usebeeline 0.0.114 → 0.0.115

package/dist/usebeeline.mjs

@@ -2415,7 +2415,7 @@ var require_websocket = __commonJS({
     var http = __require("http");
     var net2 = __require("net");
     var tls = __require("tls");
-    var { randomBytes: randomBytes7, createHash: createHash9 } = __require("crypto");
+    var { randomBytes: randomBytes7, createHash: createHash10 } = __require("crypto");
     var { Duplex, Readable } = __require("stream");
     var { URL: URL2 } = __require("url");
     var PerMessageDeflate2 = require_permessage_deflate();
@@ -3083,7 +3083,7 @@ var require_websocket = __commonJS({
           abortHandshake(websocket, socket, "Invalid Upgrade header");
           return;
         }
-        const digest = createHash9("sha1").update(key + GUID).digest("base64");
+        const digest = createHash10("sha1").update(key + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest) {
           abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -3452,7 +3452,7 @@ var require_websocket_server = __commonJS({
     var EventEmitter2 = __require("events");
     var http = __require("http");
     var { Duplex } = __require("stream");
-    var { createHash: createHash9 } = __require("crypto");
+    var { createHash: createHash10 } = __require("crypto");
     var extension2 = require_extension();
     var PerMessageDeflate2 = require_permessage_deflate();
     var subprotocol2 = require_subprotocol();
@@ -3759,7 +3759,7 @@ var require_websocket_server = __commonJS({
           );
         }
         if (this._state > RUNNING) return abortHandshake(socket, 503);
-        const digest = createHash9("sha1").update(key + GUID).digest("base64");
+        const digest = createHash10("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -3984,14 +3984,14 @@ __export(self_update_exports, {
   writeUpdateAttemptFixture: () => writeUpdateAttemptFixture,
   writeUpdateState: () => writeUpdateState
 });
-import { createHash as createHash7 } from "node:crypto";
+import { createHash as createHash8 } from "node:crypto";
 import { constants as fsConstants2 } from "node:fs";
 import { access, chmod as chmod5, lstat as lstat3, mkdir as mkdir15, open, readFile as readFile10, rename as rename4, rm as rm6, symlink as symlink3, writeFile as writeFile10 } from "node:fs/promises";
-import { spawn as spawn7 } from "node:child_process";
-import { homedir as homedir9 } from "node:os";
-import { dirname as dirname11, join as join10, resolve as resolve22 } from "node:path";
+import { spawn as spawn8 } from "node:child_process";
+import { homedir as homedir10 } from "node:os";
+import { dirname as dirname12, join as join11, resolve as resolve23 } from "node:path";
 function anchorLayout(rawLibDir) {
-  const libDir = resolve22(rawLibDir);
+  const libDir = resolve23(rawLibDir);
   const segments = libDir.split(/[/\\]/);
   const idx = segments.lastIndexOf(RELEASES_SEGMENT);
   if (idx >= 2 && segments[idx - 1] === "lib") {
@@ -4007,9 +4007,9 @@ function anchorLayout(rawLibDir) {
     // prefix's bin, NOT <prefix>/lib/bin — deriving it one level up was the
     // defect that made activateRelease write its stable forwarders where
     // nothing executed them, leaving stale raw wrappers in <prefix>/bin.
-    binDir: resolve22(libDir, "../../bin"),
+    binDir: resolve23(libDir, "../../bin"),
     libDir,
-    releasesRoot: resolve22(libDir, `../${RELEASES_SEGMENT}`)
+    releasesRoot: resolve23(libDir, `../${RELEASES_SEGMENT}`)
   };
 }
 function beelineInstallLayout(env = process.env) {
@@ -4019,8 +4019,8 @@ function beelineInstallLayout(env = process.env) {
   return anchorLayout(raw);
 }
 function defaultBeelineInstallLayout(env = process.env) {
-  const home = env.HOME?.trim() || homedir9();
-  return anchorLayout(resolve22(home, ".local", "lib", "beeline"));
+  const home = env.HOME?.trim() || homedir10();
+  return anchorLayout(resolve23(home, ".local", "lib", "beeline"));
 }
 function discoveredBeelineInstallLayout(env = process.env) {
   const explicitAnchor = env.BEELINE_INSTALL_LIB_DIR?.trim();
@@ -4028,7 +4028,7 @@ function discoveredBeelineInstallLayout(env = process.env) {
     return anchorLayout(explicitAnchor);
   const explicitBinDir = env.BEELINE_INSTALL_DIR?.trim();
   if (explicitBinDir)
-    return anchorLayout(resolve22(dirname11(resolve22(explicitBinDir)), "lib", "beeline"));
+    return anchorLayout(resolve23(dirname12(resolve23(explicitBinDir)), "lib", "beeline"));
   return defaultBeelineInstallLayout(env);
 }
 function hostPlatformKey() {
@@ -4039,7 +4039,7 @@ function hostPlatformKey() {
   return `${os}-${arch}`;
 }
 function bundleJsonCandidates(bundleDir) {
-  return [join10(bundleDir, "lib", "beeline", "bundle.json"), join10(bundleDir, "bundle.json")];
+  return [join11(bundleDir, "lib", "beeline", "bundle.json"), join11(bundleDir, "bundle.json")];
 }
 async function readBundleJson(bundleDir) {
   let raw;
@@ -4063,7 +4063,7 @@ async function readBundleJson(bundleDir) {
   }
 }
 function updateStatePath(layout) {
-  return join10(layout.releasesRoot, ".state", "update-state.json");
+  return join11(layout.releasesRoot, ".state", "update-state.json");
 }
 async function readUpdateState(layout) {
   try {
@@ -4073,7 +4073,7 @@ async function readUpdateState(layout) {
   }
 }
 async function writeUpdateState(layout, state) {
-  await mkdir15(join10(layout.releasesRoot, ".state"), { recursive: true });
+  await mkdir15(join11(layout.releasesRoot, ".state"), { recursive: true });
   await writeFile10(updateStatePath(layout), `${JSON.stringify(state, null, 2)}
 `, "utf8");
 }
@@ -4137,7 +4137,7 @@ async function fetchText(url, fetchImpl) {
 }
 function run(command, args, timeoutMs) {
   return new Promise((resolveRun) => {
-    const child = spawn7(command, args, { stdio: ["ignore", "ignore", "pipe"] });
+    const child = spawn8(command, args, { stdio: ["ignore", "ignore", "pipe"] });
     let stderr = "";
     child.stderr?.setEncoding("utf8");
     child.stderr?.on("data", (chunk) => {
@@ -4155,7 +4155,7 @@ function run(command, args, timeoutMs) {
   });
 }
 function entrypointCandidates(bundleDir) {
-  return [join10(bundleDir, BUNDLE_ENTRYPOINT), join10(bundleDir, "beeline-cli.mjs")];
+  return [join11(bundleDir, BUNDLE_ENTRYPOINT), join11(bundleDir, "beeline-cli.mjs")];
 }
 async function resolveBundleEntrypoint(bundleDir) {
   for (const candidate of entrypointCandidates(bundleDir)) {
@@ -4177,8 +4177,8 @@ async function stageRelease(layout, manifestUrl, published, opts = {}) {
   const fetchImpl = opts.fetchImpl ?? fetch;
   const log2 = opts.logger ?? ((line) => console.log(`[body] self-update: ${line}`));
   const releaseId = sanitizeReleaseId(published.commit ?? published.version ?? `release-${Date.now()}`);
-  const releaseDir = join10(layout.releasesRoot, releaseId);
-  const okMarker = join10(releaseDir, ".stage-ok");
+  const releaseDir = join11(layout.releasesRoot, releaseId);
+  const okMarker = join11(releaseDir, ".stage-ok");
   let previouslyVerified = false;
   try {
     const recorded = await readFile10(okMarker, "utf8");
@@ -4188,7 +4188,7 @@ async function stageRelease(layout, manifestUrl, published, opts = {}) {
   } catch {
   }
   await mkdir15(releaseDir, { recursive: true });
-  const tempArchive = join10(layout.releasesRoot, `.download-${releaseId}-${process.pid}.tar.gz`);
+  const tempArchive = join11(layout.releasesRoot, `.download-${releaseId}-${process.pid}.tar.gz`);
   try {
     log2(`downloading ${published.file}`);
     const response = await fetchImpl(archiveUrlFor(manifestUrl, published.file), {
@@ -4197,7 +4197,7 @@ async function stageRelease(layout, manifestUrl, published, opts = {}) {
     if (!response.ok || !response.body) {
       throw new Error(`downloading ${published.file} failed: HTTP ${response.status}`);
     }
-    const hash = createHash7("sha256");
+    const hash = createHash8("sha256");
     const chunks = [];
     for await (const chunk of response.body) {
       const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
@@ -4210,7 +4210,7 @@ async function stageRelease(layout, manifestUrl, published, opts = {}) {
     }
     await writeFile10(tempArchive, Buffer.concat(chunks), { mode: 384 });
     const entries = (await new Promise((resolveList, rejectList) => {
-      const child = spawn7("tar", ["-tzf", tempArchive], { stdio: ["ignore", "pipe", "inherit"] });
+      const child = spawn8("tar", ["-tzf", tempArchive], { stdio: ["ignore", "pipe", "inherit"] });
       let out = "";
       child.stdout?.on("data", (chunk) => {
         out += chunk.toString("utf8");
@@ -4228,13 +4228,13 @@ async function stageRelease(layout, manifestUrl, published, opts = {}) {
       throw new Error(`extracting bundle failed: ${extract2.stderr}`);
     for (const relative3 of requiredBundlePaths()) {
       try {
-        await access(join10(releaseDir, relative3), fsConstants2.F_OK);
+        await access(join11(releaseDir, relative3), fsConstants2.F_OK);
       } catch {
         throw new Error(`staged bundle is missing ${relative3}`);
       }
     }
     if (opts.smokeTestCli !== false) {
-      const probe = await run(process.execPath, [join10(releaseDir, BUNDLE_ENTRYPOINT), "--version"], 6e4);
+      const probe = await run(process.execPath, [join11(releaseDir, BUNDLE_ENTRYPOINT), "--version"], 6e4);
       if (probe.status !== 0) {
         throw new Error(`staged bundle failed its startup smoke test (--version exited ${probe.status})${probe.stderr ? `: ${probe.stderr.trim()}` : ""}`);
       }
@@ -4272,8 +4272,8 @@ async function replaceFile(path, contents, mode) {
   await rename4(temp, path);
 }
 async function activateRelease(layout, releaseId) {
-  const releaseDir = join10(layout.releasesRoot, releaseId);
-  await access(join10(releaseDir, BUNDLE_ENTRYPOINT), fsConstants2.F_OK);
+  const releaseDir = join11(layout.releasesRoot, releaseId);
+  await access(join11(releaseDir, BUNDLE_ENTRYPOINT), fsConstants2.F_OK);
   await mkdir15(layout.releasesRoot, { recursive: true });
   await mkdir15(layout.binDir, { recursive: true });
   let previousReleaseId = await activeReleaseId(layout);
@@ -4281,12 +4281,12 @@ async function activateRelease(layout, releaseId) {
   if (kind === "directory") {
     const legacyIdentity = await readBundleJson(layout.libDir);
     const legacyId = sanitizeReleaseId(legacyIdentity?.commit ?? legacyIdentity?.version ?? `legacy-${Date.now()}`);
-    const legacyDir = join10(layout.releasesRoot, legacyId);
+    const legacyDir = join11(layout.releasesRoot, legacyId);
     try {
       await access(legacyDir, fsConstants2.F_OK);
       previousReleaseId = `${legacyId}-${Date.now()}`;
-      await rename4(layout.libDir, join10(layout.releasesRoot, previousReleaseId));
-      await normalizeLegacyBundleShape(join10(layout.releasesRoot, previousReleaseId));
+      await rename4(layout.libDir, join11(layout.releasesRoot, previousReleaseId));
+      await normalizeLegacyBundleShape(join11(layout.releasesRoot, previousReleaseId));
     } catch {
       await rename4(layout.libDir, legacyDir);
       await normalizeLegacyBundleShape(legacyDir);
@@ -4295,18 +4295,18 @@ async function activateRelease(layout, releaseId) {
   }
   const tempLink = `${layout.libDir}.new-${process.pid}`;
   await rm6(tempLink, { force: true });
-  await symlink3(join10("beeline-releases", releaseId), tempLink);
+  await symlink3(join11("beeline-releases", releaseId), tempLink);
   await rename4(tempLink, layout.libDir);
-  await fsyncDir(dirname11(layout.libDir));
+  await fsyncDir(dirname12(layout.libDir));
   await writeBinForwarders(layout, releaseDir);
   return { previousReleaseId };
 }
 async function normalizeLegacyBundleShape(bundleDir) {
-  const innerLib = join10(bundleDir, "lib", "beeline");
+  const innerLib = join11(bundleDir, "lib", "beeline");
   let anyFlat = false;
   for (const name of LEGACY_FLAT_BUNDLE_FILES) {
     try {
-      await access(join10(bundleDir, name), fsConstants2.F_OK);
+      await access(join11(bundleDir, name), fsConstants2.F_OK);
       anyFlat = true;
       break;
     } catch {
@@ -4317,11 +4317,11 @@ async function normalizeLegacyBundleShape(bundleDir) {
   await mkdir15(innerLib, { recursive: true });
   for (const name of LEGACY_FLAT_BUNDLE_FILES) {
     try {
-      await access(join10(innerLib, name), fsConstants2.F_OK);
+      await access(join11(innerLib, name), fsConstants2.F_OK);
       continue;
     } catch {
     }
-    await rename4(join10(bundleDir, name), join10(innerLib, name)).catch(() => void 0);
+    await rename4(join11(bundleDir, name), join11(innerLib, name)).catch(() => void 0);
   }
 }
 async function writeBinForwarders(layout, activeBundleRoot) {
@@ -4330,13 +4330,13 @@ async function writeBinForwarders(layout, activeBundleRoot) {
     ...Object.entries(FORWARDER_ALIASES).map(([alias, tool]) => [alias, tool])
   ];
   for (const [name, tool] of entries) {
-    const target = join10(activeBundleRoot, "bin", tool);
+    const target = join11(activeBundleRoot, "bin", tool);
     try {
       await access(target, fsConstants2.X_OK);
     } catch {
       continue;
     }
-    await replaceFile(join10(layout.binDir, name), forwarderScript(tool), 493);
+    await replaceFile(join11(layout.binDir, name), forwarderScript(tool), 493);
   }
 }
 async function repairInstallForwarders(layout, opts = {}) {
@@ -4345,7 +4345,7 @@ async function repairInstallForwarders(layout, opts = {}) {
   const forwarderHealthy = async (name, tool) => {
     let current;
     try {
-      current = await readFile10(join10(layout.binDir, name), "utf8");
+      current = await readFile10(join11(layout.binDir, name), "utf8");
     } catch {
       current = void 0;
     }
@@ -4364,19 +4364,19 @@ async function repairInstallForwarders(layout, opts = {}) {
   return true;
 }
 async function rollbackToPreviousRelease(layout, previousReleaseId) {
-  const releaseDir = join10(layout.releasesRoot, previousReleaseId);
+  const releaseDir = join11(layout.releasesRoot, previousReleaseId);
   const entrypoint = await resolveBundleEntrypoint(releaseDir);
   if (!entrypoint) {
     throw new Error(`release ${previousReleaseId} has no runnable CLI entrypoint`);
   }
   const tempLink = `${layout.libDir}.rollback-${process.pid}`;
   await rm6(tempLink, { force: true });
-  await symlink3(join10("beeline-releases", previousReleaseId), tempLink);
+  await symlink3(join11("beeline-releases", previousReleaseId), tempLink);
   await rename4(tempLink, layout.libDir);
-  await fsyncDir(dirname11(layout.libDir));
+  await fsyncDir(dirname12(layout.libDir));
 }
 function updateAttemptPath(layout) {
-  return join10(layout.releasesRoot, ".state", "update-attempt.json");
+  return join11(layout.releasesRoot, ".state", "update-attempt.json");
 }
 async function readUpdateAttempt(layout) {
   try {
@@ -4390,7 +4390,7 @@ async function readUpdateAttempt(layout) {
   }
 }
 async function writeUpdateAttempt(layout, record3) {
-  await mkdir15(join10(layout.releasesRoot, ".state"), { recursive: true });
+  await mkdir15(join11(layout.releasesRoot, ".state"), { recursive: true });
   const path = updateAttemptPath(layout);
   const staged = `${path}.${process.pid}.tmp`;
   await writeFile10(staged, `${JSON.stringify(record3, null, 2)}
@@ -4668,7 +4668,7 @@ function configureNetworkFamilyDefaults(network = net) {
 configureNetworkFamilyDefaults();
 
 // apps/body/dist/cli.js
-import { dirname as dirname17, resolve as resolve30 } from "node:path";
+import { dirname as dirname18, resolve as resolve31 } from "node:path";
 import { readFile as readFile15, unlink as unlink5, writeFile as writeFile16 } from "node:fs/promises";
 import { stdin as stdin4, stdout as stdout5 } from "node:process";
 
@@ -6079,13 +6079,496 @@ ${r2}
 var import_picocolors3 = __toESM(require_picocolors(), 1);
 
 // apps/body/dist/config.js
-import { accessSync as accessSync2, constants as constants2, existsSync as existsSync2, readFileSync } from "node:fs";
+import { accessSync as accessSync2, constants as constants2, existsSync as existsSync3, readFileSync } from "node:fs";
 import { basename, dirname, resolve as resolve2 } from "node:path";
 
