runwork 0.25.3 → 0.26.0

package/dist/index.js

@@ -62,7 +62,11 @@ import {
   createInflateRaw
 } from "node:zlib";
 function firstEnv(names) {
-  for (const variable of names) {
+  const keys = Object.keys(process.env);
+  for (const candidate of names) {
+    const variable = keys.find((k) => k === candidate) ?? keys.find((k) => k.toLowerCase() === candidate.toLowerCase());
+    if (variable === undefined)
+      continue;
     const value = process.env[variable];
     if (value && value.trim() !== "")
       return { variable, value: value.trim() };
@@ -828,6 +832,10 @@ class ApiClient {
   async reportTelemetry(workspaceId, events) {
     await this.request(`/api/workspaces/${workspaceId}/team/telemetry`, { method: "POST", body: JSON.stringify({ events }) });
   }
+  async createDebugReport(workspaceId, body) {
+    const res = await this.request(`/api/workspaces/${workspaceId}/debug-reports`, { method: "POST", body: JSON.stringify(body) });
+    return res.data;
+  }
   async createSharedConversation(workspaceId, body) {
     const res = await this.request(`/api/workspaces/${workspaceId}/shared-conversations`, {
       method: "POST",
@@ -1038,10 +1046,13 @@ var init_workspace_state = __esm(() => {
 // src/utils/subprocess.ts
 import {
   execFileSync as cpExecFileSync,
-  spawn as cpSpawn
+  spawn as cpSpawn,
+  spawnSync as cpSpawnSync
 } from "child_process";
 var execFileSync = (file, args, options) => {
   return cpExecFileSync(file, args, { windowsHide: true, ...options ?? {} });
+}, spawnSync = (file, args, options) => {
+  return cpSpawnSync(file, args, { windowsHide: true, ...options ?? {} });
 }, spawn2 = (command, args, options) => {
   return cpSpawn(command, args ?? [], { windowsHide: true, ...options ?? {} });
 };
@@ -3135,13 +3146,56 @@ function bufToStr2(val) {
     return val.toString("utf-8").trim();
   return "";
 }
+function pushSyncStash(cwd) {
+  execFileSync("git", ["stash", "push", "-m", SYNC_STASH_TAG], { cwd, stdio: "pipe" });
+  return findSyncStashSha(cwd);
+}
+function findSyncStashSha(cwd) {
+  try {
+    const line = execFileSync("git", ["stash", "list", "--format=%H %gs"], { cwd, encoding: "utf-8" }).split(`
+`).find((l) => l.includes(SYNC_STASH_TAG));
+    return line ? line.split(" ")[0] : null;
+  } catch {
+    return null;
+  }
+}
+function stashRefForSha(cwd, sha) {
+  try {
+    const line = execFileSync("git", ["stash", "list", "--format=%H %gd"], { cwd, encoding: "utf-8" }).split(`
+`).find((l) => l.startsWith(`${sha} `));
+    return line ? line.slice(sha.length + 1).trim() : null;
+  } catch {
+    return null;
+  }
+}
+function restoreSyncStash(cwd, sha) {
+  const resolved = sha ?? findSyncStashSha(cwd);
+  if (!resolved)
+    return "missing";
+  const ref = stashRefForSha(cwd, resolved);
+  if (!ref)
+    return "missing";
+  try {
+    execFileSync("git", ["stash", "apply", resolved], { cwd, stdio: "pipe" });
+  } catch {
+    return "conflict";
+  }
+  const dropRef = stashRefForSha(cwd, resolved);
+  if (dropRef) {
+    try {
+      execFileSync("git", ["stash", "drop", dropRef], { cwd, stdio: "pipe" });
+    } catch {}
+  }
+  return "restored";
+}
 function syncWithRemote(cwd) {
   if (!hasCommits(cwd)) {
     return { status: "skipped", pushed: false };
   }
   const dirty = hasTrackedChanges(cwd);
+  let stashSha = null;
   if (dirty) {
-    execFileSync("git", ["stash", "push", "-m", "runwork-dev-sync"], { cwd, stdio: "pipe" });
+    stashSha = pushSyncStash(cwd);
   }
   let status = "synced";
   let syncError;
@@ -3182,9 +3236,8 @@ function syncWithRemote(cwd) {
     syncError = extractGitError(fetchErr);
   }
   if (dirty) {
-    try {
-      execFileSync("git", ["stash", "pop"], { cwd, stdio: "pipe" });
-    } catch {
+    const restored = restoreSyncStash(cwd, stashSha);
+    if (restored !== "restored") {
       return { status, pushed: false, error: "stash-conflict", keptUntracked, remoteOverwrote };
     }
   }
@@ -3201,6 +3254,7 @@ function syncWithRemote(cwd) {
   }
   return { status, pushed, pushError, keptUntracked, remoteOverwrote };
 }
+var SYNC_STASH_TAG = "runwork-dev-sync";
 var init_sync = __esm(() => {
   init_subprocess();
   init_manifest();
@@ -5105,10 +5159,6 @@ export declare class FileStorageClient {
  */
 export declare function createFileStorageClient(env: Env): FileStorageClient;
 import type { Hono } from 'hono';
-/**
- * Mount file storage routes on the Hono app
- * Provides REST API for R2 bucket operations
- */
 export declare function fileStorageRoutes(app: Hono<{
     Bindings: Env;
 }>): void;
@@ -5285,6 +5335,46 @@ export declare function componentRoutes(app: Hono<{
 `,
     "workspace.d.ts": `export { WorkspaceContext, getWorkspaceContext, listWorkspaceEntity, getWorkspaceEntity, createWorkspaceEntity, updateWorkspaceEntity, deleteWorkspaceEntity, callAppEndpoint, initializeWorkspace, } from './core-workspace';
 export type { WorkspaceUser, ListUsersOptions, ListUsersResponse, NotifyUserParams, NotifyUserResult, ListEntityRequest, ListEntityResponse, GetEntityRequest, CreateEntityRequest, UpdateEntityRequest, DeleteEntityRequest, RegisterEntityRequest, RegisterAppRequest, RegisterComponentRequest, RegisterScheduleRequest, RegisterWorkflowRequest, RegisterEndpointRequest, RegisterIntegrationRequest, CallAppEndpointOptions, CallAppEndpointResult, RegisterAgentRequest as WorkspaceRegisterAgentRequest, } from './core-workspace';
+`,
+    "client.d.ts": `/**
+ * Framework client entry: browser-side helpers an app's frontend imports as
+ * \`@runworkai/framework/client\`, so app code never carries this plumbing
+ * itself.
+ *
+ * Analytics: what people do in the app, reported to the workspace.
+ *
+ * Envelope follows the Segment Spec (the de-facto standard Google Analytics,
+ * Mixpanel, PostHog and friends all map to), so nothing here needs to change
+ * if the workspace later forwards events to a real analytics tool.
+ *
+ * The app does not interpret events. \`/api/analytics\` stamps the app's
+ * identity and forwards to the workspace, which decides what each one means.
+ * Today a \`page\` counts as one USE of the app, the multiplier behind a
+ * standalone app's value in the workspace's reports. \`track\` events are kept
+ * for a later analytics surface.
+ *
+ * A page load is reported here because the document is served before the
+ * app's Worker runs, leaving no server-side trace otherwise. Once per
+ * document, not per route change: the workspace counts an opened tool, and a
+ * person navigating inside it is still one use.
+ *
+ * Fire-and-forget. Nothing here may ever affect the person using the app.
+ */
+/** Record a custom event. Use a flat Title Case name ("Report Exported") and put variables in properties. */
+export declare function track(event: string, properties?: Record<string, unknown>): void;
+/** Record a named screen or view inside the app. */
+export declare function screen(name: string, properties?: Record<string, unknown>): void;
+/**
+ * Tell the workspace who this browser belongs to, in the APP's own terms.
+ * A claim, recorded as data; the workspace never grants anything on it.
+ */
+export declare function identify(userId: string, traits?: Record<string, unknown>): void;
+/** Attach this person to a company, account or team the app knows about. */
+export declare function group(groupId: string, traits?: Record<string, unknown>): void;
+/** Link a past anonymous identity to a known one. */
+export declare function alias(userId: string, previousId?: string): void;
+/** Record that this app was opened. Called once automatically on load. */
+export declare function page(): void;
 `,
     "core-scheduler.d.ts": `/**
  * Core Scheduled Jobs Framework
@@ -5936,8 +6026,6 @@ export type Doc<T> = {
  * - Security validation on all field names
  */
 export declare class EntityDO extends DurableObject<Env> {
-    ctx: DurableObjectState;
-    env: Env;
     private _tableReady;
     private _migrationDone;
     constructor(ctx: DurableObjectState, env: Env);
@@ -6942,13 +7030,6 @@ export declare function toChannelName(appName: string): string;
  * these entries in the observability timeline.
  */
 export declare function flog(level: 'info' | 'warn' | 'error', system: string, message: string, data?: Record<string, unknown>): void;
-/**
- * Emit an event to the workspace unified event stream.
- * Fire-and-forget: uses ctx.waitUntil so it doesn't block the response.
- * Silently skips if workspace env vars are not configured (standalone mode).
- *
- * Automatically routes events to a channel derived from APP_NAME when available.
- */
 export declare function emitEvent(ctx: WaitUntilContext, env: EventEnv, event: EmitEventParams): void;
 export {};
 `,
@@ -7023,7 +7104,109 @@ export declare const isStr: (s: unknown) => s is string;
  * that would cause structured clone to fail in ctx.storage.put().
  */
 export declare function safeClone<T>(value: T, fallback?: T): T;
-export declare function platformFetch(env: Env, url: string | URL, init?: RequestInit): Promise<Response>;
+/**
+ * Platform fetch - routes requests through WorkspaceObject DO for production workers.
+ *
+ * Workers for Platforms (WfP) workers cannot reliably make HTTP requests back to their
+ * parent platform worker (they get 522 timeouts). This utility routes platform API calls
+ * through the WorkspaceObject Durable Object binding, which works across worker boundaries.
+ *
+ * Supported paths:
+ * - /api/proxy/integrations/* - Integration proxy (Nango)
+ * - /api/proxy/openai/* - AI Gateway proxy
+ * - /api/storage/presign - Storage presigned URLs
+ *
+ * For preview containers (DEPLOYMENT_MODE !== 'production'), uses standard fetch.
+ *
+ * @example
+ * \`\`\`typescript
+ * // Instead of:
+ * const response = await fetch('https://runwork.ai/api/proxy/integrations/proxy/contacts', options);
+ *
+ * // Use:
+ * const response = await platformFetch(env, 'https://runwork.ai/api/proxy/integrations/proxy/contacts', options);
+ * \`\`\`
+ */
+/**
+ * What the app was doing when it made a call.
+ *
+ * Internal plumbing, deliberately not exported from the package: app authors
+ * never set this, the framework establishes it at each entry point (schedule
+ * tick, workflow run, route handler, agent turn) and \`platformFetch\` below
+ * reads it. It lives beside \`platformFetch\` because that is its only consumer.
+ *
+ * WHY IT EXISTS: usage rows record \`appId\` and \`userId\` and nothing about what
+ * was executing, so a HubSpot call made by a nightly schedule cannot be told
+ * apart from one a person made from their own agent. \`runId\` is the field that
+ * cannot be reconstructed later: it links one run's AI calls and integration
+ * calls together, which is what per-run cost is built from.
+ *
+ * Design: docs/plans/2026-08-28-baselines-capture-redesign.md section 4.1.
+ */
+export interface RunContext {
+    /**
+     * WHAT was executing. Only constructs the framework itself runs, never
+     * "where the caller was" (a browser, MCP, the CLI): that is a different
+     * question and \`audit_logs.actor_type\` owns it.
+     */
+    kind: 'schedule' | 'workflow' | 'endpoint' | 'route' | 'agent';
+    /**
+     * Human-readable name, following the convention the audit rows already use:
+     * a schedule/workflow/agent slug, or \`METHOD /path\` for endpoints and routes.
+     *
+     * OMITTED rather than defaulted when genuinely unknown. A placeholder string
+     * like 'unknown' becomes a value every query has to filter out, and it is
+     * indistinguishable from an app that named something 'unknown'.
+     */
+    name?: string;
+    /**
+     * App-local registry key, so a usage row joins back to a registration. The
+     * app id is a column of its own, so this is the part after it: a slug for
+     * schedules, workflows and agents, \`METHOD /path\` for endpoints.
+     */
+    resourceKey?: string;
+    /** One id shared by everything emitted inside this execution. */
+    runId: string;
+    /** The enclosing run, for workflow steps, nested calls and sub-agents. */
+    parentRunId?: string;
+    trigger?: 'cron' | 'manual' | 'webhook' | 'chat' | 'api';
+    /**
+     * The person who started this run. Named to match the governance program's
+     * \`DelegationChain.triggererUserId\` (\`worker/types/permissions.ts\`), which is
+     * the same fact: one name for it across both programs.
+     *
+     * ATTRIBUTION, NEVER AUTHORITY. This travels on a header from the app, behind
+     * the shared WORKSPACE_API_KEY, so an app can put any user id here. The
+     * platform may RECORD it; nothing may ever AUTHORIZE on it. Whose authority a
+     * run borrows is resolved platform-side by PermissionService, not stated by
+     * the caller.
+     */
+    triggererUserId?: string;
+    attempt?: number;
+}
+/** Header carrying the context to the platform side, which writes the audit row. */
+export declare const RUN_CONTEXT_HEADER = "x-runwork-run-context";
+/**
+ * Run \`fn\` with \`ctx\` as the ambient execution context.
+ *
+ * Nesting is automatic: entering a context inside another records the outer
+ * \`runId\` as \`parentRunId\` unless the caller set one. That is what makes a
+ * sub-agent's calls point at the run that started it. Re-entering the SAME
+ * run id is not nesting (a workflow resumes into its own run across wake-ups)
+ * and must not make a run its own parent.
+ */
+export declare function withRunContext<T>(ctx: RunContext, fn: () => T): T;
+/** The current execution context, or undefined outside any entry point. */
+export declare function getRunContext(): RunContext | undefined;
+/**
+ * Merge the context header into request headers.
+ *
+ * One serialised header rather than several, so adding a field never needs a
+ * matching change in the platform's parsing. Never overwrites a header the
+ * caller set: a caller that knows its own context beats the ambient one.
+ */
+export declare function withRunContextHeader(init?: HeadersInit): HeadersInit | undefined;
+export declare function platformFetch(env: Env, url: string | URL, rawInit?: RequestInit): Promise<Response>;
 /**
  * Workspace API fetch - routes workspace service requests through WorkspaceObject DO
  * for production WfP workers, avoiding 522 recursive invocation errors.
@@ -7036,7 +7219,7 @@ export declare function platformFetch(env: Env, url: string | URL, init?: Reques
  * @param path - Workspace API sub-path (e.g., '/ingest-event')
  * @param init - Standard fetch options
  */
-export declare function workspaceApiFetch(env: Pick<Env, 'WORKSPACE_API_URL' | 'WORKSPACE_API_KEY' | 'WORKSPACE_ID' | 'DEPLOYMENT_MODE' | 'WorkspaceObject'>, path: string, init?: RequestInit): Promise<Response>;
+export declare function workspaceApiFetch(env: Pick<Env, 'WORKSPACE_API_URL' | 'WORKSPACE_API_KEY' | 'WORKSPACE_ID' | 'DEPLOYMENT_MODE' | 'WorkspaceObject'>, path: string, rawInit?: RequestInit): Promise<Response>;
 `,
     "workflows.d.ts": `import type { WorkflowDefinition } from './core-workflow-types';
 /**
@@ -7231,7 +7414,7 @@ export declare class BaseAgent extends AIChatAgent<Env> {
  * - Types are defined in core-workflow-types.ts
  * - Native DO-based implementation is in core-workflow-instance.ts and core-workflow-coordinator.ts
  */
-import type { Env } from './core-utils';
+import { type Env } from './core-utils';
 export type { WorkflowResult, WorkflowStatus, WorkflowInstanceInfo, WorkflowDefinition, WorkflowContext, WorkflowStepUtilities, StepOptions, WaitEventOptions, WorkflowLogger, WorkflowState, WorkflowStatusResponse, } from './core-workflow-types';
 import type { WorkflowInstanceInfo } from './core-workflow-types';
 /**
@@ -7780,8 +7963,8 @@ export declare const integrationApiSchema: z.ZodObject<{
     endpoint: z.ZodString;
     data: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
 }, "strip", z.ZodTypeAny, {
-    method: "POST" | "GET" | "PUT" | "PATCH" | "DELETE";
     endpoint: string;
+    method: "POST" | "GET" | "PUT" | "PATCH" | "DELETE";
     data?: Record<string, unknown> | undefined;
 }, {
     endpoint: string;
@@ -8022,7 +8205,7 @@ function createKeyboardListener() {
 }
 
