tesseract-agent 0.9.33 → 0.9.35

package/dist-bundle/cli.js

@@ -27453,10 +27453,10 @@ var init_client = __esm({
        *  collect the result of an `async: true` submission. */
       async archive(searchId, output2 = "json") {
         const { apiKey, baseUrl } = await this.creds();
-        const safe = String(searchId).trim();
-        if (!/^[A-Za-z0-9_-]{6,128}$/.test(safe))
+        const safe2 = String(searchId).trim();
+        if (!/^[A-Za-z0-9_-]{6,128}$/.test(safe2))
           throw new SerpApiError(`Invalid search id "${searchId}".`, "bad_request");
-        const u = _SerpClient.join(baseUrl ?? DEFAULT_BASE_URL, `searches/${safe}.${output2 === "md" ? "md" : "json"}`);
+        const u = _SerpClient.join(baseUrl ?? DEFAULT_BASE_URL, `searches/${safe2}.${output2 === "md" ? "md" : "json"}`);
         u.searchParams.set("api_key", apiKey);
         return this.getJson(u.toString(), "archive", {}, { billed: false });
       }
@@ -27465,10 +27465,10 @@ var init_client = __esm({
        *  the body is text, and feeding it to JSON.parse is how the markdown path used to throw. */
       async archiveMarkdown(searchId) {
         const { apiKey, baseUrl } = await this.creds();
-        const safe = String(searchId).trim();
-        if (!/^[A-Za-z0-9_-]{6,128}$/.test(safe))
+        const safe2 = String(searchId).trim();
+        if (!/^[A-Za-z0-9_-]{6,128}$/.test(safe2))
           throw new SerpApiError(`Invalid search id "${searchId}".`, "bad_request");
-        const u = _SerpClient.join(baseUrl ?? DEFAULT_BASE_URL, `searches/${safe}.md`);
+        const u = _SerpClient.join(baseUrl ?? DEFAULT_BASE_URL, `searches/${safe2}.md`);
         u.searchParams.set("api_key", apiKey);
         const { text: text9 } = await this.fetchWithRetry(u.toString(), "archive", {}, false);
         return { markdown: text9 };
@@ -29181,7 +29181,123 @@ var init_plan_splitter = __esm({
   }
 });
 
+// ../../packages/agent-core/dist/unattended-log.js
+var unattended_log_exports = {};
+__export(unattended_log_exports, {
+  readUnattendedDecisions: () => readUnattendedDecisions,
+  recordUnattendedDecision: () => recordUnattendedDecision,
+  recordVerificationDecision: () => recordVerificationDecision,
+  setUnattendedLogSink: () => setUnattendedLogSink,
+  unattendedLogPath: () => unattendedLogPath
+});
+import { appendFileSync, closeSync as closeSync3, existsSync as existsSync7, mkdirSync as mkdirSync9, openSync as openSync3, readFileSync as readFileSync13, readSync as readSync2, renameSync as renameSync6, statSync as statSync5 } from "node:fs";
+import { dirname as dirname7 } from "node:path";
+function unattendedLogPath() {
+  return daemonPath("unattended.jsonl");
+}
+function rolledPath() {
+  return `${unattendedLogPath()}.1`;
+}
+function healPrefix(file2) {
+  if (appended)
+    return "";
+  appended = true;
+  try {
+    const size = statSync5(file2).size;
+    if (size === 0)
+      return "";
+    const fd = openSync3(file2, "r");
+    try {
+      const buf = Buffer.alloc(1);
+      readSync2(fd, buf, 0, 1, size - 1);
+      return buf[0] === 10 ? "" : "\n";
+    } finally {
+      closeSync3(fd);
+    }
+  } catch {
+    return "";
+  }
+}
+function setUnattendedLogSink(fn) {
+  sink = fn;
+  warned = false;
+  appended = false;
+}
+function rotateIfNeeded(file2) {
+  try {
+    if (!existsSync7(file2) || statSync5(file2).size < MAX_BYTES)
+      return;
+    renameSync6(file2, rolledPath());
+  } catch {
+  }
+}
+function recordUnattendedDecision(entry) {
+  if (sink) {
+    try {
+      sink(entry);
+    } catch {
+    }
+    return;
+  }
+  try {
+    const file2 = unattendedLogPath();
+    mkdirSync9(dirname7(file2), { recursive: true });
+    rotateIfNeeded(file2);
+    appendFileSync(file2, `${healPrefix(file2)}${JSON.stringify(entry)}
+`, { mode: 384 });
+  } catch (err2) {
+    if (warned)
+      return;
+    warned = true;
+    console.error("[unattended] decision log unavailable:", err2 instanceof Error ? err2.message : err2);
+  }
+}
+function recordVerificationDecision(entry) {
+  recordUnattendedDecision({ ts: (/* @__PURE__ */ new Date()).toISOString(), source: "verification", ...entry });
+}
+function readUnattendedDecisions(limit = 200, opts) {
+  const out = [];
+  for (const file2 of [rolledPath(), unattendedLogPath()]) {
+    let text9;
+    try {
+      if (!existsSync7(file2))
+        continue;
+      text9 = readFileSync13(file2, "utf8");
+    } catch {
+      continue;
+    }
+    for (const line of text9.split("\n")) {
+      if (!line.trim())
+        continue;
+      try {
+        const entry = JSON.parse(line);
+        if (opts?.sessionId && entry.sessionId !== opts.sessionId)
+          continue;
+        if (opts?.source && entry.source !== opts.source)
+          continue;
+        out.push(entry);
+      } catch {
+      }
+    }
+  }
+  return limit > 0 && out.length > limit ? out.slice(-limit) : out;
+}
+var MAX_BYTES, appended, warned, sink;
+var init_unattended_log = __esm({
+  "../../packages/agent-core/dist/unattended-log.js"() {
+    "use strict";
+    init_base_paths();
+    MAX_BYTES = 4 * 1024 * 1024;
+    appended = false;
+    warned = false;
+    sink = null;
+  }
+});
+
 // ../../packages/agent-core/dist/unattended.js
+function errText(err2) {
+  return err2 instanceof Error ? err2.message : String(err2);
+}
 function unattendedModeFor(o) {
   if (o.optedIn === true)
     return "auto";
@@ -29232,18 +29348,48 @@ function unattendedAnswer(mode, prompt, opts) {
     }
   }
 }
+function logSubject(prompt) {
+  switch (prompt.kind) {
+    case "permission":
+    case "question":
+    case "plan":
+      return prompt.tool;
+    case "elicitation":
+      return prompt.serverName;
+    case "dialog":
+      return prompt.dialogKind;
+    default:
+      return void 0;
+  }
+}
 function scheduleUnattendedAnswer(prompt, deps) {
   if (deps.mode() === "off")
     return;
+  const record2 = (mode, outcome, extra = {}) => {
+    recordUnattendedDecision({
+      ts: (/* @__PURE__ */ new Date()).toISOString(),
+      source: "prompt",
+      ...deps.context?.sessionId ? { sessionId: deps.context.sessionId } : {},
+      ...deps.context?.engine ? { engine: deps.context.engine } : {},
+      mode,
+      kind: prompt.kind,
+      ...logSubject(prompt) ? { subject: logSubject(prompt) } : {},
+      outcome,
+      ...extra
+    });
+  };
   const timer2 = setTimeout(() => {
     const mode = deps.mode();
-    if (mode === "off")
+    if (mode === "off") {
+      record2("off", "skipped", { reason: "unattended switched off before the answer landed" });
       return;
+    }
     let spent;
     try {
       spent = deps.charge();
     } catch (err2) {
       deps.log?.("unattended budget charge failed:", err2);
+      record2(mode, "failed", { reason: `budget charge failed: ${errText(err2)}` });
       return;
     }
     const cappedOut = spent > UNATTENDED_MAX_DECISIONS;
@@ -29253,6 +29399,7 @@ function scheduleUnattendedAnswer(prompt, deps) {
         deps.refund();
       } catch {
       }
+      record2(mode, "skipped", { reason: "no policy answer for this prompt kind", spent });
       return;
     }
     let applied = false;
@@ -29260,6 +29407,13 @@ function scheduleUnattendedAnswer(prompt, deps) {
       applied = deps.apply(answer);
     } catch (err2) {
       deps.log?.("unattended auto-answer failed:", err2);
+      record2(mode, "failed", {
+        reason: `apply failed: ${errText(err2)}`,
+        behavior: answer.behavior,
+        decision: answer.decision,
+        spent,
+        ...cappedOut ? { cappedOut } : {}
+      });
       return;
     }
     if (!applied) {
@@ -29267,9 +29421,21 @@ function scheduleUnattendedAnswer(prompt, deps) {
         deps.refund();
       } catch {
       }
+      record2(mode, "skipped", {
+        reason: "prompt already resolved \u2014 answered by a human, or the turn ended",
+        behavior: answer.behavior,
+        decision: answer.decision,
+        spent
+      });
       return;
     }
     deps.log?.(`unattended (${mode}) answered ${prompt.kind}: ${answer.behavior}${cappedOut ? " (budget spent)" : ""} \u2014 ${answer.decision}`);
+    record2(mode, "answered", {
+      behavior: answer.behavior,
+      decision: answer.decision,
+      spent,
+      ...cappedOut ? { cappedOut } : {}
+    });
     try {
       deps.report(answer, cappedOut);
     } catch (err2) {
@@ -29283,6 +29449,7 @@ var init_unattended = __esm({
   "../../packages/agent-core/dist/unattended.js"() {
     "use strict";
     init_dist();
+    init_unattended_log();
     UNATTENDED_ANSWER_DELAY_MS = 700;
     UNATTENDED_MAX_DECISIONS = 100;
     UNATTENDED_DECIDE_NOTE = "This is an unattended run \u2014 nobody is at the keyboard to answer, and no answer is coming. Choose the best option yourself, proceed, and briefly note which decision you made and why.";
@@ -29304,8 +29471,11 @@ var init_unattended = __esm({
 var reinforced_verification_exports = {};
 __export(reinforced_verification_exports, {
   RV_CLEAN_STREAK_TO_STOP: () => RV_CLEAN_STREAK_TO_STOP,
+  RV_HISTORY_MAX: () => RV_HISTORY_MAX,
   RV_MAX_CYCLES: () => RV_MAX_CYCLES,
   RV_MIN_REVIEWED_PCT: () => RV_MIN_REVIEWED_PCT,
+  RV_PHASE_DIRECTIVE: () => RV_PHASE_DIRECTIVE,
+  RV_PHASE_EVIDENCE_ASKS: () => RV_PHASE_EVIDENCE_ASKS,
   VERDICT_JSON_SCHEMA: () => VERDICT_JSON_SCHEMA,
   blockingIssues: () => blockingIssues,
   completenessGrade: () => completenessGrade,
@@ -29313,13 +29483,15 @@ __export(reinforced_verification_exports, {
   fixPrompt: () => fixPrompt,
   newRvState: () => newRvState,
   parseVerdict: () => parseVerdict,
+  phaseGrade: () => phaseGrade,
+  phaseReviewPrompt: () => phaseReviewPrompt,
   reviewGrade: () => reviewGrade,
   reviewPrompt: () => reviewPrompt,
   rvAdvance: () => rvAdvance,
   rvDecision: () => rvDecision
 });
 function newRvState(task) {
-  return { cycles: 0, phase: "idle", cleanStreak: 0, ...task ? { task } : {} };
+  return { cycles: 0, phase: "idle", cleanStreak: 0, phasesDone: 0, phaseAsks: 0, history: [], ...task ? { task } : {} };
 }
 function blockingIssues(v) {
   return v.issues.filter((i) => i.severity === "critical" || i.severity === "major");
@@ -29339,20 +29511,43 @@ function rvDecision(verdict, state3) {
         return { kind: "review", prompt: reviewPrompt(state3, verdict) };
       return { kind: "done" };
     }
-    if (!verdict.taskComplete)
+    if (state3.phase === "phase-review") {
+      if (blocking.length > 0)
+        return { kind: "fix", prompt: fixPrompt(verdict, state3) };
+      if (!verdict.exercised && state3.phaseAsks < RV_PHASE_EVIDENCE_ASKS) {
+        return { kind: "phase-review", prompt: phaseReviewPrompt(state3, verdict) };
+      }
+      return verdict.taskComplete ? { kind: "review", prompt: reviewPrompt(state3) } : { kind: "continue", prompt: continuePrompt(verdict, state3) };
+    }
+    if (!verdict.taskComplete) {
+      if (verdict.phaseComplete)
+        return { kind: "phase-review", prompt: phaseReviewPrompt(state3, verdict) };
       return { kind: "continue", prompt: continuePrompt(verdict, state3) };
+    }
     if (blocking.length > 0)
       return { kind: "fix", prompt: fixPrompt(verdict, state3) };
     return { kind: "review", prompt: reviewPrompt(state3) };
   })();
-  if (action.kind === "done" || action.kind === "review")
+  if (action.kind === "done" || action.kind === "review" || action.kind === "phase-review")
     return action;
   return state3.cycles >= RV_MAX_CYCLES ? { kind: "capped" } : action;
 }
 function rvAdvance(state3, action, verdict) {
   const clean2 = verdict.taskComplete && blockingIssues(verdict).length === 0;
   const cleanStreak = state3.phase === "review" ? clean2 ? state3.cleanStreak + 1 : 0 : clean2 ? state3.cleanStreak : 0;
-  const next = { ...state3, lastVerdict: verdict, cleanStreak };
+  const gate = state3.phase === "review" ? "review" : state3.phase === "phase-review" ? "phase" : "completeness";
+  const next = {
+    ...state3,
+    lastVerdict: verdict,
+    cleanStreak,
+    history: [...state3.history, {
+      gate,
+      phaseName: verdict.phaseName,
+      taskComplete: verdict.taskComplete,
+      exercised: verdict.exercised,
+      summary: verdict.summary.slice(0, 200)
+    }].slice(-RV_HISTORY_MAX)
+  };
   switch (action.kind) {
     // Sending the agent back to work is what the budget counts — a review pass is the
     // loop doing its own job, not the agent being given another attempt.
@@ -29361,12 +29556,59 @@ function rvAdvance(state3, action, verdict) {
       return { ...next, cycles: state3.cycles + 1, phase: "idle" };
     case "review":
       return { ...next, phase: "review" };
+    // No cycle, for the same reason a review costs none: the loop asking for evidence is not
+    // the agent being given another attempt. The budget still binds, because every `continue`
+    // and `fix` between phases charges one.
+    case "phase-review":
+      return {
+        ...next,
+        phase: "phase-review",
+        // Counted on ENTRY to a checkpoint only. The evidence re-ask stays inside the same
+        // checkpoint, and phaseGrade is explicitly asked to answer `phaseComplete` there too —
+        // so counting it again scored one phase twice, and did it for the phase that had just
+        // failed to produce any evidence at all.
+        phasesDone: state3.phasesDone + (state3.phase !== "phase-review" && verdict.phaseComplete ? 1 : 0),
+        // Entering a checkpoint resets the counter; re-asking within one increments it.
+        phaseAsks: state3.phase === "phase-review" ? state3.phaseAsks + 1 : 0
+      };
     case "done":
       return { ...next, phase: "done" };
     case "capped":
       return { ...next, phase: "capped" };
   }
 }
+function phaseReviewPrompt(state3, verdict) {
+  const name = verdict?.phaseName?.trim();
+  const notRun = verdict && verdict.exercised === false;
+  return promptLines([
+    "AUTOMATED PHASE CHECKPOINT \u2014 prove this phase before building on it.",
+    "",
+    state3.task ? `The request you are working on:
+${state3.task}` : void 0,
+    "",
+    name ? `The phase you just finished: ${name}` : "You have just finished a phase of the work.",
+    "",
+    notRun ? "Your last pass did not RUN anything. Reading the code again is not a checkpoint \u2014 run it." : void 0,
+    notRun ? "" : void 0,
+    "Do these, in this order:",
+    "1. RUN it. Execute the tests that cover this phase, or the command/script/request that",
+    "   exercises it. Actually run them \u2014 do not describe what would happen.",
+    "2. Paste the command you ran and its real output. If it failed, that is the finding.",
+    "3. Check that what worked BEFORE this phase still works: run the wider test suite, or",
+    "   the parts of it this phase could plausibly have broken, and say which you ran.",
+    "4. Only then read the phase's diff for defects the run would not surface.",
+    "",
+    "If this phase genuinely cannot be exercised on its own, say so and say WHY, in one line.",
+    "Do not substitute a description of the code for evidence that it works.",
+    "",
+    SERIOUSNESS_BAR,
+    "",
+    "Report, briefly:",
+    "- what you ran, and the outcome",
+    '- anything serious you found (or "nothing serious")',
+    "- whether the phase is sound enough to build the next one on top of"
+  ]);
+}
 function continuePrompt(verdict, state3) {
   const missing = verdict.unfinished.length > 0 ? verdict.unfinished.map((u) => `- ${u}`).join("\n") : "- (the request has not been fully delivered \u2014 re-read it and identify what is missing)";
   const defects = blockingIssues(verdict);
@@ -29459,21 +29701,42 @@ ${verdict.unfinished.map((u) => `- ${u}`).join("\n")}` : void 0,
 function issueLine(i) {
   return `- [${i.severity}/${i.kind}] ${i.summary}${i.where ? ` (${i.where})` : ""} \u2014 ${i.impact}`;
 }
-function completenessGrade(task, finalText, todos) {
-  const plan = todos && todos.length > 0 ? `
-
-## The agent's own checklist at the end of the turn
-${todos.map((t) => `- [${t.status}] ${t.content}`).join("\n")}` : "";
+function gradeContext(state3, todos) {
+  const out = [
+    "## What the user asked for",
+    state3.task || "(not captured \u2014 judge from the account below)"
+  ];
+  if (state3.plan) {
+    out.push("", "## The plan the agent laid out at the start", state3.plan.slice(0, 4e3));
+  }
+  if (state3.history.length > 0) {
+    out.push("", "## What has already been established, oldest first");
+    for (const h of state3.history) {
+      const bits = [
+        `[${h.gate}]`,
+        h.phaseName ? `phase "${h.phaseName}"` : null,
+        h.taskComplete ? "request complete" : "request outstanding",
+        h.gate === "phase" ? h.exercised ? "RAN it" : "did NOT run it" : null,
+        h.summary || null
+      ].filter(Boolean);
+      out.push(`- ${bits.join(" \xB7 ")}`);
+    }
+    out.push("", "Use this to judge PROGRESS. If the same claim keeps recurring with nothing", "new established, say so in `summary` and do not keep the run open on it.");
+  }
+  if (todos && todos.length > 0) {
+    out.push("", "## The agent's own checklist at the end of the turn", ...todos.map((t) => `- [${t.status}] ${t.content}`));
+  }
+  return out.join("\n");
+}
+function completenessGrade(state3, finalText, todos) {
   return {
     system: GRADER_SYSTEM,
     schema: VERDICT_JSON_SCHEMA,
     prompt: [
-      "## What the user asked for",
-      task || "(not captured \u2014 judge completeness from the agent's own account below)",
+      gradeContext(state3, todos),
       "",
       "## What the agent said when it stopped",
       finalText.slice(0, 24e3) || "(the agent produced no closing message)",
-      plan,
       "",
       "## Your task",
       "Decide whether the user's request has actually been delivered. Set `taskComplete`",
@@ -29482,18 +29745,68 @@ ${todos.map((t) => `- [${t.status}] ${t.content}`).join("\n")}` : "";
       "expected here unless the account admits to something broken. Fill the percentages from",
       'what the account evidences; if it evidences nothing, use 0 and confidence "low".',
       "",
+      "## The phase checkpoint",
+      "This run is verified AS IT IS BUILT. Separately from whether the whole request is",
+      "done, decide whether the agent has just finished one testable PHASE of it \u2014 a slice",
+      "that leaves the project working and can be exercised on its own.",
+      "",
+      "Set `phaseComplete` true only when BOTH hold:",
+      '- the account describes a coherent slice as finished (not "started", not "in progress"), and',
+      "- `taskComplete` is false \u2014 the whole request is still outstanding.",
+      "A finished REQUEST is not a phase checkpoint; the ordinary completeness path handles it.",
+      "Name that slice in `phaseName` (a few words, the agent's own framing), and put the",
+      "number of phases it still expects in `phasesRemaining` (null if it has not said).",
+      "",
+      "Set `exercised` true only if the account shows the work was actually RUN \u2014 a command",
+      'and its output, a test that executed, an observed result. "I reviewed it", "this should',
+      'work", or a description of what the code does is NOT exercised. When in doubt, false.',
+      "",
       "Return ONLY this JSON:",
       VERDICT_SCHEMA
     ].join("\n")
   };
 }
-function reviewGrade(task, reviewText) {
+function phaseGrade(state3, phaseName, reportText, todos) {
   return {
     system: GRADER_SYSTEM,
     schema: VERDICT_JSON_SCHEMA,
     prompt: [
-      "## What the user asked for",
-      task || "(not captured)",
+      gradeContext(state3, todos),
+      "",
+      phaseName ? `## The phase being checked
+${phaseName}` : "## The phase being checked\n(unnamed)",
+      "",
+      "## The agent's checkpoint report",
+      reportText.slice(0, 24e3) || "(the agent produced no report)",
+      "",
+      "## Your task",
+      "This was a CHECKPOINT: the agent was told to prove the phase by running it.",
+      "",
+      "`exercised` is the field that matters. Set it true ONLY if the report shows something",
+      "was actually executed \u2014 a command with its real output, a test run with a result, an",
+      'observed behaviour. A description of the code, a claim that it "should work", or a',
+      "read-through of the diff is NOT exercised, however confident it sounds. A report that",
+      "says the phase cannot be exercised on its own, and says why, is also not exercised \u2014",
+      "but that is an honest answer, so do not manufacture issues over it.",
+      "",
+      "Record in `issues` only what the report shows is genuinely broken \u2014 a failing test, a",
+      "command that errored, a regression it found. Do not invent findings from silence.",
+      "",
+      "Set `taskComplete` for the WHOLE request (usually false at a phase checkpoint), and",
+      "`phaseComplete` true if this phase is now sound enough to build on.",
+      "Fill `manuallyTestedPct` from what was actually run, not from what exists.",
+      "",
+      "Return ONLY this JSON:",
+      VERDICT_SCHEMA
+    ].join("\n")
+  };
+}
+function reviewGrade(state3, reviewText, todos) {
+  return {
+    system: GRADER_SYSTEM,
+    schema: VERDICT_JSON_SCHEMA,
+    prompt: [
+      gradeContext(state3, todos),
       "",
       "## The agent's review of its own work",
       reviewText.slice(0, 32e3) || "(the agent produced no review)",
@@ -29535,6 +29848,15 @@ function parseVerdict(raw) {
   })).slice(0, 40);
   return {
     taskComplete: o.taskComplete === true,
+    // All four default to the CONSERVATIVE reading. `phaseComplete: false` means "no
+    // checkpoint yet", which costs nothing; a defaulted `true` would fire a phase review at
+    // every turn end. `exercised: false` means "nothing was run", which sends the phase
+    // review back once — the safe direction, because the opposite lets "tested" quietly
+    // come to mean "read", which is the one thing this gate exists to prevent.
+    phaseComplete: o.phaseComplete === true,
+    phaseName: typeof o.phaseName === "string" ? o.phaseName.trim().slice(0, 120) : "",
+    phasesRemaining: typeof o.phasesRemaining === "number" && Number.isFinite(o.phasesRemaining) ? Math.max(0, Math.min(99, Math.round(o.phasesRemaining))) : null,
+    exercised: o.exercised === true,
     confidence: o.confidence === "high" || o.confidence === "medium" ? o.confidence : "low",
     unfinished: strList(o.unfinished),
     issues,
@@ -29549,13 +29871,14 @@ function parseVerdict(raw) {
     summary: typeof o.summary === "string" ? o.summary.trim().slice(0, 2e3) : ""
   };
 }
-var RV_MIN_REVIEWED_PCT, RV_CLEAN_STREAK_TO_STOP, SEVERITY_LIST, KIND_LIST, SEVERITIES, KINDS2, SERIOUSNESS_BAR, promptLines, VERDICT_SCHEMA, GRADER_SYSTEM, VERDICT_JSON_SCHEMA, NON_BLOCKING_WORDS, pct, tri, strList;
+var RV_MIN_REVIEWED_PCT, RV_PHASE_EVIDENCE_ASKS, RV_CLEAN_STREAK_TO_STOP, SEVERITY_LIST, KIND_LIST, SEVERITIES, KINDS2, RV_HISTORY_MAX, SERIOUSNESS_BAR, RV_PHASE_DIRECTIVE, promptLines, VERDICT_SCHEMA, GRADER_SYSTEM, VERDICT_JSON_SCHEMA, NON_BLOCKING_WORDS, pct, tri, strList;
 var init_reinforced_verification = __esm({
   "../../packages/agent-core/dist/reinforced-verification.js"() {
     "use strict";
     init_dist();
     init_dist();
     RV_MIN_REVIEWED_PCT = 90;
+    RV_PHASE_EVIDENCE_ASKS = 1;
     RV_CLEAN_STREAK_TO_STOP = 2;
     SEVERITY_LIST = ["critical", "major", "minor"];
     KIND_LIST = [
@@ -29570,6 +29893,7 @@ var init_reinforced_verification = __esm({
     ];
     SEVERITIES = new Set(SEVERITY_LIST);
     KINDS2 = new Set(KIND_LIST);
+    RV_HISTORY_MAX = 12;
     SERIOUSNESS_BAR = `Only these count as problems worth reporting:
 - It breaks functionality that is supposed to work \u2014 now, or for a realistic input.
 - It is a regression: something that worked before this run does not work now.
@@ -29584,9 +29908,26 @@ var init_reinforced_verification = __esm({
 Explicitly DO NOT report, and do not spend time on: naming, formatting, comment wording,
 documentation gaps, test style, micro-optimisation, hypothetical futures, "could be
 cleaner", or anything you would not stop a release for. Reporting those wastes the run.`;
+    RV_PHASE_DIRECTIVE = `This run is verified as you build it. Work in PHASES.
+
+Before you start, split the request into the smallest sequence of phases where each one:
+- leaves the project in a WORKING state (it builds, and what worked before still works), and
+- can be EXERCISED on its own \u2014 a test you can run, a command with observable output, a
+  script, a request against a running service. Not "read the diff and see that it is right".
+
+Then build one phase at a time. When a phase is done, say so plainly \u2014 name the phase, and
+say how it can be exercised. Do not start the next phase in the same turn: finishing one is
+a checkpoint, and the checkpoint is where it gets proven.
+
+If the request is genuinely a single small change, that is one phase. Do not invent phases to
+look thorough; a phase that cannot be run on its own is not a phase.`;
     promptLines = (lines) => lines.filter((l) => l !== void 0).join("\n");
     VERDICT_SCHEMA = `{
   "taskComplete": boolean,
+  "phaseComplete": boolean,
+  "phaseName": string,
+  "phasesRemaining": number | null,
+  "exercised": boolean,
   "confidence": "low" | "medium" | "high",
   "unfinished": string[],
   "issues": [{
@@ -29625,9 +29966,16 @@ Respond with ONLY a JSON object matching the schema. No prose, no markdown fence
     VERDICT_JSON_SCHEMA = {
       type: "object",
       additionalProperties: false,
-      required: ["taskComplete", "confidence", "unfinished", "issues", "reviewedPct", "testCoveragePct", "manuallyTestedPct", "buildsClean", "testsPass", "verdict", "summary"],
+      required: ["taskComplete", "phaseComplete", "phaseName", "phasesRemaining", "exercised", "confidence", "unfinished", "issues", "reviewedPct", "testCoveragePct", "manuallyTestedPct", "buildsClean", "testsPass", "verdict", "summary"],
       properties: {
         taskComplete: { type: "boolean" },
+        // REQUIRED, so the grader has to take a position on the checkpoint every time rather
+        // than omitting it and leaving the loop to guess (an omitted field parses to `false`,
+        // which is silently "no checkpoint" — fine as a failure mode, useless as a default).
+        phaseComplete: { type: "boolean" },
+        phaseName: { type: "string" },
+        phasesRemaining: { type: ["integer", "null"] },
+        exercised: { type: "boolean" },
         confidence: { type: "string", enum: ["low", "medium", "high"] },
         unfinished: { type: "array", items: { type: "string" } },
         issues: {
@@ -29667,6 +30015,90 @@ Respond with ONLY a JSON object matching the schema. No prose, no markdown fence
   }
 });
 