 // apps/body/dist/agent-command.js
-import { accessSync, constants, existsSync, readdirSync } from "node:fs";
+import { accessSync, constants, existsSync as existsSync2, readdirSync } from "node:fs";
 import { homedir } from "node:os";
 import { delimiter, isAbsolute, join, resolve } from "node:path";
+
+// apps/body/dist/cursor-acp-bridge.js
+import { spawn as spawn2 } from "node:child_process";
+import { existsSync } from "node:fs";
+import { createRequire } from "node:module";
+import { createInterface as createInterface2 } from "node:readline";
+import { resolve as resolvePath } from "node:path";
+import { fileURLToPath } from "node:url";
+import { randomUUID } from "node:crypto";
+
+// apps/body/dist/cursor-models.js
+import { spawn } from "node:child_process";
+var CURSOR_MODELS_TIMEOUT_MS = 1e4;
+function parseCursorModelsOutput(output) {
+  const options = [];
+  for (const line of output.split(/\r?\n/)) {
+    const match = /^\s*([A-Za-z0-9][A-Za-z0-9._-]*)\s+-\s+(\S.*?)\s*$/.exec(line);
+    if (!match)
+      continue;
+    const id = match[1];
+    const name = match[2].replace(/\s*\(current, default\)\s*$/i, "").trim();
+    options.push({ id, ...name && name !== id ? { name } : {} });
+  }
+  if (!options.length)
+    return void 0;
+  return {
+    currentValue: options.some((option) => option.id === "auto") ? "auto" : options[0].id,
+    options
+  };
+}
+async function enumerateCursorModels(env = process.env) {
+  return new Promise((resolve32) => {
+    const child = spawn("cursor-agent", ["models"], {
+      env,
+      stdio: ["ignore", "pipe", "ignore"]
+    });
+    let output = "";
+    const timer = setTimeout(() => {
+      child.kill("SIGKILL");
+    }, CURSOR_MODELS_TIMEOUT_MS);
+    child.stdout?.on("data", (chunk) => {
+      output += chunk.toString();
+    });
+    child.on("error", () => {
+      clearTimeout(timer);
+      resolve32(void 0);
+    });
+    child.on("close", (code) => {
+      clearTimeout(timer);
+      resolve32(code === 0 ? parseCursorModelsOutput(output) : void 0);
+    });
+  });
+}
+
+// apps/body/dist/cursor-acp-bridge.js
+var CURSOR_ACP_BRIDGE_FLAG = "--cursor-acp-bridge";
+var CURSOR_ACP_BRIDGE_LABEL = "cursor-acp-bridge";
+var CURSOR_AGENT_FORCE_FLAG = "--force";
+var CURSOR_AGENT_TRUST_FLAG = "--trust";
+var CURSOR_HARNESS_COMMAND = /(^|[/\\])(cursor-acp-bridge|cursor-agent-acp)(\.[a-z]+)?$/i;
+var STDERR_TAIL_MAX_CHARS = 2e3;
+var MODEL_AXIS_ID = "model";
+function harnessIdentityLabel(agent) {
+  if (agent.kind === "cursor")
+    return CURSOR_ACP_BRIDGE_LABEL;
+  return agent.command ?? "";
+}
+function cursorAcpBridgeLaunch() {
+  const meta = "usebeeline:npm";
+  if (meta === "beeline:bundle" || meta.startsWith("beeline:")) {
+    const entry = process.argv[1];
+    if (!entry) {
+      throw new Error("Cursor ACP bridge cannot resolve the Beeline CLI entry");
+    }
+    return { command: process.execPath, args: [entry, CURSOR_ACP_BRIDGE_FLAG] };
+  }
+  const js = fileURLToPath(new URL("./cursor-acp-bridge.js", meta));
+  const ts = fileURLToPath(new URL("./cursor-acp-bridge.ts", meta));
+  if (existsSync(js))
+    return { command: process.execPath, args: [js] };
+  if (existsSync(ts)) {
+    const tsx = createRequire(meta).resolve("tsx");
+    return { command: process.execPath, args: ["--import", tsx, ts] };
+  }
+  throw new Error("Cursor ACP bridge entry not found next to the Beeline helper");
+}
+function cursorAgentArgv(input) {
+  const argv = [
+    "--print",
+    "--output-format",
+    "stream-json",
+    CURSOR_AGENT_TRUST_FLAG,
+    CURSOR_AGENT_FORCE_FLAG
+  ];
+  if (input.model && input.model !== "auto")
+    argv.push("--model", input.model);
+  argv.push(input.prompt);
+  return argv;
+}
+function asRecord(value) {
+  return value && typeof value === "object" ? value : void 0;
+}
+function textChunksFromContent(content) {
+  if (typeof content === "string" && content)
+    return [content];
+  if (!Array.isArray(content))
+    return [];
+  const chunks = [];
+  for (const block2 of content) {
+    const record3 = asRecord(block2);
+    if (!record3)
+      continue;
+    if (record3.type === "text" && typeof record3.text === "string" && record3.text) {
+      chunks.push(record3.text);
+    }
+  }
+  return chunks;
+}
+function thoughtText(event) {
+  if (typeof event.text === "string")
+    return event.text;
+  const record3 = asRecord(event);
+  if (!record3)
+    return "";
+  if (typeof record3.delta === "string")
+    return record3.delta;
+  return textChunksFromContent(record3.content).join("");
+}
+function assistantTexts(event) {
+  if (typeof event.text === "string" && event.text)
+    return [event.text];
+  const message = asRecord(event.message);
+  if (message)
+    return textChunksFromContent(message.content);
+  return textChunksFromContent(asRecord(event)?.content);
+}
+function chunkUpdate(sessionUpdate, text2) {
+  return { sessionUpdate, content: { type: "text", text: text2 } };
+}
+function translateCursorStreamEvent(event) {
+  if (event.type === "thinking") {
+    if (event.subtype === "completed")
+      return [];
+    const text2 = thoughtText(event);
+    return text2 ? [chunkUpdate("agent_thought_chunk", text2)] : [];
+  }
+  if (event.type === "assistant") {
+    return assistantTexts(event).map((text2) => chunkUpdate("agent_message_chunk", text2));
+  }
+  return [];
+}
+function resultEventText(event) {
+  if (typeof event.result === "string")
+    return event.result;
+  const record3 = asRecord(event.result);
+  if (record3 && typeof record3.text === "string")
+    return record3.text;
+  return "";
+}
+function isCursorResultEvent(event) {
+  return event.type === "result";
+}
+function cursorResultIsError(event) {
+  return event.is_error === true || event.subtype === "error";
+}
+function trimReason(value) {
+  return value.replace(/\s+/g, " ").trim().slice(0, 200);
+}
+function describeCursorTurnFailure(input) {
+  if (input.spawnError) {
+    return trimReason(`cursor-agent failed to start: ${input.spawnError}`);
+  }
+  const stderr = input.stderr?.trim() ?? "";
+  if (input.isError) {
+    const named = input.resultText?.trim() || stderr || "cursor-agent reported an error with no answer text";
+    return trimReason(`cursor-agent reported an error: ${named}`);
+  }
+  if (input.signal) {
+    return trimReason(`cursor-agent terminated by ${input.signal}${stderr ? `: ${stderr}` : ""}`);
+  }
+  if (input.exitCode !== 0 && input.exitCode !== null) {
+    return trimReason(`cursor-agent exited ${input.exitCode}${stderr ? `: ${stderr}` : " with no answer text"}`);
+  }
+  return void 0;
+}
+function promptTextFromParams(params, systemPrompt) {
+  const record3 = asRecord(params);
+  const blocks = Array.isArray(record3?.prompt) ? record3.prompt : [];
+  const user = blocks.map((block2) => {
+    const item = asRecord(block2);
+    return item?.type === "text" && typeof item.text === "string" ? item.text : "";
+  }).filter(Boolean).join("\n");
+  return systemPrompt ? `${systemPrompt}
+
+${user}` : user;
+}
+function defaultSpawnCursorAgent(input) {
+  return spawn2("cursor-agent", input.argv, {
+    cwd: input.cwd,
+    env: input.env,
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+}
+var CursorAcpServer = class {
+  write;
+  spawnCursorAgent;
+  enumerateModels;
+  env;
+  sessions = /* @__PURE__ */ new Map();
+  models;
+  modelsLoaded = false;
+  constructor(options) {
+    this.write = options.write;
+    this.spawnCursorAgent = options.spawnCursorAgent ?? defaultSpawnCursorAgent;
+    this.enumerateModels = options.enumerateModels ?? enumerateCursorModels;
+    this.env = options.env ?? process.env;
+  }
+  async handle(message) {
+    const method = typeof message.method === "string" ? message.method : "";
+    const id = message.id;
+    if (!method)
+      return;
+    if (id === void 0) {
+      if (method === "session/cancel")
+        this.cancel(message.params);
+      return;
+    }
+    try {
+      const result = await this.dispatch(method, message.params);
+      this.write({ jsonrpc: "2.0", id, result });
+    } catch (error) {
+      const rpcError = error;
+      this.write({
+        jsonrpc: "2.0",
+        id,
+        error: {
+          code: typeof rpcError.code === "number" ? rpcError.code : -32e3,
+          message: error instanceof Error ? error.message : String(error)
+        }
+      });
+    }
+  }
+  async dispatch(method, params) {
+    switch (method) {
+      case "initialize":
+        return {
+          protocolVersion: 1,
+          agentCapabilities: { promptCapabilities: { image: false } }
+        };
+      case "session/new":
+        return this.sessionNew(params);
+      case "session/prompt":
+        return this.sessionPrompt(params);
+      case "session/set_config_option":
+        return this.setConfigOption(params);
+      case "session/set_model":
+        return this.setModel(params);
+      case "shutdown":
+        this.shutdown();
+        return {};
+      default:
+        return {};
+    }
+  }
+  async loadModels() {
+    if (this.modelsLoaded) {
+      return this.models ?? { currentValue: "auto", options: [{ id: "auto", name: "Auto" }] };
+    }
+    this.modelsLoaded = true;
+    this.models = await this.enumerateModels(this.env);
+    return this.models ?? { currentValue: "auto", options: [{ id: "auto", name: "Auto" }] };
+  }
+  async sessionNew(params) {
+    const record3 = asRecord(params);
+    const cwd = typeof record3?.cwd === "string" && record3.cwd ? record3.cwd : process.cwd();
+    const systemPrompt = typeof record3?.systemPrompt === "string" ? record3.systemPrompt : void 0;
+    const catalog = await this.loadModels();
+    const session = {
+      id: randomUUID(),
+      cwd,
+      ...systemPrompt ? { systemPrompt } : {},
+      model: catalog.currentValue
+    };
+    this.sessions.set(session.id, session);
+    return {
+      sessionId: session.id,
+      configOptions: [
+        {
+          id: MODEL_AXIS_ID,
+          category: "model",
+          currentValue: session.model,
+          options: catalog.options.map((option) => ({
+            id: option.id,
+            ...option.name ? { name: option.name } : {}
+          }))
+        }
+      ]
+    };
+  }
+  session(params) {
+    const record3 = asRecord(params);
+    const sessionId = typeof record3?.sessionId === "string" ? record3.sessionId : "";
+    const session = this.sessions.get(sessionId);
+    if (!session) {
+      const error = new Error(`unknown ACP session ${sessionId || "(missing)"}`);
+      error.code = -32602;
+      throw error;
+    }
+    return session;
+  }
+  setConfigOption(params) {
+    const session = this.session(params);
+    const record3 = asRecord(params);
+    if (record3?.configId === MODEL_AXIS_ID && typeof record3.value === "string" && record3.value) {
+      session.model = record3.value;
+    }
+    return {};
+  }
+  setModel(params) {
+    const session = this.session(params);
+    const record3 = asRecord(params);
+    if (typeof record3?.modelId === "string" && record3.modelId)
+      session.model = record3.modelId;
+    return {};
+  }
+  emitUpdate(sessionId, update) {
+    this.write({
+      jsonrpc: "2.0",
+      method: "session/update",
+      params: { sessionId, update }
+    });
+  }
+  async sessionPrompt(params) {
+    const session = this.session(params);
+    if (session.child) {
+      throw new Error("cursor-agent is already running a turn for this session");
+    }
+    const prompt = promptTextFromParams(params, session.systemPrompt);
+    const argv = cursorAgentArgv({ prompt, model: session.model });
+    let stderr = "";
+    let spawnError;
+    let sawAssistant = false;
+    let resultEvent;
+    const pending = [];
+    const consumeLine = (line) => {
+      const trimmed = line.trim();
+      if (!trimmed)
+        return;
+      let event;
+      try {
+        event = JSON.parse(trimmed);
+      } catch {
+        return;
+      }
+      if (isCursorResultEvent(event)) {
+        resultEvent = event;
+        return;
+      }
+      for (const update of translateCursorStreamEvent(event)) {
+        if (update.sessionUpdate === "agent_message_chunk")
+          sawAssistant = true;
+        this.emitUpdate(session.id, update);
+      }
+    };
+    const child = this.spawnCursorAgent({ argv, cwd: session.cwd, env: this.env });
+    session.child = child;
+    child.stderr?.setEncoding("utf8");
+    child.stderr?.on("data", (chunk) => {
+      stderr = `${stderr}${chunk}`.slice(-STDERR_TAIL_MAX_CHARS);
+    });
+    child.stdout?.setEncoding("utf8");
+    child.stdout?.on("data", (chunk) => {
+      pending.push(chunk);
+      const joined = pending.join("");
+      const lines = joined.split(/\r?\n/);
+      pending.length = 0;
+      const rest = lines.pop();
+      if (rest)
+        pending.push(rest);
+      for (const line of lines)
+        consumeLine(line);
+    });
+    try {
+      const { code, signal } = await new Promise((resolve32) => {
+        let settled = false;
+        const finish = (exitCode, exitSignal) => {
+          if (settled)
+            return;
+          settled = true;
+          resolve32({ code: exitCode, signal: exitSignal });
+        };
+        child.once("error", (error) => {
+          spawnError = error instanceof Error ? error.message : String(error);
+          finish(1, null);
+        });
+        child.once("close", (exitCode, exitSignal) => {
+          finish(exitCode, exitSignal);
+        });
+      });
+      if (pending.length)
+        consumeLine(pending.join(""));
+      const failure = describeCursorTurnFailure({
+        isError: resultEvent ? cursorResultIsError(resultEvent) : false,
+        resultText: resultEvent ? resultEventText(resultEvent) : void 0,
+        exitCode: spawnError ? 1 : code,
+        signal,
+        stderr,
+        spawnError
+      });
+      if (failure)
+        throw new Error(failure);
+      if (!sawAssistant) {
+        const fallback = resultEvent && !cursorResultIsError(resultEvent) ? resultEventText(resultEvent) : "";
+        if (fallback)
+          this.emitUpdate(session.id, chunkUpdate("agent_message_chunk", fallback));
+      }
+      return { stopReason: "end_turn" };
+    } finally {
+      session.child = void 0;
+    }
+  }
+  cancel(params) {
+    const record3 = asRecord(params);
+    const sessionId = typeof record3?.sessionId === "string" ? record3.sessionId : "";
+    const session = this.sessions.get(sessionId);
+    if (!session?.child?.pid)
+      return;
+    try {
+      session.child.kill("SIGTERM");
+    } catch {
+    }
+  }
+  shutdown() {
+    for (const session of this.sessions.values()) {
+      if (!session.child?.pid)
+        continue;
+      try {
+        session.child.kill("SIGTERM");
+      } catch {
+      }
+    }
+    this.sessions.clear();
+  }
+};
+async function runCursorAcpStdioServer(options = {}) {
+  const server = new CursorAcpServer({
+    ...options,
+    write: (message) => {
+      process.stdout.write(`${JSON.stringify(message)}
+`);
+    }
+  });
+  const lines = createInterface2({ input: process.stdin });
+  for await (const line of lines) {
+    const trimmed = line.trim();
+    if (!trimmed)
+      continue;
+    let message;
+    try {
+      message = JSON.parse(trimmed);
+    } catch {
+      continue;
+    }
+    await server.handle(message);
+    if (message.method === "shutdown")
+      break;
+  }
+}
+function isDirectBridgeRun() {
+  const entry = process.argv[1];
+  if (!entry || entry.includes(".test."))
+    return false;
+  try {
+    return resolvePath(entry) === resolvePath(fileURLToPath("usebeeline:npm"));
+  } catch {
+    return false;
+  }
+}
+if (isDirectBridgeRun()) {
+  void runCursorAcpStdioServer();
+}
+
+// apps/body/dist/agent-command.js
 var AGENT_KINDS = [
   "codex",
   "claude",
@@ -6117,10 +6600,6 @@ var ADAPTER_INSTALL_COMMANDS = {
   pi: {
     command: "npm",
     args: ["install", "-g", "pi-acp"]
-  },
-  cursor: {
-    command: "npm",
-    args: ["install", "-g", "cursor-agent-acp"]
   }
 };
 function adapterInstallHint(kind) {
@@ -6190,7 +6669,7 @@ function describeExecutableSearch(env = process.env) {
   return augmentedSearchDirectories(env).join(", ");
 }
 function firstExisting(paths) {
-  return paths.find((path) => path && existsSync(path));
+  return paths.find((path) => path && existsSync2(path));
 }
 function executableOnPath(name, env = process.env) {
   for (const directory of augmentedSearchDirectories(env)) {
@@ -6303,8 +6782,8 @@ function resolveAgentCommand(opts) {
   }
   if (typedKind === "cursor") {
     requireExecutable("cursor-agent", env, cwd, "Cursor Agent CLI not found. Install it from https://cursor.com/docs/cli, then retry with `--agent cursor`.");
-    const command2 = requireExecutable("cursor-agent-acp", env, cwd, `Cursor ACP adapter not found. Install it with \`${adapterInstallHint("cursor")}\`, then retry with \`--agent cursor\`.`);
-    return { kind: typedKind, command: command2, args: [] };
+    const bridge = cursorAcpBridgeLaunch();
+    return { kind: typedKind, command: bridge.command, args: bridge.args };
   }
   if (typedKind === "grok") {
     const command2 = requireExecutable("grok", env, cwd, "Grok CLI not found. Install it with `curl -fsSL https://x.ai/cli/install.sh | bash`, then retry with `--agent grok`.");
@@ -6341,7 +6820,7 @@ function detectInstalledAgentCommands(opts = {}) {
         agent: resolveAgentCommand({ kind, env, cwd: opts.cwd })
       });
     } catch {
-      if (kind !== "goose" && kind !== "grok") {
+      if (kind !== "goose" && kind !== "grok" && kind !== "cursor") {
         detected.push({
           kind,
           status: "missing-adapter",
@@ -6365,7 +6844,7 @@ function formatAdapterInstallCommand(install) {
 // apps/body/dist/config.js
 function firstExisting2(paths) {
   for (const p of paths) {
-    if (p && existsSync2(p))
+    if (p && existsSync3(p))
       return p;
   }
   return void 0;
@@ -6418,7 +6897,7 @@ function resolveReadonlyMcpCommand(env = process.env) {
   if (binary)
     return { command: binary, args: [] };
   const script = env.BEELINE_READONLY_MCP_SCRIPT;
-  if (script && existsSync2(script))
+  if (script && existsSync3(script))
     return { command: process.execPath, args: [script] };
   const built = firstExisting2([
     resolve2(process.cwd(), "apps", "body", "dist", "read-only-mcp.js"),
@@ -6453,7 +6932,7 @@ function resolveCodegraphCommand(env = process.env) {
 }
 function parseEnvFile(path) {
   const out = {};
-  if (!existsSync2(path))
+  if (!existsSync3(path))
     return out;
   const text2 = readFileSync(path, "utf8");
   for (const raw of text2.split("\n")) {
@@ -6694,7 +7173,7 @@ import { tmpdir } from "node:os";
 import { resolve as resolve4 } from "node:path";
 
 // apps/body/dist/acp.js
-import { spawn } from "node:child_process";
+import { spawn as spawn3 } from "node:child_process";
 import { EventEmitter } from "node:events";
 
 // apps/body/dist/harness-capabilities.js
@@ -6775,10 +7254,10 @@ var PROFILES = [
     }
   },
   {
-    match: /(^|[/\\])cursor-agent-acp(\.[a-z]+)?$/i,
+    match: CURSOR_HARNESS_COMMAND,
     profile: {
       enforcement: "config-isolated",
-      note: "cursor-agent-acp bridges cursor-agent to ACP; cursor-agent loads MCP servers from ~/.cursor/mcp.json, so an isolated CURSOR_HOME scopes the session"
+      note: "cursor-acp-bridge drives cursor-agent; cursor-agent loads MCP servers from ~/.cursor/mcp.json, so an isolated CURSOR_HOME scopes the session"
     }
   }
 ];
@@ -6800,7 +7279,7 @@ function matchProfile(agentCommand) {
 }
 
 // apps/body/dist/acp.js
-var STDERR_TAIL_MAX_CHARS = 2e3;
+var STDERR_TAIL_MAX_CHARS2 = 2e3;
 function braceDelta(line) {
   let delta = 0;
   for (const char of line) {
@@ -7015,7 +7494,7 @@ function agentStreamSnapshot(updates, agentLabel) {
   const completedMessages = [];
   let messageText2 = "";
   let lastWasMessage = false;
-  let thoughtText = "";
+  let thoughtText2 = "";
   let thoughtRunOpen = false;
   for (const { update } of updates) {
     const kind = typeof update.sessionUpdate === "string" ? update.sessionUpdate : "";
@@ -7044,8 +7523,8 @@ function agentStreamSnapshot(updates, agentLabel) {
       if (!delta)
         continue;
       if (!thoughtRunOpen)
-        thoughtText = "";
-      thoughtText += delta;
+        thoughtText2 = "";
+      thoughtText2 += delta;
       thoughtRunOpen = true;
     } else {
       thoughtRunOpen = false;
@@ -7053,7 +7532,7 @@ function agentStreamSnapshot(updates, agentLabel) {
   }
   return {
     messageText: messageText2,
-    ...thoughtText || completedMessages.length ? { thoughtText: thoughtText || completedMessages.at(-1) } : {}
+    ...thoughtText2 || completedMessages.length ? { thoughtText: thoughtText2 || completedMessages.at(-1) } : {}
   };
 }
 function toolCallEntries(updates) {
@@ -7139,7 +7618,7 @@ var AcpClient = class extends EventEmitter {
   async start(timeoutMs = 6e4) {
     if (this.alive)
       return;
-    this.child = spawn(this.agentCommand, this.agentArgs, {
+    this.child = spawn3(this.agentCommand, this.agentArgs, {
       // agentEnv is the child's whole environment: buildAgentEnv's allowlist is
       // a real boundary, not a decorative one layered over a full inherit.
       env: this.inheritProcessEnv ? { ...process.env, ...this.agentEnv } : this.agentEnv,
@@ -7154,7 +7633,7 @@ var AcpClient = class extends EventEmitter {
     this.stderrTail = "";
     this.child.stderr.setEncoding("utf8");
     this.child.stderr.on("data", (chunk) => {
-      this.stderrTail = (this.stderrTail + chunk).slice(-STDERR_TAIL_MAX_CHARS);
+      this.stderrTail = (this.stderrTail + chunk).slice(-STDERR_TAIL_MAX_CHARS2);
       this.emit("stderr", chunk);
     });
     this.child.stdout.setEncoding("utf8");
@@ -7553,7 +8032,7 @@ var AcpClient = class extends EventEmitter {
     const current = this.activeRunIds.get(sessionId);
     if (current)
       return Promise.resolve(current);
-    return new Promise((resolve31, reject) => {
+    return new Promise((resolve32, reject) => {
       const onUpdate = (update) => {
         if (update.sessionId !== sessionId)
           return;
@@ -7561,7 +8040,7 @@ var AcpClient = class extends EventEmitter {
         if (!runId)
           return;
         cleanup();
-        resolve31(runId);
+        resolve32(runId);
       };
       const timer = setTimeout(() => {
         cleanup();
@@ -7645,13 +8124,13 @@ var AcpClient = class extends EventEmitter {
     }
     const id = this.nextId++;
     const payload = { jsonrpc: "2.0", id, method, params };
-    return new Promise((resolve31, reject) => {
+    return new Promise((resolve32, reject) => {
       const timer = setTimeout(() => {
         this.pending.delete(id);
         reject(new AcpRequestTimeoutError(method, timeoutMs, this.stderrTail, Boolean(onStart), detail));
       }, timeoutMs);
       this.pending.set(id, {
-        resolve: resolve31,
+        resolve: resolve32,
         reject,
         timer,
         method,
@@ -8170,8 +8649,8 @@ async function syncAgentModelCatalog(input) {
 }
 
 // apps/body/dist/connector-google.js
-import { readFileSync as readFileSync3 } from "node:fs";
-import { join as join2 } from "node:path";
+import { readFileSync as readFileSync4 } from "node:fs";
+import { join as join3 } from "node:path";
 
 // apps/body/dist/google-workspace-client.js
 function credentialsTokenSource(credentials) {
@@ -8391,182 +8870,164 @@ function googleWorkspaceClient(tokenSource, transport = defaultGoogleApiTranspor
   };
 }
 
