usebeeline 0.0.107 → 0.0.109

package/dist/usebeeline.mjs

@@ -3989,7 +3989,7 @@ import { constants as fsConstants2 } from "node:fs";
 import { access, chmod as chmod5, lstat as lstat3, mkdir as mkdir15, open, readFile as readFile10, rename as rename4, rm as rm6, symlink as symlink3, writeFile as writeFile10 } from "node:fs/promises";
 import { spawn as spawn6 } from "node:child_process";
 import { homedir as homedir9 } from "node:os";
-import { dirname as dirname11, join as join9, resolve as resolve22 } from "node:path";
+import { dirname as dirname11, join as join10, resolve as resolve22 } from "node:path";
 function anchorLayout(rawLibDir) {
   const libDir = resolve22(rawLibDir);
   const segments = libDir.split(/[/\\]/);
@@ -4039,7 +4039,7 @@ function hostPlatformKey() {
   return `${os}-${arch}`;
 }
 function bundleJsonCandidates(bundleDir) {
-  return [join9(bundleDir, "lib", "beeline", "bundle.json"), join9(bundleDir, "bundle.json")];
+  return [join10(bundleDir, "lib", "beeline", "bundle.json"), join10(bundleDir, "bundle.json")];
 }
 async function readBundleJson(bundleDir) {
   let raw;
@@ -4063,7 +4063,7 @@ async function readBundleJson(bundleDir) {
   }
 }
 function updateStatePath(layout) {
-  return join9(layout.releasesRoot, ".state", "update-state.json");
+  return join10(layout.releasesRoot, ".state", "update-state.json");
 }
 async function readUpdateState(layout) {
   try {
@@ -4073,7 +4073,7 @@ async function readUpdateState(layout) {
   }
 }
 async function writeUpdateState(layout, state) {
-  await mkdir15(join9(layout.releasesRoot, ".state"), { recursive: true });
+  await mkdir15(join10(layout.releasesRoot, ".state"), { recursive: true });
   await writeFile10(updateStatePath(layout), `${JSON.stringify(state, null, 2)}
 `, "utf8");
 }
@@ -4155,7 +4155,7 @@ function run(command, args, timeoutMs) {
   });
 }
 function entrypointCandidates(bundleDir) {
-  return [join9(bundleDir, BUNDLE_ENTRYPOINT), join9(bundleDir, "beeline-cli.mjs")];
+  return [join10(bundleDir, BUNDLE_ENTRYPOINT), join10(bundleDir, "beeline-cli.mjs")];
 }
 async function resolveBundleEntrypoint(bundleDir) {
   for (const candidate of entrypointCandidates(bundleDir)) {
@@ -4177,8 +4177,8 @@ async function stageRelease(layout, manifestUrl, published, opts = {}) {
   const fetchImpl = opts.fetchImpl ?? fetch;
   const log2 = opts.logger ?? ((line) => console.log(`[body] self-update: ${line}`));
   const releaseId = sanitizeReleaseId(published.commit ?? published.version ?? `release-${Date.now()}`);
-  const releaseDir = join9(layout.releasesRoot, releaseId);
-  const okMarker = join9(releaseDir, ".stage-ok");
+  const releaseDir = join10(layout.releasesRoot, releaseId);
+  const okMarker = join10(releaseDir, ".stage-ok");
   let previouslyVerified = false;
   try {
     const recorded = await readFile10(okMarker, "utf8");
@@ -4188,7 +4188,7 @@ async function stageRelease(layout, manifestUrl, published, opts = {}) {
   } catch {
   }
   await mkdir15(releaseDir, { recursive: true });
-  const tempArchive = join9(layout.releasesRoot, `.download-${releaseId}-${process.pid}.tar.gz`);
+  const tempArchive = join10(layout.releasesRoot, `.download-${releaseId}-${process.pid}.tar.gz`);
   try {
     log2(`downloading ${published.file}`);
     const response = await fetchImpl(archiveUrlFor(manifestUrl, published.file), {
@@ -4228,13 +4228,13 @@ async function stageRelease(layout, manifestUrl, published, opts = {}) {
       throw new Error(`extracting bundle failed: ${extract2.stderr}`);
     for (const relative3 of requiredBundlePaths()) {
       try {
-        await access(join9(releaseDir, relative3), fsConstants2.F_OK);
+        await access(join10(releaseDir, relative3), fsConstants2.F_OK);
       } catch {
         throw new Error(`staged bundle is missing ${relative3}`);
       }
     }
     if (opts.smokeTestCli !== false) {
-      const probe = await run(process.execPath, [join9(releaseDir, BUNDLE_ENTRYPOINT), "--version"], 6e4);
+      const probe = await run(process.execPath, [join10(releaseDir, BUNDLE_ENTRYPOINT), "--version"], 6e4);
       if (probe.status !== 0) {
         throw new Error(`staged bundle failed its startup smoke test (--version exited ${probe.status})${probe.stderr ? `: ${probe.stderr.trim()}` : ""}`);
       }
@@ -4272,8 +4272,8 @@ async function replaceFile(path, contents, mode) {
   await rename4(temp, path);
 }
 async function activateRelease(layout, releaseId) {
-  const releaseDir = join9(layout.releasesRoot, releaseId);
-  await access(join9(releaseDir, BUNDLE_ENTRYPOINT), fsConstants2.F_OK);
+  const releaseDir = join10(layout.releasesRoot, releaseId);
+  await access(join10(releaseDir, BUNDLE_ENTRYPOINT), fsConstants2.F_OK);
   await mkdir15(layout.releasesRoot, { recursive: true });
   await mkdir15(layout.binDir, { recursive: true });
   let previousReleaseId = await activeReleaseId(layout);
@@ -4281,12 +4281,12 @@ async function activateRelease(layout, releaseId) {
   if (kind === "directory") {
     const legacyIdentity = await readBundleJson(layout.libDir);
     const legacyId = sanitizeReleaseId(legacyIdentity?.commit ?? legacyIdentity?.version ?? `legacy-${Date.now()}`);
-    const legacyDir = join9(layout.releasesRoot, legacyId);
+    const legacyDir = join10(layout.releasesRoot, legacyId);
     try {
       await access(legacyDir, fsConstants2.F_OK);
       previousReleaseId = `${legacyId}-${Date.now()}`;
-      await rename4(layout.libDir, join9(layout.releasesRoot, previousReleaseId));
-      await normalizeLegacyBundleShape(join9(layout.releasesRoot, previousReleaseId));
+      await rename4(layout.libDir, join10(layout.releasesRoot, previousReleaseId));
+      await normalizeLegacyBundleShape(join10(layout.releasesRoot, previousReleaseId));
     } catch {
       await rename4(layout.libDir, legacyDir);
       await normalizeLegacyBundleShape(legacyDir);
@@ -4295,18 +4295,18 @@ async function activateRelease(layout, releaseId) {
   }
   const tempLink = `${layout.libDir}.new-${process.pid}`;
   await rm6(tempLink, { force: true });
-  await symlink3(join9("beeline-releases", releaseId), tempLink);
+  await symlink3(join10("beeline-releases", releaseId), tempLink);
   await rename4(tempLink, layout.libDir);
   await fsyncDir(dirname11(layout.libDir));
   await writeBinForwarders(layout, releaseDir);
   return { previousReleaseId };
 }
 async function normalizeLegacyBundleShape(bundleDir) {
-  const innerLib = join9(bundleDir, "lib", "beeline");
+  const innerLib = join10(bundleDir, "lib", "beeline");
   let anyFlat = false;
   for (const name of LEGACY_FLAT_BUNDLE_FILES) {
     try {
-      await access(join9(bundleDir, name), fsConstants2.F_OK);
+      await access(join10(bundleDir, name), fsConstants2.F_OK);
       anyFlat = true;
       break;
     } catch {
@@ -4317,11 +4317,11 @@ async function normalizeLegacyBundleShape(bundleDir) {
   await mkdir15(innerLib, { recursive: true });
   for (const name of LEGACY_FLAT_BUNDLE_FILES) {
     try {
-      await access(join9(innerLib, name), fsConstants2.F_OK);
+      await access(join10(innerLib, name), fsConstants2.F_OK);
       continue;
     } catch {
     }
-    await rename4(join9(bundleDir, name), join9(innerLib, name)).catch(() => void 0);
+    await rename4(join10(bundleDir, name), join10(innerLib, name)).catch(() => void 0);
   }