 // src/generated/version.ts
-var VERSION = "0.25.3";
+var VERSION = "0.26.0";
 
 // src/commands/dev.ts
 var exports_dev = {};
@@ -8103,6 +8286,7 @@ async function execDev(options) {
     await ensureGitCredentialHelper(creds.baseUrl);
   }
   ensureRunworkRemote(cwd, client.getGitRemoteUrl(config.workspaceId, config.appId));
+  let editsUnprotected = false;
   const oldManifest = await loadManifest(cwd);
   if (oldManifest) {
     const userEdits = await detectUserEdits(cwd, oldManifest);
@@ -8126,9 +8310,22 @@ async function execDev(options) {
         execFileSync("git", ["add", "--", ...userEdits], { stdio: "pipe" });
         execFileSync("git", ["commit", "-m", "sync: user edits"], { stdio: "pipe" });
       } catch {}
+      editsUnprotected = hasTrackedChanges(cwd);
+      if (editsUnprotected) {
+        if (useJson) {
+          jsonLine({
+            event: "startup",
+            phase: "user_edits_unprotected",
+            timestamp: ts(),
+            warning: "Could not commit your edits (a commit hook or lock may be interfering). Skipping the template update so they are not lost."
+          });
+        } else {
+          console.warn(yellow("Could not commit your edits (a commit hook or lock may be interfering). Skipping the template update so they are not lost."));
+        }
+      }
     }
   }
-  if (!noSync) {
+  if (!noSync && !editsUnprotected) {
     if (useJson) {
       jsonLine({ event: "startup", phase: "template_update", timestamp: ts() });
     } else {
@@ -8971,10 +9168,31 @@ function startAppProbeScript(pattern) {
 function isCommandNotFoundExit(code) {
   return typeof code === "number" && COMMAND_NOT_FOUND_EXIT_CODES.includes(code);
 }
-var PATH_REFRESH_FAILED_MARKER = "__runwork_path_refresh_failed__", WINDOWS_PATH_REFRESH, COMMAND_NOT_FOUND_EXIT_CODES;
+function expandWindowsPathTemplate(path2, resolved) {
+  for (const [placeholder, defaults] of Object.entries(WINDOWS_PATH_PLACEHOLDERS)) {
+    if (!path2.startsWith(placeholder))
+      continue;
+    const rest = path2.slice(placeholder.length).replace(/^[/\\]/, "");
+    const fromEnv = resolved[placeholder];
+    if (fromEnv) {
+      return { path: `${fromEnv.replace(/[/\\]+$/, "")}\\${rest.replace(/\//g, "\\")}`, needsHomeJoin: false };
+    }
+    if ("absoluteDefault" in defaults) {
+      return { path: `${defaults.absoluteDefault}\\${rest.replace(/\//g, "\\")}`, needsHomeJoin: false };
+    }
+    return { path: `${defaults.homeRelativeDefault}/${rest}`, needsHomeJoin: true };
+  }
+  return { path: path2, needsHomeJoin: !/^([A-Za-z]:[\\/]|\\\\|\/)/.test(path2) };
+}
+var PATH_REFRESH_FAILED_MARKER = "__runwork_path_refresh_failed__", WINDOWS_PATH_REFRESH, COMMAND_NOT_FOUND_EXIT_CODES, WINDOWS_PATH_PLACEHOLDERS;
 var init_detection_probes = __esm(() => {
   WINDOWS_PATH_REFRESH = "try { $env:Path = [Environment]::GetEnvironmentVariable('Path','Machine') + ';' + " + "[Environment]::GetEnvironmentVariable('Path','User') + ';' + $env:Path } " + `catch { Write-Output '${PATH_REFRESH_FAILED_MARKER}' }; `;
   COMMAND_NOT_FOUND_EXIT_CODES = [127, 9009];
+  WINDOWS_PATH_PLACEHOLDERS = {
+    "%APPDATA%": { homeRelativeDefault: "AppData/Roaming" },
+    "%LOCALAPPDATA%": { homeRelativeDefault: "AppData/Local" },
+    "%ProgramFiles%": { absoluteDefault: "C:\\Program Files" }
+  };
 });
 
 // src/utils/which.ts
@@ -9477,7 +9695,7 @@ var init_registry_data = __esm(() => {
           {
             method: "path",
             target: {
-              windows: "AppData/Roaming/Claude/claude_desktop_config.json",
+              windows: "%APPDATA%/Claude/claude_desktop_config.json",
               linux: ".config/Claude/claude_desktop_config.json"
             }
           }
@@ -9490,7 +9708,7 @@ var init_registry_data = __esm(() => {
       skillsPaths: { global: ".claude/skills", project: ".claude/skills" },
       mcpConfigPath: {
         macos: "Library/Application Support/Claude/claude_desktop_config.json",
-        windows: "AppData/Roaming/Claude/claude_desktop_config.json",
+        windows: "%APPDATA%/Claude/claude_desktop_config.json",
         linux: ".config/Claude/claude_desktop_config.json"
       },
       mcpConfigKey: "mcpServers",
@@ -9800,8 +10018,8 @@ var init_registry_data = __esm(() => {
         target: [
           { method: "binary", target: "windsurf" },
           { method: "path", target: { macos: "/Applications/Windsurf.app" } },
-          { method: "path", target: { windows: "AppData/Local/Programs/Windsurf" } },
-          { method: "path", target: { windows: "C:\\Program Files\\Windsurf" } }
+          { method: "path", target: { windows: "%LOCALAPPDATA%/Programs/Windsurf" } },
+          { method: "path", target: { windows: "%ProgramFiles%/Windsurf" } }
         ]
       },
       launch: { app: { macos: "Windsurf", windows: "Windsurf" } },
@@ -9881,7 +10099,14 @@ var init_registry_data = __esm(() => {
       name: "GitHub Copilot (VS Code)",
       description: "GitHub's AI pair programmer in VS Code",
       category: "extension",
-      detection: { method: "binary", target: "code" },
+      detection: {
+        method: "path",
+        target: {
+          macos: "Library/Application Support/Code/User/globalStorage/github.copilot",
+          windows: "%APPDATA%/Code/User/globalStorage/github.copilot",
+          linux: ".config/Code/User/globalStorage/github.copilot"
+        }
+      },
       launch: { app: { macos: "Visual Studio Code", windows: "Code" }, cli: "code" },
       logo: "vscode",
       downloadUrl: "https://marketplace.visualstudio.com/items?itemName=GitHub.copilot",
@@ -11760,7 +11985,7 @@ var verbose = false;
 import { execFile } from "child_process";
 import { existsSync as existsSync31 } from "fs";
 import { homedir as homedir8, platform as platform3 } from "os";
-import { isAbsolute as isAbsolute3, join as join25 } from "path";
+import { join as join25 } from "path";
 import { promisify } from "util";
 function isWindows() {
   return platform3() === "win32";
@@ -11781,7 +12006,12 @@ function resolveDetectionPath(target) {
   const resolved = resolvePlatformString(target);
   if (!resolved)
     return null;
-  return isAbsolute3(resolved) ? resolved : join25(homedir8(), resolved);
+  const expanded = expandWindowsPathTemplate(resolved, {
+    "%APPDATA%": process.env.APPDATA,
+    "%LOCALAPPDATA%": process.env.LOCALAPPDATA,
+    "%ProgramFiles%": process.env.ProgramFiles
+  });
+  return expanded.needsHomeJoin ? join25(homedir8(), expanded.path) : expanded.path;
 }
 function checkPath(target) {
   const absolute = resolveDetectionPath(target);
@@ -11865,8 +12095,70 @@ var init_detection = __esm(() => {
   NOT_DETECTED = { detected: false };
 });
 
