",
+      status: "fail",
+      message: `API unreachable via ${proxy.variable} (${proxy.value}): ${message}`,
+      details: [
+        `A proxy is configured through ${proxy.variable}.`,
+        "Runwork routes requests through `curl` when a proxy is set, so curl must be installed and able to reach the proxy.",
+        "If this host should bypass the proxy, add it to NO_PROXY."
+      ]
+    } : { name: "network", status: "fail", message: `API unreachable: ${message}` };
     return {
       auth: { name: "auth", status: "skip", message: "could not verify (network error)" },
-      network: { name: "network", status: "fail", message: `API unreachable: ${message}` }
+      network
     };
   }
 }
@@ -25572,6 +26314,7 @@ async function checkAgentSetup() {
     details.push(`${state.configuredAgents.length} agent(s) configured`);
   }
   let mcpChecked = false;
+  let mcpAllHealthy = true;
   for (const slug of state.configuredAgents) {
     const adapter2 = getAdapterBySlug(slug);
     if (!adapter2 || !adapter2.supportsMcpScope("user"))
@@ -25584,19 +26327,22 @@ async function checkAgentSetup() {
         if (missingMcp.length > 0) {
           details.push(`${missingMcp.length} MCP server(s) missing from ${slug} config`);
           upgrade("warn");
-        } else {
-          details.push(`${state.mcpServers.length} MCP server(s) configured`);
+          mcpAllHealthy = false;
         }
         mcpChecked = true;
-        break;
       } catch {}
     }
   }
+  if (mcpChecked && mcpAllHealthy && state.mcpServers.length > 0) {
+    details.push(`${state.mcpServers.length} MCP server(s) configured`);
+  }
   if (!mcpChecked && state.mcpServers.length > 0) {
     details.push("could not verify MCP servers");
     upgrade("warn");
   }
   let skillsChecked = false;
+  let skillsAllHealthy = true;
+  let skillsSummaryLine = null;
   for (const slug of state.configuredAgents) {
     const skillsDir = getSkillsDir(slug, "user");
     if (!skillsDir)
@@ -25613,13 +26359,16 @@ async function checkAgentSetup() {
     if (missingSkills.length > 0) {
       details.push(`${missingSkills.length} skill(s) missing from ${slug}`);
       upgrade("warn");
-    } else if (state.skills.length > 0) {
+      skillsAllHealthy = false;
+    } else if (state.skills.length > 0 && !skillsSummaryLine) {
       const mcpCoveredCount = state.skills.filter(isCoveredByMcp).length;
       const onDiskCount = state.skills.length - mcpCoveredCount;
-      details.push(mcpCoveredCount > 0 ? `${state.skills.length} skill(s) installed (${onDiskCount} on disk, ${mcpCoveredCount} via MCP)` : `${state.skills.length} skill(s) installed`);
+      skillsSummaryLine = mcpCoveredCount > 0 ? `${state.skills.length} skill(s) installed (${onDiskCount} on disk, ${mcpCoveredCount} via MCP)` : `${state.skills.length} skill(s) installed`;
     }
     skillsChecked = true;
-    break;
+  }
+  if (skillsChecked && skillsAllHealthy && skillsSummaryLine) {
+    details.push(skillsSummaryLine);
   }
   if (!skillsChecked && state.skills.length > 0) {
     details.push("could not verify skills");
@@ -25794,7 +26543,7 @@ async function applyDoctorFixes(ctx, failingNames) {
 }
 
 // src/agents/runtime-detection.ts
-import { existsSync as existsSync58, readFileSync as readFileSync47, statSync as statSync10, readdirSync as readdirSync16 } from "fs";
+import { existsSync as existsSync58, readFileSync as readFileSync47, statSync as statSync11, readdirSync as readdirSync17 } from "fs";
 import { homedir as homedir33 } from "os";
 import { join as join55 } from "path";
 var RUNWORK_SESSIONS_DIR = join55(homedir33(), ".runwork", "sessions");
@@ -25877,7 +26626,7 @@ function findClaudeCodeSessionFile(sessionId) {
     return null;
   let projectDirs;
   try {
-    projectDirs = readdirSync16(root);
+    projectDirs = readdirSync17(root);
   } catch {
     return null;
   }
@@ -25897,7 +26646,7 @@ function findCodexRolloutFile(threadId) {
     const dir = stack.pop();
     let entries;
     try {
-      entries = readdirSync16(dir);
+      entries = readdirSync17(dir);
     } catch {
       continue;
     }
@@ -25905,7 +26654,7 @@ function findCodexRolloutFile(threadId) {
       const full = join55(dir, entry);
       let s;
       try {
-        s = statSync10(full);
+        s = statSync11(full);
       } catch {
         continue;
       }
@@ -25924,7 +26673,7 @@ function findNewestClaudeCodeSession() {
     return null;
   let projectDirs;
   try {
-    projectDirs = readdirSync16(root);
+    projectDirs = readdirSync17(root);
   } catch {
     return null;
   }
@@ -25933,7 +26682,7 @@ function findNewestClaudeCodeSession() {
     const projectPath = join55(root, dir);
     let files;
     try {
-      files = readdirSync16(projectPath);
+      files = readdirSync17(projectPath);
     } catch {
       continue;
     }
@@ -25942,7 +26691,7 @@ function findNewestClaudeCodeSession() {
         continue;
       const full = join55(projectPath, file);
       try {
-        const s = statSync10(full);
+        const s = statSync11(full);
         if (!best || s.mtimeMs > best.mtime) {
           best = {
             sessionId: file.replace(/\.jsonl$/, ""),
@@ -25967,7 +26716,7 @@ function findNewestCodexRollout() {
     const dir = stack.pop();
     let entries;
     try {
-      entries = readdirSync16(dir);
+      entries = readdirSync17(dir);
     } catch {
       continue;
     }
@@ -25975,7 +26724,7 @@ function findNewestCodexRollout() {
       const full = join55(dir, entry);
       let s;
       try {
-        s = statSync10(full);
+        s = statSync11(full);
       } catch {
         continue;
       }
