very-happy-cli 0.2.179 → 0.2.181

package/dist/{run-CNXwIe0A.cjs → run-C_FumCQk.cjs}

@@ -1,25 +1,26 @@
 'use strict';
 
-var mirrorProtocol = require('./mirrorProtocol-DEy2g1CB.cjs');
-var piRunnerArgs = require('./piRunnerArgs-Cs-378Vz.cjs');
+var mirrorProtocol = require('./mirrorProtocol-BphKIAK9.cjs');
+var piRunnerArgs = require('./piRunnerArgs-gxLYIZH4.cjs');
 var fs = require('fs/promises');
+var os$1 = require('os');
 var tmp = require('tmp');
 var axios = require('axios');
-var api = require('./api-Cmjfr8Z7.cjs');
-var spawnAgents = require('./spawnAgents-DsXgegHM.cjs');
-var logger = require('./logger-C1GWx3gi.cjs');
 var node_fs = require('node:fs');
 var path = require('node:path');
-var index$2 = require('./index-D09T1m8Y.cjs');
-var auth = require('./auth-D6bBUwZa.cjs');
-var configuration = require('./configuration-CMHZnp6G.cjs');
+var configuration = require('./configuration-C8JgseHy.cjs');
+var api = require('./api-COHFAkb_.cjs');
+var spawnAgents = require('./spawnAgents-iwuqrgR9.cjs');
+var logger = require('./logger-DgBwUSgS.cjs');
+var index$2 = require('./index-BRMq9gOe.cjs');
+var auth = require('./auth-CgQP7d0q.cjs');
 var child_process = require('child_process');
-var _package = require('./package-SgqTYsjn.cjs');
-var doctor = require('./doctor-Br1Kcy2J.cjs');
-var spawnHappyCLI = require('./spawnHappyCLI-Dywezwk6.cjs');
-var persistence = require('./persistence-BegE7NPa.cjs');
-var controlClient = require('./controlClient-C-5qCt8W.cjs');
-var sessionOps = require('./sessionOps-S-qPBLFf.cjs');
+var _package = require('./package-NoD8QOOM.cjs');
+var doctor = require('./doctor-Be7zC0AF.cjs');
+var spawnHappyCLI = require('./spawnHappyCLI-DnKmIsEt.cjs');
+var persistence = require('./persistence-BY-D00wT.cjs');
+var controlClient = require('./controlClient-D68Zj7Q-.cjs');
+var sessionOps = require('./sessionOps-DVA-00nR.cjs');
 var fastify = require('fastify');
 var z = require('zod');
 var fastifyTypeProviderZod = require('fastify-type-provider-zod');
@@ -27,61 +28,62 @@ var authRelay = require('./authRelay-Dy1qU9td.cjs');
 var node_crypto = require('node:crypto');
 var previewPath = require('./previewPath-B0rBdhy1.cjs');
 var backgroundTaskActivity = require('./backgroundTaskActivity-CBvUdj39.cjs');
-var rateLimitWindows = require('./rateLimitWindows-Dj_8voBK.cjs');
-var peerTools = require('./peerTools-DRQETXaz.cjs');
+var rateLimitWindows = require('./rateLimitWindows-OpAmdOtC.cjs');
+var peerTools = require('./peerTools-CP-x-Peu.cjs');
 var os = require('node:os');
-var remoteSessionClient = require('./remoteSessionClient-B7i7MkYV.cjs');
-var bootstrap = require('./bootstrap-exVucYav.cjs');
-var index$1 = require('./index-B0UjHlAe.cjs');
-var fs$1 = require('fs');
-var path$2 = require('path');
+var remoteSessionClient = require('./remoteSessionClient-CFCn42bs.cjs');
+var bootstrap = require('./bootstrap-CYtOtbi7.cjs');
+var index$1 = require('./index-BkluinoS.cjs');
+var require$$0 = require('fs');
+var require$$1 = require('path');
 var node_child_process = require('node:child_process');
-var projectPath = require('./projectPath-ChLhdOyt.cjs');
-var doctorReadiness = require('./doctorReadiness-BCZGcN0a.cjs');
-var machineMetadata = require('./machineMetadata-CLHS9sv_.cjs');
-var handleResumeCommand = require('./handleResumeCommand-tKD_Hpxc.cjs');
+var projectPath = require('./projectPath-C3ioB4Bu.cjs');
+var doctorReadiness = require('./doctorReadiness-Dl6yRQCy.cjs');
+var machineMetadata = require('./machineMetadata-DB03ez4K.cjs');
+var fileStore = require('./fileStore-7qhnbs6N.cjs');
+var pi = require('./pi-DlsrPCTa.cjs');
+var require$$3 = require('crypto');
+var detectCLI = require('./detectCLI-BuYR_Qxe.cjs');
+var handleResumeCommand = require('./handleResumeCommand-BFZlrFVH.cjs');
 var webPanels = require('./webPanels-FCgFKvVe.cjs');
-var index = require('./index-C6O2vVjm.cjs');
+var index = require('./index-Df2eHm3O.cjs');
 var promises = require('node:fs/promises');
 var cliUpdate = require('./cliUpdate-DsKXPFYp.cjs');
-var client = require('./client-ZjOsn6nZ.cjs');
-var client$1 = require('./client-CuVdN6PP.cjs');
+var client = require('./client-DWs6k041.cjs');
+var client$1 = require('./client-D_U2VjO3.cjs');
 var module$1 = require('node:module');
 var path$1 = require('./path-B7zW-WwE.cjs');
 var editPaths = require('./editPaths-Bqp4OFPw.cjs');
-var startFileWatcher = require('./startFileWatcher-RECH5qY8.cjs');
-var sync = require('./sync-D23jbqVa.cjs');
+var startFileWatcher = require('./startFileWatcher-K6hJSyiR.cjs');
+var sync = require('./sync-1hQ5KHpL.cjs');
 var types = require('./types-CRS-srZK.cjs');
 var tmuxSocket = require('./tmuxSocket-D-Xt6Vn-.cjs');
-var sessionLock = require('./sessionLock-DokGab2R.cjs');
+var sessionLock = require('./sessionLock-CdIRJlHH.cjs');
 var doctor$1 = require('./doctor-u46qYYKX.cjs');
-var resources = require('./resources-CvIlkzpP.cjs');
+var resources = require('./resources-BPyN59Iv.cjs');
 var node_util = require('node:util');
 var template = require('./template-BaHAmH2K.cjs');
 var daemonSupervisor = require('./daemonSupervisor-B-SPSqhs.cjs');
 var loginShellEnv = require('./loginShellEnv-BkuYtExZ.cjs');
-require('./acpSessionResume-oiCBnAVA.cjs');
-require('./lidState-Dv2wwFTj.cjs');
-require('os');
+require('./acpSessionResume-BaVMD80f.cjs');
+require('./lidState-x8cJ8J_9.cjs');
 require('node:events');
 require('socket.io-client');
-require('./pushNotifications-DaLQUyi0.cjs');
+require('./pushNotifications-BXoOSq_G.cjs');
 require('./contentLogMetadata-ZSFk_NjQ.cjs');
 require('./limits-C-a7gr04.cjs');
-require('./time-CrwIMHta.cjs');
-require('./registerCommonHandlers-Cj084Sg7.cjs');
+require('./time-nqa9shu8.cjs');
+require('./registerCommonHandlers-CRjBoJLK.cjs');
 require('util');
-require('crypto');
 require('cross-spawn');
 require('@paralleldrive/cuid2');
 require('chalk');
 require('tweetnacl');
-require('./browser-BohJK12g.cjs');
+require('./browser-DjNNQQk2.cjs');
 require('open');
 require('./ids-B6ZC0HGt.cjs');
 require('url');
-require('./detectCLI-DR9ZaN6B.cjs');
-require('./localHappyAgentAuth-DjYvkXvV.cjs');
+require('./localHappyAgentAuth-DZ2kb9uq.cjs');
 require('./processTreeSnapshot-mDbnuojn.cjs');
 require('ps-list');
 
@@ -114,6 +116,87 @@ async function resolveRelaunchMetadata(snapshot, fetchServer) {
   return { metadata: snapshot, source: "snapshot" };
 }
 
+function receiptPath(home, operationId) {
+  if (!/^[a-zA-Z0-9_-]{1,128}$/.test(operationId)) throw new Error("Invalid team operation id");
+  return path.join(home, "teams", "effects", `${operationId}.json`);
+}
+function readReceipt(home, id) {
+  try {
+    const value = JSON.parse(node_fs.readFileSync(receiptPath(home, id), "utf8"));
+    if (value.operationId !== id || typeof value.claimId !== "string" || !["prepared", "spawning", "spawned", "delivered", "completed"].includes(value.phase)) throw new Error("Invalid team effect receipt");
+    return value;
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  }
+}
+function writeReceipt$1(home, receipt) {
+  configuration.ensurePrivateDirectorySync(path.join(home, "teams", "effects"));
+  const target = receiptPath(home, receipt.operationId);
+  const tmp = `${target}.${process.pid}.tmp`;
+  configuration.writePrivateFileSync(tmp, JSON.stringify(receipt));
+  const file = node_fs.openSync(tmp, "r");
+  try {
+    node_fs.fsyncSync(file);
+  } finally {
+    node_fs.closeSync(file);
+  }
+  node_fs.renameSync(tmp, target);
+  if (process.platform !== "win32") {
+    const directory = node_fs.openSync(path.join(home, "teams", "effects"), "r");
+    try {
+      node_fs.fsyncSync(directory);
+    } finally {
+      node_fs.closeSync(directory);
+    }
+  }
+}
+
+const OPERATION_ID = /^[a-zA-Z0-9_-]{1,128}$/;
+function teamScopeFilePath(home, operationId) {
+  if (!OPERATION_ID.test(operationId)) throw new Error("Invalid team operation id");
+  return path.join(home, "teams", "scopes", `${operationId}.json`);
+}
+function relaunchTeamOperationId(home, sessionId, metadata) {
+  const fromMetadata = metadata?.teamOperationId;
+  if (typeof fromMetadata === "string" && OPERATION_ID.test(fromMetadata)) return fromMetadata;
+  let names;
+  try {
+    names = node_fs.readdirSync(path.join(home, "teams", "effects"));
+  } catch {
+    return null;
+  }
+  let newest = null;
+  for (const name of names) {
+    if (!name.endsWith(".json")) continue;
+    const id = name.slice(0, -".json".length);
+    if (!OPERATION_ID.test(id)) continue;
+    try {
+      const receipt = readReceipt(home, id);
+      if (receipt?.sessionId !== sessionId || !receipt.scopeFile) continue;
+      const at = node_fs.statSync(receiptPath(home, id)).mtimeMs;
+      if (!newest || at > newest.at) newest = { id, at };
+    } catch {
+    }
+  }
+  return newest?.id ?? null;
+}
+async function teamRelaunchEnv(input) {
+  const operationId = relaunchTeamOperationId(input.home, input.sessionId, input.metadata);
+  if (!operationId) return {};
+  const scopeFile = teamScopeFilePath(input.home, operationId);
+  if (!node_fs.existsSync(scopeFile) && input.recover) {
+    try {
+      await input.recover(operationId, scopeFile);
+      input.log(`Teams scope for ${input.sessionId} rebuilt from operation ${operationId}`);
+    } catch (error) {
+      input.log(`Teams scope for ${input.sessionId} could not be rebuilt: ${error instanceof Error ? error.message : "unknown error"}`);
+    }
+  }
+  if (!node_fs.existsSync(scopeFile)) input.log(`Teams scope for ${input.sessionId} is missing; team tools will refuse until the owner restores it`);
+  return { VH_TEAM_SCOPE_FILE: scopeFile, VH_TEAM_OPERATION_ID: operationId, HAPPY_SPAWNED_BY: "teams" };
+}
+
 const DEFAULT_LOG_PRUNE_POLICY = {
   maxAgeMs: 14 * 24 * 60 * 6e4,
   maxTotalBytes: 200 * 1024 * 1024,
@@ -394,6 +477,20 @@ function formatAssistantReportMessage(title, sessionId, event) {
   return `[\u7CFB\u7EDF\u901A\u62A5] \u4F1A\u8BDD\u300C${title}\u300D${state}\uFF08${sessionId}\uFF09\u3002\u8BF7\u7528 session_read \u6838\u5B9E\u7ED3\u679C\uFF0C\u5E76\u5411\u7528\u6237\u53E3\u5934\u6C47\u62A5\u4E00\u53E5\u7ED3\u8BBA\uFF1B\u591A\u6761\u901A\u62A5\u63A5\u8FD1\u65F6\u5408\u5E76\u6C47\u62A5\u3002`;
 }
 
+const CLAUDE_OUTBOUND_MODES = ["default", "acceptEdits", "plan", "bypassPermissions"];
+function normalizeClaudeOutboundMode(value) {
+  if (value === null || value === void 0) return null;
+  if (value === "yolo") return "bypassPermissions";
+  return CLAUDE_OUTBOUND_MODES.includes(value) ? value : "default";
+}
+function publishedRelaunchPermissionMode(metadata) {
+  const published = typeof metadata?.permissionMode === "string" ? metadata.permissionMode : null;
+  if ((metadata?.flavor ?? "claude") === "claude") {
+    return normalizeClaudeOutboundMode(published) ?? void 0;
+  }
+  return published ?? void 0;
+}
+
 function resumePrecheck(metadata, fs) {
   const flavor = metadata.flavor ?? "claude";
   if (flavor === "acp" && metadata.piSessionId) {
@@ -420,6 +517,9 @@ function resumePrecheck(metadata, fs) {
   }
   return { ok: true };
 }
+function resumeStartsFreshConversation(reason) {
+  return reason === "conversation-missing" || reason === "no-backend-id";
+}
 function sanitizeResumeModel(value) {
   if (typeof value !== "string") return null;
   return /^[A-Za-z0-9][A-Za-z0-9._:-]{0,63}(\[1m\])?$/i.test(value) ? value : null;
@@ -777,7 +877,7 @@ function startDaemonControlServer({
         return { success: false, error: "daemon is still starting up" };
       }
       logger.logger.debug(`[CONTROL SERVER] Resume session request: ${sessionId} (model=${model ?? "unset"}, permissionMode=${permissionMode ?? "unset"})`);
-      const result = await resumeSession(sessionId, { model, permissionMode });
+      const result = await resumeSession(sessionId, { model, permissionMode, keepPublishedPermissionMode: true });
       switch (result.type) {
         case "success":
           return { success: true, sessionId: result.sessionId };
@@ -2085,6 +2185,2032 @@ function spawnAgentUnavailableError(agent, availability) {
   return null;
 }
 
+const MAX_DIFF_LINES = 4e3;
+function splitLines(text) {
+  if (text === "") return [];
+  const lines = text.split("\n");
+  if (lines[lines.length - 1] === "") lines.pop();
+  return lines;
+}
+function diffOps(a, b) {
+  if (a.length > MAX_DIFF_LINES || b.length > MAX_DIFF_LINES) {
+    return [...a.map((text) => ({ kind: "-", text })), ...b.map((text) => ({ kind: "+", text }))];
+  }
+  const n = a.length;
+  const m = b.length;
+  const lcs = Array.from({ length: n + 1 }, () => new Uint32Array(m + 1));
+  for (let i2 = n - 1; i2 >= 0; i2--) {
+    for (let j2 = m - 1; j2 >= 0; j2--) {
+      lcs[i2][j2] = a[i2] === b[j2] ? lcs[i2 + 1][j2 + 1] + 1 : Math.max(lcs[i2 + 1][j2], lcs[i2][j2 + 1]);
+    }
+  }
+  const ops = [];
+  let i = 0;
+  let j = 0;
+  while (i < n && j < m) {
+    if (a[i] === b[j]) {
+      ops.push({ kind: " ", text: a[i] });
+      i++;
+      j++;
+    } else if (lcs[i + 1][j] >= lcs[i][j + 1]) {
+      ops.push({ kind: "-", text: a[i] });
+      i++;
+    } else {
+      ops.push({ kind: "+", text: b[j] });
+      j++;
+    }
+  }
+  while (i < n) ops.push({ kind: "-", text: a[i++] });
+  while (j < m) ops.push({ kind: "+", text: b[j++] });
+  return ops;
+}
+function unifiedDiff(oldText, newText, label, context = 3) {
+  if (oldText === newText) return "";
+  const a = splitLines(oldText);
+  const b = splitLines(newText);
+  const ops = diffOps(a, b);
+  const changed = ops.map((op) => op.kind !== " ");
+  if (!changed.some(Boolean)) {
+    return `--- ${label}
++++ ${label}
+@@ trailing newline changed @@
+`;
+  }
+  const out = [`--- ${oldText === "" ? "/dev/null" : label}`, `+++ ${label}`];
+  let k = 0;
+  while (k < ops.length) {
+    if (!changed[k]) {
+      k++;
+      continue;
+    }
+    let start = Math.max(0, k - context);
+    let end = k;
+    while (end < ops.length) {
+      if (changed[end]) {
+        end++;
+        continue;
+      }
+      let next = end;
+      while (next < ops.length && !changed[next]) next++;
+      if (next < ops.length && next - end <= context * 2) {
+        end = next;
+        continue;
+      }
+      break;
+    }
+    const stop = Math.min(ops.length, end + context);
+    let oldStart = 1;
+    let newStart = 1;
+    for (let p = 0; p < start; p++) {
+      if (ops[p].kind !== "+") oldStart++;
+      if (ops[p].kind !== "-") newStart++;
+    }
+    const slice = ops.slice(start, stop);
+    const oldCount = slice.filter((op) => op.kind !== "+").length;
+    const newCount = slice.filter((op) => op.kind !== "-").length;
+    out.push(`@@ -${oldCount ? oldStart : oldStart - 1},${oldCount} +${newCount ? newStart : newStart - 1},${newCount} @@`);
+    for (const op of slice) out.push(`${op.kind}${op.text}`);
+    k = stop;
+    start = stop;
+  }
+  return `${out.join("\n")}
+`;
+}
+
+const ROLE$1 = "settings";
+const AUTH_TOKEN = "ANTHROPIC_AUTH_TOKEN";
+const API_KEY$1 = "ANTHROPIC_API_KEY";
+const ALIAS_VARS = { opusModel: "ANTHROPIC_DEFAULT_OPUS_MODEL", sonnetModel: "ANTHROPIC_DEFAULT_SONNET_MODEL", haikuModel: "ANTHROPIC_DEFAULT_HAIKU_MODEL" };
+function claudeEnvHelper(name) {
+  return `printf %s "$${name}"`;
+}
+const OUR_HELPER = /^printf %s "\$([A-Za-z_][A-Za-z0-9_]*)"$/;
+const OWNED_PATHS = [
+  ["env", "ANTHROPIC_BASE_URL"],
+  ["env", AUTH_TOKEN],
+  ["env", API_KEY$1],
+  ["env", ALIAS_VARS.opusModel],
+  ["env", ALIAS_VARS.sonnetModel],
+  ["env", ALIAS_VARS.haikuModel],
+  ["model"],
+  ["modelPicker", "options"],
+  ["apiKeyHelper"],
+  ["availableModels"]
+];
+function claudeSettingsPath(ctx) {
+  const dir = ctx.env.CLAUDE_CONFIG_DIR?.trim() || path.join(ctx.home, ".claude");
+  return path.join(dir, "settings.json");
+}
+function str$3(v) {
+  return typeof v === "string" && v.trim() ? v : null;
+}
+function envOf(settings) {
+  const env = settings.env;
+  return env && typeof env === "object" && !Array.isArray(env) ? env : {};
+}
+function pickerOptions(settings) {
+  const picker = settings.modelPicker;
+  if (!picker || typeof picker !== "object" || Array.isArray(picker)) return [];
+  const options = picker.options;
+  return Array.isArray(options) ? options.filter((o) => !!o && typeof o === "object" && typeof o.model === "string") : [];
+}
+function secretView$1(settings, ctx) {
+  const env = envOf(settings);
+  const literal = str$3(env[AUTH_TOKEN]) ?? str$3(env[API_KEY$1]);
+  if (literal) return { mode: "literal", masked: pi.maskSecret(literal) };
+  const helper = str$3(settings.apiKeyHelper);
+  if (helper) {
+    const ours = OUR_HELPER.exec(helper.trim());
+    if (ours) return { mode: "env", envName: ours[1], envPresent: !!ctx.env[ours[1]] };
+    return { mode: "command" };
+  }
+  return { mode: "none" };
+}
+function currentOf$2(settings, ctx) {
+  const env = envOf(settings);
+  return {
+    baseUrl: str$3(env.ANTHROPIC_BASE_URL),
+    authHeader: !str$3(env[AUTH_TOKEN]) && str$3(env[API_KEY$1]) ? "x-api-key" : "bearer",
+    apiKey: secretView$1(settings, ctx),
+    model: str$3(settings.model),
+    opusModel: str$3(env[ALIAS_VARS.opusModel]),
+    sonnetModel: str$3(env[ALIAS_VARS.sonnetModel]),
+    haikuModel: str$3(env[ALIAS_VARS.haikuModel]),
+    pickerModels: pickerOptions(settings).map((o) => o.model)
+  };
+}
+function pickerModelsOf(current) {
+  return pi.uniq([current.model, current.opusModel, current.sonnetModel, current.haikuModel, ...current.pickerModels ?? []]);
+}
+function warningsOf$2(settings, current, ctx) {