 }
 async function writeBinForwarders(layout, activeBundleRoot) {
@@ -4330,13 +4330,13 @@ async function writeBinForwarders(layout, activeBundleRoot) {
     ...Object.entries(FORWARDER_ALIASES).map(([alias, tool]) => [alias, tool])
   ];
   for (const [name, tool] of entries) {
-    const target = join9(activeBundleRoot, "bin", tool);
+    const target = join10(activeBundleRoot, "bin", tool);
     try {
       await access(target, fsConstants2.X_OK);
     } catch {
       continue;
     }
-    await replaceFile(join9(layout.binDir, name), forwarderScript(tool), 493);
+    await replaceFile(join10(layout.binDir, name), forwarderScript(tool), 493);
   }
 }
 async function repairInstallForwarders(layout, opts = {}) {
@@ -4345,7 +4345,7 @@ async function repairInstallForwarders(layout, opts = {}) {
   const forwarderHealthy = async (name, tool) => {
     let current;
     try {
-      current = await readFile10(join9(layout.binDir, name), "utf8");
+      current = await readFile10(join10(layout.binDir, name), "utf8");
     } catch {
       current = void 0;
     }
@@ -4364,19 +4364,19 @@ async function repairInstallForwarders(layout, opts = {}) {
   return true;
 }
 async function rollbackToPreviousRelease(layout, previousReleaseId) {
-  const releaseDir = join9(layout.releasesRoot, previousReleaseId);
+  const releaseDir = join10(layout.releasesRoot, previousReleaseId);
   const entrypoint = await resolveBundleEntrypoint(releaseDir);
   if (!entrypoint) {
     throw new Error(`release ${previousReleaseId} has no runnable CLI entrypoint`);
   }
   const tempLink = `${layout.libDir}.rollback-${process.pid}`;
   await rm6(tempLink, { force: true });
-  await symlink3(join9("beeline-releases", previousReleaseId), tempLink);
+  await symlink3(join10("beeline-releases", previousReleaseId), tempLink);
   await rename4(tempLink, layout.libDir);
   await fsyncDir(dirname11(layout.libDir));
 }
 function updateAttemptPath(layout) {
-  return join9(layout.releasesRoot, ".state", "update-attempt.json");
+  return join10(layout.releasesRoot, ".state", "update-attempt.json");
 }
 async function readUpdateAttempt(layout) {
   try {
@@ -4390,7 +4390,7 @@ async function readUpdateAttempt(layout) {
   }
 }
 async function writeUpdateAttempt(layout, record3) {
-  await mkdir15(join9(layout.releasesRoot, ".state"), { recursive: true });
+  await mkdir15(join10(layout.releasesRoot, ".state"), { recursive: true });
   const path = updateAttemptPath(layout);
   const staged = `${path}.${process.pid}.tmp`;
   await writeFile10(staged, `${JSON.stringify(record3, null, 2)}
@@ -8156,9 +8156,390 @@ async function syncAgentModelCatalog(input) {
   }
 }
 
+// apps/body/dist/connector-google.js
+import { readFileSync as readFileSync3 } from "node:fs";
+import { join as join2 } from "node:path";
+
+// apps/body/dist/google-workspace-client.js
+function credentialsTokenSource(credentials) {
+  return {
+    accessToken: () => Promise.resolve(credentials.accessToken),
+    accountEmail: credentials.accountEmail ? () => credentials.accountEmail : void 0
+  };
+}
+var defaultGoogleApiTransport = {
+  async request(method, url, body, headers) {
+    const response = await fetch(url, {
+      method,
+      headers: {
+        "content-type": "application/json",
+        ...headers
+      },
+      ...body !== void 0 ? { body: JSON.stringify(body) } : {}
+    });
+    let json = null;
+    const text2 = await response.text();
+    if (text2) {
+      try {
+        json = JSON.parse(text2);
+      } catch {
+        json = { raw: text2 };
+      }
+    }
+    return { status: response.status, json };
+  }
+};
+var GoogleApiError = class extends Error {
+  status;
+  detail;
+  constructor(status, detail) {
+    super(`Google API ${status}: ${detail}`);
+    this.status = status;
+    this.detail = detail;
+  }
+};
+var MAX_RESULTS = 25;
+function assertOk(status, json) {
+  if (status >= 200 && status < 300)
+    return;
+  const detail = json && typeof json === "object" && "error" in json ? JSON.stringify(json.error) : `HTTP ${status}`;
+  throw new GoogleApiError(status, detail);
+}
+function rfc822(input) {
+  return `To: ${input.to}\r
+Subject: ${input.subject}\r
+Content-Type: text/plain; charset="UTF-8"\r
+\r
+${input.body}`;
+}
+function googleWorkspaceClient(tokenSource, transport = defaultGoogleApiTransport) {
+  const authorized = {
+    async request(method, url, body) {
+      const token = await tokenSource.accessToken();
+      const response = await transport.request(method, url, body, {
+        authorization: `Bearer ${token}`
+      });
+      if (response.status === 401) {
+        throw new GoogleApiError(401, "access token rejected; reconnect the Google tool");
+      }
+      return response;
+    }
+  };
+  const gmailFetch = async (path) => {
+    const { status, json } = await authorized.request("GET", `https://gmail.googleapis.com/gmail/v1/users/me${path}`);
+    assertOk(status, json);
+    return json;
+  };
+  return {
+    gmail: {
+      async listMessages(query) {
+        const params = new URLSearchParams({ maxResults: String(MAX_RESULTS) });
+        if (query)
+          params.set("q", query);
+        const { status, json } = await authorized.request("GET", `https://gmail.googleapis.com/gmail/v1/users/me/messages?${params}`);
+        assertOk(status, json);
+        const messages = json.messages ?? [];
+        return messages.map((entry) => ({ id: entry.id, snippet: entry.snippet }));
+      },
+      async getMessage(id) {
+        const message = await gmailFetch(`/messages/${encodeURIComponent(id)}?format=metadata`);
+        const snippet = typeof message.snippet === "string" ? message.snippet : void 0;
+        const payload = message.payload;
+        const subject = payload?.headers?.find((header) => header.name === "Subject")?.value;
+        const bodyText = payload?.body?.data !== void 0 ? Buffer.from(payload.body.data, "base64url").toString("utf8") : void 0;
+        return { id, snippet: subject ?? snippet, body: bodyText };
+      },
+      async createDraft(input) {
+        const { status, json } = await authorized.request("POST", "https://gmail.googleapis.com/gmail/v1/users/me/drafts", { message: { raw: Buffer.from(rfc822(input), "utf8").toString("base64url") } });
+        assertOk(status, json);
+        return { id: String(json.id) };
+      },
+      async sendMessage(input) {
+        const raw = Buffer.from(rfc822(input), "utf8").toString("base64url");
+        const { status, json } = await authorized.request("POST", "https://gmail.googleapis.com/gmail/v1/users/me/messages/send", { raw });
+        assertOk(status, json);
+        return { id: String(json.id) };
+      }
+    },
+    calendar: {
+      async listEvents(input) {
+        const params = new URLSearchParams({
+          maxResults: String(input?.maxResults ?? MAX_RESULTS),
+          singleEvents: "true",
+          orderBy: "startTime",
+          timeMin: (/* @__PURE__ */ new Date()).toISOString()
+        });
+        const { status, json } = await authorized.request("GET", `https://www.googleapis.com/calendar/v3/calendars/primary/events?${params}`);
+        assertOk(status, json);
+        const events = json.items ?? [];
+        return events.map((event) => ({
+          id: String(event.id),