@@ -26199,13 +26948,627 @@ var doctorCommand = new Command34("doctor").description("Check system health: au
   }
 });
 
+// src/commands/debug.ts
+init_colors();
+import { Command as Command35 } from "commander";
+import { readFileSync as readFileSync48 } from "fs";
+import { homedir as homedir35, platform as platform7, release, arch, type as osType } from "os";
+import { join as join58 } from "path";
+
+// src/debug/capture-plan.ts
+var CONFIG_MAX_BYTES = 64 * 1024;
+var LOG_TAIL_BYTES = 64 * 1024;
+var CENSUS_MAX_ENTRIES = 200;
+var ENV_NAMES = [
+  "PATH",
+  "SHELL",
+  "HOME",
+  "USERPROFILE",
+  "APPDATA",
+  "LOCALAPPDATA",
+  "XDG_CONFIG_HOME",
+  "HTTP_PROXY",
+  "HTTPS_PROXY",
+  "http_proxy",
+  "https_proxy",
+  "NO_PROXY",
+  "no_proxy",
+  "NODE_EXTRA_CA_CERTS",
+  "RUNWORK_HTTP_TRANSPORT",
+  "RUNWORK_API_URL",
+  "TERM_PROGRAM",
+  "LANG"
+];
+function buildCapturePlan(input) {
+  const sep5 = input.sep ?? (input.platform === "win32" ? "\\" : "/");
+  const join56 = (...parts) => parts.join(sep5);
+  const home = input.homeDir.replace(/[/\\]+$/, "");
+  const rw = (...parts) => join56(home, ".runwork", ...parts);
+  const steps = [];
+  steps.push({ id: "env", kind: "env", names: ENV_NAMES, note: "process environment (proxy credentials stripped)" });
+  for (const [id, file] of [
+    ["runwork.setup", "setup.json"],
+    ["runwork.workspaces", "workspaces.json"],
+    ["runwork.reflect-state", "reflect-state.json"],
+    ["runwork.reflect-runs", "reflect-runs.json"],
+    ["runwork.telemetry-outbox", "telemetry-outbox.json"],
+    ["runwork.session-summaries-outbox", "session-summaries-outbox.json"]
+  ]) {
+    steps.push({ id, kind: "file", path: rw(file), maxBytes: CONFIG_MAX_BYTES });
+  }
+  for (const [id, file] of [
+    ["runwork.conversations", "conversations.json"],
+    ["runwork.reflect-queue", "reflect-queue.json"],
+    ["runwork.insights", "insights.json"],
+    ["runwork.pattern-store", "pattern-store.json"]
+  ]) {
+    steps.push({ id, kind: "stat", path: rw(file), note: "size and mtime only: contains conversation text" });
+  }
+  steps.push({ id: "runwork.dir", kind: "census", path: rw(), depth: 1, maxEntries: CENSUS_MAX_ENTRIES }, { id: "runwork.bin", kind: "census", path: rw("bin"), depth: 1, maxEntries: 50, note: "which CLI binaries are installed here" }, { id: "runwork.sessions", kind: "census", path: rw("sessions"), depth: 1, maxEntries: CENSUS_MAX_ENTRIES, note: "written by the agent hooks we install" }, { id: "runwork.log", kind: "file", path: rw("desktop-launch.log"), maxBytes: LOG_TAIL_BYTES, tail: true, note: "tail: this log has no rotation" });
+  for (const [id, ...parts] of [
+    ["claude.settings", ".claude", "settings.json"],
+    ["claude.md", ".claude", "CLAUDE.md"],
+    ["claude.mcp", ".claude", ".mcp.json"],
+    ["codex.config", ".codex", "config.toml"],
+    ["codex.agents-md", ".codex", "AGENTS.md"],
+    ["gemini.settings", ".gemini", "settings.json"]
+  ]) {
+    steps.push({ id, kind: "file", path: join56(home, ...parts), maxBytes: CONFIG_MAX_BYTES });
+  }
+  for (const [id, ...parts] of [
+    ["claude.skills", ".claude", "skills"],
+    ["claude.plugins", ".claude", "plugins"],
+    ["agents.skills", ".agents", "skills"],
+    ["codex.skills", ".codex", "skills"]
+  ]) {
+    steps.push({ id, kind: "census", path: join56(home, ...parts), depth: 1, maxEntries: CENSUS_MAX_ENTRIES });
+  }
+  steps.push({ id: "transcripts.claude-code", kind: "census", path: join56(home, ".claude", "projects"), depth: 1, maxEntries: CENSUS_MAX_ENTRIES }, { id: "transcripts.codex", kind: "census", path: join56(home, ".codex", "sessions"), depth: 2, maxEntries: CENSUS_MAX_ENTRIES }, { id: "transcripts.gemini", kind: "census", path: join56(home, ".gemini", "tmp"), depth: 1, maxEntries: CENSUS_MAX_ENTRIES }, { id: "transcripts.cowork", kind: "census", path: coworkBaseDir(input, join56), depth: 1, maxEntries: CENSUS_MAX_ENTRIES, note: "macOS TCC can refuse this while it still exists" });
+  for (const profile of shellProfiles(input.platform)) {
+    steps.push({
+      id: `shell${profile}`,
+      kind: "stat",
+      path: join56(home, profile),
+      note: "presence only: profile bodies can contain the user's own secrets"
+    });
+  }
+  steps.push(...binaryResolutionSteps(input));
+  if (input.cliPath) {
+    steps.push({ id: "cli.version", kind: "exec", command: input.cliPath, args: ["--version"] }, { id: "cli.doctor", kind: "exec", command: input.cliPath, args: ["--json", "doctor", "-v"] }, { id: "cli.conversations", kind: "exec", command: input.cliPath, args: ["--json", "conversations", "status", "--days", "0"], note: "per-agent scan outcome, no conversation data" });
+  }
+  return steps;
+}
+function coworkBaseDir(input, join56) {
+  const home = input.homeDir.replace(/[/\\]+$/, "");
+  if (input.platform === "darwin") {
+    return join56(home, "Library", "Application Support", "Claude", "local-agent-mode-sessions");
+  }
+  if (input.platform === "win32") {
+    const base = input.appData ?? join56(home, "AppData", "Roaming");
+    return join56(base, "Claude", "local-agent-mode-sessions");
+  }
+  return join56(home, ".config", "Claude", "local-agent-mode-sessions");
+}
+function shellProfiles(platform7) {
+  if (platform7 === "win32")
+    return [];
+  return [".zshrc", ".zprofile", ".bashrc", ".bash_profile", ".profile"];
+}
+function binaryResolutionSteps(input) {
+  const sep5 = input.sep ?? (input.platform === "win32" ? "\\" : "/");
+  const join56 = (...parts) => parts.join(sep5);
+  const home = input.homeDir.replace(/[/\\]+$/, "");
+  if (input.platform === "win32") {
+    return [