+  const env = envOf(settings);
+  const out = [...pi.baseUrlWarnings(current.baseUrl, "anthropic")];
+  if (str$3(env.ANTHROPIC_MODEL)) {
+    out.push({ code: "env-model-overrides", message: "env.ANTHROPIC_MODEL is set in settings.json and overrides the default model." });
+  }
+  const daemonOther = current.authHeader === "bearer" ? API_KEY$1 : AUTH_TOKEN;
+  if (current.baseUrl && ctx.env[daemonOther]) {
+    out.push({ code: "daemon-env-credential", message: `The daemon's environment also defines ${daemonOther}; sessions inherit it.` });
+  }
+  if (current.apiKey?.mode === "env" && !current.apiKey.envPresent) {
+    out.push({ code: "env-missing", message: `${current.apiKey.envName} is not set in the daemon's environment, so sessions will not get a key.` });
+  }
+  if (Array.isArray(settings.availableModels)) {
+    const allowed = settings.availableModels;
+    const missing = pickerModelsOf(current).filter((id) => !allowed.includes(id));
+    if (missing.length) out.push({ code: "available-models-filter", message: `availableModels does not list ${missing.join(", ")}; Claude Code hides them.` });
+  }
+  return out;
+}
+function parsePatch$1(raw) {
+  const p = raw;
+  if (p.authHeader !== void 0 && p.authHeader !== "bearer" && p.authHeader !== "x-api-key") pi.fail("invalid-input", "authHeader must be bearer or x-api-key");
+  return {
+    harness: "claude",
+    baseUrl: pi.normalizeBaseUrl(p.baseUrl),
+    authHeader: p.authHeader,
+    apiKey: pi.normalizeSecret(p.apiKey),
+    model: pi.normalizeModelId(p.model),
+    opusModel: pi.normalizeModelId(p.opusModel, "opusModel"),
+    sonnetModel: pi.normalizeModelId(p.sonnetModel, "sonnetModel"),
+    haikuModel: pi.normalizeModelId(p.haikuModel, "haikuModel"),
+    pickerModels: pi.normalizeModelList(p.pickerModels, "pickerModels")
+  };
+}
+const claudeAdapter = {
+  id: "claude",
+  binary: "claude",
+  files: (ctx) => [{ role: ROLE$1, path: claudeSettingsPath(ctx) }],
+  view(files, ctx) {
+    const settings = pi.parseJsonObject(files[ROLE$1].content, "settings.json");
+    const current = currentOf$2(settings, ctx);
+    return { current, pickerModels: pickerModelsOf(current), warnings: warningsOf$2(settings, current, ctx) };
+  },
+  plan(files, raw, ctx) {
+    const patch = parsePatch$1(raw);
+    const original = files[ROLE$1].content;
+    const before = pi.parseJsonObject(original, "settings.json");
+    const settings = structuredClone(before);
+    const hadEnv = settings.env !== void 0;
+    const env = pi.childObject(settings, "env", "settings");
+    if (patch.baseUrl !== void 0) pi.setOrDelete(env, "ANTHROPIC_BASE_URL", patch.baseUrl);
+    const currentHeader = !str$3(env[AUTH_TOKEN]) && str$3(env[API_KEY$1]) ? "x-api-key" : "bearer";
+    const header = patch.authHeader ?? currentHeader;
+    const target = header === "bearer" ? AUTH_TOKEN : API_KEY$1;
+    const other = header === "bearer" ? API_KEY$1 : AUTH_TOKEN;
+    const helperIsOurs = typeof settings.apiKeyHelper === "string" && OUR_HELPER.test(settings.apiKeyHelper.trim());
+    const secrets = [];
+    switch (patch.apiKey.mode) {
+      case "literal":
+        env[target] = patch.apiKey.value;
+        delete env[other];
+        if (helperIsOurs) delete settings.apiKeyHelper;
+        secrets.push(patch.apiKey.value);
+        break;
+      case "env":
+        settings.apiKeyHelper = claudeEnvHelper(patch.apiKey.name);
+        delete env[AUTH_TOKEN];
+        delete env[API_KEY$1];
+        break;
+      case "clear":
+        delete env[AUTH_TOKEN];
+        delete env[API_KEY$1];
+        if (helperIsOurs) delete settings.apiKeyHelper;
+        break;
+      case "keep":
+        if (header !== currentHeader && str$3(env[other]) && !str$3(env[target])) {
+          env[target] = env[other];
+          delete env[other];
+        }
+        break;
+    }
+    if (patch.model !== void 0) pi.setOrDelete(settings, "model", patch.model);
+    for (const [field, variable] of Object.entries(ALIAS_VARS)) {
+      if (patch[field] !== void 0) pi.setOrDelete(env, variable, patch[field]);
+    }
+    if (patch.pickerModels !== void 0) {
+      const hadPicker = settings.modelPicker !== void 0;
+      const picker = pi.childObject(settings, "modelPicker", "settings");
+      const existing = pickerOptions(settings);
+      const next = patch.pickerModels.map((id) => existing.find((o) => o.model === id) ?? { model: id });
+      if (next.length) picker.options = next;
+      else delete picker.options;
+      if (!hadPicker && Object.keys(picker).length === 0) delete settings.modelPicker;
+    }
+    if (!hadEnv && Object.keys(env).length === 0) delete settings.env;
+    const current = currentOf$2(settings, ctx);
+    if (Array.isArray(settings.availableModels)) {
+      const allowed = settings.availableModels;
+      const add = pickerModelsOf(current).filter((id) => !allowed.includes(id));
+      if (add.length) settings.availableModels = [...allowed, ...add];
+    }
+    const changedKeys = pi.changedPaths(before, settings, OWNED_PATHS);
+    const content = changedKeys.length === 0 ? void 0 : pi.stringifyLike(original, settings);
+    return { contents: { [ROLE$1]: content }, warnings: warningsOf$2(settings, current, ctx), changedKeys, secrets };
+  },
+  secretsIn(_role, content) {
+    try {
+      return pi.collectSecretValues(pi.parseJsonObject(content, "settings.json"));
+    } catch {
+      return /* @__PURE__ */ new Set();
+    }
+  }
+};
+
+/*!
+ * Copyright (c) Squirrel Chat et al., All rights reserved.
+ * SPDX-License-Identifier: BSD-3-Clause
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice, this
+ *    list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright notice,
+ *    this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of the copyright holder nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software without
+ *    specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+function getLineColFromPtr(string, ptr) {
+  let lines = string.slice(0, ptr).split(/\r?\n/);
+  return [lines.length, lines.pop().length + 1];
+}
+function makeCodeBlock(string, line, column) {
+  let lines = string.split(/\r?\n/);
+  let codeblock = "";
+  let numberLen = (Math.log10(line + 1) | 0) + 1;
+  for (let i = line - 1; i <= line + 1; i++) {
+    let l = lines[i - 1];
+    if (!l)
+      continue;
+    codeblock += i.toString().padEnd(numberLen, " ");
+    codeblock += ":  ";
+    codeblock += l;
+    codeblock += "\n";
+    if (i === line) {
+      codeblock += " ".repeat(numberLen + column + 2);
+      codeblock += "^\n";
+    }
+  }
+  return codeblock;
+}
+class TomlError extends Error {
+  line;
+  column;
+  codeblock;
+  constructor(message, options) {
+    const [line, column] = getLineColFromPtr(options.toml, options.ptr);
+    const codeblock = makeCodeBlock(options.toml, line, column);
+    super(`Invalid TOML document: ${message}
+
+${codeblock}`, options);
+    this.line = line;
+    this.column = column;
+    this.codeblock = codeblock;
+  }
+  /** @internal */
+  static x(message, ctx, ptr) {
+    throw new TomlError(message, { toml: ctx.s, ptr: ptr ?? ctx.p });
+  }
+}
+
+function parseString(ctx) {
+  let startPtr = ctx.p;
+  let c = ctx.s.charCodeAt(ctx.p++);
+  let first = c;
+  let isLiteral = c === 39;
+  let isMultiline = c === ctx.s.charCodeAt(ctx.p) && c === ctx.s.charCodeAt(ctx.p + 1);
+  if (isMultiline) {
+    if ((c = ctx.s.charCodeAt(ctx.p += 2)) === 10)
+      ctx.p++;
+    else if (c === 13 && ctx.s.charCodeAt(ctx.p + 1) === 10)
+      ctx.p += 2;
+  }
+  let parsed = "";
+  let sliceStart = ctx.p;
+  let state = 0;
+  for (; ctx.p < ctx.s.length; ctx.p++) {
+    c = ctx.s.charCodeAt(ctx.p);
+    if (isMultiline && (c === 10 || c === 13 && ctx.s.charCodeAt(ctx.p + 1) === 10)) {
+      state = state && 3;
+    } else if (c < 32 && c !== 9 || c === 127) {
+      TomlError.x("control characters are not allowed in strings", ctx);
+    } else if ((!state || state === 3) && c === first && (!isMultiline || ctx.s.charCodeAt(ctx.p + 1) === first && ctx.s.charCodeAt(ctx.p + 2) === first)) {
+      if (isMultiline) {
+        if (ctx.s.charCodeAt(ctx.p + 3) === first)
+          ctx.p++;
+        if (ctx.s.charCodeAt(ctx.p + 3) === first)
+          ctx.p++;
+      }
+      if (!state) {
+        let s = ctx.s.slice(sliceStart, ctx.p);
+        parsed = parsed ? parsed + s : s;
+      }
+      ctx.p += isMultiline ? 3 : 1;
+      return parsed;
+    } else if (!state) {
+      if (!isLiteral && c === 92) {
+        parsed += ctx.s.slice(sliceStart, sliceStart = ctx.p);
+        state = 1;
+      }
+    } else if (state === 1) {
+      if (c === 120 || c === 117 || c === 85) {
+        let errPtr = ctx.p++ - 1;
+        let value = 0;
+        let len = c === 120 ? 2 : c === 117 ? 4 : 8;
+        for (let j = 0; j < len; j++, ctx.p++) {
+          let hex = ctx.s.charCodeAt(ctx.p);
+          let digit = (
+            /* 0-9 */
+            hex >= 48 && hex <= 57 ? hex - 48 : (
+              /* A-F */
+              hex >= 65 && hex <= 70 ? hex - 65 + 10 : (
+                /* a-f */
+                hex >= 97 && hex <= 102 ? hex - 97 + 10 : -1
+              )
+            )
+          );
+          if (digit < 0)
+            TomlError.x("invalid non-hex character in unicode escape", ctx);
+          value = value << 4 | digit;
+        }
+        if (value < 0 || value > 1114111 || value >= 55296 && value <= 57343) {
+          TomlError.x("invalid unicode escape", ctx, errPtr);
+        }
+        parsed += String.fromCodePoint(value);
+        sliceStart = ctx.p--;
+        state = 0;
+      } else if (isMultiline && (c === 32 || c === 9)) {
+        state = 2;
+      } else {
+        if (c === 98)
+          parsed += "\b";
+        else if (c === 116)
+          parsed += "	";
+        else if (c === 110)
+          parsed += "\n";
+        else if (c === 102)
+          parsed += "\f";
+        else if (c === 114)
+          parsed += "\r";
+        else if (c === 101)
+          parsed += "\x1B";
+        else if (c === 34)
+          parsed += '"';
+        else if (c === 92)
+          parsed += "\\";
+        else
+          TomlError.x("unrecognised escape sequence", ctx);
+        sliceStart = ctx.p + 1;
+        state = 0;
+      }
+    } else if (c !== 32 && c !== 9) {
+      if (state === 2)
+        TomlError.x("invalid escape: only line-ending whitespace may be escaped", ctx, sliceStart);
+      state = !isLiteral && c === 92 ? 1 : 0;
+      sliceStart = ctx.p;
+    }
+  }
+  TomlError.x("unfinished string", ctx, startPtr);
+}
+
+/*!
+ * Copyright (c) Squirrel Chat et al., All rights reserved.
+ * SPDX-License-Identifier: BSD-3-Clause
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice, this
+ *    list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright notice,
+ *    this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of the copyright holder nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software without
+ *    specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+let DATE_TIME_RE = /^(\d{4}-\d{2}-\d{2})?[Tt ]?(?:(\d{2}):\d{2}(?::\d{2}(?:\.\d+)?)?)?(Z|z|[-+]\d{2}:\d{2})?$/i;
+class TomlDate extends Date {
+  #hasDate = false;
+  #hasTime = false;
+  #offset = null;
+  constructor(date, fasttype, unsafeDelim) {
+    let hasDate = true;
+    let hasTime = true;
+    let offset = "Z";
+    let c;
+    if (typeof date === "string") {
+      if (fasttype)
+        prep: {
+          if (fasttype < 3) {
+            if (+date.slice(11, 13) > 23) {
+              date = "";
+              break prep;
+            }
+            if (fasttype === 2) {
+              offset = null;
+              date += "Z";
+            } else if ((c = date.charCodeAt(date.length - 1)) !== 90 && c !== 122) {
+              offset = date.slice(date.length - 6);
+            }
+            if (unsafeDelim)
+              date = date.slice(0, 10) + "T" + date.slice(11);
+          } else if (fasttype === 4) {
+            date = +date.slice(0, 2) > 23 ? "" : `0000-01-01T${date}Z`;
+          }
+          hasDate = fasttype !== 4;
+          hasTime = fasttype !== 3;
+        }
+      else {
+        let match = date.match(DATE_TIME_RE);
+        if (match) {
+          if (!match[1]) {
+            hasDate = false;
+            date = `0000-01-01T${date}`;
+          }
+          hasTime = !!match[2];
+          hasTime && date[10] === " " && (date = date.replace(" ", "T"));
+          if (match[2] && +match[2] > 23) {
+            date = "";
+          } else {
+            offset = match[3] || null;
+            if (!offset && hasTime)
+              date += "Z";
+          }
+        } else {
+          date = "";
+        }
+      }
+    }
+    super(date);
+    if (!isNaN(this.getTime())) {
+      this.#hasDate = hasDate;
+      this.#hasTime = hasTime;
+      this.#offset = offset;
+    }
+  }
+  isDateTime() {
+    return this.#hasDate && this.#hasTime;
+  }
+  isLocal() {
+    return !this.#hasDate || !this.#hasTime || !this.#offset;
+  }
+  isDate() {
+    return this.#hasDate && !this.#hasTime;
+  }
+  isTime() {
+    return this.#hasTime && !this.#hasDate;
+  }
+  isValid() {
+    return this.#hasDate || this.#hasTime;
+  }
+  toISOString() {
+    let iso = super.toISOString();
+    if (this.isDate())
+      return iso.slice(0, 10);
+    if (this.isTime())
+      return iso.slice(11, 23);
+    if (this.#offset === null)
+      return iso.slice(0, -1);
+    if (this.#offset === "Z" || this.#offset === "z")
+      return iso;
+    let offset = +this.#offset.slice(1, 3) * 60 + +this.#offset.slice(4, 6);
+    offset = this.#offset[0] === "-" ? offset : -offset;
+    let offsetDate = new Date(this.getTime() - offset * 6e4);
+    return offsetDate.toISOString().slice(0, -1) + this.#offset;
+  }
+  static wrapAsOffsetDateTime(jsDate, offset = "Z") {
+    let date = new TomlDate(jsDate);
+    date.#offset = offset;
+    return date;
+  }
+  static wrapAsLocalDateTime(jsDate) {
+    let date = new TomlDate(jsDate);
+    date.#offset = null;
+    return date;
+  }
+  static wrapAsLocalDate(jsDate) {
+    let date = new TomlDate(jsDate);
+    date.#hasTime = false;
+    date.#offset = null;
+    return date;
+  }
+  static wrapAsLocalTime(jsDate) {
+    let date = new TomlDate(jsDate);
+    date.#hasDate = false;
+    date.#offset = null;
+    return date;
+  }
+}
+
+function isDigit(char, base = 10) {
+  return base === 16 ? char > 47 && char < 58 || char > 64 && char < 71 || char > 96 && char < 103 : char > 47 && char < 48 + base;
+}
+function isEndOfValue(char, delim) {
+  return char === 32 || char === 9 || char === 10 || char === 13 || // Structure end or next value delimiter
+  delim && (char === delim || char === 44) || // Comment
+  char === 35;
+}
+function extractValue(ctx, end) {
+  let errPtr = ctx.p;
+  let c = ctx.s.charCodeAt(ctx.p);
+  if (c === 91 || c === 123) {
+    ctx.d-- || TomlError.x("document contains excessively nested structures. aborting.", ctx);
+    let value = c === 91 ? parseArray(ctx) : parseInlineTable(ctx);
+    ctx.d++;
+    return value;
+  }
+  if (c === 34 || c === 39) {
+    return parseString(ctx);
+  }
+  if (c === 116) {
+    if (ctx.s.charCodeAt(++ctx.p) !== 114 || ctx.s.charCodeAt(++ctx.p) !== 117 || ctx.s.charCodeAt(++ctx.p) !== 101)
+      TomlError.x("invalid value", ctx, errPtr);
+    return ctx.p++, true;
+  }
+  if (c === 102) {
+    if (ctx.s.charCodeAt(++ctx.p) !== 97 || ctx.s.charCodeAt(++ctx.p) !== 108 || ctx.s.charCodeAt(++ctx.p) !== 115 || ctx.s.charCodeAt(++ctx.p) !== 101)
+      TomlError.x("invalid value", ctx, errPtr);
+    return ctx.p++, false;
+  }
+  if (c === 43 || c === 45) {
+    return parseNumber(ctx, ctx.p, ctx.s.charCodeAt(++ctx.p), 44 - c, end);
+  }
+  if (ctx.s.charCodeAt(ctx.p + 4) === 45 && ctx.s.charCodeAt(ctx.p + 7) === 45) {
+    return parseDate(ctx, c, end);
+  }
+  if (ctx.s.charCodeAt(ctx.p + 2) === 58) {
+    return parseTime(ctx, c, end);
+  }
+  return parseNumber(ctx, ctx.p, c, 0, end);
+}
+function parseNumber(ctx, startPtr, startChr, sign, endChr) {
+  let c = startChr;
+  let state = 0;
+  let hasUnderscores = false;
+  if (c === 105) {
+    if (ctx.s.charCodeAt(++ctx.p) !== 110 || ctx.s.charCodeAt(++ctx.p) !== 102)
+      TomlError.x("invalid value", ctx, startPtr);
+    return ctx.p++, (sign || 1) / 0;
+  }
+  if (c === 110) {
+    if (ctx.s.charCodeAt(++ctx.p) !== 97 || ctx.s.charCodeAt(++ctx.p) !== 110)
+      TomlError.x("invalid value", ctx, startPtr);
+    return ctx.p++, NaN;
+  }
+  if (c === 48) {
+    if (++ctx.p >= ctx.s.length || isEndOfValue(c = ctx.s.charCodeAt(ctx.p), endChr))
+      return ctx.bi === true ? 0n : 0;
+    if (!sign) {
+      if (c === 120)
+        return parseIntegerBaseN(ctx, startPtr, 16, endChr);
+      else if (c === 98)
+        return parseIntegerBaseN(ctx, startPtr, 2, endChr);
+      else if (c === 111)
+        return parseIntegerBaseN(ctx, startPtr, 8, endChr);
+    }
+    if (c === 46)
+      state = 2;
+    else if (c === 101 || c === 69)
+      state = 4;
+    else
+      TomlError.x("illegal leading zero", ctx, startPtr);
+  } else if (!isDigit(c))
+    TomlError.x("invalid value", ctx, startPtr);
+  while (++ctx.p < ctx.s.length && (c = ctx.s.charCodeAt(ctx.p), !isEndOfValue(c, endChr))) {
+    if (!state)
+      state = 1;
+    if (c === 95) {
+      if (!(state & 1))
+        TomlError.x("illegal underscore", ctx);
+      state += 11;
+      hasUnderscores = true;
+    } else if (state === 1 && c === 46)