+// src/agents/transcript-sources.ts
+import { accessSync, constants, statSync as statSync4 } from "fs";
+function classifyFsErrorCode(code) {
+  if (code === "ENOENT" || code === "ENOTDIR")
+    return "missing-dir";
+  if (code === "EACCES" || code === "EPERM")
+    return "permission-denied";
+  return "error";
+}
+function errorCode(err) {
+  const e = err;
+  return e && typeof e === "object" && typeof e.code === "string" ? e.code : undefined;
+}
+function probeTranscriptSource(source) {
+  if (source.available && !source.available()) {
+    return { status: "missing-tool", path: source.path, detail: source.tool ?? "unknown tool" };
+  }
+  try {
+    statSync4(source.path);
+  } catch (err) {
+    return { status: classifyFsErrorCode(errorCode(err)), path: source.path, detail: errorCode(err) };
+  }
+  try {
+    accessSync(source.path, source.kind === "dir" ? constants.R_OK | constants.X_OK : constants.R_OK);
+  } catch (err) {
+    return { status: classifyFsErrorCode(errorCode(err)), path: source.path, detail: errorCode(err) };
+  }
+  return { status: "ok", path: source.path };
+}
+function diagnoseTranscriptRead(agent, thrown) {
+  const probe = summarizeTranscriptSources(agent.transcriptSources?.() ?? []);
+  const base = { agentSlug: agent.slug, sessions: null };
+  if (probe.status !== "ok" && probe.status !== "no-reader") {
+    return {
+      ...base,
+      status: probe.status,
+      path: probe.path,
+      ...probe.detail ? { detail: probe.detail } : {}
+    };
+  }
+  if (thrown !== undefined) {
+    return { ...base, status: "error", detail: thrown instanceof Error ? thrown.message : String(thrown) };
+  }
+  return probe.status === "ok" ? { ...base, status: "error", path: probe.path, detail: "read returned no result" } : { ...base, status: "no-reader" };
+}
+function transcriptSourcesReadable(sources) {
+  return summarizeTranscriptSources(sources).status === "ok";
+}
+function summarizeTranscriptSources(sources) {
+  if (sources.length === 0)
+    return { status: "no-reader", path: "" };
+  const probes = sources.map(probeTranscriptSource);
+  const rank = ["permission-denied", "missing-tool", "error", "ok", "missing-dir"];
+  for (const status of rank) {
+    const hit = probes.find((p) => p.status === status);
+    if (hit)
+      return hit;
+  }
+  return probes[0];
+}
+var init_transcript_sources = () => {};
+
 // src/agents/claude-code.ts
-import { chmodSync, existsSync as existsSync32, mkdirSync as mkdirSync16, readFileSync as readFileSync25, readdirSync as readdirSync7, rmSync as rmSync5, statSync as statSync4, writeFileSync as writeFileSync16 } from "fs";
+import { chmodSync, existsSync as existsSync32, mkdirSync as mkdirSync16, readFileSync as readFileSync25, readdirSync as readdirSync7, rmSync as rmSync5, statSync as statSync5, writeFileSync as writeFileSync16 } from "fs";
 import { join as join26 } from "path";
 import { homedir as homedir9 } from "os";
 function getPluginJson() {
@@ -11910,6 +12202,7 @@ var init_claude_code = __esm(() => {
   init_instruction_hint();
   init_session_start_hook();
   init_detection();
+  init_transcript_sources();
   ClaudeCodeAdapter = class ClaudeCodeAdapter extends RegistryDetectedAdapter {
     name = "Claude Code";
     slug = "claude-code";
@@ -12207,7 +12500,7 @@ ${instructions}`;
             const filePath = join26(cwdPath, file);
             let stat;
             try {
-              stat = statSync4(filePath);
+              stat = statSync5(filePath);
             } catch {
               continue;
             }
@@ -12299,9 +12592,15 @@ ${instructions}`;
         return null;
       }
     }
+    transcriptRoot() {
+      return join26(homedir9(), ".claude", "projects");
+    }
+    transcriptSources() {
+      return [{ path: this.transcriptRoot(), kind: "dir" }];
+    }
     async readSessionDigests(sinceISO) {
       try {
-        const projectsDir = join26(homedir9(), ".claude", "projects");
+        const projectsDir = this.transcriptRoot();
         if (!existsSync32(projectsDir))
           return null;
         const sinceMs = sinceISO ? new Date(sinceISO).getTime() : 0;
@@ -12326,7 +12625,7 @@ ${instructions}`;
             const filePath = join26(cwdPath, file);
             let stat;
             try {
-              stat = statSync4(filePath);
+              stat = statSync5(filePath);
             } catch {
               continue;
             }
@@ -12350,8 +12649,8 @@ ${instructions}`;
     }
     async listSessions(sinceISO) {
       try {
-        const projectsDir = join26(homedir9(), ".claude", "projects");
-        if (!existsSync32(projectsDir))
+        const projectsDir = this.transcriptRoot();
+        if (!transcriptSourcesReadable(this.transcriptSources()))
           return null;
         const sinceMs = sinceISO ? new Date(sinceISO).getTime() : 0;
         let cwdEntries;
@@ -12375,7 +12674,7 @@ ${instructions}`;
             const filePath = join26(cwdPath, file);
             let stat;
             try {
-              stat = statSync4(filePath);
+              stat = statSync5(filePath);
             } catch {
               continue;
             }
@@ -12413,7 +12712,7 @@ ${instructions}`;
     }
     async readSkillUsage(lastSyncAt) {
       try {
-        const projectsDir = join26(homedir9(), ".claude", "projects");
+        const projectsDir = this.transcriptRoot();
         if (!existsSync32(projectsDir))
           return null;
         const sinceMs = lastSyncAt ? new Date(lastSyncAt).getTime() : 0;
@@ -12448,7 +12747,7 @@ ${instructions}`;
             const filePath = join26(cwdPath, file);
             let fileStat;
             try {
-              fileStat = statSync4(filePath);
+              fileStat = statSync5(filePath);
             } catch {
               continue;
             }
@@ -12704,7 +13003,7 @@ var init_claude_desktop_plugin_tree = __esm(() => {
 });
 
 // src/agents/claude-desktop.ts
-import { existsSync as existsSync34, mkdtempSync as mkdtempSync3, readdirSync as readdirSync8, readFileSync as readFileSync26, rmSync as rmSync7, statSync as statSync5, writeFileSync as writeFileSync18, mkdirSync as mkdirSync18 } from "fs";
+import { existsSync as existsSync34, mkdtempSync as mkdtempSync3, readdirSync as readdirSync8, readFileSync as readFileSync26, rmSync as rmSync7, statSync as statSync6, writeFileSync as writeFileSync18, mkdirSync as mkdirSync18 } from "fs";
 import { dirname as dirname9, join as join28 } from "path";
 import { homedir as homedir10, platform as platform4, tmpdir as tmpdir3 } from "os";
 function isRunworkRpmPluginName(name) {
@@ -12863,6 +13162,7 @@ function setCoworkPluginEnabled(pluginsDir, enabled) {
 var PLUGIN_NAME2 = "runwork", PLUGIN_VERSION2 = "1.0.0", PLUGIN_DESCRIPTION = "Skills and tools from your Runwork workspace", PLUGIN_AUTHOR_NAME = "Runwork", ClaudeDesktopAdapter;
 var init_claude_desktop = __esm(() => {
   init_types();
+  init_transcript_sources();
   init_session_digest();
   init_json_config();
   init_instruction_hint();
@@ -13136,7 +13436,7 @@ var init_claude_desktop = __esm(() => {
                   const filePath = join28(projPath, file);
                   let stat;
                   try {
-                    stat = statSync5(filePath);
+                    stat = statSync6(filePath);
                   } catch {
                     continue;
                   }
@@ -13161,10 +13461,13 @@ var init_claude_desktop = __esm(() => {
         return null;
       }
     }
+    transcriptSources() {
+      return [{ path: getCoworkBaseDir(), kind: "dir" }];
+    }
     async listSessions(sinceISO) {
       try {
         const baseDir = getCoworkBaseDir();
-        if (!existsSync34(baseDir))
+        if (!transcriptSourcesReadable(this.transcriptSources()))
           return null;
         const sinceMs = sinceISO ? new Date(sinceISO).getTime() : 0;
         let accounts;
@@ -13200,7 +13503,7 @@ var init_claude_desktop = __esm(() => {
                   const filePath = join28(projPath, file);
                   let stat;
                   try {
-                    stat = statSync5(filePath);
+                    stat = statSync6(filePath);
                   } catch {
                     continue;
                   }
@@ -13341,7 +13644,7 @@ var init_claude_desktop = __esm(() => {
             continue;
           const orgPath = join28(baseDir, orgDir);
           try {
-            if (!statSync5(orgPath).isDirectory())
+            if (!statSync6(orgPath).isDirectory())
               continue;
           } catch {
             continue;
@@ -13351,7 +13654,7 @@ var init_claude_desktop = __esm(() => {
               continue;
             const userPath = join28(orgPath, userDir);
             try {
-              if (!statSync5(userPath).isDirectory())
+              if (!statSync6(userPath).isDirectory())
                 continue;
             } catch {
               continue;
@@ -13479,6 +13782,7 @@ var init_cursor = __esm(async () => {
   init_skill_removal();
   init_json_config();
   init_detection();
+  init_transcript_sources();
   await init_sqlite();
   CursorAdapter = class CursorAdapter extends RegistryDetectedAdapter {
     name = "Cursor";
@@ -13737,6 +14041,16 @@ ${instructions}`;
         return null;
       }
     }
+    transcriptSources() {
+      return [
+        {
+          path: this.globalStorageDbPath(),
+          kind: "file",
+          tool: "sqlite",
+          available: sqliteAvailable
+        }
+      ];
+    }
     globalStorageDbPath() {
       const os2 = platform5();
       if (os2 === "darwin") {
@@ -13764,7 +14078,7 @@ ${instructions}`;
     async listSessions(sinceISO) {
       try {
         const dbPath = this.globalStorageDbPath();
-        if (!existsSync35(dbPath) || !sqliteAvailable())
+        if (!transcriptSourcesReadable(this.transcriptSources()))
           return null;
         const rows = queryReadonlySqlite(dbPath, `SELECT json_object('id', json_extract(value,'$.composerId'), 'name', json_extract(value,'$.name'), 'createdAt', json_extract(value,'$.createdAt'), 'lastUpdatedAt', json_extract(value,'$.lastUpdatedAt')) FROM cursorDiskKV WHERE key LIKE 'composerData:%'`);
         const sinceMs = sinceISO ? new Date(sinceISO).getTime() : 0;
@@ -13893,7 +14207,7 @@ ${hint}`;
 });
 
 // src/agents/codex.ts
-import { existsSync as existsSync37, mkdirSync as mkdirSync21, readdirSync as readdirSync11, readFileSync as readFileSync27, statSync as statSync6, writeFileSync as writeFileSync21 } from "fs";
+import { existsSync as existsSync37, mkdirSync as mkdirSync21, readdirSync as readdirSync11, readFileSync as readFileSync27, statSync as statSync7, writeFileSync as writeFileSync21 } from "fs";
 import { basename as basename3, join as join31 } from "path";
 import { homedir as homedir13 } from "os";
 import { parse, stringify } from "smol-toml";
@@ -13903,6 +14217,7 @@ function isRunworkManagedCodexKey(key) {
 var CodexAdapter, CodexDesktopAdapter;
 var init_codex = __esm(async () => {
   init_types();
+  init_transcript_sources();
   init_session_digest();
   init_session_listing();
   init_skill_removal();
@@ -14121,6 +14436,12 @@ var init_codex = __esm(async () => {
         return null;
       }
     }
+    transcriptRoot() {
+      return join31(homedir13(), ".codex", "sessions");
+    }
+    transcriptSources() {
+      return [{ path: this.transcriptRoot(), kind: "dir" }];
+    }
     scanRolloutActivity(sinceMs) {
       const days = new Set;
       const result = {
@@ -14131,7 +14452,7 @@ var init_codex = __esm(async () => {
         latestMs: 0,
         activeDays: []
       };
-      const sessionsDir = join31(homedir13(), ".codex", "sessions");
+      const sessionsDir = this.transcriptRoot();
       if (!existsSync37(sessionsDir))
         return result;
       const files = [];
@@ -14154,7 +14475,7 @@ var init_codex = __esm(async () => {
       for (const file of files) {
         let stat;
         try {
-          stat = statSync6(file);
+          stat = statSync7(file);
         } catch {
           continue;
         }
@@ -14221,8 +14542,8 @@ var init_codex = __esm(async () => {
     }
     async readSessionDigests(sinceISO) {
       try {
-        const sessionsDir = join31(homedir13(), ".codex", "sessions");
-        if (!existsSync37(sessionsDir))
+        const sessionsDir = this.transcriptRoot();
+        if (!transcriptSourcesReadable(this.transcriptSources()))
           return null;
         const sinceMs = sinceISO ? new Date(sinceISO).getTime() : 0;
         const files = [];
@@ -14246,7 +14567,7 @@ var init_codex = __esm(async () => {
         for (const file of files) {
           let stat;
           try {
-            stat = statSync6(file);
+            stat = statSync7(file);
           } catch {
             continue;
           }
@@ -14269,8 +14590,8 @@ var init_codex = __esm(async () => {
     }
     async listSessions(sinceISO) {
       try {
-        const sessionsDir = join31(homedir13(), ".codex", "sessions");
-        if (!existsSync37(sessionsDir))
+        const sessionsDir = this.transcriptRoot();
+        if (!transcriptSourcesReadable(this.transcriptSources()))
           return null;
         const sinceMs = sinceISO ? new Date(sinceISO).getTime() : 0;
         const files = [];
@@ -14294,7 +14615,7 @@ var init_codex = __esm(async () => {
         for (const file of files) {
           let stat;
           try {
-            stat = statSync6(file);
+            stat = statSync7(file);
           } catch {
             continue;
           }
@@ -14333,7 +14654,7 @@ var init_codex = __esm(async () => {
     }
     async readSkillUsage(lastSyncAt) {
       try {
-        const sessionsDir = join31(homedir13(), ".codex", "sessions");
+        const sessionsDir = this.transcriptRoot();
         if (!existsSync37(sessionsDir))
           return null;
         const sinceMs = lastSyncAt ? new Date(lastSyncAt).getTime() : 0;
@@ -14350,7 +14671,7 @@ var init_codex = __esm(async () => {
             if (entry.endsWith(".jsonl")) {
               let fileStat;
               try {
-                fileStat = statSync6(fullPath);
+                fileStat = statSync7(fullPath);
               } catch {
                 continue;
               }
@@ -14359,7 +14680,7 @@ var init_codex = __esm(async () => {
               this.parseRolloutForSkills(fullPath, sinceMs, skillCounts);
             } else {
               try {
-                if (statSync6(fullPath).isDirectory())
+                if (statSync7(fullPath).isDirectory())
                   walkDir2(fullPath);
               } catch {
                 continue;
@@ -14480,6 +14801,12 @@ var init_codex = __esm(async () => {
     async listSessions() {
       return null;
     }
+    async readSessionDigests() {
+      return null;
+    }
+    transcriptSources() {
+      return [];
+    }
   };
 });
 