+// ../../packages/agent-core/dist/context-recovery.js
+async function recoverFromContextOverflow(deps) {
+  const mode = safe(deps.mode, "off");
+  if (mode === "off")
+    return false;
+  const record2 = (action, attempt2, reason) => {
+    recordUnattendedDecision({
+      ts: (/* @__PURE__ */ new Date()).toISOString(),
+      source: "recovery",
+      ...deps.context?.sessionId ? { sessionId: deps.context.sessionId } : {},
+      ...deps.context?.engine ? { engine: deps.context.engine } : {},
+      mode,
+      kind: "context-overflow",
+      action,
+      attempt: attempt2,
+      ...reason ? { reason } : {}
+    });
+  };
+  if (!safe(deps.canCompact, false)) {
+    record2("gave-up", safe(deps.tries, 0), "this engine cannot be asked to compact");
+    return false;
+  }
+  const attempt = safe(deps.tries, 0) + 1;
+  if (attempt > OVERFLOW_MAX_TRIES) {
+    record2("gave-up", attempt, `compaction did not reclaim enough after ${OVERFLOW_MAX_TRIES} attempts`);
+    deps.log?.(`context overflow: giving up after ${OVERFLOW_MAX_TRIES} compaction attempts`);
+    return false;
+  }
+  try {
+    deps.bump();
+  } catch {
+  }
+  try {
+    await deps.compactAndResume();
+  } catch (err2) {
+    deps.log?.("context overflow: compact-and-resume failed", err2);
+    record2("gave-up", attempt, `compact-and-resume failed: ${err2 instanceof Error ? err2.message : String(err2)}`);
+    return false;
+  }
+  record2("compact-and-resume", attempt);
+  deps.log?.(`context overflow: compacting and resuming (attempt ${attempt}/${OVERFLOW_MAX_TRIES})`);
+  return true;
+}
+function safe(fn, fallback) {
+  try {
+    return fn();
+  } catch {
+    return fallback;
+  }
+}
+function autoCompactEnvFor(pct2, supplied) {
+  if (supplied?.CLAUDE_AUTOCOMPACT_PCT_OVERRIDE)
+    return {};
+  if (typeof pct2 !== "number" || !Number.isFinite(pct2) || pct2 <= 0 || pct2 >= 100)
+    return {};
+  return { CLAUDE_AUTOCOMPACT_PCT_OVERRIDE: String(Math.round(pct2)) };
+}
+function shouldCompactProactively(a) {
+  if (a.mode === "off")
+    return "skip";
+  if (a.inFlight)
+    return "skip";
+  if (typeof a.pct !== "number" || !Number.isFinite(a.pct) || a.pct <= 0 || a.pct >= 100)
+    return "skip";
+  if (typeof a.usagePct !== "number" || !Number.isFinite(a.usagePct))
+    return "skip";
+  if (a.usagePct < a.pct)
+    return "reset";
+  if (typeof a.lastCompactPct === "number" && a.usagePct < a.lastCompactPct + PROACTIVE_REGROWTH_POINTS)
+    return "skip";
+  return "compact";
+}
+var OVERFLOW_MAX_TRIES, OVERFLOW_COMPACT_MESSAGE, OVERFLOW_RESUME_MESSAGE, PROACTIVE_REGROWTH_POINTS;
+var init_context_recovery = __esm({
+  "../../packages/agent-core/dist/context-recovery.js"() {
+    "use strict";
+    init_unattended_log();
+    OVERFLOW_MAX_TRIES = 3;
+    OVERFLOW_COMPACT_MESSAGE = "/compact";
+    OVERFLOW_RESUME_MESSAGE = "Continue.";
+    PROACTIVE_REGROWTH_POINTS = 5;
+  }
+});
+
 // ../../packages/agent-core/dist/session-edit.js
 function deleteTranscriptEntry(entries, uuid3, mode = "single") {
   const target = entries.find((e) => e.uuid === uuid3);
@@ -29833,7 +30265,7 @@ var init_session_edit = __esm({
 });
 
 // ../../packages/agent-core/dist/session-mirror.js
-import { appendFileSync, existsSync as existsSync7, mkdirSync as mkdirSync9, readFileSync as readFileSync13, readdirSync, statSync as statSync5, unlinkSync as unlinkSync2 } from "node:fs";
+import { appendFileSync as appendFileSync2, existsSync as existsSync8, mkdirSync as mkdirSync10, readFileSync as readFileSync14, readdirSync, statSync as statSync6, unlinkSync as unlinkSync2 } from "node:fs";
 import { join as join16 } from "node:path";
 function sessionsRoot() {
   return tessPath("sessions");
@@ -29861,8 +30293,8 @@ function loadSeen(file2) {
   if (cached3)
     return cached3;
   const set2 = /* @__PURE__ */ new Set();
-  if (existsSync7(file2)) {
-    for (const line of readFileSync13(file2, "utf8").split("\n")) {
+  if (existsSync8(file2)) {
+    for (const line of readFileSync14(file2, "utf8").split("\n")) {
       if (!line.trim())
         continue;
       try {
@@ -29883,7 +30315,7 @@ function createLocalSessionStore(opts = {}) {
         return;
       const file2 = fileFor(key2);
       try {
-        mkdirSync9(join16(file2, ".."), { recursive: true });
+        mkdirSync10(join16(file2, ".."), { recursive: true });
         withLock(`session-store-${safeSegment(key2.projectKey)}-${safeSegment(key2.sessionId)}`, () => {
           const seen = loadSeen(file2);
           const lines = [];
@@ -29897,7 +30329,7 @@ function createLocalSessionStore(opts = {}) {
             lines.push(JSON.stringify(e));
           }
           if (lines.length)
-            appendFileSync(file2, `${lines.join("\n")}
+            appendFileSync2(file2, `${lines.join("\n")}
 `, { mode: 384 });
         }, 5e3);
       } catch (err2) {
@@ -29906,11 +30338,11 @@ function createLocalSessionStore(opts = {}) {
     },
     async load(key2) {
       const file2 = fileFor(key2);
-      if (!existsSync7(file2))
+      if (!existsSync8(file2))
         return null;
       try {
         const out = [];
-        for (const line of readFileSync13(file2, "utf8").split("\n")) {
+        for (const line of readFileSync14(file2, "utf8").split("\n")) {
           if (!line.trim())
             continue;
           try {
@@ -29926,7 +30358,7 @@ function createLocalSessionStore(opts = {}) {
     },
     async listSessions(projectKey) {
       const dir2 = join16(sessionsRoot(), safeSegment(projectKey));
-      if (!existsSync7(dir2))
+      if (!existsSync8(dir2))
         return [];
       const out = [];
       for (const name of readdirSync(dir2)) {
@@ -29936,7 +30368,7 @@ function createLocalSessionStore(opts = {}) {
         if (base.includes("__"))
           continue;
         try {
-          out.push({ sessionId: base, mtime: Math.floor(statSync5(join16(dir2, name)).mtimeMs) });
+          out.push({ sessionId: base, mtime: Math.floor(statSync6(join16(dir2, name)).mtimeMs) });
         } catch {
         }
       }
@@ -29944,7 +30376,7 @@ function createLocalSessionStore(opts = {}) {
     },
     async listSubkeys(key2) {
       const dir2 = join16(sessionsRoot(), safeSegment(key2.projectKey));
-      if (!existsSync7(dir2))
+      if (!existsSync8(dir2))
         return [];
       const prefix = `${safeSegment(key2.sessionId)}__`;
       return readdirSync(dir2).filter((n) => n.startsWith(prefix) && n.endsWith(".jsonl")).map((n) => n.slice(prefix.length, -".jsonl".length));
@@ -29952,13 +30384,13 @@ function createLocalSessionStore(opts = {}) {
     async delete(key2) {
       const file2 = fileFor(key2);
       try {
-        if (existsSync7(file2))
+        if (existsSync8(file2))
           unlinkSync2(file2);
         seenUuids.delete(file2);
         if (!key2.subpath) {
           const dir2 = join16(sessionsRoot(), safeSegment(key2.projectKey));
           const prefix = `${safeSegment(key2.sessionId)}__`;
-          if (existsSync7(dir2)) {
+          if (existsSync8(dir2)) {
             for (const n of readdirSync(dir2)) {
               if (n.startsWith(prefix) && n.endsWith(".jsonl")) {
                 try {
@@ -30835,8 +31267,8 @@ import { query, createSdkMcpServer, startup } from "@anthropic-ai/claude-agent-s
 import { writeFile as writeFile4, mkdir as mkdir4, readFile as readFile6 } from "node:fs/promises";
 import { randomUUID as randomUUID6 } from "node:crypto";
 import { tmpdir as tmpdir3, homedir as homedir4, userInfo } from "node:os";
-import { join as join18, dirname as dirname7 } from "node:path";
-import { existsSync as existsSync8, readFileSync as readFileSync14, readdirSync as readdirSync2, openSync as openSync3, readSync as readSync2, closeSync as closeSync3, statSync as statSync6, writeFileSync as writeFileSync10, mkdirSync as mkdirSync10, copyFileSync, renameSync as renameSync6 } from "node:fs";
+import { join as join18, dirname as dirname8 } from "node:path";
+import { existsSync as existsSync9, readFileSync as readFileSync15, readdirSync as readdirSync2, openSync as openSync4, readSync as readSync3, closeSync as closeSync4, statSync as statSync7, writeFileSync as writeFileSync10, mkdirSync as mkdirSync11, copyFileSync, renameSync as renameSync7 } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { createRequire as createRequire2 } from "node:module";
 import { createServer as createServer2 } from "node:net";
@@ -30860,11 +31292,11 @@ function findUserInstalledClaude(binName) {
     "/usr/bin/" + binName
   ];
   for (const p of abs)
-    if (existsSync8(p))
+    if (existsSync9(p))
       return p;
   try {
     const out = execFileSync2(process.platform === "win32" ? "where" : "which", [binName], { encoding: "utf8" }).split("\n")[0]?.trim();
-    if (out && existsSync8(out))
+    if (out && existsSync9(out))
       return out;
   } catch {
   }
@@ -30889,8 +31321,8 @@ function resolveClaudeCodeExecutable() {
   for (const key2 of keys) {
     try {
       const pkgJson = require2.resolve(`@anthropic-ai/claude-agent-sdk-${key2}/package.json`);
-      const bin = join18(dirname7(pkgJson), binName);
-      if (existsSync8(bin))
+      const bin = join18(dirname8(pkgJson), binName);
+      if (existsSync9(bin))
         return cachedClaudeExe = bin;
     } catch {
     }
@@ -30900,7 +31332,7 @@ function resolveClaudeCodeExecutable() {
     const platKey = process.platform === "darwin" ? "mac" : process.platform === "win32" ? "win" : "linux";
     for (const dir2 of [`${platKey}-${process.arch}`, platKey]) {
       const bundled = join18(resourcesPath, "claude-cli", dir2, binName);
-      if (existsSync8(bundled))
+      if (existsSync9(bundled))
         return cachedClaudeExe = bundled;
     }
   }
@@ -30927,7 +31359,7 @@ function engineCapsPath() {
 function claudeBinaryStamp() {
   try {
     const path6 = resolveClaudeCodeExecutable();
-    const st = statSync6(path6);
+    const st = statSync7(path6);
     return `${path6}:${st.size}:${Math.round(st.mtimeMs)}`;
   } catch {
     return null;
@@ -30941,7 +31373,7 @@ function loadEngineCaps() {
   if (!stamp2)
     return;
   try {
-    const store = JSON.parse(readFileSync14(engineCapsPath(), "utf8"));
+    const store = JSON.parse(readFileSync15(engineCapsPath(), "utf8"));
     const entry = store[stamp2];
     if (entry && (entry.v ?? 1) !== CAPS_VERSION) {
       log(`Engine caps: discarding a v${entry.v ?? 1} entry for this binary \u2014 its flags cannot be read under the current rules; they will be re-learned if they still apply.`);
@@ -30965,7 +31397,7 @@ function saveEngineCaps() {
   try {
     let store = {};
     try {
-      store = JSON.parse(readFileSync14(engineCapsPath(), "utf8"));
+      store = JSON.parse(readFileSync15(engineCapsPath(), "utf8"));
     } catch {
     }
     store[stamp2] = {
@@ -30973,7 +31405,7 @@ function saveEngineCaps() {
       unsupported: [...unsupportedCliOptions],
       rejectedArgs: Object.fromEntries([...rejectedCliArgs].map(([f, v]) => [f, [...v]]))
     };
-    mkdirSync10(tessPath(), { recursive: true });
+    mkdirSync11(tessPath(), { recursive: true });
     writeFileSync10(engineCapsPath(), JSON.stringify(store, null, 2), { mode: 384 });
   } catch {
   }
@@ -31106,13 +31538,13 @@ function findSessionCwd(sessionId, configDir) {
   }
   for (const slug2 of slugs) {
     const file2 = join18(base, slug2, `${sessionId}.jsonl`);
-    if (!existsSync8(file2))
+    if (!existsSync9(file2))
       continue;
     try {
-      const fd = openSync3(file2, "r");
+      const fd = openSync4(file2, "r");
       const buf = Buffer.alloc(65536);
-      const n = readSync2(fd, buf, 0, buf.length, 0);
-      closeSync3(fd);
+      const n = readSync3(fd, buf, 0, buf.length, 0);
+      closeSync4(fd);
       for (const line of buf.toString("utf-8", 0, n).split("\n")) {
         if (!line.trim())
           continue;
@@ -31138,7 +31570,7 @@ function newestVersionManagerNode() {
     join18(home, "Library", "pnpm", "node"),
     join18(home, ".local", "bin", "node")
   ])
-    if (existsSync8(p))
+    if (existsSync9(p))
       return p;
   const roots = [
     { dir: join18(home, ".nvm", "versions", "node"), bin: (v) => join18(v, "bin", "node") },
@@ -31156,7 +31588,7 @@ function newestVersionManagerNode() {
     }
     for (const name of names) {
       const path6 = bin(join18(dir2, name));
-      if (!existsSync8(path6))
+      if (!existsSync9(path6))
         continue;
       const parts = name.replace(/^v/, "").split(".").map((n) => Number.parseInt(n, 10) || 0);
       const ver = [parts[0] ?? 0, parts[1] ?? 0, parts[2] ?? 0];
@@ -31171,12 +31603,12 @@ function loginShellNode() {
   if (process.platform === "win32")
     return null;
   const shell = process.env.SHELL || "/bin/zsh";
-  if (!existsSync8(shell))
+  if (!existsSync9(shell))
     return null;
   try {
     const out = execFileSync2(shell, ["-lic", `printf '<<NODE:%s>>' "$(command -v node 2>/dev/null)"`], { encoding: "utf8", timeout: 4e3, stdio: ["ignore", "pipe", "ignore"] });
     const path6 = out.match(/<<NODE:(.*?)>>/)?.[1]?.trim();
-    return path6 && existsSync8(path6) ? path6 : null;
+    return path6 && existsSync9(path6) ? path6 : null;
   } catch {
     return null;
   }
@@ -31187,12 +31619,12 @@ function resolveNodeExecutable() {
   if (!process.versions.electron)
     return cachedNodeExe2 = process.execPath;
   for (const p of [process.env.CCB_NODE_PATH, "/opt/homebrew/bin/node", "/usr/local/bin/node", "/usr/bin/node"]) {
-    if (p && existsSync8(p))
+    if (p && existsSync9(p))
       return cachedNodeExe2 = p;
   }
   try {
     const found = execSync2(process.platform === "win32" ? "where node" : "command -v node", { encoding: "utf8", timeout: 3e3 }).split(/\r?\n/)[0].trim();
-    if (found && existsSync8(found))
+    if (found && existsSync9(found))
       return cachedNodeExe2 = found;
   } catch {
   }
@@ -31626,11 +32058,11 @@ function buildMobileClause(dir2) {
   try {
     let fw = "";
     let runCmd = "";
-    if (existsSync8(join18(dir2, "pubspec.yaml"))) {
+    if (existsSync9(join18(dir2, "pubspec.yaml"))) {
       fw = "Flutter";
       runCmd = "flutter run -d chrome";
-    } else if (existsSync8(join18(dir2, "package.json"))) {
-      const pkg = JSON.parse(readFileSync14(join18(dir2, "package.json"), "utf8"));
+    } else if (existsSync9(join18(dir2, "package.json"))) {
+      const pkg = JSON.parse(readFileSync15(join18(dir2, "package.json"), "utf8"));
       const deps = { ...pkg.dependencies, ...pkg.devDependencies };
       if (deps.expo) {
         fw = "Expo";
@@ -31713,6 +32145,8 @@ var init_agent_manager = __esm({
     init_plan_splitter();
     init_unattended();
     init_reinforced_verification();
+    init_unattended_log();
+    init_context_recovery();
     init_dist();
     init_dist();
     init_base_paths();
@@ -31887,6 +32321,15 @@ var init_agent_manager = __esm({
        *  the host (setVerifierLlm); null ⇒ reinforced verification cannot grade, and says so
        *  rather than letting a run pass unverified. */
       verifierLlm = null;
+      /** The user's auto-compact threshold, read from the DAEMON's settings snapshot.
+       *
+       *  Exists because the desktop-only route does not cover an unattended run. The threshold
+       *  normally reaches the CLI as `CLAUDE_AUTOCOMPACT_PCT_OVERRIDE` inside `params.env`,
+       *  which the desktop main process fills in per send (`getAgentSettings`) — so a turn the
+       *  DAEMON originates (a cron fire, or anything sent while the app is closed) carried no
+       *  threshold at all and ran at the CLI's own default instead of the number the user set.
+       *  The other three engines already read this daemon-side at spawn; this is Claude's. */
+      autoCompactPct = null;
       /** Plugin-contributed Pre/PostToolUse hooks (Epic G). Appended (never replacing) the
        *  built-in edit-capture hooks at session start. */
       pluginHooks = [];
@@ -32158,7 +32601,7 @@ var init_agent_manager = __esm({
       constructor(rawSend2, onBrowserRequest) {
         this.rawSend = rawSend2;
         this.onBrowserRequest = onBrowserRequest;
-        const __dirname = dirname7(fileURLToPath(import.meta.url));
+        const __dirname = dirname8(fileURLToPath(import.meta.url));
         this.browserCliPath = join18(__dirname, "browser-cli.js");
         this.narrator = new Narrator((sessionId, text9, engineLabel) => this.send({ type: "agent:narration", sessionId, text: text9, ...engineLabel ? { engineLabel } : {} }, this.liveSessions.get(sessionId)?.origin));
       }
@@ -32168,6 +32611,131 @@ var init_agent_manager = __esm({
       setVerifierLlm(fn) {
         this.verifierLlm = fn;
       }
+      /**
+       * PROACTIVE compaction: keep an unattended run comfortably inside the window instead of
+       * letting it walk into the wall.
+       *
+       * The renderer already does this at the user's threshold — but only for a conversation
+       * it has on screen. Headless there was nothing, and the fallback everyone assumed
+       * (`CLAUDE_AUTOCOMPACT_PCT_OVERRIDE`, which the desktop also sets) turns out to be inert:
+       * measured against Claude Code 2.1.241, setting it to 25 left `autoCompactThreshold` at
+       * the CLI's own 167000 and the context climbed straight past 25%, 33%, 42%, 52% without
+       * compacting. So an unattended run honoured no threshold at all; its only protection was
+       * the wall-hit recovery, which is a last resort, not a setting.
+       *
+       * Only when NOBODY IS WATCHING. With a client attached the renderer owns this, and both
+       * doing it would spend two turns on one reclaim.
+       */
+      async maybeCompactProactively(live) {
+        const pct2 = (() => {
+          try {
+            return this.autoCompactPct?.();
+          } catch {
+            return void 0;
+          }
+        })();
+        const usage2 = await this.getContextUsage(live.sessionId).catch(() => null);
+        const verdict = shouldCompactProactively({
+          mode: live.unattended ?? "off",
+          pct: pct2,
+          usagePct: typeof usage2?.percentage === "number" ? usage2.percentage : null,
+          lastCompactPct: live.proactiveCompactedAt ?? null,
+          inFlight: live.overflowCompacting === true
+        });
+        if (verdict === "reset") {
+          live.proactiveCompactedAt = void 0;
+          return;
+        }
+        if (verdict !== "compact")
+          return;
+        live.proactiveCompactedAt = usage2?.percentage ?? 0;
+        live.overflowCompacting = true;
+        try {
+          log(`auto-compact: ${Math.round(usage2?.percentage ?? 0)}% of the window used (threshold ${String(pct2)}%) \u2014 compacting`);
+          await this.sendMessage({
+            message: OVERFLOW_COMPACT_MESSAGE,
+            url: "",
+            sessionId: live.sessionId,
+            projectDir: live.cwd,
+            origin: live.origin,
+            browserId: live.browserId,
+            windowId: live.windowId,
+            autoContinuation: true,
+            ...live.unattended === "auto" ? { unattended: true } : {},
+            ...live.model ? { model: live.model } : {}
+          });
+        } catch (err2) {
+          log("auto-compact failed:", err2 instanceof Error ? err2.message : String(err2));
+        } finally {
+          live.overflowCompacting = false;
+        }
+      }
+      /**
+       * Compact and resume after this session outgrew the window, when nobody is watching.
+       *
+       * Returns true when the recovery was dispatched, in which case the caller must NOT report
+       * the turn as finished — the run continues on a reclaimed window.
+       *
+       * The two sends mirror the renderer's `continueLastTurn(id, 'context_window')` exactly,
+       * because they have to agree: `/compact` alone just compacts and stops, and the resume
+       * alone overflows again. Both ride `autoContinuation`, which is what tells the rest of
+       * the manager this is the SAME run — without it the verification loop would re-anchor on
+       * the literal request "Continue.", which the very next turn satisfies by construction.
+       */
+      async recoverContextOverflow(live, turnSid) {
+        return recoverFromContextOverflow({
+          mode: () => live.unattended ?? "off",
+          // Claude takes `/compact` as a real slash command.
+          canCompact: () => true,
+          tries: () => live.overflowTries ?? 0,
+          bump: () => {
+            live.overflowTries = (live.overflowTries ?? 0) + 1;
+          },
+          context: { sessionId: turnSid, engine: "claude-code" },
+          log: (m, err2) => log(m, err2 instanceof Error ? err2.message : err2 !== void 0 ? String(err2) : ""),
+          compactAndResume: async () => {
+            const base = {
+              url: "",
+              sessionId: live.sessionId,
+              projectDir: live.cwd,
+              origin: live.origin,
+              browserId: live.browserId,
+              windowId: live.windowId,
+              autoContinuation: true,
+              ...live.unattended === "auto" ? { unattended: true } : {},
+              ...live.model ? { model: live.model } : {}
+            };
+            live.overflowCompacting = true;
+            try {
+              await this.sendMessage({ ...base, message: OVERFLOW_COMPACT_MESSAGE });
+            } finally {
+              live.overflowCompacting = false;
+            }
+            await this.sendMessage({ ...base, message: OVERFLOW_RESUME_MESSAGE });
+          }
+        });
+      }
+      /** Inject the daemon's view of the auto-compact threshold. Read at SPAWN, never
+       *  captured, so flipping the slider at 23:00 reaches a session started at 03:00. */
+      setAutoCompactPct(fn) {
+        this.autoCompactPct = fn;
+      }
+      /**
+       * `CLAUDE_AUTOCOMPACT_PCT_OVERRIDE` for a spawn the desktop did not configure.
+       *
+       * Empty whenever the caller already supplied one (the desktop's per-send env wins), when
+       * no provider is wired, or when the number is not a usable percentage — 0 and 100 both
+       * mean "no proactive compaction", and writing either would turn the CLI's own default
+       * OFF rather than leaving it alone. Never throws: a settings read that fails must not
+       * take the spawn with it.
+       */
+      daemonCompactEnv(supplied) {
+        try {
+          return autoCompactEnvFor(this.autoCompactPct?.(), supplied);
+        } catch {
+          return {};
+        }
+      }
       setNarrationLlm(cfg2) {
         this.narrator.setConfig(cfg2);
         this.cheapLlm = cfg2?.complete ?? null;
@@ -32353,7 +32921,7 @@ ${full.slice(-8e3)}`;
         if (live.rvGrading === rv)
           return;
         live.rvGrading = rv;
-        const gate = rv.phase === "review" ? "review" : "completeness";
+        const gate = rv.phase === "review" ? "review" : rv.phase === "phase-review" ? "phase" : "completeness";
         let owned = rv;
         const evtSessionId = live.sessionId;
         const evtCrid = live.clientRequestId;
@@ -32366,7 +32934,7 @@ ${full.slice(-8e3)}`;
             this.send(evt, evtOrigin);
         };
         try {
-          if (!didWork && gate !== "review") {
+          if (!didWork && gate === "completeness") {
             emitVerification({ action: "done", gate, cycle: rv.cycles, maxCycles: RV_MAX_CYCLES, unavailable: "This turn used no tools, so there was nothing to verify." });
             return;
           }
@@ -32377,7 +32945,7 @@ ${full.slice(-8e3)}`;
             return;
           }
           const todos = live.todos?.map((t) => ({ content: t.content, status: String(t.status) }));
-          const call3 = gate === "review" ? reviewGrade(rv.task, finalText) : completenessGrade(rv.task, finalText, todos);
+          const call3 = gate === "review" ? reviewGrade(rv, finalText, todos) : gate === "phase" ? phaseGrade(rv, rv.lastVerdict?.phaseName ?? "", finalText, todos) : completenessGrade(rv, finalText, todos);
           const raw = await llm({ model: live.model, system: call3.system, prompt: call3.prompt, maxTokens: 16e3, schema: call3.schema });
           if (live.rv !== rv || live.reaped) {
             if (live.reaped || live.rv === void 0) {
@@ -32391,14 +32959,31 @@ ${full.slice(-8e3)}`;
             live.rv = { ...rv, phase: "done" };
             return;
           }
+          if (!rv.plan && finalText.trim())
+            rv.plan = finalText.slice(0, 4e3);
           const action = rvDecision(verdict, rv);
           const nextState = rvAdvance(rv, action, verdict);
           live.rv = nextState;
           owned = nextState;
           emitVerification({ action: action.kind, gate, cycle: nextState.cycles, maxCycles: RV_MAX_CYCLES, verdict });
           log(`reinforced-verification: ${gate} \u2192 ${action.kind} (cycle ${nextState.cycles}/${RV_MAX_CYCLES}, ${verdict.issues.length} issue(s), complete=${verdict.taskComplete})`);
+          recordVerificationDecision({
+            sessionId: live.sessionId,
+            engine: "claude-code",
+            gate,
+            action: action.kind,
+            cycle: nextState.cycles,
+            phasesDone: nextState.phasesDone,
+            phaseName: verdict.phaseName,
+            taskComplete: verdict.taskComplete,
+            phaseComplete: verdict.phaseComplete,
+            exercised: verdict.exercised,
+            blocking: blockingIssues(verdict).length,
+            summary: verdict.summary
+          });
           if (action.kind === "done" || action.kind === "capped")
             return;
+          await this.maybeCompactProactively(live);
           await this.sendMessage({
             message: action.prompt,
             url: "",
@@ -32476,6 +33061,7 @@ ${full.slice(-8e3)}`;
        *  Abandoning it is a hang — the precise failure this whole path exists to prevent. */
       autoAnswerPrompt(live, requestId, prompt, apply2) {
         scheduleUnattendedAnswer(prompt, {
+          context: { sessionId: live.sessionId, engine: "claude-code" },
           mode: () => live.unattended ?? "off",
           charge: () => live.autoDecisions = (live.autoDecisions ?? 0) + 1,
           // Relative, not absolute — siblings can be mid-window; see the deps doc.
@@ -32890,7 +33476,7 @@ ${qText}`;
         if (!file2)
           return { ok: false, reason: "This conversation has no transcript on this machine." };
         try {
-          const before = parseTranscript(readFileSync14(file2, "utf8"));
+          const before = parseTranscript(readFileSync15(file2, "utf8"));
           const want = typeof locator === "string" ? { uuid: locator } : locator;
           const uuid3 = want.uuid ?? (want.text ? findUserEntryByText(before, want.text)?.uuid : void 0);
           if (!uuid3) {
@@ -32905,7 +33491,7 @@ ${qText}`;
           }
           const tmp = `${file2}.tmp-${randomUUID6().slice(0, 8)}`;
           writeFileSync10(tmp, serializeTranscript(res.entries), { mode: 384 });
-          renameSync6(tmp, file2);
+          renameSync7(tmp, file2);
           log(`Removed ${res.removed.length} transcript entr${res.removed.length === 1 ? "y" : "ies"} from ${sessionId}; re-parented ${res.relinked.length}.`);
           if (live) {
             try {
@@ -33300,12 +33886,12 @@ ${qText}`;
         const cli = `ELECTRON_RUN_AS_NODE=1 "${process.execPath}" "${this.browserCliPath}"`;
         const pageInfo = url2 ? `
 The user's current browser tab is: ${url2}` : "";
-        const designClause = this.projectDir && existsSync8(join18(this.projectDir, TOKENS_FILE)) ? `
+        const designClause = this.projectDir && existsSync9(join18(this.projectDir, TOKENS_FILE)) ? `
 
 DESIGN SYSTEM:
 - This project has a design system at design-system/tokens.json. For any UI you build or edit, use those tokens (colors, spacing, typography, radius) \u2014 call read_design_tokens to read values, set them with write_design_token, and NEVER hardcode hex/sizes that duplicate a token.` : "";
         const mobileClause = this.projectDir ? buildMobileClause(this.projectDir) : "";
-        const buildClause = this.projectDir && existsSync8(join18(this.projectDir, ".tesseract", "brief.md")) ? `
+        const buildClause = this.projectDir && existsSync9(join18(this.projectDir, ".tesseract", "brief.md")) ? `
 