+      state = 2;
+    else if ((state === 1 || state === 3) && (c === 101 || c === 69))
+      state = 4;
+    else if (state === 4 && (c === 43 || c === 45)) ; else if (!isDigit(c))
+      TomlError.x(`illegal character in numeric literal`, ctx);
+    else if (state > 9)
+      state -= 11;
+    else if (!(state & 1))
+      state++;
+  }
+  if (!state) {
+    let val = (startChr - 48) * (sign || 1);
+    return ctx.bi === true ? BigInt(val) : val;
+  }
+  if (!(state & 1))
+    TomlError.x("unfinished numeric value", ctx, startPtr);
+  let str = ctx.s.slice(startPtr, ctx.p);
+  if (hasUnderscores)
+    str = str.replaceAll("_", "");
+  return state > 1 ? parseFloat(str) : parseInteger(ctx, str, 10, startPtr);
+}
+function parseIntegerBaseN(ctx, startPtr, base, endChr) {
+  let c, underscore = 1;
+  while (++ctx.p < ctx.s.length && (c = ctx.s.charCodeAt(ctx.p), !isEndOfValue(c, endChr))) {
+    if (c === 95) {
+      if (underscore & 1)
+        TomlError.x("illegal underscore", ctx);
+      underscore = 3;
+    } else if (!isDigit(c, base))
+      TomlError.x(`illegal character in numeric literal`, ctx);
+    else if (underscore & 1)
+      underscore--;
+  }
+  if (underscore & 1)
+    TomlError.x("unfinished numeric value", ctx);
+  let str = ctx.s.slice(startPtr + 2, ctx.p);
+  if (underscore)
+    str = str.replaceAll("_", "");
+  return parseInteger(ctx, str, base, startPtr);
+}
+function parseInteger(ctx, str, base, startPtr) {
+  if (ctx.bi !== true)
+    int: {
+      let val = parseInt(str, base);
+      if (!Number.isSafeInteger(val)) {
+        if (ctx.bi)
+          break int;
+        TomlError.x("integer value cannot be represented losslessly", ctx, startPtr);
+      }
+      return val;
+    }
+  return base === 10 ? BigInt(str) : BigInt((base === 2 ? "0b" : base === 8 ? "0o" : "0x") + str);
+}
+function parseDate(ctx, c, endChr) {
+  let startPtr = ctx.p++, unsafeSeparator;
+  if (!isDigit(c) || !isDigit(ctx.s.charCodeAt(ctx.p++)) || !isDigit(ctx.s.charCodeAt(ctx.p++)) || !isDigit(ctx.s.charCodeAt(ctx.p++))) {
+    return parseNumber(ctx, ctx.p = startPtr, c, 0, endChr);
+  }
+  ctx.p += 5;
+  if (!isDigit(ctx.s.charCodeAt(ctx.p++)))
+    TomlError.x("invalid date-time: date part is malformed", ctx, startPtr);
+  if (ctx.p >= ctx.s.length || ((c = ctx.s.charCodeAt(ctx.p)) !== 32 || (unsafeSeparator = true, !isDigit(ctx.s.charCodeAt(ctx.p + 1)))) && c !== 84 && c !== 116) {
+    let t2 = ctx.s.slice(startPtr, ctx.p);
+    return readDate(ctx, t2, 3, false, startPtr);
+  }
+  if (ctx.s.charCodeAt(ctx.p += 3) !== 58)
+    TomlError.x("invalid date-time: time part is malformed", ctx, startPtr);
+  if (ctx.s.charCodeAt(ctx.p += 3) === 58)
+    ctx.p += 3;
+  if (ctx.s.charCodeAt(ctx.p) === 46)
+    while (isDigit(ctx.s.charCodeAt(++ctx.p)))
+      ;
+  if (c = ctx.s.charCodeAt(ctx.p)) {
+    if (c === 90 || c === 122) {
+      let t2 = ctx.s.slice(startPtr, ++ctx.p);
+      return readDate(ctx, t2, 1, unsafeSeparator, startPtr, "[+00:00]");
+    }
+    if (c === 43 || c === 45) {
+      let t2 = ctx.s.slice(startPtr, ctx.p += 6);
+      return readDate(ctx, t2, 1, unsafeSeparator, startPtr, !ctx.ld && "[" + ctx.s.slice(ctx.p - 6, ctx.p) + "]");
+    }
+  }
+  let t = ctx.s.slice(startPtr, ctx.p);
+  return readDate(ctx, t, 2, unsafeSeparator, startPtr);
+}
+function parseTime(ctx, c, endChr) {
+  let start = ctx.p;
+  if (!isDigit(c) || !isDigit(ctx.s.charCodeAt(++ctx.p))) {
+    return parseNumber(ctx, --ctx.p, c, 0, endChr);
+  }
+  if (ctx.s.charCodeAt(ctx.p += 4) === 58)
+    ctx.p += 3;
+  if (ctx.s.charCodeAt(ctx.p) === 46)
+    while (isDigit(ctx.s.charCodeAt(++ctx.p)))
+      ;
+  let t = ctx.s.slice(start, ctx.p);
+  return readDate(ctx, t, 4, false, start);
+}
+function readDate(ctx, str, type, unsafeDelim, errPtr, temporalSuffix) {
+  if (ctx.ld) {
+    let date = new TomlDate(str, type, unsafeDelim);
+    if (!date.isValid())
+      TomlError.x("invalid date", ctx, errPtr);
+    return date;
+  }
+  try {
+    if (temporalSuffix)
+      str += temporalSuffix;
+    switch (type) {
+      case 1:
+        return Temporal.ZonedDateTime.from(str);
+      case 2:
+        return Temporal.PlainDateTime.from(str);
+      case 3:
+        return Temporal.PlainDate.from(str);
+      case 4:
+        return Temporal.PlainTime.from(str);
+    }
+  } catch (e) {
+    TomlError.x(e instanceof Error ? e.message : "" + e, ctx, errPtr);
+  }
+}
+
+function skipComment(ctx) {
+  for (; ctx.p < ctx.s.length; ctx.p++) {
+    let c = ctx.s.charCodeAt(ctx.p);
+    if (c === 10)
+      break;
+    if (c === 13 && ctx.s.charCodeAt(ctx.p + 1) === 10) {
+      ctx.p++;
+      break;
+    }
+    if (c < 32 && c !== 9 || c === 127) {
+      TomlError.x("control characters are not allowed in comments", ctx);
+    }
+  }
+}
+function skipVoid(ctx, banNewLines, banComments) {
+  let c;
+  while (ctx.p < ctx.s.length) {
+    while (ctx.p < ctx.s.length && ((c = ctx.s.charCodeAt(ctx.p)) === 32 || c === 9 || !banNewLines && (c === 10 || c === 13 && ctx.s.charCodeAt(ctx.p + 1) === 10)))
+      ctx.p++;
+    if (banComments || c !== 35)
+      break;
+    skipComment(ctx);
+  }
+}
+
+function parseKey(ctx, end = 61) {
+  let startPtr;
+  let state = 0;
+  let parsed = [];
+  let sliceStart;
+  let c = ctx.s.charCodeAt(startPtr = ctx.p);
+  do {
+    if (c === end) {
+      if (!state)
+        TomlError.x("unexpected end of key", ctx);
+      if (state === 1)
+        parsed.push(ctx.s.slice(sliceStart, ctx.p));
+      return ctx.p++, parsed;
+    } else if (c === 46) {
+      if (!state)
+        TomlError.x("illegal empty bare key", ctx);
+      if (state === 1)
+        parsed.push(ctx.s.slice(sliceStart, ctx.p));
+      state = 0;
+    } else if (!state && (c === 34 || c === 39)) {
+      if (c === ctx.s.charCodeAt(ctx.p + 1) && c === ctx.s.charCodeAt(ctx.p + 2))
+        TomlError.x("illegal quoted key: multiline strings are not allowed", ctx);
+      parsed.push(parseString(ctx));
+      state = 2;
+      ctx.p--;
+    } else if (c === 32 || c === 9) {
+      if (state === 1) {
+        parsed.push(ctx.s.slice(sliceStart, ctx.p));
+        state = 2;
+      }
+    } else if (state === 2 || c < 48 && c !== 45 || c > 57 && c < 65 || c > 90 && c < 97 && c !== 95 || c > 122) {
+      TomlError.x("illegal character in key", ctx);
+    } else if (!state) {
+      state = 1;
+      sliceStart = ctx.p;
+    }
+  } while (c = ctx.s.charCodeAt(++ctx.p));
+  TomlError.x("incomplete key-value: cannot find end of key", ctx, startPtr);
+}
+function parseInlineTable(ctx) {
+  let startPtr = ctx.p++;
+  let res = /* @__PURE__ */ Object.create(null);
+  let seen = /* @__PURE__ */ new Set();
+  let c;
+  while (ctx.p < ctx.s.length) {
+    skipVoid(ctx);
+    if ((c = ctx.s.charCodeAt(ctx.p)) === 125) {
+      ctx.p++;
+      return res;
+    }
+    let k;
+    let t = res;
+    let hasOwn = false;
+    let errPtr = ctx.p;
+    let key = parseKey(ctx);
+    for (let i = 0; i < key.length; i++) {
+      if (i)
+        t = hasOwn ? t[k] : t[k] = /* @__PURE__ */ Object.create(null);
+      k = key[i];
+      if ((hasOwn = Object.hasOwn(t, k)) && (typeof t[k] !== "object" || seen.has(t[k]))) {
+        TomlError.x("trying to redefine an already defined value", ctx, errPtr);
+      }
+      let unsafe = k === "__proto__";
+      if (ctx.uk && (unsafe || k === "constructor")) {
+        t = ctx.uk !== 1 && TomlError.x("document contains an unsafe property", ctx, errPtr);
+        break;
+      }
+      if (!hasOwn && unsafe) {
+        Object.defineProperty(t, k, { enumerable: true, configurable: true, writable: true });
+      }
+    }
+    if (hasOwn) {
+      TomlError.x("trying to redefine an already defined value", ctx, errPtr);
+    }
+    skipVoid(ctx, true, true);
+    let value = extractValue(
+      ctx,
+      125
+      /* } */
+    );
+    if (t && typeof (t[k] = value) === "object")
+      seen.add(value);
+    skipVoid(ctx);
+    if ((c = ctx.s.charCodeAt(ctx.p++)) === 125) {
+      return res;
+    }
+    if (c !== 44)
+      TomlError.x("expected comma or end of structure", ctx, ctx.p - 1);
+  }
+  TomlError.x("unfinished table", ctx, startPtr);
+}
+function parseArray(ctx) {
+  let startPtr = ctx.p++;
+  let res = [];
+  let c;
+  while (ctx.p < ctx.s.length) {
+    skipVoid(ctx);
+    if ((c = ctx.s.charCodeAt(ctx.p)) === 93) {
+      ctx.p++;
+      return res;
+    }
+    res.push(extractValue(
+      ctx,
+      93
+      /* ] */
+    ));
+    skipVoid(ctx);
+    if ((c = ctx.s.charCodeAt(ctx.p++)) === 93) {
+      return res;
+    }
+    if (c !== 44)
+      TomlError.x("expected comma or end of structure", ctx, ctx.p - 1);
+  }
+  TomlError.x("unfinished array", ctx, startPtr);
+}
+
+function peekTable(ctx, key, table, meta, type) {
+  let t = table;
+  let m = meta;
+  let k;
+  let hasOwn = false;
+  let state;
+  for (let i = 0; i < key.length; i++) {
+    if (i) {
+      t = hasOwn ? t[k] : t[k] = /* @__PURE__ */ Object.create(null);
+      m = (state = m[k]).c;
+      if (type === 0 && (state.t === 1 || state.t === 2)) {
+        return null;
+      }
+      if (state.t === 2) {
+        let l = t.length - 1;
+        t = t[l];
+        m = m[l].c;
+      }
+    }
+    k = key[i];
+    if ((hasOwn = Object.hasOwn(t, k)) && m[k]?.t === 0 && m[k]?.d) {
+      return null;
+    }
+    if (!hasOwn) {
+      let unsafe = k === "__proto__";
+      if (ctx.uk && (unsafe || k === "constructor"))
+        return false;
+      if (unsafe) {
+        Object.defineProperty(t, k, { enumerable: true, configurable: true, writable: true });
+        Object.defineProperty(m, k, { enumerable: true, configurable: true, writable: true });
+      }
+      m[k] = {
+        t: i < key.length - 1 && type === 2 ? 3 : type,
+        d: false,
+        i: 0,
+        c: /* @__PURE__ */ Object.create(null)
+      };
+    }
+  }
+  state = m[k];
+  if (state.t !== type && !(type === 1 && state.t === 3)) {
+    return null;
+  }
+  if (type === 2) {
+    if (!state.d) {
+      state.d = true;
+      t[k] = [];
+    }
+    t[k].push(t = /* @__PURE__ */ Object.create(null));
+    state.c[state.i++] = state = { t: 1, d: false, i: 0, c: /* @__PURE__ */ Object.create(null) };
+  }
+  if (state.d) {
+    return null;
+  }
+  state.d = true;
+  if (type === 1) {
+    t = hasOwn ? t[k] : t[k] = /* @__PURE__ */ Object.create(null);
+  } else if (type === 0 && hasOwn) {
+    return null;
+  }
+  return [k, t, state.c];
+}
+function validateTablePeek(ctx, peek, ptr) {
+  if (peek === null || ctx.uk === 2)
+    TomlError.x(peek === null ? "trying to redefine an already defined table or value" : "document contains an unsafe property", ctx, ptr);
+}
+function parse(toml, options = {}) {
+  let ctx = {
+    s: toml,
+    p: 0,
+    d: options.maxDepth ?? 1e3,
+    bi: options.integersAsBigInt ?? false,
+    ld: options.useLegacyDate ?? true,
+    uk: options.unsafeKeyBehaviour === "throw" ? 2 : options.unsafeKeyBehaviour === "drop" ? 1 : 0
+  };
+  let res = /* @__PURE__ */ Object.create(null);
+  let meta = /* @__PURE__ */ Object.create(null);
+  let tmp;
+  let skipping = false;
+  let tbl = res;
+  let m = meta;
+  if (toml.charCodeAt(0) === 65279)
+    ctx.p++;
+  skipVoid(ctx);
+  while (ctx.p < toml.length) {
+    if (toml.charCodeAt(ctx.p) === 91) {
+      let isTableArray = toml.charCodeAt(++ctx.p) === 91;
+      tmp = ctx.p += +isTableArray;
+      skipping = false;
+      let k = parseKey(
+        ctx,
+        93
+        /* ] */
+      );
+      if (isTableArray) {
+        if (toml.charCodeAt(ctx.p) !== 93) {
+          TomlError.x("expected end of table array declaration", ctx);
+        }
+        ctx.p++;
+      }
+      let p = peekTable(
+        ctx,
+        k,
+        res,
+        meta,
+        isTableArray ? 2 : 1
+        /* Type.EXPLICIT */
+      );
+      if (!p) {
+        validateTablePeek(ctx, p, tmp);
+        skipping = true;
+      } else {
+        m = p[2];
+        tbl = p[1];
+      }
+    } else {
+      tmp = ctx.p;
+      let k = parseKey(ctx);
+      let p = peekTable(
+        ctx,
+        k,
+        tbl,
+        m,
+        0
+        /* Type.DOTTED */
+      );
+      if (!p && !skipping)
+        validateTablePeek(ctx, p, tmp);
+      skipVoid(ctx, true, true);
+      let v = extractValue(ctx, void 0);
+      if (p && !skipping)
+        p[1][p[0]] = v;
+    }
+    skipVoid(ctx, true);
+    if (ctx.p < toml.length && (tmp = toml.charCodeAt(ctx.p)) !== 10 && (tmp !== 13 || toml.charCodeAt(ctx.p + 1) !== 10)) {
+      TomlError.x("each key-value declaration must be followed by an end-of-line", ctx);
+    }
+    skipVoid(ctx);
+  }
+  return res;
+}
+
+const BARE_KEY = /^[A-Za-z0-9_-]+$/;
+function formatTomlKey(key) {
+  return BARE_KEY.test(key) ? key : JSON.stringify(key);
+}
+function formatTomlValue(value) {
+  if (typeof value === "boolean") return value ? "true" : "false";
+  return JSON.stringify(value).replace(/\u007f/g, "\\u007F");
+}
+function splitDottedKey(raw) {
+  const parts = [];
+  let i = 0;
+  const s = raw.trim();
+  while (i < s.length) {
+    while (s[i] === " " || s[i] === "	") i++;
+    let part = "";
+    if (s[i] === '"') {
+      let j = i + 1;
+      while (j < s.length && s[j] !== '"') {
+        if (s[j] === "\\") j++;
+        j++;
+      }
+      if (j >= s.length) return null;
+      try {
+        part = JSON.parse(s.slice(i, j + 1));
+      } catch {
+        return null;
+      }
+      i = j + 1;
+    } else if (s[i] === "'") {
+      const j = s.indexOf("'", i + 1);
+      if (j < 0) return null;
+      part = s.slice(i + 1, j);
+      i = j + 1;
+    } else {
+      let j = i;
+      while (j < s.length && /[A-Za-z0-9_-]/.test(s[j])) j++;
+      if (j === i) return null;
+      part = s.slice(i, j);
+      i = j;
+    }
+    parts.push(part);
+    while (s[i] === " " || s[i] === "	") i++;
+    if (i >= s.length) break;
+    if (s[i] !== ".") return null;
+    i++;
+  }
+  return parts.length ? parts : null;
+}
+function scan(lines) {
+  const sections = [{ path: null, arrayTable: false, headerLine: -1, start: 0, end: lines.length, keys: /* @__PURE__ */ new Map(), lastKeyLine: -1 }];
+  let inMulti = null;
+  let depth = 0;
+  for (let n = 0; n < lines.length; n++) {
+    const line = lines[n];
+    const current = sections[sections.length - 1];
+    if (inMulti) {
+      if (line.includes(inMulti)) {
+        inMulti = null;
+        current.lastKeyLine = n;
+      }
+      continue;
+    }
+    const trimmed = line.trim();
+    if (depth === 0) {
+      const header = /^\[(\[)?\s*([^\[\]]+?)\s*\](\])?\s*(#.*)?$/.exec(trimmed);
+      if (header) {
+        current.end = n;
+        const path = splitDottedKey(header[2]);
+        sections.push({ path: path ?? [`\0invalid:${header[2]}`], arrayTable: !!header[1], headerLine: n, start: n + 1, end: lines.length, keys: /* @__PURE__ */ new Map(), lastKeyLine: n });
+        continue;
+      }
+      const kv = /^((?:"(?:[^"\\]|\\.)*"|'[^']*'|[A-Za-z0-9_.\s"'-])+?)\s*=/.exec(trimmed);
+      if (kv) {
+        const keyPath = splitDottedKey(kv[1]);
+        if (keyPath) current.keys.set(keyPath.join("\0"), n);
+        current.lastKeyLine = n;
+      }
+    } else if (trimmed) {
+      current.lastKeyLine = n;
+    }
+    let i = 0;
+    while (i < line.length) {
+      const ch = line[i];
+      if (ch === "#") break;
+      if (line.startsWith('"""', i) || line.startsWith("'''", i)) {
+        const fence = line.slice(i, i + 3);
+        const close = line.indexOf(fence, i + 3);
+        if (close < 0) {
+          inMulti = fence;
+          break;
+        }
+        i = close + 3;
+        continue;
+      }
+      if (ch === '"') {
+        i++;
+        while (i < line.length && line[i] !== '"') {
+          if (line[i] === "\\") i++;
+          i++;
+        }
+        i++;
+        continue;
+      }
+      if (ch === "'") {
+        const close = line.indexOf("'", i + 1);
+        i = close < 0 ? line.length : close + 1;
+        continue;
+      }
+      if (ch === "[" || ch === "{") depth++;
+      if (ch === "]" || ch === "}") depth = Math.max(0, depth - 1);
+      i++;
+    }
+  }
+  return sections;
+}
+function trailingComment(line) {
+  const m = /^\s*[^=]+=\s*("(?:[^"\\]|\\.)*"|'[^']*'|true|false|[0-9][0-9_.eE+-]*)(\s+#.*)$/.exec(line);
+  return m ? m[2] : "";
+}
+const samePath = (a, b) => a !== null && a.length === b.length && a.every((p, i) => p === b[i]);
+const isUnder = (a, prefix) => a !== null && a.length >= prefix.length && prefix.every((p, i) => p === a[i]);
+function applyOne(text, edit) {
+  const eol = text.includes("\r\n") ? "\r\n" : "\n";
+  const lines = text.split(/\r?\n/);
+  const sections = scan(lines);
+  if ("removeTable" in edit) {
+    const doomed = sections.filter((s) => !s.arrayTable && isUnder(s.path, edit.table)).sort((a, b) => b.headerLine - a.headerLine);
+    for (const s of doomed) {
+      let end = s.end;
+      while (end > s.start && lines[end - 1]?.trim() === "" && end - 1 > s.lastKeyLine) end--;
+      lines.splice(s.headerLine, end - s.headerLine);
+    }
+    return lines.join(eol).replace(/(\r?\n){3,}/g, `${eol}${eol}`).replace(/(\r?\n)+$/, eol);
+  }
+  const root = edit.table.length === 0;
+  const section = root ? sections[0] : sections.find((s) => !s.arrayTable && samePath(s.path, edit.table));
+  const keyId = edit.key;
+  const rendered = edit.value === null ? null : `${formatTomlKey(edit.key)} = ${formatTomlValue(edit.value)}`;
+  if (section) {