+          summary: typeof event.summary === "string" ? event.summary : void 0,
+          start: event.start?.dateTime,
+          end: event.end?.dateTime
+        }));
+      },
+      async createEvent(input) {
+        const { status, json } = await authorized.request("POST", `https://www.googleapis.com/calendar/v3/calendars/${encodeURIComponent(input.calendarId ?? "primary")}/events`, {
+          summary: input.summary,
+          ...input.description ? { description: input.description } : {},
+          start: { dateTime: input.start },
+          end: { dateTime: input.end }
+        });
+        assertOk(status, json);
+        const event = json;
+        return { id: event.id, ...event.htmlLink ? { htmlLink: event.htmlLink } : {} };
+      }
+    },
+    drive: {
+      async searchFiles(query) {
+        const params = new URLSearchParams({
+          q: `name contains '${query.replace(/'/g, "\\'")}' and trashed = false`,
+          pageSize: String(MAX_RESULTS),
+          fields: "files(id,name,mimeType)"
+        });
+        const { status, json } = await authorized.request("GET", `https://www.googleapis.com/drive/v3/files?${params}`);
+        assertOk(status, json);
+        return (json.files ?? []).map((file) => ({
+          id: String(file.id),
+          name: typeof file.name === "string" ? file.name : void 0,
+          mimeType: typeof file.mimeType === "string" ? file.mimeType : void 0
+        }));
+      },
+      async readFile(fileId) {
+        const meta = await authorized.request("GET", `https://www.googleapis.com/drive/v3/files/${encodeURIComponent(fileId)}?fields=id,name`);
+        assertOk(meta.status, meta.json);
+        const content = await authorized.request("GET", `https://www.googleapis.com/drive/v3/files/${encodeURIComponent(fileId)}?alt=media`);
+        assertOk(content.status, content.json);
+        const body = content.json;
+        return {
+          id: fileId,
+          name: meta.json.name,
+          content: body.raw ?? JSON.stringify(content.json)
+        };
+      }
+    },
+    youtube: {
+      async listPlaylists(mine = true) {
+        const params = new URLSearchParams({
+          part: "snippet",
+          maxResults: String(MAX_RESULTS),
+          ...mine ? { mine: "true" } : {}
+        });
+        const { status, json } = await authorized.request("GET", `https://www.googleapis.com/youtube/v3/playlists?${params}`);
+        assertOk(status, json);
+        return (json.items ?? []).map((item) => ({
+          id: String(item.id),
+          title: item.snippet?.title
+        }));
+      },
+      async listPlaylistItems(playlistId) {
+        const params = new URLSearchParams({
+          part: "snippet",
+          maxResults: String(MAX_RESULTS),
+          playlistId
+        });
+        const { status, json } = await authorized.request("GET", `https://www.googleapis.com/youtube/v3/playlistItems?${params}`);
+        assertOk(status, json);
+        return (json.items ?? []).map((item) => ({
+          videoId: String(item.snippet?.resourceId?.videoId ?? item.id),
+          title: item.snippet?.title
+        }));
+      },
+      async getTranscript(videoId) {
+        const params = new URLSearchParams({ lang: "en", v: videoId });
+        const { status, json } = await authorized.request("GET", `https://video.google.com/timedtext?${params}`);
+        if (status < 200 || status >= 300) {
+          throw new GoogleApiError(status, `no caption track could be fetched for ${videoId} (timedtext ${status})`);
+        }
+        const raw = json.raw ?? "";
+        const transcript = raw.replace(/<[^>]+>/g, " ").replace(/\s+/g, " ").trim();
+        if (!transcript) {
+          throw new GoogleApiError(404, `video ${videoId} has no fetchable captions`);
+        }
+        return { videoId, transcript };
+      }
+    },
+    async verify() {
+      try {
+        const { status, json } = await authorized.request("GET", "https://www.googleapis.com/oauth2/v3/userinfo");
+        if (status === 401)
+          return { ok: false, reason: "Google rejected the access token" };
+        assertOk(status, json);
+        const email = json.email;
+        return { ok: true, ...email ? { account: email } : {} };
+      } catch (error) {
+        return {
+          ok: false,
+          reason: error instanceof Error ? error.message : String(error)
+        };
+      }
+    }
+  };
+}
+
+// apps/body/dist/connector-google.js
+var GOOGLE_TOOL_SCOPES = {
+  "google-gmail": [
+    "https://www.googleapis.com/auth/gmail.send",
+    "https://www.googleapis.com/auth/gmail.readonly",
+    "https://www.googleapis.com/auth/gmail.compose"
+  ],
+  "google-calendar": ["https://www.googleapis.com/auth/calendar.events", "https://www.googleapis.com/auth/calendar.readonly"],
+  "google-drive": ["https://www.googleapis.com/auth/drive.readonly"],
+  "google-youtube": ["https://www.googleapis.com/auth/youtube.readonly"]
+};
+function isGoogleToolConnectorType(type) {
+  return type in GOOGLE_TOOL_SCOPES;
+}
+async function readGoogleCredentialsFromVault(mcp) {
+  if (!mcp)
+    return { source: "unavailable", reason: "no Trusty Squire connector is paired" };
+  let raw;
+  try {
+    raw = await mcp.call("google_oauth_credentials", {});
+  } catch (error) {
+    return {
+      source: "unavailable",
+      reason: `Squire has no Google OAuth grant on record yet (connect your Google account in Squire first: ${describe(error)})`
+    };
+  }
+  const record3 = raw && typeof raw === "object" ? raw : {};
+  const inner = record3.credentials && typeof record3.credentials === "object" ? record3.credentials : record3;
+  const accessToken = inner.accessToken ?? inner.access_token;
+  if (!accessToken || typeof accessToken !== "string") {
+    return { source: "unavailable", reason: "Squire returned a Google grant without an access token" };
+  }
+  return {
+    source: "squire",
+    credentials: {
+      accessToken,
+      refreshToken: typeof record3.refreshToken === "string" ? record3.refreshToken : typeof record3.refresh_token === "string" ? record3.refresh_token : void 0,
+      expiresAt: typeof record3.expiresAt === "number" ? record3.expiresAt : void 0,
+      accountEmail: typeof record3.accountEmail === "string" ? record3.accountEmail : typeof record3.email === "string" ? record3.email : void 0
+    }
+  };
+}
+function manualGoogleCredentialsSearchPaths(home) {
+  return [join2(home, "google-credentials.json")];
+}
+function loadManualGoogleCredentials(home, env = process.env) {
+  if (env.BEELINE_GOOGLE_ACCESS_TOKEN) {
+    return {
+      source: "manual",
+      credentials: { accessToken: env.BEELINE_GOOGLE_ACCESS_TOKEN }
+    };
+  }
+  for (const path of manualGoogleCredentialsSearchPaths(home)) {
+    try {
+      const parsed = JSON.parse(readFileSync3(path, "utf8"));
+      if (typeof parsed.accessToken === "string" || typeof parsed.access_token === "string") {
+        return {
+          source: "manual",
+          credentials: {
+            accessToken: parsed.accessToken ?? parsed.access_token,
+            refreshToken: typeof parsed.refreshToken === "string" ? parsed.refreshToken : void 0,
+            accountEmail: typeof parsed.accountEmail === "string" ? parsed.accountEmail : void 0
+          }
+        };
+      }
+    } catch {
+    }
+  }
+  return {