 WEBSITE BUILD MODE:
 This is a guided website build. Read \`.tesseract/brief.md\` (the user's brief), \`design-system/reference.html\` (the chosen template \u2014 the visual/structural spec) and \`design-system/tokens.json\` (the theme). Protocol:
@@ -33359,8 +33945,8 @@ CRITICAL RULES:
             const match = f.dataUrl.match(/^data:[^;]*;base64,(.+)$/);
             if (!match)
               continue;
-            const safe = (f.name || `file-${i}`).replace(/[^\w.\-]+/g, "_").slice(-100);
-            const filePath = join18(fileDir, `${process.pid}-${Date.now()}-${randomUUID6().slice(0, 8)}-${i}-${safe}`);
+            const safe2 = (f.name || `file-${i}`).replace(/[^\w.\-]+/g, "_").slice(-100);
+            const filePath = join18(fileDir, `${process.pid}-${Date.now()}-${randomUUID6().slice(0, 8)}-${i}-${safe2}`);
             await writeFile4(filePath, Buffer.from(match[1], "base64"));
             paths.push(filePath);
           }
@@ -33518,7 +34104,7 @@ CRITICAL RULES:
         let pinnedSource;
         if (params.sessionId) {
           const originCwd = findSessionCwd(params.sessionId, params.engineEnv?.CLAUDE_CONFIG_DIR ?? params.env?.CLAUDE_CONFIG_DIR);
-          if (originCwd && originCwd !== openProject && existsSync8(originCwd)) {
+          if (originCwd && originCwd !== openProject && existsSync9(originCwd)) {
             log(`Resuming ${params.sessionId} in its ORIGINAL cwd ${originCwd} (open project ${openProject} added as a source)`);
             cwd = originCwd;
             pinnedSource = openProject;
@@ -34166,9 +34752,18 @@ CRITICAL RULES:
                 ...identityEnv(),
                 ...options.env,
                 // params.env carries CLAUDE_AUTOCOMPACT_PCT_OVERRIDE from the user's setting
-                // (getAgentSettings) — IF this CLI honours it, native mid-run compaction fires
-                // at the same threshold as our renderer-side proactive `/compact`.
+                // (getAgentSettings). MEASURED INERT on Claude Code 2.1.241: set to 25, the
+                // reported `autoCompactThreshold` stayed at the CLI's own 167000 and the
+                // conversation climbed past 25%, 33%, 42%, 52% without compacting once. Kept
+                // because it costs nothing and other CLI versions may honour it — but nothing
+                // depends on it: `maybeCompactProactively` is what actually holds an unattended
+                // run to the user's threshold.
                 ...params.env ?? {},
+                // FALLBACK, not an override: `params.env` wins whenever the desktop supplied a
+                // threshold. This fills the gap for a turn the daemon originated itself, which
+                // carries no env — without it an unattended run compacts at the CLI's default
+                // rather than the number in the run-mode menu.
+                ...this.daemonCompactEnv(params.env),
                 ...params.engineEnv ?? {},
                 CCB_IPC_PORT: String(live.ipcPort)
               };
@@ -34208,9 +34803,16 @@ CRITICAL RULES:
             // restores the SDK's dynamic command list, gitStatus/date context,
             // env-info and memory/CLAUDE.md preamble that a bare custom string
             // prompt suppresses — while `append` keeps the Tesseract browser tools.
+            // The phase directive rides here when verification is armed. It has to be in the
+            // SYSTEM prompt, not prepended to the user's message: the loop only speaks at turn
+            // END, so without this the agent has already built the whole thing monolithically by
+            // the time anything can ask it to work in slices — and rewriting the user's message
+            // is the mistake that made `/compact` the graded task.
             systemPrompt: { type: "preset", preset: "claude_code", append: this.applyPromptHook(this.buildSystemPrompt(params.url) + (params.appendSystemPrompt ? `
 
-${params.appendSystemPrompt}` : ""), live.sessionId) },
+${params.appendSystemPrompt}` : "") + (params.reinforcedVerification ? `
+
+${RV_PHASE_DIRECTIVE}` : ""), live.sessionId) },
             includePartialMessages: true,
             // Emit a predicted follow-up prompt after each turn (git/context-aware) — rendered
             // as a clickable suggestion chip. Off by default in the SDK, so opt in here.
@@ -34566,9 +35168,13 @@ ${params.appendSystemPrompt}` : ""), live.sessionId) },
                   });
                 }
                 const limitRejection = live.usageLimitRejection ?? (r.subtype === "success" ? assistantUsageLimitFallback(live.lastAssistantContent) : void 0);
+                const resultText = typeof r.result === "string" ? r.result : "";
+                const textOverflow = r.is_error === true && isContextOverflow(resultText);
                 if (limitRejection) {
                   reportUsageLimit(limitRejection, turnSid);
-                } else if (r.subtype === "success") {
+                } else if (r.subtype === "success" && !textOverflow) {
+                  if (!live.overflowCompacting)
+                    live.overflowTries = 0;
                   if (!turnStreamed && Array.isArray(live.lastAssistantContent)) {
                     for (const blk of live.lastAssistantContent) {
                       if (blk?.type === "thinking" && typeof blk.thinking === "string" && blk.thinking) {
@@ -34605,6 +35211,8 @@ ${params.appendSystemPrompt}` : ""), live.sessionId) },
                   const didWork = typeof r.num_turns !== "number" || r.num_turns > 1;
                   if (live.rv && !continuable)
                     void this.runVerification(live, typeof r.result === "string" ? r.result : "", didWork);
+                  else
+                    void this.maybeCompactProactively(live);
                 } else if (live.interrupted) {
                   live.interrupted = false;
                   this.clearStopWatchdog(live);
@@ -34613,13 +35221,16 @@ ${params.appendSystemPrompt}` : ""), live.sessionId) },
                   emit2({ type: "agent:status", sessionId: turnSid, status: "idle" });
                 } else {
                   const errors = Array.isArray(r.errors) ? r.errors.map(String).filter(Boolean) : [];
-                  const detail = errors.length > 0 ? errors.join("\n") : `Agent returned ${r.subtype}${r.stop_reason ? ` (stop_reason: ${r.stop_reason})` : ""}`;
-                  const contextHit = r.subtype === "error_max_turns" ? "max_turns" : String(r.subtype).includes("context") || r.stop_reason === "model_context_window_exceeded" ? "context_window" : void 0;
+                  const detail = textOverflow ? resultText : errors.length > 0 ? errors.join("\n") : `Agent returned ${r.subtype}${r.stop_reason ? ` (stop_reason: ${r.stop_reason})` : ""}`;
+                  const contextHit = r.subtype === "error_max_turns" ? "max_turns" : textOverflow || String(r.subtype).includes("context") || r.stop_reason === "model_context_window_exceeded" ? "context_window" : void 0;
                   const looksTransient = !contextHit && /overloaded|\b429\b|\b529\b|rate.?limit|too many requests|throttl|\b50[0234]\b|service unavailable|bad gateway|gateway timeout|timed? ?out|ETIMEDOUT|ECONNRESET|ECONNREFUSED|EPIPE|ENOTFOUND|ENETUNREACH|EAI_AGAIN|socket hang up|network error|temporarily unavailable/i.test(detail);
                   log("Session result error:", turnSid, JSON.stringify({ subtype: r.subtype, stop_reason: r.stop_reason, errors, looksTransient }));
                   live.resultErrorReported = true;
-                  emit2({ type: "chat:error", sessionId: turnSid, error: detail, ...contextHit ? { continuable: true, continueReason: contextHit } : looksTransient ? { transient: true } : {} });
-                  emit2({ type: "agent:status", sessionId: turnSid, status: contextHit ? "idle" : "error" });
+                  const recovered = contextHit === "context_window" && await this.recoverContextOverflow(live, turnSid);
+                  if (!recovered) {
+                    emit2({ type: "chat:error", sessionId: turnSid, error: detail, ...contextHit ? { continuable: true, continueReason: contextHit } : looksTransient ? { transient: true } : {} });
+                    emit2({ type: "agent:status", sessionId: turnSid, status: contextHit ? "idle" : "error" });
+                  }
                 }
                 blockAcc.clear();
                 insideXmlByKey.clear();
@@ -35678,8 +36289,12 @@ __export(dist_exports2, {
   DesignTokensSchema: () => DesignTokensSchema,
   DtcgTokensSchema: () => DtcgTokensSchema,
   HookBus: () => HookBus,
+  OVERFLOW_COMPACT_MESSAGE: () => OVERFLOW_COMPACT_MESSAGE,
+  OVERFLOW_MAX_TRIES: () => OVERFLOW_MAX_TRIES,
+  OVERFLOW_RESUME_MESSAGE: () => OVERFLOW_RESUME_MESSAGE,
   PRESENT_TOOL_NAMES: () => PRESENT_TOOL_NAMES,
   PRESENT_TOOL_SPECS: () => PRESENT_TOOL_SPECS,
+  PROACTIVE_REGROWTH_POINTS: () => PROACTIVE_REGROWTH_POINTS,
   SCREEN_CONTROL_SPECS: () => SCREEN_CONTROL_SPECS,
   SessionStore: () => SessionStore,
   TOKENS_CSS_FILE: () => TOKENS_CSS_FILE,
@@ -35691,6 +36306,7 @@ __export(dist_exports2, {
   appendImageArtifact: () => appendImageArtifact,
   appendSurfaceArtifact: () => appendSurfaceArtifact,
   applyDesignPack: () => applyDesignPack,
+  autoCompactEnvFor: () => autoCompactEnvFor,
   buildAppControlTools: () => buildAppControlTools,
   buildClaudeNarrationLlm: () => buildClaudeNarrationLlm,
   buildClaudeSmartLlm: () => buildClaudeSmartLlm,
@@ -35724,6 +36340,9 @@ __export(dist_exports2, {
   normalizeTokens: () => normalizeTokens,
   parseColorToRgb: () => parseColorToRgb,
   readSessionArtifacts: () => readSessionArtifacts,
+  readUnattendedDecisions: () => readUnattendedDecisions,
+  recordUnattendedDecision: () => recordUnattendedDecision,
+  recoverFromContextOverflow: () => recoverFromContextOverflow,
   renderAppControlReference: () => renderAppControlReference,
   resolveNodeExecutable: () => resolveNodeExecutable,
   resolveOauthToken: () => resolveOauthToken,
@@ -35737,6 +36356,8 @@ __export(dist_exports2, {
   setBrowserExtensionProbe: () => setBrowserExtensionProbe,
   setTokenPath: () => setTokenPath,
   setTokenSegments: () => setTokenSegments,
+  setUnattendedLogSink: () => setUnattendedLogSink,
+  shouldCompactProactively: () => shouldCompactProactively,
   specParametersJsonSchema: () => specParametersJsonSchema,
   stringifyValue: () => stringifyValue,
   stripPromptPrefix: () => stripPromptPrefix,
@@ -35747,6 +36368,7 @@ __export(dist_exports2, {
   toolSpecJsonSchema: () => specParametersJsonSchema,
   transferSession: () => transferSession,
   unattendedAnswer: () => unattendedAnswer,
+  unattendedLogPath: () => unattendedLogPath,
   unattendedModeFor: () => unattendedModeFor,
   walkTokens: () => walkTokens,
   wrapCtxTool: () => wrapCtxTool,
@@ -35759,6 +36381,8 @@ var init_dist5 = __esm({
     init_session_store();
     init_session_usage();
     init_unattended();
+    init_unattended_log();
+    init_context_recovery();
     init_session_transfer();
     init_log();
     init_kill_tree();
@@ -35789,7 +36413,7 @@ __export(tesseract_mcp_endpoint_exports, {
   startTesseractMcpEndpoint: () => startTesseractMcpEndpoint
 });
 import { createServer as createServer3 } from "node:http";
-import { readFileSync as readFileSync15, writeFileSync as writeFileSync11 } from "node:fs";
+import { readFileSync as readFileSync16, writeFileSync as writeFileSync11 } from "node:fs";
 import { join as join20 } from "node:path";
 function readBody2(req, limitBytes = 4 * 1024 * 1024) {
   return new Promise((resolve16, reject) => {
@@ -35818,7 +36442,7 @@ function portFile() {
 }
 function rememberedPort() {
   try {
-    const o = JSON.parse(readFileSync15(portFile(), "utf8"));
+    const o = JSON.parse(readFileSync16(portFile(), "utf8"));
     return typeof o.port === "number" && o.port > 1024 ? o.port : 0;
   } catch {
     return 0;
@@ -35959,7 +36583,7 @@ __export(serpapi_runner_exports, {
   createDaemonSerpClient: () => createDaemonSerpClient,
   resolveSerpCreds: () => resolveSerpCreds
 });
-import { existsSync as existsSync9, readFileSync as readFileSync16 } from "node:fs";
+import { existsSync as existsSync10, readFileSync as readFileSync17 } from "node:fs";
 function resolveSerpCreds() {
   const snap = readDaemonAgentSettings().serp;
   if (snap?.apiKey?.trim()) {
@@ -35974,8 +36598,8 @@ function resolveSerpCreds() {
     };
   }
   const file2 = daemonPath("serpapi.key");
-  if (existsSync9(file2)) {
-    const k = readFileSync16(file2, "utf-8").trim();
+  if (existsSync10(file2)) {
+    const k = readFileSync17(file2, "utf-8").trim();
     if (k)
       return { apiKey: k, tier: "own", source: "key-file" };
   }
@@ -62997,8 +63621,8 @@ var require_selfsigned = __commonJS({
 // ../../packages/host-core/dist/peer-link/tls-direct.js
 import tls from "node:tls";
 import { X509Certificate, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
-import { readFileSync as readFileSync32, writeFileSync as writeFileSync22, existsSync as existsSync19, mkdirSync as mkdirSync22 } from "node:fs";
-import { dirname as dirname17 } from "node:path";
+import { readFileSync as readFileSync33, writeFileSync as writeFileSync22, existsSync as existsSync20, mkdirSync as mkdirSync23 } from "node:fs";
+import { dirname as dirname18 } from "node:path";
 function fingerprintOf(certPem) {
   return new X509Certificate(certPem).fingerprint256;
 }
@@ -63010,15 +63634,15 @@ function fingerprintsEqual(a, b) {
   return ba.length === bb.length && timingSafeEqual2(ba, bb);
 }
 async function loadOrCreateIdentity(certPath, keyPath) {
-  if (existsSync19(certPath) && existsSync19(keyPath)) {
-    const cert = readFileSync32(certPath, "utf8");
-    const key2 = readFileSync32(keyPath, "utf8");
+  if (existsSync20(certPath) && existsSync20(keyPath)) {
+    const cert = readFileSync33(certPath, "utf8");
+    const key2 = readFileSync33(keyPath, "utf8");
     return { cert, key: key2, fingerprint256: fingerprintOf(cert) };
   }
   const tenYears = new Date(Date.now() + 10 * 365 * 24 * 60 * 60 * 1e3);
   const pems = await (0, import_selfsigned.generate)([{ name: "commonName", value: "tesseract-peer" }], { keySize: 2048, notAfterDate: tenYears, algorithm: "sha256" });
   try {
-    mkdirSync22(dirname17(certPath), { recursive: true });
+    mkdirSync23(dirname18(certPath), { recursive: true });
   } catch {
   }
   try {
@@ -70813,7 +71437,7 @@ var mesh_ca_exports = {};
 __export(mesh_ca_exports, {
   netCaCommand: () => netCaCommand
 });
-import { chmodSync as chmodSync8, existsSync as existsSync41, mkdirSync as mkdirSync41, readFileSync as readFileSync47, writeFileSync as writeFileSync42 } from "node:fs";
+import { chmodSync as chmodSync8, existsSync as existsSync42, mkdirSync as mkdirSync42, readFileSync as readFileSync48, writeFileSync as writeFileSync42 } from "node:fs";
 import { join as join76, resolve as resolve13 } from "node:path";
 import { createInterface } from "node:readline";
 function die(msg) {
@@ -70852,7 +71476,7 @@ function writeSecretFile(p, bytes2) {
   }
 }
 function ensureDir(p) {
-  mkdirSync41(p, { recursive: true, mode: 448 });
+  mkdirSync42(p, { recursive: true, mode: 448 });
   try {
     chmodSync8(p, 448);
   } catch {
@@ -70861,12 +71485,12 @@ function ensureDir(p) {
 async function openCa(dir2) {
   const gPath = join76(dir2, "genesis.bin");
   const sPath = join76(dir2, "ca.sealed");
-  if (!existsSync41(gPath) || !existsSync41(sPath)) {
+  if (!existsSync42(gPath) || !existsSync42(sPath)) {
     die(`No mesh CA in ${dir2}. Run: tesseract-agent net init --org NAME --ca-dir ${dir2}`);
   }
-  const genesisBytes = new Uint8Array(readFileSync47(gPath));
+  const genesisBytes = new Uint8Array(readFileSync48(gPath));
   const genesis = decodeGenesis(genesisBytes);
-  const sealed = decodeRecoveryBundle(new Uint8Array(readFileSync47(sPath)));
+  const sealed = decodeRecoveryBundle(new Uint8Array(readFileSync48(sPath)));
   const pass = await readPassphrase("CA passphrase: ");
   let seed;
   try {
@@ -70882,7 +71506,7 @@ async function netCaCommand(rest, flags) {
   if (sub === "init") {
     const org = typeof flags.org === "string" ? flags.org.trim() : "";
     if (!org) die("Usage: tesseract-agent net init --org NAME [--ca-dir DIR]");
-    if (existsSync41(join76(caDir, "ca.sealed"))) {
+    if (existsSync42(join76(caDir, "ca.sealed"))) {
       die(`A mesh CA already exists in ${caDir}. Refusing to overwrite it.`);
     }
     const pass = await readPassphrase("New CA passphrase: ");
@@ -71040,12 +71664,12 @@ var init_mesh_ca = __esm({
 
 // src/cli.ts
 init_base_paths();
-import { existsSync as existsSync42, mkdtempSync as mkdtempSync2, readFileSync as readFileSync49, rmSync as rmSync11 } from "node:fs";
+import { existsSync as existsSync43, mkdtempSync as mkdtempSync2, readFileSync as readFileSync50, rmSync as rmSync11 } from "node:fs";
 import { createHash as createHash8 } from "node:crypto";
 import { execFileSync as execFileSync6, spawn as spawn16 } from "node:child_process";
 import { fileURLToPath as fileURLToPath6 } from "node:url";
 import { tmpdir as tmpdir6 } from "node:os";
-import { dirname as dirname31, join as join77, resolve as resolve15 } from "node:path";
+import { dirname as dirname32, join as join77, resolve as resolve15 } from "node:path";
 import { createInterface as createInterface2 } from "node:readline/promises";
 
 // ../../packages/host-core/dist/control-link.js
@@ -71075,7 +71699,7 @@ function toRewindOutcome(res, noHistory) {
 // ../../packages/host-core/dist/control-link.js
 import { join as join53, basename as basename11 } from "node:path";
 import { randomUUID as randomUUID22 } from "node:crypto";
-import { mkdirSync as mkdirSync26 } from "node:fs";
+import { mkdirSync as mkdirSync27 } from "node:fs";
 
 // ../../node_modules/ws/wrapper.mjs
 var import_stream = __toESM(require_stream(), 1);
@@ -72384,6 +73008,7 @@ async function createClaudeCodeBackend(send4, onBrowserRequest, loadPluginRuntim
     send4(msg, origin);
   };
   const manager2 = new AgentManager2(sendWatchingSessions, onBrowserRequest);
+  manager2.setAutoCompactPct(() => readDaemonAgentSettings().autoCompactPct);
   const claudeSnapshots = createSnapshotStore(join19(daemonDir(), "engine-snapshots", "claude-code.json"));
   const claudeTurnSeq = /* @__PURE__ */ new Map();
   const pendingAlias = /* @__PURE__ */ new Map();
@@ -73162,7 +73787,7 @@ function geminiMessageText(m) {
 }
 
 // ../../packages/host-core/dist/engines/hosted-verification.js
-function createHostedVerification() {
+function createHostedVerification(engineId) {
   let verifier = null;
   return {
     setVerifier: (fn) => {
@@ -73171,6 +73796,7 @@ function createHostedVerification() {
     canGrade: () => verifier !== null,
     async run({ sessionId, task, finalText, todos, reprompt, emit: emit2, model, clientRequestId, cancelled }) {
       const rv = await Promise.resolve().then(() => (init_reinforced_verification(), reinforced_verification_exports));
+      const ulog = await Promise.resolve().then(() => (init_unattended_log(), unattended_log_exports));
       const base = { type: "agent:verification", sessionId, ...clientRequestId ? { clientRequestId } : {}, maxCycles: rv.RV_MAX_CYCLES };
       const standDown = (cycle, unavailable) => {
         emit2({ ...base, action: "done", gate: "completeness", cycle, unavailable });
@@ -73189,11 +73815,14 @@ function createHostedVerification() {
       }
       const grade = verifier;
       let state3 = rv.newRvState(task);
+      if (finalText.trim())
+        state3 = { ...state3, plan: finalText.slice(0, 4e3) };
       let text9 = finalText;
       let reviewText = "";
-      for (let i = 0; i < rv.RV_MAX_CYCLES * 2 + 2; i++) {
-        const gate = state3.phase === "review" ? "review" : "completeness";
-        const call3 = gate === "review" ? rv.reviewGrade(task, reviewText || text9) : rv.completenessGrade(task, text9, todos);
+      let phaseText = "";
+      for (let i = 0; i < rv.RV_MAX_CYCLES * 5 + 4; i++) {
+        const gate = state3.phase === "review" ? "review" : state3.phase === "phase-review" ? "phase" : "completeness";
+        const call3 = gate === "review" ? rv.reviewGrade(state3, reviewText || text9, todos) : gate === "phase" ? rv.phaseGrade(state3, state3.lastVerdict?.phaseName ?? "", phaseText || text9, todos) : rv.completenessGrade(state3, text9, todos);
         let verdict = null;
         try {
           verdict = rv.parseVerdict(await grade({ model, system: call3.system, prompt: call3.prompt, maxTokens: 16e3, schema: call3.schema }));
@@ -73214,6 +73843,20 @@ function createHostedVerification() {
         const action = rv.rvDecision(verdict, state3);
         state3 = rv.rvAdvance(state3, action, verdict);
         emit2({ ...base, action: action.kind, gate, cycle: state3.cycles, verdict });
+        ulog.recordVerificationDecision({
+          sessionId,
+          ...engineId ? { engine: engineId } : {},
+          gate,
+          action: action.kind,
+          cycle: state3.cycles,
+          phasesDone: state3.phasesDone,
+          phaseName: verdict.phaseName,
+          taskComplete: verdict.taskComplete,
+          phaseComplete: verdict.phaseComplete,
+          exercised: verdict.exercised,
+          blocking: rv.blockingIssues(verdict).length,
+          summary: verdict.summary
+        });
         if (action.kind === "done" || action.kind === "capped")
           return text9;
         try {
@@ -73224,15 +73867,18 @@ function createHostedVerification() {
               return text9;
             }
           }
-          const before = action.kind === "review" ? reviewText : text9;
+          const before = action.kind === "review" ? reviewText : action.kind === "phase-review" ? phaseText : text9;
           const reply3 = await reprompt(action.prompt);
           if (!reply3 || reply3 === before) {
             standDown(state3.cycles, "The agent did not produce anything new when sent back, so this run was not verified.");
             return text9;
           }
-          if (action.kind !== "review")
+          if (action.kind === "review")
+            reviewText = reply3;
+          else if (action.kind === "phase-review")
+            phaseText = reply3;
+          else
             text9 = reply3;
-          reviewText = action.kind === "review" ? reply3 : reviewText;
         } catch {
           standDown(state3.cycles, "Verification could not be completed, so this run was not verified.");
           return text9;
@@ -73246,7 +73892,7 @@ function createHostedVerification() {
 
 // ../../packages/host-core/dist/engines/model-pricing.js
 init_credentials();
-import { readFileSync as readFileSync17, writeFileSync as writeFileSync12 } from "node:fs";
+import { readFileSync as readFileSync18, writeFileSync as writeFileSync12 } from "node:fs";
 import { join as join22 } from "node:path";
 var LITELLM_URL = "https://raw.githubusercontent.com/BerriAI/litellm/main/model_prices_and_context_window.json";
 var MODELS_DEV_URL = "https://models.dev/api.json";
@@ -73278,7 +73924,7 @@ var Source = class {
     if (this.data || this.pinned)
       return;
     try {
-      const o = JSON.parse(readFileSync17(this.path, "utf8"));
+      const o = JSON.parse(readFileSync18(this.path, "utf8"));
       if (o.map && this.sane(o.map)) {
         this.data = o.map;
         this.fetchedAt = o.fetchedAt ?? 0;
@@ -73577,7 +74223,7 @@ var AcpTransport = class {
 import { spawn as spawn5 } from "node:child_process";
 import { mkdir as mkdir5, readFile as readFile8, writeFile as writeFile6 } from "node:fs/promises";
 import { realpathSync as realpathSync3 } from "node:fs";
-import { basename as basename3, dirname as dirname8, isAbsolute as isAbsolute4, resolve as resolve6, sep as sep4 } from "node:path";
+import { basename as basename3, dirname as dirname9, isAbsolute as isAbsolute4, resolve as resolve6, sep as sep4 } from "node:path";
 var DEFAULT_OUTPUT_BYTE_LIMIT = 1024 * 1024;
 var MAX_OUTPUT_BYTE_LIMIT = 8 * 1024 * 1024;
 var MAX_TERMINALS = 16;
@@ -73597,7 +74243,7 @@ function realpathDeep(abs) {
       return tail3.length ? resolve6(real, ...tail3) : real;
     } catch {
     }
-    const parent = dirname8(head);
+    const parent = dirname9(head);
     if (parent === head)
       return abs;
     tail3.unshift(basename3(head));
@@ -73665,7 +74311,7 @@ function installWorkspaceHandlers(t, opts) {
     if (!target)
       return null;
     const content = p.content ?? "";
-    await mkdir5(dirname8(target), { recursive: true }).catch(() => {
+    await mkdir5(dirname9(target), { recursive: true }).catch(() => {
     });
     await writeFile6(target, content, "utf8").catch(() => {
     });
@@ -73784,9 +74430,9 @@ function installWorkspaceHandlers(t, opts) {
 }
 
 // ../../packages/host-core/dist/engines/mcp-injection.js
-import { copyFileSync as copyFileSync2, existsSync as existsSync10, mkdirSync as mkdirSync11, readFileSync as readFileSync18, readdirSync as readdirSync3, symlinkSync as symlinkSync2, writeFileSync as writeFileSync13 } from "node:fs";
+import { copyFileSync as copyFileSync2, existsSync as existsSync11, mkdirSync as mkdirSync12, readFileSync as readFileSync19, readdirSync as readdirSync3, symlinkSync as symlinkSync2, writeFileSync as writeFileSync13 } from "node:fs";
 import { homedir as homedir6 } from "node:os";
-import { dirname as dirname9, join as join23, resolve as resolve7 } from "node:path";
+import { dirname as dirname10, join as join23, resolve as resolve7 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 var BUNDLED_MCP_SERVERS = [
   { name: "tesseract-serp", basename: "serpapi-mcp.js", envOverride: "CCB_SERPAPI_MCP_JS" }
@@ -73804,7 +74450,7 @@ function resolveBundledMcpBin(basename14, envOverride) {
   if (rp)
     candidates.push(join23(rp, "host-daemon", basename14));
   try {
-    const here = dirname9(fileURLToPath2(import.meta.url));
+    const here = dirname10(fileURLToPath2(import.meta.url));
     candidates.push(join23(here, basename14));
     candidates.push(resolve7(here, "../../../../apps/host-daemon/dist-bundle", basename14));
     candidates.push(resolve7(here, "../../../../apps/host-daemon/dist", basename14));
@@ -73812,7 +74458,7 @@ function resolveBundledMcpBin(basename14, envOverride) {
   } catch {
   }
   for (const c of candidates) {
-    if (existsSync10(c)) {
+    if (existsSync11(c)) {
       resolvedBins.set(basename14, c);
       return c;
     }
@@ -73874,7 +74520,7 @@ function specToSettingsServer(spec) {
 }
 function readJson(path6) {
   try {
-    return JSON.parse(readFileSync18(path6, "utf8"));
+    return JSON.parse(readFileSync19(path6, "utf8"));
   } catch {
     return {};
   }
@@ -73883,9 +74529,9 @@ function writeManagedMcpHome(engineId, layout, servers, projectDir, baseDir, use
   try {
     const home = join23(baseDir, "engine-mcp-home", engineId);
     const cfg2 = join23(home, layout.configDir);
-    mkdirSync11(cfg2, { recursive: true });
+    mkdirSync12(cfg2, { recursive: true });
     if (layout.linkSiblingConfigs) {
-      const realRoot = dirname9(join23(userHome2, layout.userConfigDirRel ?? layout.configDir));
+      const realRoot = dirname10(join23(userHome2, layout.userConfigDirRel ?? layout.configDir));
       let entries = [];
       try {
         entries = readdirSync3(realRoot);
@@ -73896,7 +74542,7 @@ function writeManagedMcpHome(engineId, layout, servers, projectDir, baseDir, use
         if (name === layout.configDir)
           continue;
         const link = join23(home, name);
-        if (existsSync10(link))
+        if (existsSync11(link))
           continue;
         try {
           symlinkSync2(join23(realRoot, name), link);
@@ -73920,7 +74566,7 @@ function writeManagedMcpHome(engineId, layout, servers, projectDir, baseDir, use
         if ((layout.seedFiles ?? []).includes(name))
           continue;
         const link = join23(cfg2, name);
-        if (existsSync10(link))
+        if (existsSync11(link))
           continue;
         try {
           symlinkSync2(join23(userCfg, name), link);
@@ -73931,7 +74577,7 @@ function writeManagedMcpHome(engineId, layout, servers, projectDir, baseDir, use
     for (const f of layout.seedFiles ?? []) {
       const src = join23(userCfg, f);
       const dst = join23(cfg2, f);
-      if (existsSync10(src) && !existsSync10(dst)) {
+      if (existsSync11(src) && !existsSync11(dst)) {
         try {
           copyFileSync2(src, dst);
         } catch {
@@ -73940,7 +74586,7 @@ function writeManagedMcpHome(engineId, layout, servers, projectDir, baseDir, use
     }
     for (const f of layout.mirrorFiles ?? []) {
       const src = join23(userCfg, f);
-      if (!existsSync10(src))
+      if (!existsSync11(src))
         continue;
       try {
         copyFileSync2(src, join23(cfg2, f));
@@ -74537,7 +75183,7 @@ function httpApiArgs(spec, port) {
 }
 