+    const at = section.keys.get(keyId);
+    if (at !== void 0) {
+      const indent = /^\s*/.exec(lines[at])?.[0] ?? "";
+      if (rendered === null) lines.splice(at, 1);
+      else lines[at] = indent + rendered + trailingComment(lines[at]);
+      return lines.join(eol);
+    }
+    if (rendered === null) return text;
+    if (root) {
+      const anchor = section.lastKeyLine;
+      lines.splice(anchor + 1, 0, rendered);
+    } else {
+      lines.splice(section.lastKeyLine + 1, 0, rendered);
+    }
+    return lines.join(eol);
+  }
+  if (rendered === null) return text;
+  while (lines.length && lines[lines.length - 1].trim() === "") lines.pop();
+  const header = `[${edit.table.map(formatTomlKey).join(".")}]`;
+  if (lines.length) lines.push("");
+  lines.push(header, rendered, "");
+  return lines.join(eol);
+}
+function parseToml(text) {
+  try {
+    return parse(text);
+  } catch (error) {
+    const message = error instanceof Error ? error.message.split("\n")[0] : String(error);
+    throw new fileStore.ModelConfigError("invalid-toml", `Not valid TOML: ${message}`);
+  }
+}
+function getPath(obj, path) {
+  let cur = obj;
+  for (const p of path) {
+    if (!cur || typeof cur !== "object" || Array.isArray(cur)) return void 0;
+    cur = cur[p];
+  }
+  return cur;
+}
+function withoutPaths(obj, paths) {
+  const clone = structuredClone(obj);
+  for (const path of paths) {
+    let cur = clone;
+    for (const p of path.slice(0, -1)) {
+      if (!cur || typeof cur !== "object") {
+        cur = null;
+        break;
+      }
+      cur = cur[p];
+    }
+    if (cur && typeof cur === "object") delete cur[path[path.length - 1]];
+  }
+  return clone;
+}
+function pruneEmpty(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value) || value instanceof Date) return value;
+  const out = {};
+  for (const [k, v] of Object.entries(value)) {
+    const pruned = pruneEmpty(v);
+    if (pruned && typeof pruned === "object" && !Array.isArray(pruned) && !(pruned instanceof Date) && Object.keys(pruned).length === 0) continue;
+    out[k] = pruned;
+  }
+  return out;
+}
+function stableStringify(value) {
+  if (value instanceof Date) return JSON.stringify(value.toISOString());
+  if (Array.isArray(value)) return `[${value.map(stableStringify).join(",")}]`;
+  if (value && typeof value === "object") {
+    return `{${Object.keys(value).sort().map((k) => `${JSON.stringify(k)}:${stableStringify(value[k])}`).join(",")}}`;
+  }
+  return JSON.stringify(value) ?? "null";
+}
+function verifyTomlEdit(oldText, newText, edits) {
+  const before = parseToml(oldText);
+  let after;
+  try {
+    after = parse(newText);
+  } catch (error) {
+    throw new fileStore.ModelConfigError("unsafe-edit", `Edit would produce invalid TOML (${error instanceof Error ? error.message.split("\n")[0] : String(error)}); the file layout is not one this editor can change safely`);
+  }
+  const owned = edits.map((e) => "removeTable" in e ? e.table : [...e.table, e.key]);
+  for (const edit of edits) {
+    if ("removeTable" in edit) {
+      if (getPath(after, edit.table) !== void 0) throw new fileStore.ModelConfigError("unsafe-edit", `Table ${edit.table.join(".")} is still present after removal`);
+      continue;
+    }
+    const got = getPath(after, [...edit.table, edit.key]);
+    const want = edit.value === null ? void 0 : edit.value;
+    if (got !== want) throw new fileStore.ModelConfigError("unsafe-edit", `Key ${[...edit.table, edit.key].join(".")} did not take the requested value`);
+  }
+  if (stableStringify(pruneEmpty(withoutPaths(before, owned))) !== stableStringify(pruneEmpty(withoutPaths(after, owned)))) {
+    throw new fileStore.ModelConfigError("unsafe-edit", "Edit would change settings outside the keys Very Happy manages");
+  }
+}
+function editToml(text, edits) {
+  parseToml(text);
+  let out = text;
+  const ordered = [...edits.filter((e) => e.table.length === 0), ...edits.filter((e) => e.table.length > 0)];
+  for (const edit of ordered) out = applyOne(out, edit);
+  if (out !== text && !out.endsWith("\n")) out += text.includes("\r\n") ? "\r\n" : "\n";
+  verifyTomlEdit(text, out, edits);
+  return out;
+}
+
+const ROLE = "config";
+const CODEX_RESERVED_PROVIDERS = ["openai", "ollama", "lmstudio", "amazon-bedrock", "amazon-bedrock-runtime", "oss"];
+function codexConfigPath(ctx) {
+  const dir = ctx.env.CODEX_HOME?.trim() || path.join(ctx.home, ".codex");
+  return path.join(dir, "config.toml");
+}
+const str$2 = (v) => typeof v === "string" && v.trim() ? v : null;
+function providersOf(doc) {
+  const table = doc.model_providers;
+  if (!table || typeof table !== "object" || Array.isArray(table)) return {};
+  return Object.fromEntries(Object.entries(table).filter(([, v]) => v && typeof v === "object" && !Array.isArray(v)));
+}
+function secretView(provider, ctx) {
+  if (!provider) return { mode: "none" };
+  const token = str$2(provider.experimental_bearer_token);
+  if (token) return { mode: "literal", masked: pi.maskSecret(token) };
+  const envKey = str$2(provider.env_key);
+  if (envKey) return { mode: "env", envName: envKey, envPresent: !!ctx.env[envKey] };
+  if (provider.auth && typeof provider.auth === "object") return { mode: "command" };
+  return { mode: "none" };
+}
+function selectProvider(doc, requested) {
+  const providers = providersOf(doc);
+  if (requested) return requested;
+  const active = str$2(doc.model_provider);
+  if (active && providers[active]) return active;
+  return Object.keys(providers)[0] ?? null;
+}
+function currentOf$1(doc, providerId, ctx) {
+  const provider = providerId ? providersOf(doc)[providerId] : void 0;
+  const activeProvider = str$2(doc.model_provider);
+  return {
+    providerId,
+    providerName: str$2(provider?.name),
+    baseUrl: str$2(provider?.base_url),
+    apiKey: secretView(provider, ctx),
+    model: str$2(doc.model),
+    activeProvider,
+    active: !!providerId && activeProvider === providerId
+  };
+}
+function warningsOf$1(doc, current) {
+  const out = [...pi.baseUrlWarnings(current.baseUrl, "openai")];
+  const provider = current.providerId ? providersOf(doc)[current.providerId] : void 0;
+  if (provider && str$2(provider.wire_api) && provider.wire_api !== "responses") {
+    out.push({ code: "wire-api-unsupported", message: `wire_api = "${String(provider.wire_api)}" is rejected by current Codex; only "responses" is supported.` });
+  }
+  if (current.apiKey?.mode === "env" && !current.apiKey.envPresent) {
+    out.push({ code: "env-missing", message: `${current.apiKey.envName} is not set in the daemon's environment, so sessions will not get a key.` });
+  }
+  const active = current.activeProvider;
+  if (active && !CODEX_RESERVED_PROVIDERS.includes(active) && !providersOf(doc)[active]) {
+    out.push({ code: "active-provider-missing", message: `model_provider = "${active}" has no [model_providers.${active}] table.` });
+  }
+  return out;
+}
+function parsePatch(raw) {
+  const p = raw;
+  if (p.activate !== void 0 && typeof p.activate !== "boolean") pi.fail("invalid-input", "activate must be a boolean");
+  if (p.providerName !== void 0 && (typeof p.providerName !== "string" || p.providerName.length > 120 || /[\u0000-\u001f]/.test(p.providerName))) {
+    pi.fail("invalid-input", "providerName must be a short single-line string");
+  }
+  return {
+    providerId: pi.normalizeProviderId(p.providerId, CODEX_RESERVED_PROVIDERS),
+    providerName: p.providerName?.trim(),
+    baseUrl: pi.normalizeBaseUrl(p.baseUrl),
+    apiKey: pi.normalizeSecret(p.apiKey),
+    model: pi.normalizeModelId(p.model),
+    activate: p.activate
+  };
+}
+const codexAdapter = {
+  id: "codex",
+  binary: "codex",
+  files: (ctx) => [{ role: ROLE, path: codexConfigPath(ctx) }],
+  view(files, ctx, opts) {
+    const doc = parseToml(files[ROLE].content);
+    const current = currentOf$1(doc, selectProvider(doc, opts.providerId), ctx);
+    return { current, providers: Object.keys(providersOf(doc)), pickerModels: pi.uniq([current.model]), warnings: warningsOf$1(doc, current) };
+  },
+  plan(files, raw, ctx) {
+    const patch = parsePatch(raw);
+    const original = files[ROLE].content;
+    const before = parseToml(original);
+    const existing = providersOf(before)[patch.providerId];
+    const table = ["model_providers", patch.providerId];
+    const edits = [];
+    const secrets = [];
+    if (!existing && !patch.baseUrl) pi.fail("invalid-input", "A new provider needs a base URL");
+    const name = patch.providerName || str$2(existing?.name) || patch.providerId;
+    if (!existing || patch.providerName && patch.providerName !== existing.name || !str$2(existing.name)) edits.push({ table, key: "name", value: name });
+    if (patch.baseUrl !== void 0) {
+      if (patch.baseUrl === null && existing) pi.fail("invalid-input", "A provider needs a base URL; remove the provider instead");
+      edits.push({ table, key: "base_url", value: patch.baseUrl });
+    }
+    if (!existing || str$2(existing.wire_api) && existing.wire_api !== "responses") edits.push({ table, key: "wire_api", value: "responses" });
+    switch (patch.apiKey.mode) {
+      case "literal":
+        edits.push({ table, key: "experimental_bearer_token", value: patch.apiKey.value }, { table, key: "env_key", value: null });
+        secrets.push(patch.apiKey.value);
+        break;
+      case "env":
+        edits.push({ table, key: "env_key", value: patch.apiKey.name }, { table, key: "experimental_bearer_token", value: null });
+        break;
+      case "clear":
+        edits.push({ table, key: "env_key", value: null }, { table, key: "experimental_bearer_token", value: null });
+        break;
+    }
+    if (patch.model !== void 0) edits.push({ table: [], key: "model", value: patch.model });
+    if (patch.activate === true) edits.push({ table: [], key: "model_provider", value: patch.providerId });
+    if (patch.activate === false && str$2(before.model_provider) === patch.providerId) edits.push({ table: [], key: "model_provider", value: null });
+    const effective = edits.filter((e) => "removeTable" in e || pi.getPath(before, [...e.table, e.key]) !== (e.value ?? void 0));
+    const content = effective.length ? editToml(original, effective) : void 0;
+    const after = content === void 0 ? before : parseToml(content);
+    const current = currentOf$1(after, patch.providerId, ctx);
+    const changedKeys = effective.map((e) => [...e.table, "removeTable" in e ? "*" : e.key].join("."));
+    return { contents: { [ROLE]: content }, warnings: warningsOf$1(after, current), changedKeys, secrets };
+  },
+  secretsIn(_role, content) {
+    try {
+      return pi.collectSecretValues(parseToml(content));
+    } catch (error) {
+      if (error instanceof fileStore.ModelConfigError) return /* @__PURE__ */ new Set();
+      throw error;
+    }
+  }
+};
+
+var main = {exports: {}};
+
+var version = "16.6.1";
+var require$$4 = {
+	version: version};
+
+var hasRequiredMain;
+
+function requireMain () {
+	if (hasRequiredMain) return main.exports;
+	hasRequiredMain = 1;
+	const fs = require$$0;
+	const path = require$$1;
+	const os = os$1;
+	const crypto = require$$3;
+	const packageJson = require$$4;
+	const version = packageJson.version;
+	const LINE = /(?:^|^)\s*(?:export\s+)?([\w.-]+)(?:\s*=\s*?|:\s+?)(\s*'(?:\\'|[^'])*'|\s*"(?:\\"|[^"])*"|\s*`(?:\\`|[^`])*`|[^#\r\n]+)?\s*(?:#.*)?(?:$|$)/mg;
+	function parse(src) {
+	  const obj = {};
+	  let lines = src.toString();
+	  lines = lines.replace(/\r\n?/mg, "\n");
+	  let match;
+	  while ((match = LINE.exec(lines)) != null) {
+	    const key = match[1];
+	    let value = match[2] || "";
+	    value = value.trim();
+	    const maybeQuote = value[0];
+	    value = value.replace(/^(['"`])([\s\S]*)\1$/mg, "$2");
+	    if (maybeQuote === '"') {
+	      value = value.replace(/\\n/g, "\n");
+	      value = value.replace(/\\r/g, "\r");
+	    }
+	    obj[key] = value;
+	  }
+	  return obj;
+	}
+	function _parseVault(options) {
+	  options = options || {};
+	  const vaultPath = _vaultPath(options);
+	  options.path = vaultPath;
+	  const result = DotenvModule.configDotenv(options);
+	  if (!result.parsed) {
+	    const err = new Error(`MISSING_DATA: Cannot parse ${vaultPath} for an unknown reason`);
+	    err.code = "MISSING_DATA";
+	    throw err;
+	  }
+	  const keys = _dotenvKey(options).split(",");
+	  const length = keys.length;
+	  let decrypted;
+	  for (let i = 0; i < length; i++) {
+	    try {
+	      const key = keys[i].trim();
+	      const attrs = _instructions(result, key);
+	      decrypted = DotenvModule.decrypt(attrs.ciphertext, attrs.key);
+	      break;
+	    } catch (error) {
+	      if (i + 1 >= length) {
+	        throw error;
+	      }
+	    }
+	  }
+	  return DotenvModule.parse(decrypted);
+	}
+	function _warn(message) {
+	  console.log(`[dotenv@${version}][WARN] ${message}`);
+	}
+	function _debug(message) {
+	  console.log(`[dotenv@${version}][DEBUG] ${message}`);
+	}
+	function _log(message) {
+	  console.log(`[dotenv@${version}] ${message}`);
+	}
+	function _dotenvKey(options) {
+	  if (options && options.DOTENV_KEY && options.DOTENV_KEY.length > 0) {
+	    return options.DOTENV_KEY;
+	  }
+	  if (process.env.DOTENV_KEY && process.env.DOTENV_KEY.length > 0) {
+	    return process.env.DOTENV_KEY;
+	  }
+	  return "";
+	}
+	function _instructions(result, dotenvKey) {
+	  let uri;
+	  try {
+	    uri = new URL(dotenvKey);
+	  } catch (error) {
+	    if (error.code === "ERR_INVALID_URL") {
+	      const err = new Error("INVALID_DOTENV_KEY: Wrong format. Must be in valid uri format like dotenv://:key_1234@dotenvx.com/vault/.env.vault?environment=development");
+	      err.code = "INVALID_DOTENV_KEY";
+	      throw err;
+	    }
+	    throw error;
+	  }
+	  const key = uri.password;
+	  if (!key) {
+	    const err = new Error("INVALID_DOTENV_KEY: Missing key part");
+	    err.code = "INVALID_DOTENV_KEY";
+	    throw err;
+	  }
+	  const environment = uri.searchParams.get("environment");
+	  if (!environment) {
+	    const err = new Error("INVALID_DOTENV_KEY: Missing environment part");
+	    err.code = "INVALID_DOTENV_KEY";
+	    throw err;
+	  }
+	  const environmentKey = `DOTENV_VAULT_${environment.toUpperCase()}`;
+	  const ciphertext = result.parsed[environmentKey];
+	  if (!ciphertext) {
+	    const err = new Error(`NOT_FOUND_DOTENV_ENVIRONMENT: Cannot locate environment ${environmentKey} in your .env.vault file.`);
+	    err.code = "NOT_FOUND_DOTENV_ENVIRONMENT";
+	    throw err;
+	  }
+	  return { ciphertext, key };
+	}
+	function _vaultPath(options) {
+	  let possibleVaultPath = null;
+	  if (options && options.path && options.path.length > 0) {
+	    if (Array.isArray(options.path)) {
+	      for (const filepath of options.path) {
+	        if (fs.existsSync(filepath)) {
+	          possibleVaultPath = filepath.endsWith(".vault") ? filepath : `${filepath}.vault`;
+	        }
+	      }
+	    } else {
+	      possibleVaultPath = options.path.endsWith(".vault") ? options.path : `${options.path}.vault`;
+	    }
+	  } else {
+	    possibleVaultPath = path.resolve(process.cwd(), ".env.vault");
+	  }
+	  if (fs.existsSync(possibleVaultPath)) {
+	    return possibleVaultPath;
+	  }
+	  return null;
+	}
+	function _resolveHome(envPath) {
+	  return envPath[0] === "~" ? path.join(os.homedir(), envPath.slice(1)) : envPath;
+	}
+	function _configVault(options) {
+	  const debug = Boolean(options && options.debug);
+	  const quiet = options && "quiet" in options ? options.quiet : true;
+	  if (debug || !quiet) {
+	    _log("Loading env from encrypted .env.vault");
+	  }
+	  const parsed = DotenvModule._parseVault(options);
+	  let processEnv = process.env;
+	  if (options && options.processEnv != null) {
+	    processEnv = options.processEnv;
+	  }
+	  DotenvModule.populate(processEnv, parsed, options);
+	  return { parsed };
+	}
+	function configDotenv(options) {
+	  const dotenvPath = path.resolve(process.cwd(), ".env");
+	  let encoding = "utf8";
+	  const debug = Boolean(options && options.debug);
+	  const quiet = options && "quiet" in options ? options.quiet : true;
+	  if (options && options.encoding) {
+	    encoding = options.encoding;
+	  } else {
+	    if (debug) {
+	      _debug("No encoding is specified. UTF-8 is used by default");
+	    }
+	  }
+	  let optionPaths = [dotenvPath];
+	  if (options && options.path) {
+	    if (!Array.isArray(options.path)) {
+	      optionPaths = [_resolveHome(options.path)];
+	    } else {
+	      optionPaths = [];
+	      for (const filepath of options.path) {
+	        optionPaths.push(_resolveHome(filepath));
+	      }
+	    }
+	  }
+	  let lastError;
+	  const parsedAll = {};
+	  for (const path2 of optionPaths) {
+	    try {
+	      const parsed = DotenvModule.parse(fs.readFileSync(path2, { encoding }));
+	      DotenvModule.populate(parsedAll, parsed, options);
+	    } catch (e) {
+	      if (debug) {
+	        _debug(`Failed to load ${path2} ${e.message}`);
+	      }
+	      lastError = e;
+	    }
+	  }
+	  let processEnv = process.env;
+	  if (options && options.processEnv != null) {
+	    processEnv = options.processEnv;
+	  }
+	  DotenvModule.populate(processEnv, parsedAll, options);
+	  if (debug || !quiet) {
+	    const keysCount = Object.keys(parsedAll).length;
+	    const shortPaths = [];
+	    for (const filePath of optionPaths) {
+	      try {
+	        const relative = path.relative(process.cwd(), filePath);
+	        shortPaths.push(relative);
+	      } catch (e) {
+	        if (debug) {