@@ -14602,7 +14929,7 @@ var init_cline = __esm(() => {
 });
 
 // src/agents/gemini.ts
-import { existsSync as existsSync39, mkdirSync as mkdirSync23, readdirSync as readdirSync13, readFileSync as readFileSync29, statSync as statSync7, writeFileSync as writeFileSync23 } from "fs";
+import { existsSync as existsSync39, mkdirSync as mkdirSync23, readdirSync as readdirSync13, readFileSync as readFileSync29, statSync as statSync8, writeFileSync as writeFileSync23 } from "fs";
 import { basename as basename4, join as join33 } from "path";
 import { homedir as homedir15 } from "os";
 var GeminiAdapter;
@@ -14612,6 +14939,7 @@ var init_gemini = __esm(() => {
   init_skill_removal();
   init_trash();
   init_types();
+  init_transcript_sources();
   init_instruction_hint();
   init_json_config();
   init_detection();
@@ -14684,7 +15012,7 @@ var init_gemini = __esm(() => {
     }
     async readUsageStats(lastSyncAt) {
       try {
-        const tmpDir = join33(homedir15(), ".gemini", "tmp");
+        const tmpDir = this.transcriptRoot();
         if (!existsSync39(tmpDir))
           return null;
         const sinceMs = lastSyncAt ? new Date(lastSyncAt).getTime() : 0;
@@ -14714,7 +15042,7 @@ var init_gemini = __esm(() => {
             const filePath = join33(chatsDir, file.name);
             let stat;
             try {
-              stat = statSync7(filePath);
+              stat = statSync8(filePath);
             } catch {
               continue;
             }
@@ -14762,8 +15090,14 @@ var init_gemini = __esm(() => {
         return null;
       }
     }
+    transcriptRoot() {
+      return join33(homedir15(), ".gemini", "tmp");
+    }
+    transcriptSources() {
+      return [{ path: this.transcriptRoot(), kind: "dir" }];
+    }
     *chatFiles(sinceMs) {
-      const tmpDir = join33(homedir15(), ".gemini", "tmp");
+      const tmpDir = this.transcriptRoot();
       if (!existsSync39(tmpDir))
         return;
       let projects;
@@ -14788,7 +15122,7 @@ var init_gemini = __esm(() => {
           const filePath = join33(chatsDir, file);
           let stat;
           try {
-            stat = statSync7(filePath);
+            stat = statSync8(filePath);
           } catch {
             continue;
           }
@@ -14800,6 +15134,8 @@ var init_gemini = __esm(() => {
     }
     async listSessions(sinceISO) {
       try {
+        if (!transcriptSourcesReadable(this.transcriptSources()))
+          return null;
         const sinceMs = sinceISO ? new Date(sinceISO).getTime() : 0;
         const sessions = [];
         for (const { filePath, project, mtimeMs } of this.chatFiles(sinceMs)) {
@@ -14839,6 +15175,8 @@ var init_gemini = __esm(() => {
     }
     async readSessionDigests(sinceISO) {
       try {
+        if (!transcriptSourcesReadable(this.transcriptSources()))
+          return null;
         const sinceMs = sinceISO ? new Date(sinceISO).getTime() : 0;
         const digests = [];
         for (const { filePath, project } of this.chatFiles(sinceMs)) {
@@ -14884,6 +15222,7 @@ var init_generic_adapter = __esm(() => {
   init_json_config();
   init_instruction_hint();
   init_registry();
+  init_detection_probes();
   init_detection();
   init_trash();
   GenericAgentAdapter = class GenericAgentAdapter extends RegistryDetectedAdapter {
@@ -14908,7 +15247,13 @@ var init_generic_adapter = __esm(() => {
     async writeMcpServers(servers, _scope) {
       if (!this.def.mcpConfigPath)
         return;
-      const filePath = join34(homedir16(), resolvePlatformString(this.def.mcpConfigPath) || "");
+      const resolved = resolvePlatformString(this.def.mcpConfigPath) || "";
+      const expanded = expandWindowsPathTemplate(resolved, {
+        "%APPDATA%": process.env.APPDATA,
+        "%LOCALAPPDATA%": process.env.LOCALAPPDATA,
+        "%ProgramFiles%": process.env.ProgramFiles
+      });
+      const filePath = expanded.needsHomeJoin ? join34(homedir16(), expanded.path) : expanded.path;
       if (!filePath)
         return;
       const entries = {};
@@ -15061,6 +15406,26 @@ var init_detect = __esm(async () => {
   ALL_ADAPTERS = buildAllAdapters();
 });
 
+// ../../shared/types/local-conversations.ts
+function describeScanOutcome(outcome) {
+  switch (outcome.status) {
+    case "ok":
+    case "no-reader":
+      return null;
+    case "missing-dir":
+      return `no conversation history found${outcome.path ? ` at ${outcome.path}` : ""}`;
+    case "permission-denied":
+      return `access denied${outcome.path ? ` to ${outcome.path}` : ""}`;
+    case "missing-tool":
+      return `needs ${outcome.detail ?? "a tool that is not installed"}`;
+    case "error":
+      return `could not be read${outcome.detail ? `: ${outcome.detail}` : ""}`;
+  }
+}
+function scanOutcomeNeedsAttention(outcome) {
+  return outcome.status === "permission-denied" || outcome.status === "error";
+}
+
 // src/utils/insight-id.ts
 import { createHash as createHash3 } from "node:crypto";
 function computeInsightId(userSeed, localKey) {
@@ -15211,7 +15576,7 @@ __export(exports_run_log, {
   RUN_LOG_CAP: () => RUN_LOG_CAP,
   ANALYST_ERROR_MAX_CHARS: () => ANALYST_ERROR_MAX_CHARS
 });
-import { existsSync as existsSync43, mkdirSync as mkdirSync25, readFileSync as readFileSync32, readdirSync as readdirSync15, statSync as statSync8, unlinkSync as unlinkSync7, writeFileSync as writeFileSync25 } from "fs";
+import { existsSync as existsSync43, mkdirSync as mkdirSync25, readFileSync as readFileSync32, readdirSync as readdirSync15, statSync as statSync9, unlinkSync as unlinkSync7, writeFileSync as writeFileSync25 } from "fs";
 import { dirname as dirname10, join as join37 } from "path";
 import { homedir as homedir19 } from "os";
 function runLogPath() {
@@ -15355,7 +15720,7 @@ function acquireRunLock(nowMs = Date.now()) {
       return true;
     } catch {
       try {
-        if (nowMs - statSync8(p).mtimeMs < RUN_STALE_MS)
+        if (nowMs - statSync9(p).mtimeMs < RUN_STALE_MS)
           return false;
         unlinkSync7(p);
       } catch {
@@ -16043,6 +16408,7 @@ var init_reflect = __esm(async () => {
   init_store();
   init_client();
   init_resolve();
+  init_transcript_sources();
   init_session_digest();
   init_insight_id();
   init_insight_store();
@@ -16107,13 +16473,13 @@ var init_reflect = __esm(async () => {
     const seen = new Set;
     for (const adapter2 of adapters) {
       if (!adapter2.readSessionDigests) {
-        perAgent.push({ slug: adapter2.slug, sessions: "unsupported" });
+        perAgent.push({ agentSlug: adapter2.slug, status: "no-reader", sessions: null });
         continue;
       }
       try {
         const sessions = await adapter2.readSessionDigests(sinceISO);
         if (sessions === null) {
-          perAgent.push({ slug: adapter2.slug, sessions: "unsupported" });
+          perAgent.push(diagnoseTranscriptRead(adapter2));
           continue;
         }
         let added = 0;
@@ -16125,20 +16491,26 @@ var init_reflect = __esm(async () => {
           digests.push(s);
           added++;
         }
-        perAgent.push({ slug: adapter2.slug, sessions: added });
-      } catch {
-        perAgent.push({ slug: adapter2.slug, sessions: "error" });
+        perAgent.push({ agentSlug: adapter2.slug, status: "ok", sessions: added });
+      } catch (err) {
+        perAgent.push(diagnoseTranscriptRead(adapter2, err));
       }
     }
     if (!json) {
       console.error(bold(`
 Reflection over the last ${days} days`));
-      for (const a of perAgent)
-        console.error(`  ${cyan(a.slug)}: ${a.sessions === "unsupported" ? gray("no transcript reader") : a.sessions === "error" ? red("read error") : `${a.sessions} session(s)`}`);
+      for (const a of perAgent) {
+        const reason = describeScanOutcome(a);
+        if (reason === null) {
+          console.error(`  ${cyan(a.agentSlug)}: ${a.status === "no-reader" ? gray("no transcript reader") : `${a.sessions} session(s)`}`);
+        } else {
+          console.error(`  ${cyan(a.agentSlug)}: ${scanOutcomeNeedsAttention(a) ? red(reason) : gray(reason)}`);
+        }
+      }
     }
     if (digests.length === 0) {
       if (json) {
-        jsonOut({ insights: [], reason: "no-sessions" });
+        jsonOut({ insights: [], reason: "no-sessions", perAgent });
         return;
       }
       console.error(yellow(`
@@ -16503,19 +16875,19 @@ async function listLocalConversations(opts = {}) {
   const perAgent = [];
   for (const adapter2 of adapters) {
     if (!adapter2.listSessions) {
-      perAgent.push({ slug: adapter2.slug, sessions: "unsupported" });
+      perAgent.push({ agentSlug: adapter2.slug, status: "no-reader", sessions: null });
       continue;
     }
     try {
       const sessions = await adapter2.listSessions(sinceISO);
       if (sessions === null) {
-        perAgent.push({ slug: adapter2.slug, sessions: "unsupported" });
+        perAgent.push(diagnoseTranscriptRead(adapter2));
         continue;
       }
       listings.push(sessions);
-      perAgent.push({ slug: adapter2.slug, sessions: sessions.length });
-    } catch {
-      perAgent.push({ slug: adapter2.slug, sessions: "error" });
+      perAgent.push({ agentSlug: adapter2.slug, status: "ok", sessions: sessions.length });
+    } catch (err) {
+      perAgent.push(diagnoseTranscriptRead(adapter2, err));
     }
   }
   const conversations = mergeSessionListings(listings, {
@@ -16526,6 +16898,7 @@ async function listLocalConversations(opts = {}) {
 }
 var DEFAULT_IDLE_MINUTES = 10;
 var init_conversation_registry = __esm(async () => {
+  init_transcript_sources();
   await init_detect();
 });
 
@@ -17922,7 +18295,7 @@ var init_welcome = __esm(() => {
 });
 
 // src/index.ts
-import { Command as Command39 } from "commander";
+import { Command as Command40 } from "commander";
 