-// apps/body/dist/connector-google.js
-var GOOGLE_TOOL_SCOPES = {
-  "google-gmail": [
-    "https://www.googleapis.com/auth/gmail.send",
-    "https://www.googleapis.com/auth/gmail.readonly",
-    "https://www.googleapis.com/auth/gmail.compose"
-  ],
-  "google-calendar": ["https://www.googleapis.com/auth/calendar.events", "https://www.googleapis.com/auth/calendar.readonly"],
-  "google-drive": ["https://www.googleapis.com/auth/drive.readonly"],
-  "google-youtube": ["https://www.googleapis.com/auth/youtube.readonly"]
-};
-function isGoogleToolConnectorType(type) {
-  return type in GOOGLE_TOOL_SCOPES;
+// apps/body/dist/connector-squire.js
+import { execFile, spawn as spawn4 } from "node:child_process";
+import { createHash as createHash2 } from "node:crypto";
+import { lstatSync as lstatSync2, readFileSync as readFileSync3, realpathSync, rmSync } from "node:fs";
+import { homedir as homedir2, hostname, tmpdir as tmpdir2 } from "node:os";
+import { basename as basename3, dirname as dirname2, join as join2, resolve as resolve6 } from "node:path";
+var SQUIRE_MCP_NAME = "@trusty-squire/mcp";
+var SQUIRE_CONNECT_PACKAGE = `${SQUIRE_MCP_NAME}@latest`;
+var activeConnectSession;
+function squireConnectSession() {
+  return activeConnectSession;
 }
-async function readGoogleCredentialsFromVault(mcp) {
-  if (!mcp)
-    return { source: "unavailable", reason: "no Trusty Squire connector is paired" };
-  let raw;
+function isProcessAlive(pid) {
+  if (pid === void 0 || pid <= 0)
+    return false;
   try {
-    raw = await mcp.call("google_oauth_credentials", {});
+    process.kill(pid, 0);
+    return true;
   } catch (error) {
-    return {
-      source: "unavailable",
-      reason: `Squire has no Google OAuth grant on record yet (connect your Google account in Squire first: ${describe(error)})`
-    };
+    return error?.code === "EPERM";
   }
-  const record3 = raw && typeof raw === "object" ? raw : {};
-  const inner = record3.credentials && typeof record3.credentials === "object" ? record3.credentials : record3;
-  const accessToken = inner.accessToken ?? inner.access_token;
-  if (!accessToken || typeof accessToken !== "string") {
-    return { source: "unavailable", reason: "Squire returned a Google grant without an access token" };
+}
+function releaseSquireConnectSession(log2) {
+  const claim = activeConnectSession;
+  activeConnectSession = void 0;
+  if (!claim)
+    return;
+  if (isProcessAlive(claim.pid)) {
+    log2?.(`released trusty-squire connect session claim (pid ${String(claim.pid)} still live \u2014 a fresh connect owns the browser now)`);
+    claim.abort();
+  } else {
+    log2?.("cleared dead trusty-squire connect session claim (owner process gone)");
   }
-  return {
-    source: "squire",
-    credentials: {
-      accessToken,
-      refreshToken: typeof record3.refreshToken === "string" ? record3.refreshToken : typeof record3.refresh_token === "string" ? record3.refresh_token : void 0,
-      expiresAt: typeof record3.expiresAt === "number" ? record3.expiresAt : void 0,
-      accountEmail: typeof record3.accountEmail === "string" ? record3.accountEmail : typeof record3.email === "string" ? record3.email : void 0
-    }
-  };
 }
-function manualGoogleCredentialsSearchPaths(home) {
-  return [join2(home, "google-credentials.json")];
+function squireChromeProfileDir() {
+  return process.env.TRUSTY_SQUIRE_PROFILE_DIR ?? join2(homedir2(), ".trusty-squire", "chrome-profile");
 }
-function loadManualGoogleCredentials(home, env = process.env) {
-  if (env.BEELINE_GOOGLE_ACCESS_TOKEN) {
-    return {
-      source: "manual",
-      credentials: { accessToken: env.BEELINE_GOOGLE_ACCESS_TOKEN }
-    };
-  }
-  for (const path of manualGoogleCredentialsSearchPaths(home)) {
+function squireProfilePathIdentity(profileDir) {
+  const absolute = resolve6(profileDir);
+  const suffix = [];
+  let candidate = absolute;
+  for (; ; ) {
     try {
-      const parsed = JSON.parse(readFileSync3(path, "utf8"));
-      if (typeof parsed.accessToken === "string" || typeof parsed.access_token === "string") {
-        return {
-          source: "manual",
-          credentials: {
-            accessToken: parsed.accessToken ?? parsed.access_token,
-            refreshToken: typeof parsed.refreshToken === "string" ? parsed.refreshToken : void 0,
-            accountEmail: typeof parsed.accountEmail === "string" ? parsed.accountEmail : void 0
-          }
-        };
-      }
+      return join2(realpathSync.native(candidate), ...suffix.reverse());
     } catch {
+      const parent = dirname2(candidate);
+      if (parent === candidate)
+        return absolute;
+      suffix.push(basename3(candidate));
+      candidate = parent;
     }
   }
-  return {
-    source: "manual-missing",
-    reason: `no Google credentials found. Put a google-credentials.json (OAuth access token) at ${manualGoogleCredentialsSearchPaths(home)[0]} or connect your Google account in Trusty Squire first.`
-  };
 }
-var step = (label, status, extra) => ({
-  label,
-  status,
-  ...extra
-});
-function outputTail(text2, maxChars = 800) {
-  const trimmed = text2.trim();
-  return trimmed.length <= maxChars ? trimmed : `\u2026${trimmed.slice(-maxChars)}`;
+function squireProfileLockPath(profileDir = squireChromeProfileDir(), lockRoot = tmpdir2()) {
+  const digest = createHash2("sha256").update(squireProfilePathIdentity(profileDir)).digest("hex").slice(0, 24);
+  return join2(lockRoot, `trusty-squire-profile-${digest}.lock`);
 }
-async function installGoogleTool(options) {
-  const steps = [step("helper reached", "done")];
-  const emit = () => options.onProgress?.([...steps]);
-  const push = (next) => {
-    steps.push(next);
-    emit();
-  };
-  const fail = (label, reason, output) => {
-    push(step(label, "failed", { reason, ...output ? { output } : {} }));
-    return { status: "error", steps, errorMessage: reason };
-  };
-  emit();
-  if (!isGoogleToolConnectorType(options.connectorType)) {
-    return fail("connector type", `${options.connectorType} is not a Google tool connector`);
-  }
-  push(step("Google credentials resolved", "running", { output: "resolving\u2026" }));
-  const resolved = options.resolvedCredentials ? await options.resolvedCredentials : options.resolveCredentials ? await options.resolveCredentials() : await (async () => {
-    const oneClick = await readGoogleCredentialsFromVault(options.squire);
-    return oneClick.source === "squire" ? { ...oneClick } : { ...loadManualGoogleCredentials(options.home, options.env) };
-  })();
-  if (!("credentials" in resolved)) {
-    const reason = resolved.reason;
-    steps[1] = step("Google credentials resolved", "failed", { reason, output: outputTail(reason) });
-    emit();
-    return { status: "error", steps, errorMessage: reason };
-  }
-  steps[1] = step("Google credentials resolved", "done", {
-    output: resolved.source === "squire" ? "one-click: read the Google grant from Trusty Squire" : "manual: local google-credentials.json"
-  });
-  emit();
-  const client = options.client ?? googleWorkspaceClient(credentialsTokenSource(resolved.credentials));
-  push(step("authorized with Google", "running", { output: "verifying the grant with Google\u2026" }));
-  const verify = await client.verify();
-  if (!verify.ok) {
-    return fail("authorized with Google", verify.reason, outputTail(verify.reason));
-  }
-  steps[2] = step("authorized with Google", "done", {
-    ...verify.account ? { output: `signed in as ${verify.account}` } : {}
-  });
-  emit();
-  push(step("tools enabled", "done", {
-    output: `${GOOGLE_TOOL_SCOPES[options.connectorType].length} Google scopes granted`
-  }));
-  return {
-    status: "connected",
-    steps,
-    ...verify.account ? { signedInAs: verify.account } : {}
-  };
+var SQUIRE_BROWSER_BUSY_GOOGLE_REASON = "Trusty Squire is still using the browser \u2014 connect Trusty Squire first";
+function isSquireBrowserSessionFailure(text2) {
+  if (typeof text2 !== "string" || text2.length === 0)
+    return false;
+  return /Trusty Squire[\s\S]{0,80}browser/i.test(text2) || /browser[\s\S]{0,80}Trusty Squire/i.test(text2);
 }
-function describe(error) {
-  return error instanceof Error ? error.message : String(error);
+function squireForeignClaimAction(owner) {
+  return `Trusty Squire's browser is in use by another process (pid ${owner.pid}). Finish or close that Trusty Squire session, then press Connect again.`;
 }
-
-// apps/body/dist/connector-squire.js
-import { execFile, spawn as spawn2 } from "node:child_process";
-var SQUIRE_MCP_NAME = "@trusty-squire/mcp";
-var SQUIRE_CONNECT_PACKAGE = `${SQUIRE_MCP_NAME}@latest`;
-var activeConnectSession;
-function isProcessAlive(pid) {
-  if (pid === void 0 || pid <= 0)
-    return false;
+function readLinuxStartTime(pid) {
   try {
-    process.kill(pid, 0);
+    const stat4 = readFileSync3(`/proc/${pid}/stat`, "utf8");
+    const close = stat4.lastIndexOf(")");
+    return close < 0 ? void 0 : stat4.slice(close + 2).split(" ")[19];
+  } catch {
+    return void 0;
+  }
+}
+function lockOwnerIsAlive(owner) {
+  if (!isProcessAlive(owner.pid))
+    return false;
+  if (owner.startTime === null || owner.startTime === "unknown")
     return true;
-  } catch (error) {
-    return error?.code === "EPERM";
+  const actual = readLinuxStartTime(owner.pid);
+  if (actual === void 0)
+    return true;
+  return actual === owner.startTime;
+}
+function readLockFileOwner(lockPath) {
+  try {
+    const target = lstatSync2(lockPath).isDirectory() ? join2(lockPath, "owner.json") : lockPath;
+    const parsed = JSON.parse(readFileSync3(target, "utf8"));
+    if (typeof parsed.host !== "string" || typeof parsed.pid !== "number")
+      return void 0;
+    return {
+      host: parsed.host,
+      pid: parsed.pid,
+      startTime: typeof parsed.start_time === "string" ? parsed.start_time : null
+    };
+  } catch {
+    return void 0;
   }
 }
-function releaseSquireConnectSession(log2) {
-  const claim = activeConnectSession;
-  activeConnectSession = void 0;
-  if (!claim)
-    return;
-  if (isProcessAlive(claim.pid)) {
-    log2?.(`released trusty-squire connect session claim (pid ${String(claim.pid)} still live \u2014 a fresh connect owns the browser now)`);
-    claim.abort();
-  } else {
-    log2?.("cleared dead trusty-squire connect session claim (owner process gone)");
+function removeProfileLock(lockPath) {
+  rmSync(lockPath, { recursive: true, force: true });
+}
+function reclaimSquireProfileClaim(options) {
+  const profileDir = options?.profileDir ?? squireChromeProfileDir();
+  const lockRoot = options?.lockRoot ?? tmpdir2();
+  const lockPath = squireProfileLockPath(profileDir, lockRoot);
+  const owner = readLockFileOwner(lockPath);
+  if (!owner) {
+    return { kind: "free" };
+  }
+  const ours = (options?.ourPids ?? []).includes(owner.pid);
+  if (ours) {
+    removeProfileLock(lockPath);
+    options?.log?.(`released our trusty-squire on-disk browser claim (pid ${owner.pid})`);
+    return { kind: "released-ours", owner };
+  }
+  if (owner.host !== hostname() || lockOwnerIsAlive(owner)) {
+    const action = squireForeignClaimAction(owner);
+    options?.log?.(`trusty-squire browser claim blocked by live pid ${owner.pid} \u2014 not superseding a foreign session`);
+    return { kind: "blocked-foreign", owner, action };
   }
+  removeProfileLock(lockPath);
+  options?.log?.(`cleared dead trusty-squire on-disk browser claim (pid ${owner.pid} gone)`);
+  return { kind: "reclaimed-dead", owner };
 }
-var defaultShellRunner = (command, args) => new Promise((resolve31) => {
+var defaultShellRunner = (command, args) => new Promise((resolve32) => {
   execFile(command, [...args], { timeout: 12e4, maxBuffer: 4 * 1024 * 1024, encoding: "utf8" }, (error, stdout6, stderr) => {
     const code = error?.code;
-    resolve31({
+    resolve32({
       code: typeof code === "number" ? code : error ? 1 : 0,
       stdout: String(stdout6 ?? ""),
       stderr: String(stderr ?? "")
     });
   });
 });
+function squireConnectProcessEnv(profileDir = squireChromeProfileDir()) {
+  return {
+    ...process.env,
+    TRUSTY_SQUIRE_PROFILE_DIR: profileDir
+  };
+}
 var CONNECT_TIMEOUT_MS = 3e5;
-var defaultStreamedRunner = (command, args) => new Promise((resolve31) => {
-  const child = spawn2(command, args, {
-    stdio: ["ignore", "pipe", "pipe"]
+function killConnectTree(child) {
+  const pid = child.pid;
+  if (pid !== void 0) {
+    try {
+      process.kill(-pid, "SIGTERM");
+    } catch {
+    }
+  }
+  child.kill();
+}
+var defaultStreamedRunner = (command, args, env) => new Promise((resolve32) => {
+  const child = spawn4(command, args, {
+    stdio: ["ignore", "pipe", "pipe"],
+    env: env ?? squireConnectProcessEnv(),
+    detached: true
   });
   let stdout6 = "";
   let stderr = "";
@@ -8574,14 +9035,14 @@ var defaultStreamedRunner = (command, args) => new Promise((resolve31) => {
   const safetyTimer = setTimeout(() => {
     if (!resolved) {
       resolved = true;
-      resolve31({ stdout: stdout6, stderr, pid: child.pid ?? void 0, signIn: void 0, abort: () => {
+      resolve32({ stdout: stdout6, stderr, pid: child.pid ?? void 0, signIn: void 0, abort: () => {
       } });
     }
-    child.kill();
+    killConnectTree(child);
   }, CONNECT_TIMEOUT_MS);
   const abort = () => {
     clearTimeout(safetyTimer);
-    child.kill();
+    killConnectTree(child);
   };
   const claim = {
     pid: child.pid ?? void 0,
@@ -8593,7 +9054,7 @@ var defaultStreamedRunner = (command, args) => new Promise((resolve31) => {
     if (!resolved) {
       resolved = true;
       clearTimeout(safetyTimer);
-      resolve31(result);
+      resolve32(result);
     }
   };
   const checkOutput = () => {
@@ -8621,7 +9082,7 @@ ${stderr}`;
     } });
   });
 });
-var step2 = (label, status, reason) => ({
+var step = (label, status, reason) => ({
   label,
   status,
   ...reason ? { reason } : {}
@@ -8685,142 +9146,311 @@ function parseSignedInAs(output) {
   return output.match(/signed in as ([^\s,;]+)/i)?.[1];
 }
 async function installSquire(options) {
+  const profileDir = options.profileDir ?? squireChromeProfileDir();
+  const lockRoot = options.lockRoot ?? tmpdir2();
   const run2 = options.run ?? defaultShellRunner;
   const streamRun = options.streamRun ?? defaultStreamedRunner;
   const log2 = options.log ?? (() => {
   });
+  const steps = [step("helper reached", "done")];
+  const emit = () => options.onProgress?.([...steps]);
+  const push = (next) => {
+    steps.push(next);
+    emit();
+  };
+  const fail = (reason) => {
+    steps.push(step("waiting for sign-in", "pending"));
+    emit();
+    return { status: "error", steps, errorMessage: reason };
+  };
+  emit();
+  const previousPid = squireConnectSession()?.pid;
+  releaseSquireConnectSession(log2);
+  const claim = reclaimSquireProfileClaim({
+    log: log2,
+    profileDir,
+    lockRoot,
+    ...previousPid !== void 0 ? { ourPids: [previousPid] } : {}
+  });
+  if (claim.kind === "blocked-foreign") {
+    push(step("trusty-squire installed", "failed", claim.action));
+    return fail(claim.action);
+  }
+  const resolution = await resolveSquireConnectSpec(run2);
+  if (resolution.reResolved) {
+    log2(`trusty-squire stale copy ${resolution.resolvedVersion ?? "unknown"} re-resolved against current release ${resolution.currentRelease}`);
+  }
+  const install = await streamRun("npx", [
+    ...resolution.npxArgs,
+    "connect",
+    "--force-relogin=google",
+    "--target=codex",
+    "--skip-browser"
+  ], squireConnectProcessEnv(profileDir));
+  if (!install.signIn) {
+    const stderr = install.stderr.trim();
+    let stepReason = stderr || "connect printed no sign-in URL";
+    let failReason = stderr || "the trusty-squire connect command printed no sign-in surface";
+    if (isSquireBrowserSessionFailure(stderr)) {
+      const again = reclaimSquireProfileClaim({ log: log2, profileDir, lockRoot });
+      if (again.kind === "blocked-foreign") {
+        stepReason = again.action;
+        failReason = again.action;
+      }
+    }
+    push(step("trusty-squire installed", "failed", stepReason));
+    return fail(failReason);
+  }
+  const version = resolution.resolvedVersion;
+  push(step(`trusty-squire${version ? ` ${version}` : ""} installed`, "done"));
+  const signIn = install.signIn;
+  const signedInAs = parseSignedInAs(`${install.stdout}
+${install.stderr}`);
+  push(step("waiting for sign-in", "done"));
+  const pair = await pairSquire(options.mcp, options.workspaceId);
+  if (!pair.ok) {
+    push(step("paired to workspace", "failed", pair.reason));
+    return {
+      status: "installing",
+      steps,
+      signIn,
+      ...version ? { squireVersion: version } : {},
+      ...signedInAs ? { signedInAs } : {}
+    };
+  }
+  push(step("paired to workspace", "done"));
+  return {
+    status: "connected",
+    steps,
+    signIn,
+    ...version ? { squireVersion: version } : {},
+    ...signedInAs ? { signedInAs } : {}
+  };
+}
+async function pairSquire(mcp, _workspaceId) {
+  if (!mcp)
+    return { ok: false, reason: "the Squire MCP surface is not mounted on this helper" };
+  try {
+    await mcp.call("list_credentials", { fields: "summary" });
+    return { ok: true };
+  } catch (error) {
+    return { ok: false, reason: error instanceof Error ? error.message : String(error) };
+  }
+}
+function asRecord2(value) {
+  return value && typeof value === "object" ? value : {};
+}
+function asArray(value) {
+  return Array.isArray(value) ? value : [];
+}
+function stringList(value) {
+  return asArray(value).filter((entry) => typeof entry === "string");
+}
+function numberOrNull(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : null;
+}
+function vaultConnectionMeta(raw) {
+  const record3 = asRecord2(raw);
+  const reference = String(record3.reference ?? record3.id ?? "");
+  return {
+    reference,
+    service: typeof record3.service === "string" ? record3.service : null,
+    label: String(record3.label ?? record3.service ?? reference),
+    fieldNames: stringList(record3.field_names ?? record3.fieldNames),
+    allowedHosts: stringList(record3.allowed_hosts ?? record3.allowedHosts ?? record3.login_hosts),
+    createdAt: numberOrNull(record3.created_at ?? record3.createdAt) ?? 0,
+    stale: record3.stale === true,
+    state: record3.state === "error" ? "error" : "active"
+  };
+}
+async function readVault(mcp) {
+  const result = asRecord2(await mcp.call("list_credentials"));
+  return asArray(result.credentials ?? result.items ?? result).map(vaultConnectionMeta);
+}
+function connectionGrant(raw) {
+  const record3 = asRecord2(raw);
+  return {
+    grantId: String(record3.grant_id ?? record3.grantId ?? record3.id ?? ""),
+    credentialRef: String(record3.credential_ref ?? record3.credentialRef ?? record3.reference ?? ""),
+    createdAt: numberOrNull(record3.created_at ?? record3.createdAt) ?? 0,
+    ...numberOrNull(record3.revoked_at ?? record3.revokedAt) !== null ? { revokedAt: numberOrNull(record3.revoked_at ?? record3.revokedAt) } : {},
+    ...numberOrNull(record3.rate_limit_per_hour) !== null ? { rateLimitPerHour: numberOrNull(record3.rate_limit_per_hour) } : {},
+    ...numberOrNull(record3.spend_cap_usd) !== null ? { spendCapUsd: numberOrNull(record3.spend_cap_usd) } : {}
+  };
+}
+async function readGrants(mcp, ref) {
+  const result = asRecord2(await mcp.call("list_app_access", {}));
+  return asArray(result.grants ?? result.items ?? result).map(connectionGrant).filter((grant) => grant.credentialRef === ref && grant.revokedAt === void 0);
+}
+async function revokeGrants(mcp, ref) {
+  const grants = await readGrants(mcp, ref);
+  let revoked = 0;
+  let failed = 0;
+  for (const grant of grants) {
+    try {
+      const result = asRecord2(await mcp.call("revoke_app_access", { grant_id: grant.grantId }));
+      if (result.revoked === false)
+        failed += 1;
+      else
+        revoked += 1;
+    } catch {
+      failed += 1;
+    }
+  }
+  return { revoked, failed };
+}
+
+// apps/body/dist/connector-google.js
+var GOOGLE_TOOL_SCOPES = {
+  "google-gmail": [
+    "https://www.googleapis.com/auth/gmail.send",
+    "https://www.googleapis.com/auth/gmail.readonly",
+    "https://www.googleapis.com/auth/gmail.compose"
+  ],
+  "google-calendar": ["https://www.googleapis.com/auth/calendar.events", "https://www.googleapis.com/auth/calendar.readonly"],
+  "google-drive": ["https://www.googleapis.com/auth/drive.readonly"],
+  "google-youtube": ["https://www.googleapis.com/auth/youtube.readonly"]
+};
+function isGoogleToolConnectorType(type) {
+  return type in GOOGLE_TOOL_SCOPES;
+}
+async function readGoogleCredentialsFromVault(mcp) {
+  if (!mcp)
+    return { source: "unavailable", reason: "no Trusty Squire connector is paired" };
+  let raw;
+  try {
+    raw = await mcp.call("google_oauth_credentials", {});
+  } catch (error) {
+    const detail = describe(error);
+    if (isSquireBrowserSessionFailure(detail)) {
+      return {
+        source: "unavailable",
+        reason: SQUIRE_BROWSER_BUSY_GOOGLE_REASON
+      };
+    }
+    return {
+      source: "unavailable",
+      reason: `Squire has no Google OAuth grant on record yet (connect your Google account in Squire first: ${detail})`
+    };
+  }
+  const record3 = raw && typeof raw === "object" ? raw : {};
+  const inner = record3.credentials && typeof record3.credentials === "object" ? record3.credentials : record3;
+  const accessToken = inner.accessToken ?? inner.access_token;
+  if (!accessToken || typeof accessToken !== "string") {
+    return { source: "unavailable", reason: "Squire returned a Google grant without an access token" };
+  }
+  return {
+    source: "squire",
+    credentials: {
+      accessToken,
+      refreshToken: typeof record3.refreshToken === "string" ? record3.refreshToken : typeof record3.refresh_token === "string" ? record3.refresh_token : void 0,
+      expiresAt: typeof record3.expiresAt === "number" ? record3.expiresAt : void 0,
+      accountEmail: typeof record3.accountEmail === "string" ? record3.accountEmail : typeof record3.email === "string" ? record3.email : void 0
+    }
+  };
+}
+function manualGoogleCredentialsSearchPaths(home) {
+  return [join3(home, "google-credentials.json")];
+}
+function loadManualGoogleCredentials(home, env = process.env) {
+  if (env.BEELINE_GOOGLE_ACCESS_TOKEN) {
+    return {
+      source: "manual",
+      credentials: { accessToken: env.BEELINE_GOOGLE_ACCESS_TOKEN }
+    };
+  }
+  for (const path of manualGoogleCredentialsSearchPaths(home)) {
+    try {
+      const parsed = JSON.parse(readFileSync4(path, "utf8"));
+      if (typeof parsed.accessToken === "string" || typeof parsed.access_token === "string") {
+        return {
+          source: "manual",
+          credentials: {
+            accessToken: parsed.accessToken ?? parsed.access_token,
+            refreshToken: typeof parsed.refreshToken === "string" ? parsed.refreshToken : void 0,
+            accountEmail: typeof parsed.accountEmail === "string" ? parsed.accountEmail : void 0
+          }
+        };
+      }
+    } catch {
+    }
+  }
+  return {
+    source: "manual-missing",
+    reason: `no Google credentials found. Put a google-credentials.json (OAuth access token) at ${manualGoogleCredentialsSearchPaths(home)[0]} or connect your Google account in Trusty Squire first.`
+  };
+}
+var step2 = (label, status, extra) => ({
+  label,
+  status,
+  ...extra
+});
+function outputTail(text2, maxChars = 800) {
+  const trimmed = text2.trim();
+  return trimmed.length <= maxChars ? trimmed : `\u2026${trimmed.slice(-maxChars)}`;
+}
+async function installGoogleTool(options) {
   const steps = [step2("helper reached", "done")];
   const emit = () => options.onProgress?.([...steps]);
   const push = (next) => {
     steps.push(next);
     emit();
   };
-  const fail = (reason) => {
-    steps.push(step2("waiting for sign-in", "pending"));
-    emit();
+  const fail = (label, reason, output) => {
+    push(step2(label, "failed", { reason, ...output ? { output } : {} }));
     return { status: "error", steps, errorMessage: reason };
   };
   emit();
-  releaseSquireConnectSession(log2);
-  const resolution = await resolveSquireConnectSpec(run2);
-  if (resolution.reResolved) {
-    log2(`trusty-squire stale copy ${resolution.resolvedVersion ?? "unknown"} re-resolved against current release ${resolution.currentRelease}`);
+  if (!isGoogleToolConnectorType(options.connectorType)) {
+    return fail("connector type", `${options.connectorType} is not a Google tool connector`);
   }
-  const install = await streamRun("npx", [
-    ...resolution.npxArgs,
-    "connect",
-    "--force-relogin=google",
-    "--target=codex",
-    "--skip-browser"
-  ]);
-  if (!install.signIn) {
-    const stderr = install.stderr.trim();
-    push(step2("trusty-squire installed", "failed", stderr || "connect printed no sign-in URL"));
-    return fail(stderr || "the trusty-squire connect command printed no sign-in surface");
+  push(step2("Google credentials resolved", "running", { output: "resolving\u2026" }));
+  const resolved = options.resolvedCredentials ? await options.resolvedCredentials : options.resolveCredentials ? await options.resolveCredentials() : await (async () => {
+    const oneClick = await readGoogleCredentialsFromVault(options.squire);
+    if (oneClick.source === "squire")
+      return oneClick;
+    if (isSquireBrowserSessionFailure(oneClick.reason))
+      return oneClick;
+    return loadManualGoogleCredentials(options.home, options.env);
+  })();
+  if (!("credentials" in resolved)) {
+    const reason = resolved.reason;
+    steps[1] = step2("Google credentials resolved", "failed", { reason, output: outputTail(reason) });
+    emit();
+    return { status: "error", steps, errorMessage: reason };
   }
-  const version = resolution.resolvedVersion;
-  push(step2(`trusty-squire${version ? ` ${version}` : ""} installed`, "done"));
-  const signIn = install.signIn;
-  const signedInAs = parseSignedInAs(`${install.stdout}
-${install.stderr}`);
-  push(step2("waiting for sign-in", "done"));
-  const pair = await pairSquire(options.mcp, options.workspaceId);
-  if (!pair.ok) {
-    push(step2("paired to workspace", "failed", pair.reason));
-    return {
-      status: "installing",
-      steps,
-      signIn,
-      ...version ? { squireVersion: version } : {},
-      ...signedInAs ? { signedInAs } : {}
-    };
+  steps[1] = step2("Google credentials resolved", "done", {
+    output: resolved.source === "squire" ? "one-click: read the Google grant from Trusty Squire" : "manual: local google-credentials.json"
+  });
+  emit();
+  const client = options.client ?? googleWorkspaceClient(credentialsTokenSource(resolved.credentials));
+  push(step2("authorized with Google", "running", { output: "verifying the grant with Google\u2026" }));
+  const verify = await client.verify();
+  if (!verify.ok) {
+    return fail("authorized with Google", verify.reason, outputTail(verify.reason));
   }
-  push(step2("paired to workspace", "done"));
+  steps[2] = step2("authorized with Google", "done", {
+    ...verify.account ? { output: `signed in as ${verify.account}` } : {}
+  });
+  emit();
+  push(step2("tools enabled", "done", {
+    output: `${GOOGLE_TOOL_SCOPES[options.connectorType].length} Google scopes granted`
+  }));
   return {
     status: "connected",
     steps,
-    signIn,
-    ...version ? { squireVersion: version } : {},
-    ...signedInAs ? { signedInAs } : {}
-  };
-}
-async function pairSquire(mcp, _workspaceId) {
-  if (!mcp)
-    return { ok: false, reason: "the Squire MCP surface is not mounted on this helper" };
-  try {
-    await mcp.call("list_credentials", { fields: "summary" });
-    return { ok: true };
-  } catch (error) {
-    return { ok: false, reason: error instanceof Error ? error.message : String(error) };
-  }
-}
-function asRecord(value) {
-  return value && typeof value === "object" ? value : {};
-}
-function asArray(value) {
-  return Array.isArray(value) ? value : [];
-}
-function stringList(value) {
-  return asArray(value).filter((entry) => typeof entry === "string");
-}
-function numberOrNull(value) {
-  return typeof value === "number" && Number.isFinite(value) ? value : null;
-}
-function vaultConnectionMeta(raw) {
-  const record3 = asRecord(raw);
-  const reference = String(record3.reference ?? record3.id ?? "");
-  return {
-    reference,
-    service: typeof record3.service === "string" ? record3.service : null,
-    label: String(record3.label ?? record3.service ?? reference),
-    fieldNames: stringList(record3.field_names ?? record3.fieldNames),
-    allowedHosts: stringList(record3.allowed_hosts ?? record3.allowedHosts ?? record3.login_hosts),
-    createdAt: numberOrNull(record3.created_at ?? record3.createdAt) ?? 0,
-    stale: record3.stale === true,
-    state: record3.state === "error" ? "error" : "active"
-  };
-}
-async function readVault(mcp) {
-  const result = asRecord(await mcp.call("list_credentials"));
-  return asArray(result.credentials ?? result.items ?? result).map(vaultConnectionMeta);
-}
-function connectionGrant(raw) {
-  const record3 = asRecord(raw);
-  return {
-    grantId: String(record3.grant_id ?? record3.grantId ?? record3.id ?? ""),
-    credentialRef: String(record3.credential_ref ?? record3.credentialRef ?? record3.reference ?? ""),
-    createdAt: numberOrNull(record3.created_at ?? record3.createdAt) ?? 0,
-    ...numberOrNull(record3.revoked_at ?? record3.revokedAt) !== null ? { revokedAt: numberOrNull(record3.revoked_at ?? record3.revokedAt) } : {},
-    ...numberOrNull(record3.rate_limit_per_hour) !== null ? { rateLimitPerHour: numberOrNull(record3.rate_limit_per_hour) } : {},
-    ...numberOrNull(record3.spend_cap_usd) !== null ? { spendCapUsd: numberOrNull(record3.spend_cap_usd) } : {}
+    ...verify.account ? { signedInAs: verify.account } : {}
   };
 }
-async function readGrants(mcp, ref) {
-  const result = asRecord(await mcp.call("list_app_access", {}));
-  return asArray(result.grants ?? result.items ?? result).map(connectionGrant).filter((grant) => grant.credentialRef === ref && grant.revokedAt === void 0);
-}
-async function revokeGrants(mcp, ref) {
-  const grants = await readGrants(mcp, ref);
-  let revoked = 0;
-  let failed = 0;
-  for (const grant of grants) {
-    try {
-      const result = asRecord(await mcp.call("revoke_app_access", { grant_id: grant.grantId }));
-      if (result.revoked === false)
-        failed += 1;
-      else
-        revoked += 1;
-    } catch {
-      failed += 1;
-    }
-  }
-  return { revoked, failed };
+function describe(error) {
+  return error instanceof Error ? error.message : String(error);
 }
 
 // apps/body/dist/squire-mcp-client.js
-import { spawn as spawn3 } from "node:child_process";
+import { spawn as spawn5 } from "node:child_process";
 var INITIALIZE_TIMEOUT_MS = 3e4;
 var CALL_TIMEOUT_MS = 12e4;
+var SQUIRE_MCP_SERVER_ARGS = ["-y", "@trusty-squire/mcp@latest", "server"];
 var StdioSquireMcpClient = class {
   options;
   child;
@@ -8874,12 +9504,7 @@ var StdioSquireMcpClient = class {
     return this.initialized;
   }
   initialize() {
-    const child = (this.options.spawn ?? spawn3)(this.options.command ?? "npx", [
-      // `@latest`: the current release, never a source-level version pin
-      // (captain). Only the vault MCP server the agent spawns; the connect
-      // install path verifies freshness itself (connector-squire.ts).
-      ...this.options.args ?? ["-y", "@trusty-squire/mcp@latest"]
-    ]);
+    const child = (this.options.spawn ?? spawn5)(this.options.command ?? "npx", [...this.options.args ?? [...SQUIRE_MCP_SERVER_ARGS]], { env: this.options.env ?? squireConnectProcessEnv() });
     this.child = child;
     this.buffer = "";
     child.stdout.setEncoding("utf8");
@@ -8913,12 +9538,12 @@ var StdioSquireMcpClient = class {
     const child = this.child;
     if (!child)
       return Promise.reject(new Error("Squire MCP session is not running"));
-    return new Promise((resolve31, reject) => {
+    return new Promise((resolve32, reject) => {
       const timer = setTimeout(() => {
         this.pending.delete(id);
         reject(new Error(`${method} timed out`));
       }, method === "initialize" ? INITIALIZE_TIMEOUT_MS : CALL_TIMEOUT_MS);
-      this.pending.set(id, { resolve: resolve31, reject, timer });
+      this.pending.set(id, { resolve: resolve32, reject, timer });
       child.stdin.write(`${JSON.stringify({ jsonrpc: "2.0", id, method, params })}
 `);
     });
@@ -9034,6 +9659,7 @@ var ConnectorAssignmentLoop = class {
       this.log(`connector assignments unavailable: ${describe2(error)}`);
       return;
     }
+    const squireWork = [];
     let googleBatch;
     for (const assignment of assignments) {
       const key = `${assignment.kind}:${assignment.connectorId}`;
@@ -9049,17 +9675,15 @@ var ConnectorAssignmentLoop = class {
       if (this.inFlight.has(key))
         continue;
       this.inFlight.add(key);
-      void this.handle(assignment).catch((error) => this.log(`connector assignment ${key} failed: ${describe2(error)}`)).finally(() => this.inFlight.delete(key));
+      squireWork.push(this.handle(assignment).catch((error) => this.log(`connector assignment ${key} failed: ${describe2(error)}`)).finally(() => this.inFlight.delete(key)));
+    }
+    if (googleBatch) {
+      const keys = googleBatch.map((assignment) => `${assignment.kind}:${assignment.connectorId}`);
+      void Promise.all(squireWork).then(() => this.runGoogleBatch(googleBatch)).catch((error) => this.log(`google connector installs failed: ${describe2(error)}`)).finally(() => {
+        for (const key of keys)
+          this.inFlight.delete(key);
+      });
     }
-    if (googleBatch)
-      this.flushGoogleBatch(googleBatch);
-  }
-  flushGoogleBatch(batch) {
-    const keys = batch.map((a2) => `${a2.kind}:${a2.connectorId}`);
-    void this.runGoogleBatch(batch).catch((error) => this.log(`google connector installs failed: ${describe2(error)}`)).finally(() => {
-      for (const key of keys)
-        this.inFlight.delete(key);
-    });
   }
   /** The Google tool connectors ride ONE grant: every install in the batch
    * shares one credential resolution (the single Google consent) and the
@@ -9083,6 +9707,8 @@ var ConnectorAssignmentLoop = class {
         const oneClick = await readGoogleCredentialsFromVault(this.squire());
         if (oneClick.source === "squire")
           return oneClick;
+        if (isSquireBrowserSessionFailure(oneClick.reason))
+          return oneClick;
       } catch (error) {
         this.log(`google one-click grant lookup failed: ${describe2(error)}`);
       }
@@ -9227,12 +9853,13 @@ var SERVER_EVENT_KINDS = [
   "check-failed",
   "merged",
   "grant-decided",
+  "connector-offer-decided",
   "turn-cancelled"
 ];
 