+	          _debug(`Failed to load ${filePath} ${e.message}`);
+	        }
+	        lastError = e;
+	      }
+	    }
+	    _log(`injecting env (${keysCount}) from ${shortPaths.join(",")}`);
+	  }
+	  if (lastError) {
+	    return { parsed: parsedAll, error: lastError };
+	  } else {
+	    return { parsed: parsedAll };
+	  }
+	}
+	function config(options) {
+	  if (_dotenvKey(options).length === 0) {
+	    return DotenvModule.configDotenv(options);
+	  }
+	  const vaultPath = _vaultPath(options);
+	  if (!vaultPath) {
+	    _warn(`You set DOTENV_KEY but you are missing a .env.vault file at ${vaultPath}. Did you forget to build it?`);
+	    return DotenvModule.configDotenv(options);
+	  }
+	  return DotenvModule._configVault(options);
+	}
+	function decrypt(encrypted, keyStr) {
+	  const key = Buffer.from(keyStr.slice(-64), "hex");
+	  let ciphertext = Buffer.from(encrypted, "base64");
+	  const nonce = ciphertext.subarray(0, 12);
+	  const authTag = ciphertext.subarray(-16);
+	  ciphertext = ciphertext.subarray(12, -16);
+	  try {
+	    const aesgcm = crypto.createDecipheriv("aes-256-gcm", key, nonce);
+	    aesgcm.setAuthTag(authTag);
+	    return `${aesgcm.update(ciphertext)}${aesgcm.final()}`;
+	  } catch (error) {
+	    const isRange = error instanceof RangeError;
+	    const invalidKeyLength = error.message === "Invalid key length";
+	    const decryptionFailed = error.message === "Unsupported state or unable to authenticate data";
+	    if (isRange || invalidKeyLength) {
+	      const err = new Error("INVALID_DOTENV_KEY: It must be 64 characters long (or more)");
+	      err.code = "INVALID_DOTENV_KEY";
+	      throw err;
+	    } else if (decryptionFailed) {
+	      const err = new Error("DECRYPTION_FAILED: Please check your DOTENV_KEY");
+	      err.code = "DECRYPTION_FAILED";
+	      throw err;
+	    } else {
+	      throw error;
+	    }
+	  }
+	}
+	function populate(processEnv, parsed, options = {}) {
+	  const debug = Boolean(options && options.debug);
+	  const override = Boolean(options && options.override);
+	  if (typeof parsed !== "object") {
+	    const err = new Error("OBJECT_REQUIRED: Please check the processEnv argument being passed to populate");
+	    err.code = "OBJECT_REQUIRED";
+	    throw err;
+	  }
+	  for (const key of Object.keys(parsed)) {
+	    if (Object.prototype.hasOwnProperty.call(processEnv, key)) {
+	      if (override === true) {
+	        processEnv[key] = parsed[key];
+	      }
+	      if (debug) {
+	        if (override === true) {
+	          _debug(`"${key}" is already defined and WAS overwritten`);
+	        } else {
+	          _debug(`"${key}" is already defined and was NOT overwritten`);
+	        }
+	      }
+	    } else {
+	      processEnv[key] = parsed[key];
+	    }
+	  }
+	}
+	const DotenvModule = {
+	  configDotenv,
+	  _configVault,
+	  _parseVault,
+	  config,
+	  decrypt,
+	  parse,
+	  populate
+	};
+	main.exports.configDotenv = DotenvModule.configDotenv;
+	main.exports._configVault = DotenvModule._configVault;
+	main.exports._parseVault = DotenvModule._parseVault;
+	main.exports.config = DotenvModule.config;
+	main.exports.decrypt = DotenvModule.decrypt;
+	main.exports.parse = DotenvModule.parse;
+	main.exports.populate = DotenvModule.populate;
+	main.exports = DotenvModule;
+	return main.exports;
+}
+
+var mainExports = requireMain();
+
+const LINE = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=/;
+function parseDotenv(text) {
+  return mainExports.parse(text);
+}
+function formatDotenvValue(value) {
+  if (/^[A-Za-z0-9_./:@+,-]*$/.test(value)) return value;
+  return `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\n/g, "\\n")}"`;
+}
+function editDotenv(text, edits) {
+  const eol = text.includes("\r\n") ? "\r\n" : "\n";
+  let lines = text === "" ? [] : text.split(/\r?\n/);
+  if (lines.length && lines[lines.length - 1] === "") lines.pop();
+  for (const edit of edits) {
+    const at = lines.map((l, i) => LINE.exec(l)?.[1] === edit.key ? i : -1).filter((i) => i >= 0);
+    if (edit.value === null) {
+      lines = lines.filter((_, i) => !at.includes(i));
+      continue;
+    }
+    const rendered = `${edit.key}=${formatDotenvValue(edit.value)}`;
+    if (at.length) {
+      lines[at[0]] = rendered;
+      lines = lines.filter((_, i) => !at.slice(1).includes(i));
+    } else {
+      lines.push(rendered);
+    }
+  }
+  const out = lines.length ? lines.join(eol) + eol : "";
+  const before = mainExports.parse(text);
+  const after = mainExports.parse(out);
+  for (const edit of edits) {
+    if ((after[edit.key] ?? null) !== edit.value) throw new fileStore.ModelConfigError("unsafe-edit", `.env edit did not produce ${edit.key} as requested`);
+    delete before[edit.key];
+    delete after[edit.key];
+  }
+  if (JSON.stringify(Object.entries(before).sort()) !== JSON.stringify(Object.entries(after).sort())) {
+    throw new fileStore.ModelConfigError("unsafe-edit", ".env edit would change other variables");
+  }
+  return out;
+}
+
+const SETTINGS = "settings";
+const ENV = "env";
+const BASE_URL = "GOOGLE_GEMINI_BASE_URL";
+const API_KEY = "GEMINI_API_KEY";
+function geminiDir(ctx) {
+  return path.join(ctx.env.GEMINI_CLI_HOME?.trim() || ctx.home, ".gemini");
+}
+const str$1 = (v) => typeof v === "string" && v.trim() ? v : null;
+function currentOf(settings, env, ctx) {
+  const literal = str$1(env[API_KEY]);
+  const apiKey = literal ? { mode: "literal", masked: pi.maskSecret(literal) } : ctx.env[API_KEY] ? { mode: "env", envName: API_KEY, envPresent: true } : { mode: "none" };
+  return { baseUrl: str$1(env[BASE_URL]), apiKey, model: str$1(pi.getPath(settings, ["model", "name"])) };
+}
+function warningsOf(settings, current) {
+  const out = [...pi.baseUrlWarnings(current.baseUrl, "gemini")];
+  if (current.baseUrl || current.apiKey?.mode === "literal") {
+    out.push({ code: "project-env-shadows", message: "~/.gemini/.env is used only when the session folder (or a parent) has no .gemini/.env or .env of its own." });
+  }
+  const selected = str$1(pi.getPath(settings, ["security", "auth", "selectedType"]));
+  if (current.baseUrl && selected && selected !== "gateway") {
+    out.push({ code: "auth-type-pinned", message: `security.auth.selectedType is "${selected}"; Gemini only uses GOOGLE_GEMINI_BASE_URL with the gateway auth type.` });
+  }
+  if (current.baseUrl && !/^https:/.test(current.baseUrl) && !/^http:\/\/(localhost|127\.0\.0\.1|\[::1\])(:|\/|$)/.test(current.baseUrl)) {
+    out.push({ code: "gemini-https", message: "Gemini requires an https base URL (localhost excepted)." });
+  }
+  return out;
+}
+const geminiAdapter = {
+  id: "gemini",
+  binary: "gemini",
+  files: (ctx) => [{ role: SETTINGS, path: path.join(geminiDir(ctx), "settings.json") }, { role: ENV, path: path.join(geminiDir(ctx), ".env") }],
+  view(files, ctx) {
+    const settings = pi.parseJsonObject(files[SETTINGS].content, "settings.json");
+    const current = currentOf(settings, parseDotenv(files[ENV].content), ctx);
+    return { current, pickerModels: pi.uniq([current.model]), warnings: warningsOf(settings, current) };
+  },
+  plan(files, raw, ctx) {
+    const p = raw;
+    const baseUrl = pi.normalizeBaseUrl(p.baseUrl);
+    const apiKey = pi.normalizeSecret(p.apiKey, ["keep", "clear", "literal"]);
+    const model = pi.normalizeModelId(p.model);
+    const settingsText = files[SETTINGS].content;
+    const before = pi.parseJsonObject(settingsText, "settings.json");
+    const settings = structuredClone(before);
+    const changedKeys = [];
+    let settingsOut;
+    if (model !== void 0 && (str$1(pi.getPath(before, ["model", "name"])) ?? null) !== model) {
+      const hadModel = settings.model !== void 0;
+      const modelObj = pi.childObject(settings, "model", "settings");
+      pi.setOrDelete(modelObj, "name", model);
+      if (!hadModel && Object.keys(modelObj).length === 0) delete settings.model;
+      settingsOut = pi.stringifyLike(settingsText, settings);
+      changedKeys.push("settings.model.name");
+    }
+    const envText = files[ENV].content;
+    const env = parseDotenv(envText);
+    const edits = [];
+    if (baseUrl !== void 0 && (env[BASE_URL] ?? null) !== baseUrl) edits.push({ key: BASE_URL, value: baseUrl });
+    if (apiKey.mode === "literal" && env[API_KEY] !== apiKey.value) edits.push({ key: API_KEY, value: apiKey.value });
+    if (apiKey.mode === "clear" && env[API_KEY] !== void 0) edits.push({ key: API_KEY, value: null });
+    const envOut = edits.length ? editDotenv(envText, edits) : void 0;
+    changedKeys.push(...edits.map((e) => `.env.${e.key}`));
+    const afterEnv = envOut === void 0 ? env : parseDotenv(envOut);
+    const current = currentOf(settings, afterEnv, ctx);
+    return {
+      contents: { [SETTINGS]: settingsOut, [ENV]: envOut },
+      warnings: warningsOf(settings, current),
+      changedKeys,
+      secrets: apiKey.mode === "literal" ? [apiKey.value] : []
+    };
+  },
+  secretsIn(role, content) {
+    try {
+      return role === ENV ? pi.collectSecretValues(parseDotenv(content)) : pi.collectSecretValues(pi.parseJsonObject(content, "settings.json"));
+    } catch {
+      return /* @__PURE__ */ new Set();
+    }
+  }
+};
+
+const MODEL_CONFIG_CAPABILITY_VERSION = 1;
+const HARNESS_IDS = ["claude", "codex", "gemini", "pi"];
+
+const ADAPTERS = { claude: claudeAdapter, codex: codexAdapter, gemini: geminiAdapter, pi: pi.piAdapter };
+function harnessOf(value) {
+  if (typeof value !== "string" || !HARNESS_IDS.includes(value)) {
+    throw new fileStore.ModelConfigError("invalid-harness", `harness must be one of ${HARNESS_IDS.join(", ")}`);
+  }
+  return value;
+}
+class ModelConfigService {
+  constructor(opts) {
+    this.opts = opts;
+    this.backups = new fileStore.BackupStore(path.join(opts.happyHomeDir, "model-config-backups"));
+    this.auditPath = path.join(opts.happyHomeDir, "model-config-audit.jsonl");
+  }
+  backups;
+  auditPath;
+  chain = Promise.resolve();
+  get ctx() {
+    return { home: this.opts.home, env: this.opts.env };
+  }
+  serialize(fn) {
+    const next = this.chain.then(fn, fn);
+    this.chain = next.catch(() => {
+    });
+    return next;
+  }
+  async loadFiles(adapter) {
+    const files = {};
+    for (const { role, path } of adapter.files(this.ctx)) files[role] = await fileStore.readConfigFile(path);
+    const baseHash = fileStore.sha256(Object.entries(files).map(([role, f]) => `${role}\0${f.exists ? f.hash : "-"}`).join("\n"));
+    return { files, baseHash };
+  }
+  async readOne(harness, providerId) {
+    const adapter = ADAPTERS[harness];
+    const installed = harness === "claude" || (this.opts.isInstalled?.(adapter.binary) ?? true);
+    const backups = await this.backups.list(harness);
+    let loaded;
+    try {
+      loaded = await this.loadFiles(adapter);
+    } catch (error) {
+      const e = toError(error);
+      return {
+        harness,
+        installed,
+        baseHash: "",
+        current: {},
+        pickerModels: [],
+        backups,
+        warnings: [],
+        files: adapter.files(this.ctx).map((f) => ({ role: f.role, path: f.path, exists: false, error: e }))
+      };
+    }
+    const files = Object.entries(loaded.files).map(([role, f]) => ({ role, path: f.path, exists: f.exists }));
+    try {
+      const view = adapter.view(loaded.files, this.ctx, { providerId });
+      return { harness, installed, files, baseHash: loaded.baseHash, backups, ...view };
+    } catch (error) {
+      const e = toError(error);
+      return { harness, installed, baseHash: loaded.baseHash, current: {}, pickerModels: [], backups, warnings: [], files: files.map((f) => ({ ...f, error: e })) };
+    }
+  }
+  async read(params = {}) {
+    const list = params.harness === void 0 ? [...HARNESS_IDS] : [harnessOf(params.harness)];
+    const providerId = typeof params.providerId === "string" && params.providerId ? params.providerId : void 0;
+    const harnesses = await Promise.all(list.map((h) => this.readOne(h, providerId)));
+    return { version: MODEL_CONFIG_CAPABILITY_VERSION, harnesses };
+  }
+  diffs(adapter, files, next, extraSecrets) {
+    const out = [];
+    for (const [role, file] of Object.entries(files)) {
+      const target = next[role];
+      if (target === void 0) continue;
+      const newText = target ?? "";
+      if (target !== null && file.exists && newText === file.content) continue;
+      if (target === null && !file.exists) continue;
+      const secrets = [...adapter.secretsIn(role, file.content), ...target ? adapter.secretsIn(role, target) : [], ...extraSecrets];
+      const raw = unifiedDiff(file.content, newText, file.path);
+      out.push({ path: file.path, diff: pi.redactText(raw, secrets), created: !file.exists && target !== null, deleted: target === null && file.exists });
+    }
+    return out;
+  }
+  async write(harness, action, files, next, keys, apiKeyMode) {
+    const touched = Object.entries(next).filter(([, v]) => v !== void 0);
+    const snapshot = touched.map(([role]) => ({ path: files[role].path, content: files[role].exists ? files[role].content : null, mode: files[role].mode }));
+    const backup = await this.backups.create(harness, action === "apply" ? "before-apply" : "before-restore", snapshot, this.opts.now?.() ?? Date.now());
+    for (const [role, target] of touched) {
+      const file = files[role];
+      if (target.content === null) await node_fs.promises.rm(file.path, { force: true });
+      else await fileStore.atomicWriteFile(file.path, target.content, file.mode ?? target.mode);
+    }
+    await this.audit({ at: this.opts.now?.() ?? Date.now(), action, harness, files: touched.map(([role]) => files[role].path), keys, apiKeyMode, backupId: backup.id });
+    this.opts.onChanged?.(harness);
+    return backup;
+  }
+  async audit(record) {
+    try {
+      await node_fs.promises.mkdir(this.opts.happyHomeDir, { recursive: true });
+      await node_fs.promises.appendFile(this.auditPath, `${JSON.stringify(record)}
+`, { encoding: "utf8", mode: 384 });
+    } catch {
+    }
+  }
+  apply(params) {
+    const run = async () => {
+      const patch = params.patch;
+      if (!patch || typeof patch !== "object") throw new fileStore.ModelConfigError("invalid-input", "patch is required");
+      const harness = harnessOf(patch.harness);
+      const adapter = ADAPTERS[harness];
+      const { files, baseHash } = await this.loadFiles(adapter);
+      const dryRun = params.dryRun !== false;
+      if (!dryRun && params.baseHash !== baseHash) {
+        throw new fileStore.ModelConfigError("conflict", "The config files changed since the preview; review the new diff and apply again");
+      }
+      const plan = adapter.plan(files, patch, this.ctx);
+      const diffs = this.diffs(adapter, files, plan.contents, plan.secrets);
+      const changed = diffs.length > 0;
+      if (dryRun || !changed) {
+        return { harness, dryRun, changed, baseHash, files: diffs, warnings: plan.warnings };
+      }
+      const next = Object.fromEntries(Object.entries(plan.contents).map(([role, content]) => [role, content === void 0 ? void 0 : { content, mode: null }]));
+      const apiKeyMode = patch.apiKey?.mode;
+      const backup = await this.write(harness, "apply", files, next, plan.changedKeys, typeof apiKeyMode === "string" ? apiKeyMode : void 0);
+      const config = await this.readOne(harness, patch.providerId);
+      return { harness, dryRun, changed, baseHash: config.baseHash, files: diffs, warnings: plan.warnings, backup, config };
+    };
+    return params.dryRun === false ? this.serialize(run) : run();
+  }
+  restore(params) {
+    const run = async () => {
+      const harness = harnessOf(params.harness);
+      const adapter = ADAPTERS[harness];
+      if (typeof params.backupId !== "string") throw new fileStore.ModelConfigError("invalid-input", "backupId is required");
+      const saved = await this.backups.read(harness, params.backupId);
+      const { files, baseHash } = await this.loadFiles(adapter);
+      const dryRun = params.dryRun !== false;
+      if (!dryRun && params.baseHash !== baseHash) {
+        throw new fileStore.ModelConfigError("conflict", "The config files changed since the preview; review the new diff and restore again");
+      }
+      const allowed = new Map(Object.entries(files).map(([role, f]) => [f.path, role]));
+      const target = {};
+      for (const file of saved) {
+        const role = allowed.get(file.path);
+        if (!role) throw new fileStore.ModelConfigError("backup-mismatch", "Backup does not belong to the current config location");
+        target[role] = { content: file.content, mode: file.mode };
+      }
+      const diffs = this.diffs(adapter, files, Object.fromEntries(Object.entries(target).map(([r, v]) => [r, v?.content])), []);
+      const changed = diffs.length > 0;
+      if (dryRun || !changed) return { harness, dryRun, changed, baseHash, files: diffs, warnings: [] };
+      const keys = ["*restore*"];
+      const backup = await this.write(harness, "restore", files, target, keys);
+      const config = await this.readOne(harness);
+      return { harness, dryRun, changed, baseHash: config.baseHash, files: diffs, warnings: [], backup, config };
+    };
+    return params.dryRun === false ? this.serialize(run) : run();
+  }
+}
+function toError(error) {
+  if (error instanceof fileStore.ModelConfigError) return { code: error.code, message: error.message };
+  return { code: "read-failed", message: error instanceof Error ? error.message : String(error) };
+}
+