+    source: "manual-missing",
+    reason: `no Google credentials found. Put a google-credentials.json (OAuth access token) at ${manualGoogleCredentialsSearchPaths(home)[0]} or connect your Google account in Trusty Squire first.`
+  };
+}
+var step = (label, status, extra) => ({
+  label,
+  status,
+  ...extra
+});
+function outputTail(text2, maxChars = 800) {
+  const trimmed = text2.trim();
+  return trimmed.length <= maxChars ? trimmed : `\u2026${trimmed.slice(-maxChars)}`;
+}
+async function installGoogleTool(options) {
+  const steps = [step("helper reached", "done")];
+  const emit = () => options.onProgress?.([...steps]);
+  const push = (next) => {
+    steps.push(next);
+    emit();
+  };
+  const fail = (label, reason, output) => {
+    push(step(label, "failed", { reason, ...output ? { output } : {} }));
+    return { status: "error", steps, errorMessage: reason };
+  };
+  emit();
+  if (!isGoogleToolConnectorType(options.connectorType)) {
+    return fail("connector type", `${options.connectorType} is not a Google tool connector`);
+  }
+  push(step("Google credentials resolved", "running", { output: "resolving\u2026" }));
+  const resolved = options.resolvedCredentials ? await options.resolvedCredentials : options.resolveCredentials ? await options.resolveCredentials() : await (async () => {
+    const oneClick = await readGoogleCredentialsFromVault(options.squire);
+    return oneClick.source === "squire" ? { ...oneClick } : { ...loadManualGoogleCredentials(options.home, options.env) };
+  })();
+  if (!("credentials" in resolved)) {
+    const reason = resolved.reason;
+    steps[1] = step("Google credentials resolved", "failed", { reason, output: outputTail(reason) });
+    emit();
+    return { status: "error", steps, errorMessage: reason };
+  }
+  steps[1] = step("Google credentials resolved", "done", {
+    output: resolved.source === "squire" ? "one-click: read the Google grant from Trusty Squire" : "manual: local google-credentials.json"
+  });
+  emit();
+  const client = options.client ?? googleWorkspaceClient(credentialsTokenSource(resolved.credentials));
+  push(step("authorized with Google", "running", { output: "verifying the grant with Google\u2026" }));
+  const verify = await client.verify();
+  if (!verify.ok) {
+    return fail("authorized with Google", verify.reason, outputTail(verify.reason));
+  }
+  steps[2] = step("authorized with Google", "done", {
+    ...verify.account ? { output: `signed in as ${verify.account}` } : {}
+  });
+  emit();
+  push(step("tools enabled", "done", {
+    output: `${GOOGLE_TOOL_SCOPES[options.connectorType].length} Google scopes granted`
+  }));
+  return {
+    status: "connected",
+    steps,
+    ...verify.account ? { signedInAs: verify.account } : {}
+  };
+}
+function describe(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+
 // apps/body/dist/connector-squire.js
 import { execFile, spawn as spawn2 } from "node:child_process";
-var SQUIRE_CONNECT_PACKAGE = "@trusty-squire/mcp@next";
+var SQUIRE_MCP_NAME = "@trusty-squire/mcp";
+var SQUIRE_CONNECT_PACKAGE = `${SQUIRE_MCP_NAME}@latest`;
+var activeConnectSession;
+function isProcessAlive(pid) {
+  if (pid === void 0 || pid <= 0)
+    return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error?.code === "EPERM";
+  }
+}
+function releaseSquireConnectSession(log2) {
+  const claim = activeConnectSession;
+  activeConnectSession = void 0;
+  if (!claim)
+    return;
+  if (isProcessAlive(claim.pid)) {
+    log2?.(`released trusty-squire connect session claim (pid ${String(claim.pid)} still live \u2014 a fresh connect owns the browser now)`);
+    claim.abort();
+  } else {
+    log2?.("cleared dead trusty-squire connect session claim (owner process gone)");
+  }
+}
 var defaultShellRunner = (command, args) => new Promise((resolve31) => {
   execFile(command, [...args], { timeout: 12e4, maxBuffer: 4 * 1024 * 1024, encoding: "utf8" }, (error, stdout6, stderr) => {
     const code = error?.code;
@@ -8180,7 +8561,7 @@ var defaultStreamedRunner = (command, args) => new Promise((resolve31) => {
   const safetyTimer = setTimeout(() => {
     if (!resolved) {
       resolved = true;
-      resolve31({ stdout: stdout6, stderr, signIn: void 0, abort: () => {
+      resolve31({ stdout: stdout6, stderr, pid: child.pid ?? void 0, signIn: void 0, abort: () => {
       } });
     }
     child.kill();
@@ -8189,6 +8570,12 @@ var defaultStreamedRunner = (command, args) => new Promise((resolve31) => {
     clearTimeout(safetyTimer);
     child.kill();
   };
+  const claim = {
+    pid: child.pid ?? void 0,
+    claimedAt: Date.now(),
+    abort
+  };
+  activeConnectSession = claim;
   const finish = (result) => {
     if (!resolved) {
       resolved = true;
@@ -8213,15 +8600,15 @@ ${stderr}`;
     checkOutput();
   });
   child.on("close", () => {
-    finish({ stdout: stdout6, stderr, signIn: void 0, abort: () => {
+    finish({ stdout: stdout6, stderr, pid: child.pid ?? void 0, signIn: void 0, abort: () => {
     } });
   });
   child.on("error", () => {
-    finish({ stdout: stdout6, stderr, signIn: void 0, abort: () => {
+    finish({ stdout: stdout6, stderr, pid: child.pid ?? void 0, signIn: void 0, abort: () => {
     } });
   });
 });
-var step = (label, status, reason) => ({
+var step2 = (label, status, reason) => ({
   label,
   status,
   ...reason ? { reason } : {}
@@ -8238,32 +8625,76 @@ function parseConnectOutput(output) {
   }
   return { method: "streamed-page", url };
 }
-async function installedSquireVersion(run2) {
-  const probe = await run2("npx", ["-y", SQUIRE_CONNECT_PACKAGE, "--version"]);
+async function installedSquireVersion(run2, spec = SQUIRE_CONNECT_PACKAGE, preferOnline = false) {
+  const probe = await run2("npx", [
+    ...preferOnline ? ["--prefer-online"] : [],
+    "-y",
+    spec,
+    "--version"
+  ]);
   const version = probe.stdout.match(/\d+\.\d+\.\d+[^\s]*/)?.[0];
   return version;
 }
+async function currentSquireRelease(run2) {
+  const probe = await run2("npm", ["view", SQUIRE_MCP_NAME, "version"]);
+  if (probe.code !== 0)
+    return void 0;
+  return probe.stdout.match(/\d+\.\d+\.\d+[^\s]*/)?.[0];
+}
+async function resolveSquireConnectSpec(run2) {
+  const currentRelease = await currentSquireRelease(run2);
+  const first = await installedSquireVersion(run2);
+  if (currentRelease === void 0 || first === currentRelease) {
+    return {
+      npxArgs: ["-y", SQUIRE_CONNECT_PACKAGE],
+      ...first !== void 0 ? { resolvedVersion: first } : {},
+      ...currentRelease !== void 0 ? { currentRelease } : {},
+      reResolved: false
+    };
+  }
+  const fresh = await installedSquireVersion(run2, SQUIRE_CONNECT_PACKAGE, true);
+  if (fresh === currentRelease) {
+    return {
+      npxArgs: ["--prefer-online", "-y", SQUIRE_CONNECT_PACKAGE],
+      resolvedVersion: fresh,
+      currentRelease,
+      reResolved: true
+    };
+  }
+  return {
+    npxArgs: ["-y", `${SQUIRE_MCP_NAME}@${currentRelease}`],
+    ...fresh !== void 0 ? { resolvedVersion: fresh } : {},
+    currentRelease,
+    reResolved: true
+  };
+}
 function parseSignedInAs(output) {
   return output.match(/signed in as ([^\s,;]+)/i)?.[1];
 }
 async function installSquire(options) {
   const run2 = options.run ?? defaultShellRunner;
   const streamRun = options.streamRun ?? defaultStreamedRunner;