 // apps/body/dist/daemon-api-client.js
-import { resolve as resolve7 } from "node:path";
-import { randomUUID } from "node:crypto";
+import { resolve as resolve8 } from "node:path";
+import { randomUUID as randomUUID2 } from "node:crypto";
 
 // node_modules/ws/wrapper.mjs
 var import_stream = __toESM(require_stream(), 1);
@@ -9250,9 +9877,9 @@ import { randomBytes as randomBytes5 } from "node:crypto";
 import { execFile as execFile2 } from "node:child_process";
 import { closeSync, openSync } from "node:fs";
 import { mkdir, readFile as readFile2, readdir, rename, stat, writeFile as writeFile2 } from "node:fs/promises";
-import { homedir as homedir2 } from "node:os";
-import { dirname as dirname2, resolve as resolve6 } from "node:path";
-import { spawn as spawn4 } from "node:child_process";
+import { homedir as homedir3 } from "node:os";
+import { dirname as dirname3, resolve as resolve7 } from "node:path";
+import { spawn as spawn6 } from "node:child_process";
 import { promisify } from "node:util";
 
 // node_modules/@noble/hashes/_u64.js
@@ -13639,7 +14266,7 @@ function alphabet(letters) {
   };
 }
 // @__NO_SIDE_EFFECTS__
-function join3(separator = "") {
+function join4(separator = "") {
   astr("join", separator);
   return {
     encode: (from) => {
@@ -13769,8 +14396,8 @@ var base64 = hasBase64Builtin ? {
   decode(s) {
     return decodeBase64Builtin(s, false);
   }
-} : /* @__PURE__ */ chain(/* @__PURE__ */ radix2(6), /* @__PURE__ */ alphabet("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"), /* @__PURE__ */ padding(6), /* @__PURE__ */ join3(""));
-var BECH_ALPHABET = /* @__PURE__ */ chain(/* @__PURE__ */ alphabet("qpzry9x8gf2tvdw0s3jn54khce6mua7l"), /* @__PURE__ */ join3(""));
+} : /* @__PURE__ */ chain(/* @__PURE__ */ radix2(6), /* @__PURE__ */ alphabet("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"), /* @__PURE__ */ padding(6), /* @__PURE__ */ join4(""));
+var BECH_ALPHABET = /* @__PURE__ */ chain(/* @__PURE__ */ alphabet("qpzry9x8gf2tvdw0s3jn54khce6mua7l"), /* @__PURE__ */ join4(""));
 var POLYMOD_GENERATORS = [996825010, 642813549, 513874426, 1027748829, 705979059];
 function bech32Polymod(pre) {
   const b = pre >> 25;
@@ -17788,15 +18415,15 @@ var DEFAULT_AGENT_IDENTITY_NAME = "beeline-agent";
 var DEFAULT_BODY_IDENTITY_NAME = "beeline-body";
 var DEFAULT_DAEMON_MONOLITH_BASE_URL = "https://server.usebeeline.app";
 function defaultSupervisorRoot(env = process.env) {
-  return resolve6(env.XDG_STATE_HOME ?? resolve6(homedir2(), ".local", "state"));
+  return resolve7(env.XDG_STATE_HOME ?? resolve7(homedir3(), ".local", "state"));
 }
 function runtimeDirectory(supervisorRoot, publicKey) {
   if (!/^[0-9a-f]{64}$/i.test(publicKey))
     throw new Error("invalid agent public key");
-  return resolve6(supervisorRoot, "beeline", "agents", publicKey.toLowerCase());
+  return resolve7(supervisorRoot, "beeline", "agents", publicKey.toLowerCase());
 }
 function runtimeConfigPath(supervisorRoot, publicKey) {
-  return resolve6(runtimeDirectory(supervisorRoot, publicKey), "runtime.json");
+  return resolve7(runtimeDirectory(supervisorRoot, publicKey), "runtime.json");
 }
 function identityFromKey(value, name) {
   const secretKey = value ? value.startsWith("nsec1") ? decodeNsec(value) : Uint8Array.from(Buffer.from(value, "hex")) : randomBytes5(32);
@@ -17817,7 +18444,13 @@ function runtimeIdentity(identity) {
     throw new Error("stored identity public key mismatch");
   return restored;
 }
-function runtimeAgentCommand(runtime) {
+function runtimeAgentCommand(runtime, env = process.env) {
+  if (runtime.agentKind === "cursor") {
+    try {
+      return resolveAgentCommand({ kind: "cursor", env });
+    } catch {
+    }
+  }
   return {
     kind: runtime.agentKind ?? "reference",
     command: runtime.agentCommand ?? runtime.agentBinary,
@@ -17826,7 +18459,7 @@ function runtimeAgentCommand(runtime) {
 }
 async function writeRuntimeRecord(runtime) {
   const path = runtimeConfigPath(runtime.supervisorRoot, runtime.agent.publicKey);
-  await mkdir(dirname2(path), { recursive: true, mode: 448 });
+  await mkdir(dirname3(path), { recursive: true, mode: 448 });
   const staged = `${path}.${process.pid}.tmp`;
   await writeFile2(staged, `${JSON.stringify(runtime, null, 2)}
 `, { mode: 384 });
@@ -17852,7 +18485,7 @@ async function migrateRuntimeRecordAccessPolicy(path) {
   return { runtime, migrated: true };
 }
 async function stageMonolithAgentRuntime(input) {
-  const supervisorRoot = input.supervisorRoot ? resolve6(input.supervisorRoot) : defaultSupervisorRoot();
+  const supervisorRoot = input.supervisorRoot ? resolve7(input.supervisorRoot) : defaultSupervisorRoot();
   const configPath = runtimeConfigPath(supervisorRoot, input.agentIdentity.publicKey);
   const configuredBaseUrl = input.monolithBaseUrl ?? DEFAULT_DAEMON_MONOLITH_BASE_URL;
   const baseUrl = new URL(configuredBaseUrl).origin;
@@ -17897,9 +18530,9 @@ async function stageMonolithAgentRuntime(input) {
   return { runtime, configPath };
 }
 async function runtimePaths(root) {
-  const agents = resolve6(root, "beeline", "agents");
+  const agents = resolve7(root, "beeline", "agents");
   const entries = await readdir(agents, { withFileTypes: true }).catch(() => []);
-  return entries.filter((entry) => entry.isDirectory()).map((entry) => resolve6(agents, entry.name, "runtime.json"));
+  return entries.filter((entry) => entry.isDirectory()).map((entry) => resolve7(agents, entry.name, "runtime.json"));
 }
 async function findAgentRuntimeConfigPaths(env = process.env, _cwd = process.cwd()) {
   return runtimePaths(defaultSupervisorRoot(env));
@@ -17908,13 +18541,13 @@ async function findRuntimeConfigPaths(cwd = process.cwd(), env = process.env) {
   return findAgentRuntimeConfigPaths(env, cwd);
 }
 async function resolveRuntimeConfigPath(path) {
-  return resolve6(path);
+  return resolve7(path);
 }
 async function selectRuntimeConfigPaths(options) {
   const hostScope = true;
   const configs = await options.findHostRuntimes(options.cwd);
   const requestedPubkey = options.requestedPubkey;
-  const paths = requestedPubkey ? configs.filter((path) => dirname2(path).endsWith(requestedPubkey)) : [...new Set(configs)];
+  const paths = requestedPubkey ? configs.filter((path) => dirname3(path).endsWith(requestedPubkey)) : [...new Set(configs)];
   if (!paths.length)
     throw new Error(options.noRuntimeMessage(hostScope));
   if (options.requestedPubkey && paths.length > 1)
@@ -17923,7 +18556,7 @@ async function selectRuntimeConfigPaths(options) {
 }
 async function runtimeDaemonPid(configPath) {
   try {
-    const pid = Number((await readFile2(resolve6(dirname2(configPath), "daemon.pid"), "utf8")).trim());
+    const pid = Number((await readFile2(resolve7(dirname3(configPath), "daemon.pid"), "utf8")).trim());
     if (!Number.isSafeInteger(pid) || pid <= 0)
       return null;
     process.kill(pid, 0);
@@ -17936,11 +18569,11 @@ async function daemonIsThisRuntime(pid, configPath) {
   try {
     const argv = (await readFile2(`/proc/${pid}/cmdline`, "utf8")).split("\0").filter(Boolean);
     const flag = argv.lastIndexOf("--config");
-    return flag > 0 && argv[flag - 1] === "daemon" && resolve6(argv[flag + 1]) === resolve6(configPath);
+    return flag > 0 && argv[flag - 1] === "daemon" && resolve7(argv[flag + 1]) === resolve7(configPath);
   } catch {
     try {
       const { stdout: stdout6 } = await execFileAsync("ps", ["-p", String(pid), "-o", "command="]);
-      return stdout6.includes(" daemon ") && stdout6.includes(resolve6(configPath));
+      return stdout6.includes(" daemon ") && stdout6.includes(resolve7(configPath));
     } catch {
       return false;
     }
@@ -17966,14 +18599,14 @@ async function stopRuntimeDaemon(path, opts = {}) {
   throw new Error(`agent daemon ${pid} did not stop after ${timeout}ms`);
 }
 async function launchRuntimeDaemon(configPath, opts = {}) {
-  const directory = dirname2(configPath);
+  const directory = dirname3(configPath);
   await mkdir(directory, { recursive: true, mode: 448 });
   const foreground = opts.foreground === true;
-  const output = foreground ? "inherit" : openSync(resolve6(directory, "daemon.log"), "a", 384);
+  const output = foreground ? "inherit" : openSync(resolve7(directory, "daemon.log"), "a", 384);
   const entrypoint = opts.entrypoint ?? process.argv[1];
   if (!entrypoint)
     throw new Error("cannot resolve daemon CLI entrypoint");
-  const child = spawn4(process.execPath, [...opts.execArgv ?? [], entrypoint, "daemon", "--config", resolve6(configPath)], {
+  const child = spawn6(process.execPath, [...opts.execArgv ?? [], entrypoint, "daemon", "--config", resolve7(configPath)], {
     cwd: directory,
     env: opts.env ?? process.env,
     detached: !foreground,
@@ -17990,9 +18623,9 @@ async function launchRuntimeDaemon(configPath, opts = {}) {
 }
 async function removeAgentRuntime(runtime) {
   const source = runtimeDirectory(runtime.supervisorRoot, runtime.agent.publicKey);
-  const deletedRoot = resolve6(runtime.supervisorRoot, "beeline", "deleted-runtimes");
+  const deletedRoot = resolve7(runtime.supervisorRoot, "beeline", "deleted-runtimes");
   await mkdir(deletedRoot, { recursive: true, mode: 448 });
-  const target = resolve6(deletedRoot, `${runtime.agent.publicKey}-${Date.now()}`);
+  const target = resolve7(deletedRoot, `${runtime.agent.publicKey}-${Date.now()}`);
   await rename(source, target);
   return target;
 }
@@ -18033,7 +18666,7 @@ var DaemonApiClient = class {
   agentId;
   fetchImpl;
   webSocketFactory;
-  presenceLifecycleId = randomUUID();
+  presenceLifecycleId = randomUUID2();
   liveSocket;
   liveReconnect;
   liveReconnectDelayMs = 1e3;
@@ -18227,8 +18860,8 @@ var DaemonApiClient = class {
 };
 async function activateDaemonTransport(path, fetchImpl = fetch) {
   const runtime = await readRuntimeRecord(path);
-  const expectedPath = resolve7(runtimeDirectory(runtime.supervisorRoot, runtime.agent.publicKey), "runtime.json");
-  if (resolve7(path) !== expectedPath) {
+  const expectedPath = resolve8(runtimeDirectory(runtime.supervisorRoot, runtime.agent.publicKey), "runtime.json");
+  if (resolve8(path) !== expectedPath) {
     throw new Error(`refusing daemon token exchange outside canonical runtime path: ${path}`);
   }
   const transport = runtime.transport;
@@ -18268,18 +18901,18 @@ async function activateDaemonTransport(path, fetchImpl = fetch) {
 
 // apps/body/dist/room-runtime.js
 import { execFile as execFile6 } from "node:child_process";
-import { createHash as createHash6 } from "node:crypto";
-import { existsSync as existsSync4, mkdirSync } from "node:fs";
+import { createHash as createHash7 } from "node:crypto";
+import { existsSync as existsSync5, mkdirSync } from "node:fs";
 import { mkdir as mkdir13, rm as rm5 } from "node:fs/promises";
-import { dirname as dirname8, resolve as resolve20 } from "node:path";
+import { dirname as dirname9, resolve as resolve21 } from "node:path";
 import { promisify as promisify4 } from "node:util";
 
 // apps/body/dist/grant-runner.js
 import { execFile as execFile3 } from "node:child_process";
-import { createHash as createHash2, randomBytes as randomBytes6 } from "node:crypto";
+import { createHash as createHash3, randomBytes as randomBytes6 } from "node:crypto";
 import { readFile as readFile4 } from "node:fs/promises";
 import { createServer } from "node:http";
-import { dirname as dirname4, resolve as resolve10 } from "node:path";
+import { dirname as dirname5, resolve as resolve11 } from "node:path";
 
 // packages/api-contract/dist/agent-grants.js
 var AGENT_GRANT_KINDS = ["path", "host", "secret", "device", "budget", "command"];
@@ -18502,9 +19135,9 @@ function surfaceAllows(surface, capability) {
 
 // apps/body/dist/bwrap-sandbox.js
 import { spawnSync } from "node:child_process";
-import { lstatSync as lstatSync2 } from "node:fs";
-import { homedir as homedir3 } from "node:os";
-import { isAbsolute as isAbsolute2, relative, resolve as resolve8 } from "node:path";
+import { lstatSync as lstatSync3 } from "node:fs";
+import { homedir as homedir4 } from "node:os";
+import { isAbsolute as isAbsolute2, relative, resolve as resolve9 } from "node:path";
 var DEFAULT_SANDBOX_POLICY = "bwrap";
 function isSandboxPolicy(value) {
   return value === "bwrap" || value === "off";
@@ -18536,16 +19169,16 @@ var HARNESS_HOME_STATE_DIRS = [
     dirs: [".grok"]
   },
   {
-    match: /(^|[/\\])cursor-agent-acp(\.[a-z]+)?$/i,
+    match: CURSOR_HARNESS_COMMAND,
     dirs: [".cursor"]
   }
 ];
-function harnessHomeStateDirs(agentCommand, home = homedir3()) {
+function harnessHomeStateDirs(agentCommand, home = homedir4()) {
   if (!agentCommand)
     return [];
   for (const { match, dirs } of HARNESS_HOME_STATE_DIRS) {
     if (match.test(agentCommand))
-      return dirs.map((dir) => resolve8(home, dir));
+      return dirs.map((dir) => resolve9(home, dir));
   }
   return [];
 }
@@ -18557,18 +19190,18 @@ var KNOWN_CREDENTIAL_MASK_PATHS = [
   ".git-credentials",
   ".secrets.env"
 ];
-function credentialMaskPaths(extraPaths, home = homedir3(), stat4 = (path) => {
+function credentialMaskPaths(extraPaths, home = homedir4(), stat4 = (path) => {
   try {
-    const info = lstatSync2(path);
+    const info = lstatSync3(path);
     return { isDirectory: info.isDirectory() };
   } catch {
     return void 0;
   }
 }, requiredPaths = []) {
-  const required = new Set(requiredPaths.map((path) => resolve8(path)));
+  const required = new Set(requiredPaths.map((path) => resolve9(path)));
   const candidates = [
-    ...KNOWN_CREDENTIAL_MASK_PATHS.map((entry) => resolve8(home, entry)),
-    ...(extraPaths ?? []).map((entry) => resolve8(entry))
+    ...KNOWN_CREDENTIAL_MASK_PATHS.map((entry) => resolve9(home, entry)),
+    ...(extraPaths ?? []).map((entry) => resolve9(entry))
   ];
   const seen = /* @__PURE__ */ new Set();
   const masks = [];
@@ -18595,7 +19228,7 @@ function normalize(paths) {
   for (const path of paths) {
     if (!path)
       continue;
-    seen.add(resolve8(path));
+    seen.add(resolve9(path));
   }
   return Array.from(seen).sort();
 }
@@ -18633,7 +19266,7 @@ function sandboxMountPlan(spec) {
     writable,
     quotaTmpfs: spec.workbench ? [
       {
-        target: resolve8(spec.workbench.dir),
+        target: resolve9(spec.workbench.dir),
         maxBytes: spec.workbench.maxBytes,
         maxInodes: spec.workbench.maxInodes,
         blockGit: true
@@ -18688,7 +19321,7 @@ function buildBwrapArgv(input) {
   for (const binding of quotaTmpfs) {
     args.push("--dir", binding.target, "--size", String(binding.maxBytes), "--tmpfs", binding.target);
     if (binding.blockGit)
-      args.push("--ro-bind", "/dev/null", resolve8(binding.target, ".git"));
+      args.push("--ro-bind", "/dev/null", resolve9(binding.target, ".git"));
   }
   args.push("--chdir", input.cwd);
   args.push("--die-with-parent");
@@ -18754,8 +19387,8 @@ function detectBwrapSandbox(options = {}) {
 
 // apps/body/dist/provider-key-store.js
 import { chmod, mkdir as mkdir2, readFile as readFile3, writeFile as writeFile3 } from "node:fs/promises";
-import { homedir as homedir4 } from "node:os";
-import { dirname as dirname3, resolve as resolve9 } from "node:path";
+import { homedir as homedir5 } from "node:os";
+import { dirname as dirname4, resolve as resolve10 } from "node:path";
 var PROVIDER_KEY_ENV_VARS = {
   openrouter: "OPENROUTER_API_KEY",
   openai: "OPENAI_API_KEY",
@@ -18765,8 +19398,8 @@ var PROVIDER_KEY_ENV_VARS = {
 };
 var GOOGLE_ENV_ALIAS = "GEMINI_API_KEY";
 function providerKeyStorePath(env = process.env) {
-  const configRoot = env.XDG_CONFIG_HOME?.trim() || resolve9(homedir4(), ".config");
-  return resolve9(configRoot, "beeline", "providers.json");
+  const configRoot = env.XDG_CONFIG_HOME?.trim() || resolve10(homedir5(), ".config");
+  return resolve10(configRoot, "beeline", "providers.json");
 }
 async function readProviderKeyStore(env = process.env) {
   const path = providerKeyStorePath(env);
@@ -18789,7 +19422,7 @@ async function readSavedProviderKey(provider, env = process.env) {
 async function saveProviderKey(provider, key, env = process.env) {
   const path = providerKeyStorePath(env);
   const store = { ...await readProviderKeyStore(env), [provider]: key };
-  await mkdir2(dirname3(path), { recursive: true, mode: 448 });
+  await mkdir2(dirname4(path), { recursive: true, mode: 448 });
   await writeFile3(path, `${JSON.stringify(store, null, 2)}
 `, { mode: 384 });
   await chmod(path, 384);
@@ -18826,7 +19459,7 @@ function operatorSecretResolver(env = process.env) {
       if (saved)
         return saved;
     }
-    const raw = await readFile4(resolve10(dirname4(providerKeyStorePath(env)), "secrets.json"), "utf8").catch(() => void 0);
+    const raw = await readFile4(resolve11(dirname5(providerKeyStorePath(env)), "secrets.json"), "utf8").catch(() => void 0);
     if (!raw)
       return void 0;
     try {
@@ -18938,9 +19571,9 @@ var GrantCommandRunner = class {
       ...Object.fromEntries(secrets)
     };
     const cap = this.options.outputCapBytes ?? GRANT_COMMAND_OUTPUT_CAP_BYTES;
-    const spawn11 = surfaceAllows(policy.surface, "run-host-command") ? { command: argv[0], args: argv.slice(1) } : roomSandboxCommand(policy, room.cwd, argv);
+    const spawn12 = surfaceAllows(policy.surface, "run-host-command") ? { command: argv[0], args: argv.slice(1) } : roomSandboxCommand(policy, room.cwd, argv);
     const outcome = await new Promise((resolveRun) => {
-      const child = execFile3(spawn11.command, spawn11.args, {
+      const child = execFile3(spawn12.command, spawn12.args, {
         cwd: room.cwd,
         env,
         timeout: this.options.timeoutMs ?? GRANT_COMMAND_TIMEOUT_MS,
@@ -19018,7 +19651,7 @@ ${ROOM_WRITE_REFUSED_NOTE}` : outcome.output, secrets), cap);
     if (!script || script.path !== argument.path) {
       throw new Error(`${argument.path} is a script no human has read: this grant was approved without it. Ask with request_grant kind=command so the card carries what the command runs.`);
     }
-    if (createHash2("sha256").update(bytes).digest("hex") !== script.sha256) {
+    if (createHash3("sha256").update(bytes).digest("hex") !== script.sha256) {
       throw new Error(`${argument.path} changed after it was approved, so the approval no longer covers it. Ask with request_grant kind=command again so a human reads what runs now.`);
     }
   }
@@ -19028,8 +19661,8 @@ function scriptCandidates(cwd, scratch, argv) {
   if (!argument)
     return [];
   const paths = [
-    resolve10(cwd, argument.path),
-    ...scratch ? [resolve10(scratch, argument.path)] : []
+    resolve11(cwd, argument.path),
+    ...scratch ? [resolve11(scratch, argument.path)] : []
   ];
   return [...new Set(paths)];
 }
@@ -19210,20 +19843,20 @@ function captureConnectionUsage(recorder, turn, calls) {
 }
 
 // apps/body/dist/server-command-intake.js
-import { randomUUID as randomUUID2 } from "node:crypto";
+import { randomUUID as randomUUID3 } from "node:crypto";
 import { mkdir as mkdir3, writeFile as writeFile4 } from "node:fs/promises";
-import { tmpdir as tmpdir2 } from "node:os";
-import { dirname as dirname5, join as join4 } from "node:path";
+import { tmpdir as tmpdir3 } from "node:os";
+import { dirname as dirname6, join as join5 } from "node:path";
 var CommandExecutionContext = class {
-  generationId = randomUUID2();
+  generationId = randomUUID3();
   path;
   current;
   constructor(root) {
-    this.path = join4(root ?? tmpdir2(), `beeline-command-${this.generationId}.json`);
+    this.path = join5(root ?? tmpdir3(), `beeline-command-${this.generationId}.json`);
   }
   async enter(command) {
     this.current = command;
-    await mkdir3(dirname5(this.path), { recursive: true });
+    await mkdir3(dirname6(this.path), { recursive: true });
     await writeFile4(this.path, JSON.stringify({
       roomId: command.roomId,
       requestId: command.turnRequestId,
@@ -19345,13 +19978,13 @@ async function runServerCommandIntake(options) {
         }
       }
       options.onPoll?.();
-      const reconcile = await new Promise((resolve31) => {
+      const reconcile = await new Promise((resolve32) => {
         const done = (needed) => {
           if (timer)
             clearTimeout(timer);
           signal?.removeEventListener("abort", aborted);
           wake = void 0;
-          resolve31(needed);
+          resolve32(needed);
         };
         const aborted = () => done(false);
         wake = done;
@@ -19377,22 +20010,35 @@ async function runServerCommandIntake(options) {
 
 // apps/body/dist/monolith-corner-turn.js
 import { execFile as execFile5 } from "node:child_process";
-import { createHash as createHash5 } from "node:crypto";
+import { createHash as createHash6 } from "node:crypto";
 import { mkdir as mkdir12 } from "node:fs/promises";
-import { homedir as homedir7 } from "node:os";
-import { join as join9 } from "node:path";
+import { homedir as homedir8 } from "node:os";
+import { join as join10 } from "node:path";
 import { promisify as promisify3 } from "node:util";
 
 // apps/body/dist/agent-home.js
-import { existsSync as existsSync3, readFileSync as readFileSync5 } from "node:fs";
-import { createHash as createHash3, randomUUID as randomUUID3 } from "node:crypto";
+import { existsSync as existsSync4, readFileSync as readFileSync6 } from "node:fs";
+import { createHash as createHash4, randomUUID as randomUUID4 } from "node:crypto";
 import { chmod as chmod2, copyFile, lstat, mkdir as mkdir5, readFile as readFile6, readdir as readdir2, realpath, rename as rename2, rm as rm2, symlink, unlink, writeFile as writeFile6 } from "node:fs/promises";
-import { homedir as homedir5 } from "node:os";
-import { basename as basename3, dirname as dirname6, join as join5, relative as relative2, resolve as resolve13, sep } from "node:path";
+import { homedir as homedir6 } from "node:os";
+import { basename as basename4, dirname as dirname7, join as join6, relative as relative2, resolve as resolve14, sep } from "node:path";
 
 // apps/body/dist/beeline-skill.js
-import { readFileSync as readFileSync4 } from "node:fs";
-import { resolve as resolve11 } from "node:path";
+import { readFileSync as readFileSync5 } from "node:fs";
+import { resolve as resolve12 } from "node:path";
+
+// packages/api-contract/dist/workbench.js
+var CONNECTABLE_CONNECTOR_KINDS = [
+  "trusty-squire",
+  "google-gmail",
+  "google-calendar",
+  "google-drive",
+  "google-youtube"
+];
+
+// packages/api-contract/dist/connector-offers.js
+var CONNECTOR_OFFER_WINDOW_MS = 2 * 6e4;
+var OFFERABLE_CONNECTOR_KINDS = CONNECTABLE_CONNECTOR_KINDS.filter((kind) => kind !== "wallet");
 
 // packages/api-contract/dist/agent-pairing-code.js
 var CURRENT_AGENT_PAIRING_CODE = /^[0-9A-F]{8}-[0-9A-F]{8}$/;
@@ -19457,12 +20103,12 @@ function beelineCapabilityContextForHarness(agentCommand, repository, directMess
     ...harnessHonorsSessionSystemPrompt(agentCommand) ? {} : { compatibilityTurnPrefix: primer }
   };
 }
-function runningBeelineReleaseId(env = process.env, read = (path) => readFileSync4(path, "utf8")) {
+function runningBeelineReleaseId(env = process.env, read = (path) => readFileSync5(path, "utf8")) {
   try {
     const lib = env.BEELINE_LIB_DIR;
     if (!lib)
       return "source";
-    const manifest = JSON.parse(read(resolve11(lib, "bundle.json")));
+    const manifest = JSON.parse(read(resolve12(lib, "bundle.json")));
     return [manifest.version, manifest.commit].filter(Boolean).join("-") || "source";
   } catch {
     return "source";
@@ -19484,13 +20130,17 @@ When your corner's pull request is ready, merging is your step: once the configu
 
 ## Tools and the Workbench
 
-A **tool** is something you can use once a human pairs it; a **key** is the credential that tool holds for that human. You spend a key through the mounted connector and never see the credential itself.
+A **tool** is something you can use once a human adds it; a **key** is the credential that tool holds for that human. You spend a key through the mounted connector and never see the credential itself.
 