 function startWebPanelsSync(deps) {
   let lastMtime;
   let lastProblems = "";
@@ -2414,26 +4540,45 @@ function createUpdateController(deps) {
   let blocked = false;
   let handoverHold;
   let lastPublished = "";
+  let autoUpdateEnabled;
+  let lastInstall = (() => {
+    try {
+      return deps.lastInstall?.read() ?? null;
+    } catch {
+      return null;
+    }
+  })();
   const now = deps.now ?? Date.now;
+  function snapshot() {
+    return {
+      ...policy,
+      retrySupported: !blocked,
+      manualUpdateSupported: !blocked,
+      handoverHold,
+      autoUpdate: outcome,
+      ...autoUpdateEnabled === void 0 ? {} : { autoUpdateEnabled },
+      ...lastInstall ? { lastInstall } : {}
+    };
+  }
   function validManualTarget(next, version) {
     return version === next.recommendedVersion && Number.isFinite(next.checkedAt) && now() - next.checkedAt <= 65 * 6e4 && next.checkedAt <= now() + 6e4 && cliUpdate.compareExactVersions(next.currentVersion, version) === -1 && (!next.minimumVersion || [0, 1].includes(cliUpdate.compareExactVersions(version, next.minimumVersion) ?? -1));
   }
   function publish(state, version, detail) {
     if (!policy) return;
-    const fingerprint = JSON.stringify([policy.checkedAt, state, version, detail, manualVersion]);
+    const fingerprint = JSON.stringify([policy.checkedAt, state, version, detail, manualVersion, autoUpdateEnabled]);
     if (fingerprint === lastPublished) return;
     lastPublished = fingerprint;
     outcome = { state, version, detail, at: now(), ...manualVersion ? { source: "manual" } : {} };
-    deps.publish({ ...policy, retrySupported: !blocked, manualUpdateSupported: !blocked, handoverHold, autoUpdate: outcome });
+    deps.publish(snapshot());
   }
   async function evaluate() {
     if (!policy || running) return;
     const target = manualVersion ?? policy.autoUpdateVersion ?? null;
     if (outcome?.version === target && ["failed", "installed", "manual_required"].includes(outcome.state)) {
-      const fingerprint = JSON.stringify([policy.checkedAt, outcome.state, outcome.version, outcome.detail, manualVersion]);
+      const fingerprint = JSON.stringify([policy.checkedAt, outcome.state, outcome.version, outcome.detail, manualVersion, autoUpdateEnabled]);
       if (fingerprint !== lastPublished) {
         lastPublished = fingerprint;
-        deps.publish({ ...policy, retrySupported: !blocked, manualUpdateSupported: !blocked, handoverHold, autoUpdate: outcome });
+        deps.publish(snapshot());
       }
       return;
     }
@@ -2441,9 +4586,12 @@ function createUpdateController(deps) {
       publish("policy_stale", target);
       return;
     }
-    if (!manualVersion && !await deps.enabled()) {
-      publish("disabled", target);
-      return;
+    if (!manualVersion) {
+      autoUpdateEnabled = await deps.enabled();
+      if (!autoUpdateEnabled) {
+        publish("disabled", target);
+        return;
+      }
     }
     if (running) return;
     if (now() - policy.checkedAt > 65 * 6e4) {
@@ -2473,6 +4621,13 @@ function createUpdateController(deps) {
         return;
       }
       blocked = code === "blocked";
+      if (code === 0) {
+        lastInstall = { from: policy.currentVersion, to: target, at: now(), source: manualVersion ? "manual" : "auto" };
+        try {
+          deps.lastInstall?.write(lastInstall);
+        } catch {
+        }
+      }
       publish(
         blocked ? "manual_required" : code === 0 ? "installed" : "failed",
         target,
@@ -2574,7 +4729,224 @@ function createUpdateController(deps) {
     handoverHold = { reason, at: now() };
     publish("failed", manualVersion ?? policy?.autoUpdateVersion ?? null, "handover_preflight_failed");
   }
-  return { refresh, retry, request, tick, withHandover, holdHandover, isRunning: () => running };
+  return { refresh, retry, request, tick, withHandover, holdHandover, isRunning: () => running, currentTarget: () => policy?.autoUpdateVersion ?? null };
+}
+
+function parseLastInstall(raw) {
+  if (!raw || typeof raw !== "object") return null;
+  const { from, to, at, source } = raw;
+  if (typeof from !== "string" || typeof to !== "string" || !cliUpdate.parseExactVersion(from) || !cliUpdate.parseExactVersion(to)) return null;
+  if (typeof at !== "number" || !Number.isFinite(at) || source !== "auto" && source !== "manual") return null;
+  return { from, to, at, source };
+}
+function lastInstallStore(homeDir) {
+  const file = path.join(homeDir, "cli-update-last.json");
+  return {
+    read() {
+      try {
+        return parseLastInstall(JSON.parse(node_fs.readFileSync(file, "utf8")));
+      } catch {
+        return null;
+      }
+    },
+    write(record) {
+      const tmp = `${file}.${process.pid}.tmp`;
+      node_fs.writeFileSync(tmp, JSON.stringify(record));
+      node_fs.renameSync(tmp, file);
+    }
+  };
+}
+
+const ANNOUNCE_FIRST_DELAY_MS = 9e4;
+const ANNOUNCE_JITTER_MS = 6e4;
+const ANNOUNCE_FOLLOW_UP_MS = 5 * 6e4;
+function announcedVersion(payload) {
+  if (!payload || typeof payload !== "object") return null;
+  const raw = payload.autoUpdateVersion;
+  if (typeof raw !== "string" || raw.length > 64) return null;
+  return cliUpdate.parseExactVersion(raw)?.exact ?? null;
+}
+function createPolicyAnnouncementHandler(deps) {
+  const random = deps.random ?? Math.random;
+  const setTimer = deps.setTimer ?? ((fn, ms) => {
+    const t = setTimeout(fn, ms);
+    t.unref?.();
+    return t;
+  });
+  const clearTimer = deps.clearTimer ?? ((handle) => clearTimeout(handle));
+  let timer = null;
+  let pending = null;
+  let stopped = false;
+  function schedule(version, ms, followUp) {
+    if (timer !== null) clearTimer(timer);
+    pending = version;
+    timer = setTimer(() => {
+      timer = null;
+      void deps.refresh().catch(() => void 0).finally(() => {
+        if (stopped || pending !== version) return;
+        if (deps.currentTarget() === version || !followUp) {
+          pending = null;
+          return;
+        }
+        schedule(version, ANNOUNCE_FOLLOW_UP_MS, false);
+      });
+    }, ms);
+  }
+  return {
+    /** Socket handler. Returns the scheduled delay (ms) or null when ignored — for logs and tests. */
+    onAnnouncement(payload) {
+      if (stopped) return null;
+      const version = announcedVersion(payload);
+      if (!version || version === deps.currentTarget() || version === pending) return null;
+      const delay = ANNOUNCE_FIRST_DELAY_MS + Math.floor(random() * ANNOUNCE_JITTER_MS);
+      schedule(version, delay, true);
+      return delay;
+    },
+    stop() {
+      stopped = true;
+      if (timer !== null) clearTimer(timer);
+      timer = null;
+    }
+  };
+}
+
+const HARNESS_INSTALL_CATALOG = Object.freeze({
+  claude: Object.freeze({ packages: [{ name: "@anthropic-ai/claude-code", spec: "latest" }], commands: ["claude"], minNode: "22.0.0", scripts: true }),
+  codex: Object.freeze({ packages: [{ name: "@openai/codex", spec: "latest" }], commands: ["codex"], minNode: "16.0.0", scripts: false }),
+  gemini: Object.freeze({ packages: [{ name: "@google/gemini-cli", spec: "latest" }], commands: ["gemini"], minNode: "20.0.0", scripts: false }),
+  pi: Object.freeze({
+    packages: [{ name: "@earendil-works/pi-coding-agent", spec: "latest" }, { name: "pi-acp", spec: "0.0.33" }],
+    commands: ["pi", "pi-acp"],
+    minNode: "22.19.0",
+    scripts: false
+  })
+});
+function harnessInstallArgs(id, prefix) {
+  const entry = HARNESS_INSTALL_CATALOG[id];
+  if (!entry) throw new Error("Unknown harness");
+  const args = ["i", "-g", `--prefix=${prefix}`, "--no-fund", "--no-audit", ...entry.scripts ? [] : ["--ignore-scripts"], ...entry.packages.map((p) => `${p.name}@${p.spec}`)];
+  if (args.some((arg) => !doctor.NPM_SAFE_ARG.test(arg))) throw new Error("Unsafe npm argument");
+  return args;
+}
+function parseNode(version) {
+  const m = /^v?(\d+)\.(\d+)\.(\d+)/.exec(version.trim());
+  return m ? [Number(m[1]), Number(m[2]), Number(m[3])] : null;
+}
+function nodeSatisfies(current, minimum) {
+  const a = parseNode(current);
+  const b = parseNode(minimum);
+  if (!a || !b) return false;
+  for (let i = 0; i < 3; i++) if (a[i] !== b[i]) return a[i] > b[i];
+  return true;
+}
+
+async function defaultCanWrite(path) {
+  try {
+    await promises.access(path, promises.constants.W_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function defaultIsPlainDirectory(path) {
+  try {
+    const s = await promises.lstat(path);
+    return s.isDirectory() && !s.isSymbolicLink();
+  } catch {
+    return false;
+  }
+}
+function redactNpmText(text) {
+  return text.replace(/(_authToken|_auth|_password|token|password)\s*=\s*\S+/gi, "$1=***").replace(/Bearer\s+\S+/gi, "Bearer ***").replace(/([a-z][a-z0-9+.-]*:\/\/)[^\s/@:]+(:[^\s/@]*)?@/gi, "$1***@").replace(/\/(home|Users)\/[^/\s]+/g, "~").replace(/\/root(?=\/|\s|$)/g, "~");
+}
+function summarizeNpmFailure(result) {
+  const tail = `${result.stderr ?? ""}
+${result.stdout ?? ""}`.trim().split("\n").filter((line) => /npm (error|ERR!)|EACCES|ENOTFOUND|ETARGET|E404|engine/i.test(line)).slice(-3).join(" | ");
+  const code = result.code === null ? "npm_timeout" : `npm_exit_${result.code}`;
+  const safe = redactNpmText(tail).slice(0, 300);
+  return safe ? `${code}: ${safe}` : code;
+}
+function createHarnessInstaller(deps) {
+  const now = deps.now ?? Date.now;
+  const canWrite = deps.canWrite ?? defaultCanWrite;
+  const isPlainDirectory = deps.isPlainDirectory ?? defaultIsPlainDirectory;
+  let running = null;
+  let blocked = false;
+  const nodeVersion = deps.nodeVersion ?? process.versions.node;
+  async function installPrefix() {
+    const prefix = doctor.globalPrefixForPackage(deps.runningPackageDir);
+    if (!prefix || !await isPlainDirectory(deps.runningPackageDir)) return { error: "install_location_unverified" };
+    for (const path$1 of [path.dirname(deps.runningPackageDir), path.join(prefix, "bin")]) {
+      if (!await canWrite(path$1)) return { error: "install_location_not_writable" };
+    }
+    return { prefix };
+  }
+  async function run(harness, prefix, startedAt) {
+    const publish = (state, detail) => deps.publish({ harness, state, ...detail ? { detail } : {}, startedAt, at: now() });
+    try {
+      const args = harnessInstallArgs(harness, prefix);
+      deps.log(`[HARNESS] installing ${harness}: npm ${args.join(" ")}`);
+      const result = await deps.npm(args);
+      if (result.terminationConfirmed === false) {
+        blocked = true;
+        deps.log(`[HARNESS] ${harness} install timed out and npm could not be confirmed stopped; holding the npm tree until the daemon restarts`);
+        publish("failed", "installer_termination_unconfirmed");
+        return;
+      }
+      if (result.code !== 0) {
+        const detail = summarizeNpmFailure(result);
+        deps.log(`[HARNESS] ${harness} install failed: ${detail}`);
+        publish("failed", detail);
+        return;
+      }
+      const missing = HARNESS_INSTALL_CATALOG[harness].commands.filter((command) => !deps.commandOnPath(command));
+      if (missing.length > 0) {
+        const detail = `not_on_path: ${missing.join(", ")}`;
+        deps.log(`[HARNESS] ${harness} installed into ${prefix} but ${detail}`);
+        publish("failed", detail);
+        return;
+      }
+      await deps.afterInstall().catch((error) => deps.log(`[HARNESS] refresh after ${harness} install failed: ${String(error)}`));
+      deps.log(`[HARNESS] ${harness} installed`);
+      publish("installed");
+    } catch (error) {
+      deps.log(`[HARNESS] ${harness} install error: ${String(error)}`);
+      publish("failed", "install_error");
+    } finally {
+      if (!blocked) running = null;
+    }
+  }
+  return {
+    /** True while npm may be writing the prefix — including after an unconfirmed kill. */
+    isRunning: () => running !== null || blocked,
+    async request(params) {
+      const harness = params && typeof params === "object" ? params.harness : void 0;
+      if (!index.isHarnessInstallId(harness)) {
+        deps.log(`[HARNESS] refused install request for an unknown harness`);
+        return { error: "unknown_harness" };
+      }
+      if (blocked) return { error: "installer_blocked" };
+      if (running) return { error: "install_in_progress" };
+      if (deps.cliUpdateBusy()) return { error: "cli_update_in_progress" };
+      const minNode = HARNESS_INSTALL_CATALOG[harness].minNode;
+      if (!nodeSatisfies(nodeVersion, minNode)) {
+        deps.log(`[HARNESS] ${harness} install refused: needs Node ${minNode}+, daemon runs ${nodeVersion}`);
+        return { error: "node_too_old", required: minNode, current: nodeVersion };
+      }
+      running = harness;
+      const location = await installPrefix();
+      if ("error" in location) {
+        running = null;
+        deps.log(`[HARNESS] ${harness} install refused: ${location.error}`);
+        return location;
+      }
+      const startedAt = now();
+      deps.log(`[HARNESS] owner requested ${harness} install`);
+      deps.publish({ harness, state: "installing", startedAt, at: startedAt });
+      void run(harness, location.prefix, startedAt);
+      return { accepted: true, harness };
+    }
+  };
 }
 
 function buildPresenceBatch(live, previous) {
@@ -2805,7 +5177,7 @@ function parseJsonObject(text) {
     return null;
   }
 }
-function resolveSdkClaudeBinary(platform = process.platform, arch = process.arch, resolver = (s) => module$1.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('run-CNXwIe0A.cjs', document.baseURI).href))).resolve(s)) {
+function resolveSdkClaudeBinary(platform = process.platform, arch = process.arch, resolver = (s) => module$1.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('run-C_FumCQk.cjs', document.baseURI).href))).resolve(s)) {
   const platformArch = `${platform}-${arch}`;
   const candidates = [
     `@anthropic-ai/claude-agent-sdk-${platformArch}/claude`,
@@ -3794,6 +6166,57 @@ function withDaemonHeartbeat(state, lastHeartbeat) {
   return { ...state, lastHeartbeat };
 }
 
+const TAIL_BYTES = 64 * 1024;
+const MAX_REASON = 300;
+function extractStartupExitReason(logText) {
+  const lines = logText.split("\n");
+  for (let i = lines.length - 1; i >= 0; i--) {
+    const exit = /\[EXIT\] Exiting with code -?\d+: (.+)$/.exec(lines[i]);
+    if (exit) return clamp(exit[1]);
+  }
+  for (let i = lines.length - 1; i >= 0; i--) {
+    if (!/\[ERROR\]|\[WARN\]/.test(lines[i])) continue;
+    const detail = lines.slice(i, i + 8).join("\n");
+    const message = /message: '([^'\n]+)'/.exec(detail)?.[1];
+    const code = /code: '([A-Z0-9_]+)'/.exec(detail)?.[1];
+    const head = lines[i].replace(/^\[[\d:.]+\]\s*/, "").replace(/\s*\{\s*$/, "").trim();
+    return clamp([head, message, code].filter(Boolean).join(" "));
+  }
+  return void 0;
+}
+function describeStartupExit(exit, timeoutMs) {
+  if (exit.timedOut) {
+    const tail = exit.exited ? "and was stopped" : "and could not be confirmed stopped";
+    return `Agent process did not report its session within ${Math.round(timeoutMs / 1e3)}s ${tail}${exit.reason ? `: ${exit.reason}` : ""}`;
+  }
+  const how = exit.signal ? `signal ${exit.signal}` : `code ${exit.code ?? "unknown"}`;
+  return `Agent process exited during startup (${how}): ${exit.reason ?? "no reason found in its log"}`;
+}
+function readStartupExitReason(logsDir, pid) {
+  try {
+    const suffix = `-pid-${pid}.log`;
+    const file = node_fs.readdirSync(logsDir).filter((name) => name.endsWith(suffix)).sort().pop();
+    if (!file) return void 0;
+    const path$1 = path.join(logsDir, file);
+    const size = node_fs.statSync(path$1).size;
+    const length = Math.min(size, TAIL_BYTES);
+    const buffer = Buffer.alloc(length);
+    const fd = node_fs.openSync(path$1, "r");
+    try {
+      node_fs.readSync(fd, buffer, 0, length, size - length);
+    } finally {
+      node_fs.closeSync(fd);
+    }
+    return extractStartupExitReason(buffer.toString("utf8"));
+  } catch {
+    return void 0;
+  }
+}
+function clamp(value) {
+  const line = value.replace(/\s+/g, " ").trim();
+  return line.length > MAX_REASON ? `${line.slice(0, MAX_REASON - 1)}\u2026` : line;
+}
+
 function recoverableSessionPid(metadata, liveHappyPids) {
   const pid = metadata?.hostPid;
   return typeof pid === "number" && Number.isInteger(pid) && pid > 0 && liveHappyPids.has(pid) ? pid : null;
@@ -3835,7 +6258,10 @@ function mergeRestoreMetadata(stale, reported) {
 }
 
 function teamInitialPrompt(goal, root, directory) {
-  const role = root ? "You are the team lead. Inspect your assigned goal, arrange independent work when useful, review member results, integrate changes, and submit the final result for the user to accept. Delegate under your assigned goal using parentTaskId. You must not accept your own root goal." : "You are a team member. Inspect your assigned task and work in your assigned worktree. Delegate within your task when useful, then submit evidence for the lead to review.";
+  const role = root ? `You are the team lead. Inspect your assigned goal, arrange independent work when useful, review member results, integrate changes, and submit the final result for the user to accept. Delegate under your assigned goal using parentTaskId. You must not accept your own root goal.
+
+${resources.TEAM_LEAD_PLAYBOOK}` : `You are a team member. Inspect your assigned task and work in your assigned worktree. Delegate within your task when useful, then submit evidence for the lead to review.