-  const steps = [step("helper reached", "done")];
+  const log2 = options.log ?? (() => {
+  });
+  const steps = [step2("helper reached", "done")];
   const emit = () => options.onProgress?.([...steps]);
   const push = (next) => {
     steps.push(next);
     emit();
   };
   const fail = (reason) => {
-    steps.push(step("waiting for sign-in", "pending"));
+    steps.push(step2("waiting for sign-in", "pending"));
     emit();
     return { status: "error", steps, errorMessage: reason };
   };
   emit();
+  releaseSquireConnectSession(log2);
+  const resolution = await resolveSquireConnectSpec(run2);
+  if (resolution.reResolved) {
+    log2(`trusty-squire stale copy ${resolution.resolvedVersion ?? "unknown"} re-resolved against current release ${resolution.currentRelease}`);
+  }
   const install = await streamRun("npx", [
-    "-y",
-    SQUIRE_CONNECT_PACKAGE,
+    ...resolution.npxArgs,
     "connect",
     "--force-relogin=google",
     "--target=codex",
@@ -8271,18 +8702,18 @@ async function installSquire(options) {
   ]);
   if (!install.signIn) {
     const stderr = install.stderr.trim();
-    push(step("trusty-squire installed", "failed", stderr || "connect printed no sign-in URL"));
+    push(step2("trusty-squire installed", "failed", stderr || "connect printed no sign-in URL"));
     return fail(stderr || "the trusty-squire connect command printed no sign-in surface");
   }
-  const version = await installedSquireVersion(run2);
-  push(step(`trusty-squire${version ? ` ${version}` : ""} installed`, "done"));
+  const version = resolution.resolvedVersion;
+  push(step2(`trusty-squire${version ? ` ${version}` : ""} installed`, "done"));
   const signIn = install.signIn;
   const signedInAs = parseSignedInAs(`${install.stdout}
 ${install.stderr}`);
-  push(step("waiting for sign-in", "done"));
+  push(step2("waiting for sign-in", "done"));
   const pair = await pairSquire(options.mcp, options.workspaceId);
   if (!pair.ok) {
-    push(step("paired to workspace", "failed", pair.reason));
+    push(step2("paired to workspace", "failed", pair.reason));
     return {
       status: "installing",
       steps,
@@ -8291,7 +8722,7 @@ ${install.stderr}`);
       ...signedInAs ? { signedInAs } : {}
     };
   }
-  push(step("paired to workspace", "done"));
+  push(step2("paired to workspace", "done"));
   return {
     status: "connected",
     steps,
@@ -8431,9 +8862,10 @@ var StdioSquireMcpClient = class {
   }
   initialize() {
     const child = (this.options.spawn ?? spawn3)(this.options.command ?? "npx", [
-      // `@next` RC: only the RC coordinates with a running Trusty Squire broker
-      // for concurrent sessions; stable `latest` cannot share its browser.
-      ...this.options.args ?? ["-y", "@trusty-squire/mcp@next"]
+      // `@latest`: the current release, never a source-level version pin
+      // (captain). Only the vault MCP server the agent spawns; the connect
+      // install path verifies freshness itself (connector-squire.ts).
+      ...this.options.args ?? ["-y", "@trusty-squire/mcp@latest"]
     ]);
     this.child = child;
     this.buffer = "";
@@ -8523,6 +8955,8 @@ var ConnectorAssignmentLoop = class {
   intervalMs;
   log;
   install;
+  installGoogle;
+  googleHomeDir;
   readVaultFn;
   revokeGrantsFn;
   schedule;
@@ -8540,6 +8974,13 @@ var ConnectorAssignmentLoop = class {
     this.log = options.log ?? (() => {
     });
     this.install = options.install ?? installSquire;
+    this.installGoogle = options.installGoogle ?? ((connectorType, onProgress, sharedCredentials) => installGoogleTool({
+      connectorType,
+      home: this.googleHome(),
+      onProgress,
+      resolvedCredentials: sharedCredentials ? sharedCredentials() : this.resolveGoogleCredentials()
+    }));
+    this.googleHomeDir = options.googleHome ?? process.env.BEELINE_AGENT_HOME ?? process.cwd();
     this.readVaultFn = options.readVault ?? readVault;
     this.revokeGrantsFn = options.revokeGrants ?? revokeGrants;
     this.schedule = options.schedule ?? ((fn, ms) => {
@@ -8577,44 +9018,120 @@ var ConnectorAssignmentLoop = class {
       const result = await this.api.execute("getConnectorAssignments", { agentId: this.agentId });
       assignments = result.assignments;
     } catch (error) {
-      this.log(`connector assignments unavailable: ${describe(error)}`);
+      this.log(`connector assignments unavailable: ${describe2(error)}`);
       return;
     }
+    let googleBatch;
     for (const assignment of assignments) {
       const key = `${assignment.kind}:${assignment.connectorId}`;
       if (assignment.kind === "uninstall")
         continue;
+      if (assignment.kind === "install" && isGoogleToolConnectorType(assignment.connectorType)) {
+        if (this.inFlight.has(key))
+          continue;
+        this.inFlight.add(key);
+        (googleBatch ??= []).push(assignment);
+        continue;
+      }
       if (this.inFlight.has(key))
         continue;
       this.inFlight.add(key);
-      void this.handle(assignment).catch((error) => this.log(`connector assignment ${key} failed: ${describe(error)}`)).finally(() => this.inFlight.delete(key));
+      void this.handle(assignment).catch((error) => this.log(`connector assignment ${key} failed: ${describe2(error)}`)).finally(() => this.inFlight.delete(key));
     }
+    if (googleBatch)
+      this.flushGoogleBatch(googleBatch);
+  }
+  flushGoogleBatch(batch) {
+    const keys = batch.map((a2) => `${a2.kind}:${a2.connectorId}`);
+    void this.runGoogleBatch(batch).catch((error) => this.log(`google connector installs failed: ${describe2(error)}`)).finally(() => {
+      for (const key of keys)
+        this.inFlight.delete(key);
+    });
+  }
+  /** The Google tool connectors ride ONE grant: every install in the batch
+   * shares one credential resolution (the single Google consent) and the
+   * installs run one at a time. Each tool still verifies and fails
+   * independently — a grant that cannot serve one tool's scope refuses that
+   * tool alone, never its siblings. */
+  async runGoogleBatch(batch) {
+    let shared;
+    const sharedCredentials = () => shared ??= this.resolveGoogleCredentials();
+    for (const assignment of batch) {
+      await this.runGoogleInstall(assignment.connectorId, assignment.connectorType, sharedCredentials);
+    }
+  }
+  /** The ONE grant resolution shared by every Google tool install of a
+   * drain: the Squire one-click vault path first, then the manual
+   * credentials path. Never rejects — a failure resolves as an unusable
+   * grant each install reports through its own steps. */
+  resolveGoogleCredentials() {
+    return (async () => {
+      try {
+        const oneClick = await readGoogleCredentialsFromVault(this.squire());
+        if (oneClick.source === "squire")
+          return oneClick;
+      } catch (error) {
+        this.log(`google one-click grant lookup failed: ${describe2(error)}`);
+      }
+      return loadManualGoogleCredentials(this.googleHome(), process.env);
+    })();
   }
   squire() {
     this.mcp ??= defaultSquireMcpClient();
     return this.mcp;
   }
   async handle(assignment) {
-    if (assignment.kind === "install")
+    if (assignment.kind === "install") {
       await this.runInstall(assignment.connectorId);
-    else if (assignment.kind === "sync")
+    } else if (assignment.kind === "sync")