-This build knows one tool: Trusty Squire - vaulted credentials and a browser that signs in for you. Wallet and Tailscale are named in the Workbench but not yet available.
+The tools this build knows, what each is for, and which the person you are answering already has are one call away: beeline-agent workbench_status. Trusty Squire is vaulted credentials plus a browser that signs up and signs in for you; the Google tools (Gmail, Calendar, Drive, YouTube) work through the person's own Google sign-in. The wallet is created only from the Workbench page, and Tailscale is not available yet.
 
-You NEVER pair a tool and never ask for a raw credential in chat. When a task needs one you do not have, say so plainly, name the tool that would solve it, and tell the person exactly where to go: Settings \u2192 Workbench \u2192 Tools.
+**Offer the tool at the moment you need it.** When the work in front of you needs a tool the person does not have, do not send them to a settings page and do not stop at naming it. Call workbench_status first - a tool they already have is used, not offered. Then call offer_connector with the connectorType and one short reason: a card appears in this Room, spoken by you, addressed to the person you are answering, with one action. Only that person or a Workspace admin can accept it; accepting adds the tool on your machine, and the sign-in or keys stay theirs. Your turn pauses on the card - say in prose what you are waiting for and end the turn; you are woken when it is added, and then you carry on.
 
-Keys are sovereign: they belong to the human who provisioned them. You cannot use another member's key and must not ask a member to share one.
+**Research before you offer, and say so.** Never offer a tool you cannot describe. If someone asks you to install or add something you do not already know - by name, by purpose, or by what it will hold - say plainly that you are looking it up first, find out what it is and what it does with credentials, and state what you learned in your reply BEFORE the card appears. A person reading "Add X?" must already have read, in your own words, what X is. Refusing to act blind is part of being trusted with keys.
+
+An offer is setup, never authority: it does not replace a grant, write permission, target-branch confirmation, or the merge gate, and it never needs a raw credential in chat. You never pair a tool yourself and never ask anyone for a key value; once a tool is added, provisioning happens inside it and receipts reach the person through the tool's own status message.
+
+Keys are sovereign: they belong to the human who provisioned them. You cannot use another member's key and must not ask a member to share one. The Workbench page remains the place a person manages tools and keys by hand (Settings \u2192 Workbench); you point there to MANAGE what exists, not to add what you need.
 
 ## Showing a mock
 
@@ -19644,7 +20294,7 @@ var SQUIRE_GOVERNED_TOOL_SET = new Set(SQUIRE_GOVERNED_TOOLS);
 
 // apps/body/dist/openrouter-routing.js
 import { mkdir as mkdir4, readFile as readFile5, writeFile as writeFile5 } from "node:fs/promises";
-import { resolve as resolve12 } from "node:path";
+import { resolve as resolve13 } from "node:path";
 var OPENROUTER_ENDPOINTS_BASE_URL = "https://openrouter.ai/api/v1/models";
 var OPENROUTER_COMPLETIONS_URL = "https://openrouter.ai/api/v1/chat/completions";
 var OPENROUTER_ROUTING_CACHE_TTL_MS = 24 * 60 * 60 * 1e3;
@@ -19746,10 +20396,10 @@ function openRouterRoutingFor(providers, allowFallbacks = true) {
   };
 }
 function openRouterRoutingCacheDir(runtimeDir) {
-  return resolve12(runtimeDir, "openrouter-routing");
+  return resolve13(runtimeDir, "openrouter-routing");
 }
 function cachePath(cacheDir, model) {
-  return resolve12(cacheDir, `${model.replace(/[^A-Za-z0-9._-]+/g, "_")}.json`);
+  return resolve13(cacheDir, `${model.replace(/[^A-Za-z0-9._-]+/g, "_")}.json`);
 }
 async function readCache(cacheDir, model) {
   try {
@@ -19780,7 +20430,7 @@ async function writeCache(cacheDir, value) {
   });
 }
 function probeCachePath(cacheDir, model) {
-  return resolve12(cacheDir, `${model.replace(/[^A-Za-z0-9._-]+/g, "_")}.probe.json`);
+  return resolve13(cacheDir, `${model.replace(/[^A-Za-z0-9._-]+/g, "_")}.probe.json`);
 }
 async function readProbeCache(cacheDir, model) {
   try {
@@ -20220,8 +20870,8 @@ var SHARED_CREDENTIALS = [
   // shape as codex).
   { dir: "grok", source: ".grok/auth.json", target: "auth.json" },
   { dir: "pi", source: ".pi/agent/auth.json", target: "auth.json" },
-  // Cursor CLI stores auth state under ~/.cursor/; cursor-agent-acp
-  // reads CURSOR_HOME to relocate the data directory.
+  // Cursor CLI stores auth state under ~/.cursor/; cursor-agent reads
+  // CURSOR_HOME to relocate the data directory.
   { dir: "cursor", source: ".cursor/agent-cli-state.json", target: "agent-cli-state.json" }
 ];
 var GOOSE_SHARED_CONFIG_FILES = ["config.yaml", "secrets.yaml"];
@@ -20270,8 +20920,8 @@ var HOME_SUBDIRS = [
   "tmp"
 ];
 async function prepareRoomAgentHome(input) {
-  const root = resolve13(input.root);
-  const operatorHome = input.operatorHome ?? homedir5();
+  const root = resolve14(input.root);
+  const operatorHome = input.operatorHome ?? homedir6();
   try {
     await mkdir5(root, { recursive: true, mode: 448 });
     const rootStats = await lstat(root);
@@ -20279,7 +20929,7 @@ async function prepareRoomAgentHome(input) {
       throw new AgentHomeSecurityError(`agent home root is not an ordinary directory: ${root}`);
     }
     for (const subdir of HOME_SUBDIRS) {
-      const path = resolve13(root, subdir);
+      const path = resolve14(root, subdir);
       await mkdir5(path, { recursive: true, mode: 448 });
       await assertRealContainedDirectory(path, root);
     }
@@ -20290,9 +20940,9 @@ async function prepareRoomAgentHome(input) {
     return {};
   }
   for (const credential of SHARED_CREDENTIALS) {
-    const source = resolve13(operatorHome, credential.source);
-    const target = resolve13(root, credential.dir, credential.target);
-    if (!existsSync3(source) || existsSync3(target))
+    const source = resolve14(operatorHome, credential.source);
+    const target = resolve14(root, credential.dir, credential.target);
+    if (!existsSync4(source) || existsSync4(target))
       continue;
     await symlink(source, target).catch(() => void 0);
   }
@@ -20314,12 +20964,12 @@ async function provisionAgentSkillsAndMcp(root, operatorHome, skillReleaseId, fa
     ...isReviewer ? [{ name: BEELINE_REVIEW_SKILL_NAME, content: beelineReviewSkillMarkdown(skillReleaseId) }] : []
   ];
   const shared = await resolveSharedSkillSources(operatorHome, sharedSkills);
-  await provisionManagedSkillsDir(resolve13(root, skillDir, "skills"), managedSkills, shared, sharedSkills.length === 0);
+  await provisionManagedSkillsDir(resolve14(root, skillDir, "skills"), managedSkills, shared, sharedSkills.length === 0);
   for (const config of HARNESS_MCP_CONFIGS) {
     try {
-      const source = resolve13(operatorHome, config.toml);
-      const target = resolve13(root, config.dir, "config.toml");
-      const mcpSection = existsSync3(source) ? filteredHarnessMcpToml(readFileSync5(source, "utf8")) : void 0;
+      const source = resolve14(operatorHome, config.toml);
+      const target = resolve14(root, config.dir, "config.toml");
+      const mcpSection = existsSync4(source) ? filteredHarnessMcpToml(readFileSync6(source, "utf8")) : void 0;
       const section = config.dir === "codex" ? [CODEX_ROOM_AGENT_LOCKDOWN_TOML, CODEX_ROOM_WEB_SEARCH_TOML, mcpSection].filter(Boolean).join("\n") : mcpSection;
       if (!section) {
         await unlink(target).catch(() => void 0);
@@ -20333,13 +20983,13 @@ async function provisionAgentSkillsAndMcp(root, operatorHome, skillReleaseId, fa
     }
   }
   try {
-    const gooseConfigDir = resolve13(root, "goose", "config");
+    const gooseConfigDir = resolve14(root, "goose", "config");
     await mkdir5(gooseConfigDir, { recursive: true, mode: 448 });
     for (const name of GOOSE_SHARED_CONFIG_FILES) {
-      const source = resolve13(operatorHome, ".config", "goose", name);
-      const target = resolve13(gooseConfigDir, name);
-      if (existsSync3(source)) {
-        await writeIsolatedHarnessFile(target, readFileSync5(source, "utf8"));
+      const source = resolve14(operatorHome, ".config", "goose", name);
+      const target = resolve14(gooseConfigDir, name);
+      if (existsSync4(source)) {
+        await writeIsolatedHarnessFile(target, readFileSync6(source, "utf8"));
       } else {
         await unlink(target).catch(() => void 0);
       }
@@ -20350,9 +21000,9 @@ async function provisionAgentSkillsAndMcp(root, operatorHome, skillReleaseId, fa
     console.warn("[body] operator Goose configuration passthrough failed:", error);
   }
   try {
-    const claudeJson = resolve13(operatorHome, ".claude.json");
-    const claudeTarget = resolve13(root, "claude", ".claude.json");
-    const mcpServers = existsSync3(claudeJson) ? readClaudeUserScopeMcpServers(claudeJson) : void 0;
+    const claudeJson = resolve14(operatorHome, ".claude.json");
+    const claudeTarget = resolve14(root, "claude", ".claude.json");
+    const mcpServers = existsSync4(claudeJson) ? readClaudeUserScopeMcpServers(claudeJson) : void 0;
     if (mcpServers && Object.keys(mcpServers).length > 0) {
       await writeIsolatedHarnessFile(claudeTarget, `${JSON.stringify({ mcpServers }, null, 2)}
 `);
@@ -20366,7 +21016,7 @@ async function provisionAgentSkillsAndMcp(root, operatorHome, skillReleaseId, fa
   }
   try {
     const settings2 = { permissions: { allow: ["WebSearch", "WebFetch"] } };
-    await writeIsolatedHarnessFile(resolve13(root, "claude", "settings.json"), `${JSON.stringify(settings2, null, 2)}
+    await writeIsolatedHarnessFile(resolve14(root, "claude", "settings.json"), `${JSON.stringify(settings2, null, 2)}
 `);
   } catch (error) {
     if (failClosed)
@@ -20376,8 +21026,8 @@ async function provisionAgentSkillsAndMcp(root, operatorHome, skillReleaseId, fa
   await provisionPiCustomModelConfig(root, operatorHome, failClosed, openRouterRouting);
 }
 async function provisionPiCustomModelConfig(root, operatorHome, failClosed, openRouterRouting) {
-  const source = resolve13(operatorHome, PI_CUSTOM_MODEL_CONFIG.source);
-  const target = resolve13(root, "pi", PI_CUSTOM_MODEL_CONFIG.target);
+  const source = resolve14(operatorHome, PI_CUSTOM_MODEL_CONFIG.source);
+  const target = resolve14(root, "pi", PI_CUSTOM_MODEL_CONFIG.target);
   let decision2;
   if (openRouterRouting) {
     decision2 = await resolveOpenRouterRouting(openRouterRouting);
@@ -20410,7 +21060,7 @@ async function provisionPiCustomModelConfig(root, operatorHome, failClosed, open
     if (resolvedSource !== source) {
       throw new AgentHomeSecurityError(`Pi custom model config resolves through a link: ${source}`);
     }
-    const sourceValue = JSON.parse(readFileSync5(resolvedSource, "utf8"));
+    const sourceValue = JSON.parse(readFileSync6(resolvedSource, "utf8"));
     await writeIsolatedHarnessFile(target, `${JSON.stringify(withOpenRouterModelRouting(sourceValue, pin), null, 2)}
 `);
   } catch (error) {
@@ -20422,7 +21072,7 @@ async function provisionPiCustomModelConfig(root, operatorHome, failClosed, open
 }
 function readClaudeUserScopeMcpServers(path) {
   try {
-    const parsed = JSON.parse(readFileSync5(path, "utf8"));
+    const parsed = JSON.parse(readFileSync6(path, "utf8"));
     if (parsed && typeof parsed.mcpServers === "object" && parsed.mcpServers !== null) {
       return Object.fromEntries(Object.entries(parsed.mcpServers).filter(([name, value]) => {
         if (name === "squire")
@@ -20446,21 +21096,21 @@ function filteredHarnessMcpToml(source) {
   return extractTomlSections(source, ["mcp_servers"], excluded);
 }
 async function provisionManagedSkillsDir(target, managedSkills, sharedSkills, optionalShares) {
-  const parent = dirname6(target);
-  await assertRealContainedDirectory(parent, dirname6(parent));
+  const parent = dirname7(target);
+  await assertRealContainedDirectory(parent, dirname7(parent));
   const plan = await planManagedSkills(managedSkills, sharedSkills, optionalShares);
   if (await materializedSkillManifest(target) === plan.manifest)
     return;
-  const staged = resolve13(parent, `.skills.${process.pid}.${randomUUID3()}.tmp`);
+  const staged = resolve14(parent, `.skills.${process.pid}.${randomUUID4()}.tmp`);
   await mkdir5(staged, { mode: 448 });
   try {
     for (const entry of plan.entries) {
       if (entry.kind === "managed") {
-        const skillDir = resolve13(staged, entry.name);
+        const skillDir = resolve14(staged, entry.name);
         await mkdir5(skillDir, { recursive: true });
-        await writeIsolatedHarnessFile(resolve13(skillDir, "SKILL.md"), entry.content);
+        await writeIsolatedHarnessFile(resolve14(skillDir, "SKILL.md"), entry.content);
       } else {
-        await copySafeSkillTree(entry.source, resolve13(staged, entry.name), entry.source);
+        await copySafeSkillTree(entry.source, resolve14(staged, entry.name), entry.source);
       }
     }
     const existing = await lstat(target).catch(() => void 0);
@@ -20487,8 +21137,8 @@ async function planManagedSkills(managedSkills, sharedSkills, optionalShares) {
     try {
       const tree = [];
       await walkSafeSkillTree(shared.source, shared.source, {
-        directory: async (rel) => void tree.push(`d ${join5(shared.name, rel)}`),
-        file: async (rel, realPath) => void tree.push(`f ${join5(shared.name, rel)} ${sha2563(await readFile6(realPath))}`)
+        directory: async (rel) => void tree.push(`d ${join6(shared.name, rel)}`),
+        file: async (rel, realPath) => void tree.push(`f ${join6(shared.name, rel)} ${sha2563(await readFile6(realPath))}`)
       });
       entries.push({ kind: "shared", name: shared.name, source: shared.source });
       lines.push(...tree);
@@ -20507,8 +21157,8 @@ async function materializedSkillManifest(target) {
   const lines = [];
   const visit = async (directory, prefix) => {
     for (const entry of await readdir2(directory)) {
-      const path = resolve13(directory, entry);
-      const rel = prefix ? join5(prefix, entry) : entry;
+      const path = resolve14(directory, entry);
+      const rel = prefix ? join6(prefix, entry) : entry;
       const entryStats = await lstat(path);
       if (entryStats.isSymbolicLink())
         return false;
@@ -20533,7 +21183,7 @@ async function materializedSkillManifest(target) {
   return lines.sort().join("\n");
 }
 function sha2563(value) {
-  return createHash3("sha256").update(value).digest("hex");
+  return createHash4("sha256").update(value).digest("hex");
 }
 async function resolveSharedSkillSources(operatorHome, names) {
   if (names.length > 0)
@@ -20542,14 +21192,14 @@ async function resolveSharedSkillSources(operatorHome, names) {
   const resolved = [];
   const skipped = [];
   for (const relativeRoot of OPERATOR_SKILL_SOURCE_DIRS) {
-    const sourceRoot = resolve13(operatorHome, relativeRoot);
+    const sourceRoot = resolve14(operatorHome, relativeRoot);
     const rootStats = await lstat(sourceRoot).catch(() => void 0);
     if (!rootStats?.isDirectory() || rootStats.isSymbolicLink())
       continue;
     for (const entry of await readdir2(sourceRoot)) {
       if (!isSharedSkillName(entry) || seen.has(entry))
         continue;
-      const candidate = resolve13(sourceRoot, entry);
+      const candidate = resolve14(sourceRoot, entry);
       try {
         const candidateStats = await lstat(candidate);
         if (candidateStats.isSymbolicLink()) {
@@ -20565,7 +21215,7 @@ async function resolveSharedSkillSources(operatorHome, names) {
           continue;
         }
         assertContained(sourceRoot, candidate);
-        const skillMd = resolve13(candidate, "SKILL.md");
+        const skillMd = resolve14(candidate, "SKILL.md");
         const skillStats = await lstat(skillMd).catch((error) => {
           if (isMissingPathError(error)) {
             skipped.push({ path: candidate, reason: "missing SKILL.md" });
@@ -20617,8 +21267,8 @@ async function resolveExplicitSkillSources(operatorHome, names) {
   for (const name of unique) {
     const matches = [];
     for (const relativeRoot of OPERATOR_SKILL_SOURCE_DIRS) {
-      const sourceRoot = resolve13(operatorHome, relativeRoot);
-      const candidate = resolve13(sourceRoot, name);
+      const sourceRoot = resolve14(operatorHome, relativeRoot);
+      const candidate = resolve14(sourceRoot, name);
       const rootStats = await lstat(sourceRoot).catch(() => void 0);
       const candidateStats = await lstat(candidate).catch(() => void 0);
       if (!candidateStats)
@@ -20635,7 +21285,7 @@ async function resolveExplicitSkillSources(operatorHome, names) {
     if (matches.length !== 1) {
       throw new Error(matches.length === 0 ? `shared skill is unavailable: ${name}` : `shared skill source is ambiguous: ${name}`);
     }
-    const skillMd = resolve13(matches[0], "SKILL.md");
+    const skillMd = resolve14(matches[0], "SKILL.md");
     const skillStats = await lstat(skillMd).catch(() => void 0);
     if (!skillStats?.isFile() || skillStats.isSymbolicLink() || skillStats.nlink !== 1) {
       throw new Error(`shared skill requires an ordinary SKILL.md: ${name}`);
@@ -20646,7 +21296,7 @@ async function resolveExplicitSkillSources(operatorHome, names) {
 }
 function assertContained(root, candidate) {
   const rel = relative2(root, candidate);
-  if (rel === ".." || rel.startsWith(`..${sep}`) || resolve13(root, rel) !== resolve13(candidate)) {
+  if (rel === ".." || rel.startsWith(`..${sep}`) || resolve14(root, rel) !== resolve14(candidate)) {
     throw new Error(`path escapes the agent skill boundary: ${candidate}`);
   }
 }
@@ -20661,14 +21311,14 @@ var BLOCKED_SHARED_FILENAMES = /^(?:\.env(?:\..*)?|auth\.json|\.credentials\.jso
 async function walkSafeSkillTree(source, sourceRoot, visitor, rel = "") {
   assertContained(sourceRoot, source);
   const resolvedSource = await realpath(source);
-  if (resolvedSource !== resolve13(source)) {
+  if (resolvedSource !== resolve14(source)) {
     throw new Error(`shared skill path resolves through a link: ${source}`);
   }
   assertContained(sourceRoot, resolvedSource);
   const stats = await lstat(resolvedSource);
   if (stats.isSymbolicLink())
     throw new Error(`shared skill contains a symlink: ${source}`);
-  if (BLOCKED_SHARED_FILENAMES.test(basename3(source))) {
+  if (BLOCKED_SHARED_FILENAMES.test(basename4(source))) {
     throw new Error(`shared skill contains credential or configuration material: ${source}`);
   }
   if (stats.isDirectory()) {
@@ -20676,7 +21326,7 @@ async function walkSafeSkillTree(source, sourceRoot, visitor, rel = "") {
     for (const entry of await readdir2(resolvedSource)) {
       if (entry === "." || entry === "..")
         throw new Error("invalid shared skill entry");
-      await walkSafeSkillTree(resolve13(source, entry), sourceRoot, visitor, rel ? join5(rel, entry) : entry);
+      await walkSafeSkillTree(resolve14(source, entry), sourceRoot, visitor, rel ? join6(rel, entry) : entry);
     }
     return;
   }
@@ -20688,22 +21338,22 @@ async function walkSafeSkillTree(source, sourceRoot, visitor, rel = "") {
 async function copySafeSkillTree(source, target, sourceRoot) {
   await walkSafeSkillTree(source, sourceRoot, {
     directory: async (rel) => {
-      await mkdir5(resolve13(target, rel), { mode: 448 });
+      await mkdir5(resolve14(target, rel), { mode: 448 });
     },
     file: async (rel, realPath) => {
-      const destination = resolve13(target, rel);
+      const destination = resolve14(target, rel);
       await copyFile(realPath, destination);
       await chmod2(destination, 384);
     }
   });
 }
 async function writeIsolatedHarnessFile(path, content) {
-  const parent = dirname6(path);
+  const parent = dirname7(path);
   const parentStats = await lstat(parent);
   if (!parentStats.isDirectory() || parentStats.isSymbolicLink()) {
     throw new Error(`isolated harness parent is not a real directory: ${parent}`);
   }
-  const temporary = resolve13(parent, `.${basename3(path)}.${process.pid}.${randomUUID3()}.tmp`);
+  const temporary = resolve14(parent, `.${basename4(path)}.${process.pid}.${randomUUID4()}.tmp`);
   try {
     await writeFile6(temporary, content, { mode: 384, flag: "wx" });
     await chmod2(temporary, 384);
@@ -20713,18 +21363,18 @@ async function writeIsolatedHarnessFile(path, content) {
   }
 }
 function roomAgentHomeEnv(root) {
-  const resolved = resolve13(root);
+  const resolved = resolve14(root);
   return {
-    HOME: resolve13(resolved, "user"),
-    CLAUDE_CONFIG_DIR: resolve13(resolved, "claude"),
-    CODEX_HOME: resolve13(resolved, "codex"),
-    GOOSE_PATH_ROOT: resolve13(resolved, "goose"),
-    GROK_HOME: resolve13(resolved, "grok"),
-    CURSOR_HOME: resolve13(resolved, "cursor"),
-    PI_CODING_AGENT_DIR: resolve13(resolved, "pi"),
-    XDG_STATE_HOME: resolve13(resolved, "state"),
-    XDG_CACHE_HOME: resolve13(resolved, "cache"),
-    TMPDIR: resolve13(resolved, "tmp")
+    HOME: resolve14(resolved, "user"),
+    CLAUDE_CONFIG_DIR: resolve14(resolved, "claude"),
+    CODEX_HOME: resolve14(resolved, "codex"),
+    GOOSE_PATH_ROOT: resolve14(resolved, "goose"),
+    GROK_HOME: resolve14(resolved, "grok"),
+    CURSOR_HOME: resolve14(resolved, "cursor"),
+    PI_CODING_AGENT_DIR: resolve14(resolved, "pi"),
+    XDG_STATE_HOME: resolve14(resolved, "state"),
+    XDG_CACHE_HOME: resolve14(resolved, "cache"),
+    TMPDIR: resolve14(resolved, "tmp")
   };
 }
 var HARNESS_STATE_ENV_VARS = [
@@ -20743,22 +21393,22 @@ function harnessStateDirsFromEnv(env) {
   for (const name of HARNESS_STATE_ENV_VARS) {
     const value = env[name];
     if (value)
-      stateDirs.push(resolve13(value));
+      stateDirs.push(resolve14(value));
   }
   const tmp = env.TMPDIR;
-  return { stateDirs, ...tmp ? { tmpDir: resolve13(tmp) } : {} };
+  return { stateDirs, ...tmp ? { tmpDir: resolve14(tmp) } : {} };
 }
 