+      { id: "binaries.where", kind: "exec", command: "where.exe", args: ["runwork"], note: "every match, not just the first" },
+      { id: "binaries.runwork-bin", kind: "stat", path: join56(home, ".runwork", "bin", "runwork.exe") },
+      { id: "binaries.user-path", kind: "exec", command: "reg.exe", args: ["query", "HKCU\\Environment", "/v", "Path"], note: "the PATH a NEW shell will inherit, not this one" }
+    ];
+  }
+  return [
+    { id: "binaries.which", kind: "exec", command: "which", args: ["-a", "runwork"], note: "every match, not just the first" },
+    { id: "binaries.runwork-bin", kind: "stat", path: join56(home, ".runwork", "bin", "runwork") },
+    { id: "binaries.local-bin", kind: "stat", path: join56(home, ".local", "bin", "runwork") },
+    ...input.platform === "darwin" ? [{ id: "binaries.usr-local-bin", kind: "stat", path: "/usr/local/bin/runwork" }] : []
+  ];
+}
+
+// src/debug/capture.ts
+var CAPTURE_FORMAT = 1;
+function summarizeBundle(jsonl) {
+  const summary = {
+    formatVersion: CAPTURE_FORMAT,
+    producer: null,
+    stepsPlanned: 0,
+    stepsRun: 0,
+    redactions: 0,
+    withheld: 0,
+    complete: false
+  };
+  for (const line of jsonl.split(`
+`)) {
+    if (!line.trim())
+      continue;
+    let record;
+    try {
+      record = JSON.parse(line);
+    } catch {
+      continue;
+    }
+    if (record.type === "plan") {
+      summary.formatVersion = record.format;
+      summary.producer = record.producer;
+      summary.stepsPlanned = record.steps.length;
+    } else if (record.type === "step") {
+      summary.stepsRun++;
+      summary.redactions += record.redactions ?? 0;
+      summary.withheld += record.withheld ?? 0;
+    } else if (record.type === "complete") {
+      summary.complete = true;
+    }
+  }
+  return summary;
+}
+async function sha256Hex(text2) {
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(text2));
+  return [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+var NEVER_READ = [".credentials", "credentials.json", "auth.json", ".netrc", "id_rsa"];
+function isForbiddenPath(path4) {
+  const name = path4.split(/[/\\]/).pop()?.toLowerCase() ?? "";
+  return NEVER_READ.some((deny) => name === deny.toLowerCase());
+}
+var SECRET_KEY_NAMES = "token|secret|password|passwd|api[-_]?key|apikey|authorization|access[-_]?token|refresh[-_]?token|client[-_]?secret|private[-_]?key|access[-_]?key|credentials?";
+var SECRET_KEY_PATTERN = `[A-Za-z0-9_-]*?(?:${SECRET_KEY_NAMES})`;
+var QUOTED_VALUE = String.raw`"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'`;
+var SECRET_QUERY_PARAMS = "token|key|secret|password|api[-_]?key|apikey|access[-_]?token|sig|signature";
+function redactSecrets(text2) {
+  let redactions = 0;
+  const mark = () => {
+    redactions++;
+    return "<redacted>";
+  };
+  const out = text2.replace(new RegExp(`([?&](?:${SECRET_QUERY_PARAMS})=)[^&\\s"'\`]+`, "gi"), (_m, prefix) => `${prefix}${mark()}`).replace(/\b(Bearer\s+)[A-Za-z0-9._~+/=-]{8,}/gi, (_m, prefix) => `${prefix}${mark()}`).replace(new RegExp(`("?${SECRET_KEY_PATTERN}"?\\s*[:=]\\s*)(${QUOTED_VALUE}|[^\\s,}\\]&"']+)`, "gi"), (match, prefix, value) => {
+    if (value.includes("<redacted>"))
+      return match;
+    const quote = value.startsWith('"') ? '"' : value.startsWith("'") ? "'" : "";
+    return `${prefix}${quote}${mark()}${quote}`;
+  });
+  return { text: out, redactions };
+}
+var CONTENT_KEY_NAMES = "currentTitle|title|prompt|userMessages|summary|body|snippet";
+function redactUserContent(text2) {
+  let withheld = 0;
+  const out = text2.replace(new RegExp(`("?\\b(?:${CONTENT_KEY_NAMES})"?\\s*[:=]\\s*)(${QUOTED_VALUE})`, "gi"), (match, prefix, value) => {
+    if (value === '""' || value === "''")
+      return match;
+    withheld++;
+    const quote = value[0];
+    return `${prefix}${quote}<withheld>${quote}`;
+  });
+  return { text: out, withheld };
+}
+function redactEnvValue(value) {
+  if (value === null)
+    return null;
+  return value.replace(/(\w+:\/\/)[^/@\s]*@/g, "$1<redacted>@");
+}
+function classifyCaptureError(err) {
+  const e = err;
+  const code = e && typeof e === "object" && typeof e.code === "string" ? e.code : undefined;
+  const message = e instanceof Error ? e.message : String(err);
+  if (code === "ENOENT" || code === "ENOTDIR")
+    return { status: "missing", detail: code };
+  if (code === "EACCES" || code === "EPERM")
+    return { status: "denied", detail: code };
+  if (code === "ETIMEDOUT" || code === "TIMEOUT")
+    return { status: "timeout", detail: code };
+  if (code === "ESCOPE")
+    return { status: "skipped", detail: message };
+  return { status: "error", detail: code ? `${code}: ${message}` : message };
+}
+function stepTarget(step) {
+  switch (step.kind) {
+    case "file":
+    case "census":
+    case "stat":
+      return step.path;
+    case "env":
+      return step.names.join(",");
+    case "exec":
+      return [step.command, ...step.args].join(" ");
+  }
+}
+function withDeadline(work, ms) {
+  return new Promise((resolve5, reject) => {
+    const timer = setTimeout(() => reject(Object.assign(new Error("step deadline"), { code: "TIMEOUT" })), ms);
+    work.then((value) => {
+      clearTimeout(timer);
+      resolve5(value);
+    }, (err) => {
+      clearTimeout(timer);
+      reject(err);
+    });
+  });
+}
+async function runStep(port, step, deadlineMs) {
+  const startedMs = port.now();
+  const base = { type: "step", id: step.id, kind: step.kind, target: stepTarget(step) };
+  const done = (extra) => ({ ...base, status: "ok", durationMs: port.now() - startedMs, ...extra });
+  if ((step.kind === "file" || step.kind === "stat") && isForbiddenPath(step.path)) {
+    return { ...base, status: "skipped", detail: "excluded by policy", durationMs: 0 };