 // src/commands/login.ts
 init_login_flow();
@@ -18231,7 +18604,18 @@ var deployCommand = new Command5("deploy").description("Deploy the current app t
     console.log("Syncing...");
   try {
     commitWorkingTree(cwd, `deploy: ${new Date().toISOString().replace("T", " ").slice(0, 19)}`);
-  } catch {}
+  } catch (err) {
+    if (hasTrackedChanges(cwd)) {
+      const detail = err instanceof Error ? err.message : String(err);
+      if (useJson) {
+        jsonOut(buildErrorResponse("deploy", "Could not commit your changes", `Your working tree has uncommitted changes that could not be committed (${detail.slice(0, 300)}). Deploying now would ship the PREVIOUS commit while reporting success.`, ["Check for a failing pre-commit hook or a stale .git/index.lock", "Commit the changes yourself with git commit", "Then re-run runwork deploy"]));
+        process.exit(1);
+      }
+      console.error("Could not commit your changes, so nothing new would be deployed.");
+      console.error("A pre-commit hook or a stale .git/index.lock may be interfering. Commit manually, then re-run `runwork deploy`.");
+      process.exit(1);
+    }
+  }
   if (!hasCommits(cwd)) {
     if (useJson) {
       jsonOut(buildErrorResponse("deploy", "Nothing to deploy", "No commits exist and the working tree has no changes to commit, so there is nothing to sync or deploy.", ["Make changes to your app first", "Run runwork dev to develop and verify changes", "Then run runwork deploy"]));
@@ -20372,9 +20756,14 @@ conversationsCommand.command("list").description("List local conversations acros
 Local conversations, last ${days} day(s)` : `
 Local conversations (all)`));
   for (const a of result.perAgent) {
-    if (a.sessions === "unsupported")
+    if (a.status === "no-reader")
       continue;
-    console.log(dim(`  ${a.slug}: ${a.sessions === "error" ? "read error" : `${a.sessions} session(s)`}`));
+    const reason = describeScanOutcome(a);
+    if (reason === null) {
+      console.log(dim(`  ${a.agentSlug}: ${a.sessions} session(s)`));
+    } else {
+      console.log(`  ${a.agentSlug}: ${scanOutcomeNeedsAttention(a) ? yellow(reason) : dim(reason)}`);
+    }
   }
   console.log("");
   const width = process.stdout.columns || 120;
@@ -20391,6 +20780,26 @@ Local conversations (all)`));
   if (result.conversations.length === 0)
     console.log(dim("  none"));
 });
+conversationsCommand.command("status").description("Why each agent did or did not contribute conversations (no conversation data)").option("--days <n>", "Look back this many days (0 = no limit)", String(DEFAULT_LOOKBACK_DAYS)).action(async (opts, command) => {
+  const json = command.optsWithGlobals().json === true || !process.stdout.isTTY;
+  const days = parseDays(opts.days);
+  const { perAgent } = await listLocalConversations({ sinceISO: sinceFromDays(days) });
+  if (json) {
+    jsonOut({ perAgent });
+    return;
+  }
+  console.log(bold(days > 0 ? `
+Conversation sources, last ${days} day(s)` : `
+Conversation sources`));
+  for (const a of perAgent) {
+    const reason = describeScanOutcome(a);
+    if (reason === null) {
+      console.log(`  ${cyan(a.agentSlug)}: ${a.status === "no-reader" ? dim("no transcript reader") : `${a.sessions} conversation(s)`}`);
+    } else {
+      console.log(`  ${cyan(a.agentSlug)}: ${scanOutcomeNeedsAttention(a) ? yellow(reason) : dim(reason)}`);
+    }
+  }
+});
 conversationsCommand.command("scan").description("Detect finished conversations (idle threshold) and queue them for reflection").option("--days <n>", "Look back this many days (0 = no limit)", String(DEFAULT_LOOKBACK_DAYS)).option("--idle-minutes <n>", "Idle threshold that marks a conversation finished", String(DEFAULT_IDLE_MINUTES)).action(async (opts, command) => {
   const json = command.optsWithGlobals().json === true || !process.stdout.isTTY;
   const days = parseDays(opts.days);
@@ -20454,11 +20863,12 @@ conversationsCommand.command("scan").description("Detect finished conversations
   const snapshot = {
     generatedAt: new Date().toISOString(),
     idleMinutes,
-    conversations: [...listed, ...rescued].sort((a, b) => b.lastActivityAt.localeCompare(a.lastActivityAt))
+    conversations: [...listed, ...rescued].sort((a, b) => b.lastActivityAt.localeCompare(a.lastActivityAt)),
+    perAgent: result.perAgent
   };
   writeJsonAtomic(join43(homedir24(), ".runwork", "conversations.json"), snapshot);
   if (json) {
-    jsonOut({ queued: scan.queued, reopened: scan.reopened, pruned: scan.pruned, pending, finished: finished.length });
+    jsonOut({ queued: scan.queued, reopened: scan.reopened, pruned: scan.pruned, pending, finished: finished.length, perAgent: result.perAgent });
     return;
   }
   console.log(green(`Scanned ${result.conversations.length} conversation(s): ${scan.queued} newly queued, ${scan.reopened} reopened, ${pending} pending analysis.`));
@@ -23433,7 +23843,11 @@ async function executeSyncPlan(plan, resolvedConflicts, ctx) {
     if (!action.remoteContent)
       continue;
     const skillFile = makeSkillFile(action.name, action.remoteContent);
-    await writeSkillToAgents(skillFile, action.source, ctx);
+    const outcome = await writeSkillToAgents(skillFile, action.source, ctx);
+    if (!writeLanded(outcome)) {
+      vlog(`  Pull FAILED for ${action.name} (${outcome.succeeded}/${outcome.attempted} agent writes); will retry next sync`);
+      continue;
+    }
     newHashes[action.name] = {
       localHash: contentHash(buildSkillMd2(skillFile)),
       remoteHash: contentHash(action.remoteContent),
@@ -23475,7 +23889,11 @@ async function executeSyncPlan(plan, resolvedConflicts, ctx) {
       vlog(`  Pushed (conflict resolved): ${action.name}`);
     } else if (resolution === "remote" && action.remoteContent) {
       const skillFile = makeSkillFile(action.name, action.remoteContent);
-      await writeSkillToAgents(skillFile, action.source, ctx);
+      const outcome = await writeSkillToAgents(skillFile, action.source, ctx);
+      if (!writeLanded(outcome)) {
+        vlog(`  Conflict pull FAILED for ${action.name} (${outcome.succeeded}/${outcome.attempted} agent writes); will retry next sync`);
+        continue;
+      }
       newHashes[action.name] = {
         localHash: contentHash(buildSkillMd2(skillFile)),
         remoteHash: contentHash(action.remoteContent),
@@ -23487,6 +23905,7 @@ async function executeSyncPlan(plan, resolvedConflicts, ctx) {
   }
   for (const _action of plan.skips) {}
   const deletionSlugs = plan.deletions.map((action) => toSlug(action.name));
+  let removalsFailed = false;
   if (deletionSlugs.length) {
     for (const adapter2 of ctx.adapters) {
       if (!adapter2.supportsSkills() || !adapter2.removeSkills)
@@ -23494,14 +23913,19 @@ async function executeSyncPlan(plan, resolvedConflicts, ctx) {
       for (const scope of ctx.scopes) {
         try {
           await adapter2.removeSkills(deletionSlugs, scope);
-        } catch {}
+        } catch {
+          removalsFailed = true;
+        }
       }
     }
     for (const action of plan.deletions) {
-      vlog(`  Deleted locally: ${action.name}`);
+      vlog(removalsFailed ? `  Deletion of ${action.name} incomplete; will retry next sync` : `  Deleted locally: ${action.name}`);
     }
   }
-  return newHashes;
+  return {
+    newHashes,
+    failedDeletions: removalsFailed ? plan.deletions.map((action) => action.name) : []
+  };
 }
 function makeSkillFile(name, content) {
   return {
@@ -23512,17 +23936,25 @@ function makeSkillFile(name, content) {
   };
 }
 async function writeSkillToAgents(skillFile, source, ctx) {
+  let attempted = 0;
+  let succeeded = 0;
   for (const adapter2 of ctx.adapters) {
     if (source === "app" && ctx.hasMcp && adapter2.mcpProvidesSkills)
       continue;
     for (const scope of ctx.scopes) {
       if (!adapter2.supportsSkills())
         continue;
+      attempted++;
       try {
         await adapter2.writeSkills([skillFile], scope);
+        succeeded++;
       } catch {}
     }
   }
+  return { attempted, succeeded };
+}
+function writeLanded(outcome) {
+  return outcome.attempted === 0 || outcome.succeeded > 0;
 }
 function extractDescription(content) {
   const match = content.match(/^---\n[\s\S]*?description:\s*(.+)\n[\s\S]*?---/);
@@ -23937,7 +24369,7 @@ This account is not a member of "${state.workspaceName || state.workspaceId}".`)
   if (adapters.length > 0) {
     console.log(`  Syncing to: ${adapters.map((a) => a.name).join(", ")}`);
   }
-  const newHashes = await executeSyncPlan(plan, resolvedConflicts, {
+  const { newHashes, failedDeletions } = await executeSyncPlan(plan, resolvedConflicts, {
     client,
     workspaceId: state.workspaceId,
     adapters,
@@ -24324,7 +24756,10 @@ This account is not a member of "${state.workspaceName || state.workspaceId}".`)
   for (const [name, hash] of Object.entries(newHashes)) {
     mergedHashes[name] = hash;
   }
+  const retryDeletions = new Set(failedDeletions);
   for (const del of plan.deletions) {
+    if (retryDeletions.has(del.name))
+      continue;
     delete mergedHashes[del.name];
   }
   state.skillHashes = mergedHashes;
@@ -25879,6 +26314,7 @@ async function checkAgentSetup() {
     details.push(`${state.configuredAgents.length} agent(s) configured`);
   }
   let mcpChecked = false;
+  let mcpAllHealthy = true;
   for (const slug of state.configuredAgents) {
     const adapter2 = getAdapterBySlug(slug);
     if (!adapter2 || !adapter2.supportsMcpScope("user"))
@@ -25891,19 +26327,22 @@ async function checkAgentSetup() {
         if (missingMcp.length > 0) {
           details.push(`${missingMcp.length} MCP server(s) missing from ${slug} config`);
           upgrade("warn");
-        } else {
-          details.push(`${state.mcpServers.length} MCP server(s) configured`);
+          mcpAllHealthy = false;
         }
         mcpChecked = true;
-        break;
       } catch {}
     }
   }
+  if (mcpChecked && mcpAllHealthy && state.mcpServers.length > 0) {
+    details.push(`${state.mcpServers.length} MCP server(s) configured`);
+  }
   if (!mcpChecked && state.mcpServers.length > 0) {
     details.push("could not verify MCP servers");
     upgrade("warn");
   }
   let skillsChecked = false;
+  let skillsAllHealthy = true;
+  let skillsSummaryLine = null;
   for (const slug of state.configuredAgents) {
     const skillsDir = getSkillsDir(slug, "user");
     if (!skillsDir)
@@ -25920,13 +26359,16 @@ async function checkAgentSetup() {
     if (missingSkills.length > 0) {
       details.push(`${missingSkills.length} skill(s) missing from ${slug}`);
       upgrade("warn");
-    } else if (state.skills.length > 0) {
+      skillsAllHealthy = false;
+    } else if (state.skills.length > 0 && !skillsSummaryLine) {
       const mcpCoveredCount = state.skills.filter(isCoveredByMcp).length;
       const onDiskCount = state.skills.length - mcpCoveredCount;
-      details.push(mcpCoveredCount > 0 ? `${state.skills.length} skill(s) installed (${onDiskCount} on disk, ${mcpCoveredCount} via MCP)` : `${state.skills.length} skill(s) installed`);
+      skillsSummaryLine = mcpCoveredCount > 0 ? `${state.skills.length} skill(s) installed (${onDiskCount} on disk, ${mcpCoveredCount} via MCP)` : `${state.skills.length} skill(s) installed`;
     }
     skillsChecked = true;
-    break;
+  }
+  if (skillsChecked && skillsAllHealthy && skillsSummaryLine) {
+    details.push(skillsSummaryLine);
   }
   if (!skillsChecked && state.skills.length > 0) {
     details.push("could not verify skills");
@@ -26101,7 +26543,7 @@ async function applyDoctorFixes(ctx, failingNames) {
 }
 
 // src/agents/runtime-detection.ts
-import { existsSync as existsSync58, readFileSync as readFileSync47, statSync as statSync10, readdirSync as readdirSync17 } from "fs";
+import { existsSync as existsSync58, readFileSync as readFileSync47, statSync as statSync11, readdirSync as readdirSync17 } from "fs";
 import { homedir as homedir33 } from "os";
 import { join as join55 } from "path";
 var RUNWORK_SESSIONS_DIR = join55(homedir33(), ".runwork", "sessions");
@@ -26212,7 +26654,7 @@ function findCodexRolloutFile(threadId) {
       const full = join55(dir, entry);
       let s;
       try {
-        s = statSync10(full);
+        s = statSync11(full);
       } catch {
         continue;
       }
@@ -26249,7 +26691,7 @@ function findNewestClaudeCodeSession() {
         continue;
       const full = join55(projectPath, file);
       try {
-        const s = statSync10(full);
+        const s = statSync11(full);
         if (!best || s.mtimeMs > best.mtime) {
           best = {
             sessionId: file.replace(/\.jsonl$/, ""),
@@ -26282,7 +26724,7 @@ function findNewestCodexRollout() {
       const full = join55(dir, entry);
       let s;
       try {
-        s = statSync10(full);
+        s = statSync11(full);
       } catch {
         continue;
       }
@@ -26506,13 +26948,627 @@ var doctorCommand = new Command34("doctor").description("Check system health: au
   }
 });
 