 // apps/body/dist/attachment-delivery.js
 import { mkdir as mkdir6, writeFile as writeFile7 } from "node:fs/promises";
-import { basename as basename4, extname, join as join6 } from "node:path";
+import { basename as basename5, extname, join as join7 } from "node:path";
 var MAX_ATTACHMENT_BYTES = 25 * 1024 * 1024;
 var MEDIA_TTL_HOURS = 24;
 var EXPIRED_REASON = `expired: attachments are kept for ${MEDIA_TTL_HOURS} hours and these bytes are past that window`;
 var FETCH_TIMEOUT_MS = 3e4;
 var MAX_INLINE_IMAGE_BYTES = 5 * 1024 * 1024;
 function safeFileName(attachment, index, taken) {
-  const raw = basename4(attachment.name ?? "").replace(/[^\w.-]+/g, "_").replace(/^\.+/, "");
+  const raw = basename5(attachment.name ?? "").replace(/[^\w.-]+/g, "_").replace(/^\.+/, "");
   let name = raw || `attachment-${index + 1}`;
   if (taken.has(name)) {
     const ext = extname(name);
@@ -20795,7 +21445,7 @@ async function deliverAttachments(attachments, dir, fetchImpl = fetch) {
       const bytes = Buffer.from(await response.arrayBuffer());
       if (bytes.length > MAX_ATTACHMENT_BYTES)
         return tooLarge(bytes.length);
-      const path = join6(dir, safeFileName(attachment, index, taken));
+      const path = join7(dir, safeFileName(attachment, index, taken));
       await writeFile7(path, bytes);
       const mimeType = attachment.mimeType ?? response.headers.get("content-type") ?? "";
       if (!mimeType.startsWith("image/"))
@@ -21186,7 +21836,7 @@ function sessionConfigFingerprint(input) {
 
 // apps/body/dist/pi-mcp-bridge.js
 import { mkdir as mkdir7 } from "node:fs/promises";
-import { resolve as resolve14 } from "node:path";
+import { resolve as resolve15 } from "node:path";
 var PI_MCP_BRIDGE_FILENAME = "beeline-mcp-bridge.js";
 function harnessMountsSessionMcpServers(agentCommand) {
   return !(agentCommand && /(^|[/\\])pi-acp(\.[a-z]+)?$/i.test(agentCommand));
@@ -21206,8 +21856,8 @@ async function installPiMcpBridge(input) {
     return void 0;
   if (!input.piHome || !input.servers.length)
     return void 0;
-  const directory = resolve14(input.piHome, "extensions");
-  const path = resolve14(directory, PI_MCP_BRIDGE_FILENAME);
+  const directory = resolve15(input.piHome, "extensions");
+  const path = resolve15(directory, PI_MCP_BRIDGE_FILENAME);
   try {
     await mkdir7(directory, { recursive: true, mode: 448 });
     await writeIsolatedHarnessFile(path, piMcpBridgeSource(input.servers));
@@ -21407,7 +22057,7 @@ async function contains(git, head, ancestor) {
 }
 
 // apps/body/dist/room-session.js
-import { resolve as resolve15 } from "node:path";
+import { resolve as resolve16 } from "node:path";
 
 // apps/body/dist/read-only-policy.js
 var READ_ONLY_MCP_SERVER_NAME = "beeline-readonly-mcp";
@@ -21632,21 +22282,21 @@ function readOnlyMcpServer(config, cwd, agentMemoryDir) {
     command: config.readonlyMcpCommand,
     args: [...config.readonlyMcpArgs ?? []],
     env: [
-      { name: "BEELINE_READONLY_ROOT", value: resolve15(cwd) },
+      { name: "BEELINE_READONLY_ROOT", value: resolve16(cwd) },
       ...config.agentHomeRoot ? [
         {
           name: "BEELINE_READONLY_AGENT_SKILLS_ROOT",
-          value: resolve15(config.agentHomeRoot, skillDir, "skills")
+          value: resolve16(config.agentHomeRoot, skillDir, "skills")
         }
       ] : [],
-      ...agentMemoryDir ? [{ name: "BEELINE_READONLY_AGENT_MEMORY_ROOT", value: resolve15(agentMemoryDir) }] : []
+      ...agentMemoryDir ? [{ name: "BEELINE_READONLY_AGENT_MEMORY_ROOT", value: resolve16(agentMemoryDir) }] : []
     ]
   };
 }
 
 // apps/body/dist/pi-turn-record.js
 import { readdir as readdir3, readFile as readFile7 } from "node:fs/promises";
-import { resolve as resolve16 } from "node:path";
+import { resolve as resolve17 } from "node:path";
 function summarizeProviderError(errorMessage2) {
   const trimmed = errorMessage2.trim();
   const statusMatch = /^(\d{3}):\s*([\s\S]*)$/.exec(trimmed);
@@ -21667,7 +22317,7 @@ function summarizeProviderError(errorMessage2) {
 }
 async function sessionFileFromMap(home, sessionId) {
   try {
-    const raw = await readFile7(resolve16(home, ".pi", "pi-acp", "session-map.json"), "utf8");
+    const raw = await readFile7(resolve17(home, ".pi", "pi-acp", "session-map.json"), "utf8");
     const map = JSON.parse(raw);
     const file = map.sessions?.[sessionId]?.sessionFile;
     return typeof file === "string" && file ? file : void 0;
@@ -21676,7 +22326,7 @@ async function sessionFileFromMap(home, sessionId) {
   }
 }
 async function sessionFileFromLayout(piDir, sessionId) {
-  const sessionsRoot = resolve16(piDir, "sessions");
+  const sessionsRoot = resolve17(piDir, "sessions");
   const suffix = `_${sessionId}.jsonl`;
   let projects;
   try {
@@ -21685,7 +22335,7 @@ async function sessionFileFromLayout(piDir, sessionId) {
     return void 0;
   }
   for (const project of projects) {
-    const dir = resolve16(sessionsRoot, project);
+    const dir = resolve17(sessionsRoot, project);
     let files;
     try {
       files = await readdir3(dir);
@@ -21694,7 +22344,7 @@ async function sessionFileFromLayout(piDir, sessionId) {
     }
     const match = files.find((file) => file.endsWith(suffix));
     if (match)
-      return resolve16(dir, match);
+      return resolve17(dir, match);
   }
   return void 0;
 }
@@ -21869,7 +22519,7 @@ async function withTurnReceiptHeartbeat(api, receipt, task, onHeartbeatError) {
 
 // apps/body/dist/turn-trace.js
 import { appendFile, mkdir as mkdir8, readdir as readdir4, rm as rm3 } from "node:fs/promises";
-import { resolve as resolve17 } from "node:path";
+import { resolve as resolve18 } from "node:path";
 import { performance as performance2 } from "node:perf_hooks";
 var TURN_PHASES = [
   /** Enqueued on `SessionScheduler` until this turn holds a slot. A capacity wait lives here. */
@@ -22099,7 +22749,7 @@ function formatTurnTraceLine(record3) {
   return [head, ...record3.attempts.map((attempt) => formatTurnAttempt(attempt))].join("\n  ");
 }
 function turnTraceDirectory(runtimeDir) {
-  return resolve17(runtimeDir, "turn-traces");
+  return resolve18(runtimeDir, "turn-traces");
 }
 var TURN_TRACE_RETENTION_DAYS = 7;
 function traceFileName(date) {
@@ -22116,7 +22766,7 @@ var TurnTraceFile = class {
     this.options = options;
   }
   path(now2 = (this.options.clock ?? (() => /* @__PURE__ */ new Date()))()) {
-    return resolve17(this.directory, traceFileName(now2));
+    return resolve18(this.directory, traceFileName(now2));
   }
   write(record3) {
     this.tail = this.tail.catch(() => void 0).then(async () => {
@@ -22140,15 +22790,15 @@ var TurnTraceFile = class {
     this.prunedDay = day;
     const cutoff = traceFileName(new Date(now2.getTime() - TURN_TRACE_RETENTION_DAYS * 864e5));
     const names = await readdir4(this.directory).catch(() => []);
-    await Promise.all(names.filter((name) => /^turns-\d{4}-\d{2}-\d{2}\.jsonl$/.test(name) && name < cutoff).map((name) => rm3(resolve17(this.directory, name), { force: true })));
+    await Promise.all(names.filter((name) => /^turns-\d{4}-\d{2}-\d{2}\.jsonl$/.test(name) && name < cutoff).map((name) => rm3(resolve18(this.directory, name), { force: true })));
   }
 };
 
 // apps/body/dist/corner-github-auth.js
 import { chmod as chmod3, mkdir as mkdir9, writeFile as writeFile8 } from "node:fs/promises";
-import { delimiter as delimiter2, resolve as resolve18 } from "node:path";
+import { delimiter as delimiter2, resolve as resolve19 } from "node:path";
 async function installCornerGitHubWrappers(input) {
-  const bin = resolve18(input.root, "beeline-github-bin");
+  const bin = resolve19(input.root, "beeline-github-bin");
   await mkdir9(bin, { recursive: true, mode: 448 });
   const common = {
     node: process.execPath,
@@ -22158,13 +22808,13 @@ async function installCornerGitHubWrappers(input) {
     featureBranch: input.featureBranch,
     targetBranch: input.targetBranch
   };
-  await writeLauncher(resolve18(bin, "git"), {
+  await writeLauncher(resolve19(bin, "git"), {
     ...common,
     command: input.gitBinary,
     launcher: "git"
   });
   if (input.ghBinary)
-    await writeLauncher(resolve18(bin, "gh"), {
+    await writeLauncher(resolve19(bin, "gh"), {
       ...common,
       command: input.ghBinary,
       launcher: "gh"
@@ -22299,25 +22949,25 @@ process.exit(result.status ?? 1);
 }
 
 // apps/body/dist/warm-node-modules.js
-import { createHash as createHash4, randomUUID as randomUUID4 } from "node:crypto";
+import { createHash as createHash5, randomUUID as randomUUID5 } from "node:crypto";
 import { constants as fsConstants } from "node:fs";
 import { chmod as chmod4, copyFile as copyFile2, link, lstat as lstat2, mkdir as mkdir10, readdir as readdir5, readFile as readFile8, readlink, rename as rename3, rm as rm4, stat as stat2, symlink as symlink2, utimes } from "node:fs/promises";
-import { dirname as dirname7, join as join7, resolve as resolve19 } from "node:path";
+import { dirname as dirname8, join as join8, resolve as resolve20 } from "node:path";
 var STORE_FORMAT = "v1";
 var STAGING_PREFIX = ".beeline-warm-";
 var STAGING_SWEEP_MS = 24 * 60 * 60 * 1e3;
 var WARM_STORE_MAX_ENTRIES = 3;
 function sharedNpmCacheDir(supervisorRoot) {
-  return resolve19(supervisorRoot, "beeline", "npm-cache");
+  return resolve20(supervisorRoot, "beeline", "npm-cache");
 }
 function warmNodeModulesStoreDir(supervisorRoot) {
-  return resolve19(supervisorRoot, "beeline", "node-modules");
+  return resolve20(supervisorRoot, "beeline", "node-modules");
 }
 function isPlanRefusal(value) {
   return "failure" in value;
 }
 async function readWarmPlan(worktreePath) {
-  const lockfile = await readFile8(resolve19(worktreePath, "package-lock.json")).catch(() => void 0);
+  const lockfile = await readFile8(resolve20(worktreePath, "package-lock.json")).catch(() => void 0);
   if (!lockfile)
     return { failure: "no-lockfile" };
   const packages = parseLockfilePackages(lockfile);
@@ -22332,7 +22982,7 @@ async function readWarmPlan(worktreePath) {
   const unsafe = trees.find((tree) => !isContainedTreePath(tree));
   if (unsafe)
     return { failure: "unsafe-lockfile", detail: unsafe };
-  const key = createHash4("sha256").update(`${STORE_FORMAT}\0${process.platform}\0${process.arch}\0${process.versions.modules}\0`).update(lockfile).digest("hex").slice(0, 32);
+  const key = createHash5("sha256").update(`${STORE_FORMAT}\0${process.platform}\0${process.arch}\0${process.versions.modules}\0`).update(lockfile).digest("hex").slice(0, 32);
   return { key, trees };
 }
 function nodeModulesTreePaths(packages) {
@@ -22356,11 +23006,11 @@ async function seedWarmNodeModules(input) {
     return { reason: plan.failure, ...plan.detail ? { detail: plan.detail } : {} };
   }
   for (const tree of plan.trees) {
-    if (await pathExists(resolve19(input.worktreePath, tree))) {
+    if (await pathExists(resolve20(input.worktreePath, tree))) {
       return { reason: "present", key: plan.key };
     }
   }
-  const entry = resolve19(input.storeRoot, plan.key);
+  const entry = resolve20(input.storeRoot, plan.key);
   if (!await isDirectory(entry))
     return { reason: "cold", key: plan.key };
   const [storeDevice, checkoutDevice] = await Promise.all([
@@ -22370,19 +23020,19 @@ async function seedWarmNodeModules(input) {
   if (storeDevice === void 0 || storeDevice !== checkoutDevice) {
     return { reason: "cross-device", key: plan.key };
   }
-  const staging = resolve19(input.storeRoot, `${STAGING_PREFIX}${process.pid}.${randomUUID4()}`);
+  const staging = resolve20(input.storeRoot, `${STAGING_PREFIX}${process.pid}.${randomUUID5()}`);
   const placed = [];
   const now2 = (input.now ?? Date.now)();
   try {
     await sweepStaleStaging(input.storeRoot, now2);
     await utimes(entry, now2 / 1e3, now2 / 1e3).catch(() => void 0);
     for (const tree of plan.trees) {
-      await cloneTree(resolve19(entry, tree), resolve19(staging, tree), seedFile);
+      await cloneTree(resolve20(entry, tree), resolve20(staging, tree), seedFile);
     }
     for (const tree of plan.trees) {
-      const target = resolve19(input.worktreePath, tree);
-      await mkdir10(dirname7(target), { recursive: true });
-      await rename3(resolve19(staging, tree), target);
+      const target = resolve20(input.worktreePath, tree);
+      await mkdir10(dirname8(target), { recursive: true });
+      await rename3(resolve20(staging, tree), target);
       placed.push(target);
     }
     return { reason: "seeded", key: plan.key };
@@ -22400,11 +23050,11 @@ async function harvestWarmNodeModules(input) {
   if (isPlanRefusal(plan)) {
     return { reason: plan.failure, ...plan.detail ? { detail: plan.detail } : {} };
   }
-  const entry = resolve19(input.storeRoot, plan.key);
+  const entry = resolve20(input.storeRoot, plan.key);
   if (await pathExists(entry))
     return { reason: "already-warm", key: plan.key };
   for (const tree of plan.trees) {
-    if (!await isDirectory(resolve19(input.worktreePath, tree))) {
+    if (!await isDirectory(resolve20(input.worktreePath, tree))) {
       return { reason: "no-node-modules", key: plan.key, detail: tree };
     }
   }
@@ -22416,12 +23066,12 @@ async function harvestWarmNodeModules(input) {
       detail: `${missing.length} absent, e.g. ${missing.slice(0, 3).join(", ")}`
     };
   }
-  const staging = resolve19(input.storeRoot, `${STAGING_PREFIX}${process.pid}.${randomUUID4()}`);
+  const staging = resolve20(input.storeRoot, `${STAGING_PREFIX}${process.pid}.${randomUUID5()}`);
   try {
     await mkdir10(input.storeRoot, { recursive: true, mode: 493 });
     await sweepStaleStaging(input.storeRoot, (input.now ?? Date.now)());
     for (const tree of plan.trees) {
-      await cloneTree(resolve19(input.worktreePath, tree), resolve19(staging, tree), harvestFile);
+      await cloneTree(resolve20(input.worktreePath, tree), resolve20(staging, tree), harvestFile);
     }
     await input.onCopied?.();
     if (!await stagedTreeIsPublishable(input.worktreePath, staging, plan.key)) {
@@ -22442,18 +23092,18 @@ async function stagedTreeIsPublishable(worktreePath, staging, key) {
   const settled = await readWarmPlan(worktreePath);
   if (isPlanRefusal(settled) || settled.key !== key)
     return false;
-  const hidden = join7("node_modules", ".package-lock.json");
+  const hidden = join8("node_modules", ".package-lock.json");
   const [copied, current] = await Promise.all([
-    readFile8(resolve19(staging, hidden)).catch(() => void 0),
-    readFile8(resolve19(worktreePath, hidden)).catch(() => void 0)
+    readFile8(resolve20(staging, hidden)).catch(() => void 0),
+    readFile8(resolve20(worktreePath, hidden)).catch(() => void 0)
   ]);
   if (!copied || !current || !copied.equals(current))
     return false;
   return (await missingInstalledPackages(worktreePath, staging)).length === 0;
 }
 async function missingInstalledPackages(worktreePath, treeRoot = worktreePath) {
-  const wanted = parseLockfilePackages(await readFile8(resolve19(worktreePath, "package-lock.json")).catch(() => void 0));
-  const installed = parseLockfilePackages(await readFile8(resolve19(treeRoot, "node_modules", ".package-lock.json")).catch(() => void 0));
+  const wanted = parseLockfilePackages(await readFile8(resolve20(worktreePath, "package-lock.json")).catch(() => void 0));
+  const installed = parseLockfilePackages(await readFile8(resolve20(treeRoot, "node_modules", ".package-lock.json")).catch(() => void 0));
   if (!wanted)
     return ["package-lock.json is unreadable"];
   if (!installed)
@@ -22473,14 +23123,14 @@ async function missingInstalledPackages(worktreePath, treeRoot = worktreePath) {
       required.push(path);
   }
   await mapWithLimit(required, INTEGRITY_READ_CONCURRENCY, async (path) => {
-    if (!(path in installed) || !await isInstalledPackage(resolve19(treeRoot, path))) {
+    if (!(path in installed) || !await isInstalledPackage(resolve20(treeRoot, path))) {
       missing.push(path);
     }
   });
   return missing.sort();
 }
 async function isInstalledPackage(path) {
-  return stat2(join7(path, "package.json")).then((info) => info.isFile(), () => false);
+  return stat2(join8(path, "package.json")).then((info) => info.isFile(), () => false);
 }
 var INTEGRITY_READ_CONCURRENCY = 64;
 async function mapWithLimit(values, limit, visit) {
@@ -22514,8 +23164,8 @@ function isContainedTreePath(value) {
 async function cloneTree(source, target, file, topLevel = true) {
   await mkdir10(target, { recursive: true, mode: 493 });
   for (const entry of await readdir5(source, { withFileTypes: true })) {
-    const from = join7(source, entry.name);
-    const to = join7(target, entry.name);
+    const from = join8(source, entry.name);
+    const to = join8(target, entry.name);
     if (entry.isSymbolicLink()) {
       await symlink2(await readlink(from), to);
       continue;
@@ -22545,13 +23195,13 @@ async function pruneWarmStore(storeRoot, keep) {
   const names = (await readdir5(storeRoot).catch(() => [])).filter((name) => !name.startsWith(STAGING_PREFIX));
   const entries = [];
   for (const name of names) {
-    const info = await lstat2(join7(storeRoot, name)).catch(() => void 0);
+    const info = await lstat2(join8(storeRoot, name)).catch(() => void 0);
     if (info?.isDirectory())
       entries.push({ name, usedAt: info.mtimeMs });
   }
   const dropped = entries.sort((a2, b) => b.usedAt - a2.usedAt || a2.name.localeCompare(b.name)).slice(keep);
   for (const entry of dropped) {
-    await rm4(join7(storeRoot, entry.name), { recursive: true, force: true }).catch(() => void 0);
+    await rm4(join8(storeRoot, entry.name), { recursive: true, force: true }).catch(() => void 0);
   }
   return dropped.map((entry) => entry.name);
 }
@@ -22560,7 +23210,7 @@ async function sweepStaleStaging(storeRoot, now2) {
   for (const name of entries) {
     if (!name.startsWith(STAGING_PREFIX))
       continue;
-    const path = join7(storeRoot, name);
+    const path = join8(storeRoot, name);
     const info = await lstat2(path).catch(() => void 0);
     if (!info || now2 - info.mtimeMs < STAGING_SWEEP_MS)
       continue;
@@ -22582,8 +23232,8 @@ function describe3(error) {
 
 // apps/body/dist/monolith-room-turn.js
 import { mkdir as mkdir11 } from "node:fs/promises";
-import { homedir as homedir6 } from "node:os";
-import { join as join8 } from "node:path";
+import { homedir as homedir7 } from "node:os";
+import { join as join9 } from "node:path";
 