 // ../../packages/host-core/dist/engines/session-index.js
-import { mkdirSync as mkdirSync12, readFileSync as readFileSync19, writeFileSync as writeFileSync14 } from "node:fs";
+import { mkdirSync as mkdirSync13, readFileSync as readFileSync20, writeFileSync as writeFileSync14 } from "node:fs";
 import { join as join24 } from "node:path";
 var MAX_ROWS = 500;
 function createSessionIndex(engineId, baseDir, now2 = Date.now) {
@@ -74547,7 +75193,7 @@ function createSessionIndex(engineId, baseDir, now2 = Date.now) {
     if (rows)
       return rows;
     try {
-      const parsed = JSON.parse(readFileSync19(file2, "utf8"));
+      const parsed = JSON.parse(readFileSync20(file2, "utf8"));
       rows = (parsed.sessions ?? []).filter((r) => r && typeof r.id === "string");
     } catch {
       rows = [];
@@ -74561,7 +75207,7 @@ function createSessionIndex(engineId, baseDir, now2 = Date.now) {
     if (rows.length > MAX_ROWS)
       rows = rows.slice(0, MAX_ROWS);
     try {
-      mkdirSync12(join24(baseDir, "engine-sessions"), { recursive: true });
+      mkdirSync13(join24(baseDir, "engine-sessions"), { recursive: true });
       writeFileSync14(file2, JSON.stringify({ sessions: rows }, null, 2), { mode: 384 });
     } catch {
     }
@@ -74637,7 +75283,7 @@ function wrapWithSeatbelt(command, args, profile) {
 
 // ../../packages/host-core/dist/engines/opencode-acp.js
 init_dist5();
-import { mkdirSync as mkdirSync13, writeFileSync as writeFileSync15, readFileSync as readFileSync20 } from "node:fs";
+import { mkdirSync as mkdirSync14, writeFileSync as writeFileSync15, readFileSync as readFileSync21 } from "node:fs";
 import { join as join25, relative as relative4 } from "node:path";
 import { homedir as homedir7, tmpdir as tmpdir4 } from "node:os";
 var TESSERACT_INTERNAL_SECRET2 = /^(CCB_JWT_SECRET|JWT_SECRET|TESSERACT_TOKEN|CCB_RELAY_SECRET|TURN_SECRET|LIVEKIT_API_SECRET)$/;
@@ -74686,7 +75332,7 @@ function modelMemoPath(engineId) {
 }
 function lastKnownModel(engineId) {
   try {
-    return readFileSync20(modelMemoPath(engineId), "utf8").trim() || void 0;
+    return readFileSync21(modelMemoPath(engineId), "utf8").trim() || void 0;
   } catch {
     return void 0;
   }
@@ -74695,7 +75341,7 @@ function rememberModel(engineId, modelId) {
   if (!modelId || modelId === lastKnownModel(engineId))
     return;
   try {
-    mkdirSync13(join25(daemonDir2(), "engine-config", engineId), { recursive: true });
+    mkdirSync14(join25(daemonDir2(), "engine-config", engineId), { recursive: true });
     writeFileSync15(modelMemoPath(engineId), modelId, { mode: 384 });
   } catch {
   }
@@ -74711,7 +75357,7 @@ async function writeTokenCompactionConfig(engineId, spec, modelId, pct2, baseDir
     return {};
   try {
     const dir2 = join25(baseDir, "engine-config", engineId);
-    mkdirSync13(dir2, { recursive: true });
+    mkdirSync14(dir2, { recursive: true });
     const file2 = join25(dir2, "tesseract.json");
     const cfg2 = {};
     let node = cfg2;
@@ -74796,7 +75442,15 @@ var OPENCODE_ACP = {
   // Its own threshold, since ACP gives us no way to ASK it to compact. Without this the
   // auto-compact slider could not reach OpenCode at all and it compacted only at its own
   // hardcoded 95%.
-  tokenCompaction: { configEnv: "OPENCODE_CONFIG", bufferPath: ["compaction", "buffer"] },
+  // `reserved`, not `buffer` — read out of OpenCode's own bundle (1.18.21):
+  //   let l = cfg.compaction?.reserved ?? Math.min(20000, maxOutputTokens(model))
+  //   return model.limit.input ? max(0, model.limit.input - l) : max(0, context - maxOutput)
+  // `buffer` was not a key it knows, so this reserve had never once taken effect. Note the
+  // second branch: even under the right name the reserve is IGNORED for a model that does
+  // not declare `limit.input` — which is most of them (1329 of 7482 on models.dev), gpt-4o
+  // and gpt-4o-mini included. So this is worth writing correctly, and is NOT something the
+  // slider can rely on; `shouldCompactProactively` is what actually holds the line.
+  tokenCompaction: { configEnv: "OPENCODE_CONFIG", bufferPath: ["compaction", "reserved"] },
   compactCommand: "/compact",
   // ACP fallback; the HTTP RPC below is preferred
   // `opencode acp` serves the full HTTP API on the same process — verified: the ACP session
@@ -75082,7 +75736,7 @@ function createAcpBackend(engine, send4, resolve16, onBrowserRequest, loadPlugin
   let hostTasks = null;
   let refreshHostedTools = null;
   const lastTurnText = /* @__PURE__ */ new Map();
-  const verification = createHostedVerification();
+  const verification = createHostedVerification(engine.id);
   const scheduling = createHostedScheduling(async (task) => {
     const pol = scheduling.policy();
     try {
@@ -75133,10 +75787,10 @@ function createAcpBackend(engine, send4, resolve16, onBrowserRequest, loadPlugin
       collectReplay(replay, u);
       return;
     }
-    const sink = subagentSinks.get(sid);
-    if (sink) {
+    const sink2 = subagentSinks.get(sid);
+    if (sink2) {
       if (u.sessionUpdate === "agent_message_chunk")
-        sink.push(u.content?.text ?? "");
+        sink2.push(u.content?.text ?? "");
       return;
     }
     if (u.sessionUpdate === "usage_update") {
@@ -75257,6 +75911,7 @@ function createAcpBackend(engine, send4, resolve16, onBrowserRequest, loadPlugin
       if (!turn)
         return;
       scheduleUnattendedAnswer({ kind: "elicitation", serverName: engine.label }, {
+        context: { sessionId: sid, engine: engine.id },
         mode: () => turn.unattended,
         charge: () => turn.autoDecisions += 1,
         refund: () => {
@@ -75434,6 +76089,7 @@ function createAcpBackend(engine, send4, resolve16, onBrowserRequest, loadPlugin
           }, turn?.origin);
           if (turn) {
             scheduleUnattendedAnswer({ kind: "permission", tool: toolName }, {
+              context: { sessionId: psid, engine: engine.id },
               mode: () => turn.unattended,
               charge: () => turn.autoDecisions += 1,
               refund: () => {
@@ -75493,6 +76149,7 @@ function createAcpBackend(engine, send4, resolve16, onBrowserRequest, loadPlugin
           if (!turn)
             return;
           scheduleUnattendedAnswer({ kind: "elicitation", serverName: "connector" }, {
+            context: { sessionId: esid, engine: engine.id },
             mode: () => turn.unattended,
             charge: () => turn.autoDecisions += 1,
             refund: () => {
@@ -75780,11 +76437,11 @@ ${text9}`);
     await replayLoad(conn, sessionId);
   }
   async function promptForText(t, sid, prompt) {
-    const sink = [];
-    subagentSinks.set(sid, sink);
+    const sink2 = [];
+    subagentSinks.set(sid, sink2);
     try {
       for (let attempt = 0; attempt < RESEED_SUMMARY_ATTEMPTS; attempt++) {
-        sink.length = 0;
+        sink2.length = 0;
         let timer2;
         const timedOut = Symbol("timeout");
         const outcome = await Promise.race([
@@ -75807,7 +76464,7 @@ ${text9}`);
           }
           return null;
         }
-        const out = sink.join("").trim();
+        const out = sink2.join("").trim();
         if (out)
           return out;
         if (attempt < RESEED_SUMMARY_ATTEMPTS - 1)
@@ -75889,6 +76546,56 @@ ${text9}`);
     const all = await listSessionsFor(projectDir);
     return all.filter((row) => row.title.toLowerCase().includes(q) || (sessionBodies.get(row.id) ?? "").includes(q));
   }
+  const proactiveCompactedAt = /* @__PURE__ */ new Map();
+  const sessionRekey = /* @__PURE__ */ new Map();
+  const overflowTries = /* @__PURE__ */ new Map();
+  function contextUsageFor(sessionId) {
+    const model = sessionResolvedModel.get(sessionId) ?? sessionConfig.get(sessionId)?.currentModel;
+    const rep = sessionReported.get(sessionId);
+    const total = rep?.used ?? sessionUsage.get(sessionId)?.total;
+    const maxTokens = rep?.size ?? contextWindowFor(model) ?? void 0;
+    if (total === void 0 || !maxTokens)
+      return null;
+    return {
+      totalTokens: total,
+      maxTokens,
+      percentage: Math.min(100, Math.round(total / maxTokens * 1e3) / 10),
+      ...model ? { model } : {}
+    };
+  }
+  async function maybeCompactProactively(sid, params) {
+    try {
+      if (params.autoContinuation)
+        return;
+      if (!declared.contextCompaction)
+        return;
+      const live = sessionRekey.get(sid) ?? sid;
+      const usage2 = contextUsageFor(live);
+      const verdict = shouldCompactProactively({
+        mode: unattendedModeFor({ optedIn: params.unattended, origin: params.origin }),
+        pct: readDaemonAgentSettings().autoCompactPct,
+        usagePct: typeof usage2?.percentage === "number" ? usage2.percentage : null,
+        lastCompactPct: proactiveCompactedAt.get(live) ?? null,
+        inFlight: false
+      });
+      if (verdict === "reset") {
+        proactiveCompactedAt.delete(live);
+        return;
+      }
+      if (verdict !== "compact")
+        return;
+      proactiveCompactedAt.set(live, usage2?.percentage ?? 0);
+      console.warn(`[${LABEL2}] auto-compact: ${Math.round(usage2?.percentage ?? 0)}% of the window used \u2014 compacting`);
+      await sendMessage({ ...params, message: OVERFLOW_COMPACT_MESSAGE, sessionId: live, autoContinuation: true });
+      const now2 = sessionRekey.get(live) ?? live;
+      if (now2 !== live) {
+        proactiveCompactedAt.set(now2, proactiveCompactedAt.get(live) ?? 0);
+        proactiveCompactedAt.delete(live);
+      }
+    } catch (err2) {
+      console.warn(`[${LABEL2}] auto-compact failed:`, err2 instanceof Error ? err2.message : String(err2));
+    }
+  }
   async function sendMessage(params) {
     const origin = params.origin;
     const fail4 = (sessionId, error51, transient = false) => send4({ type: "chat:error", sessionId, clientRequestId: params.clientRequestId, error: error51, ...transient ? { transient: true } : {} }, origin);
@@ -76004,6 +76711,12 @@ ${text9}`);
       }
       sessionIndex.record({ id: next, cwd: params.projectDir, title, updatedAt: Date.now() });
       sessionIndex.forget(from);
+      sessionRekey.set(from, next);
+      const spentTries = overflowTries.get(from);
+      if (spentTries !== void 0) {
+        overflowTries.set(next, spentTries);
+        overflowTries.delete(from);
+      }
       send4({ type: "session:created", sessionId: next, clientRequestId: params.clientRequestId }, origin);
       send4({ type: "chat:complete", sessionId: next, clientRequestId: params.clientRequestId, messageId: randomUUID11(), result: "Compacted this conversation to free up context.", turnId: randomUUID11() }, origin);
       send4({ type: "agent:status", sessionId: next, clientRequestId: params.clientRequestId, status: "idle" }, origin);
@@ -76163,6 +76876,10 @@ ${text9}`);
           }
         }
       }
+      void maybeCompactProactively(sid, params);
+      if (!(params.autoContinuation === true && params.message === OVERFLOW_COMPACT_MESSAGE)) {
+        overflowTries.delete(sid);
+      }
       send4({ type: "chat:complete", sessionId: sid, clientRequestId: params.clientRequestId, messageId, result: finalText, turnId, ...res?.stopReason ? { stopReason: res.stopReason } : {} }, origin);
       send4({ type: "agent:status", sessionId: sid, clientRequestId: params.clientRequestId, status: "idle" }, origin);
     } catch (e) {
@@ -76170,6 +76887,19 @@ ${text9}`);
       const detail = String(e?.message ?? e);
       const overflow = isContextOverflow(detail);
       if (overflow && declared.contextCompaction) {
+        const recovered = await recoverFromContextOverflow({
+          mode: () => unattendedModeFor({ optedIn: params.unattended, origin: params.origin }),
+          canCompact: () => true,
+          tries: () => overflowTries.get(sid) ?? 0,
+          bump: () => overflowTries.set(sid, (overflowTries.get(sid) ?? 0) + 1),
+          context: { sessionId: sid, engine: engine.id },
+          compactAndResume: async () => {
+            await sendMessage({ ...params, message: OVERFLOW_COMPACT_MESSAGE, sessionId: sid, autoContinuation: true });
+            await sendMessage({ ...params, message: OVERFLOW_RESUME_MESSAGE, sessionId: sessionRekey.get(sid) ?? sid, autoContinuation: true });
+          }
+        });
+        if (recovered)
+          return;
         send4({ type: "chat:error", sessionId: sid, clientRequestId: params.clientRequestId, error: detail, continuable: true, continueReason: "context_window" }, origin);
         send4({ type: "agent:status", sessionId: sid, clientRequestId: params.clientRequestId, status: "idle" }, origin);
         return;
@@ -76443,21 +77173,7 @@ ${detail}` : detail, !overflow);
       }
     },
     ...declared.contextUsage ? {
-      getContextUsage: async (sessionId) => {
-        const model = sessionResolvedModel.get(sessionId) ?? sessionConfig.get(sessionId)?.currentModel;
-        const rep = sessionReported.get(sessionId);
-        const total = rep?.used ?? sessionUsage.get(sessionId)?.total;
-        const maxTokens = rep?.size ?? contextWindowFor(model) ?? void 0;
-        if (total === void 0 || !maxTokens)
-          return null;
-        const usage2 = {
-          totalTokens: total,
-          maxTokens,
-          percentage: Math.min(100, Math.round(total / maxTokens * 1e3) / 10),
-          ...model ? { model } : {}
-        };
-        return usage2;
-      }
+      getContextUsage: async (sessionId) => contextUsageFor(sessionId)
     } : {},
     ...declared.costTracking ? {
       getSessionCost: async (sessionId) => {
@@ -76889,7 +77605,7 @@ init_dist();
 init_credentials();
 import { spawn as spawn8 } from "node:child_process";
 import { randomUUID as randomUUID12 } from "node:crypto";
-import { mkdirSync as mkdirSync14, readFileSync as readFileSync21, writeFileSync as writeFileSync16 } from "node:fs";
+import { mkdirSync as mkdirSync15, readFileSync as readFileSync22, writeFileSync as writeFileSync16 } from "node:fs";
 import { join as join26 } from "node:path";
 init_daemon_settings();
 init_dist5();
@@ -77147,7 +77863,7 @@ function createCodexAppServerBackend(send4, resolve16, onBrowserRequest, loadPlu
   let hostedBearer = null;
   let refreshHostedTools = null;
   const lastTurnText = /* @__PURE__ */ new Map();
-  const verification = createHostedVerification();
+  const verification = createHostedVerification("codex");
   const scheduling = createHostedScheduling(async (task) => {
     try {
       await sendMessage({ message: task.prompt, url: "", projectDir: spawnedCwd ?? void 0, sessionId: task.sessionId, origin: "cron" });
@@ -77220,6 +77936,7 @@ function createCodexAppServerBackend(send4, resolve16, onBrowserRequest, loadPlu
       if (!turn)
         return;
       scheduleUnattendedAnswer({ kind: "permission", tool: toolName }, {
+        context: { sessionId: turn.threadId, engine: "codex" },
         mode: () => turn.unattended,
         charge: () => turn.autoDecisions += 1,
         refund: () => {
@@ -77253,6 +77970,7 @@ function createCodexAppServerBackend(send4, resolve16, onBrowserRequest, loadPlu
     if (!turn)
       return;
     scheduleUnattendedAnswer(prompt, {
+      context: { sessionId: turn.threadId, engine: "codex" },
       mode: () => turn.unattended,
       charge: () => turn.autoDecisions += 1,
       refund: () => {
@@ -77284,10 +78002,10 @@ function createCodexAppServerBackend(send4, resolve16, onBrowserRequest, loadPlu
   function onNotification(method, raw) {
     const p = raw ?? {};
     const threadId = String(p.threadId ?? "");
-    const sink = subagentSinks.get(threadId);
-    if (sink) {
+    const sink2 = subagentSinks.get(threadId);
+    if (sink2) {
       if (method === "item/agentMessage/delta")
-        sink.push(String(p.delta ?? ""));
+        sink2.push(String(p.delta ?? ""));
       if (method === "turn/completed" || method === "error")
         subagentDone.get(threadId)?.();
       return;
@@ -77425,7 +78143,7 @@ function createCodexAppServerBackend(send4, resolve16, onBrowserRequest, loadPlu
     lastWindow = window2;
     try {
       const dir2 = join26(daemonDir2(), "engine-config", "openai-codex");
-      mkdirSync14(dir2, { recursive: true });
+      mkdirSync15(dir2, { recursive: true });
       writeFileSync16(join26(dir2, "window"), String(window2), { mode: 384 });
     } catch {
     }
@@ -77434,7 +78152,7 @@ function createCodexAppServerBackend(send4, resolve16, onBrowserRequest, loadPlu
     if (lastWindow)
       return lastWindow;
     try {
-      const n = Number(readFileSync21(join26(daemonDir2(), "engine-config", "openai-codex", "window"), "utf8").trim());
+      const n = Number(readFileSync22(join26(daemonDir2(), "engine-config", "openai-codex", "window"), "utf8").trim());
       return Number.isFinite(n) && n > 0 ? lastWindow = n : void 0;
     } catch {
       return void 0;
@@ -77599,6 +78317,61 @@ function createCodexAppServerBackend(send4, resolve16, onBrowserRequest, loadPlu
     })();
     return initPromise;
   }
+  const proactiveCompactedAt = /* @__PURE__ */ new Map();
+  const overflowTries = /* @__PURE__ */ new Map();
+  function contextUsageFor(sessionId) {
+    const u = tokenUsage.get(sessionId);
+    if (!u?.window)
+      return null;
+    const current = u.lastTotal || u.total;
+    const usage2 = {
+      // `last`, NOT `total`. Measured: `total` is CUMULATIVE over the conversation and grows
+      // by exactly the previous turn's tokens (142,394 → 162,119 after a 19,725-token turn),
+      // so it can never fall. Reporting it as context usage meant the meter climbed past
+      // 100% of a 258k window on a conversation nowhere near full, never came down after a
+      // compaction, and — because this figure is what the proactive threshold reads — asked
+      // for compaction after compaction with the number refusing to move.
+      //
+      // `last.totalTokens` is the CURRENT context: the input the model actually saw on the
+      // most recent turn, which is what a window is measured against and what drops when a
+      // compaction succeeds.
+      // `|| u.total`, not `?? u.total`: the single writer stores `u.last?.totalTokens ?? 0`,
+      // so a missing `last` arrives here as 0 — which `??` passes straight through and the
+      // meter reads 0% on a full conversation. Under-reporting is the dangerous direction,
+      // because the proactive threshold then never fires and the context hits a hard
+      // overflow instead of compacting. Observed live: a `thread/tokenUsage/updated` whose
+      // `total` was all zeros while `last.totalTokens` was 4666, and the reverse.
+      totalTokens: current,
+      maxTokens: u.window,
+      percentage: Math.min(100, Math.round(current / u.window * 1e3) / 10)
+    };
+    return usage2;
+  }
+  async function maybeCompactProactively(threadId, params) {
+    try {
+      if (params.autoContinuation)
+        return;
+      const usage2 = contextUsageFor(threadId);
+      const verdict = shouldCompactProactively({
+        mode: unattendedModeFor({ optedIn: params.unattended, origin: params.origin }),
+        pct: readDaemonAgentSettings().autoCompactPct,
+        usagePct: typeof usage2?.percentage === "number" ? usage2.percentage : null,
+        lastCompactPct: proactiveCompactedAt.get(threadId) ?? null,
+        inFlight: false
+      });
+      if (verdict === "reset") {
+        proactiveCompactedAt.delete(threadId);
+        return;
+      }
+      if (verdict !== "compact")
+        return;
+      proactiveCompactedAt.set(threadId, usage2?.percentage ?? 0);
+      console.warn(`[${LABEL2}] auto-compact: ${Math.round(usage2?.percentage ?? 0)}% of the window used \u2014 compacting`);
+      await sendMessage({ ...params, message: OVERFLOW_COMPACT_MESSAGE, sessionId: threadId, autoContinuation: true });
+    } catch (err2) {
+      console.warn(`[${LABEL2}] auto-compact failed:`, err2 instanceof Error ? err2.message : String(err2));
+    }
+  }
   async function sendMessage(params) {
     const origin = params.origin;
     const cfg2 = resolve16(ENGINE_ID2);
@@ -77788,12 +78561,30 @@ function createCodexAppServerBackend(send4, resolve16, onBrowserRequest, loadPlu
           }
         });
       }
+      void maybeCompactProactively(threadId, params);
+      if (!(params.autoContinuation === true && params.message === OVERFLOW_COMPACT_MESSAGE)) {
+        overflowTries.delete(threadId);
+      }
       send4({ type: "chat:complete", sessionId: threadId, clientRequestId: params.clientRequestId, messageId, result: finalText, turnId, ...stopReason ? { stopReason } : {} }, origin);
       send4({ type: "agent:status", sessionId: threadId, clientRequestId: params.clientRequestId, status: "idle" }, origin);
     } catch (e) {
       turns.delete(threadId);
       const detail = String(e?.message ?? e);
       if (isContextOverflow(detail)) {
+        const recovered = await recoverFromContextOverflow({
+          mode: () => unattendedModeFor({ optedIn: params.unattended, origin: params.origin }),
+          canCompact: () => true,
+          // Codex maps '/compact' to thread/compact/start
+          tries: () => overflowTries.get(threadId) ?? 0,
+          bump: () => overflowTries.set(threadId, (overflowTries.get(threadId) ?? 0) + 1),
+          context: { sessionId: threadId, engine: "codex" },
+          compactAndResume: async () => {
+            await sendMessage({ ...params, message: OVERFLOW_COMPACT_MESSAGE, sessionId: threadId, autoContinuation: true });
+            await sendMessage({ ...params, message: OVERFLOW_RESUME_MESSAGE, sessionId: threadId, autoContinuation: true });
+          }
+        });
+        if (recovered)
+          return;
         send4({ type: "chat:error", sessionId: threadId, clientRequestId: params.clientRequestId, error: detail, continuable: true, continueReason: "context_window" }, origin);
         send4({ type: "agent:status", sessionId: threadId, clientRequestId: params.clientRequestId, status: "idle" }, origin);
         return;
@@ -78117,34 +78908,7 @@ ${text9}`;
       await transport.request("config/mcpServer/reload", {}).catch(() => {
       });
     },
-    getContextUsage: async (sessionId) => {
-      const u = tokenUsage.get(sessionId);
-      if (!u?.window)
-        return null;
-      const current = u.lastTotal || u.total;
-      const usage2 = {
-        // `last`, NOT `total`. Measured: `total` is CUMULATIVE over the conversation and grows
-        // by exactly the previous turn's tokens (142,394 → 162,119 after a 19,725-token turn),
-        // so it can never fall. Reporting it as context usage meant the meter climbed past
-        // 100% of a 258k window on a conversation nowhere near full, never came down after a
-        // compaction, and — because this figure is what the proactive threshold reads — asked
-        // for compaction after compaction with the number refusing to move.
-        //
-        // `last.totalTokens` is the CURRENT context: the input the model actually saw on the
-        // most recent turn, which is what a window is measured against and what drops when a
-        // compaction succeeds.
-        // `|| u.total`, not `?? u.total`: the single writer stores `u.last?.totalTokens ?? 0`,
-        // so a missing `last` arrives here as 0 — which `??` passes straight through and the
-        // meter reads 0% on a full conversation. Under-reporting is the dangerous direction,
-        // because the proactive threshold then never fires and the context hits a hard
-        // overflow instead of compacting. Observed live: a `thread/tokenUsage/updated` whose
-        // `total` was all zeros while `last.totalTokens` was 4666, and the reverse.
-        totalTokens: current,
-        maxTokens: u.window,
-        percentage: Math.min(100, Math.round(current / u.window * 1e3) / 10)
-      };
-      return usage2;
-    },
+    getContextUsage: async (sessionId) => contextUsageFor(sessionId),
     /** toolInjection, host half. Codex reads MCP servers from its config, so a change takes
      *  effect on the next install (the flag is reset so the write actually re-runs). */
     setInjectedMcpServers: (servers) => {
@@ -78445,7 +79209,7 @@ async function createBackend(engineId, send4, onBrowserRequest, resolver, loadPl
 // ../../packages/host-core/dist/session-recorder.js
 init_base_paths();
 import { join as join27 } from "node:path";
-import { mkdirSync as mkdirSync15, writeFileSync as writeFileSync17, appendFileSync as appendFileSync2, readdirSync as readdirSync4, rmSync as rmSync2, statSync as statSync7 } from "node:fs";
+import { mkdirSync as mkdirSync16, writeFileSync as writeFileSync17, appendFileSync as appendFileSync3, readdirSync as readdirSync4, rmSync as rmSync2, statSync as statSync8 } from "node:fs";
 init_dist5();
 var dir = null;
 var seq = 0;
@@ -78470,7 +79234,7 @@ function recordEvent(type, data = {}) {
   if (!dir)
     return;
   try {
-    appendFileSync2(join27(dir, "events.jsonl"), `${JSON.stringify({ ts: now(), seq: seq++, type, ...data })}
+    appendFileSync3(join27(dir, "events.jsonl"), `${JSON.stringify({ ts: now(), seq: seq++, type, ...data })}
 `);
   } catch {
   }
@@ -78481,8 +79245,8 @@ init_dist5();
 
 // ../../packages/host-core/dist/plugin-tools.js
 init_base_paths();
-import { existsSync as existsSync11, readdirSync as readdirSync5 } from "node:fs";
-import { join as join28, dirname as dirname10 } from "node:path";
+import { existsSync as existsSync12, readdirSync as readdirSync5 } from "node:fs";
+import { join as join28, dirname as dirname11 } from "node:path";
 
 // ../../packages/plugin-host/dist/index.js
 init_dist();
@@ -78816,7 +79580,7 @@ function convertTool(t) {
   };
 }
 function createOpenClawAdapter(pluginId, config2, secretResolver, registry3) {
-  const warned = /* @__PURE__ */ new Set();
+  const warned2 = /* @__PURE__ */ new Set();
   const impl = {
     pluginId,
     config: config2,
@@ -78887,8 +79651,8 @@ function createOpenClawAdapter(pluginId, config2, secretResolver, registry3) {
         return Reflect.get(target, prop, recv);
       if (typeof prop === "string") {
         return (..._args) => {
-          if (!warned.has(prop)) {
-            warned.add(prop);
+          if (!warned2.has(prop)) {
+            warned2.add(prop);
             registry3.diagnostics.push(`[${pluginId}] api.${prop}() is not supported by the Tesseract host \u2014 ignored`);
           }
         };
@@ -79000,7 +79764,7 @@ function buildDaemonPluginLoader(pluginsDir) {
   return async () => {
     const skillsPlugin = daemonSkillsPluginConfig();
     const snap = readDaemonAgentSettings();
-    const desktopRoots = (snap.pluginRoots ?? []).filter((r) => r?.dir && existsSync11(r.dir));
+    const desktopRoots = (snap.pluginRoots ?? []).filter((r) => r?.dir && existsSync12(r.dir));
     if (desktopRoots.length > 0) {
       const resDir = process.resourcesPath;
       for (const r of desktopRoots) {
@@ -79009,7 +79773,7 @@ function buildDaemonPluginLoader(pluginsDir) {
         if (resDir && r.dir.startsWith(resDir))
           continue;
         try {
-          writeOpenClawShim(r.dir.endsWith("node_modules") ? dirname10(r.dir) : r.dir);
+          writeOpenClawShim(r.dir.endsWith("node_modules") ? dirname11(r.dir) : r.dir);
         } catch {
         }
       }
@@ -79023,7 +79787,7 @@ function buildDaemonPluginLoader(pluginsDir) {
       return { ...rt2, skillsPlugin };
     }
     const scan = join28(pluginsDir, "node_modules");
-    if (!existsSync11(scan))
+    if (!existsSync12(scan))
       return { tools: [], hooks: [], messageHooks: [], commands: [], themeOps: [], engines: [], skillsPlugin };
     writeOpenClawShim(pluginsDir);
     const rt = await loadPluginRuntime({
@@ -79035,11 +79799,11 @@ function buildDaemonPluginLoader(pluginsDir) {
 }
 function daemonSkillsPluginConfig() {
   const root = readDaemonAgentSettings().skillsRoot ?? tessPath("extensions-skills");
-  if (!existsSync11(join28(root, ".claude-plugin", "plugin.json")))
+  if (!existsSync12(join28(root, ".claude-plugin", "plugin.json")))
     return null;
   const enabled = join28(root, "skills");
   try {
-    const hasSkill = readdirSync5(enabled).some((slug2) => existsSync11(join28(enabled, slug2, "SKILL.md")));
+    const hasSkill = readdirSync5(enabled).some((slug2) => existsSync12(join28(enabled, slug2, "SKILL.md")));
     return hasSkill ? { type: "local", path: root } : null;
   } catch {
     return null;
@@ -79241,10 +80005,10 @@ async function enableEditorMirror(browserId, onEvent) {
     });
     page.on("pageerror", (err2) => relay({ level: "error", kind: "console", message: err2.message }));
     page.on("requestfailed", (req) => {
-      const errText = req.failure()?.errorText ?? "request failed";
-      if (errText.includes("ERR_ABORTED"))
+      const errText2 = req.failure()?.errorText ?? "request failed";
+      if (errText2.includes("ERR_ABORTED"))
         return;
-      relay({ level: "error", kind: "network", message: `Failed to load ${req.url()} \u2014 ${errText}` });
+      relay({ level: "error", kind: "network", message: `Failed to load ${req.url()} \u2014 ${errText2}` });
     });
     page.on("close", () => editorErrorTaps.delete(browserId));
   }
@@ -79339,10 +80103,10 @@ import { join as join30 } from "node:path";
 