+  }
+  try {
+    switch (step.kind) {
+      case "file": {
+        const raw = await withDeadline(port.readText(step.path, step.maxBytes, step.tail === true), deadlineMs);
+        const secrets = redactSecrets(raw.text);
+        const content = redactUserContent(secrets.text);
+        return done({
+          text: content.text,
+          truncated: raw.truncated,
+          ...secrets.redactions > 0 ? { redactions: secrets.redactions } : {},
+          ...content.withheld > 0 ? { withheld: content.withheld } : {}
+        });
+      }
+      case "census": {
+        const entries = await withDeadline(port.listDir(step.path, step.depth, step.maxEntries), deadlineMs);
+        return done({ entries, entryCount: entries.length });
+      }
+      case "stat": {
+        const info = await withDeadline(port.stat(step.path), deadlineMs);
+        return done({ bytes: info.bytes, modifiedAt: info.modifiedAt });
+      }
+      case "env": {
+        const raw = port.env(step.names);
+        return done({
+          env: Object.fromEntries(Object.entries(raw).map(([k, v]) => [k, redactEnvValue(v)]))
+        });
+      }
+      case "exec": {
+        const result = await withDeadline(port.exec(step.command, step.args), deadlineMs);
+        const out = redactSecrets(result.stdout);
+        const err = redactSecrets(result.stderr);
+        const redactions = out.redactions + err.redactions;
+        return done({
+          text: out.text,
+          exitCode: result.exitCode,
+          stderr: err.text,
+          ...redactions > 0 ? { redactions } : {}
+        });
+      }
+    }
+  } catch (err) {
+    const { status, detail } = classifyCaptureError(err);
+    return { ...base, status, detail, durationMs: port.now() - startedMs };
+  }
+}
+async function runCapture(port, producer, steps, opts = {}) {
+  const deadlineMs = opts.stepDeadlineMs ?? 1e4;
+  const startedMs = port.now();
+  await port.append({
+    type: "plan",
+    format: CAPTURE_FORMAT,
+    producer,
+    startedAt: new Date(startedMs).toISOString(),
+    steps: steps.map((s) => ({ id: s.id, kind: s.kind, ...s.note ? { note: s.note } : {} }))
+  });
+  let stepsRun = 0;
+  for (const step of steps) {
+    await port.append(await runStep(port, step, deadlineMs));
+    stepsRun++;
+  }
+  if (opts.claims) {
+    try {
+      for (const claim of await opts.claims())
+        await port.append(claim);
+    } catch (err) {
+      await port.append({
+        type: "claim",
+        id: "claims-failed",
+        producer,
+        value: { error: err instanceof Error ? err.message : String(err) }
+      });
+    }
+  }
+  await port.append({
+    type: "complete",
+    finishedAt: new Date(port.now()).toISOString(),
+    stepsPlanned: steps.length,
+    stepsRun,
+    durationMs: port.now() - startedMs
+  });
+  return { stepsRun };
+}
+
+// src/utils/machine-id.ts
+init_atomic_json();
+import { randomUUID } from "crypto";
+import { homedir as homedir34 } from "os";
+import { join as join56 } from "path";
+function machineIdPath() {
+  return join56(homedir34(), ".runwork", "machine.json");
+}
+function isValidId(value) {
+  return typeof value === "string" && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(value);
+}
+function getMachineId() {
+  const path4 = machineIdPath();
+  const existing = readJsonOrNull(path4);
+  if (existing && isValidId(existing.id))
+    return existing.id;
+  const record = { id: randomUUID(), createdAt: new Date().toISOString() };
+  try {
+    writeJsonAtomic(path4, record);
+  } catch {
+    return null;
+  }
+  const settled = readJsonOrNull(path4);
+  return settled && isValidId(settled.id) ? settled.id : record.id;
+}
+
+// src/commands/debug.ts
+init_store();
+init_client();
+init_resolve();
+
+// src/debug/node-port.ts
+init_subprocess();
+init_which();
+import { closeSync as closeSync5, fsyncSync, mkdirSync as mkdirSync29, openSync as openSync5, readSync as readSync3, readdirSync as readdirSync18, statSync as statSync12, writeSync } from "fs";
+import { dirname as dirname12, join as join57 } from "path";
+var EXEC_OUTPUT_MAX = 256 * 1024;
+var EXEC_TIMEOUT_MS = 20000;
+function truncate5(text2, maxBytes) {
+  return text2.length > maxBytes ? { text: text2.slice(0, maxBytes), truncated: true } : { text: text2, truncated: false };
+}
+function entryKind(path4) {
+  try {
+    const s = statSync12(path4);
+    return s.isDirectory() ? "dir" : s.isFile() ? "file" : "other";
+  } catch {
+    return "other";
+  }
+}
+function createNodeCapturePort(outputPath) {
+  mkdirSync29(dirname12(outputPath), { recursive: true });
+  const fd = openSync5(outputPath, "w");
+  return {
+    close: () => closeSync5(fd),
+    async append(record) {
+      writeSync(fd, JSON.stringify(record) + `
+`);
+      try {
+        fsyncSync(fd);
+      } catch {}
+    },
+    async listDir(path4, depth, maxEntries) {
+      const out = [];
+      const queue = [{ dir: path4, prefix: "", level: 0 }];
+      let first = true;
+      while (queue.length > 0 && out.length < maxEntries) {
+        const { dir, prefix, level } = queue.shift();
+        let names;
+        try {
+          names = readdirSync18(dir);
+        } catch (err) {
+          if (first)
+            throw err;
+          continue;
+        } finally {
+          first = false;
+        }
+        for (const name of names) {
+          if (out.length >= maxEntries)
+            break;
+          const full = join57(dir, name);
+          const kind = entryKind(full);
+          let bytes;
+          let modifiedAt;
+          try {
+            const s = statSync12(full);
+            bytes = s.size;