       await this.runSync();
     else if (assignment.kind === "revoke-grants")
       await this.runRevoke(assignment.connectorId, assignment.reference);
   }
+  /** Google tool connectors keep their manual credentials next to the runtime. */
+  googleHome() {
+    return this.googleHomeDir;
+  }
+  /** Install one Google tool connector (Gmail/Calendar/Drive/YouTube),
+   * riding the drain's shared grant resolution. */
+  async runGoogleInstall(connectorId, connectorType, sharedCredentials) {
+    const report = async (steps) => {
+      try {
+        await this.api.execute("postConnectorStatus", { agentId: this.agentId, connectorId, steps });
+      } catch (error) {
+        this.log(`step report failed: ${describe2(error)}`);
+      }
+    };
+    const result = await this.installGoogle(connectorType, report, sharedCredentials);
+    if (result.status === "error") {
+      await this.api.execute("postConnectorStatus", {
+        agentId: this.agentId,
+        connectorId,
+        steps: result.steps,
+        errorMessage: result.errorMessage
+      });
+      return;
+    }
+    await this.api.execute("installConnector", {
+      agentId: this.agentId,
+      connectorId,
+      ...result.signedInAs ? { signedInAs: result.signedInAs } : {}
+    });
+  }
   /** Install Trusty Squire, reporting every step as it settles. */
   async runInstall(connectorId) {
     const report = async (steps) => {
       try {
         await this.api.execute("postConnectorStatus", { agentId: this.agentId, connectorId, steps });
       } catch (error) {
-        this.log(`step report failed: ${describe(error)}`);
+        this.log(`step report failed: ${describe2(error)}`);
       }
     };
     const result = await this.install({
       workspaceId: this.agentId,
       mcp: this.squire(),
-      onProgress: report
+      onProgress: report,
+      log: (message) => this.log(`[trusty-squire] ${message}`)
     });
     if (result.status === "error") {
       await this.api.execute("postConnectorStatus", {
@@ -8659,7 +9176,7 @@ var ConnectorAssignmentLoop = class {
     await this.api.execute("postConnectorVault", { agentId: this.agentId, connections });
   }
 };
-function describe(error) {
+function describe2(error) {
   return error instanceof Error ? error.message : String(error);
 }
 
@@ -13109,7 +13626,7 @@ function alphabet(letters) {
   };
 }
 // @__NO_SIDE_EFFECTS__
-function join2(separator = "") {
+function join3(separator = "") {
   astr("join", separator);
   return {
     encode: (from) => {
@@ -13239,8 +13756,8 @@ var base64 = hasBase64Builtin ? {
   decode(s) {
     return decodeBase64Builtin(s, false);
   }
-} : /* @__PURE__ */ chain(/* @__PURE__ */ radix2(6), /* @__PURE__ */ alphabet("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"), /* @__PURE__ */ padding(6), /* @__PURE__ */ join2(""));
-var BECH_ALPHABET = /* @__PURE__ */ chain(/* @__PURE__ */ alphabet("qpzry9x8gf2tvdw0s3jn54khce6mua7l"), /* @__PURE__ */ join2(""));
+} : /* @__PURE__ */ chain(/* @__PURE__ */ radix2(6), /* @__PURE__ */ alphabet("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"), /* @__PURE__ */ padding(6), /* @__PURE__ */ join3(""));
+var BECH_ALPHABET = /* @__PURE__ */ chain(/* @__PURE__ */ alphabet("qpzry9x8gf2tvdw0s3jn54khce6mua7l"), /* @__PURE__ */ join3(""));
 var POLYMOD_GENERATORS = [996825010, 642813549, 513874426, 1027748829, 705979059];
 function bech32Polymod(pre) {
   const b = pre >> 25;
@@ -16845,13 +17362,13 @@ var NegentropyStorageVector = class {
     let count = last - first;
     while (count > 0) {
       let it = first;
-      let step2 = Math.floor(count / 2);
-      it += step2;
+      let step3 = Math.floor(count / 2);
+      it += step3;
       if (cmp(arr[it])) {
         first = ++it;
-        count -= step2 + 1;
+        count -= step3 + 1;
       } else {
-        count = step2;
+        count = step3;
       }
     }
     return first;
@@ -18656,13 +19173,13 @@ function captureConnectionUsage(recorder, turn, calls) {
 import { randomUUID as randomUUID2 } from "node:crypto";
 import { mkdir as mkdir3, writeFile as writeFile4 } from "node:fs/promises";
 import { tmpdir as tmpdir2 } from "node:os";
-import { dirname as dirname5, join as join3 } from "node:path";
+import { dirname as dirname5, join as join4 } from "node:path";
 var CommandExecutionContext = class {
   generationId = randomUUID2();
   path;
   current;
   constructor(root) {
-    this.path = join3(root ?? tmpdir2(), `beeline-command-${this.generationId}.json`);
+    this.path = join4(root ?? tmpdir2(), `beeline-command-${this.generationId}.json`);
   }
   async enter(command) {
     this.current = command;
@@ -18823,18 +19340,18 @@ import { execFile as execFile5 } from "node:child_process";
 import { createHash as createHash5 } from "node:crypto";
 import { mkdir as mkdir12 } from "node:fs/promises";
 import { homedir as homedir7 } from "node:os";
-import { join as join8 } from "node:path";
+import { join as join9 } from "node:path";
 import { promisify as promisify3 } from "node:util";
 
 // apps/body/dist/agent-home.js
-import { existsSync as existsSync3, readFileSync as readFileSync4 } from "node:fs";
+import { existsSync as existsSync3, readFileSync as readFileSync5 } from "node:fs";
 import { createHash as createHash3, randomUUID as randomUUID3 } from "node:crypto";
 import { chmod as chmod2, copyFile, lstat, mkdir as mkdir5, readFile as readFile6, readdir as readdir2, realpath, rename as rename2, rm as rm2, symlink, unlink, writeFile as writeFile6 } from "node:fs/promises";
 import { homedir as homedir5 } from "node:os";
-import { basename as basename3, dirname as dirname6, join as join4, relative as relative2, resolve as resolve13, sep } from "node:path";
+import { basename as basename3, dirname as dirname6, join as join5, relative as relative2, resolve as resolve13, sep } from "node:path";
 
 // apps/body/dist/beeline-skill.js
-import { readFileSync as readFileSync3 } from "node:fs";
+import { readFileSync as readFileSync4 } from "node:fs";
 import { resolve as resolve11 } from "node:path";
 
 // packages/api-contract/dist/agent-pairing-code.js
@@ -18898,7 +19415,7 @@ function beelineCapabilityContextForHarness(agentCommand, repository, directMess
     ...harnessHonorsSessionSystemPrompt(agentCommand) ? {} : { compatibilityTurnPrefix: primer }
   };
 }
-function runningBeelineReleaseId(env = process.env, read = (path) => readFileSync3(path, "utf8")) {
+function runningBeelineReleaseId(env = process.env, read = (path) => readFileSync4(path, "utf8")) {
   try {
     const lib = env.BEELINE_LIB_DIR;
     if (!lib)
@@ -19018,7 +19535,7 @@ Then take exactly one action:
 }
 
 // apps/body/dist/external-mcp-capabilities.js
-var SQUIRE_MCP_VERSION = "next";
+var SQUIRE_MCP_VERSION = "latest";
 var SQUIRE_MCP_PACKAGE = `@trusty-squire/mcp@${SQUIRE_MCP_VERSION}`;
 function isTrustySquireMcpLaunch(command, args = []) {
   return [command, ...args].some((value) => {
@@ -19704,7 +20221,7 @@ async function provisionAgentSkillsAndMcp(root, operatorHome, skillReleaseId, fa
     try {
       const source = resolve13(operatorHome, config.toml);
       const target = resolve13(root, config.dir, "config.toml");
-      const mcpSection = existsSync3(source) ? filteredHarnessMcpToml(readFileSync4(source, "utf8")) : void 0;