 // ../../packages/host-core/dist/gui/daemon-gui.js
 init_credentials();
-import { join as join29, dirname as dirname11 } from "node:path";
+import { join as join29, dirname as dirname12 } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 import { spawn as spawn9, spawnSync } from "node:child_process";
-import { existsSync as existsSync12 } from "node:fs";
+import { existsSync as existsSync13 } from "node:fs";
 
 // ../../packages/host-core/dist/gui/main-app-launch.js
 var LAUNCH_MARKERS = [
@@ -79578,14 +80342,14 @@ function daemonUiDir() {
     return resolvedUiDir;
   const ok = (d) => {
     try {
-      return existsSync12(join29(d, "preload.cjs"));
+      return existsSync13(join29(d, "preload.cjs"));
     } catch {
       return false;
     }
   };
   let here = null;
   try {
-    here = dirname11(fileURLToPath4(import.meta.url));
+    here = dirname12(fileURLToPath4(import.meta.url));
   } catch {
     here = null;
   }
@@ -79617,8 +80381,8 @@ function devAppPath() {
     return env;
   const daemonEntry = process.argv[1];
   if (daemonEntry) {
-    const cand = join29(dirname11(daemonEntry), "..", "..", "desktop");
-    if (existsSync12(join29(cand, "package.json")))
+    const cand = join29(dirname12(daemonEntry), "..", "..", "desktop");
+    if (existsSync13(join29(cand, "package.json")))
       return cand;
   }
   return null;
@@ -80001,7 +80765,7 @@ function widgetDisplayBounds(w) {
 }
 
 // ../../packages/host-core/dist/gui/ai-control.js
-import { join as join31, dirname as dirname12 } from "node:path";
+import { join as join31, dirname as dirname13 } from "node:path";
 import { randomUUID as randomUUID14 } from "node:crypto";
 init_dist5();
 init_credentials();
@@ -80081,7 +80845,7 @@ var MOONDREAM_URL = (process.env.CCB_MOONDREAM_URL?.trim() || "http://127.0.0.1:
 
 // ../../packages/host-core/dist/voice-control.js
 init_base_paths();
-import { existsSync as existsSync13, readFileSync as readFileSync22 } from "node:fs";
+import { existsSync as existsSync14, readFileSync as readFileSync23 } from "node:fs";
 import { basename as basename4, join as join32 } from "node:path";
 
 // ../../packages/voice-core/dist/providers/tool-adapters.js
@@ -81332,8 +82096,8 @@ function readGeminiKeyFile() {
   try {
     const home = tesseractHome();
     const f = join32(home, "daemon", "gemini.key");
-    if (existsSync13(f)) {
-      const k = readFileSync22(f, "utf-8").trim();
+    if (existsSync14(f)) {
+      const k = readFileSync23(f, "utf-8").trim();
       if (k)
         return k;
     }
@@ -81751,13 +82515,13 @@ ${priorText}` : "";
 };
 
 // ../../packages/host-core/dist/daemon-agent.js
-import { mkdirSync as mkdirSync21 } from "node:fs";
+import { mkdirSync as mkdirSync22 } from "node:fs";
 init_pool();
 
 // ../../packages/host-core/dist/image-gen-runner.js
 init_base_paths();
 import { randomUUID as randomUUID16 } from "node:crypto";
-import { mkdirSync as mkdirSync16, writeFileSync as writeFileSync18, readFileSync as readFileSync23 } from "node:fs";
+import { mkdirSync as mkdirSync17, writeFileSync as writeFileSync18, readFileSync as readFileSync24 } from "node:fs";
 import { join as join33 } from "node:path";
 
 // ../../packages/image-edit-core/dist/transparent.js
@@ -82246,7 +83010,7 @@ function createDaemonImageGenRunner() {
       let inputMime;
       if (req.sourceImagePath) {
         try {
-          inputImageB64 = readFileSync23(req.sourceImagePath).toString("base64");
+          inputImageB64 = readFileSync24(req.sourceImagePath).toString("base64");
           const lower = req.sourceImagePath.toLowerCase();
           inputMime = lower.endsWith(".jpg") || lower.endsWith(".jpeg") ? "image/jpeg" : lower.endsWith(".webp") ? "image/webp" : "image/png";
         } catch (e) {
@@ -82267,7 +83031,7 @@ function createDaemonImageGenRunner() {
         if (!images.length)
           return { ok: false, error: "The provider returned no image." };
         const dir2 = req.outDir ?? join33(generatedImagesDir(), randomUUID16());
-        mkdirSync16(dir2, { recursive: true });
+        mkdirSync17(dir2, { recursive: true });
         const files = images.map((img, i) => {
           const ext = img.mime.split("/")[1]?.split("+")[0] || "png";
           const path6 = join33(dir2, `${i + 1}.${ext}`);
@@ -82287,7 +83051,7 @@ function createDaemonImageGenRunner() {
 init_serpapi_runner();
 
 // ../../packages/host-core/dist/video-gen-runner.js
-import { readFileSync as readFileSync25 } from "node:fs";
+import { readFileSync as readFileSync26 } from "node:fs";
 
 // ../../packages/video-core/dist/cost.js
 var VEO_RATES = [
@@ -83687,9 +84451,9 @@ init_daemon_settings();
 
 // ../../packages/host-core/dist/video-jobs.js
 init_base_paths();
-import { mkdirSync as mkdirSync17, readdirSync as readdirSync6, readFileSync as readFileSync24, writeFileSync as writeFileSync19, rmSync as rmSync3 } from "node:fs";
+import { mkdirSync as mkdirSync18, readdirSync as readdirSync6, readFileSync as readFileSync25, writeFileSync as writeFileSync19, rmSync as rmSync3 } from "node:fs";
 import { mkdir as mkdir6, writeFile as writeFile7 } from "node:fs/promises";
-import { dirname as dirname13, join as join34 } from "node:path";
+import { dirname as dirname14, join as join34 } from "node:path";
 import { randomUUID as randomUUID17 } from "node:crypto";
 function mediaJobsDir() {
   const home = tesseractHome();
@@ -83738,7 +84502,7 @@ var VideoJobRegistry = class {
     if (mem)
       return { ...mem };
     try {
-      const raw = readFileSync24(join34(mediaJobsDir(), `${jobId}.json`), "utf-8");
+      const raw = readFileSync25(join34(mediaJobsDir(), `${jobId}.json`), "utf-8");
       return JSON.parse(raw);
     } catch {
       return null;
@@ -83790,7 +84554,7 @@ var VideoJobRegistry = class {
     for (const f of files) {
       const fp = join34(mediaJobsDir(), f);
       try {
-        const job = JSON.parse(readFileSync24(fp, "utf-8"));
+        const job = JSON.parse(readFileSync25(fp, "utf-8"));
         if (TERMINAL.has(job.state)) {
           if (now2 - (job.updatedAt ?? job.createdAt ?? now2) > DISK_RETENTION_MS)
             rmSync3(fp, { force: true });
@@ -83874,7 +84638,7 @@ var VideoJobRegistry = class {
     this.materializing.add(job.id);
     try {
       const res = await provider.fetchResult({ providerId: job.providerId, model: job.model, operationName: job.operationName });
-      await mkdir6(dirname13(job.outPath), { recursive: true });
+      await mkdir6(dirname14(job.outPath), { recursive: true });
       await writeFile7(job.outPath, res.bytes);
       this.update(job, { state: "succeeded", mime: res.mime, progressPct: 100 });
     } catch (e) {
@@ -83910,7 +84674,7 @@ var VideoJobRegistry = class {
   persist(job) {
     this.jobs.set(job.id, job);
     try {
-      mkdirSync17(mediaJobsDir(), { recursive: true });
+      mkdirSync18(mediaJobsDir(), { recursive: true });
       writeFileSync19(join34(mediaJobsDir(), `${job.id}.json`), JSON.stringify(job, null, 2));
     } catch {
     }
@@ -83955,7 +84719,7 @@ function buildProvider(id, pc, model) {
 function readFrame(path6) {
   const lower = path6.toLowerCase();
   const mime = lower.endsWith(".jpg") || lower.endsWith(".jpeg") ? "image/jpeg" : lower.endsWith(".webp") ? "image/webp" : "image/png";
-  return { bytes: new Uint8Array(readFileSync25(path6)), mime };
+  return { bytes: new Uint8Array(readFileSync26(path6)), mime };
 }
 function providerForJob(providerId, model) {
   const c = creds2();
@@ -84063,7 +84827,7 @@ function createDaemonVideoGenRunner() {
 
 // ../../packages/host-core/dist/video-edit-runner.js
 init_base_paths();
-import { existsSync as existsSync16, readFileSync as readFileSync30 } from "node:fs";
+import { existsSync as existsSync17, readFileSync as readFileSync31 } from "node:fs";
 import { mkdir as mkdir7, writeFile as writeFile8 } from "node:fs/promises";
 import { join as join38, basename as basename6 } from "node:path";
 import { randomUUID as randomUUID19 } from "node:crypto";
@@ -84072,12 +84836,12 @@ init_daemon_settings();
 // ../../packages/host-core/dist/video-edit.js
 init_base_paths();
 import { spawn as spawn11 } from "node:child_process";
-import { mkdirSync as mkdirSync18, readFileSync as readFileSync26, rmSync as rmSync4, writeFileSync as writeFileSync20 } from "node:fs";
+import { mkdirSync as mkdirSync19, readFileSync as readFileSync27, rmSync as rmSync4, writeFileSync as writeFileSync20 } from "node:fs";
 import { join as join35, isAbsolute as isAbsolute5 } from "node:path";
 import { randomUUID as randomUUID18 } from "node:crypto";
 
 // ../../packages/host-core/dist/ffmpeg.js
-import { existsSync as existsSync14 } from "node:fs";
+import { existsSync as existsSync15 } from "node:fs";
 import { spawnSync as spawnSync2 } from "node:child_process";
 import { sep as sep5 } from "node:path";
 import { createRequire as createRequire3 } from "node:module";
@@ -84090,7 +84854,7 @@ function fromPackage(name) {
     if (typeof raw !== "string")
       return null;
     const p = unpacked(raw);
-    return existsSync14(p) ? p : null;
+    return existsSync15(p) ? p : null;
   } catch {
     return null;
   }
@@ -84106,7 +84870,7 @@ function fromPath(cmd) {
 function resolveBinary(envVar, pkg, cmd, hint) {
   const env = process.env[envVar]?.trim();
   if (env) {
-    if (existsSync14(env) || fromPath(env))
+    if (existsSync15(env) || fromPath(env))
       return env;
     throw new Error(`${envVar}=${env} does not exist or is not executable.`);
   }
@@ -84148,14 +84912,14 @@ var mediaCwd;
 function mediaSpawnCwd() {
   if (!mediaCwd) {
     mediaCwd = tessPath("media-work");
-    mkdirSync18(mediaCwd, { recursive: true });
+    mkdirSync19(mediaCwd, { recursive: true });
   }
   return mediaCwd;
 }
 var workDir = () => {
   const home = tesseractHome();
   const dir2 = join35(home, "media-work", randomUUID18());
-  mkdirSync18(dir2, { recursive: true });
+  mkdirSync19(dir2, { recursive: true });
   return dir2;
 };
 var MIME_BY_EXT = {
@@ -84244,7 +85008,7 @@ async function renderEdl(edl, opts) {
     }
   }
   const dir2 = opts.outDir ?? workDir();
-  mkdirSync18(dir2, { recursive: true });
+  mkdirSync19(dir2, { recursive: true });
   const format = edl.output?.format ?? "mp4";
   const outPath = join35(dir2, `edit.${format}`);
   let assFile;
@@ -84318,7 +85082,7 @@ async function enhanceVideo(path6, spec, opts) {
     throw new Error("Nothing to enhance \u2014 request at least one of: upscale, denoise, deblock, deband, sharpen, or interpolate.");
   }
   const dir2 = opts?.outDir ?? workDir();
-  mkdirSync18(dir2, { recursive: true });
+  mkdirSync19(dir2, { recursive: true });
   const outPath = join35(dir2, "enhanced.mp4");
   const audioArgs = probe.hasAudio ? ["-c:a", "copy"] : ["-an"];
   const args = [
@@ -84396,7 +85160,7 @@ ${stderrTail}`));
 async function extractFrames(path6, timestamps, outDir) {
   path6 = requireAbsolutePath(path6, "path");
   const dir2 = outDir ?? workDir();
-  mkdirSync18(dir2, { recursive: true });
+  mkdirSync19(dir2, { recursive: true });
   const out = [];
   for (const [i, ts] of timestamps.slice(0, 20).entries()) {
     const file2 = join35(dir2, `frame-${i + 1}-${Math.round(ts * 1e3)}ms.jpg`);
@@ -84431,7 +85195,7 @@ async function detectSilence(path6, opts) {
 async function extractAudio(path6, format, outDir, opts) {
   path6 = requireAbsolutePath(path6, "path");
   const dir2 = outDir ?? workDir();
-  mkdirSync18(dir2, { recursive: true });
+  mkdirSync19(dir2, { recursive: true });
   const out = join35(dir2, `audio.${format}`);
   const codec2 = format === "mp3" ? ["-c:a", "libmp3lame", "-q:a", "2"] : format === "wav" ? ["-c:a", "pcm_s16le"] : ["-c:a", "aac", "-b:a", "192k"];
   const gain = opts?.gainDb ? ["-af", `volume=${opts.gainDb}dB`] : [];
@@ -84447,7 +85211,7 @@ async function isolateSpeakerAudio(path6, windows2, outDir) {
   const merged = mergeWindows(windows2).slice(0, 200);
   const enable = merged.map((w) => `between(t,${w.startSec},${w.endSec})`).join("+");
   const dir2 = outDir ?? workDir();
-  mkdirSync18(dir2, { recursive: true });
+  mkdirSync19(dir2, { recursive: true });
   const out = join35(dir2, "speaker.m4a");
   const r = await run2(resolveFfmpeg(), ["-y", "-i", path6, "-vn", "-af", `volume=enable='1-min(1,${enable})':volume=0`, "-c:a", "aac", "-b:a", "192k", out], {
     timeoutMs: LONG_TIMEOUT_MS
@@ -84501,19 +85265,19 @@ function cleanupDir(dir2) {
   }
 }
 function readChunkBase64(path6) {
-  return readFileSync26(path6).toString("base64");
+  return readFileSync27(path6).toString("base64");
 }
 
 // ../../packages/host-core/dist/video-upscale.js
 init_base_paths();
 import { spawn as spawn12 } from "node:child_process";
-import { existsSync as existsSync15, mkdirSync as mkdirSync19, readFileSync as readFileSync27, readdirSync as readdirSync7 } from "node:fs";
-import { join as join36, dirname as dirname14 } from "node:path";
+import { existsSync as existsSync16, mkdirSync as mkdirSync20, readFileSync as readFileSync28, readdirSync as readdirSync7 } from "node:fs";
+import { join as join36, dirname as dirname15 } from "node:path";
 var upscaleCwd;
 function upscaleSpawnCwd() {
   if (!upscaleCwd) {
     upscaleCwd = tessPath("media-work");
-    mkdirSync19(upscaleCwd, { recursive: true });
+    mkdirSync20(upscaleCwd, { recursive: true });
   }
   return upscaleCwd;
 }
@@ -84525,12 +85289,12 @@ function resolveRealesrgan() {
     envBin,
     // Packaged app: extraResources → Resources/vendor/realesrgan/<plat>/…
     process.resourcesPath ? join36(process.resourcesPath, "vendor", "realesrgan", platDir, exe) : void 0
-  ].filter((p) => !!p && existsSync15(p));
+  ].filter((p) => !!p && existsSync16(p));
   const bin = candidates[0] ?? fromPath2("realesrgan-ncnn-vulkan");
   if (!bin)
     return null;
-  const models = process.env.TESSERACT_REALESRGAN_MODELS?.trim() || join36(dirname14(bin), "models");
-  return existsSync15(models) ? { bin, models } : null;
+  const models = process.env.TESSERACT_REALESRGAN_MODELS?.trim() || join36(dirname15(bin), "models");
+  return existsSync16(models) ? { bin, models } : null;
 }
 function fromPath2(cmd) {
   try {
@@ -84552,8 +85316,8 @@ function installedRealesrModels() {
     return [];
   return REALESRGAN_MODELS.filter((m) => {
     if (m.scales.length > 1)
-      return m.scales.some((s) => existsSync15(join36(re.models, `${m.id}-x${s}.bin`)));
-    return existsSync15(join36(re.models, `${m.id}.bin`));
+      return m.scales.some((s) => existsSync16(join36(re.models, `${m.id}-x${s}.bin`)));
+    return existsSync16(join36(re.models, `${m.id}.bin`));
   }).map((m) => m.id);
 }
 function upscaleAdvert() {
@@ -84574,7 +85338,7 @@ async function realesrganGpuWorks() {
     const dir2 = workDir();
     const inP = join36(dir2, "p.png"), outP = join36(dir2, "p2.png");
     const gen = await run2(resolveFfmpeg(), ["-y", "-f", "lavfi", "-i", "testsrc=size=64x64:duration=1", "-frames:v", "1", inP], { timeoutMs: 15e3 });
-    if (!gen.ok || !existsSync15(inP)) {
+    if (!gen.ok || !existsSync16(inP)) {
       gpuProbe = false;
       return false;
     }
@@ -84593,7 +85357,7 @@ async function realesrganGpuWorks() {
         code === 0 ? resolve16() : reject(new Error(`exit ${code}`));
       });
     });
-    gpuProbe = existsSync15(outP);
+    gpuProbe = existsSync16(outP);
   } catch {
     gpuProbe = false;
   }
@@ -84612,8 +85376,8 @@ async function upscaleCapabilities(opts) {
 function resolveFalKey() {
   const home = tesseractHome();
   const file2 = join36(home, "daemon", "fal.key");
-  if (existsSync15(file2)) {
-    const k = readFileSync27(file2, "utf-8").trim();
+  if (existsSync16(file2)) {
+    const k = readFileSync28(file2, "utf-8").trim();
     if (k)
       return k;
   }
@@ -84660,8 +85424,8 @@ async function realesrganUpscale(path6, opts) {
   const scale = opts.scale ?? 2;
   const dir2 = opts.outDir ?? workDir();
   const fin = join36(dir2, "in"), fup = join36(dir2, "up");
-  mkdirSync19(fin, { recursive: true });
-  mkdirSync19(fup, { recursive: true });
+  mkdirSync20(fin, { recursive: true });
+  mkdirSync20(fup, { recursive: true });
   const fps = p.fps ?? 30;
   const src = path6;
   let extractSrc = src;
@@ -84728,7 +85492,7 @@ async function falTopazEnhance(path6, spec, opts) {
   path6 = requireAbsolutePath(path6, "path");
   const p = await probeMedia(path6);
   opts.onProgress?.(3, "Uploading to fal\u2026");
-  const bytes2 = readFileSync27(path6);
+  const bytes2 = readFileSync28(path6);
   const videoUrl = await falUploadVideo(new Uint8Array(bytes2), "video/mp4", { apiKey: opts.apiKey });
   opts.onProgress?.(12, "Submitting Topaz job\u2026");
   const sub = await falTopazSubmit({ ...spec, videoUrl }, { apiKey: opts.apiKey });
@@ -84755,7 +85519,7 @@ async function falTopazEnhance(path6, spec, opts) {
   if (!dl.ok)
     throw new Error(`Downloading the fal result failed (HTTP ${dl.status}).`);
   const dir2 = opts.outDir ?? workDir();
-  mkdirSync19(dir2, { recursive: true });
+  mkdirSync20(dir2, { recursive: true });
   const outPath = join36(dir2, "enhanced.mp4");
   const { writeFileSync: writeFileSync43 } = await import("node:fs");
   writeFileSync43(outPath, Buffer.from(await dl.arrayBuffer()));
@@ -84801,7 +85565,7 @@ async function smartEnhance(path6, args) {
 }
 
 // ../../packages/host-core/dist/video-effects.js
-import { readFileSync as readFileSync28, mkdirSync as mkdirSync20, writeFileSync as writeFileSync21 } from "node:fs";
+import { readFileSync as readFileSync29, mkdirSync as mkdirSync21, writeFileSync as writeFileSync21 } from "node:fs";
 import { join as join37, basename as basename5, extname } from "node:path";
 init_daemon_settings();
 var IMG_MIME = { jpg: "image/jpeg", jpeg: "image/jpeg", png: "image/png", webp: "image/webp", heic: "image/heic" };
@@ -84840,11 +85604,11 @@ async function applyEffect(effectId, inputs, opts) {
   const imageUrls = [];
   for (const p of imgs.slice(0, needImgs || imgs.length)) {
     const ext2 = extname(p).slice(1).toLowerCase();
-    imageUrls.push(await falUploadVideo(new Uint8Array(readFileSync28(p)), IMG_MIME[ext2] ?? "image/jpeg", { apiKey: key2, fileName: basename5(p) }));
+    imageUrls.push(await falUploadVideo(new Uint8Array(readFileSync29(p)), IMG_MIME[ext2] ?? "image/jpeg", { apiKey: key2, fileName: basename5(p) }));
   }
   let videoUrl;
   if (inputs.videoPath)
-    videoUrl = await falUploadVideo(new Uint8Array(readFileSync28(inputs.videoPath)), "video/mp4", { apiKey: key2, fileName: basename5(inputs.videoPath) });
+    videoUrl = await falUploadVideo(new Uint8Array(readFileSync29(inputs.videoPath)), "video/mp4", { apiKey: key2, fileName: basename5(inputs.videoPath) });
   const body = { ...def.params };
   const usesImageArray = def.modelPath.includes("/vidu/") || def.modelPath.includes("/kling-video/") || def.modelPath.includes("nano-banana");
   const arrayKey = def.modelPath.includes("nano-banana") ? "image_urls" : "input_image_urls";
@@ -84888,7 +85652,7 @@ async function applyEffect(effectId, inputs, opts) {
   if (!dl.ok)
     throw new Error(`Downloading the result failed (HTTP ${dl.status}).`);
   const dir2 = opts?.outDir ?? workDir();
-  mkdirSync20(dir2, { recursive: true });
+  mkdirSync21(dir2, { recursive: true });
   const ext = media.isVideo ? "mp4" : extname(new URL(media.url).pathname).slice(1) || "png";
   const outPath = join37(dir2, `${effectId}.${ext}`);
   writeFileSync21(outPath, Buffer.from(await dl.arrayBuffer()));
@@ -84913,9 +85677,9 @@ async function applyGeminiImageEffect(def, inputs, opts) {
 ${inputs.prompt}` : "");
   opts?.onProgress?.(10, `Generating ${def.label}\u2026`);
   const provider = createImageEditProvider("google", { apiKey: key2, model: def.modelPath });
-  const out = await runImageEdit(provider, { op: "prompt", imageB64: readFileSync28(imgPath).toString("base64"), mime: IMG_MIME[ext] ?? "image/jpeg", prompt });
+  const out = await runImageEdit(provider, { op: "prompt", imageB64: readFileSync29(imgPath).toString("base64"), mime: IMG_MIME[ext] ?? "image/jpeg", prompt });
   const dir2 = opts?.outDir ?? workDir();
-  mkdirSync20(dir2, { recursive: true });
+  mkdirSync21(dir2, { recursive: true });
   const outPath = join37(dir2, `${def.id}.png`);
   writeFileSync21(outPath, Buffer.from(out.bytes));
   opts?.onProgress?.(100, "Done");
@@ -85035,13 +85799,13 @@ ${compact2}`;
 }
 
 // ../../packages/host-core/dist/video-vision.js
-import { readFileSync as readFileSync29 } from "node:fs";
+import { readFileSync as readFileSync30 } from "node:fs";
 var BASE_URL3 = "https://generativelanguage.googleapis.com/v1beta";
 var MODEL = "gemini-3.5-flash";
 var TIMEOUT_MS = 6e4;
 async function reviewFrameGemini(framePath, intent, apiKey) {
   try {
-    const b642 = readFileSync29(framePath).toString("base64");
+    const b642 = readFileSync30(framePath).toString("base64");
     const prompt = `This is a frame from an AI-generated video clip meant to show: "${intent}". Judge ONLY for obvious defects: melted/warped faces or hands, garbled text, broken anatomy, severe artifacts. Reply with STRICT JSON: {"acceptable": <true|false>, "note": "<\u226412 words, only if not acceptable>"}.`;
     const res = await fetch(`${BASE_URL3}/models/${MODEL}:generateContent`, {
       method: "POST",
@@ -85088,8 +85852,8 @@ function readDaemonKeyFile(name) {
   try {
     const home = tesseractHome();
     const f = join38(home, "daemon", name);
-    if (existsSync16(f)) {
-      const k = readFileSync30(f, "utf-8").trim();
+    if (existsSync17(f)) {
+      const k = readFileSync31(f, "utf-8").trim();
       if (k)
         return k;
     }
@@ -85248,7 +86012,7 @@ function createDaemonVideoEditRunner() {
       if (!apiKey)
         return { ok: false, error: "Voice cloning needs an ElevenLabs key (Settings \u2192 Voice)." };
       try {
-        const samples = sampleAudioPaths.slice(0, 25).map((p) => requireAbsolutePath(p, "sample audio path")).map((p) => ({ bytes: new Uint8Array(readFileSync30(p)), mime: audioMimeForPath(p), filename: basename6(p) }));
+        const samples = sampleAudioPaths.slice(0, 25).map((p) => requireAbsolutePath(p, "sample audio path")).map((p) => ({ bytes: new Uint8Array(readFileSync31(p)), mime: audioMimeForPath(p), filename: basename6(p) }));
         const v = await cloneVoiceElevenLabs(name, samples, { apiKey, description });
         return { ok: true, voiceId: v.voiceId, name: v.name };
       } catch (e) {
@@ -85344,7 +86108,7 @@ function createDaemonVideoEditRunner() {
 
 // ../../packages/host-core/dist/support-submit.js
 init_credentials();
-import { openSync as openSync4, fstatSync, readSync as readSync3, closeSync as closeSync4 } from "node:fs";
+import { openSync as openSync5, fstatSync, readSync as readSync4, closeSync as closeSync5 } from "node:fs";
 import { join as join39 } from "node:path";
 
 // ../../packages/host-core/dist/host-metrics.js
@@ -85384,19 +86148,19 @@ var LOG_TAIL_BYTES = 64 * 1024;
 function tail2(path6, bytes2 = LOG_TAIL_BYTES) {
   let fd = null;
   try {
-    fd = openSync4(path6, "r");
+    fd = openSync5(path6, "r");
     const size = fstatSync(fd).size;
     const len = Math.min(size, bytes2);
     const start3 = Math.max(0, size - len);
     const buf = Buffer.alloc(len);
-    readSync3(fd, buf, 0, len, start3);
+    readSync4(fd, buf, 0, len, start3);
     return buf.toString("utf8");
   } catch {
     return "";
   } finally {
     if (fd !== null) {
       try {
-        closeSync4(fd);
+        closeSync5(fd);
       } catch {
       }
     }
@@ -86291,9 +87055,9 @@ async function replayTurn(turn) {
     } catch {
     }
     for (const msg of terminal) {
-      for (const sink of [...sinks]) {
+      for (const sink2 of [...sinks]) {
         try {
-          sink(msg, turn.params.origin);
+          sink2(msg, turn.params.origin);
         } catch {
         }
       }
@@ -86333,10 +87097,10 @@ function drainBrowserEvents(params) {
   return events;
 }
 setBrowserExtensionProbe(() => extensionBrowserConn != null);
-function registerAgentSink(sink) {
-  sinks.add(sink);
+function registerAgentSink(sink2) {
+  sinks.add(sink2);
   return () => {
-    sinks.delete(sink);
+    sinks.delete(sink2);
   };
 }
 function emitAgentEvent(msg, origin) {
@@ -86587,7 +87351,7 @@ function refreshDaemonScheduling(b) {
 function daemonWorkspaceDir() {
   const dir2 = tessPath("workspace");
   try {
-    mkdirSync21(dir2, { recursive: true });
+    mkdirSync22(dir2, { recursive: true });
   } catch {
   }
   return dir2;
@@ -86619,9 +87383,9 @@ function voiceUnavailableFrames(err2, reason) {
 
 // ../../packages/host-core/dist/fs-remote.js
 import { readdir as readdir4, readFile as readFile10, writeFile as writeFile9, mkdir as mkdir8, cp, rm as rm2, rename as renameAsync, stat as stat3 } from "node:fs/promises";
-import { openSync as openSync5, readSync as readSync4, writeSync, closeSync as closeSync5, statSync as statSync8, existsSync as existsSync17, mkdtempSync, rmSync as rmSync5, readFileSync as readFileSync31, readdirSync as readdirSync8, watch, realpathSync as realpathSync4, constants as fsConstants } from "node:fs";
+import { openSync as openSync6, readSync as readSync5, writeSync, closeSync as closeSync6, statSync as statSync9, existsSync as existsSync18, mkdtempSync, rmSync as rmSync5, readFileSync as readFileSync32, readdirSync as readdirSync8, watch, realpathSync as realpathSync4, constants as fsConstants } from "node:fs";
 import { tmpdir as tmpdir5 } from "node:os";
-import { basename as basename7, dirname as dirname15, join as join42, relative as relative5, resolve as resolve8, sep as sep6, isAbsolute as isAbsolute6 } from "node:path";
+import { basename as basename7, dirname as dirname16, join as join42, relative as relative5, resolve as resolve8, sep as sep6, isAbsolute as isAbsolute6 } from "node:path";
 import { execFile as execFile5 } from "node:child_process";
 import { promisify as promisify2 } from "node:util";
 