+            modifiedAt = new Date(s.mtimeMs).toISOString();
+          } catch {}
+          out.push({ name: prefix ? `${prefix}/${name}` : name, kind, ...bytes !== undefined ? { bytes } : {}, ...modifiedAt ? { modifiedAt } : {} });
+          if (kind === "dir" && level + 1 < depth) {
+            queue.push({ dir: full, prefix: prefix ? `${prefix}/${name}` : name, level: level + 1 });
+          }
+        }
+      }
+      return out;
+    },
+    async stat(path4) {
+      const s = statSync12(path4);
+      return {
+        bytes: s.size,
+        modifiedAt: new Date(s.mtimeMs).toISOString(),
+        kind: s.isDirectory() ? "dir" : s.isFile() ? "file" : "other"
+      };
+    },
+    async readText(path4, maxBytes, tail) {
+      const s = statSync12(path4);
+      const size = s.size;
+      const length = Math.min(size, maxBytes);
+      const start = tail && size > maxBytes ? size - maxBytes : 0;
+      const buffer = Buffer.alloc(length);
+      const handle = openSync5(path4, "r");
+      try {
+        readSync3(handle, buffer, 0, length, start);
+      } finally {
+        closeSync5(handle);
+      }
+      return { text: buffer.toString("utf-8"), truncated: size > length };
+    },
+    env(names) {
+      return Object.fromEntries(names.map((n) => [n, process.env[n] ?? null]));
+    },
+    async exec(command, args) {
+      const spec = toSpawnSpec(command, args);
+      const result = spawnSync(spec.command, spec.args, {
+        encoding: "utf-8",
+        timeout: EXEC_TIMEOUT_MS,
+        maxBuffer: EXEC_OUTPUT_MAX,
+        ...spec.windowsVerbatimArguments ? { windowsVerbatimArguments: true } : {}
+      });
+      if (result.error)
+        throw result.error;
+      return {
+        exitCode: result.status ?? -1,
+        stdout: truncate5(result.stdout ?? "", EXEC_OUTPUT_MAX).text,
+        stderr: truncate5(result.stderr ?? "", 8 * 1024).text
+      };
+    },
+    now: () => Date.now()
+  };
+}
+
+// src/commands/debug.ts
+init_transcript_sources();
+init_which();
+await init_detect();
+function defaultOutputPath(now) {
+  const stamp = now.toISOString().replace(/[:.]/g, "-").replace("T", "_").slice(0, 19);
+  return join58(homedir35(), ".runwork", "debug", `runwork-debug-${stamp}.jsonl`);
+}
+async function cliClaims() {
+  const records = [];
+  records.push({
+    type: "claim",
+    id: "producer.process",
+    producer: "cli",
+    value: {
+      cliVersion: VERSION,
+      execPath: process.execPath,
+      argv0: process.argv[1] ?? null,
+      nodeVersion: process.version,
+      platform: platform7(),
+      osType: osType(),
+      release: release(),
+      arch: arch(),
+      cwd: process.cwd()
+    }
+  });
+  records.push({
+    type: "claim",
+    id: "cli.path-resolution",
+    producer: "cli",
+    derivedFrom: ["binaries.which", "binaries.where", "env"],
+    value: { pathResolved: whichBinary("runwork") }
+  });
+  const adapters = await detectAgents();
+  records.push({
+    type: "claim",
+    id: "agents.detected",
+    producer: "cli",
+    derivedFrom: ["transcripts.claude-code", "transcripts.codex", "transcripts.gemini", "transcripts.cowork"],
+    value: adapters.map((adapter2) => {
+      const sources = adapter2.transcriptSources?.() ?? [];
+      return {
+        slug: adapter2.slug,
+        name: adapter2.name,
+        hasListing: typeof adapter2.listSessions === "function",
+        hasDigests: typeof adapter2.readSessionDigests === "function",
+        transcriptSources: sources.map((s) => s.path),
+        readable: sources.length > 0 ? summarizeTranscriptSources(sources) : null
+      };
+    })
+  });
+  return records;
+}
+var debugCommand = new Command35("debug").description("Diagnostics for support");
+debugCommand.command("capture").description("Collect a diagnostic bundle to a file you can send to support").option("--out <path>", "Where to write the bundle (default: ~/.runwork/debug/)").option("--send", "Also send the bundle to Runwork support (requires sign-in)").option("--note <text>", "What went wrong, in your words. Included with --send").action(async (opts, command) => {
+  const json = command.optsWithGlobals().json === true || !process.stdout.isTTY;
+  const outputPath = typeof opts.out === "string" && opts.out ? opts.out : defaultOutputPath(new Date);
+  const cliPath = whichBinary("runwork");
+  const plan = buildCapturePlan({
+    platform: platform7(),
+    homeDir: homedir35(),
+    appData: process.env.APPDATA ?? null,
+    cliPath
+  });
+  if (!json) {
+    console.log(bold(`
+Collecting diagnostics`));
+    console.log(dim(`  ${plan.length} checks, writing to ${outputPath}`));
+  }
+  const port = createNodeCapturePort(outputPath);
+  let stepsRun = 0;
+  try {
+    ({ stepsRun } = await runCapture(port, "cli", plan, { claims: cliClaims }));
+  } finally {
+    port.close();
+  }
+  const sent = opts.send === true ? await sendBundle(outputPath, typeof opts.note === "string" ? opts.note : undefined) : null;
+  if (json) {
+    jsonOut({ path: outputPath, stepsPlanned: plan.length, stepsRun, ...sent ? { sent } : {} });
+    return;
+  }
+  const counted = stepsRun === plan.length ? `${stepsRun}` : `${stepsRun} of ${plan.length}`;
+  console.log(green(`
+Done. ${counted} checks recorded.`));
+  console.log(`
+  ${cyan(outputPath)}
+`);
+  if (!cliPath) {
+    console.log(yellow("Note: no `runwork` was found on PATH, so the doctor report is not included.\n"));
+  }
+  if (!sent) {
+    console.log(dim("Send that file to support. It contains no credentials and no conversation text."));
+    console.log(dim("Or re-run with --send to upload it."));
+    return;
+  }
+  if (sent.ok) {