+// src/commands/debug.ts
+init_colors();
+import { Command as Command35 } from "commander";
+import { readFileSync as readFileSync48 } from "fs";
+import { homedir as homedir35, platform as platform7, release, arch, type as osType } from "os";
+import { join as join58 } from "path";
+
+// src/debug/capture-plan.ts
+var CONFIG_MAX_BYTES = 64 * 1024;
+var LOG_TAIL_BYTES = 64 * 1024;
+var CENSUS_MAX_ENTRIES = 200;
+var ENV_NAMES = [
+  "PATH",
+  "SHELL",
+  "HOME",
+  "USERPROFILE",
+  "APPDATA",
+  "LOCALAPPDATA",
+  "XDG_CONFIG_HOME",
+  "HTTP_PROXY",
+  "HTTPS_PROXY",
+  "http_proxy",
+  "https_proxy",
+  "NO_PROXY",
+  "no_proxy",
+  "NODE_EXTRA_CA_CERTS",
+  "RUNWORK_HTTP_TRANSPORT",
+  "RUNWORK_API_URL",
+  "TERM_PROGRAM",
+  "LANG"
+];
+function buildCapturePlan(input) {
+  const sep5 = input.sep ?? (input.platform === "win32" ? "\\" : "/");
+  const join56 = (...parts) => parts.join(sep5);
+  const home = input.homeDir.replace(/[/\\]+$/, "");
+  const rw = (...parts) => join56(home, ".runwork", ...parts);
+  const steps = [];
+  steps.push({ id: "env", kind: "env", names: ENV_NAMES, note: "process environment (proxy credentials stripped)" });
+  for (const [id, file] of [
+    ["runwork.setup", "setup.json"],
+    ["runwork.workspaces", "workspaces.json"],
+    ["runwork.reflect-state", "reflect-state.json"],
+    ["runwork.reflect-runs", "reflect-runs.json"],
+    ["runwork.telemetry-outbox", "telemetry-outbox.json"],
+    ["runwork.session-summaries-outbox", "session-summaries-outbox.json"]
+  ]) {
+    steps.push({ id, kind: "file", path: rw(file), maxBytes: CONFIG_MAX_BYTES });
+  }
+  for (const [id, file] of [
+    ["runwork.conversations", "conversations.json"],
+    ["runwork.reflect-queue", "reflect-queue.json"],
+    ["runwork.insights", "insights.json"],
+    ["runwork.pattern-store", "pattern-store.json"]
+  ]) {
+    steps.push({ id, kind: "stat", path: rw(file), note: "size and mtime only: contains conversation text" });
+  }
+  steps.push({ id: "runwork.dir", kind: "census", path: rw(), depth: 1, maxEntries: CENSUS_MAX_ENTRIES }, { id: "runwork.bin", kind: "census", path: rw("bin"), depth: 1, maxEntries: 50, note: "which CLI binaries are installed here" }, { id: "runwork.sessions", kind: "census", path: rw("sessions"), depth: 1, maxEntries: CENSUS_MAX_ENTRIES, note: "written by the agent hooks we install" }, { id: "runwork.log", kind: "file", path: rw("desktop-launch.log"), maxBytes: LOG_TAIL_BYTES, tail: true, note: "tail: this log has no rotation" });
+  for (const [id, ...parts] of [
+    ["claude.settings", ".claude", "settings.json"],
+    ["claude.md", ".claude", "CLAUDE.md"],
+    ["claude.mcp", ".claude", ".mcp.json"],
+    ["codex.config", ".codex", "config.toml"],
+    ["codex.agents-md", ".codex", "AGENTS.md"],
+    ["gemini.settings", ".gemini", "settings.json"]
+  ]) {
+    steps.push({ id, kind: "file", path: join56(home, ...parts), maxBytes: CONFIG_MAX_BYTES });
+  }
+  for (const [id, ...parts] of [
+    ["claude.skills", ".claude", "skills"],
+    ["claude.plugins", ".claude", "plugins"],
+    ["agents.skills", ".agents", "skills"],
+    ["codex.skills", ".codex", "skills"]
+  ]) {
+    steps.push({ id, kind: "census", path: join56(home, ...parts), depth: 1, maxEntries: CENSUS_MAX_ENTRIES });
+  }
+  steps.push({ id: "transcripts.claude-code", kind: "census", path: join56(home, ".claude", "projects"), depth: 1, maxEntries: CENSUS_MAX_ENTRIES }, { id: "transcripts.codex", kind: "census", path: join56(home, ".codex", "sessions"), depth: 2, maxEntries: CENSUS_MAX_ENTRIES }, { id: "transcripts.gemini", kind: "census", path: join56(home, ".gemini", "tmp"), depth: 1, maxEntries: CENSUS_MAX_ENTRIES }, { id: "transcripts.cowork", kind: "census", path: coworkBaseDir(input, join56), depth: 1, maxEntries: CENSUS_MAX_ENTRIES, note: "macOS TCC can refuse this while it still exists" });
+  for (const profile of shellProfiles(input.platform)) {
+    steps.push({
+      id: `shell${profile}`,
+      kind: "stat",
+      path: join56(home, profile),
+      note: "presence only: profile bodies can contain the user's own secrets"
+    });
+  }
+  steps.push(...binaryResolutionSteps(input));
+  if (input.cliPath) {
+    steps.push({ id: "cli.version", kind: "exec", command: input.cliPath, args: ["--version"] }, { id: "cli.doctor", kind: "exec", command: input.cliPath, args: ["--json", "doctor", "-v"] }, { id: "cli.conversations", kind: "exec", command: input.cliPath, args: ["--json", "conversations", "status", "--days", "0"], note: "per-agent scan outcome, no conversation data" });
+  }
+  return steps;
+}
+function coworkBaseDir(input, join56) {
+  const home = input.homeDir.replace(/[/\\]+$/, "");
+  if (input.platform === "darwin") {
+    return join56(home, "Library", "Application Support", "Claude", "local-agent-mode-sessions");
+  }
+  if (input.platform === "win32") {
+    const base = input.appData ?? join56(home, "AppData", "Roaming");
+    return join56(base, "Claude", "local-agent-mode-sessions");
+  }
+  return join56(home, ".config", "Claude", "local-agent-mode-sessions");
+}
+function shellProfiles(platform7) {
+  if (platform7 === "win32")
+    return [];
+  return [".zshrc", ".zprofile", ".bashrc", ".bash_profile", ".profile"];
+}
+function binaryResolutionSteps(input) {
+  const sep5 = input.sep ?? (input.platform === "win32" ? "\\" : "/");
+  const join56 = (...parts) => parts.join(sep5);
+  const home = input.homeDir.replace(/[/\\]+$/, "");
+  if (input.platform === "win32") {
+    return [
+      { id: "binaries.where", kind: "exec", command: "where.exe", args: ["runwork"], note: "every match, not just the first" },
+      { id: "binaries.runwork-bin", kind: "stat", path: join56(home, ".runwork", "bin", "runwork.exe") },
+      { id: "binaries.user-path", kind: "exec", command: "reg.exe", args: ["query", "HKCU\\Environment", "/v", "Path"], note: "the PATH a NEW shell will inherit, not this one" }
+    ];
+  }
+  return [
+    { id: "binaries.which", kind: "exec", command: "which", args: ["-a", "runwork"], note: "every match, not just the first" },
+    { id: "binaries.runwork-bin", kind: "stat", path: join56(home, ".runwork", "bin", "runwork") },
+    { id: "binaries.local-bin", kind: "stat", path: join56(home, ".local", "bin", "runwork") },
+    ...input.platform === "darwin" ? [{ id: "binaries.usr-local-bin", kind: "stat", path: "/usr/local/bin/runwork" }] : []
+  ];
+}
+
+// src/debug/capture.ts
+var CAPTURE_FORMAT = 1;
+function summarizeBundle(jsonl) {
+  const summary = {
+    formatVersion: CAPTURE_FORMAT,
+    producer: null,
+    stepsPlanned: 0,
+    stepsRun: 0,
+    redactions: 0,
+    withheld: 0,
+    complete: false
+  };
+  for (const line of jsonl.split(`
+`)) {
+    if (!line.trim())
+      continue;
+    let record;
+    try {
+      record = JSON.parse(line);
+    } catch {
+      continue;
+    }
+    if (record.type === "plan") {
+      summary.formatVersion = record.format;
+      summary.producer = record.producer;
+      summary.stepsPlanned = record.steps.length;
+    } else if (record.type === "step") {
+      summary.stepsRun++;
+      summary.redactions += record.redactions ?? 0;
+      summary.withheld += record.withheld ?? 0;
+    } else if (record.type === "complete") {
+      summary.complete = true;
+    }
+  }
+  return summary;
+}
+async function sha256Hex(text2) {
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(text2));
+  return [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+var NEVER_READ = [".credentials", "credentials.json", "auth.json", ".netrc", "id_rsa"];
+function isForbiddenPath(path4) {
+  const name = path4.split(/[/\\]/).pop()?.toLowerCase() ?? "";
+  return NEVER_READ.some((deny) => name === deny.toLowerCase());
+}
+var SECRET_KEY_NAMES = "token|secret|password|passwd|api[-_]?key|apikey|authorization|access[-_]?token|refresh[-_]?token|client[-_]?secret|private[-_]?key|access[-_]?key|credentials?";
+var SECRET_KEY_PATTERN = `[A-Za-z0-9_-]*?(?:${SECRET_KEY_NAMES})`;
+var QUOTED_VALUE = String.raw`"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'`;
+var SECRET_QUERY_PARAMS = "token|key|secret|password|api[-_]?key|apikey|access[-_]?token|sig|signature";
+function redactSecrets(text2) {
+  let redactions = 0;
+  const mark = () => {
+    redactions++;
+    return "<redacted>";
+  };
+  const out = text2.replace(new RegExp(`([?&](?:${SECRET_QUERY_PARAMS})=)[^&\\s"'\`]+`, "gi"), (_m, prefix) => `${prefix}${mark()}`).replace(/\b(Bearer\s+)[A-Za-z0-9._~+/=-]{8,}/gi, (_m, prefix) => `${prefix}${mark()}`).replace(new RegExp(`("?${SECRET_KEY_PATTERN}"?\\s*[:=]\\s*)(${QUOTED_VALUE}|[^\\s,}\\]&"']+)`, "gi"), (match, prefix, value) => {
+    if (value.includes("<redacted>"))
+      return match;
+    const quote = value.startsWith('"') ? '"' : value.startsWith("'") ? "'" : "";
+    return `${prefix}${quote}${mark()}${quote}`;
+  });
+  return { text: out, redactions };
+}
+var CONTENT_KEY_NAMES = "currentTitle|title|prompt|userMessages|summary|body|snippet";
+function redactUserContent(text2) {
+  let withheld = 0;
+  const out = text2.replace(new RegExp(`("?\\b(?:${CONTENT_KEY_NAMES})"?\\s*[:=]\\s*)(${QUOTED_VALUE})`, "gi"), (match, prefix, value) => {
+    if (value === '""' || value === "''")
+      return match;
+    withheld++;
+    const quote = value[0];
+    return `${prefix}${quote}<withheld>${quote}`;
+  });
+  return { text: out, withheld };
+}
+function redactEnvValue(value) {
+  if (value === null)
+    return null;
+  return value.replace(/(\w+:\/\/)[^/@\s]*@/g, "$1<redacted>@");
+}
+function classifyCaptureError(err) {
+  const e = err;
+  const code = e && typeof e === "object" && typeof e.code === "string" ? e.code : undefined;
+  const message = e instanceof Error ? e.message : String(err);
+  if (code === "ENOENT" || code === "ENOTDIR")
+    return { status: "missing", detail: code };
+  if (code === "EACCES" || code === "EPERM")
+    return { status: "denied", detail: code };
+  if (code === "ETIMEDOUT" || code === "TIMEOUT")
+    return { status: "timeout", detail: code };
+  if (code === "ESCOPE")
+    return { status: "skipped", detail: message };
+  return { status: "error", detail: code ? `${code}: ${message}` : message };
+}
+function stepTarget(step) {
+  switch (step.kind) {
+    case "file":
+    case "census":
+    case "stat":
+      return step.path;
+    case "env":
+      return step.names.join(",");
+    case "exec":
+      return [step.command, ...step.args].join(" ");
+  }
+}
+function withDeadline(work, ms) {
+  return new Promise((resolve5, reject) => {
+    const timer = setTimeout(() => reject(Object.assign(new Error("step deadline"), { code: "TIMEOUT" })), ms);
+    work.then((value) => {
+      clearTimeout(timer);
+      resolve5(value);
+    }, (err) => {
+      clearTimeout(timer);
+      reject(err);
+    });
+  });
+}
+async function runStep(port, step, deadlineMs) {
+  const startedMs = port.now();
+  const base = { type: "step", id: step.id, kind: step.kind, target: stepTarget(step) };
+  const done = (extra) => ({ ...base, status: "ok", durationMs: port.now() - startedMs, ...extra });
+  if ((step.kind === "file" || step.kind === "stat") && isForbiddenPath(step.path)) {
+    return { ...base, status: "skipped", detail: "excluded by policy", durationMs: 0 };
+  }
+  try {
+    switch (step.kind) {
+      case "file": {
+        const raw = await withDeadline(port.readText(step.path, step.maxBytes, step.tail === true), deadlineMs);
+        const secrets = redactSecrets(raw.text);
+        const content = redactUserContent(secrets.text);
+        return done({
+          text: content.text,
+          truncated: raw.truncated,
+          ...secrets.redactions > 0 ? { redactions: secrets.redactions } : {},
+          ...content.withheld > 0 ? { withheld: content.withheld } : {}
+        });
+      }
+      case "census": {
+        const entries = await withDeadline(port.listDir(step.path, step.depth, step.maxEntries), deadlineMs);
+        return done({ entries, entryCount: entries.length });
+      }
+      case "stat": {
+        const info = await withDeadline(port.stat(step.path), deadlineMs);
+        return done({ bytes: info.bytes, modifiedAt: info.modifiedAt });
+      }
+      case "env": {
+        const raw = port.env(step.names);
+        return done({
+          env: Object.fromEntries(Object.entries(raw).map(([k, v]) => [k, redactEnvValue(v)]))
+        });
+      }
+      case "exec": {
+        const result = await withDeadline(port.exec(step.command, step.args), deadlineMs);
+        const out = redactSecrets(result.stdout);
+        const err = redactSecrets(result.stderr);
+        const redactions = out.redactions + err.redactions;
+        return done({
+          text: out.text,
+          exitCode: result.exitCode,
+          stderr: err.text,
+          ...redactions > 0 ? { redactions } : {}
+        });
+      }
+    }
+  } catch (err) {
+    const { status, detail } = classifyCaptureError(err);
+    return { ...base, status, detail, durationMs: port.now() - startedMs };
+  }
+}
+async function runCapture(port, producer, steps, opts = {}) {
+  const deadlineMs = opts.stepDeadlineMs ?? 1e4;
+  const startedMs = port.now();
+  await port.append({
+    type: "plan",
+    format: CAPTURE_FORMAT,
+    producer,
+    startedAt: new Date(startedMs).toISOString(),
+    steps: steps.map((s) => ({ id: s.id, kind: s.kind, ...s.note ? { note: s.note } : {} }))
+  });
+  let stepsRun = 0;
+  for (const step of steps) {
+    await port.append(await runStep(port, step, deadlineMs));
+    stepsRun++;
+  }
+  if (opts.claims) {
+    try {
+      for (const claim of await opts.claims())
+        await port.append(claim);
+    } catch (err) {
+      await port.append({
+        type: "claim",
+        id: "claims-failed",
+        producer,
+        value: { error: err instanceof Error ? err.message : String(err) }
+      });
+    }
+  }
+  await port.append({
+    type: "complete",
+    finishedAt: new Date(port.now()).toISOString(),
+    stepsPlanned: steps.length,
+    stepsRun,
+    durationMs: port.now() - startedMs
+  });
+  return { stepsRun };
+}
+
+// src/utils/machine-id.ts
+init_atomic_json();
+import { randomUUID } from "crypto";
+import { homedir as homedir34 } from "os";
+import { join as join56 } from "path";
+function machineIdPath() {
+  return join56(homedir34(), ".runwork", "machine.json");
+}
+function isValidId(value) {
+  return typeof value === "string" && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(value);
+}
+function getMachineId() {
+  const path4 = machineIdPath();
+  const existing = readJsonOrNull(path4);
+  if (existing && isValidId(existing.id))
+    return existing.id;
+  const record = { id: randomUUID(), createdAt: new Date().toISOString() };
+  try {
+    writeJsonAtomic(path4, record);
+  } catch {
+    return null;
+  }
+  const settled = readJsonOrNull(path4);
+  return settled && isValidId(settled.id) ? settled.id : record.id;
+}
+
+// src/commands/debug.ts
+init_store();
+init_client();
+init_resolve();
+
+// src/debug/node-port.ts
+init_subprocess();
+init_which();
+import { closeSync as closeSync5, fsyncSync, mkdirSync as mkdirSync29, openSync as openSync5, readSync as readSync3, readdirSync as readdirSync18, statSync as statSync12, writeSync } from "fs";
+import { dirname as dirname12, join as join57 } from "path";
+var EXEC_OUTPUT_MAX = 256 * 1024;
+var EXEC_TIMEOUT_MS = 20000;
+function truncate5(text2, maxBytes) {
+  return text2.length > maxBytes ? { text: text2.slice(0, maxBytes), truncated: true } : { text: text2, truncated: false };
+}
+function entryKind(path4) {
+  try {
+    const s = statSync12(path4);
+    return s.isDirectory() ? "dir" : s.isFile() ? "file" : "other";
+  } catch {
+    return "other";
+  }
+}
+function createNodeCapturePort(outputPath) {
+  mkdirSync29(dirname12(outputPath), { recursive: true });
+  const fd = openSync5(outputPath, "w");
+  return {
+    close: () => closeSync5(fd),
+    async append(record) {
+      writeSync(fd, JSON.stringify(record) + `
+`);
+      try {
+        fsyncSync(fd);
+      } catch {}
+    },
+    async listDir(path4, depth, maxEntries) {
+      const out = [];
+      const queue = [{ dir: path4, prefix: "", level: 0 }];
+      let first = true;
+      while (queue.length > 0 && out.length < maxEntries) {
+        const { dir, prefix, level } = queue.shift();
+        let names;
+        try {
+          names = readdirSync18(dir);
+        } catch (err) {
+          if (first)
+            throw err;
+          continue;
+        } finally {
+          first = false;
+        }
+        for (const name of names) {
+          if (out.length >= maxEntries)
+            break;
+          const full = join57(dir, name);
+          const kind = entryKind(full);
+          let bytes;
+          let modifiedAt;
+          try {
+            const s = statSync12(full);
+            bytes = s.size;
+            modifiedAt = new Date(s.mtimeMs).toISOString();
+          } catch {}
+          out.push({ name: prefix ? `${prefix}/${name}` : name, kind, ...bytes !== undefined ? { bytes } : {}, ...modifiedAt ? { modifiedAt } : {} });
+          if (kind === "dir" && level + 1 < depth) {
+            queue.push({ dir: full, prefix: prefix ? `${prefix}/${name}` : name, level: level + 1 });
+          }
+        }
+      }
+      return out;
+    },
+    async stat(path4) {
+      const s = statSync12(path4);
+      return {
+        bytes: s.size,
+        modifiedAt: new Date(s.mtimeMs).toISOString(),
+        kind: s.isDirectory() ? "dir" : s.isFile() ? "file" : "other"
+      };
+    },
+    async readText(path4, maxBytes, tail) {
+      const s = statSync12(path4);
+      const size = s.size;
+      const length = Math.min(size, maxBytes);
+      const start = tail && size > maxBytes ? size - maxBytes : 0;
+      const buffer = Buffer.alloc(length);
+      const handle = openSync5(path4, "r");
+      try {
+        readSync3(handle, buffer, 0, length, start);
+      } finally {
+        closeSync5(handle);
+      }
+      return { text: buffer.toString("utf-8"), truncated: size > length };
+    },
+    env(names) {
+      return Object.fromEntries(names.map((n) => [n, process.env[n] ?? null]));
+    },
+    async exec(command, args) {
+      const spec = toSpawnSpec(command, args);
+      const result = spawnSync(spec.command, spec.args, {
+        encoding: "utf-8",
+        timeout: EXEC_TIMEOUT_MS,
+        maxBuffer: EXEC_OUTPUT_MAX,
+        ...spec.windowsVerbatimArguments ? { windowsVerbatimArguments: true } : {}
+      });
+      if (result.error)
+        throw result.error;
+      return {
+        exitCode: result.status ?? -1,
+        stdout: truncate5(result.stdout ?? "", EXEC_OUTPUT_MAX).text,
+        stderr: truncate5(result.stderr ?? "", 8 * 1024).text
+      };
+    },
+    now: () => Date.now()
+  };
+}
+
+// src/commands/debug.ts
+init_transcript_sources();
+init_which();
+await init_detect();
+function defaultOutputPath(now) {
+  const stamp = now.toISOString().replace(/[:.]/g, "-").replace("T", "_").slice(0, 19);
+  return join58(homedir35(), ".runwork", "debug", `runwork-debug-${stamp}.jsonl`);
+}
+async function cliClaims() {
+  const records = [];
+  records.push({
+    type: "claim",
+    id: "producer.process",
+    producer: "cli",
+    value: {
+      cliVersion: VERSION,
+      execPath: process.execPath,
+      argv0: process.argv[1] ?? null,
+      nodeVersion: process.version,
+      platform: platform7(),
+      osType: osType(),
+      release: release(),
+      arch: arch(),
+      cwd: process.cwd()
+    }
+  });
+  records.push({
+    type: "claim",
+    id: "cli.path-resolution",
+    producer: "cli",
+    derivedFrom: ["binaries.which", "binaries.where", "env"],
+    value: { pathResolved: whichBinary("runwork") }
+  });
+  const adapters = await detectAgents();
+  records.push({
+    type: "claim",
+    id: "agents.detected",
+    producer: "cli",
+    derivedFrom: ["transcripts.claude-code", "transcripts.codex", "transcripts.gemini", "transcripts.cowork"],
+    value: adapters.map((adapter2) => {
+      const sources = adapter2.transcriptSources?.() ?? [];
+      return {
+        slug: adapter2.slug,
+        name: adapter2.name,
+        hasListing: typeof adapter2.listSessions === "function",
+        hasDigests: typeof adapter2.readSessionDigests === "function",
+        transcriptSources: sources.map((s) => s.path),
+        readable: sources.length > 0 ? summarizeTranscriptSources(sources) : null
+      };
+    })
+  });
+  return records;
+}
+var debugCommand = new Command35("debug").description("Diagnostics for support");
+debugCommand.command("capture").description("Collect a diagnostic bundle to a file you can send to support").option("--out <path>", "Where to write the bundle (default: ~/.runwork/debug/)").option("--send", "Also send the bundle to Runwork support (requires sign-in)").option("--note <text>", "What went wrong, in your words. Included with --send").action(async (opts, command) => {
+  const json = command.optsWithGlobals().json === true || !process.stdout.isTTY;
+  const outputPath = typeof opts.out === "string" && opts.out ? opts.out : defaultOutputPath(new Date);
+  const cliPath = whichBinary("runwork");
+  const plan = buildCapturePlan({
+    platform: platform7(),
+    homeDir: homedir35(),
+    appData: process.env.APPDATA ?? null,
+    cliPath
+  });
+  if (!json) {
+    console.log(bold(`
+Collecting diagnostics`));
+    console.log(dim(`  ${plan.length} checks, writing to ${outputPath}`));
+  }
+  const port = createNodeCapturePort(outputPath);
+  let stepsRun = 0;
+  try {
+    ({ stepsRun } = await runCapture(port, "cli", plan, { claims: cliClaims }));
+  } finally {
+    port.close();
+  }
+  const sent = opts.send === true ? await sendBundle(outputPath, typeof opts.note === "string" ? opts.note : undefined) : null;
+  if (json) {
+    jsonOut({ path: outputPath, stepsPlanned: plan.length, stepsRun, ...sent ? { sent } : {} });
+    return;
+  }
+  const counted = stepsRun === plan.length ? `${stepsRun}` : `${stepsRun} of ${plan.length}`;
+  console.log(green(`
+Done. ${counted} checks recorded.`));
+  console.log(`
+  ${cyan(outputPath)}
+`);
+  if (!cliPath) {
+    console.log(yellow("Note: no `runwork` was found on PATH, so the doctor report is not included.\n"));
+  }
+  if (!sent) {
+    console.log(dim("Send that file to support. It contains no credentials and no conversation text."));
+    console.log(dim("Or re-run with --send to upload it."));
+    return;
+  }
+  if (sent.ok) {
+    console.log(green(`Sent to Runwork support (report ${sent.id}).`));
+    console.log(dim(`It is kept until ${sent.expiresAt?.slice(0, 10)} and then deleted.`));
+  } else {
+    console.log(yellow(`Could not send: ${sent.error}`));
+    console.log(dim("The file above is saved and can be sent to support by hand."));
+  }
+});
+async function sendBundle(path4, note) {
+  try {
+    const content = readFileSync48(path4, "utf-8");
+    const summary = summarizeBundle(content);
+    const machineId = getMachineId();
+    if (!machineId)
+      return { ok: false, error: "could not identify this machine" };
+    const credentials = getCredentials();
+    if (!credentials)
+      return { ok: false, error: "not signed in; run `runwork login`" };
+    const api = new ApiClient(credentials);
+    const workspace = await resolveWorkspace2(api);
+    const result = await api.createDebugReport(workspace.workspaceId, {
+      machineId,
+      producer: "cli",
+      content,
+      sha256: await sha256Hex(content),
+      formatVersion: summary.formatVersion,
+      ...note ? { note } : {},
+      context: {
+        cliVersion: VERSION,
+        platform: platform7(),
+        release: release(),
+        stepsPlanned: summary.stepsPlanned,
+        stepsRun: summary.stepsRun,
+        redactions: summary.redactions,
+        withheld: summary.withheld,
+        complete: summary.complete
+      }
+    });
+    return { ok: true, id: result.id, expiresAt: result.expiresAt };
+  } catch (err) {
+    return { ok: false, error: err instanceof Error ? err.message : String(err) };
+  }
+}
+
 // src/commands/share-convo.ts
 init_store();
 init_client();
 init_resolve();
-import { Command as Command35 } from "commander";
-import { readFileSync as readFileSync48, writeFileSync as writeFileSync33, existsSync as existsSync59, mkdtempSync as mkdtempSync4 } from "fs";
-import { join as join56 } from "path";
+import { Command as Command36 } from "commander";
+import { readFileSync as readFileSync49, writeFileSync as writeFileSync33, existsSync as existsSync59, mkdtempSync as mkdtempSync4 } from "fs";
+import { join as join59 } from "path";
 import { tmpdir as tmpdir4 } from "os";
 import { createHash as createHash6 } from "crypto";
 