+      const mcpSection = existsSync3(source) ? filteredHarnessMcpToml(readFileSync5(source, "utf8")) : void 0;
       const section = config.dir === "codex" ? [CODEX_ROOM_AGENT_LOCKDOWN_TOML, CODEX_ROOM_WEB_SEARCH_TOML, mcpSection].filter(Boolean).join("\n") : mcpSection;
       if (!section) {
         await unlink(target).catch(() => void 0);
@@ -19724,7 +20241,7 @@ async function provisionAgentSkillsAndMcp(root, operatorHome, skillReleaseId, fa
       const source = resolve13(operatorHome, ".config", "goose", name);
       const target = resolve13(gooseConfigDir, name);
       if (existsSync3(source)) {
-        await writeIsolatedHarnessFile(target, readFileSync4(source, "utf8"));
+        await writeIsolatedHarnessFile(target, readFileSync5(source, "utf8"));
       } else {
         await unlink(target).catch(() => void 0);
       }
@@ -19795,7 +20312,7 @@ async function provisionPiCustomModelConfig(root, operatorHome, failClosed, open
     if (resolvedSource !== source) {
       throw new AgentHomeSecurityError(`Pi custom model config resolves through a link: ${source}`);
     }
-    const sourceValue = JSON.parse(readFileSync4(resolvedSource, "utf8"));
+    const sourceValue = JSON.parse(readFileSync5(resolvedSource, "utf8"));
     await writeIsolatedHarnessFile(target, `${JSON.stringify(withOpenRouterModelRouting(sourceValue, pin), null, 2)}
 `);
   } catch (error) {
@@ -19807,7 +20324,7 @@ async function provisionPiCustomModelConfig(root, operatorHome, failClosed, open
 }
 function readClaudeUserScopeMcpServers(path) {
   try {
-    const parsed = JSON.parse(readFileSync4(path, "utf8"));
+    const parsed = JSON.parse(readFileSync5(path, "utf8"));
     if (parsed && typeof parsed.mcpServers === "object" && parsed.mcpServers !== null) {
       return Object.fromEntries(Object.entries(parsed.mcpServers).filter(([name, value]) => {
         if (name === "squire")
@@ -19872,8 +20389,8 @@ async function planManagedSkills(managedSkills, sharedSkills, optionalShares) {
     try {
       const tree = [];
       await walkSafeSkillTree(shared.source, shared.source, {
-        directory: async (rel) => void tree.push(`d ${join4(shared.name, rel)}`),
-        file: async (rel, realPath) => void tree.push(`f ${join4(shared.name, rel)} ${sha2563(await readFile6(realPath))}`)
+        directory: async (rel) => void tree.push(`d ${join5(shared.name, rel)}`),
+        file: async (rel, realPath) => void tree.push(`f ${join5(shared.name, rel)} ${sha2563(await readFile6(realPath))}`)
       });
       entries.push({ kind: "shared", name: shared.name, source: shared.source });
       lines.push(...tree);
@@ -19893,7 +20410,7 @@ async function materializedSkillManifest(target) {
   const visit = async (directory, prefix) => {
     for (const entry of await readdir2(directory)) {
       const path = resolve13(directory, entry);
-      const rel = prefix ? join4(prefix, entry) : entry;
+      const rel = prefix ? join5(prefix, entry) : entry;
       const entryStats = await lstat(path);
       if (entryStats.isSymbolicLink())
         return false;
@@ -20061,7 +20578,7 @@ async function walkSafeSkillTree(source, sourceRoot, visitor, rel = "") {
     for (const entry of await readdir2(resolvedSource)) {
       if (entry === "." || entry === "..")
         throw new Error("invalid shared skill entry");
-      await walkSafeSkillTree(resolve13(source, entry), sourceRoot, visitor, rel ? join4(rel, entry) : entry);
+      await walkSafeSkillTree(resolve13(source, entry), sourceRoot, visitor, rel ? join5(rel, entry) : entry);
     }
     return;
   }
@@ -20134,7 +20651,7 @@ function harnessStateDirsFromEnv(env) {
 
 // apps/body/dist/attachment-delivery.js
 import { mkdir as mkdir6, writeFile as writeFile7 } from "node:fs/promises";
-import { basename as basename4, extname, join as join5 } from "node:path";
+import { basename as basename4, extname, join as join6 } from "node:path";
 var MAX_ATTACHMENT_BYTES = 25 * 1024 * 1024;
 var MEDIA_TTL_HOURS = 24;
 var EXPIRED_REASON = `expired: attachments are kept for ${MEDIA_TTL_HOURS} hours and these bytes are past that window`;
@@ -20178,7 +20695,7 @@ async function deliverAttachments(attachments, dir, fetchImpl = fetch) {
       const bytes = Buffer.from(await response.arrayBuffer());
       if (bytes.length > MAX_ATTACHMENT_BYTES)
         return tooLarge(bytes.length);
-      const path = join5(dir, safeFileName(attachment, index, taken));
+      const path = join6(dir, safeFileName(attachment, index, taken));
       await writeFile7(path, bytes);
       const mimeType = attachment.mimeType ?? response.headers.get("content-type") ?? "";
       if (!mimeType.startsWith("image/"))
@@ -21685,7 +22202,7 @@ process.exit(result.status ?? 1);
 import { createHash as createHash4, randomUUID as randomUUID4 } from "node:crypto";
 import { constants as fsConstants } from "node:fs";
 import { chmod as chmod4, copyFile as copyFile2, link, lstat as lstat2, mkdir as mkdir10, readdir as readdir5, readFile as readFile8, readlink, rename as rename3, rm as rm4, stat as stat2, symlink as symlink2, utimes } from "node:fs/promises";
-import { dirname as dirname7, join as join6, resolve as resolve19 } from "node:path";
+import { dirname as dirname7, join as join7, resolve as resolve19 } from "node:path";
 var STORE_FORMAT = "v1";
 var STAGING_PREFIX = ".beeline-warm-";
 var STAGING_SWEEP_MS = 24 * 60 * 60 * 1e3;
@@ -21773,7 +22290,7 @@ async function seedWarmNodeModules(input) {
     for (const target of placed) {
       await rm4(target, { recursive: true, force: true }).catch(() => void 0);
     }
-    return { reason: "failed", key: plan.key, detail: describe2(error) };
+    return { reason: "failed", key: plan.key, detail: describe3(error) };
   } finally {
     await rm4(staging, { recursive: true, force: true }).catch(() => void 0);
   }
@@ -21816,7 +22333,7 @@ async function harvestWarmNodeModules(input) {
   } catch (error) {
     if (await pathExists(entry))
       return { reason: "already-warm", key: plan.key };
-    return { reason: "failed", key: plan.key, detail: describe2(error) };
+    return { reason: "failed", key: plan.key, detail: describe3(error) };
   } finally {
     await rm4(staging, { recursive: true, force: true }).catch(() => void 0);
   }
@@ -21825,7 +22342,7 @@ async function stagedTreeIsPublishable(worktreePath, staging, key) {
   const settled = await readWarmPlan(worktreePath);
   if (isPlanRefusal(settled) || settled.key !== key)
     return false;
-  const hidden = join6("node_modules", ".package-lock.json");
+  const hidden = join7("node_modules", ".package-lock.json");
   const [copied, current] = await Promise.all([
     readFile8(resolve19(staging, hidden)).catch(() => void 0),
     readFile8(resolve19(worktreePath, hidden)).catch(() => void 0)
@@ -21863,7 +22380,7 @@ async function missingInstalledPackages(worktreePath, treeRoot = worktreePath) {
   return missing.sort();
 }
 async function isInstalledPackage(path) {
-  return stat2(join6(path, "package.json")).then((info) => info.isFile(), () => false);
+  return stat2(join7(path, "package.json")).then((info) => info.isFile(), () => false);
 }
 var INTEGRITY_READ_CONCURRENCY = 64;
 async function mapWithLimit(values, limit, visit) {
@@ -21897,8 +22414,8 @@ function isContainedTreePath(value) {
 async function cloneTree(source, target, file, topLevel = true) {