+    console.log(green(`Sent to Runwork support (report ${sent.id}).`));
+    console.log(dim(`It is kept until ${sent.expiresAt?.slice(0, 10)} and then deleted.`));
+  } else {
+    console.log(yellow(`Could not send: ${sent.error}`));
+    console.log(dim("The file above is saved and can be sent to support by hand."));
+  }
+});
+async function sendBundle(path4, note) {
+  try {
+    const content = readFileSync48(path4, "utf-8");
+    const summary = summarizeBundle(content);
+    const machineId = getMachineId();
+    if (!machineId)
+      return { ok: false, error: "could not identify this machine" };
+    const credentials = getCredentials();
+    if (!credentials)
+      return { ok: false, error: "not signed in; run `runwork login`" };
+    const api = new ApiClient(credentials);
+    const workspace = await resolveWorkspace2(api);
+    const result = await api.createDebugReport(workspace.workspaceId, {
+      machineId,
+      producer: "cli",
+      content,
+      sha256: await sha256Hex(content),
+      formatVersion: summary.formatVersion,
+      ...note ? { note } : {},
+      context: {
+        cliVersion: VERSION,
+        platform: platform7(),
+        release: release(),
+        stepsPlanned: summary.stepsPlanned,
+        stepsRun: summary.stepsRun,
+        redactions: summary.redactions,
+        withheld: summary.withheld,
+        complete: summary.complete
+      }
+    });
+    return { ok: true, id: result.id, expiresAt: result.expiresAt };
+  } catch (err) {
+    return { ok: false, error: err instanceof Error ? err.message : String(err) };
+  }
+}
+
 // src/commands/share-convo.ts
 init_store();
 init_client();
 init_resolve();
-import { Command as Command35 } from "commander";
-import { readFileSync as readFileSync48, writeFileSync as writeFileSync32, existsSync as existsSync59, mkdtempSync as mkdtempSync4 } from "fs";
-import { join as join56 } from "path";
+import { Command as Command36 } from "commander";
+import { readFileSync as readFileSync49, writeFileSync as writeFileSync33, existsSync as existsSync59, mkdtempSync as mkdtempSync4 } from "fs";
+import { join as join59 } from "path";
 import { tmpdir as tmpdir4 } from "os";
 import { createHash as createHash6 } from "crypto";
 
@@ -26327,14 +27690,14 @@ function resolveLocalSessionShare(opts, conversation) {
     process.exit(1);
   }
   const title = opts.title ?? conversation.title ?? conversation.project;
-  const markdown = renderTranscriptMarkdown(readFileSync48(conversation.transcriptPath, "utf8"), family, title);
+  const markdown = renderTranscriptMarkdown(readFileSync49(conversation.transcriptPath, "utf8"), family, title);
   if (!markdown) {
     console.error("Error: this conversation has no shareable content.");
     process.exit(1);
   }
-  const tempDir = mkdtempSync4(join56(tmpdir4(), "runwork-share-"));
-  const transcriptFile = join56(tempDir, "transcript.md");
-  writeFileSync32(transcriptFile, markdown);
+  const tempDir = mkdtempSync4(join59(tmpdir4(), "runwork-share-"));
+  const transcriptFile = join59(tempDir, "transcript.md");
+  writeFileSync33(transcriptFile, markdown);
   opts.transcriptFile = transcriptFile;
   opts.nativeFile = opts.nativeFile ?? conversation.transcriptPath;
   opts.sourceAgent = opts.sourceAgent ?? conversation.agentSlug;
@@ -26350,7 +27713,7 @@ function nativeBundleFormatForAgent(slug) {
     return "codex-rollout";
   return null;
 }
-function sha256Hex(content) {
+function sha256Hex2(content) {
   return createHash6("sha256").update(content, "utf8").digest("hex");
 }
 function utf8ByteLength(content) {
@@ -26392,13 +27755,13 @@ async function runShareConvo(opts, command, isPersonalAlias = false) {
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
   const { workspaceId } = await resolveWorkspace2(client, { workspace: opts.workspace });
-  const transcriptContent = readFileSync48(opts.transcriptFile, "utf8");
+  const transcriptContent = readFileSync49(opts.transcriptFile, "utf8");
   const bundles = [
     {
       format: "transcript",
       content: transcriptContent,
       sizeBytes: utf8ByteLength(transcriptContent),
-      sha256: sha256Hex(transcriptContent)
+      sha256: sha256Hex2(transcriptContent)
     }
   ];
   const detected = detectCurrentAgent();
@@ -26417,12 +27780,12 @@ async function runShareConvo(opts, command, isPersonalAlias = false) {
     const nativeFormat = nativeBundleFormatForAgent(sourceAgent);
     if (nativeFormat) {
       try {
-        const content = readFileSync48(nativeFilePath, "utf8");
+        const content = readFileSync49(nativeFilePath, "utf8");
         bundles.push({
           format: nativeFormat,
           content,
           sizeBytes: utf8ByteLength(content),
-          sha256: sha256Hex(content)
+          sha256: sha256Hex2(content)
         });
       } catch (err) {
         console.error(`Warning: could not read native file ${nativeFilePath}: ${err instanceof Error ? err.message : err}`);
@@ -26433,7 +27796,7 @@ async function runShareConvo(opts, command, isPersonalAlias = false) {
   let metadata = {};
   if (opts.metadataFile) {
     try {
-      metadata = JSON.parse(readFileSync48(opts.metadataFile, "utf8"));
+      metadata = JSON.parse(readFileSync49(opts.metadataFile, "utf8"));
     } catch (err) {
       console.error(`Error: --metadata-file is not valid JSON: ${err instanceof Error ? err.message : err}`);
       process.exit(1);
@@ -26488,18 +27851,18 @@ Skipped: ${result.skipped.map((s) => `${s.identifier} (${s.reason})`).join(", ")
     process.exit(1);
   }
 }