@@ -26634,13 +27690,13 @@ function resolveLocalSessionShare(opts, conversation) {
     process.exit(1);
   }
   const title = opts.title ?? conversation.title ?? conversation.project;
-  const markdown = renderTranscriptMarkdown(readFileSync48(conversation.transcriptPath, "utf8"), family, title);
+  const markdown = renderTranscriptMarkdown(readFileSync49(conversation.transcriptPath, "utf8"), family, title);
   if (!markdown) {
     console.error("Error: this conversation has no shareable content.");
     process.exit(1);
   }
-  const tempDir = mkdtempSync4(join56(tmpdir4(), "runwork-share-"));
-  const transcriptFile = join56(tempDir, "transcript.md");
+  const tempDir = mkdtempSync4(join59(tmpdir4(), "runwork-share-"));
+  const transcriptFile = join59(tempDir, "transcript.md");
   writeFileSync33(transcriptFile, markdown);
   opts.transcriptFile = transcriptFile;
   opts.nativeFile = opts.nativeFile ?? conversation.transcriptPath;
@@ -26657,7 +27713,7 @@ function nativeBundleFormatForAgent(slug) {
     return "codex-rollout";
   return null;
 }
-function sha256Hex(content) {
+function sha256Hex2(content) {
   return createHash6("sha256").update(content, "utf8").digest("hex");
 }
 function utf8ByteLength(content) {
@@ -26699,13 +27755,13 @@ async function runShareConvo(opts, command, isPersonalAlias = false) {
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
   const { workspaceId } = await resolveWorkspace2(client, { workspace: opts.workspace });
-  const transcriptContent = readFileSync48(opts.transcriptFile, "utf8");
+  const transcriptContent = readFileSync49(opts.transcriptFile, "utf8");
   const bundles = [
     {
       format: "transcript",
       content: transcriptContent,
       sizeBytes: utf8ByteLength(transcriptContent),
-      sha256: sha256Hex(transcriptContent)
+      sha256: sha256Hex2(transcriptContent)
     }
   ];
   const detected = detectCurrentAgent();
@@ -26724,12 +27780,12 @@ async function runShareConvo(opts, command, isPersonalAlias = false) {
     const nativeFormat = nativeBundleFormatForAgent(sourceAgent);
     if (nativeFormat) {
       try {
-        const content = readFileSync48(nativeFilePath, "utf8");
+        const content = readFileSync49(nativeFilePath, "utf8");
         bundles.push({
           format: nativeFormat,
           content,
           sizeBytes: utf8ByteLength(content),
-          sha256: sha256Hex(content)
+          sha256: sha256Hex2(content)
         });
       } catch (err) {
         console.error(`Warning: could not read native file ${nativeFilePath}: ${err instanceof Error ? err.message : err}`);
@@ -26740,7 +27796,7 @@ async function runShareConvo(opts, command, isPersonalAlias = false) {
   let metadata = {};
   if (opts.metadataFile) {
     try {
-      metadata = JSON.parse(readFileSync48(opts.metadataFile, "utf8"));
+      metadata = JSON.parse(readFileSync49(opts.metadataFile, "utf8"));
     } catch (err) {
       console.error(`Error: --metadata-file is not valid JSON: ${err instanceof Error ? err.message : err}`);
       process.exit(1);
@@ -26795,18 +27851,18 @@ Skipped: ${result.skipped.map((s) => `${s.identifier} (${s.reason})`).join(", ")
     process.exit(1);
   }
 }
-var shareConvoCommand = new Command35("share-convo").description("Share the current AI conversation with a teammate").option("--to <email>", "Recipient email (repeatable)", (value, prev = []) => [...prev, value], []).option("--transcript-file <path>", "Path to the LLM-emitted markdown transcript (required unless --session)").option("--session <key>", "Share a LOCAL conversation by registry key (transcript rendered mechanically)").option("--native-file <path>", "Path to the native session file (optional; auto-detected from env vars otherwise)").option("--source-agent <slug>", "Override host-agent detection (e.g. claude-code, codex, claude-desktop)").option("--title <string>", "Short title for the conversation (required)").option("--note <string>", "Optional personal note to recipients").option("--ttl-days <n>", "Days until expiration (1-30, default 7)").option("--metadata-json <json>", "Inline JSON object with workMode, openQuestions, suggestedNextStep, etc.").option("--metadata-file <path>", "Path to a JSON file with the same metadata fields").option("--workspace <name-or-id>", "Workspace name or ID").action((opts, command) => runShareConvo(opts, command, false));
+var shareConvoCommand = new Command36("share-convo").description("Share the current AI conversation with a teammate").option("--to <email>", "Recipient email (repeatable)", (value, prev = []) => [...prev, value], []).option("--transcript-file <path>", "Path to the LLM-emitted markdown transcript (required unless --session)").option("--session <key>", "Share a LOCAL conversation by registry key (transcript rendered mechanically)").option("--native-file <path>", "Path to the native session file (optional; auto-detected from env vars otherwise)").option("--source-agent <slug>", "Override host-agent detection (e.g. claude-code, codex, claude-desktop)").option("--title <string>", "Short title for the conversation (required)").option("--note <string>", "Optional personal note to recipients").option("--ttl-days <n>", "Days until expiration (1-30, default 7)").option("--metadata-json <json>", "Inline JSON object with workMode, openQuestions, suggestedNextStep, etc.").option("--metadata-file <path>", "Path to a JSON file with the same metadata fields").option("--workspace <name-or-id>", "Workspace name or ID").action((opts, command) => runShareConvo(opts, command, false));
 