+${resources.TEAM_MEMBER_RULES}`;
   return `${resources.TEAM_SKILL}
 
 ## Your role
@@ -3849,47 +6275,30 @@ Delegate from this working directory unless a different repository was explicitl
 ${goal}`;
 }
 
-function receiptPath(home, operationId) {
-  if (!/^[a-zA-Z0-9_-]{1,128}$/.test(operationId)) throw new Error("Invalid team operation id");
-  return path.join(home, "teams", "effects", `${operationId}.json`);
-}
-function readReceipt(home, id) {
-  try {
-    const value = JSON.parse(node_fs.readFileSync(receiptPath(home, id), "utf8"));
-    if (value.operationId !== id || typeof value.claimId !== "string" || !["prepared", "spawning", "spawned", "delivered", "completed"].includes(value.phase)) throw new Error("Invalid team effect receipt");
-    return value;
-  } catch (error) {
-    if (error.code === "ENOENT") return null;
-    throw error;
-  }
+const exec = node_util.promisify(node_child_process.execFile);
+const git = async (directory, args) => (await exec("git", ["-C", directory, ...args], { timeout: 3e4, maxBuffer: 2 * 1024 * 1024 })).stdout.trim();
+const gitRaw = async (directory, args) => (await exec("git", ["-C", directory, ...args], { timeout: 3e4, maxBuffer: 64 * 1024 * 1024 })).stdout;
+function expandHome$1(path$1) {
+  if (path$1 === "~") return os.homedir();
+  if (path$1.startsWith("~/") || process.platform === "win32" && path$1.startsWith("~\\")) return path.join(os.homedir(), path$1.slice(2));
+  return path$1;
 }
-function writeReceipt$1(home, receipt) {
-  configuration.ensurePrivateDirectorySync(path.join(home, "teams", "effects"));
-  const target = receiptPath(home, receipt.operationId);
-  const tmp = `${target}.${process.pid}.tmp`;
-  configuration.writePrivateFileSync(tmp, JSON.stringify(receipt));
-  const file = node_fs.openSync(tmp, "r");
-  try {
-    node_fs.fsyncSync(file);
-  } finally {
-    node_fs.closeSync(file);
-  }
-  node_fs.renameSync(tmp, target);
-  if (process.platform !== "win32") {
-    const directory = node_fs.openSync(path.join(home, "teams", "effects"), "r");
-    try {
-      node_fs.fsyncSync(directory);
-    } finally {
-      node_fs.closeSync(directory);
-    }
+async function resolveTeamRepository(home, repository, sourceOf) {
+  const worktrees = path.resolve(home, "teams", "worktrees");
+  let candidate = expandHome$1(repository);
+  for (let hop = 0; hop < 8; hop++) {
+    if (!path.isAbsolute(candidate)) break;
+    const teamWorktree = path.resolve(path.dirname(candidate)) === worktrees;
+    const top = await git(candidate, ["rev-parse", "--show-toplevel"]).catch(() => null);
+    if (top !== null && (!teamWorktree || path.resolve(top) === path.resolve(candidate))) return candidate;
+    const source = teamWorktree ? sourceOf(path.basename(candidate)) : void 0;
+    if (!source) break;
+    candidate = expandHome$1(source);
   }
+  throw new Error(`Team repository is unavailable: ${repository} is missing or not a Git checkout. Restore the folder or delegate with an existing repository, then choose Retry launch.`);
 }
-
-const exec = node_util.promisify(node_child_process.execFile);
-const git = async (directory, args) => (await exec("git", ["-C", directory, ...args], { timeout: 3e4, maxBuffer: 2 * 1024 * 1024 })).stdout.trim();
 async function prepareTeamWorktree(home, repository, id, origin = "teams") {
-  if (repository === "~") repository = os.homedir();
-  else if (repository.startsWith("~/") || process.platform === "win32" && repository.startsWith("~\\")) repository = path.join(os.homedir(), repository.slice(2));
+  repository = expandHome$1(repository);
   if (!path.isAbsolute(repository) || !/^[a-zA-Z0-9_-]{1,128}$/.test(id)) throw new Error("A team task requires an absolute repository path and valid operation id");
   await git(repository, ["rev-parse", "--show-toplevel"]);
   const root = path.join(home, "teams", "worktrees");
@@ -3908,28 +6317,69 @@ async function prepareTeamWorktree(home, repository, id, origin = "teams") {
   }
   return { directory, repository, branch };
 }
+async function unpreservedCommits(directory, repository, rev) {
+  const sourceHead = await git(repository, ["rev-parse", "HEAD"]).catch(() => "");
+  const pending = (await git(directory, ["rev-list", rev, "--not", "--remotes", ...sourceHead ? [sourceHead] : []])).split("\n").filter(Boolean);
+  if (pending.length === 0) return 0;
+  return await squashMerged(directory, rev) ? 0 : pending.length;
+}
+async function squashMerged(directory, rev) {
+  const target = await git(directory, ["rev-parse", "--abbrev-ref", "refs/remotes/origin/HEAD"]).catch(() => "") || await git(directory, ["rev-parse", "--verify", "--quiet", "refs/remotes/origin/main"]).then(() => "origin/main", () => "");
+  if (!target) return false;
+  const base = await git(directory, ["merge-base", rev, target]).catch(() => "");
+  if (!base) return false;
+  const own = patchIds(await gitRaw(directory, ["diff", base, rev]).then((diff) => diff ? patchIdOf(directory, diff) : "", () => ""));
+  if (own.length !== 1) return false;
+  const merged = patchIds(await gitRaw(directory, ["log", "-p", "--no-merges", "--max-count=500", `${base}..${target}`]).then((log) => log ? patchIdOf(directory, log) : "", () => ""));
+  return merged.includes(own[0]);
+}
+async function patchIdOf(directory, patch) {
+  return await new Promise((resolvePatch, reject) => {
+    const child = node_child_process.execFile("git", ["-C", directory, "patch-id", "--stable"], { timeout: 3e4, maxBuffer: 2 * 1024 * 1024 }, (error, stdout) => error ? reject(error) : resolvePatch(stdout));
+    child.stdin?.end(patch);
+  });
+}
+const patchIds = (output) => output.split("\n").filter(Boolean).map((line) => line.split(" ")[0]);
+async function registeredWorktree(repository, directory) {
+  const list = await git(repository, ["worktree", "list", "--porcelain"]).catch(() => "");
+  return list.split("\n").some((line) => line.startsWith("worktree ") && path.resolve(line.slice("worktree ".length)) === path.resolve(directory));
+}
+const describeHead = async (directory) => await git(directory, ["symbolic-ref", "--short", "-q", "HEAD"]).catch(() => "") || "a detached HEAD";
 async function removeTeamWorktree(resource) {
   const { directory, repository, branch } = resource;
   if (!directory || !repository || !branch) return;
-  if (node_fs.existsSync(directory)) {
-    if (await git(directory, ["symbolic-ref", "--short", "HEAD"]) !== branch) throw new Error("Worktree branch changed; preserve for manual reconciliation");
+  let present = node_fs.existsSync(directory);
+  if (present) {
+    const top = await git(directory, ["rev-parse", "--show-toplevel"]).catch(() => "");
+    if (!top || path.resolve(top) !== path.resolve(directory)) {
+      if (await registeredWorktree(repository, directory)) throw new Error(`${directory} is registered as a worktree but its git link is broken; inspect it, then mark this cleanup as handled`);
+      if (node_fs.readdirSync(directory).length === 0) node_fs.rmdirSync(directory);
+      present = false;
+    }
+  }
+  if (present) {
     const actualCommon = await git(directory, ["rev-parse", "--path-format=absolute", "--git-common-dir"]);
     const expectedCommon = await git(repository, ["rev-parse", "--path-format=absolute", "--git-common-dir"]);
     if (path.resolve(actualCommon) !== path.resolve(expectedCommon)) throw new Error("Worktree repository changed; preserve for manual reconciliation");
-    if (await git(directory, ["status", "--porcelain"])) throw new Error(`Uncommitted work retained at ${directory}`);
-    await git(repository, ["merge-base", "--is-ancestor", branch, "HEAD"]).catch(() => {
-      throw new Error(`Unmerged work retained on ${branch} at ${directory}`);
-    });
-    await git(repository, ["worktree", "remove", directory]);
+    const dirty = (await git(directory, ["status", "--porcelain"])).split("\n").filter(Boolean).length;
+    if (dirty) throw new Error(`Uncommitted work retained at ${directory} (${dirty} changed file${dirty === 1 ? "" : "s"}): commit and push it, or discard it, then retry cleanup`);
+    const head = await describeHead(directory);
+    const unsafe = await unpreservedCommits(directory, repository, "HEAD");
+    if (unsafe) throw new Error(`Unmerged work retained on ${head} at ${directory}: ${unsafe} commit${unsafe === 1 ? " is" : "s are"} not pushed or merged; push or merge, then retry cleanup`);
   }
-  try {
-    await git(repository, ["show-ref", "--verify", `refs/heads/${branch}`]);
-  } catch {
-    return;
+  const ownBranch = await git(repository, ["show-ref", "--verify", "--quiet", `refs/heads/${branch}`]).then(() => true, () => false);
+  if (ownBranch) {
+    const unsafe = await unpreservedCommits(repository, repository, `refs/heads/${branch}`);
+    if (unsafe) throw new Error(`Unmerged work retained on ${branch}: ${unsafe} commit${unsafe === 1 ? " is" : "s are"} not pushed or merged; push or merge, then retry cleanup`);
   }
-  await git(repository, ["branch", "-d", branch]);
+  if (present) await git(repository, ["worktree", "remove", directory]);
+  else await git(repository, ["worktree", "prune"]).catch(() => void 0);
+  if (ownBranch) await git(repository, ["branch", "-D", branch]);
 }
 
+function persistedSpawnMatches(operationId) {
+  return Object.entries(persistence.readPersistedSessions()).filter(([, entry]) => entry.metadata?.teamOperationId === operationId);
+}
 function createTeamWorker(deps) {
   const home = deps.home ?? configuration.configuration.happyHomeDir;
   const server = deps.serverUrl ?? configuration.configuration.serverUrl;
@@ -3963,6 +6413,12 @@ function createTeamWorker(deps) {
     if (receipt.phase === "completed") return;
     try {
       if (op.type === "spawn") {
+        if (machineMetadata.ownerRetryPending(op, receipt) && (receipt.phase === "prepared" || receipt.phase === "spawning" && persistedSpawnMatches(op.id).length === 0)) {
+          receipt = machineMetadata.consumeOwnerRetry(op, receipt);
+          writeReceipt$1(home, receipt);
+          deps.log(`Teams operation ${op.id} relaunch requested by owner`);
+        }
+        if (receipt.phase === "prepared" && machineMetadata.spawnGate(receipt, Date.now()) !== "run") return;
         if (receipt.phase === "prepared") {
           if (!credential) credential = (await action(op.teamId, `claim-${op.id}`, { type: "claim-operation", operationId: op.id, machineId: deps.machineId, ...op.teamLaunchVersion === 1 ? { teamLaunchVersion: 1 } : {} })).credential;
           if (!credential) throw new Error("No scoped credential for worker");
@@ -3975,7 +6431,26 @@ function createTeamWorker(deps) {
             return;
           }
           if (!op.directory) throw new Error("No repository selected for worker");
-          const resource = await prepareTeamWorktree(home, op.directory, op.id);
+          let resource;
+          try {
+            const repository = await resolveTeamRepository(home, op.directory, (id) => {
+              try {
+                return readReceipt(home, id)?.repository;
+              } catch {
+                return void 0;
+              }
+            });
+            resource = await prepareTeamWorktree(home, repository, op.id);
+          } catch (error) {
+            const now = Date.now();
+            receipt = machineMetadata.afterStartupFailure(receipt, now);
+            writeReceipt$1(home, receipt);
+            const detail = error instanceof Error ? error.message : "Team worktree could not be prepared";
+            await action(op.teamId, `preflight-failure-${op.id}-${receipt.retryConsumed ?? 0}-${receipt.spawnFailures}`, { type: "fail-operation", operationId: op.id, machineId: deps.machineId, claimId: receipt.claimId, error: machineMetadata.startupFailureMessage(detail, receipt, now).slice(0, 1e3) }).catch(() => {
+            });
+            deps.log(`Teams operation ${op.id} preflight failed (${receipt.spawnFailures}/${machineMetadata.TEAM_SPAWN_MAX_ATTEMPTS})`);
+            return;
+          }
           const scopes = path.join(home, "teams", "scopes");
           configuration.ensurePrivateDirectorySync(scopes);
           const scopeFile = path.join(scopes, `${op.id}.json`);
@@ -3983,12 +6458,21 @@ function createTeamWorker(deps) {
           receipt = { ...receipt, ...resource, scopeFile, phase: "spawning" };
           writeReceipt$1(home, receipt);
           const spawned = await deps.spawn({ directory: resource.directory, agent: op.assistant === "pi-acp" ? "pi" : op.assistant, permissionMode: op.permissionMode === "bypassPermissions" ? "bypassPermissions" : "default", spawnedBy: "teams", environmentVariables: { VH_TEAM_SCOPE_FILE: scopeFile, VH_TEAM_OPERATION_ID: op.id } });
+          if (spawned.type === "error" && spawned.startupExit?.exited) {
+            const now = Date.now();
+            receipt = machineMetadata.afterStartupFailure(receipt, now);
+            writeReceipt$1(home, receipt);
+            await action(op.teamId, `startup-failure-${op.id}-${receipt.retryConsumed ?? 0}-${receipt.spawnFailures}`, { type: "fail-operation", operationId: op.id, machineId: deps.machineId, claimId: receipt.claimId, error: machineMetadata.startupFailureMessage(spawned.errorMessage, receipt, now).slice(0, 1e3) }).catch(() => {
+            });
+            deps.log(`Teams operation ${op.id} startup failed (${receipt.spawnFailures}/${machineMetadata.TEAM_SPAWN_MAX_ATTEMPTS}); ${receipt.retryAt !== void 0 ? "will relaunch" : "waiting for owner retry"}`);
+            return;
+          }
           if (spawned.type !== "success") throw new Error(spawned.type === "error" ? spawned.errorMessage : "Directory approval required");
           receipt = { ...receipt, sessionId: spawned.sessionId, phase: "spawned" };
           writeReceipt$1(home, receipt);
         }
         if (receipt.phase === "spawning") {
-          const matches = Object.entries(persistence.readPersistedSessions()).filter(([, entry]) => entry.metadata?.teamOperationId === op.id);
+          const matches = persistedSpawnMatches(op.id);
           if (matches.length !== 1) throw new Error("Spawn outcome unknown; reconcile the worker before retrying");
           receipt = { ...receipt, sessionId: matches[0][0], phase: "spawned" };
           writeReceipt$1(home, receipt);
@@ -4010,6 +6494,12 @@ function createTeamWorker(deps) {
         }
         await complete(op, receipt);
       } else {
+        if (machineMetadata.ownerRetryPending(op, receipt)) {
+          const { retryAt: _retryAt, ...rest } = receipt;
+          receipt = { ...rest, retryConsumed: op.retryRequestedAt };
+          writeReceipt$1(home, receipt);
+          deps.log(`Teams operation ${op.id} cleanup retry requested by owner`);
+        } else if (receipt.retryAt !== void 0 && Date.now() < receipt.retryAt) return;
         const team = (await http.get(`/v1/teams/${encodeURIComponent(op.teamId)}`)).data.team;
         const latest = team.operations.find((candidate) => candidate.id === op.id);
         if (latest?.status === "completed") {
@@ -4036,7 +6526,14 @@ function createTeamWorker(deps) {
     } catch (error) {
       const unknown = op.type === "spawn" && receipt.phase === "spawning";
       const detail = error instanceof Error ? error.message : "Team operation failed";
-      await action(op.teamId, `failure-${op.id}-${receipt.phase}`, { type: "fail-operation", operationId: op.id, machineId: deps.machineId, claimId: receipt.claimId, error: detail.slice(0, 1e3), unknown }).catch(() => {
+      if (op.type === "stop") {
+        receipt = { ...receipt, retryAt: Date.now() + machineMetadata.TEAM_CLEANUP_RETRY_MS };
+        try {
+          writeReceipt$1(home, receipt);
+        } catch {
+        }
+      }
+      await action(op.teamId, `failure-${op.id}-${receipt.phase}-${node_crypto.createHash("sha256").update(detail).digest("hex").slice(0, 12)}`, { type: "fail-operation", operationId: op.id, machineId: deps.machineId, claimId: receipt.claimId, error: detail.slice(0, 1e3), unknown }).catch(() => {
       });
       deps.log(`Teams operation ${op.id} ${unknown ? "needs reconciliation" : "will retry"}`);
     }
@@ -4135,7 +6632,19 @@ Use the teams tools to inspect current task state before acting. This message is
   }, 5e3);
   timer.unref();
   void tick();
-  return { tick, report, hasSession: (id) => knownSessionIds.has(id), get busy() {
+  async function recoverScope(operationId, sessionId, scopeFile) {
+    const teams = (await http.get("/v1/teams")).data.teams ?? [];
+    const team = teams.find((candidate) => candidate.archivedAt === void 0 && candidate.operations.some((op2) => op2.id === operationId));
+    const op = team?.operations.find((candidate) => candidate.id === operationId);
+    if (!team || !op || op.type !== "spawn" || op.machineId !== deps.machineId) throw new Error("No live team launch for this session");
+    const bot = team.bots.find((candidate) => candidate.id === op.botId);
+    if (!bot || bot.sessionId !== sessionId || bot.generation !== op.generation) throw new Error("Team binding changed; not restoring its scope");
+    const claimed = await action(op.teamId, `claim-${op.id}`, { type: "claim-operation", operationId: op.id, machineId: deps.machineId, ...op.teamLaunchVersion === 1 ? { teamLaunchVersion: 1 } : {} });
+    if (!claimed.credential?.token || claimed.credential.botId !== op.botId) throw new Error("Team did not reissue the member credential");
+    configuration.ensurePrivateDirectorySync(path.join(home, "teams", "scopes"));
+    configuration.writePrivateFileSync(scopeFile, JSON.stringify({ serverUrl: server, scopeToken: claimed.credential.token, teamId: op.teamId, botId: op.botId, taskId: op.taskId, attemptId: op.attemptId }));
+  }
+  return { tick, report, recoverScope, hasSession: (id) => knownSessionIds.has(id), get busy() {
     return running;
   }, stop: () => {
     closed = true;
@@ -4864,7 +7373,7 @@ function sanitizeImportTitle(value) {
   return collapsed.length > 200 ? `${collapsed.slice(0, 199)}\u2026` : collapsed;
 }
 async function preflightNewBundle(bundlePath) {
-  const home = fs$1.mkdtempSync(path$2.join(os.tmpdir(), "vh-preflight-"));
+  const home = require$$0.mkdtempSync(require$$1.join(os.tmpdir(), "vh-preflight-"));
   try {
     return await new Promise((resolve) => {
       let stdout = "";
@@ -4905,12 +7414,13 @@ async function preflightNewBundle(bundlePath) {
     });
   } finally {
     try {
-      fs$1.rmSync(home, { recursive: true, force: true });
+      require$$0.rmSync(home, { recursive: true, force: true });
     } catch {
     }
   }
 }
 const HANDOVER_PREFLIGHT_TIMEOUT_MS = 3e4;
+const SPAWN_WEBHOOK_TIMEOUT_MS = 15e3;
 async function startDaemon() {
   const initialMachineMetadata = machineMetadata.getInitialMachineMetadata();
   const startupCliAvailability = machineMetadata.getStartupCliAvailability();
@@ -5294,7 +7804,7 @@ async function startDaemon() {
         if (options.token) {
           if (options.agent === "codex") {
             const codexHomeDir = tmp__namespace.dirSync();
-            await fs.writeFile(path$2.join(codexHomeDir.name, "auth.json"), options.token);
+            await fs.writeFile(require$$1.join(codexHomeDir.name, "auth.json"), options.token);
             authEnv.CODEX_HOME = codexHomeDir.name;
           } else {
             authEnv.CLAUDE_CODE_OAUTH_TOKEN = options.token;
@@ -5377,7 +7887,7 @@ async function startDaemon() {
           const sessionDesc = tmuxSessionName || "current/most recent session";
           logger.logger.debug(`[DAEMON RUN] Attempting to spawn session in tmux: ${sessionDesc}`);
           const tmux = getTmuxUtilities(tmuxSessionName);
-          const cliPath = path$2.join(projectPath.projectPath(), "dist", "index.mjs");
+          const cliPath = require$$1.join(projectPath.projectPath(), "dist", "index.mjs");
           const agent = options.agent ?? "claude";
           if (!spawnAgents.isSpawnAgent(agent)) {
             return {
@@ -5567,22 +8077,33 @@ async function startDaemon() {
       });
       logger.logger.debug(`[DAEMON RUN] Waiting for session webhook for PID ${happyProcess.pid}`);
       return new Promise((resolve) => {
+        const pid = happyProcess.pid;
+        let settled = false;
+        const fail = (startupExit) => {
+          if (settled) return;
+          settled = true;
+          clearTimeout(timeout);
+          pidToAwaiter.delete(pid);
+          startupExit.reason ??= readStartupExitReason(configuration.configuration.logsDir, pid);
+          const errorMessage = describeStartupExit(startupExit, SPAWN_WEBHOOK_TIMEOUT_MS);
+          logger.logger.debug(`[DAEMON RUN] Spawn of PID ${pid} failed: ${errorMessage}`);
+          resolve({ type: "error", errorMessage, startupExit });
+        };
+        happyProcess.once("exit", (code, signal) => fail({ exited: true, code, signal }));
         const timeout = setTimeout(() => {
-          pidToAwaiter.delete(happyProcess.pid);
-          logger.logger.debug(`[DAEMON RUN] Session webhook timeout for PID ${happyProcess.pid}`);
-          if (happyProcess.pid) {
-            try {
-              sessionLock.terminateProcess(happyProcess.pid, () => {
-              });
-            } catch {
-            }
+          if (settled) return;
+          pidToAwaiter.delete(pid);
+          logger.logger.debug(`[DAEMON RUN] Session webhook timeout for PID ${pid}`);
+          try {
+            const started = sessionLock.terminateProcess(pid, (stopped) => fail({ exited: stopped, code: null, signal: null, timedOut: true }));
+            if (!started) fail({ exited: false, code: null, signal: null, timedOut: true });
+          } catch {
+            fail({ exited: false, code: null, signal: null, timedOut: true });
           }
-          resolve({
-            type: "error",
-            errorMessage: `Session webhook timeout for PID ${happyProcess.pid}`
-          });
-        }, 15e3);
-        pidToAwaiter.set(happyProcess.pid, (completedSession) => {
+        }, SPAWN_WEBHOOK_TIMEOUT_MS);
+        pidToAwaiter.set(pid, (completedSession) => {
+          if (settled) return;
+          settled = true;
           clearTimeout(timeout);
           logger.logger.debug(`[DAEMON RUN] Session ${completedSession.happySessionId} fully spawned with webhook`);
           resolve({
@@ -5643,6 +8164,13 @@ async function startDaemon() {
       }
     };
     const resumeGates = /* @__PURE__ */ new Map();
+    const teamRelaunchEnvFor = (happySessionId, metadata) => teamRelaunchEnv({
+      home: configuration.configuration.happyHomeDir,
+      sessionId: happySessionId,
+      metadata,
+      recover: teamWorker ? (operationId, scopeFile) => teamWorker.recoverScope(operationId, happySessionId, scopeFile) : void 0,
+      log: (message) => logger.logger.debug(`[DAEMON RUN] ${message}`)
+    });
     const resumeSession = async (happySessionId, options) => {
       let gate = resumeGates.get(happySessionId);
       if (!gate) {
@@ -5700,15 +8228,15 @@ async function startDaemon() {
         tracked.happySessionMetadataFromLocalWebhook = metadata;
         logger.logger.debug(`[DAEMON RUN] Session ${happySessionId} relaunch metadata from ${relaunch.source}`);
         const precheck = resumePrecheck(metadata, {
-          cwdExists: (p) => fs$1.existsSync(p),
+          cwdExists: (p) => require$$0.existsSync(p),
           // B-478: also looks in every other Claude config dir the user's shell
           // or settings point at, not just the one the daemon was started with.