 // packages/api-contract/dist/scheduled-prompts.js
 var SCHEDULE_SCHEDULER_NAME = "Beeline Scheduler";
@@ -22615,9 +23265,23 @@ function inboxItemPromptBody(item) {
   return isScheduledPrompt(item) ? item.systemEvent?.consequence ?? item.body : item.body;
 }
 function pendingGrantToolCall(call) {
-  if (!/(?:^|[._:/-])request_grant$/i.test(call.title ?? ""))
+  if (!/(?:^|[._:/-])(?:request_grant|offer_connector)$/i.test(call.title ?? ""))
     return false;
-  return /pending, card posted/i.test(typeof call.content === "string" ? call.content : JSON.stringify(call.content ?? ""));
+  return /(?:pending|already offered), card (?:posted|still open)/i.test(typeof call.content === "string" ? call.content : JSON.stringify(call.content ?? ""));
+}
+function resumePrompt(item) {
+  if (item.systemEvent?.kind === "connector-offer-decided") {
+    return [
+      `This is the answer to your connector offer: ${item.body}.`,
+      "Your paused work resumes now. The tool is being installed on your machine; its sign-in and status reach the person through the tool\u2019s own status message, not through you.",
+      'Acknowledge in one short line (for example "Adding Trusty Squire now.") and continue the work that needed it, or say plainly what still has to happen before you can.'
+    ].join(" ");
+  }
+  return [
+    "This is the answer to your grant request; your paused work resumes now.",
+    "If it was approved and it is a command grant, run it with run_granted_command and the exact argv.",
+    "If it was declined, try another way or say plainly what you cannot do."
+  ].join(" ");
 }
 function roomMentionDirectory(roster, selfId) {
   const rows = [];
@@ -22719,7 +23383,7 @@ var MonolithRoomTurnLoop = class {
       ...this.options.config.bwrapPath ? { bwrapPath: this.options.config.bwrapPath } : {},
       ...this.sessionScratchDir ? { scratch: this.sessionScratchDir } : {},
       ...this.sessionStateDirs.length ? { harnessStateDirs: this.sessionStateDirs } : {},
-      maskPaths: credentialMaskPaths(this.options.config.sandboxMaskPaths, this.options.config.operatorHome ?? homedir6())
+      maskPaths: credentialMaskPaths(this.options.config.sandboxMaskPaths, this.options.config.operatorHome ?? homedir7())
     };
   }
   /**
@@ -22786,7 +23450,7 @@ var MonolithRoomTurnLoop = class {
     const cached = this.deliveredAttachments.get(item.id);
     if (cached)
       return cached;
-    const delivered = await deliverAttachments(item.attachments, join8(this.attachmentDir, item.id.replace(/[^\w-]/g, "_")), this.options.fetchImpl);
+    const delivered = await deliverAttachments(item.attachments, join9(this.attachmentDir, item.id.replace(/[^\w-]/g, "_")), this.options.fetchImpl);
     this.deliveredAttachments.set(item.id, withoutImageData(delivered));
     return delivered;
   }
@@ -22873,6 +23537,10 @@ var MonolithRoomTurnLoop = class {
       })
     }) : {};
     const command = this.options.config.agentCommand ?? this.options.config.agentBinary;
+    const harnessLabel = harnessIdentityLabel({
+      kind: this.options.config.agentKind,
+      command
+    });
     const agentEnv = { ...this.options.config.agentEnv, ...homeOverlay };
     this.agentEnv = agentEnv;
     const agentArgs = agentArgsWithModelSelection({
@@ -22880,12 +23548,12 @@ var MonolithRoomTurnLoop = class {
       command,
       args: this.options.config.agentArgs ?? []
     }, selection);
-    const operatorHome = this.options.config.operatorHome ?? homedir6();
+    const operatorHome = this.options.config.operatorHome ?? homedir7();
     const { stateDirs, tmpDir } = harnessStateDirsFromEnv(agentEnv);
-    this.attachmentDir = tmpDir ? join8(tmpDir, "beeline-attachments") : void 0;
+    this.attachmentDir = tmpDir ? join9(tmpDir, "beeline-attachments") : void 0;
     this.sessionScratchDir = tmpDir;
     this.sessionStateDirs = stateDirs;
-    const homeStateDirs = harnessHomeStateDirs(command, agentEnv.HOME ?? operatorHome);
+    const homeStateDirs = harnessHomeStateDirs(harnessLabel, agentEnv.HOME ?? operatorHome);
     await Promise.all(homeStateDirs.map((dir) => mkdir11(dir, { recursive: true })));
     const attachScratchRoot = this.options.config.agentHomeRoot ?? tmpDir;
     if (attachScratchRoot)
@@ -22921,7 +23589,7 @@ var MonolithRoomTurnLoop = class {
       })
     ];
     await installPiMcpBridge({
-      agentCommand: command,
+      agentCommand: harnessLabel,
       piHome: agentEnv.PI_CODING_AGENT_DIR,
       servers
     });
@@ -22931,7 +23599,7 @@ var MonolithRoomTurnLoop = class {
       agentArgs: spawnCommand.args,
       agentEnv,
       agentCwd: this.options.cwd,
-      agentLabel: command,
+      agentLabel: harnessLabel,
       // `bwrapPath` is set only when `detectBwrapSandbox` passed its self-test
       // (`config.ts`), which is exactly when `wrapAgentCommand` above wraps.
       osSandbox: Boolean(this.options.config.bwrapPath),
@@ -23007,7 +23675,10 @@ var MonolithRoomTurnLoop = class {
     if (durableReplyText(result.agentText))
       return void 0;
     return explainEmptyAgentTurn({
-      agentLabel: this.options.config.agentCommand ?? this.options.config.agentBinary,
+      agentLabel: harnessIdentityLabel({
+        kind: this.options.config.agentKind,
+        command: this.options.config.agentCommand ?? this.options.config.agentBinary
+      }),
       agentEnv: this.agentEnv,
       sessionId: this.sessionId,
       result
@@ -23129,11 +23800,7 @@ var MonolithRoomTurnLoop = class {
           const buildPrompt = () => [
             this.turnInstructionPrefix,
             WarmTranscript.render(this.warmTranscript.select(this.sessionId, transcriptRows), "Room conversation so far:", "New in the Room since your last turn (the earlier conversation is already in this session):"),
-            grantDecision ? [
-              "This is the answer to your grant request; your paused work resumes now.",
-              "If it was approved and it is a command grant, run it with run_granted_command and the exact argv.",
-              "If it was declined, try another way or say plainly what you cannot do."
-            ].join(" ") : "",
+            grantDecision ? resumePrompt(item) : "",
             roomMentionDirectory(roster, this.agent.publicKey),
             (corners.corners ?? []).some((corner) => !corner.archived) ? `Current corners you belong to (use the exact cornerId with steer_corner):
 ${JSON.stringify((corners.corners ?? []).filter((corner) => !corner.archived))}` : "",
@@ -23219,7 +23886,7 @@ ${JSON.stringify((corners.corners ?? []).filter((corner) => !corner.archived))}`
             this.pausedOnGrantRequestId = item.id;
             console.log(`[thin-core] monolith Room ${this.options.roomId} turn ${item.id} paused on a grant card`);
           } else if (resumedRequestId) {
-            console.log(`[thin-core] monolith Room ${this.options.roomId} turn ${resumedRequestId} resumed by grant decision ${item.id}`);
+            console.log(`[thin-core] monolith Room ${this.options.roomId} turn ${resumedRequestId} resumed by card decision ${item.id}`);
           }
           if (openCornerCall) {
             console.log(`[thin-core] monolith Room ${this.options.roomId} tool call: ${openCornerCall.title} (${openCornerCall.status ?? "no status"})`);
@@ -23323,7 +23990,7 @@ ${JSON.stringify((corners.corners ?? []).filter((corner) => !corner.archived))}`
           const item = {
             ...command.source,
             id: command.turnRequestId,
-            body: command.action === "resume" ? `Resume the paused turn. The server supplied this grant decision: ${command.source.body}` : command.source.body
+            body: command.action === "resume" ? `Resume the paused turn. The server supplied this answer: ${command.source.body}` : command.source.body
           };
           this.startPrompt(item);
           await this.activeTurn?.promise;
@@ -23502,7 +24169,7 @@ function toolArguments(call) {
   return input ? { input: clampBytes(redactToolDetail(input), TOOL_ARGUMENT_MAX_BYTES) } : {};
 }
 function toolCallKey(call, index) {
-  return call.id ? `id-${createHash5("sha256").update(call.id).digest("hex")}` : `tool-${index}`;
+  return call.id ? `id-${createHash6("sha256").update(call.id).digest("hex")}` : `tool-${index}`;
 }
 function toolCallSettled(call) {
   if (call.resultReceived)
@@ -23752,6 +24419,10 @@ var MonolithCornerTurnLoop = class {
       })
     }) : {};
     const command = this.options.config.agentCommand ?? this.options.config.agentBinary;
+    const harnessLabel = harnessIdentityLabel({
+      kind: this.options.config.agentKind,
+      command
+    });
     const repository = this.options.repository;
     let githubEnv = repository ? { GH_TOKEN: repository.githubToken, GITHUB_TOKEN: repository.githubToken } : {};
     if (repository && this.options.config.runtimeConfigPath && this.options.config.agentHomeRoot) {
@@ -23783,11 +24454,11 @@ var MonolithCornerTurnLoop = class {
       command,
       args: this.options.config.agentArgs ?? []
     }, selection);
-    const operatorHome = this.options.config.operatorHome ?? homedir7();
+    const operatorHome = this.options.config.operatorHome ?? homedir8();
     const { stateDirs, tmpDir } = harnessStateDirsFromEnv(agentEnv);
-    this.attachmentDir = tmpDir ? join9(tmpDir, "beeline-attachments") : void 0;
+    this.attachmentDir = tmpDir ? join10(tmpDir, "beeline-attachments") : void 0;
     this.sessionScratchDir = tmpDir;
-    const homeStateDirs = harnessHomeStateDirs(command, agentEnv.HOME ?? operatorHome);
+    const homeStateDirs = harnessHomeStateDirs(harnessLabel, agentEnv.HOME ?? operatorHome);
     await Promise.all(homeStateDirs.map((dir) => mkdir12(dir, { recursive: true })));
     const attachScratchRoot = this.options.config.agentHomeRoot ?? tmpDir;
     if (attachScratchRoot)
@@ -23820,7 +24491,7 @@ var MonolithCornerTurnLoop = class {
       agentArgs: spawnCommand.args,
       agentEnv,
       agentCwd: this.options.worktreePath,
-      agentLabel: command,
+      agentLabel: harnessLabel,
       autoApprovePermissions: true,
       permissionHandler: () => Promise.resolve("allow")
     };
@@ -23860,7 +24531,7 @@ var MonolithCornerTurnLoop = class {
       })
     ];
     await installPiMcpBridge({
-      agentCommand: command,
+      agentCommand: harnessLabel,
       piHome: agentEnv.PI_CODING_AGENT_DIR,
       servers
     });
@@ -23887,7 +24558,7 @@ var MonolithCornerTurnLoop = class {
             selfReviewerInstruction ?? cornerMergeInstruction(configuration.yoloMode, configuration.reviewerHandle)
           ],
           "Do not tag the user when a corner turn finishes: the server posts the merge summary card and its push already cover completion. Tag a human only mid-turn, and only when you need a decision or input.",
-          "Never restate server check or merge notes. On a checks turn, say nothing unless you merge or push a fix, then use one short line. Never merge while approvalPending is true. When approval is pending, wait for the reviewer to tag you. Never merge another pull request. Never create a schedule to poll pr_checks_status or the merge gate: the green transition wakes the reviewer and the reviewer's approval tag wakes you, and tagging any agent other than the configured reviewer cannot clear the gate. If a schedule wakes you in this corner anyway, follow the same rule as a checks turn: say nothing unless you merge, push a fix, or report a genuinely new blocker."
+          "Never restate server check or merge notes. On a checks turn, say nothing unless you merge or push a fix, then use one short line. When asked whether the reviewer was woken, call pr_checks_status and report reviewerWake; do not invent a cause. Never merge while approvalPending is true. When approval is pending, wait for the reviewer to tag you. Never merge another pull request. Never create a schedule to poll pr_checks_status or the merge gate: the green transition wakes the reviewer and the reviewer's approval tag wakes you, and tagging any agent other than the configured reviewer cannot clear the gate. If a schedule wakes you in this corner anyway, follow the same rule as a checks turn: say nothing unless you merge, push a fix, or report a genuinely new blocker."
         ] : [
           "This is a chat-only corner with no repository or GitHub workflow.",
           "Work in this corner's writable workspace. Use write_scratch_file or ordinary tools to create files, then post_artifact with the path to send them back to the corner.",
@@ -23937,7 +24608,10 @@ var MonolithCornerTurnLoop = class {
     if (durableReplyText(result.agentText))
       return void 0;
     return explainEmptyAgentTurn({
-      agentLabel: this.options.config.agentCommand ?? this.options.config.agentBinary,
+      agentLabel: harnessIdentityLabel({
+        kind: this.options.config.agentKind,
+        command: this.options.config.agentCommand ?? this.options.config.agentBinary
+      }),
       agentEnv: this.agentEnv,
       sessionId: this.sessionId,
       result
@@ -24006,7 +24680,7 @@ var MonolithCornerTurnLoop = class {
           const [conversation, roster, delivered] = await trace.measure("context-fetch", () => Promise.all([
             api.execute("getRoomConversation", { roomId: cornerId, limit: 200 }),
             this.roster(),
-            this.attachmentDir && attachments.length ? deliverAttachments(attachments, join9(this.attachmentDir, requestId.replace(/[^\w-]/g, "_")), this.options.fetchImpl) : Promise.resolve([])
+            this.attachmentDir && attachments.length ? deliverAttachments(attachments, join10(this.attachmentDir, requestId.replace(/[^\w-]/g, "_")), this.options.fetchImpl) : Promise.resolve([])
           ]));
           const names = new Map(roster.members.map((member) => [member.identityId, member.name]));
           const requestedBy = requester && !requester.name && names.get(requester.pubkey) ? { ...requester, name: names.get(requester.pubkey) } : requester;
@@ -24773,13 +25447,13 @@ function shouldPostInitialCornerWorkingState(restore, isOpener = true) {
 }
 async function materializeCornerWorktree(input) {
   const remote = roomCheckoutRemote(input.remote);
-  const repositoryHash = createHash6("sha256").update(remote).digest("hex").slice(0, 24);
-  const gitCommonDir = resolve20(input.supervisorRoot, "beeline", "repositories", `${repositoryHash}.git`);
-  const path = resolve20(input.supervisorRoot, "beeline", "corners", input.cornerId);
-  await mkdir13(dirname8(gitCommonDir), { recursive: true, mode: 448 });
-  await mkdir13(dirname8(path), { recursive: true, mode: 448 });
+  const repositoryHash = createHash7("sha256").update(remote).digest("hex").slice(0, 24);
+  const gitCommonDir = resolve21(input.supervisorRoot, "beeline", "repositories", `${repositoryHash}.git`);
+  const path = resolve21(input.supervisorRoot, "beeline", "corners", input.cornerId);
+  await mkdir13(dirname9(gitCommonDir), { recursive: true, mode: 448 });
+  await mkdir13(dirname9(path), { recursive: true, mode: 448 });
   const authEnv = githubGitEnv(input.token);
-  if (!existsSync4(resolve20(gitCommonDir, "HEAD"))) {
+  if (!existsSync5(resolve21(gitCommonDir, "HEAD"))) {
     await execFileAsync4("git", ["clone", "--bare", remote, gitCommonDir], {
       env: authEnv,
       maxBuffer: 4 * 1024 * 1024
@@ -24798,7 +25472,7 @@ async function materializeCornerWorktree(input) {
     "origin",
     `+refs/heads/${input.featureBranch}:refs/remotes/origin/${input.featureBranch}`
   ], { env: authEnv, maxBuffer: 4 * 1024 * 1024 }).then(() => true, () => false);
-  if (!existsSync4(resolve20(path, ".git"))) {
+  if (!existsSync5(resolve21(path, ".git"))) {
     await rm5(path, { recursive: true, force: true });
     await execFileAsync4("git", [
       `--git-dir=${gitCommonDir}`,
@@ -24849,7 +25523,7 @@ async function materializeCornerWorktree(input) {
     `${input.committer.publicKey.slice(0, 16)}@users.noreply.github.com`
   ]);
   const top = await execFileAsync4("git", ["-C", path, "rev-parse", "--show-toplevel"]);
-  if (resolve20(top.stdout.trim()) !== resolve20(path)) {
+  if (resolve21(top.stdout.trim()) !== resolve21(path)) {
     throw new Error(`corner worktree escaped its isolated root: ${top.stdout.trim()}`);
   }
   return { path, gitCommonDir };
@@ -24870,7 +25544,7 @@ async function mapWithConcurrency(values, limit, visit) {
 async function removeCornerWorktreeAndBranches(worktree) {
   const localRef = `refs/heads/${worktree.branch}`;
   const remoteRef = `refs/heads/${worktree.branch}`;
-  const worktreeExists = existsSync4(worktree.path);
+  const worktreeExists = existsSync5(worktree.path);
   const localExists = await gitRefExists(worktree.gitCommonDir, localRef);
   if (worktreeExists) {
     const checkedOut = await execFileAsync4("git", [
@@ -24915,8 +25589,8 @@ async function removeCornerWorktreeAndBranches(worktree) {
 }
 var execFileAsync4 = promisify4(execFile6);
 async function removeCornerScratchWorkspace(input) {
-  const expected = resolve20(input.roomRoot, "scratch");
-  if (resolve20(input.scratchPath) !== expected) {
+  const expected = resolve21(input.roomRoot, "scratch");
+  if (resolve21(input.scratchPath) !== expected) {
     throw new Error(`refusing to remove scratch outside corner ${input.cornerId}`);
   }
   await rm5(expected, { recursive: true, force: true });
@@ -25130,14 +25804,14 @@ var RoomRuntimeCoordinator = class {
     return this.runtime.rooms.find((room) => room.channelId === roomId);
   }
   roomRoot(roomId) {
-    return this.roomRecord(roomId)?.root ?? resolve20(dirname8(this.configPath), "rooms", roomId);
+    return this.roomRecord(roomId)?.root ?? resolve21(dirname9(this.configPath), "rooms", roomId);
   }
   roomAgentHomeRoot(workspaceRoot, required = false) {
     const flag = process.env.BUZZY_BODY_ROOM_HOME;
     if (!required && flag === "0")
       return void 0;
-    const home = resolve20(workspaceRoot, "agent-home");
-    if (!required && flag !== "1" && !existsSync4(home) && existsSync4(workspaceRoot))
+    const home = resolve21(workspaceRoot, "agent-home");
+    if (!required && flag !== "1" && !existsSync5(home) && existsSync5(workspaceRoot))
       return void 0;
     try {
       mkdirSync(home, { recursive: true, mode: 448 });
@@ -25152,10 +25826,10 @@ var RoomRuntimeCoordinator = class {
     return {
       ...this.baseConfig,
       workspaceRoot,
-      agentPrivateRoot: resolve20(workspaceRoot, "agent-private"),
-      agentMemoryRoot: resolve20(dirname8(this.configPath), "memory"),
-      openRouterRoutingCacheDir: openRouterRoutingCacheDir(dirname8(this.configPath)),
-      turnTraceDir: turnTraceDirectory(dirname8(this.configPath)),
+      agentPrivateRoot: resolve21(workspaceRoot, "agent-private"),
+      agentMemoryRoot: resolve21(dirname9(this.configPath), "memory"),
+      openRouterRoutingCacheDir: openRouterRoutingCacheDir(dirname9(this.configPath)),
+      turnTraceDir: turnTraceDirectory(dirname9(this.configPath)),
       ...agentHomeRoot ? { agentHomeRoot } : {}
     };
   }
@@ -25221,12 +25895,12 @@ var RoomRuntimeCoordinator = class {
       return this.roomRoot(roomId);
     const remote = roomCheckoutRemote(repository.remote);
     const targetBranch = repository.targetBranch || "main";
-    const checkoutId = createHash6("sha256").update(`${remote}\0${targetBranch}`).digest("hex").slice(0, 24);
-    const path = resolve20(this.runtime.supervisorRoot, "beeline", "room-checkouts", checkoutId);
-    await mkdir13(dirname8(path), { recursive: true, mode: 448 });
+    const checkoutId = createHash7("sha256").update(`${remote}\0${targetBranch}`).digest("hex").slice(0, 24);
+    const path = resolve21(this.runtime.supervisorRoot, "beeline", "room-checkouts", checkoutId);
+    await mkdir13(dirname9(path), { recursive: true, mode: 448 });
     const token = remote.startsWith("https://github.com/") ? await this.options.daemonApi.execute("getRoomGitHubToken", { roomId }) : void 0;
     const env = token ? githubGitEnv(token.token) : process.env;
-    if (!existsSync4(resolve20(path, ".git"))) {
+    if (!existsSync5(resolve21(path, ".git"))) {
       await execFileAsync4("git", ["clone", "--no-checkout", remote, path], {
         env,
         maxBuffer: 4 * 1024 * 1024
@@ -25279,7 +25953,7 @@ var RoomRuntimeCoordinator = class {
         featureBranch,
         token: granted.token
       }) : void 0;
-      const workspacePath = worktree?.path ?? resolve20(this.roomRoot(corner.cornerId), "scratch");
+      const workspacePath = worktree?.path ?? resolve21(this.roomRoot(corner.cornerId), "scratch");
       if (!worktree)
         await mkdir13(workspacePath, { recursive: true, mode: 448 });
       const isOpener = !corner.openedBy || corner.openedBy === this.agent.publicKey;
@@ -25668,8 +26342,8 @@ var ThinDaemonCore = class {
 // apps/body/dist/systemd.js
 import { execFile as execFile7 } from "node:child_process";
 import { mkdir as mkdir14, readFile as readFile9, writeFile as writeFile9 } from "node:fs/promises";
-import { homedir as homedir8 } from "node:os";
-import { dirname as dirname9, resolve as resolve21 } from "node:path";
+import { homedir as homedir9 } from "node:os";
+import { dirname as dirname10, resolve as resolve22 } from "node:path";
 import { setTimeout as sleep } from "node:timers/promises";
 import { promisify as promisify5 } from "node:util";
 var execFileAsync5 = promisify5(execFile7);
@@ -25710,10 +26384,10 @@ WantedBy=default.target
 `;
 }
 function isCanonicalInstalledLauncher(env = process.env, invocationPath = process.argv[1]) {
-  const home = env.HOME?.trim() || homedir8();
-  const expectedLibDir = resolve21(home, ".local", "lib", "beeline");
+  const home = env.HOME?.trim() || homedir9();
+  const expectedLibDir = resolve22(home, ".local", "lib", "beeline");
   const expectedPrefix = `${expectedLibDir}/`;
-  return resolve21(env.BEELINE_LIB_DIR?.trim() || "/") === expectedLibDir && Boolean(invocationPath) && resolve21(invocationPath).startsWith(expectedPrefix);
+  return resolve22(env.BEELINE_LIB_DIR?.trim() || "/") === expectedLibDir && Boolean(invocationPath) && resolve22(invocationPath).startsWith(expectedPrefix);
 }
 function assertCanonicalInstalledLauncher(env, invocationPath) {
   if (isCanonicalInstalledLauncher(env, invocationPath))
@@ -25721,8 +26395,8 @@ function assertCanonicalInstalledLauncher(env, invocationPath) {
   throw new Error("refusing to modify the shared Beeline systemd unit outside the canonical ~/.local/bin/beeline launcher");
 }
 function systemdUserUnitPath(env = process.env) {
-  const configRoot = env.XDG_CONFIG_HOME?.trim() || resolve21(homedir8(), ".config");
-  return resolve21(configRoot, "systemd", "user", SYSTEMD_UNIT_NAME);
+  const configRoot = env.XDG_CONFIG_HOME?.trim() || resolve22(homedir9(), ".config");
+  return resolve22(configRoot, "systemd", "user", SYSTEMD_UNIT_NAME);
 }
 var runSystemctl = async (args) => {
   const result = await execFileAsync5("systemctl", ["--user", ...args], {
@@ -25740,7 +26414,7 @@ async function installAgentService(publicKey, options = {}) {
   const content = agentServiceUnit();
   const existing = await readFile9(path, "utf8").catch(() => "");
   if (existing !== content) {
-    await mkdir14(dirname9(path), { recursive: true, mode: 448 });
+    await mkdir14(dirname10(path), { recursive: true, mode: 448 });
     await writeFile9(path, content, { mode: 384 });
   }
   const run2 = options.run ?? runSystemctl;
@@ -25821,7 +26495,7 @@ async function retireRemovedAgent(runtime, options = {}) {
 }
 
 // apps/body/dist/start-command.js
-import { dirname as dirname10 } from "node:path";
+import { dirname as dirname11 } from "node:path";
 var import_picocolors = __toESM(require_picocolors(), 1);
 var DEFAULT_RESTART_DRAIN_TIMEOUT_MS = 30 * 6e4;
 var RESTART_WAIT_REPORT_INTERVAL_MS = 3e4;
@@ -25896,7 +26570,7 @@ async function runStartCommand(args, interactiveUi) {
       continue;
     }
     const spinnerHandle = spinner();
-    spinnerHandle.start(`Starting ${dirname10(path)}\u2026`);
+    spinnerHandle.start(`Starting ${dirname11(path)}\u2026`);
     try {
       await startRuntime(path, spinnerHandle);
       spinnerHandle.stop(import_picocolors.default.green("Started."));
@@ -25911,11 +26585,11 @@ async function runStartCommand(args, interactiveUi) {
 }
 
 // apps/body/dist/connect-command.js
-import { spawn as spawn8 } from "node:child_process";
-import { createHash as createHash8, randomUUID as randomUUID5 } from "node:crypto";
+import { spawn as spawn9 } from "node:child_process";
+import { createHash as createHash9, randomUUID as randomUUID6 } from "node:crypto";
 import { chmod as chmod6, mkdir as mkdir16, readFile as readFile11, unlink as unlink2, writeFile as writeFile11 } from "node:fs/promises";
-import { homedir as homedir10, hostname } from "node:os";
-import { dirname as dirname12, resolve as resolve23 } from "node:path";
+import { homedir as homedir11, hostname as hostname2 } from "node:os";
+import { dirname as dirname13, resolve as resolve24 } from "node:path";
 import { stdin as stdin3, stdout as stdout4 } from "node:process";
 
 // apps/body/dist/clack-support.js
@@ -25939,50 +26613,6 @@ function unwrapPrompt(value, cancelMessage = "Cancelled.") {
   return value;
 }
 
-// apps/body/dist/cursor-models.js
-import { spawn as spawn5 } from "node:child_process";
-var CURSOR_MODELS_TIMEOUT_MS = 1e4;
-function parseCursorModelsOutput(output) {
-  const options = [];
-  for (const line of output.split(/\r?\n/)) {
-    const match = /^\s*([A-Za-z0-9][A-Za-z0-9._-]*)\s+-\s+(\S.*?)\s*$/.exec(line);
-    if (!match)
-      continue;
-    const id = match[1];
-    const name = match[2].replace(/\s*\(current, default\)\s*$/i, "").trim();
-    options.push({ id, ...name && name !== id ? { name } : {} });
-  }
-  if (!options.length)
-    return void 0;
-  return {
-    currentValue: options.some((option) => option.id === "auto") ? "auto" : options[0].id,
-    options
-  };
-}
-async function enumerateCursorModels(env = process.env) {
-  return new Promise((resolve31) => {
-    const child = spawn5("cursor-agent", ["models"], {
-      env,
-      stdio: ["ignore", "pipe", "ignore"]
-    });
-    let output = "";
-    const timer = setTimeout(() => {
-      child.kill("SIGKILL");
-    }, CURSOR_MODELS_TIMEOUT_MS);
-    child.stdout?.on("data", (chunk) => {
-      output += chunk.toString();
-    });
-    child.on("error", () => {
-      clearTimeout(timer);
-      resolve31(void 0);
-    });
-    child.on("close", (code) => {
-      clearTimeout(timer);
-      resolve31(code === 0 ? parseCursorModelsOutput(output) : void 0);
-    });
-  });
-}
-
 // apps/body/dist/provider-key-check.js
 var PROVIDER_LABELS = {
   openrouter: "OpenRouter",
@@ -26043,7 +26673,7 @@ async function verifyProviderKey(input) {
 }
 