@@ -86673,12 +87437,12 @@ async function dirStats(root, opts) {
 }
 async function codeStats(root) {
   const start3 = Date.now();
-  const MAX_FILES = 25e3, MAX_BYTES2 = 256 * 1024 * 1024, TIME_MS = 12e3;
+  const MAX_FILES = 25e3, MAX_BYTES3 = 256 * 1024 * 1024, TIME_MS = 12e3;
   const byLang = /* @__PURE__ */ new Map();
   let totalFiles = 0, totalLines = 0, bytes2 = 0, truncated = false;
   const stack = [root];
   while (stack.length) {
-    if (totalFiles >= MAX_FILES || bytes2 >= MAX_BYTES2 || Date.now() - start3 > TIME_MS) {
+    if (totalFiles >= MAX_FILES || bytes2 >= MAX_BYTES3 || Date.now() - start3 > TIME_MS) {
       truncated = true;
       break;
     }
@@ -86690,7 +87454,7 @@ async function codeStats(root) {
       continue;
     }
     for (const e of ents) {
-      if (totalFiles >= MAX_FILES || bytes2 >= MAX_BYTES2 || Date.now() - start3 > TIME_MS) {
+      if (totalFiles >= MAX_FILES || bytes2 >= MAX_BYTES3 || Date.now() - start3 > TIME_MS) {
         truncated = true;
         break;
       }
@@ -86921,14 +87685,14 @@ function resolveParent(raw, root) {
 }
 function resolveUniqueName(dir2, name) {
   const direct = join42(dir2, name);
-  if (!existsSync17(direct))
+  if (!existsSync18(direct))
     return direct;
   const dot = name.lastIndexOf(".");
   const base = dot > 0 ? name.slice(0, dot) : name;
   const ext = dot > 0 ? name.slice(dot) : "";
   for (let i = 2; i < 1e4; i++) {
     const candidate = join42(dir2, `${base} ${i}${ext}`);
-    if (!existsSync17(candidate))
+    if (!existsSync18(candidate))
       return candidate;
   }
   return direct;
@@ -86962,7 +87726,7 @@ async function readRemoteBytes(root, path6) {
   if (!real)
     return { error: "Path is outside the shared root." };
   try {
-    const s = statSync8(real);
+    const s = statSync9(real);
     if (!s.isFile())
       return { error: "Not a file" };
     if (s.size > REMOTE_READ_CAP)
@@ -86974,7 +87738,7 @@ async function readRemoteBytes(root, path6) {
 }
 var trashSeq = 0;
 function statId(real) {
-  const s = statSync8(real, { bigint: true });
+  const s = statSync9(real, { bigint: true });
   return {
     size: Number(s.size),
     mtimeMs: Number(s.mtimeMs),
@@ -87005,7 +87769,7 @@ async function renderThumbnailImpl(real, maxPx) {
     const produced = readdirSync8(dir2).find((f) => f.toLowerCase().endsWith(".png"));
     if (!produced)
       return { error: "No thumbnail available." };
-    return { png: readFileSync31(join42(dir2, produced)).toString("base64") };
+    return { png: readFileSync32(join42(dir2, produced)).toString("base64") };
   } catch (err2) {
     return { error: String(err2.message) };
   } finally {
@@ -87046,7 +87810,7 @@ var SAFE_SEG = /^[A-Za-z0-9._-]+$/;
 var TRASH_RETENTION_MS = 14 * 24 * 60 * 60 * 1e3;
 function pruneTrash(root) {
   const trashDir = join42(root, TRASH_DIR);
-  if (!existsSync17(trashDir))
+  if (!existsSync18(trashDir))
     return;
   const cutoff = Date.now() - TRASH_RETENTION_MS;
   try {
@@ -87054,7 +87818,7 @@ function pruneTrash(root) {
       if (!e.isDirectory())
         continue;
       try {
-        const meta4 = JSON.parse(readFileSync31(join42(trashDir, e.name, ".fp-meta.json"), "utf-8"));
+        const meta4 = JSON.parse(readFileSync32(join42(trashDir, e.name, ".fp-meta.json"), "utf-8"));
         if ((meta4.deletedAt ?? 0) < cutoff)
           rmSync5(join42(trashDir, e.name), { recursive: true, force: true });
       } catch {
@@ -87121,7 +87885,7 @@ async function runRemoteFsOp(root, op, args, quotaKey) {
       if (BINARY_EXT.has(ext))
         return { error: "Binary file \u2014 not shown in the editor." };
       try {
-        const s = statSync8(real);
+        const s = statSync9(real);
         if (s.size > TEXT_SIZE_LIMIT)
           return { error: "File too large for text view." };
         return { content: await readFile10(real, "utf-8") };
@@ -87136,7 +87900,7 @@ async function runRemoteFsOp(root, op, args, quotaKey) {
       if (!real)
         return OUTSIDE("write");
       try {
-        await mkdir8(dirname15(real), { recursive: true });
+        await mkdir8(dirname16(real), { recursive: true });
         await writeFile9(real, content, "utf-8");
         return { ok: true };
       } catch (err2) {
@@ -87150,7 +87914,7 @@ async function runRemoteFsOp(root, op, args, quotaKey) {
       if (!real)
         return OUTSIDE("write");
       try {
-        await mkdir8(dirname15(real), { recursive: true });
+        await mkdir8(dirname16(real), { recursive: true });
         await writeFile9(real, Buffer.from(base643, "base64"));
         return { ok: true };
       } catch (err2) {
@@ -87167,10 +87931,10 @@ async function runRemoteFsOp(root, op, args, quotaKey) {
       let fd = null;
       try {
         if (off === 0) {
-          await mkdir8(dirname15(real), { recursive: true });
-          fd = openSync5(real, "w");
+          await mkdir8(dirname16(real), { recursive: true });
+          fd = openSync6(real, "w");
         } else
-          fd = openSync5(real, "r+");
+          fd = openSync6(real, "r+");
         if (buf.length > 0)
           writeSync(fd, buf, 0, buf.length, off);
         return { ok: true, bytesWritten: buf.length };
@@ -87179,7 +87943,7 @@ async function runRemoteFsOp(root, op, args, quotaKey) {
       } finally {
         if (fd != null)
           try {
-            closeSync5(fd);
+            closeSync6(fd);
           } catch {
           }
       }
@@ -87221,16 +87985,16 @@ async function runRemoteFsOp(root, op, args, quotaKey) {
         return { base64: "", bytesRead: 0 };
       let fd = null;
       try {
-        fd = openSync5(real, "r");
+        fd = openSync6(real, "r");
         const buf = Buffer.alloc(len);
-        const bytesRead = readSync4(fd, buf, 0, len, off);
+        const bytesRead = readSync5(fd, buf, 0, len, off);
         return { base64: buf.subarray(0, bytesRead).toString("base64"), bytesRead };
       } catch (err2) {
         return { error: String(err2.message) };
       } finally {
         if (fd != null)
           try {
-            closeSync5(fd);
+            closeSync6(fd);
           } catch {
           }
       }
@@ -87241,7 +88005,7 @@ async function runRemoteFsOp(root, op, args, quotaKey) {
       if (!real)
         return { error: "Path is outside the shared root." };
       try {
-        const s = statSync8(real);
+        const s = statSync9(real);
         if (s.size > REMOTE_READ_CAP)
           return { error: `File is too large to read whole over the network (${(s.size / 1024 / 1024).toFixed(1)} MB) \u2014 open it locally.` };
         return { base64: (await readFile10(real)).toString("base64"), size: s.size };
@@ -87257,7 +88021,7 @@ async function runRemoteFsOp(root, op, args, quotaKey) {
       const target = join42(parent, name);
       if (!insideOk(target))
         return { ok: false, error: "Refusing to create a project outside the shared root." };
-      if (existsSync17(target))
+      if (existsSync18(target))
         return { ok: false, error: `A folder named "${name}" already exists.` };
       try {
         await mkdir8(target, { recursive: true });
@@ -87275,7 +88039,7 @@ async function runRemoteFsOp(root, op, args, quotaKey) {
       const target = join42(parent, name);
       if (!insideOk(target))
         return OUTSIDE("create");
-      if (existsSync17(target))
+      if (existsSync18(target))
         return { ok: false, error: `"${name}" already exists.` };
       try {
         if (op === "createFile")
@@ -87294,8 +88058,8 @@ async function runRemoteFsOp(root, op, args, quotaKey) {
         return { ok: false, error: "Invalid name." };
       if (!insideOk(oldPath))
         return OUTSIDE("rename");
-      const newPath = join42(dirname15(oldPath), newName);
-      if (existsSync17(newPath))
+      const newPath = join42(dirname16(oldPath), newName);
+      if (existsSync18(newPath))
         return { ok: false, error: `A file named "${newName}" already exists.` };
       try {
         await renameAsync(oldPath, newPath);
@@ -87341,7 +88105,7 @@ async function runRemoteFsOp(root, op, args, quotaKey) {
     }
     case "listTrash": {
       const trashDir = join42(root, TRASH_DIR);
-      if (!existsSync17(trashDir))
+      if (!existsSync18(trashDir))
         return [];
       try {
         const out = [];
@@ -87349,7 +88113,7 @@ async function runRemoteFsOp(root, op, args, quotaKey) {
           if (!e.isDirectory())
             continue;
           try {
-            const meta4 = JSON.parse(readFileSync31(join42(trashDir, e.name, ".fp-meta.json"), "utf-8"));
+            const meta4 = JSON.parse(readFileSync32(join42(trashDir, e.name, ".fp-meta.json"), "utf-8"));
             out.push({ trashId: e.name, name: meta4.name, path: join42(trashDir, e.name, meta4.name), originalPath: meta4.originalPath, deletedAt: meta4.deletedAt });
           } catch {
           }
@@ -87364,19 +88128,19 @@ async function runRemoteFsOp(root, op, args, quotaKey) {
       if (!SAFE_SEG.test(id))
         return { ok: false, error: "Bad trash id." };
       const itemDir = join42(root, TRASH_DIR, id);
-      if (!existsSync17(itemDir))
+      if (!existsSync18(itemDir))
         return { ok: false, error: "Not in trash." };
       try {
-        const meta4 = JSON.parse(readFileSync31(join42(itemDir, ".fp-meta.json"), "utf-8"));
+        const meta4 = JSON.parse(readFileSync32(join42(itemDir, ".fp-meta.json"), "utf-8"));
         if (!validName(meta4.name))
           return { ok: false, error: "Bad trashed name." };
         const src = join42(itemDir, meta4.name);
         let dest = meta4.originalPath;
         if (!insideOk(dest))
           return OUTSIDE("restore");
-        if (existsSync17(dest))
-          dest = resolveUniqueName(dirname15(dest), meta4.name);
-        await mkdir8(dirname15(dest), { recursive: true });
+        if (existsSync18(dest))
+          dest = resolveUniqueName(dirname16(dest), meta4.name);
+        await mkdir8(dirname16(dest), { recursive: true });
         await moveItem(src, dest);
         rmSync5(itemDir, { recursive: true, force: true });
         return { ok: true, path: dest };
@@ -87397,7 +88161,7 @@ async function runRemoteFsOp(root, op, args, quotaKey) {
             continue;
           if (!insideOk(src))
             return OUTSIDE(op === "copyPaths" ? "copy from" : "move from");
-          if (op === "movePaths" && dirname15(src) === destDir) {
+          if (op === "movePaths" && dirname16(src) === destDir) {
             newPaths.push(src);
             continue;
           }
@@ -87678,8 +88442,8 @@ function releaseDcClient(clientId) {
 
 // ../../packages/host-core/dist/fs-transfer.js
 import { readdir as readdir5, lstat as lstat2, mkdir as mkdir9, chmod, rm as rm3, readlink, symlink, stat as stat4 } from "node:fs/promises";
-import { openSync as openSync6, readSync as readSync5, closeSync as closeSync6, existsSync as existsSync18, createWriteStream } from "node:fs";
-import { basename as basename8, dirname as dirname16, join as join44, relative as relative7, sep as sep8 } from "node:path";
+import { openSync as openSync7, readSync as readSync6, closeSync as closeSync7, existsSync as existsSync19, createWriteStream } from "node:fs";
+import { basename as basename8, dirname as dirname17, join as join44, relative as relative7, sep as sep8 } from "node:path";
 
 // ../../packages/host-core/dist/active-link/paths.js
 init_base_paths();
@@ -87735,7 +88499,7 @@ function clearTimer(t) {
 }
 function uniqueDir(parent, name) {
   let candidate = join44(parent, name);
-  for (let i = 2; existsSync18(candidate) && i < 1e4; i++)
+  for (let i = 2; existsSync19(candidate) && i < 1e4; i++)
     candidate = join44(parent, `${name} ${i}`);
   return candidate;
 }
@@ -87744,7 +88508,7 @@ function uniqueFile(parent, name) {
   const stem = dot > 0 ? name.slice(0, dot) : name;
   const ext = dot > 0 ? name.slice(dot) : "";
   let candidate = join44(parent, name);
-  for (let i = 2; existsSync18(candidate) && i < 1e4; i++)
+  for (let i = 2; existsSync19(candidate) && i < 1e4; i++)
     candidate = join44(parent, `${stem} ${i}${ext}`);
   return candidate;
 }
@@ -87874,7 +88638,7 @@ async function startOutboundTransfer(msg, controllerClientId, ownHostId2, hostRo
     producers.delete(transferId);
     return;
   }
-  const srcBase = manifest.singleFile ? dirname16(srcPath) : srcPath;
+  const srcBase = manifest.singleFile ? dirname17(srcPath) : srcPath;
   send4({
     type: "fs:transferManifest",
     transferId,
@@ -87902,7 +88666,7 @@ async function startOutboundTransfer(msg, controllerClientId, ownHostId2, hostRo
     const abs = join44(srcBase, f.rel.split("/").join(sep8));
     let fd = null;
     try {
-      fd = openSync6(abs, "r");
+      fd = openSync7(abs, "r");
       if (f.size === 0) {
         send4({ type: "fs:transferChunk", transferId, toHost, fileIx, rel: f.rel, mode: f.mode, kind: "file", offset: 0, base64: "", eof: true }, { hostId: toHost });
       } else {
@@ -87912,7 +88676,7 @@ async function startOutboundTransfer(msg, controllerClientId, ownHostId2, hostRo
             break;
           const len = Math.min(CHUNK2, f.size - offset);
           const buf = Buffer.alloc(len);
-          const read = readSync5(fd, buf, 0, len, offset);
+          const read = readSync6(fd, buf, 0, len, offset);
           send4({ type: "fs:transferChunk", transferId, toHost, fileIx, rel: f.rel, mode: f.mode, kind: "file", offset, base64: buf.subarray(0, read).toString("base64"), eof: offset + len >= f.size }, { hostId: toHost });
           state3.sentBytes += read;
         }
@@ -87920,7 +88684,7 @@ async function startOutboundTransfer(msg, controllerClientId, ownHostId2, hostRo
     } catch (e) {
       if (fd != null)
         try {
-          closeSync6(fd);
+          closeSync7(fd);
         } catch {
         }
       failProducer(transferId, `Couldn't read ${f.rel}: ${e.message}`);
@@ -87928,7 +88692,7 @@ async function startOutboundTransfer(msg, controllerClientId, ownHostId2, hostRo
     } finally {
       if (fd != null)
         try {
-          closeSync6(fd);
+          closeSync7(fd);
         } catch {
         }
     }
@@ -88041,7 +88805,7 @@ async function beginInboundTransfer(msg, hostRoot, send4) {
   if (msg.singleFile) {
     let destFile = join44(parent, msg.destName);
     let createdFile = true;
-    if (existsSync18(destFile)) {
+    if (existsSync19(destFile)) {
       if (msg.onCollision === "abort") {
         failNoState(`"${msg.destName}" already exists on the destination.`);
         return;
@@ -88066,7 +88830,7 @@ async function beginInboundTransfer(msg, hostRoot, send4) {
   }
   let destRoot = join44(parent, msg.destName);
   let createdRoot = false;
-  if (existsSync18(destRoot)) {
+  if (existsSync19(destRoot)) {
     if (msg.onCollision === "abort") {
       failNoState(`"${msg.destName}" already exists on the destination.`);
       return;
@@ -88112,9 +88876,9 @@ async function writeInboundChunk(msg, send4) {
   try {
     if (msg.kind === "symlink") {
       const target = Buffer.from(msg.base64, "base64").toString("utf-8");
-      const resolved = join44(dirname16(abs), target);
+      const resolved = join44(dirname17(abs), target);
       if (isInsideRoot(resolved, s.destRoot)) {
-        await mkdir9(dirname16(abs), { recursive: true }).catch(() => {
+        await mkdir9(dirname17(abs), { recursive: true }).catch(() => {
         });
         await symlink(target, abs).catch(() => {
         });
@@ -88127,7 +88891,7 @@ async function writeInboundChunk(msg, send4) {
     if (s.curIx !== msg.fileIx || !s.curStream) {
       if (s.curStream)
         await new Promise((r) => s.curStream.end(r));
-      await mkdir9(dirname16(abs), { recursive: true }).catch(() => {
+      await mkdir9(dirname17(abs), { recursive: true }).catch(() => {
       });
       s.curStream = createWriteStream(abs);
       s.curIx = msg.fileIx;
@@ -88723,12 +89487,12 @@ init_credentials();
 init_credentials();
 import { hostname as hostname3, platform } from "node:os";
 import { randomUUID as randomUUID21 } from "node:crypto";
-import { chmodSync as chmodSync3, existsSync as existsSync20, mkdirSync as mkdirSync23, readFileSync as readFileSync33, writeFileSync as writeFileSync23 } from "node:fs";
+import { chmodSync as chmodSync3, existsSync as existsSync21, mkdirSync as mkdirSync24, readFileSync as readFileSync34, writeFileSync as writeFileSync23 } from "node:fs";
 import { join as join46 } from "node:path";
 var FILE = () => join46(daemonDir2(), "machine-identity.json");
 function readMachineIdentity() {
   try {
-    const m = JSON.parse(readFileSync33(FILE(), "utf-8"));
+    const m = JSON.parse(readFileSync34(FILE(), "utf-8"));
     return m?.deviceToken && m?.publicId ? m : null;
   } catch {
     return null;
@@ -88736,7 +89500,7 @@ function readMachineIdentity() {
 }
 function write(m) {
   try {
-    mkdirSync23(daemonDir2(), { recursive: true, mode: 448 });
+    mkdirSync24(daemonDir2(), { recursive: true, mode: 448 });
     writeFileSync23(FILE(), JSON.stringify(m, null, 2), { mode: 384 });
     chmodSync3(FILE(), 384);
   } catch {
@@ -88832,14 +89596,14 @@ function getMachinePublicId() {
 
 // ../../packages/host-core/dist/active-link/engine.js
 import { lstat as lstat7, readlink as readlink4, rm as rm4, mkdir as mkdir11, symlink as symlink2, rename as rename2, utimes as utimes2, writeFile as writeFile10 } from "node:fs/promises";
-import { existsSync as existsSync22 } from "node:fs";
-import { dirname as dirname21, join as join51, resolve as resolve11 } from "node:path";
+import { existsSync as existsSync23 } from "node:fs";
+import { dirname as dirname22, join as join51, resolve as resolve11 } from "node:path";
 
 // ../../packages/host-core/dist/active-link/blocks.js
 import { createHash as createHash4 } from "node:crypto";
 import { createReadStream } from "node:fs";
 import { open, mkdir as mkdir10, rename, chmod as chmod2, utimes, unlink } from "node:fs/promises";
-import { dirname as dirname18 } from "node:path";
+import { dirname as dirname19 } from "node:path";
 var CHUNK3 = 1024 * 1024;
 var MAX_INFLIGHT2 = 8 * CHUNK3;
 var IDLE_MS2 = 6e4;
@@ -88967,7 +89731,7 @@ var StagingWriter = class {
   }
   async ensureOpen() {
     if (!this.fh) {
-      await mkdir10(dirname18(this.stagingPath), { recursive: true });
+      await mkdir10(dirname19(this.stagingPath), { recursive: true });
       this.fh = await open(this.stagingPath, "w");
     }
     return this.fh;
@@ -88997,7 +89761,7 @@ var StagingWriter = class {
     });
     await fh.close();
     this.fh = null;
-    await mkdir10(dirname18(dest), { recursive: true });
+    await mkdir10(dirname19(dest), { recursive: true });
     await chmod2(this.stagingPath, mode & 511).catch(() => {
     });
     const secs = mtimeMs / 1e3;
@@ -89030,7 +89794,7 @@ var BlockAssembler = class {
     this.stagingPath = stagingPath;
   }
   async open() {
-    await mkdir10(dirname18(this.stagingPath), { recursive: true });
+    await mkdir10(dirname19(this.stagingPath), { recursive: true });
     this.fh = await open(this.stagingPath, "w");
   }
   /** Write a received block at its byte offset (index * CHUNK). */
@@ -89074,7 +89838,7 @@ var BlockAssembler = class {
       });
       return false;
     }
-    await mkdir10(dirname18(dest), { recursive: true });
+    await mkdir10(dirname19(dest), { recursive: true });
     await chmod2(this.stagingPath, mode & 511).catch(() => {
     });
     const secs = mtimeMs / 1e3;
@@ -89097,7 +89861,7 @@ var BlockAssembler = class {
 };
 
 // ../../packages/host-core/dist/active-link/manifest.js
-import { readFileSync as readFileSync34, writeFileSync as writeFileSync24, mkdirSync as mkdirSync24, existsSync as existsSync21, renameSync as renameSync7 } from "node:fs";
+import { readFileSync as readFileSync35, writeFileSync as writeFileSync24, mkdirSync as mkdirSync25, existsSync as existsSync22, renameSync as renameSync8 } from "node:fs";
 import { join as join47 } from "node:path";
 
 // ../../packages/host-core/dist/active-link/reconcile.js
@@ -89138,7 +89902,7 @@ var LinkManifest = class {
   }
   load() {
     try {
-      const raw = JSON.parse(readFileSync34(this.file(), "utf-8"));
+      const raw = JSON.parse(readFileSync35(this.file(), "utf-8"));
       this.records = new Map(Object.entries(raw.records ?? {}));
       this.tombstones = new Map(Object.entries(raw.tombstones ?? {}));
     } catch {
@@ -89219,15 +89983,15 @@ var LinkManifest = class {
     if (!this.dirty)
       return;
     try {
-      if (!existsSync21(this.dir))
-        mkdirSync24(this.dir, { recursive: true });
+      if (!existsSync22(this.dir))
+        mkdirSync25(this.dir, { recursive: true });
       const json3 = {
         records: Object.fromEntries(this.records),
         tombstones: Object.fromEntries(this.tombstones)
       };
       const tmp = `${this.file()}.tmp`;
       writeFileSync24(tmp, JSON.stringify(json3));
-      renameSync7(tmp, this.file());
+      renameSync8(tmp, this.file());
       this.dirty = false;
     } catch {
     }
@@ -90236,9 +91000,9 @@ var NodeFsHandler = class {
     if (this.fsw.closed) {
       return;
     }
-    const dirname32 = sysPath.dirname(file2);
+    const dirname33 = sysPath.dirname(file2);
     const basename14 = sysPath.basename(file2);
-    const parent = this.fsw._getWatchedDir(dirname32);
+    const parent = this.fsw._getWatchedDir(dirname33);
     let prevStats = stats;
     if (parent.has(basename14))
       return;
@@ -90265,7 +91029,7 @@ var NodeFsHandler = class {
             prevStats = newStats2;
           }
         } catch (error51) {
-          this.fsw._remove(dirname32, basename14);
+          this.fsw._remove(dirname33, basename14);
         }
       } else if (parent.has(basename14)) {
         const at = newStats.atimeMs;
@@ -91710,13 +92474,13 @@ var ActiveLinkEngine = class {
    *  file so the path still exists — recorded as a FILE matching disk so the local
    *  watcher doesn't churn. The target is containment-checked, never dereferenced. */
   async applySymlink(rel, dest, target, mtimeMs, mode) {
-    const resolved = resolve11(dirname21(dest), target);
+    const resolved = resolve11(dirname22(dest), target);
     if (!isInsideRoot(resolved, this.opts.localRoot))
       return;
     const hash2 = hashString(target);
     const secs = mtimeMs / 1e3;
     try {
-      await mkdir11(dirname21(dest), { recursive: true });
+      await mkdir11(dirname22(dest), { recursive: true });
       await rm4(dest, { force: true, recursive: true });
       try {
         await symlink2(target, dest);
@@ -91768,7 +92532,7 @@ var ActiveLinkEngine = class {
       return;
     if (fromRec && fromRec.kind === "file") {
       try {
-        await mkdir11(dirname21(toAbs2), { recursive: true });
+        await mkdir11(dirname22(toAbs2), { recursive: true });
         await rename2(fromAbs, toAbs2);
         const secs = mtimeMs / 1e3;
         await utimes2(toAbs2, secs, secs).catch(() => {
@@ -91793,7 +92557,7 @@ var ActiveLinkEngine = class {
     await this.maybeRefreshAllow(rels);
     const state3 = /* @__PURE__ */ new Map();
     for (const rel of rels) {
-      if (existsSync22(absOf(this.opts.localRoot, rel)) && !this.isSynced(rel)) {
+      if (existsSync23(absOf(this.opts.localRoot, rel)) && !this.isSynced(rel)) {
         this.manifest.dropRecord(rel);
         continue;
       }
@@ -91897,7 +92661,7 @@ var ActiveLinkEngine = class {
     for (const rel of this.manifest.recordRels()) {
       if (records.has(rel))
         continue;
-      if (existsSync22(absOf(this.opts.localRoot, rel)))
+      if (existsSync23(absOf(this.opts.localRoot, rel)))
         this.manifest.dropRecord(rel);
       else
         this.manifest.setTombstone(rel, now2);
@@ -91968,14 +92732,14 @@ var ActiveLinkEngine = class {
 };
 
 // ../../packages/host-core/dist/active-link/config.js
-import { readFileSync as readFileSync35, writeFileSync as writeFileSync25, mkdirSync as mkdirSync25, existsSync as existsSync23, renameSync as renameSync8, watch as watch3 } from "node:fs";
+import { readFileSync as readFileSync36, writeFileSync as writeFileSync25, mkdirSync as mkdirSync26, existsSync as existsSync24, renameSync as renameSync9, watch as watch3 } from "node:fs";
 import { join as join52 } from "node:path";
 function configPath2() {
   return join52(activeLinkRoot(), "links.json");
 }
 function loadLinkConfigs() {
   try {
-    const raw = JSON.parse(readFileSync35(configPath2(), "utf-8"));
+    const raw = JSON.parse(readFileSync36(configPath2(), "utf-8"));
     if (!Array.isArray(raw.links))
       return [];
     return raw.links.filter((c) => c && c.linkId && c.localRoot && c.peerHostId);
@@ -91986,11 +92750,11 @@ function loadLinkConfigs() {
 function writeAll(links) {
   try {
     const dir2 = activeLinkRoot();
-    if (!existsSync23(dir2))
-      mkdirSync25(dir2, { recursive: true });
+    if (!existsSync24(dir2))
+      mkdirSync26(dir2, { recursive: true });
     const tmp = `${configPath2()}.tmp`;
     writeFileSync25(tmp, JSON.stringify({ links }, null, 2));
-    renameSync8(tmp, configPath2());
+    renameSync9(tmp, configPath2());
   } catch {
   }
 }
@@ -92012,7 +92776,7 @@ function pendingPath() {
 }
 function loadPendingDeprovisions() {
   try {
-    const raw = JSON.parse(readFileSync35(pendingPath(), "utf-8"));
+    const raw = JSON.parse(readFileSync36(pendingPath(), "utf-8"));
     return Array.isArray(raw.pending) ? raw.pending.filter((p) => p && p.linkId && p.peerHostId) : [];
   } catch {
     return [];
@@ -92021,11 +92785,11 @@ function loadPendingDeprovisions() {
 function writePending(pending2) {
   try {
     const dir2 = activeLinkRoot();
-    if (!existsSync23(dir2))
-      mkdirSync25(dir2, { recursive: true });
+    if (!existsSync24(dir2))
+      mkdirSync26(dir2, { recursive: true });
     const tmp = `${pendingPath()}.tmp`;
     writeFileSync25(tmp, JSON.stringify({ pending: pending2 }, null, 2));
-    renameSync8(tmp, pendingPath());
+    renameSync9(tmp, pendingPath());
   } catch {
   }
 }
@@ -92037,8 +92801,8 @@ function removeLinkConfig(linkId) {
 }
 function watchLinkConfigs(onChange) {
   const dir2 = activeLinkRoot();
-  if (!existsSync23(dir2))
-    mkdirSync25(dir2, { recursive: true });
+  if (!existsSync24(dir2))
+    mkdirSync26(dir2, { recursive: true });
   let timer2 = null;
   let watcher = null;
   try {
@@ -92183,7 +92947,7 @@ function routeInboundLinkFrame(frame) {
 init_dist5();
 