-var shareConvoCommand = new Command35("share-convo").description("Share the current AI conversation with a teammate").option("--to <email>", "Recipient email (repeatable)", (value, prev = []) => [...prev, value], []).option("--transcript-file <path>", "Path to the LLM-emitted markdown transcript (required unless --session)").option("--session <key>", "Share a LOCAL conversation by registry key (transcript rendered mechanically)").option("--native-file <path>", "Path to the native session file (optional; auto-detected from env vars otherwise)").option("--source-agent <slug>", "Override host-agent detection (e.g. claude-code, codex, claude-desktop)").option("--title <string>", "Short title for the conversation (required)").option("--note <string>", "Optional personal note to recipients").option("--ttl-days <n>", "Days until expiration (1-30, default 7)").option("--metadata-json <json>", "Inline JSON object with workMode, openQuestions, suggestedNextStep, etc.").option("--metadata-file <path>", "Path to a JSON file with the same metadata fields").option("--workspace <name-or-id>", "Workspace name or ID").action((opts, command) => runShareConvo(opts, command, false));
+var shareConvoCommand = new Command36("share-convo").description("Share the current AI conversation with a teammate").option("--to <email>", "Recipient email (repeatable)", (value, prev = []) => [...prev, value], []).option("--transcript-file <path>", "Path to the LLM-emitted markdown transcript (required unless --session)").option("--session <key>", "Share a LOCAL conversation by registry key (transcript rendered mechanically)").option("--native-file <path>", "Path to the native session file (optional; auto-detected from env vars otherwise)").option("--source-agent <slug>", "Override host-agent detection (e.g. claude-code, codex, claude-desktop)").option("--title <string>", "Short title for the conversation (required)").option("--note <string>", "Optional personal note to recipients").option("--ttl-days <n>", "Days until expiration (1-30, default 7)").option("--metadata-json <json>", "Inline JSON object with workMode, openQuestions, suggestedNextStep, etc.").option("--metadata-file <path>", "Path to a JSON file with the same metadata fields").option("--workspace <name-or-id>", "Workspace name or ID").action((opts, command) => runShareConvo(opts, command, false));
 
 // src/commands/save-convo.ts
-import { Command as Command36 } from "commander";
-var saveConvoCommand = new Command36("save-convo").description("Save the current AI conversation as a personal checkpoint").option("--transcript-file <path>", "Path to the LLM-emitted markdown transcript (required)").option("--native-file <path>", "Path to the native session file (optional; auto-detected from env vars)").option("--source-agent <slug>", "Override host-agent detection").option("--title <string>", "Short title for the conversation (required)").option("--note <string>", "Optional note to your future self").option("--ttl-days <n>", "Days until expiration (1-30, default 7)").option("--metadata-json <json>", "Inline JSON object with workMode, openQuestions, etc.").option("--metadata-file <path>", "Path to a JSON file with metadata fields").option("--workspace <name-or-id>", "Workspace name or ID").action((opts, command) => runShareConvo({ ...opts, personal: true }, command, true));
+import { Command as Command37 } from "commander";
+var saveConvoCommand = new Command37("save-convo").description("Save the current AI conversation as a personal checkpoint").option("--transcript-file <path>", "Path to the LLM-emitted markdown transcript (required)").option("--native-file <path>", "Path to the native session file (optional; auto-detected from env vars)").option("--source-agent <slug>", "Override host-agent detection").option("--title <string>", "Short title for the conversation (required)").option("--note <string>", "Optional note to your future self").option("--ttl-days <n>", "Days until expiration (1-30, default 7)").option("--metadata-json <json>", "Inline JSON object with workMode, openQuestions, etc.").option("--metadata-file <path>", "Path to a JSON file with metadata fields").option("--workspace <name-or-id>", "Workspace name or ID").action((opts, command) => runShareConvo({ ...opts, personal: true }, command, true));
 
 // src/commands/inbox.ts
 init_store();
 init_client();
 init_resolve();
-import { Command as Command37 } from "commander";
-var inboxCommand = new Command37("inbox").description("List shared conversations visible to you").option("--filter <scope>", "Filter: all | received | sent | saved", "all").option("--limit <n>", "Max rows to return", "50").option("--workspace <name-or-id>", "Workspace name or ID").action(async (opts, command) => {
+import { Command as Command38 } from "commander";
+var inboxCommand = new Command38("inbox").description("List shared conversations visible to you").option("--filter <scope>", "Filter: all | received | sent | saved", "all").option("--limit <n>", "Max rows to return", "50").option("--workspace <name-or-id>", "Workspace name or ID").action(async (opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const scope = opts.filter === "received" || opts.filter === "sent" || opts.filter === "saved" ? opts.filter : "all";
   const limit = opts.limit ? parseInt(opts.limit, 10) : 50;
@@ -26541,10 +27904,10 @@ init_store();
 init_client();
 init_resolve();
 init_registry_data();
-import { Command as Command38 } from "commander";
-import { writeFileSync as writeFileSync33, mkdirSync as mkdirSync29, realpathSync } from "fs";
-import { homedir as homedir34 } from "os";
-import { join as join57 } from "path";
+import { Command as Command39 } from "commander";
+import { writeFileSync as writeFileSync34, mkdirSync as mkdirSync30, realpathSync } from "fs";