 // src/commands/save-convo.ts
-import { Command as Command36 } from "commander";
-var saveConvoCommand = new Command36("save-convo").description("Save the current AI conversation as a personal checkpoint").option("--transcript-file <path>", "Path to the LLM-emitted markdown transcript (required)").option("--native-file <path>", "Path to the native session file (optional; auto-detected from env vars)").option("--source-agent <slug>", "Override host-agent detection").option("--title <string>", "Short title for the conversation (required)").option("--note <string>", "Optional note to your future self").option("--ttl-days <n>", "Days until expiration (1-30, default 7)").option("--metadata-json <json>", "Inline JSON object with workMode, openQuestions, etc.").option("--metadata-file <path>", "Path to a JSON file with metadata fields").option("--workspace <name-or-id>", "Workspace name or ID").action((opts, command) => runShareConvo({ ...opts, personal: true }, command, true));
+import { Command as Command37 } from "commander";
+var saveConvoCommand = new Command37("save-convo").description("Save the current AI conversation as a personal checkpoint").option("--transcript-file <path>", "Path to the LLM-emitted markdown transcript (required)").option("--native-file <path>", "Path to the native session file (optional; auto-detected from env vars)").option("--source-agent <slug>", "Override host-agent detection").option("--title <string>", "Short title for the conversation (required)").option("--note <string>", "Optional note to your future self").option("--ttl-days <n>", "Days until expiration (1-30, default 7)").option("--metadata-json <json>", "Inline JSON object with workMode, openQuestions, etc.").option("--metadata-file <path>", "Path to a JSON file with metadata fields").option("--workspace <name-or-id>", "Workspace name or ID").action((opts, command) => runShareConvo({ ...opts, personal: true }, command, true));
 
 // src/commands/inbox.ts
 init_store();
 init_client();
 init_resolve();
-import { Command as Command37 } from "commander";
-var inboxCommand = new Command37("inbox").description("List shared conversations visible to you").option("--filter <scope>", "Filter: all | received | sent | saved", "all").option("--limit <n>", "Max rows to return", "50").option("--workspace <name-or-id>", "Workspace name or ID").action(async (opts, command) => {
+import { Command as Command38 } from "commander";
+var inboxCommand = new Command38("inbox").description("List shared conversations visible to you").option("--filter <scope>", "Filter: all | received | sent | saved", "all").option("--limit <n>", "Max rows to return", "50").option("--workspace <name-or-id>", "Workspace name or ID").action(async (opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const scope = opts.filter === "received" || opts.filter === "sent" || opts.filter === "saved" ? opts.filter : "all";
   const limit = opts.limit ? parseInt(opts.limit, 10) : 50;
@@ -26848,10 +27904,10 @@ init_store();
 init_client();
 init_resolve();
 init_registry_data();
-import { Command as Command38 } from "commander";
-import { writeFileSync as writeFileSync34, mkdirSync as mkdirSync29, realpathSync } from "fs";
-import { homedir as homedir34 } from "os";
-import { join as join57 } from "path";
+import { Command as Command39 } from "commander";
+import { writeFileSync as writeFileSync34, mkdirSync as mkdirSync30, realpathSync } from "fs";
+import { homedir as homedir36 } from "os";
+import { join as join60 } from "path";
 import { spawn as spawn5 } from "child_process";
 init_registry();
 init_which();
@@ -26890,9 +27946,9 @@ function extractCodexUuid(rolloutContent) {
 }
 function placeClaudeJsonl(uuid, content, recipientCwd) {
   const encoded = encodeClaudeCodeCwd(recipientCwd);
-  const projectDir = join57(homedir34(), ".claude", "projects", encoded);
-  mkdirSync29(projectDir, { recursive: true });
-  const placedAt = join57(projectDir, `${uuid}.jsonl`);
+  const projectDir = join60(homedir36(), ".claude", "projects", encoded);
+  mkdirSync30(projectDir, { recursive: true });
+  const placedAt = join60(projectDir, `${uuid}.jsonl`);
   writeFileSync34(placedAt, content);
   return { placedAt, runFromCwd: recipientCwd };
 }
@@ -26901,10 +27957,10 @@ function placeCodexRollout(uuid, content) {
   const yyyy = String(now.getUTCFullYear());
   const mm = String(now.getUTCMonth() + 1).padStart(2, "0");
   const dd = String(now.getUTCDate()).padStart(2, "0");
-  const dir = join57(homedir34(), ".codex", "sessions", yyyy, mm, dd);
-  mkdirSync29(dir, { recursive: true });
+  const dir = join60(homedir36(), ".codex", "sessions", yyyy, mm, dd);
+  mkdirSync30(dir, { recursive: true });
   const ts = now.toISOString().replace(/\.\d+Z$/, "").replace(/:/g, "-");
-  const placedAt = join57(dir, `rollout-${ts}-${uuid}.jsonl`);
+  const placedAt = join60(dir, `rollout-${ts}-${uuid}.jsonl`);
   writeFileSync34(placedAt, content);
   return { placedAt };
 }
@@ -26924,7 +27980,15 @@ function isAgentInstalled(agent) {
   }
   return false;
 }
-var resumeCommand2 = new Command38("resume").description("Resume a shared conversation locally in your agent of choice").argument("<share-id>", "The share ID (sc_*) returned by share-convo or save-convo").option("--agent <slug>", "Override target agent (e.g. claude-code, codex)").option("--into <path>", "Override target cwd (defaults to current $PWD)").option("--dry-run", "Print the resume command instead of executing it").option("--pick", "Show interactive picker (requires TTY) - not yet implemented").option("--workspace <name-or-id>", "Workspace name or ID").action(async (shareId, opts, command) => {
+function buildResumeCommand(template, uuid, resolvedCli, cliName) {
+  const argv = template.replace(/\{uuid\}/g, uuid).split(" ").filter(Boolean);
+  if (resolvedCli && cliName && argv[0] === cliName) {
+    argv[0] = resolvedCli;
+  }
+  const display = [argv[0]?.includes(" ") ? `"${argv[0]}"` : argv[0], ...argv.slice(1)].filter((part) => Boolean(part)).join(" ");
+  return { argv, display };
+}
+var resumeCommand2 = new Command39("resume").description("Resume a shared conversation locally in your agent of choice").argument("<share-id>", "The share ID (sc_*) returned by share-convo or save-convo").option("--agent <slug>", "Override target agent (e.g. claude-code, codex)").option("--into <path>", "Override target cwd (defaults to current $PWD)").option("--dry-run", "Print the resume command instead of executing it").option("--pick", "Show interactive picker (requires TTY) - not yet implemented").option("--workspace <name-or-id>", "Workspace name or ID").action(async (shareId, opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -27018,12 +28082,8 @@ Bundle placed at: ${placement.placedAt}`);
     return;
   }
   if (cap2.mode === "cli-resume") {
-    let cmd = (cap2.cliResumeCommand ?? "").replace(/\{uuid\}/g, nativeUuid);
-    const resolvedCli = resolveAgentCliCommand(target.slug);
-    const cliName = getAgent(target.slug)?.launch?.cli;
-    if (resolvedCli && cliName && resolvedCli !== cliName && cmd.startsWith(`${cliName} `)) {
-      cmd = `"${resolvedCli}" ${cmd.slice(cliName.length + 1)}`;
-    }
+    const { argv, display } = buildResumeCommand(cap2.cliResumeCommand ?? "", nativeUuid, resolveAgentCliCommand(target.slug), getAgent(target.slug)?.launch?.cli);
+    const cmd = display;
     const detected = detectCurrentAgent();
     const insideSameAgent = detected && detected.slug === target.slug;
     const shouldPrintOnly = opts.dryRun || insideSameAgent;
@@ -27055,10 +28115,11 @@ Or ask the assistant to continue the conversation in THIS session by ` + `fetchi
       }
       return;
     }
-    const parts = cmd.split(" ");
-    const child = spawn5(parts[0], parts.slice(1), {
+    const spec = toSpawnSpec(argv[0], argv.slice(1));
+    const child = spawn5(spec.command, spec.args, {
       cwd: placement.runFromCwd ?? recipientCwd,
-      stdio: "inherit"
+      stdio: "inherit",
+      ...spec.windowsVerbatimArguments ? { windowsVerbatimArguments: true } : {}
     });
     child.on("exit", (code) => {
       process.exit(code ?? 0);
@@ -27154,7 +28215,7 @@ process.on("uncaughtException", (err) => {
   console.error(`Uncaught exception: ${formatError(err)}`);
   process.exit(1);
 });
-var program = new Command39;
+var program = new Command40;
 program.name("runwork").description("Runwork CLI - local development for Runwork apps").version(VERSION).option("--json", "Output as JSON (auto-enabled when stdout is not a TTY)");
 program.addCommand(infoCommand);
 program.addCommand(loginCommand);
@@ -27187,6 +28248,7 @@ program.addCommand(appsCommand);
 program.addCommand(membersCommand);
 program.addCommand(apiCommand);
 program.addCommand(doctorCommand);
+program.addCommand(debugCommand);
 program.addCommand(shareConvoCommand);
 program.addCommand(saveConvoCommand);
 program.addCommand(inboxCommand);