   await mkdir10(target, { recursive: true, mode: 493 });
   for (const entry of await readdir5(source, { withFileTypes: true })) {
-    const from = join6(source, entry.name);
-    const to = join6(target, entry.name);
+    const from = join7(source, entry.name);
+    const to = join7(target, entry.name);
     if (entry.isSymbolicLink()) {
       await symlink2(await readlink(from), to);
       continue;
@@ -21928,13 +22445,13 @@ async function pruneWarmStore(storeRoot, keep) {
   const names = (await readdir5(storeRoot).catch(() => [])).filter((name) => !name.startsWith(STAGING_PREFIX));
   const entries = [];
   for (const name of names) {
-    const info = await lstat2(join6(storeRoot, name)).catch(() => void 0);
+    const info = await lstat2(join7(storeRoot, name)).catch(() => void 0);
     if (info?.isDirectory())
       entries.push({ name, usedAt: info.mtimeMs });
   }
   const dropped = entries.sort((a2, b) => b.usedAt - a2.usedAt || a2.name.localeCompare(b.name)).slice(keep);
   for (const entry of dropped) {
-    await rm4(join6(storeRoot, entry.name), { recursive: true, force: true }).catch(() => void 0);
+    await rm4(join7(storeRoot, entry.name), { recursive: true, force: true }).catch(() => void 0);
   }
   return dropped.map((entry) => entry.name);
 }
@@ -21943,7 +22460,7 @@ async function sweepStaleStaging(storeRoot, now2) {
   for (const name of entries) {
     if (!name.startsWith(STAGING_PREFIX))
       continue;
-    const path = join6(storeRoot, name);
+    const path = join7(storeRoot, name);
     const info = await lstat2(path).catch(() => void 0);
     if (!info || now2 - info.mtimeMs < STAGING_SWEEP_MS)
       continue;
@@ -21959,14 +22476,14 @@ async function deviceOf(path) {
 async function isDirectory(path) {
   return stat2(path).then((info) => info.isDirectory(), () => false);
 }
-function describe2(error) {
+function describe3(error) {
   return error instanceof Error ? error.message : String(error);
 }
 
 // apps/body/dist/monolith-room-turn.js
 import { mkdir as mkdir11 } from "node:fs/promises";
 import { homedir as homedir6 } from "node:os";
-import { join as join7 } from "node:path";
+import { join as join8 } from "node:path";
 
 // packages/api-contract/dist/scheduled-prompts.js
 var SCHEDULE_SCHEDULER_NAME = "Beeline Scheduler";
@@ -22169,7 +22686,7 @@ var MonolithRoomTurnLoop = class {
     const cached = this.deliveredAttachments.get(item.id);
     if (cached)
       return cached;
-    const delivered = await deliverAttachments(item.attachments, join7(this.attachmentDir, item.id.replace(/[^\w-]/g, "_")), this.options.fetchImpl);
+    const delivered = await deliverAttachments(item.attachments, join8(this.attachmentDir, item.id.replace(/[^\w-]/g, "_")), this.options.fetchImpl);
     this.deliveredAttachments.set(item.id, withoutImageData(delivered));
     return delivered;
   }
@@ -22265,7 +22782,7 @@ var MonolithRoomTurnLoop = class {
     }, selection);
     const operatorHome = this.options.config.operatorHome ?? homedir6();
     const { stateDirs, tmpDir } = harnessStateDirsFromEnv(agentEnv);
-    this.attachmentDir = tmpDir ? join7(tmpDir, "beeline-attachments") : void 0;
+    this.attachmentDir = tmpDir ? join8(tmpDir, "beeline-attachments") : void 0;
     this.sessionScratchDir = tmpDir;
     this.sessionStateDirs = stateDirs;
     const homeStateDirs = harnessHomeStateDirs(command, agentEnv.HOME ?? operatorHome);
@@ -23168,7 +23685,7 @@ var MonolithCornerTurnLoop = class {
     }, selection);
     const operatorHome = this.options.config.operatorHome ?? homedir7();
     const { stateDirs, tmpDir } = harnessStateDirsFromEnv(agentEnv);
-    this.attachmentDir = tmpDir ? join8(tmpDir, "beeline-attachments") : void 0;
+    this.attachmentDir = tmpDir ? join9(tmpDir, "beeline-attachments") : void 0;
     this.sessionScratchDir = tmpDir;
     const homeStateDirs = harnessHomeStateDirs(command, agentEnv.HOME ?? operatorHome);
     await Promise.all(homeStateDirs.map((dir) => mkdir12(dir, { recursive: true })));
@@ -23389,7 +23906,7 @@ var MonolithCornerTurnLoop = class {
           const [conversation, roster, delivered] = await trace.measure("context-fetch", () => Promise.all([
             api.execute("getRoomConversation", { roomId: cornerId, limit: 200 }),
             this.roster(),
-            this.attachmentDir && attachments.length ? deliverAttachments(attachments, join8(this.attachmentDir, requestId.replace(/[^\w-]/g, "_")), this.options.fetchImpl) : Promise.resolve([])
+            this.attachmentDir && attachments.length ? deliverAttachments(attachments, join9(this.attachmentDir, requestId.replace(/[^\w-]/g, "_")), this.options.fetchImpl) : Promise.resolve([])
           ]));
           const names = new Map(roster.members.map((member) => [member.identityId, member.name]));
           const requestedBy = requester && !requester.name && names.get(requester.pubkey) ? { ...requester, name: names.get(requester.pubkey) } : requester;
@@ -27195,7 +27712,7 @@ async function runUpdateFunctionalProbe(input) {
 
 // apps/body/dist/current-release-probe.js
 import { spawn as spawn9 } from "node:child_process";
-import { dirname as dirname16, join as join10 } from "node:path";
+import { dirname as dirname16, join as join11 } from "node:path";
 init_self_update();
 var CURRENT_RELEASE_PROBE_TIMEOUT_MS = 12e4;
 var UPDATE_PROBE_COMMAND = "update-probe";
@@ -27238,7 +27755,7 @@ function outcomeFromReport(report) {
   }
 }
 async function probeReleaseInSubprocess(input) {
-  const bundleDir = join10(input.layout.releasesRoot, input.releaseId);
+  const bundleDir = join11(input.layout.releasesRoot, input.releaseId);
   const entrypoint = await resolveBundleEntrypoint(bundleDir);
   if (!entrypoint) {
     return { kind: "unavailable", reason: `release ${input.releaseId} has no runnable CLI entrypoint` };
@@ -27301,7 +27818,7 @@ async function runUpdateProbeCommand(args, options = {}) {
   const runtime = await readRuntimeRecord(configPath);
   const agent = runtimeAgentCommand(runtime);
   const config = loadBodyConfig({
-    workspaceRoot: join10(dirname16(configPath), "workspace"),
+    workspaceRoot: join11(dirname16(configPath), "workspace"),
     llmEnvFile: runtime.llmEnvFile,
     env: { ...env, BUZZ_AGENT_BIN: agent.command, BUZZ_DEV_MCP_BIN: runtime.mcpBinary },
     agent
@@ -27327,7 +27844,7 @@ async function runUpdateProbeCommand(args, options = {}) {
     sandboxRequired: runtime.sandbox !== "off",
     sandboxUnavailableDetail: sandbox.advisory,
     // The successor's probe still holds `<runtimeDir>/update-functional-probe`.
-    probeRoot: join10(runtimeDir, "current-release-probe")
+    probeRoot: join11(runtimeDir, "current-release-probe")
   }));
   const report = outcome.kind === "served" ? { probe: "served" } : outcome.kind === "refused" ? { probe: "refused", status: outcome.status, reason: outcome.reason } : outcome.kind === "sandbox-unavailable" ? { probe: "sandbox-unavailable", reason: outcome.reason } : { probe: "failed", reason: outcome.reason };
   write(JSON.stringify(report));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "usebeeline",
-  "version": "0.0.107",
+  "version": "0.0.109",
   "description": "Connect an AI coding agent to Beeline with one command.",
   "homepage": "https://usebeeline.app",
   "bugs": {