+import { homedir as homedir36 } from "os";
+import { join as join60 } from "path";
 import { spawn as spawn5 } from "child_process";
 init_registry();
 init_which();
@@ -26583,10 +27946,10 @@ function extractCodexUuid(rolloutContent) {
 }
 function placeClaudeJsonl(uuid, content, recipientCwd) {
   const encoded = encodeClaudeCodeCwd(recipientCwd);
-  const projectDir = join57(homedir34(), ".claude", "projects", encoded);
-  mkdirSync29(projectDir, { recursive: true });
-  const placedAt = join57(projectDir, `${uuid}.jsonl`);
-  writeFileSync33(placedAt, content);
+  const projectDir = join60(homedir36(), ".claude", "projects", encoded);
+  mkdirSync30(projectDir, { recursive: true });
+  const placedAt = join60(projectDir, `${uuid}.jsonl`);
+  writeFileSync34(placedAt, content);
   return { placedAt, runFromCwd: recipientCwd };
 }
 function placeCodexRollout(uuid, content) {
@@ -26594,11 +27957,11 @@ function placeCodexRollout(uuid, content) {
   const yyyy = String(now.getUTCFullYear());
   const mm = String(now.getUTCMonth() + 1).padStart(2, "0");
   const dd = String(now.getUTCDate()).padStart(2, "0");
-  const dir = join57(homedir34(), ".codex", "sessions", yyyy, mm, dd);
-  mkdirSync29(dir, { recursive: true });
+  const dir = join60(homedir36(), ".codex", "sessions", yyyy, mm, dd);
+  mkdirSync30(dir, { recursive: true });
   const ts = now.toISOString().replace(/\.\d+Z$/, "").replace(/:/g, "-");
-  const placedAt = join57(dir, `rollout-${ts}-${uuid}.jsonl`);
-  writeFileSync33(placedAt, content);
+  const placedAt = join60(dir, `rollout-${ts}-${uuid}.jsonl`);
+  writeFileSync34(placedAt, content);
   return { placedAt };
 }
 function pickTargetAgent(opts, sourceAgent) {
@@ -26617,7 +27980,15 @@ function isAgentInstalled(agent) {
   }
   return false;
 }
-var resumeCommand2 = new Command38("resume").description("Resume a shared conversation locally in your agent of choice").argument("<share-id>", "The share ID (sc_*) returned by share-convo or save-convo").option("--agent <slug>", "Override target agent (e.g. claude-code, codex)").option("--into <path>", "Override target cwd (defaults to current $PWD)").option("--dry-run", "Print the resume command instead of executing it").option("--pick", "Show interactive picker (requires TTY) - not yet implemented").option("--workspace <name-or-id>", "Workspace name or ID").action(async (shareId, opts, command) => {
+function buildResumeCommand(template, uuid, resolvedCli, cliName) {
+  const argv = template.replace(/\{uuid\}/g, uuid).split(" ").filter(Boolean);
+  if (resolvedCli && cliName && argv[0] === cliName) {
+    argv[0] = resolvedCli;
+  }
+  const display = [argv[0]?.includes(" ") ? `"${argv[0]}"` : argv[0], ...argv.slice(1)].filter((part) => Boolean(part)).join(" ");
+  return { argv, display };
+}
+var resumeCommand2 = new Command39("resume").description("Resume a shared conversation locally in your agent of choice").argument("<share-id>", "The share ID (sc_*) returned by share-convo or save-convo").option("--agent <slug>", "Override target agent (e.g. claude-code, codex)").option("--into <path>", "Override target cwd (defaults to current $PWD)").option("--dry-run", "Print the resume command instead of executing it").option("--pick", "Show interactive picker (requires TTY) - not yet implemented").option("--workspace <name-or-id>", "Workspace name or ID").action(async (shareId, opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -26711,12 +28082,8 @@ Bundle placed at: ${placement.placedAt}`);
     return;
   }
   if (cap2.mode === "cli-resume") {
-    let cmd = (cap2.cliResumeCommand ?? "").replace(/\{uuid\}/g, nativeUuid);
-    const resolvedCli = resolveAgentCliCommand(target.slug);
-    const cliName = getAgent(target.slug)?.launch?.cli;
-    if (resolvedCli && cliName && resolvedCli !== cliName && cmd.startsWith(`${cliName} `)) {
-      cmd = `"${resolvedCli}" ${cmd.slice(cliName.length + 1)}`;
-    }
+    const { argv, display } = buildResumeCommand(cap2.cliResumeCommand ?? "", nativeUuid, resolveAgentCliCommand(target.slug), getAgent(target.slug)?.launch?.cli);
+    const cmd = display;
     const detected = detectCurrentAgent();
     const insideSameAgent = detected && detected.slug === target.slug;
     const shouldPrintOnly = opts.dryRun || insideSameAgent;
@@ -26748,10 +28115,11 @@ Or ask the assistant to continue the conversation in THIS session by ` + `fetchi
       }
       return;
     }
-    const parts = cmd.split(" ");
-    const child = spawn5(parts[0], parts.slice(1), {
+    const spec = toSpawnSpec(argv[0], argv.slice(1));
+    const child = spawn5(spec.command, spec.args, {
       cwd: placement.runFromCwd ?? recipientCwd,
-      stdio: "inherit"
+      stdio: "inherit",
+      ...spec.windowsVerbatimArguments ? { windowsVerbatimArguments: true } : {}
     });
     child.on("exit", (code) => {
       process.exit(code ?? 0);
@@ -26847,7 +28215,7 @@ process.on("uncaughtException", (err) => {
   console.error(`Uncaught exception: ${formatError(err)}`);
   process.exit(1);
 });
-var program = new Command39;
+var program = new Command40;
 program.name("runwork").description("Runwork CLI - local development for Runwork apps").version(VERSION).option("--json", "Output as JSON (auto-enabled when stdout is not a TTY)");
 program.addCommand(infoCommand);
 program.addCommand(loginCommand);
@@ -26880,6 +28248,7 @@ program.addCommand(appsCommand);
 program.addCommand(membersCommand);
 program.addCommand(apiCommand);
 program.addCommand(doctorCommand);
+program.addCommand(debugCommand);
 program.addCommand(shareConvoCommand);
 program.addCommand(saveConvoCommand);
 program.addCommand(inboxCommand);