           conversationExists: (cwd, claudeSessionId) => index$1.locateClaudeConversation(cwd, claudeSessionId) !== null
         });
         let freshConversation = false;
         if (!precheck.ok) {
-          if (precheck.reason === "conversation-missing") {
-            logger.logger.debug(`[DAEMON RUN] resume: transcript for ${happySessionId} is gone (${precheck.detail}); starting a fresh conversation in ${metadata.path}`);
+          if (resumeStartsFreshConversation(precheck.reason)) {
+            logger.logger.debug(`[DAEMON RUN] resume: ${precheck.reason} for ${happySessionId} (${precheck.detail}); starting a fresh conversation in ${metadata.path}`);
             freshConversation = true;
           } else {
             return { type: "error", errorMessage: `resume-precheck:${precheck.reason}: ${precheck.detail}` };
@@ -5721,12 +8249,15 @@ async function startDaemon() {
         const model = sanitizeResumeModel(options?.model);
         if (model) launch.args.push("--model", model);
         else if (options?.model !== void 0) logger.logger.debug(`[DAEMON RUN] resume: ignoring invalid model ${JSON.stringify(options.model)}`);
-        const permissionMode = spawnAgents.sanitizeSpawnPermissionMode(options?.permissionMode);
+        const requestedMode = options?.permissionMode ?? (options?.keepPublishedPermissionMode ? publishedRelaunchPermissionMode(metadata) : void 0);
+        const permissionMode = spawnAgents.sanitizeSpawnPermissionMode(requestedMode);
         if (permissionMode) launch.args.push("--permission-mode", permissionMode);
-        else if (options?.permissionMode !== void 0) logger.logger.debug(`[DAEMON RUN] resume: ignoring invalid permission mode ${JSON.stringify(options.permissionMode)}`);
+        else if (requestedMode !== void 0) logger.logger.debug(`[DAEMON RUN] resume: ignoring invalid permission mode ${JSON.stringify(requestedMode)}`);
+        const teamEnv = await teamRelaunchEnvFor(happySessionId, metadata);
         const result = await spawnTrackedHappyProcess({
           args: launch.args,
           cwd: launch.cwd,
+          ...teamEnv.VH_TEAM_SCOPE_FILE ? { spawnedBy: "teams" } : {},
           env: {
             ...process.env,
             // B-297: the credentialStore=file shim must ride every spawn path,
@@ -5742,7 +8273,8 @@ async function startDaemon() {
             HAPPY_RECONNECT_ENCRYPTION_VARIANT: tracked.encryption.encryptionVariant,
             HAPPY_RECONNECT_SEQ: String(tracked.encryption.seq),
             HAPPY_RECONNECT_METADATA_VERSION: String(tracked.encryption.metadataVersion),
-            HAPPY_RECONNECT_AGENT_STATE_VERSION: String(tracked.encryption.agentStateVersion)
+            HAPPY_RECONNECT_AGENT_STATE_VERSION: String(tracked.encryption.agentStateVersion),
+            ...teamEnv
           }
         });
         if (result.type === "success") {
@@ -5832,7 +8364,7 @@ async function startDaemon() {
         tracked.happySessionMetadataFromLocalWebhook = metadata;
         logger.logger.debug(`[DAEMON RUN] Session ${happySessionId} relaunch metadata from ${relaunch.source}`);
         const precheck = resumePrecheck(metadata, {
-          cwdExists: (p) => fs$1.existsSync(p),
+          cwdExists: (p) => require$$0.existsSync(p),
           // B-478: also looks in every other Claude config dir the user's shell
           // or settings point at, not just the one the daemon was started with.
           conversationExists: (cwd2, claudeSessionId) => index$1.locateClaudeConversation(cwd2, claudeSessionId) !== null
@@ -5848,7 +8380,7 @@ async function startDaemon() {
           cwd = launch.cwd;
         } else if ((metadata.flavor ?? "claude") === "claude" && typeof metadata.path === "string" && metadata.path.length > 0) {
           cwd = metadata.path;
-          if (!fs$1.existsSync(cwd)) {
+          if (!require$$0.existsSync(cwd)) {
             return { type: "error", errorMessage: `restart-precheck:cwd-missing: ${cwd}` };
           }
           args = ["claude", "--happy-starting-mode", "remote", "--started-by", "daemon"];
@@ -5860,9 +8392,11 @@ async function startDaemon() {
         const permissionMode = spawnAgents.sanitizeSpawnPermissionMode(options?.permissionMode);
         if (permissionMode) args.push("--permission-mode", permissionMode);
         restartCounts.set(happySessionId, recordRestartAttempt(prior));
+        const teamEnv = await teamRelaunchEnvFor(happySessionId, metadata);
         const result = await spawnTrackedHappyProcess({
           args,
           cwd,
+          ...teamEnv.VH_TEAM_SCOPE_FILE ? { spawnedBy: "teams" } : {},
           env: {
             ...process.env,
             // B-297: the credentialStore=file shim must ride every spawn path,
@@ -5877,7 +8411,8 @@ async function startDaemon() {
             HAPPY_RECONNECT_ENCRYPTION_VARIANT: tracked.encryption.encryptionVariant,
             HAPPY_RECONNECT_SEQ: String(tracked.encryption.seq),
             HAPPY_RECONNECT_METADATA_VERSION: String(tracked.encryption.metadataVersion),
-            HAPPY_RECONNECT_AGENT_STATE_VERSION: String(tracked.encryption.agentStateVersion)
+            HAPPY_RECONNECT_AGENT_STATE_VERSION: String(tracked.encryption.agentStateVersion),
+            ...teamEnv
           }
         });
         if (result.type === "success") {
@@ -6073,10 +8608,10 @@ async function startDaemon() {
     };
     persistence.writeDaemonState(fileState);
     logger.logger.debug("[DAEMON RUN] Daemon state written");
-    const bundlePath = path$2.join(projectPath.projectPath(), "dist", "index.mjs");
+    const bundlePath = require$$1.join(projectPath.projectPath(), "dist", "index.mjs");
     let initialBundleMtimeMs = 0;
     try {
-      initialBundleMtimeMs = fs$1.statSync(bundlePath).mtimeMs;
+      initialBundleMtimeMs = require$$0.statSync(bundlePath).mtimeMs;
     } catch {
       logger.logger.debug(`[DAEMON RUN] Bundle at ${bundlePath} not found; self-restart on upgrade disabled`);
     }
@@ -6150,6 +8685,15 @@ async function startDaemon() {
       setStore: (store) => claudeAuthService.setStore(store)
     });
     claudeAuthService.start();
+    apiMachine.setModelConfigService(new ModelConfigService({
+      home: os$1.homedir(),
+      env: process.env,
+      happyHomeDir: configuration.configuration.happyHomeDir,
+      isInstalled: detectCLI.commandOnPath,
+      onChanged: (harness) => {
+        if (harness === "claude") void claudeAuthService.probe("model-config", true);
+      }
+    }));
     apiMachine.setAgentHibernationHandlers(persistence.resolveIdleMs(agentHibernationSetting), async (requested) => {
       const value = requested <= 0 ? 0 : persistence.settingIdleMs(requested);
       await persistence.updateSettings((current) => ({ ...current, agentHibernationIdleMs: value }));
@@ -6171,6 +8715,8 @@ async function startDaemon() {
       })).then(() => logger.logger.debug(`[DAEMON RUN] claimed the machine record for host ${initialMachineMetadata.host}`)).catch((error) => logger.logger.debug("[DAEMON RUN] could not refresh the recorded host:", error));
     }
     let lastUpdateLog = "";
+    let harnessInstaller = null;
+    let handoverInFlight = false;
     const updateController = createUpdateController({
       policy: () => cliUpdate.fetchCliUpdateState(configuration.configuration.serverUrl, _package.packageJson.version),
       enabled: async () => ((await persistence.readSettings()).cliAutoUpdate ?? "idle") !== "off",
@@ -6178,8 +8724,9 @@ async function startDaemon() {
       // handover (they talk to the server themselves) and web terminals live
       // in tmux, so neither is a reason to hold an update. B-507: a session
       // whose turn ended but still has background tasks is busy too.
-      idle: () => !turnActivity.hasActiveTurn() && !backgroundTasks.hasAny(),
+      idle: () => !turnActivity.hasActiveTurn() && !backgroundTasks.hasAny() && !harnessInstaller?.isRunning(),
       install: installCliSafely,
+      lastInstall: lastInstallStore(configuration.configuration.happyHomeDir),
       publish: (state) => {
         cliUpdateStateRef = state;
         fileState = { ...fileState, cliUpdate: state };
@@ -6226,10 +8773,33 @@ async function startDaemon() {
       logger.logger.warn(`[DAEMON RUN] Ignoring invalid HAPPY_CLI_UPDATE_CHECK_INTERVAL; using ${cliUpdate.DEFAULT_CLI_UPDATE_CHECK_INTERVAL_MS}ms`);
     }
     const cliUpdateInterval = setInterval(() => void refreshCliUpdate(), cliUpdateIntervalMs);
+    const policyAnnouncements = createPolicyAnnouncementHandler({
+      refresh: refreshCliUpdate,
+      currentTarget: updateController.currentTarget
+    });
+    apiMachine.setCliUpdatePolicyHandler((payload) => {
+      const delay = policyAnnouncements.onAnnouncement(payload);
+      if (delay !== null) logger.logger.warn(`[DAEMON RUN] CLI update policy announced; re-checking in ${Math.round(delay / 1e3)}s`);
+    });
     const stopAgentVersionChecks = mirrorProtocol.startAgentVersionChecks(
       (snapshot) => apiMachine.updateDaemonState((state) => ({ ...state, status: state?.status ?? "running", agentVersions: snapshot })),
       (error) => logger.logger.debug("[DAEMON RUN] Agent version check failed", error)
     );
+    harnessInstaller = createHarnessInstaller({
+      npm: runNpm,
+      runningPackageDir: projectPath.projectPath(),
+      commandOnPath: detectCLI.commandOnPath,
+      cliUpdateBusy: () => updateController.isRunning() || handoverInFlight,
+      publish: (state) => {
+        void apiMachine.updateDaemonState((current) => ({ ...current, status: current?.status ?? "running", harnessInstall: state })).catch((error) => logger.logger.debug("[DAEMON RUN] harness install state publish failed", error));
+      },
+      afterInstall: async () => {
+        apiMachine.recheckCliAvailability();
+        await stopAgentVersionChecks.refresh();
+      },
+      log: (message) => logger.logger.warn(`[DAEMON RUN] ${message}`)
+    });
+    apiMachine.setHarnessInstallHandler((params) => harnessInstaller.request(params));
     const heartbeatIntervalMs = parseInt(process.env.HAPPY_DAEMON_HEARTBEAT_INTERVAL || "60000");
     const restartOnStaleVersionAndHeartbeat = setInterval(serialTask(async () => {
       try {
@@ -6246,53 +8816,59 @@ async function startDaemon() {
         }
         await updateController.tick();
         await updateController.withHandover(async () => {
-          let bundleReplaced = false;
-          if (initialBundleMtimeMs > 0) {
-            try {
-              const currentMtimeMs = fs$1.statSync(bundlePath).mtimeMs;
-              bundleReplaced = currentMtimeMs !== initialBundleMtimeMs;
-            } catch {
-            }
-          }
-          const relayMove = pendingRelayMove;
-          if ((bundleReplaced || relayMove) && !teamWorker?.busy && !automationRunner?.busy && !updateController.isRunning() && !turnActivity.hasActiveTurn() && !backgroundTasks.hasAny()) {
-            const preflight = bundleReplaced ? await preflightNewBundle(bundlePath) : { action: "proceed" };
-            if (preflight.action === "hold") {
-              if (lastHandoverHold !== preflight.reason) {
-                lastHandoverHold = preflight.reason;
-                logger.logger.warn(`[DAEMON RUN] holding handover: ${preflight.reason}`);
+          handoverInFlight = true;
+          try {
+            let bundleReplaced = false;
+            if (initialBundleMtimeMs > 0) {
+              try {
+                const currentMtimeMs = require$$0.statSync(bundlePath).mtimeMs;
+                bundleReplaced = currentMtimeMs !== initialBundleMtimeMs;
+              } catch {
               }
-              updateController.holdHandover(preflight.reason);
-              return;
             }
-            if (teamWorker?.busy || automationRunner?.busy || updateController.isRunning() || turnActivity.hasActiveTurn() || backgroundTasks.hasAny()) return;
-            lastHandoverHold = null;
-            logger.logger.debug(relayMove ? `[DAEMON RUN] Relay moved to ${relayMove.serverUrl}; handing off to a new daemon on the new settings` : "[DAEMON RUN] Daemon bundle replaced on disk and verified, handing off to new daemon");
-            teamWorker?.stop();
-            automationRunner?.stop();
-            projectPresence?.stop();
-            clearInterval(restartOnStaleVersionAndHeartbeat);
-            clearInterval(cliUpdateInterval);
-            stopAgentVersionChecks();
-            claudeAuthService.stop();
-            apiMachine.shutdown();
-            await stopControlServer();
-            await controlClient.cleanupDaemonState();
-            await persistence.releaseDaemonLock(daemonLockHandle);
-            await stopCaffeinate();
-            if (daemonSupervisor$1 === "systemd") {
-              logger.logger.debug(`[DAEMON RUN] systemd-supervised: exiting ${HANDOVER_EXIT_CODE} for the unit to restart on the new bundle`);
-              process.exit(HANDOVER_EXIT_CODE);
-            }
-            try {
-              spawnHappyCLI.spawnHappyCLI(["daemon", "start"], {
-                detached: true,
-                stdio: "ignore"
-              });
-            } catch (error) {
-              logger.logger.debug("[DAEMON RUN] Failed to spawn new daemon, this is quite likely to happen during integration tests as we are cleaning out dist/ directory", error);
+            const relayMove = pendingRelayMove;
+            if ((bundleReplaced || relayMove) && !teamWorker?.busy && !automationRunner?.busy && !updateController.isRunning() && !harnessInstaller?.isRunning() && !turnActivity.hasActiveTurn() && !backgroundTasks.hasAny()) {
+              const preflight = bundleReplaced ? await preflightNewBundle(bundlePath) : { action: "proceed" };
+              if (preflight.action === "hold") {
+                if (lastHandoverHold !== preflight.reason) {
+                  lastHandoverHold = preflight.reason;
+                  logger.logger.warn(`[DAEMON RUN] holding handover: ${preflight.reason}`);
+                }
+                updateController.holdHandover(preflight.reason);
+                return;
+              }
+              if (teamWorker?.busy || automationRunner?.busy || updateController.isRunning() || harnessInstaller?.isRunning() || turnActivity.hasActiveTurn() || backgroundTasks.hasAny()) return;
+              lastHandoverHold = null;
+              logger.logger.debug(relayMove ? `[DAEMON RUN] Relay moved to ${relayMove.serverUrl}; handing off to a new daemon on the new settings` : "[DAEMON RUN] Daemon bundle replaced on disk and verified, handing off to new daemon");
+              teamWorker?.stop();
+              automationRunner?.stop();
+              projectPresence?.stop();
+              clearInterval(restartOnStaleVersionAndHeartbeat);
+              clearInterval(cliUpdateInterval);
+              policyAnnouncements.stop();
+              stopAgentVersionChecks();
+              claudeAuthService.stop();
+              apiMachine.shutdown();
+              await stopControlServer();
+              await controlClient.cleanupDaemonState();
+              await persistence.releaseDaemonLock(daemonLockHandle);
+              await stopCaffeinate();
+              if (daemonSupervisor$1 === "systemd") {
+                logger.logger.debug(`[DAEMON RUN] systemd-supervised: exiting ${HANDOVER_EXIT_CODE} for the unit to restart on the new bundle`);
+                process.exit(HANDOVER_EXIT_CODE);
+              }
+              try {
+                spawnHappyCLI.spawnHappyCLI(["daemon", "start"], {
+                  detached: true,
+                  stdio: "ignore"
+                });
+              } catch (error) {
+                logger.logger.debug("[DAEMON RUN] Failed to spawn new daemon, this is quite likely to happen during integration tests as we are cleaning out dist/ directory", error);
+              }
+              process.exit(0);
             }
-            process.exit(0);
+          } finally {
+            handoverInFlight = false;
           }
         });
         const daemonState = await persistence.readDaemonState();
@@ -6340,7 +8916,7 @@ async function startDaemon() {
         return !!record && typeof record.hibernatedAt === "number" && record.hibernatedAt >= record.savedAt;
       },
       wakeHibernated: async (id) => {
-        const result = await resumeSession(id);
+        const result = await resumeSession(id, { keepPublishedPermissionMode: true });
         if (result.type !== "success") return false;
         return waitForSessionLive(id, (sid) => [...pidToTrackedSession.values()].some((s) => s.happySessionId === sid && isPidAlive(s.pid)));
       },
@@ -6359,11 +8935,18 @@ async function startDaemon() {
       log: (message) => logger.logger.debug(`[DAEMON RUN] ${message}`)
     });
     void apiMachine.updateMachineMetadata((current) => ({
-      ...current ?? initialMachineMetadata,
+      // B-718: the running CLI version, not the one that first registered the row.
+      ...machineMetadata.withRunningCliFacts(current, initialMachineMetadata),
       teamsVersion: 1,
       teamLaunchVersion: 1,
+      // B-689: this daemon acts on the owner's retry-operation (web gates「重试启动」).
+      teamRetryVersion: machineMetadata.TEAM_RETRY_CAPABILITY_VERSION,
       // B-586: this daemon serves the worktree-* RPCs (web gates 「在新 worktree 中」 on it).
-      worktreeVersion: mirrorProtocol.WORKTREE_CAPABILITY_VERSION
+      worktreeVersion: mirrorProtocol.WORKTREE_CAPABILITY_VERSION,
+      // B-688: this daemon serves the model-config-* RPCs (web gates 「模型与 Provider」 on it).
+      modelConfigVersion: MODEL_CONFIG_CAPABILITY_VERSION,
+      // B-719: this daemon serves `harness-install` (web gates the Install / Update buttons on it).
+      harnessInstallVersion: index.HARNESS_INSTALL_CAPABILITY_VERSION
     })).catch(() => logger.logger.debug("[DAEMON RUN] Teams capability publication will retry on reconnect"));
     const cleanupAndShutdown = async (source, errorMessage) => {
       webPanelsSync.stop();
@@ -6378,6 +8961,7 @@ async function startDaemon() {
         logger.logger.debug("[DAEMON RUN] Health check interval cleared");
       }
       clearInterval(cliUpdateInterval);
+      policyAnnouncements.stop();
       stopAgentVersionChecks();
       await apiMachine.updateDaemonState((state) => ({
         ...state,