 // ../../packages/host-core/dist/pty-manager.js
-import { existsSync as existsSync24 } from "node:fs";
+import { existsSync as existsSync25 } from "node:fs";
 import { homedir as homedir8 } from "node:os";
 var ptyPromise = null;
 function loadPty() {
@@ -92205,7 +92969,7 @@ function key(clientId, ptyId) {
 var sessions2 = /* @__PURE__ */ new Map();
 var FLUSH_MS = 8;
 var FLUSH_BYTES = 64 * 1024;
-function flush(ptyId, s, sink) {
+function flush(ptyId, s, sink2) {
   if (s.timer) {
     clearTimeout(s.timer);
     s.timer = null;
@@ -92215,9 +92979,9 @@ function flush(ptyId, s, sink) {
   const joined = s.buf.join("");
   s.buf = [];
   s.bytes = 0;
-  sink.output(ptyId, Buffer.from(joined, "utf8").toString("base64"));
+  sink2.output(ptyId, Buffer.from(joined, "utf8").toString("base64"));
 }
-async function openPty(opts, sink) {
+async function openPty(opts, sink2) {
   const pty = await loadPty();
   if (!pty)
     throw new Error("Terminal support is unavailable on this machine.");
@@ -92247,14 +93011,14 @@ async function openPty(opts, sink) {
     s.buf.push(data);
     s.bytes += data.length;
     if (s.bytes >= FLUSH_BYTES)
-      flush(opts.ptyId, s, sink);
+      flush(opts.ptyId, s, sink2);
     else if (!s.timer)
-      s.timer = setTimeout(() => flush(opts.ptyId, s, sink), FLUSH_MS);
+      s.timer = setTimeout(() => flush(opts.ptyId, s, sink2), FLUSH_MS);
   });
   proc.onExit(({ exitCode, signal }) => {
-    flush(opts.ptyId, s, sink);
+    flush(opts.ptyId, s, sink2);
     sessions2.delete(k);
-    sink.exit(opts.ptyId, exitCode ?? null, signal ?? null);
+    sink2.exit(opts.ptyId, exitCode ?? null, signal ?? null);
   });
   return { pid: proc.pid };
 }
@@ -92346,7 +93110,7 @@ function listUnix() {
   const seen = /* @__PURE__ */ new Set();
   const loginShell = process.env.SHELL || "";
   const add2 = (id, path6) => {
-    if (!path6 || seen.has(path6) || !existsSync24(path6))
+    if (!path6 || seen.has(path6) || !existsSync25(path6))
       return;
     seen.add(path6);
     out.push(mk(id, path6, path6 === loginShell));
@@ -92378,7 +93142,7 @@ function listWindows() {
   const gitBash = `${pf}\\Git\\bin\\bash.exe`;
   const pwsh7 = `${pf}\\PowerShell\\7\\pwsh.exe`;
   const add2 = (id, path6, label, isDefault = false) => {
-    if (path6 && existsSync24(path6))
+    if (path6 && existsSync25(path6))
       out.push(mk(id, path6, isDefault, label));
   };
   add2("powershell", winPwsh, "Windows PowerShell", true);
@@ -92437,7 +93201,7 @@ function resolveCwd(cwd, hostRoot) {
   const fallback = hostRoot || homedir8();
   if (!cwd)
     return fallback;
-  if (!existsSync24(cwd))
+  if (!existsSync25(cwd))
     return fallback;
   if (hostRoot && !isInsideRoot(cwd, hostRoot))
     return hostRoot;
@@ -92498,7 +93262,12 @@ function setHostDaemonRole(on) {
     teardownHostRole();
   }
 }
+function rdeskOrMeshOnlyBuild() {
+  return process.env.CCB_RDESK_ONLY === "1" || process.env.CCB_MESH_ONLY === "1";
+}
 function sharingEnabled() {
+  if (rdeskOrMeshOnlyBuild())
+    return false;
   return sharing || hostDaemonRole || process.env.CCB_HOST_DAEMON === "1";
 }
 var serverSelected = false;
@@ -92900,7 +93669,7 @@ function provisionActiveLinkMirror(payload) {
   if (!isInsideRoot(localRoot, HOST_ROOT))
     return;
   try {
-    mkdirSync26(localRoot, { recursive: true });
+    mkdirSync27(localRoot, { recursive: true });
   } catch {
   }
   saveLinkConfig({
@@ -93325,12 +94094,12 @@ async function serveInboundTerm(p, driverClientId) {
   const route2 = driverClientId ? { clientId: driverClientId } : {};
   switch (p.type) {
     case "term:open": {
-      const sink = {
+      const sink2 = {
         output: (ptyId, base643) => send3("term", { type: "term:output", ptyId, base64: base643 }, route2),
         exit: (ptyId, exitCode, signal) => send3("term", { type: "term:exit", ptyId, exitCode, signal }, route2)
       };
       try {
-        const { pid } = await openPty({ ptyId: p.ptyId, clientId: driverClientId, shell: p.shell, args: p.args, cwd: p.cwd, cols: p.cols, rows: p.rows, env: p.env, hostRoot: HOST_CONTAIN }, sink);
+        const { pid } = await openPty({ ptyId: p.ptyId, clientId: driverClientId, shell: p.shell, args: p.args, cwd: p.cwd, cols: p.cols, rows: p.rows, env: p.env, hostRoot: HOST_CONTAIN }, sink2);
         send3("term", { type: "term:opened", ptyId: p.ptyId, requestId: p.requestId, pid }, route2);
       } catch (err2) {
         send3("term", { type: "term:openError", ptyId: p.ptyId, requestId: p.requestId, error: err2 instanceof Error ? err2.message : String(err2) }, route2);
@@ -93474,6 +94243,8 @@ function stopHeartbeat() {
   }
 }
 function registerAsHost() {
+  if (rdeskOrMeshOnlyBuild())
+    return;
   void ensureP2pReady();
   const kind = process.env.CCB_HOST_KIND === "cloud" ? "cloud" : void 0;
   const name = kind === "cloud" ? "Cloud agent" : hostname4();
@@ -95313,7 +96084,7 @@ function setInProcConnector(fn) {
 
 // ../../packages/host-core/dist/rdesk/server-prefs.js
 init_credentials();
-import { readFileSync as readFileSync36, writeFileSync as writeFileSync26 } from "node:fs";
+import { readFileSync as readFileSync37, writeFileSync as writeFileSync26 } from "node:fs";
 import { join as join55 } from "node:path";
 function rdeskServerPrefsPath() {
   return join55(daemonDir2(), "rdesk-server.json");
@@ -95328,7 +96099,7 @@ var DEFAULTS2 = {
 };
 function readRdeskServerPrefs() {
   try {
-    const p = JSON.parse(readFileSync36(rdeskServerPrefsPath(), "utf8"));
+    const p = JSON.parse(readFileSync37(rdeskServerPrefsPath(), "utf8"));
     return {
       // `!== false` (not `?? true`): only an explicit opt-out disables sharing, so a
       // partially-written or older prefs file never silently turns the machine off.
@@ -95361,7 +96132,7 @@ function rdeskSharingEnabled() {
 // ../../packages/host-core/dist/rdesk/password.js
 init_credentials();
 import { scryptSync, randomBytes as randomBytes5, timingSafeEqual as timingSafeEqual4, randomInt } from "node:crypto";
-import { readFileSync as readFileSync37, writeFileSync as writeFileSync27, existsSync as existsSync25, unlinkSync as unlinkSync3 } from "node:fs";
+import { readFileSync as readFileSync38, writeFileSync as writeFileSync27, existsSync as existsSync26, unlinkSync as unlinkSync3 } from "node:fs";
 import { join as join56 } from "node:path";
 function pwFile() {
   return join56(daemonDir2(), "rdesk-password.json");
@@ -95379,27 +96150,27 @@ function generatePassword() {
 }
 function writePlain(password) {
   try {
-    const safe = electronModule()?.safeStorage;
-    if (!safe?.isEncryptionAvailable())
+    const safe2 = electronModule()?.safeStorage;
+    if (!safe2?.isEncryptionAvailable())
       return;
-    writeFileSync27(pwPlainFile(), safe.encryptString(password), { mode: 384 });
+    writeFileSync27(pwPlainFile(), safe2.encryptString(password), { mode: 384 });
   } catch {
   }
 }
 function canRevealRdeskPassword() {
   try {
-    const safe = electronModule()?.safeStorage;
-    return !!safe?.isEncryptionAvailable() && existsSync25(pwPlainFile());
+    const safe2 = electronModule()?.safeStorage;
+    return !!safe2?.isEncryptionAvailable() && existsSync26(pwPlainFile());
   } catch {
     return false;
   }
 }
 function readRdeskPasswordPlain() {
   try {
-    const safe = electronModule()?.safeStorage;
-    if (!safe?.isEncryptionAvailable())
+    const safe2 = electronModule()?.safeStorage;
+    if (!safe2?.isEncryptionAvailable())
       return null;
-    return safe.decryptString(readFileSync37(pwPlainFile()));
+    return safe2.decryptString(readFileSync38(pwPlainFile()));
   } catch {
     return null;
   }
@@ -95432,7 +96203,7 @@ function ensureRdeskPassword() {
   return regenerateRdeskPassword();
 }
 function hasRdeskPassword() {
-  return !!process.env.CCB_RDESK_PASSWORD || existsSync25(pwFile());
+  return !!process.env.CCB_RDESK_PASSWORD || existsSync26(pwFile());
 }
 function verifyRdeskPassword(password) {
   if (!password)
@@ -95441,7 +96212,7 @@ function verifyRdeskPassword(password) {
   if (override)
     return password.length === override.length && timingSafeEqual4(Buffer.from(password), Buffer.from(override));
   try {
-    const { salt, hash: hash2 } = JSON.parse(readFileSync37(pwFile(), "utf8"));
+    const { salt, hash: hash2 } = JSON.parse(readFileSync38(pwFile(), "utf8"));
     const got = scryptSync(password, Buffer.from(salt, "hex"), 32);
     const want = Buffer.from(hash2, "hex");
     return got.length === want.length && timingSafeEqual4(got, want);
@@ -96007,8 +96778,8 @@ function createPasskeyRegistration(rpId) {
 
 // ../../packages/host-core/dist/vault/manager.js
 init_base_paths();
-import { mkdirSync as mkdirSync29, readFileSync as readFileSync40, writeFileSync as writeFileSync30 } from "node:fs";
-import { dirname as dirname23 } from "node:path";
+import { mkdirSync as mkdirSync30, readFileSync as readFileSync41, writeFileSync as writeFileSync30 } from "node:fs";
+import { dirname as dirname24 } from "node:path";
 
 // ../../packages/vault-core/dist/crypto.js
 init_argon2();
@@ -97032,8 +97803,8 @@ function makeDaemonVaultApi(getOrigin, getToken2) {
 
 // ../../packages/host-core/dist/vault/persistence.js
 init_base_paths();
-import { existsSync as existsSync26, mkdirSync as mkdirSync27, readFileSync as readFileSync38, writeFileSync as writeFileSync28, unlinkSync as unlinkSync4 } from "node:fs";
-import { dirname as dirname22 } from "node:path";
+import { existsSync as existsSync27, mkdirSync as mkdirSync28, readFileSync as readFileSync39, writeFileSync as writeFileSync28, unlinkSync as unlinkSync4 } from "node:fs";
+import { dirname as dirname23 } from "node:path";
 function vaultStoreFile() {
   return homePath(".tesseract", "vault", "vault.json");
 }
@@ -97044,9 +97815,9 @@ function makeVaultPersistence(file2 = vaultStoreFile, deviceKeyFile = vaultDevic
   return {
     load() {
       try {
-        if (!existsSync26(file2()))
+        if (!existsSync27(file2()))
           return null;
-        const parsed = JSON.parse(readFileSync38(file2(), "utf8"));
+        const parsed = JSON.parse(readFileSync39(file2(), "utf8"));
         if (!parsed || typeof parsed !== "object")
           return null;
         return { meta: parsed.meta ?? null, items: Array.isArray(parsed.items) ? parsed.items : [] };
@@ -97056,28 +97827,28 @@ function makeVaultPersistence(file2 = vaultStoreFile, deviceKeyFile = vaultDevic
     },
     save(state3) {
       try {
-        mkdirSync27(dirname22(file2()), { recursive: true, mode: 448 });
+        mkdirSync28(dirname23(file2()), { recursive: true, mode: 448 });
         writeFileSync28(file2(), JSON.stringify(state3), { mode: 384 });
       } catch {
       }
     },
     loadDeviceKey() {
       try {
-        return existsSync26(deviceKeyFile()) ? readFileSync38(deviceKeyFile(), "utf8").trim() || null : null;
+        return existsSync27(deviceKeyFile()) ? readFileSync39(deviceKeyFile(), "utf8").trim() || null : null;
       } catch {
         return null;
       }
     },
     saveDeviceKey(base64Key) {
       try {
-        mkdirSync27(dirname22(deviceKeyFile()), { recursive: true, mode: 448 });
+        mkdirSync28(dirname23(deviceKeyFile()), { recursive: true, mode: 448 });
         writeFileSync28(deviceKeyFile(), base64Key, { mode: 384 });
       } catch {
       }
     },
     clearDeviceKey() {
       try {
-        if (existsSync26(deviceKeyFile()))
+        if (existsSync27(deviceKeyFile()))
           unlinkSync4(deviceKeyFile());
       } catch {
       }
@@ -97087,7 +97858,7 @@ function makeVaultPersistence(file2 = vaultStoreFile, deviceKeyFile = vaultDevic
 
 // ../../packages/host-core/dist/vault/biometric.js
 init_base_paths();
-import { existsSync as existsSync27, mkdirSync as mkdirSync28, readFileSync as readFileSync39, rmSync as rmSync6, writeFileSync as writeFileSync29 } from "node:fs";
+import { existsSync as existsSync28, mkdirSync as mkdirSync29, readFileSync as readFileSync40, rmSync as rmSync6, writeFileSync as writeFileSync29 } from "node:fs";
 import { join as join57 } from "node:path";
 async function electronBio() {
   if (!electronModule())
@@ -97105,7 +97876,7 @@ async function electronBio() {
 }
 function bioDir() {
   const d = homePath(".tesseract", "vault-bio");
-  mkdirSync28(d, { recursive: true, mode: 448 });
+  mkdirSync29(d, { recursive: true, mode: 448 });
   return d;
 }
 function bioFile(id) {
@@ -97124,7 +97895,7 @@ async function biometricAvailable() {
   }
 }
 function biometricEnrolled(id) {
-  return existsSync27(bioFile(id));
+  return existsSync28(bioFile(id));
 }
 async function biometricEnroll(id, base64Key) {
   const bio = await electronBio();
@@ -97135,13 +97906,13 @@ async function biometricEnroll(id, base64Key) {
 }
 async function biometricUnlock(id) {
   const f = bioFile(id);
-  if (!existsSync27(f))
+  if (!existsSync28(f))
     throw new Error("Touch ID is not set up for this vault.");
   const bio = await electronBio();
   if (!bio)
     throw new Error("Touch ID is not available on this device.");
   await bio.systemPreferences.promptTouchID("unlock your vault");
-  return bio.safeStorage.decryptString(readFileSync39(f));
+  return bio.safeStorage.decryptString(readFileSync40(f));
 }
 function biometricDisable(id) {
   try {
@@ -97171,7 +97942,7 @@ var VaultManager = class {
   // ── auto-lock ────────────────────────────────────────────────────────────────────
   loadAutoLock() {
     try {
-      const raw = JSON.parse(readFileSync40(settingsFile(), "utf8"));
+      const raw = JSON.parse(readFileSync41(settingsFile(), "utf8"));
       return Number.isFinite(raw.autoLockMinutes) ? Math.max(0, raw.autoLockMinutes) : 0;
     } catch {
       return 0;
@@ -97179,7 +97950,7 @@ var VaultManager = class {
   }
   saveAutoLock() {
     try {
-      mkdirSync29(dirname23(settingsFile()), { recursive: true, mode: 448 });
+      mkdirSync30(dirname24(settingsFile()), { recursive: true, mode: 448 });
       writeFileSync30(settingsFile(), JSON.stringify({ autoLockMinutes: this.autoLockMinutes }), { mode: 384 });
     } catch {
     }
@@ -98218,7 +98989,7 @@ async function startLocalServer(opts) {
 
 // ../../packages/host-core/dist/daemon-runtime.js
 init_base_paths();
-import { readFileSync as readFileSync45, writeFileSync as writeFileSync38, existsSync as existsSync35, mkdirSync as mkdirSync37, unlinkSync as unlinkSync6, chmodSync as chmodSync7, statSync as statSync9 } from "node:fs";
+import { readFileSync as readFileSync46, writeFileSync as writeFileSync38, existsSync as existsSync36, mkdirSync as mkdirSync38, unlinkSync as unlinkSync6, chmodSync as chmodSync7, statSync as statSync10 } from "node:fs";
 import { execFileSync as execFileSync5 } from "node:child_process";
 import { join as join70 } from "node:path";
 import { randomBytes as randomBytes10 } from "node:crypto";
@@ -98227,7 +98998,7 @@ import { hostname as hostname5 } from "node:os";
 // ../../packages/shared/dist/daemon-registry.js
 init_base_paths();
 import { execFileSync as execFileSync3 } from "node:child_process";
-import { existsSync as existsSync28, mkdirSync as mkdirSync30, readdirSync as readdirSync9, readFileSync as readFileSync41, readlinkSync, unlinkSync as unlinkSync5, writeFileSync as writeFileSync31 } from "node:fs";
+import { existsSync as existsSync29, mkdirSync as mkdirSync31, readdirSync as readdirSync9, readFileSync as readFileSync42, readlinkSync, unlinkSync as unlinkSync5, writeFileSync as writeFileSync31 } from "node:fs";
 import { join as join58 } from "node:path";
 var SUPERVISOR_PID = Number(process.env.CCB_DAEMON_SUPERVISOR_PID ?? 0) || 0;
 delete process.env.CCB_DAEMON_SUPERVISOR_PID;
@@ -98323,7 +99094,7 @@ function pidStillMatches(pid, rec) {
 }
 function registerSelfAsDaemon(version2) {
   try {
-    mkdirSync30(registryDir(), { recursive: true, mode: 448 });
+    mkdirSync31(registryDir(), { recursive: true, mode: 448 });
     const rec = {
       pid: process.pid,
       startedAt: procStartedAt(process.pid),
@@ -98352,7 +99123,7 @@ function unregisterSelfAsDaemon() {
 }
 function readRecord(pid) {
   try {
-    return JSON.parse(readFileSync41(recordPath(pid), "utf-8"));
+    return JSON.parse(readFileSync42(recordPath(pid), "utf-8"));
   } catch {
     return null;
   }
@@ -98366,7 +99137,7 @@ function allRegisteredPids() {
 }
 function registeredDaemons(selfPid) {
   const out = [];
-  if (!existsSync28(registryDir()))
+  if (!existsSync29(registryDir()))
     return out;
   for (const pid of allRegisteredPids()) {
     if (pid === selfPid)
@@ -98458,7 +99229,7 @@ function liveDaemons() {
 
 // ../../packages/host-core/dist/device-identity.js
 import { join as join59 } from "node:path";
-import { readFileSync as readFileSync42, writeFileSync as writeFileSync32, existsSync as existsSync29, mkdirSync as mkdirSync31, renameSync as renameSync9, chmodSync as chmodSync4 } from "node:fs";
+import { readFileSync as readFileSync43, writeFileSync as writeFileSync32, existsSync as existsSync30, mkdirSync as mkdirSync32, renameSync as renameSync10, chmodSync as chmodSync4 } from "node:fs";
 init_credentials();
 var cached2 = null;
 function identityPath() {
@@ -98468,7 +99239,7 @@ async function loadOrCreateDeviceIdentity() {
   if (cached2)
     return cached2;
   try {
-    const stored = JSON.parse(readFileSync42(identityPath(), "utf-8"));
+    const stored = JSON.parse(readFileSync43(identityPath(), "utf-8"));
     if (stored?.privateJwk) {
       cached2 = await importIdentity(stored.privateJwk);
       return cached2;
@@ -98478,11 +99249,11 @@ async function loadOrCreateDeviceIdentity() {
   const kp = await generateIdentityKeyPair(true);
   const { privateJwk, publicRaw } = await exportIdentity(kp);
   const dir2 = daemonDir2();
-  if (!existsSync29(dir2))
-    mkdirSync31(dir2, { recursive: true, mode: 448 });
+  if (!existsSync30(dir2))
+    mkdirSync32(dir2, { recursive: true, mode: 448 });
   const tmp = `${identityPath()}.tmp`;
   writeFileSync32(tmp, JSON.stringify({ privateJwk, publicRaw, alg: "P256-ECDSA" }, null, 2), { mode: 384 });
-  renameSync9(tmp, identityPath());
+  renameSync10(tmp, identityPath());
   try {
     chmodSync4(identityPath(), 384);
   } catch {
@@ -98500,7 +99271,7 @@ async function loadOrCreateSealingKey() {
     return sealingCached;
   const { subtle: subtle5 } = globalThis.crypto;
   try {
-    const stored = JSON.parse(readFileSync42(sealingPath(), "utf-8"));
+    const stored = JSON.parse(readFileSync43(sealingPath(), "utf-8"));
     if (stored?.privateJwk && stored.publicRaw) {
       const privateKey = await subtle5.importKey("jwk", stored.privateJwk, EC_DH, true, ["deriveBits"]);
       sealingCached = { privateKey, publicRaw: unb64u(stored.publicRaw) };
@@ -98512,11 +99283,11 @@ async function loadOrCreateSealingKey() {
   const publicRaw = new Uint8Array(await subtle5.exportKey("raw", kp.publicKey));
   const privateJwk = await subtle5.exportKey("jwk", kp.privateKey);
   const dir2 = daemonDir2();
-  if (!existsSync29(dir2))
-    mkdirSync31(dir2, { recursive: true, mode: 448 });
+  if (!existsSync30(dir2))
+    mkdirSync32(dir2, { recursive: true, mode: 448 });
   const tmp = `${sealingPath()}.tmp`;
   writeFileSync32(tmp, JSON.stringify({ privateJwk, publicRaw: b64u(publicRaw), alg: "P256-ECDH" }, null, 2), { mode: 384 });
-  renameSync9(tmp, sealingPath());
+  renameSync10(tmp, sealingPath());
   try {
     chmodSync4(sealingPath(), 384);
   } catch {
@@ -98579,8 +99350,8 @@ import { createRequire as createRequire4 } from "node:module";
 
 // ../../packages/host-core/dist/mesh/config.js
 init_credentials();
-import { chmodSync as chmodSync5, existsSync as existsSync30, mkdirSync as mkdirSync32, readdirSync as readdirSync10, readFileSync as readFileSync43, renameSync as renameSync10, rmSync as rmSync7, writeFileSync as writeFileSync33 } from "node:fs";
-import { dirname as dirname24, join as join60 } from "node:path";
+import { chmodSync as chmodSync5, existsSync as existsSync31, mkdirSync as mkdirSync33, readdirSync as readdirSync10, readFileSync as readFileSync44, renameSync as renameSync11, rmSync as rmSync7, writeFileSync as writeFileSync33 } from "node:fs";
+import { dirname as dirname25, join as join60 } from "node:path";
 function meshDir() {
   return join60(daemonDir2(), "mesh");
 }
@@ -98623,27 +99394,27 @@ var FILES = {
 function readIfPresent(name, dir2 = meshDir()) {
   const p = join60(dir2, name);
   try {
-    return existsSync30(p) ? new Uint8Array(readFileSync43(p)) : void 0;
+    return existsSync31(p) ? new Uint8Array(readFileSync44(p)) : void 0;
   } catch {
     return void 0;
   }
 }
 function migrateSingleMesh() {
   const legacyGenesis = join60(meshDir(), FILES.genesis);
-  if (!existsSync30(legacyGenesis))
+  if (!existsSync31(legacyGenesis))
     return null;
   const id = meshIdFromCert(readIfPresent(FILES.cert)) ?? LEGACY_MESH_ID;
   const dest = oneMeshDir(id);
   try {
-    mkdirSync32(dest, { recursive: true, mode: 448 });
+    mkdirSync33(dest, { recursive: true, mode: 448 });
     chmodSync5(dest, 448);
     for (const f of Object.values(FILES)) {
       const from = join60(meshDir(), f);
-      if (existsSync30(from))
-        renameSync10(from, join60(dest, f));
+      if (existsSync31(from))
+        renameSync11(from, join60(dest, f));
     }
     const key2 = join60(dest, FILES.key);
-    if (existsSync30(key2))
+    if (existsSync31(key2))
       chmodSync5(key2, 384);
   } catch {
     return null;
@@ -98666,14 +99437,14 @@ function listMeshIds() {
 }
 function readLocal(meshId) {
   try {
-    return JSON.parse(readFileSync43(join60(oneMeshDir(meshId), FILES.local), "utf8"));
+    return JSON.parse(readFileSync44(join60(oneMeshDir(meshId), FILES.local), "utf8"));
   } catch {
     return null;
   }
 }
 function writeLocal(meshId, state3) {
   try {
-    mkdirSync32(oneMeshDir(meshId), { recursive: true, mode: 448 });
+    mkdirSync33(oneMeshDir(meshId), { recursive: true, mode: 448 });
     writeFileSync33(join60(oneMeshDir(meshId), FILES.local), JSON.stringify(state3, null, 2), { mode: 384 });
   } catch {
   }
@@ -98720,7 +99491,7 @@ function saveMeshIdentity(id) {
     saveMesh(meshId, id);
     return;
   }
-  mkdirSync32(meshDir(), { recursive: true, mode: 448 });
+  mkdirSync33(meshDir(), { recursive: true, mode: 448 });
   try {
     chmodSync5(meshDir(), 448);
   } catch {
@@ -98733,7 +99504,7 @@ function saveMeshIdentity(id) {
 }
 function saveMesh(meshId, id) {
   const dir2 = oneMeshDir(meshId);
-  mkdirSync32(dir2, { recursive: true, mode: 448 });
+  mkdirSync33(dir2, { recursive: true, mode: 448 });
   try {
     chmodSync5(meshDir(), 448);
   } catch {
@@ -98767,7 +99538,7 @@ function statusPath(meshId) {
 function writeStatus(status2, meshId) {
   try {
     const p = statusPath(meshId);
-    mkdirSync32(dirname24(p), { recursive: true, mode: 448 });
+    mkdirSync33(dirname25(p), { recursive: true, mode: 448 });
     writeFileSync33(p, JSON.stringify({ ...status2, at: Date.now() }, null, 2));
   } catch {
   }
@@ -98780,7 +99551,7 @@ function clearStatus(meshId) {
 }
 function readStatus(meshId) {
   try {
-    const raw = JSON.parse(readFileSync43(statusPath(meshId), "utf8"));
+    const raw = JSON.parse(readFileSync44(statusPath(meshId), "utf8"));
     if (typeof raw.at !== "number")
       return null;
     return { ...raw, at: raw.at, stale: Date.now() - raw.at > STATUS_STALE_MS };
@@ -98792,7 +99563,7 @@ function cacheBundle(bundle, meshId) {
   try {
     const id = meshId ?? listMeshIds()[0];
     const dir2 = id === void 0 ? meshDir() : oneMeshDir(id);
-    mkdirSync32(dir2, { recursive: true, mode: 448 });
+    mkdirSync33(dir2, { recursive: true, mode: 448 });
     writeFileSync33(join60(dir2, FILES.bundle), bundle);
   } catch {
   }
@@ -99845,7 +100616,7 @@ function startNodes(log9) {
 }
 
 // ../../packages/host-core/dist/drops/receive-ui.js
-import { basename as basename12, dirname as dirname25 } from "node:path";
+import { basename as basename12, dirname as dirname26 } from "node:path";
 var log5 = (...a) => console.log("[drops]", ...a);
 function formatBytes(n) {
   if (!Number.isFinite(n) || n <= 0)
@@ -100187,7 +100958,7 @@ function createDropHandler(deps) {
 // ../../packages/host-core/dist/drops/blob-fetch.js
 import { createWriteStream as createWriteStream2 } from "node:fs";
 import { mkdir as mkdir13, rm as rm5, chmod as chmod3 } from "node:fs/promises";
-import { dirname as dirname26, join as join63 } from "node:path";
+import { dirname as dirname27, join as join63 } from "node:path";
 import { Readable as Readable2 } from "node:stream";
 import { pipeline } from "node:stream/promises";
 
@@ -100385,7 +101156,7 @@ async function fetchBlobDrop(opts) {
         log7(`drop ${opts.dropId}: refusing a path outside the destination`);
         continue;
       }
-      await mkdir13(dirname26(abs), { recursive: true });
+      await mkdir13(dirname27(abs), { recursive: true });
       abs = await uniqueDropPath(abs);
       const res = await fetchFn(new URL(item.url, opts.apiOrigin).toString(), { signal: opts.signal });
       if (!res.ok || !res.body)
@@ -100657,13 +101428,13 @@ var RdeskServerChannel = class {
 };
 