 // apps/body/dist/pair-agent-selection.js
-import { spawn as spawn6 } from "node:child_process";
+import { spawn as spawn7 } from "node:child_process";
 import { stdin as stdin2, stdout as stdout3 } from "node:process";
 var NO_AGENT_MESSAGE = `No supported ACP-capable coding agent was detected.
 Install one of these supported agents:
@@ -26052,7 +26682,7 @@ Install one of these supported agents:
   goose  https://block.github.io/goose/docs/getting-started/installation/
   pi     npm install -g @mariozechner/pi-coding-agent pi-acp
   grok   curl -fsSL https://x.ai/cli/install.sh | bash
-  cursor npm install -g cursor-agent-acp
+  cursor Install Cursor Agent CLI from https://cursor.com/docs/cli
 Then retry, or explicitly use \`--agent reference\` with an LLM key.
 For another ACP server, use \`--agent custom --agent-command "<cmd> [args...]"\`.`;
 async function clackConfirmInstall(message) {
@@ -26072,7 +26702,7 @@ async function clackSelectAgent(candidates) {
 }
 async function installAdapter(install, opts) {
   await new Promise((resolveInstall, rejectInstall) => {
-    const child = spawn6(install.command, install.args, {
+    const child = spawn7(install.command, install.args, {
       cwd: opts.cwd,
       env: opts.env ?? process.env,
       stdio: "inherit"
@@ -26583,23 +27213,23 @@ function parseConnectSubscriptions(value) {
   ];
 }
 async function readMachineId(env = process.env) {
-  const configDir = resolve23(env.XDG_CONFIG_HOME ?? resolve23(homedir10(), ".config"), "beeline");
-  const machineIdPath = resolve23(configDir, "machine-id");
+  const configDir = resolve24(env.XDG_CONFIG_HOME ?? resolve24(homedir11(), ".config"), "beeline");
+  const machineIdPath = resolve24(configDir, "machine-id");
   let machineId;
-  let machineName = hostname();
+  let machineName = hostname2();
   try {
     const existing = await readFile11(machineIdPath, "utf8");
     machineId = existing.trim();
     if (!/^[0-9a-f-]{32,}$/.test(machineId))
       throw new Error("invalid persisted machine id");
   } catch {
-    machineId = randomUUID5();
+    machineId = randomUUID6();
     try {
       await mkdir16(configDir, { recursive: true, mode: 448 });
       await writeFile11(machineIdPath, `${machineId}
 `, { mode: 384 });
     } catch {
-      machineId = createHash8("sha256").update(machineName).digest("hex").slice(0, 36);
+      machineId = createHash9("sha256").update(machineName).digest("hex").slice(0, 36);
     }
   }
   return { machineId, machineName };
@@ -26608,7 +27238,7 @@ function requestConnectGrant(baseUrl, pairingCode, selection, fetchImpl, machine
   const normalizedPairingCode = normalizeAgentPairingCode(pairingCode);
   if (!normalizedPairingCode)
     throw new Error("invalid pairing code");
-  const avatarSeed = createHash8("sha256").update(normalizedPairingCode.toUpperCase()).digest("hex").slice(0, 32);
+  const avatarSeed = createHash9("sha256").update(normalizedPairingCode.toUpperCase()).digest("hex").slice(0, 32);
   return jsonRequest(`${baseUrl}/auth/agent/connect`, {
     pairing_code: normalizedPairingCode,
     harness: selection.harness,
@@ -26657,7 +27287,7 @@ async function installCurrentRelease(fetchImpl) {
   });
   await activateRelease(layout, releaseId);
   return {
-    binary: resolve23(layout.binDir, "beeline"),
+    binary: resolve24(layout.binDir, "beeline"),
     version: published.version ?? releaseId
   };
 }
@@ -26680,7 +27310,7 @@ function providerEnvironment(selection) {
   };
 }
 async function writePrivateJson(path, value) {
-  await mkdir16(dirname12(path), { recursive: true, mode: 448 });
+  await mkdir16(dirname13(path), { recursive: true, mode: 448 });
   await writeFile11(path, `${JSON.stringify(value, null, 2)}
 `, { mode: 384 });
   await chmod6(path, 384);
@@ -26689,8 +27319,8 @@ async function writeProviderEnv(selection, agentPubkey) {
   const values = providerEnvironment(selection);
   if (Object.keys(values).length === 0)
     return void 0;
-  const path = resolve23(defaultSupervisorRoot(process.env), "beeline", "connect", `${agentPubkey}.env`);
-  await mkdir16(dirname12(path), { recursive: true, mode: 448 });
+  const path = resolve24(defaultSupervisorRoot(process.env), "beeline", "connect", `${agentPubkey}.env`);
+  await mkdir16(dirname13(path), { recursive: true, mode: 448 });
   const contents = Object.entries(values).map(([key, value]) => `${key}=${JSON.stringify(value)}`).join("\n");
   await writeFile11(path, `${contents}
 `, { mode: 384 });
@@ -26699,7 +27329,7 @@ async function writeProviderEnv(selection, agentPubkey) {
 }
 async function runInstalledFinish(binary, grantPath) {
   await new Promise((resolveRun, rejectRun) => {
-    const child = spawn8(binary, ["connect-finish", grantPath], {
+    const child = spawn9(binary, ["connect-finish", grantPath], {
       stdio: ["ignore", "pipe", "pipe"]
     });
     let diagnostic = "";
@@ -26756,7 +27386,7 @@ async function runConnectWizard(code, fetchImpl, eventSubscriptions, accessPolic
   await finishConnectedAgentPairing(baseUrl, pairingCode, grant.workspace_joined, eventSubscriptions, fetchImpl);
   const installedRelease = await brassSpinner("Installing the Beeline daemon\u2026", () => installCurrentRelease(fetchImpl), (release) => `Installed Beeline helper ${release.version}`);
   const llmEnvFile = await writeProviderEnv(selection, grant.agent_pubkey);
-  const grantPath = resolve23(defaultSupervisorRoot(process.env), "beeline", "connect", `grant-${process.pid}-${Date.now()}.json`);
+  const grantPath = resolve24(defaultSupervisorRoot(process.env), "beeline", "connect", `grant-${process.pid}-${Date.now()}.json`);
   await writePrivateJson(grantPath, {
     agentSecretKey: grant.agent_secret_key,
     bodySecretKey: grant.body_secret_key,
@@ -26841,18 +27471,18 @@ async function runConnectFinishCommand(path) {
     throw new Error("connect-finish may run only from the canonical installed Beeline launcher");
   }
   try {
-    const grant = JSON.parse(await readFile11(resolve23(path), "utf8"));
+    const grant = JSON.parse(await readFile11(resolve24(path), "utf8"));
     if (!isDevicePairingGrant(grant))
       throw new Error("device connection grant is invalid");
     const connected = await completeDevicePairing(grant);
-    await unlink2(resolve23(path));
+    await unlink2(resolve24(path));
     const providerEnv = grant.llmEnvFile ? await readFile11(grant.llmEnvFile, "utf8").catch(() => "") : "";
     const apiKey = (/^OPENROUTER_API_KEY=(\S+)/m.exec(providerEnv)?.[1] ?? "").replace(/^["']|["']$/g, "");
     const model = openRouterModelId(grant.model, { OPENROUTER_API_KEY: apiKey });
     if (model) {
       const decision2 = await resolveOpenRouterRouting({
         model,
-        cacheDir: openRouterRoutingCacheDir(dirname12(connected.configPath)),
+        cacheDir: openRouterRoutingCacheDir(dirname13(connected.configPath)),
         ...apiKey ? { apiKey } : {},
         probeTimeoutMs: 1e4
       });
@@ -26873,22 +27503,22 @@ init_self_update_manifest();
 
 // apps/body/dist/managed-update.js
 init_self_update();
-import { spawn as spawn9 } from "node:child_process";
+import { spawn as spawn10 } from "node:child_process";
 import { mkdir as mkdir18, rm as rm7, stat as stat3, writeFile as writeFile13 } from "node:fs/promises";
-import { dirname as dirname14, resolve as resolve25 } from "node:path";
+import { dirname as dirname15, resolve as resolve26 } from "node:path";
 
 // apps/body/dist/update-rollback-alert.js
 import { mkdir as mkdir17, readFile as readFile12, rename as rename5, unlink as unlink3, writeFile as writeFile12 } from "node:fs/promises";
-import { dirname as dirname13, resolve as resolve24 } from "node:path";
+import { dirname as dirname14, resolve as resolve25 } from "node:path";
 var REPORT_INTERVAL_MS = 60 * 60 * 1e3;
 var lastLogged = /* @__PURE__ */ new Map();
 function updateRollbackAlertPath(runtimeDir) {
-  return resolve24(runtimeDir, "update-rollback-alert.json");
+  return resolve25(runtimeDir, "update-rollback-alert.json");
 }
 async function writeAlert(runtimeDir, alert) {
   const path = updateRollbackAlertPath(runtimeDir);
   const staged = `${path}.${process.pid}.tmp`;
-  await mkdir17(dirname13(path), { recursive: true });
+  await mkdir17(dirname14(path), { recursive: true });
   await writeFile12(staged, `${JSON.stringify(alert, null, 2)}
 `, { mode: 384 });
   await rename5(staged, path);
@@ -26952,13 +27582,13 @@ var LOCK_STALE_MS = UPDATE_WORKER_DEADLINE_MS + 5 * 6e4;
 var DEFAULT_UPDATE_INITIAL_DELAY_MS = 0;
 async function withInstallLock(layout, work, options = {}) {
   const now2 = options.now ?? Date.now;
-  const lock = resolve25(layout.releasesRoot, ".state", "install.lock");
+  const lock = resolve26(layout.releasesRoot, ".state", "install.lock");
   const deadline = now2() + (options.waitMs ?? 1e4);
-  await mkdir18(dirname14(lock), { recursive: true });
+  await mkdir18(dirname15(lock), { recursive: true });
   for (; ; ) {
     try {
       await mkdir18(lock);
-      await writeFile13(resolve25(lock, "owner"), `${process.pid}
+      await writeFile13(resolve26(lock, "owner"), `${process.pid}
 ${now2()}
 `, "utf8");
       break;
@@ -27081,7 +27711,7 @@ var ManagedUpdateHandoff = class _ManagedUpdateHandoff {
       if (!attempt || attempt.releaseId !== desiredRelease || attempt.status !== "pending") {
         const from = await readInstalledBundleIdentity({
           ...this.#layout,
-          libDir: resolve25(this.#layout.releasesRoot, this.#loadedRelease)
+          libDir: resolve26(this.#layout.releasesRoot, this.#loadedRelease)
         }).catch(() => void 0) ?? {};
         const to = await readInstalledBundleIdentity(this.#layout).catch(() => void 0) ?? {};
         const record3 = {
@@ -27287,7 +27917,7 @@ async function runManagedUpdateWorkerProcess() {
   if (!entrypoint)
     throw new Error("cannot resolve the current Beeline entrypoint");
   await new Promise((resolveWorker, rejectWorker) => {
-    const child = spawn9(process.execPath, [entrypoint, "managed-update-worker"], {
+    const child = spawn10(process.execPath, [entrypoint, "managed-update-worker"], {
       detached: true,
       env: { ...process.env, BEELINE_INTERNAL_UPDATE_WORKER: "1" },
       stdio: ["ignore", "pipe", "pipe"]
@@ -27368,7 +27998,7 @@ async function proveLoadedReleaseReady(layout, runtimeDir, loadedRelease, option
   });
   if (!accepted)
     return false;
-  await writeFile13(resolve25(runtimeDir, "daemon-ready.json"), `${JSON.stringify({
+  await writeFile13(resolve26(runtimeDir, "daemon-ready.json"), `${JSON.stringify({
     readyAt: (options.now ?? Date.now)(),
     loadedRelease,
     functionalProof: options.functionalProof
@@ -27597,11 +28227,11 @@ init_self_update();
 
 // apps/body/dist/daemon-failure.js
 import { mkdir as mkdir19, readFile as readFile13, rename as rename6, rm as rm8, writeFile as writeFile14 } from "node:fs/promises";
-import { dirname as dirname15, resolve as resolve26 } from "node:path";
+import { dirname as dirname16, resolve as resolve27 } from "node:path";
 var DAEMON_FAILURE_LIMIT = 3;
 var DAEMON_FAILURE_WINDOW_MS = 5 * 6e4;
 function daemonFailurePath(runtimeDir) {
-  return resolve26(runtimeDir, "daemon-distress.json");
+  return resolve27(runtimeDir, "daemon-distress.json");
 }
 async function readFailureRecord(runtimeDir) {
   try {
@@ -27617,7 +28247,7 @@ async function readFailureRecord(runtimeDir) {
 async function writeFailureRecord(runtimeDir, record3) {
   const path = daemonFailurePath(runtimeDir);
   const staged = `${path}.${process.pid}.tmp`;
-  await mkdir19(dirname15(path), { recursive: true, mode: 448 });
+  await mkdir19(dirname16(path), { recursive: true, mode: 448 });
   await writeFile14(staged, `${JSON.stringify(record3, null, 2)}
 `, { mode: 384 });
   await rename6(staged, path);
@@ -27641,8 +28271,8 @@ async function clearDaemonStartFailures(runtimeDir) {
 
 // apps/body/dist/update-functional-probe.js
 import { mkdir as mkdir20, rm as rm9 } from "node:fs/promises";
-import { homedir as homedir11 } from "node:os";
-import { resolve as resolve27 } from "node:path";
+import { homedir as homedir12 } from "node:os";
+import { resolve as resolve28 } from "node:path";
 var UPDATE_PROBE_SESSION_TIMEOUT_MS = 1e4;
 var UPDATE_PROBE_SESSION_OPEN_TIMEOUT_MS = 2e4;
 var UPDATE_PROBE_TURN_TIMEOUT_MS = 45e3;
@@ -27709,6 +28339,10 @@ function describeCurrentReleaseOutcome(outcome) {
 }
 async function runUpdateFunctionalProbe(input) {
   const command = input.config.agentCommand ?? input.config.agentBinary;
+  const harnessLabel = harnessIdentityLabel({
+    kind: input.config.agentKind,
+    command
+  });
   const harness = input.config.agentKind ?? command;
   if (input.config.modelUnavailable) {
     throw new UpdateFunctionalProbeError("model-unavailable", input.config.modelUnavailable.detail);
@@ -27736,9 +28370,9 @@ async function runUpdateFunctionalProbe(input) {
       modelAnswerReason: `${detail} (the current release has the same host sandbox failure)`
     };
   }
-  const root = input.probeRoot ?? resolve27(input.runtimeDir, "update-functional-probe");
-  const cwd = resolve27(root, "checkout");
-  const homeRoot = resolve27(root, "agent-home");
+  const root = input.probeRoot ?? resolve28(input.runtimeDir, "update-functional-probe");
+  const cwd = resolve28(root, "checkout");
+  const homeRoot = resolve28(root, "agent-home");
   await rm9(root, { recursive: true, force: true });
   await mkdir20(cwd, { recursive: true, mode: 448 });
   let client;
@@ -27747,7 +28381,7 @@ async function runUpdateFunctionalProbe(input) {
       ...input.config.agentEnv,
       ...await prepareRoomAgentHome({
         root: homeRoot,
-        operatorHome: input.config.operatorHome ?? homedir11(),
+        operatorHome: input.config.operatorHome ?? homedir12(),
         sharedSkills: input.config.sharedSkills ?? [],
         ...input.config.agentKind ? { agentKind: input.config.agentKind } : {},
         skillReleaseId: input.releaseId,
@@ -27768,8 +28402,8 @@ async function runUpdateFunctionalProbe(input) {
     let turnCompleted = true;
     if (input.config.bwrapPath) {
       const { stateDirs, tmpDir } = harnessStateDirsFromEnv(agentEnv);
-      const operatorHome = input.config.operatorHome ?? homedir11();
-      const homeStateDirs = harnessHomeStateDirs(command, agentEnv.HOME ?? operatorHome);
+      const operatorHome = input.config.operatorHome ?? homedir12();
+      const homeStateDirs = harnessHomeStateDirs(harnessLabel, agentEnv.HOME ?? operatorHome);
       await Promise.all(homeStateDirs.map((dir) => mkdir20(dir, { recursive: true })));
       spawnCommand = wrapAgentCommand({
         bwrapPath: input.config.bwrapPath,
@@ -27788,7 +28422,7 @@ async function runUpdateFunctionalProbe(input) {
     client = new AcpClient({
       agentCommand: spawnCommand.command,
       agentArgs: spawnCommand.args,
-      agentLabel: command,
+      agentLabel: harnessLabel,
       agentEnv,
       agentCwd: cwd,
       autoApprovePermissions: true
@@ -27819,7 +28453,7 @@ async function runUpdateFunctionalProbe(input) {
           modelAnswer = { modelAnswer: "served" };
         } else {
           const explained = await explainEmptyAgentTurn({
-            agentLabel: command,
+            agentLabel: harnessLabel,
             agentEnv,
             sessionId,
             result: served
@@ -27919,8 +28553,8 @@ async function runUpdateFunctionalProbe(input) {
 }
 
 // apps/body/dist/current-release-probe.js
-import { spawn as spawn10 } from "node:child_process";
-import { dirname as dirname16, join as join11 } from "node:path";
+import { spawn as spawn11 } from "node:child_process";
+import { dirname as dirname17, join as join12 } from "node:path";
 init_self_update();
 var CURRENT_RELEASE_PROBE_TIMEOUT_MS = 12e4;
 var UPDATE_PROBE_COMMAND = "update-probe";
@@ -27963,14 +28597,14 @@ function outcomeFromReport(report) {
   }
 }
 async function probeReleaseInSubprocess(input) {
-  const bundleDir = join11(input.layout.releasesRoot, input.releaseId);
+  const bundleDir = join12(input.layout.releasesRoot, input.releaseId);
   const entrypoint = await resolveBundleEntrypoint(bundleDir);
   if (!entrypoint) {
     return { kind: "unavailable", reason: `release ${input.releaseId} has no runnable CLI entrypoint` };
   }
   const timeoutMs = input.timeoutMs ?? CURRENT_RELEASE_PROBE_TIMEOUT_MS;
-  return new Promise((resolve31) => {
-    const child = spawn10(input.execPath ?? process.execPath, [entrypoint, UPDATE_PROBE_COMMAND, "--config", input.runtimeConfigPath], { env: input.env ?? process.env, stdio: ["ignore", "pipe", "pipe"] });
+  return new Promise((resolve32) => {
+    const child = spawn11(input.execPath ?? process.execPath, [entrypoint, UPDATE_PROBE_COMMAND, "--config", input.runtimeConfigPath], { env: input.env ?? process.env, stdio: ["ignore", "pipe", "pipe"] });
     let stdout6 = "";
     let stderr = "";
     let settled = false;
@@ -27979,7 +28613,7 @@ async function probeReleaseInSubprocess(input) {
         return;
       settled = true;
       clearTimeout(timer);
-      resolve31(outcome);
+      resolve32(outcome);
     };
     const timer = setTimeout(() => {
       child.kill("SIGKILL");
@@ -28026,7 +28660,7 @@ async function runUpdateProbeCommand(args, options = {}) {
   const runtime = await readRuntimeRecord(configPath);
   const agent = runtimeAgentCommand(runtime);
   const config = loadBodyConfig({
-    workspaceRoot: join11(dirname16(configPath), "workspace"),
+    workspaceRoot: join12(dirname17(configPath), "workspace"),
     llmEnvFile: runtime.llmEnvFile,
     env: { ...env, BUZZ_AGENT_BIN: agent.command, BUZZ_DEV_MCP_BIN: runtime.mcpBinary },
     agent
@@ -28044,7 +28678,7 @@ async function runUpdateProbeCommand(args, options = {}) {
   }
   const layout = beelineInstallLayout(env);
   const releaseId = (layout && await activeReleaseId(layout).catch(() => void 0)) ?? "unknown";
-  const runtimeDir = dirname16(configPath);
+  const runtimeDir = dirname17(configPath);
   const outcome = await probeOutcome(() => (options.probe ?? runUpdateFunctionalProbe)({
     config,
     runtimeDir,
@@ -28052,7 +28686,7 @@ async function runUpdateProbeCommand(args, options = {}) {
     sandboxRequired: runtime.sandbox !== "off",
     sandboxUnavailableDetail: sandbox.advisory,
     // The successor's probe still holds `<runtimeDir>/update-functional-probe`.
-    probeRoot: join11(runtimeDir, "current-release-probe")
+    probeRoot: join12(runtimeDir, "current-release-probe")
   }));
   const report = outcome.kind === "served" ? { probe: "served" } : outcome.kind === "refused" ? { probe: "refused", status: outcome.status, reason: outcome.reason } : outcome.kind === "sandbox-unavailable" ? { probe: "sandbox-unavailable", reason: outcome.reason } : { probe: "failed", reason: outcome.reason };
   write(JSON.stringify(report));
@@ -28060,7 +28694,7 @@ async function runUpdateProbeCommand(args, options = {}) {
 
 // apps/body/dist/release-status.js
 import { readFile as readFile14, readdir as readdir6, rename as rename7, writeFile as writeFile15 } from "node:fs/promises";
-import { resolve as resolve28 } from "node:path";
+import { resolve as resolve29 } from "node:path";
 var DAEMON_RELEASE_STATUS_FILE = "release-status.json";
 var RELEASE_VERSION = /^v\d+\.\d+\.\d+$/;
 var SOURCE_SHA = /^[0-9a-f]{7,64}$/;
@@ -28077,7 +28711,7 @@ async function writeDaemonReleaseStatus(runtimeDir, agentPubkey, identity, optio
     pid: options.pid ?? process.pid,
     readyAt: (options.now?.() ?? /* @__PURE__ */ new Date()).toISOString()
   };
-  const target = resolve28(runtimeDir, DAEMON_RELEASE_STATUS_FILE);
+  const target = resolve29(runtimeDir, DAEMON_RELEASE_STATUS_FILE);
   const temporary = `${target}.${status.pid}.tmp`;
   await writeFile15(temporary, `${JSON.stringify(status, null, 2)}
 `, { mode: 384 });
@@ -28087,7 +28721,7 @@ async function writeDaemonReleaseStatus(runtimeDir, agentPubkey, identity, optio
 
 // apps/body/dist/scratch-sweep.js
 import { lstat as lstat4, readdir as readdir7, rmdir, unlink as unlink4 } from "node:fs/promises";
-import { resolve as resolve29 } from "node:path";
+import { resolve as resolve30 } from "node:path";
 var DEFAULT_SCRATCH_TTL_HOURS = 72;
 var NEVER_SWEEP_SUBDIR_NAMES = new Set(HOME_SUBDIRS.filter((name) => name !== "tmp"));
 function scratchTtlMs(env = process.env) {
@@ -28096,7 +28730,7 @@ function scratchTtlMs(env = process.env) {
   return (Number.isFinite(hours) && hours > 0 ? hours : DEFAULT_SCRATCH_TTL_HOURS) * 60 * 60 * 1e3;
 }
 async function discoverAttachScratchRoots(runtimeDir) {
-  const roomsDir = resolve29(runtimeDir, "rooms");
+  const roomsDir = resolve30(runtimeDir, "rooms");
   let entries;
   try {
     entries = await readdir7(roomsDir, { withFileTypes: true });
@@ -28107,7 +28741,7 @@ async function discoverAttachScratchRoots(runtimeDir) {
   for (const entry of entries) {
     if (!entry.isDirectory())
       continue;
-    const home = resolve29(roomsDir, entry.name, "agent-home");
+    const home = resolve30(roomsDir, entry.name, "agent-home");
     const stats = await lstat4(home).catch(() => void 0);
     if (stats?.isDirectory())
       roots.push(home);
@@ -28126,7 +28760,7 @@ async function removeStaleFiles(dir, cutoffMs, protectNamesHere) {
   for (const entry of entries) {
     if (protectNamesHere && NEVER_SWEEP_SUBDIR_NAMES.has(entry.name))
       continue;
-    const path = resolve29(dir, entry.name);
+    const path = resolve30(dir, entry.name);
     const stats = await lstat4(path).catch(() => void 0);
     if (!stats || stats.isSymbolicLink())
       continue;
@@ -28213,7 +28847,7 @@ var DaemonExitError = class extends Error {
 };
 async function runStoredDaemon(pathOrPointer) {
   const configPath = await resolveRuntimeConfigPath(pathOrPointer);
-  daemonFailureRuntimeDir = dirname17(configPath);
+  daemonFailureRuntimeDir = dirname18(configPath);
   const accessMigration = await migrateRuntimeRecordAccessPolicy(configPath);
   let runtime = accessMigration.runtime;
   if (!runtime.transport) {
@@ -28225,7 +28859,7 @@ async function runStoredDaemon(pathOrPointer) {
   runtime = activated.runtime;
   const daemonApi = activated.client;
   const agent = runtimeAgentCommand(runtime);
-  await writeFile16(resolve30(dirname17(configPath), "daemon.pid"), `${process.pid}
+  await writeFile16(resolve31(dirname18(configPath), "daemon.pid"), `${process.pid}
 `, { mode: 384 });
   const env = {
     ...process.env,
@@ -28233,7 +28867,7 @@ async function runStoredDaemon(pathOrPointer) {
     BUZZ_DEV_MCP_BIN: runtime.mcpBinary
   };
   const config = loadBodyConfig({
-    workspaceRoot: resolve30(dirname17(configPath), "workspace"),
+    workspaceRoot: resolve31(dirname18(configPath), "workspace"),
     llmEnvFile: runtime.llmEnvFile,
     env,
     agent
@@ -28268,7 +28902,7 @@ async function runStoredDaemon(pathOrPointer) {
   const stop = () => controller.abort();
   process.once("SIGINT", stop);
   process.once("SIGTERM", stop);
-  const runtimeDir = dirname17(configPath);
+  const runtimeDir = dirname18(configPath);
   const layout = beelineInstallLayout(process.env);
   const notifier = new SystemdNotifier();
   let rollbackAlertDrain;
@@ -28424,7 +29058,7 @@ async function runStoredDaemon(pathOrPointer) {
   } finally {
     clearInterval(scratchSweepTimer);
     await notifier.stopping(stoppingStatus).catch(() => void 0);
-    const pidPath = resolve30(dirname17(configPath), "daemon.pid");
+    const pidPath = resolve31(dirname18(configPath), "daemon.pid");
     const recorded = Number((await readFile15(pidPath, "utf8").catch(() => "")).trim());
     if (recorded === process.pid) {
       await unlink5(pidPath).catch(() => void 0);
@@ -28436,6 +29070,10 @@ async function main() {
   if (args.length === 0)
     usage();
   const command = args[0];
+  if (command === CURSOR_ACP_BRIDGE_FLAG) {
+    await runCursorAcpStdioServer();
+    return;
+  }
   if (command === "--help" || command === "-h")
     usage(0);
   if (command === "managed-update-worker") {
@@ -28452,7 +29090,7 @@ async function main() {
     const roomId = roomFlag >= 0 ? args[roomFlag + 1] : void 0;
     if (!configPath || !roomId)
       throw new Error("corner-read-token requires --config and --room");
-    const activated = await activateDaemonTransport(resolve30(configPath));
+    const activated = await activateDaemonTransport(resolve31(configPath));
     if (!activated)
       throw new Error("corner-read-token requires monolith transport");
     const credential = await activated.client.execute("getRoomGitHubToken", { roomId });
@@ -28501,14 +29139,14 @@ async function main() {
     const agentPubkey = agentFlag >= 0 ? args[agentFlag + 1] : void 0;
     if (!configPath && agentPubkey) {
       const configs = await findAgentRuntimeConfigPaths(process.env, process.cwd());
-      configPath = configs.find((candidate) => dirname17(candidate).endsWith(agentPubkey));
+      configPath = configs.find((candidate) => dirname18(candidate).endsWith(agentPubkey));
     }
     if (!configPath && agentPubkey) {
       throw new DaemonExitError(`unknown agent ${agentPubkey}: no durable runtime exists; refusing systemd restart loop`, UNKNOWN_AGENT_EXIT_STATUS);
     }
     if (!configPath)
       throw new Error("daemon requires --config <runtime.json> or --agent <pubkey>");
-    await runStoredDaemon(resolve30(configPath));
+    await runStoredDaemon(resolve31(configPath));
     return;
   }
   if (command === "update") {
@@ -28529,7 +29167,7 @@ async function main() {
     if (!agentPubkey)
       throw new Error("stop requires --agent <pubkey>");
     const configs = await findAgentRuntimeConfigPaths(process.env, process.cwd());
-    const configPath = configs.find((candidate) => dirname17(candidate).endsWith(agentPubkey));
+    const configPath = configs.find((candidate) => dirname18(candidate).endsWith(agentPubkey));
     if (!configPath)
       throw new Error(`no stored runtime found for agent ${agentPubkey}`);
     const runtime = await readRuntimeRecord(configPath);