 // ../../packages/host-core/dist/rdesk/channel-client.js
-import { readFileSync as readFileSync44 } from "node:fs";
+import { readFileSync as readFileSync45 } from "node:fs";
 import { join as join64 } from "node:path";
 var RECONNECT_MS = 2e3;
 var CLAIM_RETRY_MS = 5e3;
 function readEndpoint(dir2, selfPid) {
   try {
-    const s = JSON.parse(readFileSync44(join64(dir2, "status.json"), "utf8"));
+    const s = JSON.parse(readFileSync45(join64(dir2, "status.json"), "utf8"));
     if (selfPid && s.pid === selfPid)
       return null;
     return s.localPort && s.localToken ? `ws://127.0.0.1:${s.localPort}/?token=${s.localToken}` : null;
@@ -101097,16 +101868,16 @@ function registerRdpEngine() {
 init_credentials();
 import { appendFile, stat as stat8, rename as rename3 } from "node:fs/promises";
 import { join as join65 } from "node:path";
-var MAX_BYTES = 2 * 1024 * 1024;
+var MAX_BYTES2 = 2 * 1024 * 1024;
 function rdeskAuditPath() {
   return join65(daemonDir2(), "rdesk-audit.jsonl");
 }
 var queue = [];
 var draining = false;
-async function rotateIfNeeded(path6) {
+async function rotateIfNeeded2(path6) {
   try {
     const st = await stat8(path6);
-    if (st.size < MAX_BYTES)
+    if (st.size < MAX_BYTES2)
       return;
     await rename3(path6, `${path6}.1`);
   } catch {
@@ -101121,7 +101892,7 @@ async function drain() {
       const batch = queue.join("");
       queue = [];
       const path6 = rdeskAuditPath();
-      await rotateIfNeeded(path6);
+      await rotateIfNeeded2(path6);
       await appendFile(path6, batch, { mode: 384 });
     }
   } catch {
@@ -101140,7 +101911,7 @@ function appendRdeskAudit(e) {
 }
 
 // ../../packages/host-core/dist/fileprovider-bridge.js
-import { writeFileSync as writeFileSync34, mkdirSync as mkdirSync33, rmSync as rmSync8, existsSync as existsSync31 } from "node:fs";
+import { writeFileSync as writeFileSync34, mkdirSync as mkdirSync34, rmSync as rmSync8, existsSync as existsSync32 } from "node:fs";
 import { homedir as homedir9 } from "node:os";
 import { join as join66 } from "node:path";
 var APPEX_BUNDLE_ID = "dev.tesseract.FileProvider";
@@ -101313,7 +102084,7 @@ function stopFileProviderBridge() {
 
 // ../../packages/host-core/dist/vault/autofill-bridge.js
 import { randomBytes as randomBytes9 } from "node:crypto";
-import { existsSync as existsSync32, mkdirSync as mkdirSync34, writeFileSync as writeFileSync35, rmSync as rmSync9 } from "node:fs";
+import { existsSync as existsSync33, mkdirSync as mkdirSync35, writeFileSync as writeFileSync35, rmSync as rmSync9 } from "node:fs";
 import { homedir as homedir10 } from "node:os";
 import { join as join67 } from "node:path";
 
@@ -101388,7 +102159,7 @@ function writeBridgeInfo(port, token3, log9) {
     return;
   const containerData = appexContainerData();
   try {
-    if (!existsSync32(containerData)) {
+    if (!existsSync33(containerData)) {
       if (!infoLoggedOnce) {
         infoLoggedOnce = true;
         log9("autofill bridge-info SKIP: no appex container yet at", containerData);
@@ -101396,7 +102167,7 @@ function writeBridgeInfo(port, token3, log9) {
       return;
     }
     const dir2 = join67(containerData, "Library", "Application Support");
-    mkdirSync34(dir2, { recursive: true });
+    mkdirSync35(dir2, { recursive: true });
     writeFileSync35(bridgeInfoPath(), JSON.stringify({ port, token: token3, pid: process.pid, ts: Date.now() }), { mode: 384 });
     if (!infoLoggedOnce) {
       infoLoggedOnce = true;
@@ -101639,9 +102410,9 @@ function createNodePowerController() {
 
 // ../../packages/host-core/dist/native-host.js
 import { execFileSync as execFileSync4 } from "node:child_process";
-import { chmodSync as chmodSync6, existsSync as existsSync33, mkdirSync as mkdirSync35, writeFileSync as writeFileSync36 } from "node:fs";
+import { chmodSync as chmodSync6, existsSync as existsSync34, mkdirSync as mkdirSync36, writeFileSync as writeFileSync36 } from "node:fs";
 import { homedir as homedir11, platform as platform5 } from "node:os";
-import { dirname as dirname27, join as join68, resolve as resolve12 } from "node:path";
+import { dirname as dirname28, join as join68, resolve as resolve12 } from "node:path";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
 var HOST_NAME = "com.tesseract.companion";
 var EXTENSION_IDS = ["icpnghhpcmaonjckkpilpajblfehpplo", "giolfpookdhjfafcchaflhmigghaeffn"];
@@ -101664,13 +102435,13 @@ function resolveBridge(log9) {
     process.resourcesPath ? join68(process.resourcesPath, "companion-host", BRIDGE_BASENAME) : void 0
   ];
   try {
-    const here = dirname27(fileURLToPath5(import.meta.url));
+    const here = dirname28(fileURLToPath5(import.meta.url));
     candidates.push(resolve12(here, "../../../apps/companion-host/dist", BRIDGE_BASENAME));
     candidates.push(resolve12(here, "../../apps/companion-host/dist", BRIDGE_BASENAME));
   } catch {
   }
   for (const c of candidates)
-    if (c && existsSync33(c))
+    if (c && existsSync34(c))
       return c;
   log9("companion native-host: bridge not found; skipping registration (looked in", candidates.filter(Boolean).join(" , "), ")");
   return null;
@@ -101699,7 +102470,7 @@ function registerNativeHost(opts) {
     if (!bridge)
       return;
     const runtime = opts.runtime ?? process.execPath;
-    mkdirSync35(opts.daemonDir, { recursive: true });
+    mkdirSync36(opts.daemonDir, { recursive: true });
     const launcher = writeLauncher(opts.daemonDir, bridge, runtime);
     const manifestJson = JSON.stringify({
       name: HOST_NAME,
@@ -101712,11 +102483,11 @@ function registerNativeHost(opts) {
       return registerWindows(opts.daemonDir, manifestJson, log9);
     let wrote = 0;
     for (const profile of browserProfileDirs()) {
-      if (!existsSync33(profile))
+      if (!existsSync34(profile))
         continue;
       try {
         const dir2 = join68(profile, "NativeMessagingHosts");
-        mkdirSync35(dir2, { recursive: true });
+        mkdirSync36(dir2, { recursive: true });
         writeFileSync36(join68(dir2, `${HOST_NAME}.json`), manifestJson);
         wrote++;
       } catch {
@@ -101748,7 +102519,7 @@ init_daemon_settings();
 
 // ../../packages/host-core/dist/activity/activity-tracker.js
 init_credentials();
-import { promises as fsp, writeFileSync as writeFileSync37, mkdirSync as mkdirSync36, existsSync as existsSync34 } from "node:fs";
+import { promises as fsp, writeFileSync as writeFileSync37, mkdirSync as mkdirSync37, existsSync as existsSync35 } from "node:fs";
 import { join as join69 } from "node:path";
 function activityProfilePath() {
   return join69(daemonDir2(), "activity-profile.json");
@@ -101826,7 +102597,7 @@ function createActivityTracker(opts = {}) {
         return;
       const key2 = front.bundleId || front.name;
       await ensureLoaded();
-      if (profile && Object.keys(profile.apps).length && !existsSync34(activityProfilePath())) {
+      if (profile && Object.keys(profile.apps).length && !existsSync35(activityProfilePath())) {
         log9("activity profile cleared externally \u2014 resetting in-memory");
         profile = { version: 1, updatedAt: (/* @__PURE__ */ new Date()).toISOString(), apps: {} };
       }
@@ -101862,7 +102633,7 @@ function createActivityTracker(opts = {}) {
         if (profile) {
           pruneProfile(profile);
           profile.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
-          mkdirSync36(daemonDir2(), { recursive: true, mode: 448 });
+          mkdirSync37(daemonDir2(), { recursive: true, mode: 448 });
           writeFileSync37(activityProfilePath(), JSON.stringify(profile), { mode: 384 });
           dirty = 0;
         }
@@ -101933,13 +102704,21 @@ var reporting = false;
 var surface = "daemon";
 var logFn = () => {
 };
-function endpoint() {
-  const e = process.env.CCB_ERROR_ENDPOINT?.replace(/\/$/, "");
-  return e ? `${e}/v1/reports` : null;
+function endpoint(apiOrigin) {
+  const explicit = process.env.CCB_ERROR_ENDPOINT?.trim().replace(/\/$/, "");
+  if (explicit)
+    return `${explicit}/v1/reports`;
+  const origin = apiOrigin?.trim().replace(/\/$/, "");
+  return origin ? `${origin}/api/errors/v1/reports` : null;
 }
 function hasConsent() {
   return process.env.CCB_CRASH_REPORT_CONSENT === "1";
 }
+var LAUNCHER_SURFACES = /* @__PURE__ */ new Set(["daemon", "rdesk", "mesh"]);
+function surfaceFromEnv() {
+  const s = process.env.CCB_ERROR_SURFACE?.trim();
+  return s && LAUNCHER_SURFACES.has(s) ? s : "daemon";
+}
 function initDaemonErrorReporter(opts = {}) {
   if (timer)
     return;
@@ -101990,16 +102769,16 @@ function captureDaemonError(error51, opts = {}) {
       ...opts.context ? { context: opts.context } : {},
       fingerprint: ""
     };
-    const safe = redactError(report);
-    safe.fingerprint = computeFingerprint({
+    const safe2 = redactError(report);
+    safe2.fingerprint = computeFingerprint({
       surface,
-      type: safe.exception.type,
-      message: safe.exception.message,
-      stacktrace: safe.exception.stacktrace
+      type: safe2.exception.type,
+      message: safe2.exception.message,
+      stacktrace: safe2.exception.stacktrace
     });
     if (!hasConsent())
       return;
-    queue2.push(safe);
+    queue2.push(safe2);
     if (queue2.length > MAX_QUEUE)
       queue2.splice(0, queue2.length - MAX_QUEUE);
     if (queue2.length >= 10)
@@ -102016,12 +102795,12 @@ async function flush2() {
     return;
   if (Date.now() < nextAttemptAt)
     return;
-  const url2 = endpoint();
-  if (!url2)
-    return;
   const creds3 = readCredentials();
   if (!creds3?.accessToken)
     return;
+  const url2 = endpoint(creds3.apiOrigin);
+  if (!url2)
+    return;
   sending = true;
   const batch = queue2.slice(0, 20);
   try {
@@ -102072,7 +102851,7 @@ async function runDaemon(opts = {}) {
   };
   const lockHeldByAnother = () => {
     try {
-      const pid = Number(readFileSync45(pidfile(), "utf-8").trim());
+      const pid = Number(readFileSync46(pidfile(), "utf-8").trim());
       return Number.isFinite(pid) && pid > 0 && pid !== process.pid && isAlive2(pid);
     } catch {
       return false;
@@ -102081,8 +102860,8 @@ async function runDaemon(opts = {}) {
   function acquireLock2() {
     const f = pidfile();
     try {
-      if (!existsSync35(daemonDir2()))
-        mkdirSync37(daemonDir2(), { recursive: true, mode: 448 });
+      if (!existsSync36(daemonDir2()))
+        mkdirSync38(daemonDir2(), { recursive: true, mode: 448 });
     } catch {
     }
     for (let attempt = 0; attempt < 2; attempt++) {
@@ -102091,7 +102870,7 @@ async function runDaemon(opts = {}) {
         return true;
       } catch {
         try {
-          const prev = Number(readFileSync45(f, "utf-8").trim());
+          const prev = Number(readFileSync46(f, "utf-8").trim());
           if (!prev)
             return false;
           if (prev !== process.pid && isAlive2(prev))
@@ -102107,7 +102886,7 @@ async function runDaemon(opts = {}) {
   function releaseLock() {
     try {
       const f = pidfile();
-      if (existsSync35(f) && Number(readFileSync45(f, "utf-8").trim()) === process.pid)
+      if (existsSync36(f) && Number(readFileSync46(f, "utf-8").trim()) === process.pid)
         unlinkSync6(f);
     } catch {
     }
@@ -102117,11 +102896,11 @@ async function runDaemon(opts = {}) {
     let lockPid = 0;
     let status2 = {};
     try {
-      lockPid = Number(readFileSync45(pidfile(), "utf-8").trim());
+      lockPid = Number(readFileSync46(pidfile(), "utf-8").trim());
     } catch {
     }
     try {
-      status2 = JSON.parse(readFileSync45(statusFile(), "utf-8"));
+      status2 = JSON.parse(readFileSync46(statusFile(), "utf-8"));
     } catch {
     }
     const statusPid = Number(status2.pid ?? 0);
@@ -102183,7 +102962,7 @@ async function runDaemon(opts = {}) {
       forgetDaemon(p);
     }
     try {
-      if (existsSync35(pidfile()))
+      if (existsSync36(pidfile()))
         unlinkSync6(pidfile());
     } catch {
     }
@@ -102392,7 +103171,7 @@ async function runDaemon(opts = {}) {
     });
   } catch {
   }
-  initDaemonErrorReporter({ surface: "daemon", log: log9 });
+  initDaemonErrorReporter({ surface: surfaceFromEnv(), log: log9 });
   process.on("uncaughtException", (e) => {
     try {
       captureDaemonError(e, { severity: "error", context: { handler: "uncaughtException", keptAlive: true } });
@@ -102554,7 +103333,7 @@ async function runDaemon(opts = {}) {
     }
   } catch {
   }
-  if (ownsMachine)
+  if (ownsMachine && !WE_ARE_RDESK_ONLY)
     setHostDaemonRole(true);
   const localToken = randomBytes10(24).toString("hex");
   const sendToViewer = (kind, sessionId, clientId, msg) => {
@@ -103008,7 +103787,7 @@ async function runDaemon(opts = {}) {
     let freeTicks = 0;
     const lockHolder = () => {
       try {
-        return Number(readFileSync45(pidfile(), "utf-8").trim()) || 0;
+        return Number(readFileSync46(pidfile(), "utf-8").trim()) || 0;
       } catch {
         return 0;
       }
@@ -103213,7 +103992,7 @@ async function runDaemon(opts = {}) {
     if (appPid > 0 && appPid !== process.pid) {
       const quitMarker = () => {
         try {
-          return Number(readFileSync45(join70(daemonDir2(), "app-quit.marker"), "utf-8").trim()) || 0;
+          return Number(readFileSync46(join70(daemonDir2(), "app-quit.marker"), "utf-8").trim()) || 0;
         } catch {
           return 0;
         }
@@ -103238,7 +104017,7 @@ async function runDaemon(opts = {}) {
           log9(`desktop app (pid ${appPid}) is gone with NO clean-quit marker \u2014 reporting`);
           const tail3 = (name) => {
             try {
-              const buf = readFileSync45(join70(daemonDir2(), name), "utf-8");
+              const buf = readFileSync46(join70(daemonDir2(), name), "utf-8");
               return buf.length > 4096 ? buf.slice(-4096) : buf;
             } catch {
               return void 0;
@@ -103272,8 +104051,8 @@ async function runDaemon(opts = {}) {
     const daemonLogFile = join70(daemonDir2(), "daemon.log");
     const capTimer = setInterval(() => {
       try {
-        if (existsSync35(daemonLogFile) && statSync9(daemonLogFile).size > DAEMON_LOG_CAP) {
-          const buf = readFileSync45(daemonLogFile, "utf-8");
+        if (existsSync36(daemonLogFile) && statSync10(daemonLogFile).size > DAEMON_LOG_CAP) {
+          const buf = readFileSync46(daemonLogFile, "utf-8");
           const kept = `\u2026[daemon.log capped at ${(/* @__PURE__ */ new Date()).toISOString()}]\u2026
 ` + buf.slice(-DAEMON_LOG_CAP / 2);
           writeFileSync38(daemonLogFile, kept);
@@ -103604,8 +104383,8 @@ import { platform as platform6 } from "node:os";
 
 // ../../packages/host-core/dist/service/launchd.js
 init_credentials();
-import { writeFileSync as writeFileSync39, existsSync as existsSync36, mkdirSync as mkdirSync38, unlinkSync as unlinkSync7 } from "node:fs";
-import { dirname as dirname28, join as join71 } from "node:path";
+import { writeFileSync as writeFileSync39, existsSync as existsSync37, mkdirSync as mkdirSync39, unlinkSync as unlinkSync7 } from "node:fs";
+import { dirname as dirname29, join as join71 } from "node:path";
 import { homedir as homedir12, userInfo as userInfo2 } from "node:os";
 
 // ../../packages/host-core/dist/service/types.js
@@ -103665,9 +104444,9 @@ ${env}
   }
   return {
     async install(spec) {
-      mkdirSync38(workDirOf(spec), { recursive: true });
-      mkdirSync38(dirname28(plistPath()), { recursive: true });
-      mkdirSync38(dirname28(spec.logPath), { recursive: true });
+      mkdirSync39(workDirOf(spec), { recursive: true });
+      mkdirSync39(dirname29(plistPath()), { recursive: true });
+      mkdirSync39(dirname29(spec.logPath), { recursive: true });
       writeFileSync39(plistPath(), buildPlist(spec));
       await run4("launchctl", ["bootout", serviceTarget()]).catch(() => {
       });
@@ -103680,7 +104459,7 @@ ${env}
     async uninstall() {
       await run4("launchctl", ["bootout", serviceTarget()]).catch(() => {
       });
-      if (existsSync36(plistPath())) {
+      if (existsSync37(plistPath())) {
         try {
           unlinkSync7(plistPath());
         } catch {
@@ -103691,7 +104470,7 @@ ${env}
       await this.install(spec);
     },
     async isInstalled() {
-      return existsSync36(plistPath());
+      return existsSync37(plistPath());
     },
     async start() {
       await run4("launchctl", ["bootstrap", domainTarget(), plistPath()]).catch(() => {
@@ -103708,7 +104487,7 @@ ${env}
     },
     async logs(follow) {
       const f = logFile();
-      if (!existsSync36(f)) {
+      if (!existsSync37(f)) {
         console.log(`No log yet at ${f} \u2014 has the service started?`);
         return;
       }
@@ -103719,8 +104498,8 @@ ${env}
 
 // ../../packages/host-core/dist/service/systemd.js
 init_credentials();
-import { writeFileSync as writeFileSync40, existsSync as existsSync37, mkdirSync as mkdirSync39, unlinkSync as unlinkSync8 } from "node:fs";
-import { dirname as dirname29, join as join72 } from "node:path";
+import { writeFileSync as writeFileSync40, existsSync as existsSync38, mkdirSync as mkdirSync40, unlinkSync as unlinkSync8 } from "node:fs";
+import { dirname as dirname30, join as join72 } from "node:path";
 import { homedir as homedir13, userInfo as userInfo3 } from "node:os";
 function unitVal(v) {
   return v.replace(/%/g, "%%");
@@ -103759,9 +104538,9 @@ WantedBy=default.target
   }
   return {
     async install(spec) {
-      mkdirSync39(workDirOf(spec), { recursive: true });
-      mkdirSync39(dirname29(unitPath()), { recursive: true });
-      mkdirSync39(dirname29(spec.logPath), { recursive: true });
+      mkdirSync40(workDirOf(spec), { recursive: true });
+      mkdirSync40(dirname30(unitPath()), { recursive: true });
+      mkdirSync40(dirname30(spec.logPath), { recursive: true });
       writeFileSync40(unitPath(), buildUnit2(spec));
       await run4("loginctl", ["enable-linger", userInfo3().username]).catch(() => {
       });
@@ -103774,7 +104553,7 @@ WantedBy=default.target
     async uninstall() {
       await run4("systemctl", ["--user", "disable", "--now", unit]).catch(() => {
       });
-      if (existsSync37(unitPath())) {
+      if (existsSync38(unitPath())) {
         try {
           unlinkSync8(unitPath());
         } catch {
@@ -103787,7 +104566,7 @@ WantedBy=default.target
       await this.install(spec);
     },
     async isInstalled() {
-      return existsSync37(unitPath());
+      return existsSync38(unitPath());
     },
     async start() {
       await run4("systemctl", ["--user", "start", unit]);
@@ -103806,8 +104585,8 @@ WantedBy=default.target
 
 // ../../packages/host-core/dist/service/windows.js
 init_credentials();
-import { writeFileSync as writeFileSync41, existsSync as existsSync38, mkdirSync as mkdirSync40, unlinkSync as unlinkSync9 } from "node:fs";
-import { dirname as dirname30, join as join73 } from "node:path";
+import { writeFileSync as writeFileSync41, existsSync as existsSync39, mkdirSync as mkdirSync41, unlinkSync as unlinkSync9 } from "node:fs";
+import { dirname as dirname31, join as join73 } from "node:path";
 function makeWindowsTask(instanceId) {
   const task = `Fineguide\\TesseractHost${instanceId ? `-${instanceId}` : ""}`;
   const wrapperPath = () => join73(daemonDir2(), `run-host${instanceId ? `-${instanceId}` : ""}.cmd`);
@@ -103827,9 +104606,9 @@ start "" /b ${cmd} >> "${oneLine2(spec.logPath).replace(/"/g, "")}" 2>&1\r
   }
   return {
     async install(spec) {
-      mkdirSync40(spec.workingDirectory ?? daemonDir2(), { recursive: true });
-      mkdirSync40(dirname30(spec.logPath), { recursive: true });
-      mkdirSync40(dirname30(wrapperPath()), { recursive: true });
+      mkdirSync41(spec.workingDirectory ?? daemonDir2(), { recursive: true });
+      mkdirSync41(dirname31(spec.logPath), { recursive: true });
+      mkdirSync41(dirname31(wrapperPath()), { recursive: true });
       writeFileSync41(wrapperPath(), buildWrapper(spec));
       await run4("schtasks", ["/Create", "/TN", task, "/SC", "ONLOGON", "/RL", "LIMITED", "/F", "/TR", `"${wrapperPath()}"`]);
       await run4("schtasks", ["/Run", "/TN", task]).catch(() => {
@@ -103838,7 +104617,7 @@ start "" /b ${cmd} >> "${oneLine2(spec.logPath).replace(/"/g, "")}" 2>&1\r
     async uninstall() {
       await run4("schtasks", ["/Delete", "/TN", task, "/F"]).catch(() => {
       });
-      if (existsSync38(wrapperPath())) {
+      if (existsSync39(wrapperPath())) {
         try {
           unlinkSync9(wrapperPath());
         } catch {
@@ -103868,7 +104647,7 @@ start "" /b ${cmd} >> "${oneLine2(spec.logPath).replace(/"/g, "")}" 2>&1\r
     },
     async logs(follow) {
       const f = logFile();
-      if (!existsSync38(f)) {
+      if (!existsSync39(f)) {
         console.log(`No log yet at ${f} \u2014 has the task run?`);
         return;
       }
@@ -103899,7 +104678,7 @@ init_serpapi_runner();
 // src/auth.ts
 var import_qrcode_terminal = __toESM(require_main(), 1);
 import { randomUUID as randomUUID27 } from "node:crypto";
-import { existsSync as existsSync39, rmSync as rmSync10 } from "node:fs";
+import { existsSync as existsSync40, rmSync as rmSync10 } from "node:fs";
 import { join as join74 } from "node:path";
 
 // src/config.ts
@@ -104102,7 +104881,7 @@ async function logout() {
   for (const f of ["credentials.json", "status.json", "daemon.lock"]) {
     try {
       const p = join74(daemonDir2(), f);
-      if (existsSync39(p)) rmSync10(p);
+      if (existsSync40(p)) rmSync10(p);
     } catch {
     }
   }
@@ -104262,7 +105041,7 @@ function startSelfUpdater(current) {
 // src/service.ts
 import { join as join75 } from "node:path";
 import { platform as platform7 } from "node:os";
-import { existsSync as existsSync40, readFileSync as readFileSync46 } from "node:fs";
+import { existsSync as existsSync41, readFileSync as readFileSync47 } from "node:fs";
 function controller(instanceId) {
   const c = getServiceController(instanceId);
   if (!c) {
@@ -104289,8 +105068,8 @@ var isAlive = (pid) => {
 function runningDaemonInfo() {
   const lock = join75(daemonDir2(), "daemon.lock");
   try {
-    if (!existsSync40(lock)) return null;
-    const pid = Number(readFileSync46(lock, "utf-8").trim());
+    if (!existsSync41(lock)) return null;
+    const pid = Number(readFileSync47(lock, "utf-8").trim());
     if (!pid || !isAlive(pid)) return null;
     return { pid, device: readCredentials()?.deviceId };
   } catch {
@@ -104324,7 +105103,7 @@ async function logs(instanceId, follow) {
 }
 
 // src/net.ts
-import { readFileSync as readFileSync48 } from "node:fs";
+import { readFileSync as readFileSync49 } from "node:fs";
 import { randomBytes as randomBytes11 } from "node:crypto";
 import { hostname as hostname7 } from "node:os";
 import { resolve as resolve14 } from "node:path";
@@ -104379,7 +105158,7 @@ function readOrDie(label, p) {
     process.exit(1);
   }
   try {
-    return new Uint8Array(readFileSync48(resolve14(p)));
+    return new Uint8Array(readFileSync49(resolve14(p)));
   } catch (e) {
     console.error(`net enroll: could not read --${label} ${p}: ${e instanceof Error ? e.message : e}`);
     process.exit(1);
@@ -104845,8 +105624,8 @@ async function netCommand(rest, flags) {
 // src/cli.ts
 function pkgVersion() {
   try {
-    const p = join77(dirname31(fileURLToPath6(import.meta.url)), "..", "package.json");
-    return JSON.parse(readFileSync49(p, "utf8")).version ?? "0.0.0";
+    const p = join77(dirname32(fileURLToPath6(import.meta.url)), "..", "package.json");
+    return JSON.parse(readFileSync50(p, "utf8")).version ?? "0.0.0";
   } catch {
     return "0.0.0";
   }
@@ -104949,6 +105728,8 @@ Usage:
   tesseract-agent start | stop | restart  Control the service
   tesseract-agent status                  Show the service status
   tesseract-agent logs [--no-follow]      Tail the service logs
+  tesseract-agent decisions [--session ID] [--source prompt|verification|recovery] [-n N] [--json]
+                                          What unattended mode decided while nobody was watching
   tesseract-agent run [--engine ID] [--engine-path BIN] [--engine-env K=V ...] [--no-active-link]
                                           Run the daemon in the foreground (Docker/manual)
   tesseract-agent link add <folder> --peer <hostId> (--name <shared> | --id <id>)
@@ -105000,6 +105781,36 @@ async function confirm(question) {
     rl.close();
   }
 }
+async function decisionsCommand(flags) {
+  const { readUnattendedDecisions: readUnattendedDecisions2, unattendedLogPath: unattendedLogPath2 } = await Promise.resolve().then(() => (init_unattended_log(), unattended_log_exports));
+  const limit = typeof flags.n === "string" ? Math.max(1, Number.parseInt(flags.n, 10) || 200) : 200;
+  const source = flags.source === "prompt" || flags.source === "verification" || flags.source === "recovery" ? flags.source : void 0;
+  const sessionId = typeof flags.session === "string" ? flags.session : void 0;
+  const rows = readUnattendedDecisions2(limit, { ...sessionId ? { sessionId } : {}, ...source ? { source } : {} });
+  if (flags.json === true) {
+    for (const r of rows) console.log(JSON.stringify(r));
+    return;
+  }
+  if (!rows.length) {
+    console.log(`No unattended decisions recorded yet (${unattendedLogPath2()}).`);
+    return;
+  }
+  for (const r of rows) {
+    const when = r.ts.replace("T", " ").replace(/\.\d+Z$/, "");
+    const who = r.engine ? ` ${r.engine}` : "";
+    if (r.source === "verification") {
+      const flag = r.exercised === false ? " NOT-RUN" : "";
+      console.log(`${when}${who}  verify  ${r.gate} \u2192 ${r.action}  (cycle ${r.cycle}${r.phaseName ? `, ${r.phaseName}` : ""}${r.blocking ? `, ${r.blocking} blocking` : ""})${flag}`);
+    } else if (r.source === "recovery") {
+      console.log(`${when}${who}  recover ${r.kind} \u2192 ${r.action}  (attempt ${r.attempt})${r.reason ? `  ${r.reason}` : ""}`);
+    } else {
+      const why = r.outcome === "answered" ? r.decision ?? "" : `${r.outcome}: ${r.reason ?? ""}`;
+      console.log(`${when}${who}  ${r.mode}  ${r.kind}${r.subject ? `(${r.subject})` : ""} \u2192 ${r.behavior ?? "\u2014"}${r.cappedOut ? " [budget spent]" : ""}  ${why}`);
+    }
+  }
+  console.log(`
+${rows.length} decision(s) \u2014 ${unattendedLogPath2()}`);
+}
 async function linkCommand(rest, flags) {
   const sub = rest[0];
   if (sub === "list") {
@@ -105060,7 +105871,7 @@ async function captureClaudeSubscription(flags) {
     });
     if (code !== 0) throw new Error(`Claude sign-in did not complete (exit ${code}).`);
     const file2 = join77(home, ".credentials.json");
-    if (existsSync42(file2)) return readFileSync49(file2, "utf8");
+    if (existsSync43(file2)) return readFileSync50(file2, "utf8");
     if (process.platform === "darwin") {
       const value = execFileSync6("security", [
         "find-generic-password",
@@ -105142,7 +105953,7 @@ async function runnerCommand(rest, flags) {
       process.exit(1);
     }
     const oauthFilePath = typeof flags["oauth-file"] === "string" ? resolve15(flags["oauth-file"]) : void 0;
-    const oauthAuthFile = oauthFilePath ? readFileSync49(oauthFilePath, "utf8") : void 0;
+    const oauthAuthFile = oauthFilePath ? readFileSync50(oauthFilePath, "utf8") : void 0;
     if (oauthAuthFile) {
       try {
         JSON.parse(oauthAuthFile);
@@ -105251,6 +106062,9 @@ Re-run with --yes to replace it, or --instance <id> to install a SEPARATE agent.
     case "logs":
       await logs(instance, flags["no-follow"] !== true);
       break;
+    case "decisions":
+      await decisionsCommand(flags);
+      break;
     case "link":
       await linkCommand(rest, flags);
       break;