very-happy-cli 0.2.180 → 0.2.182

package/dist/{run-CAOCYYfT.cjs → run-BBNrcCfI.cjs}

@@ -1,26 +1,27 @@
 'use strict';
 
-var mirrorProtocol = require('./mirrorProtocol-HKPivs5o.cjs');
-var piRunnerArgs = require('./piRunnerArgs-DGaq6VYM.cjs');
+var mirrorProtocol = require('./mirrorProtocol-DkWOcZh9.cjs');
+var fsMkdir = require('./fsMkdir-0K3yENml.cjs');
+var piRunnerArgs = require('./piRunnerArgs-vxCHKnSA.cjs');
 var fs = require('fs/promises');
 var os$1 = require('os');
 var tmp = require('tmp');
 var axios = require('axios');
-var api = require('./api-DM7b1OKj.cjs');
-var spawnAgents = require('./spawnAgents-DLNMlhWJ.cjs');
-var logger = require('./logger-CphW5nUE.cjs');
 var node_fs = require('node:fs');
 var path = require('node:path');
-var index$2 = require('./index-F2UejqYs.cjs');
-var auth = require('./auth-CBXnm-Mj.cjs');
-var configuration = require('./configuration-CYO-kPOS.cjs');
+var configuration = require('./configuration-B-CugKJ3.cjs');
+var api = require('./api-CZWcG7uh.cjs');
+var spawnAgents = require('./spawnAgents-CG211IW7.cjs');
+var logger = require('./logger-DK1ytCz6.cjs');
+var index$2 = require('./index-CZC7egJA.cjs');
+var auth = require('./auth-Lw_utSMV.cjs');
 var child_process = require('child_process');
-var _package = require('./package-KhLqBDX9.cjs');
-var doctor = require('./doctor-BrgSlfXn.cjs');
-var spawnHappyCLI = require('./spawnHappyCLI-DnUZv0X2.cjs');
-var persistence = require('./persistence-9BMYspxG.cjs');
-var controlClient = require('./controlClient-Bqv5v5OM.cjs');
-var sessionOps = require('./sessionOps-BrGiU9-s.cjs');
+var _package = require('./package-BfeqAzyJ.cjs');
+var doctor = require('./doctor-DMvlzmnE.cjs');
+var spawnHappyCLI = require('./spawnHappyCLI-D47kX6jg.cjs');
+var persistence = require('./persistence-BdpwWXKh.cjs');
+var controlClient = require('./controlClient-D0kGwKYx.cjs');
+var sessionOps = require('./sessionOps-Dx7wARjI.cjs');
 var fastify = require('fastify');
 var z = require('zod');
 var fastifyTypeProviderZod = require('fastify-type-provider-zod');
@@ -28,60 +29,62 @@ var authRelay = require('./authRelay-Dy1qU9td.cjs');
 var node_crypto = require('node:crypto');
 var previewPath = require('./previewPath-B0rBdhy1.cjs');
 var backgroundTaskActivity = require('./backgroundTaskActivity-CBvUdj39.cjs');
-var rateLimitWindows = require('./rateLimitWindows-YRIYVdo4.cjs');
-var peerTools = require('./peerTools-DQNlrcqM.cjs');
+var rateLimitWindows = require('./rateLimitWindows-DJxnNw-X.cjs');
+var peerTools = require('./peerTools-BVp1z0T_.cjs');
 var os = require('node:os');
-var remoteSessionClient = require('./remoteSessionClient-D843fkzL.cjs');
-var bootstrap = require('./bootstrap-DoA7okld.cjs');
-var index$1 = require('./index-C64Ufj4D.cjs');
+var remoteSessionClient = require('./remoteSessionClient-CtV9mDko.cjs');
+var bootstrap = require('./bootstrap-DsXp74wv.cjs');
+var index$1 = require('./index-B_aNaW9w.cjs');
 var require$$0 = require('fs');
 var require$$1 = require('path');
 var node_child_process = require('node:child_process');
 var projectPath = require('./projectPath-C3ioB4Bu.cjs');
 var doctorReadiness = require('./doctorReadiness-Dl6yRQCy.cjs');
-var machineMetadata = require('./machineMetadata-BQm9YTcI.cjs');
+var machineMetadata = require('./machineMetadata-IJc6_iyx.cjs');
+var fileStore = require('./fileStore-7qhnbs6N.cjs');
+var pi = require('./pi-DlsrPCTa.cjs');
 var require$$3 = require('crypto');
 var detectCLI = require('./detectCLI-BuYR_Qxe.cjs');
-var handleResumeCommand = require('./handleResumeCommand-BvWVuRwH.cjs');
+var handleResumeCommand = require('./handleResumeCommand-Dp2Y-p6V.cjs');
 var webPanels = require('./webPanels-FCgFKvVe.cjs');
-var index = require('./index-Dv0Q48P3.cjs');
+var index = require('./index-oh8XEozJ.cjs');
 var promises = require('node:fs/promises');
 var cliUpdate = require('./cliUpdate-DsKXPFYp.cjs');
-var client = require('./client-DJplzPjD.cjs');
-var client$1 = require('./client-BWjaHKtj.cjs');
+var client = require('./client-DK8CzUry.cjs');
+var client$1 = require('./client-CDuW4MS9.cjs');
 var module$1 = require('node:module');
 var path$1 = require('./path-B7zW-WwE.cjs');
 var editPaths = require('./editPaths-Bqp4OFPw.cjs');
-var startFileWatcher = require('./startFileWatcher-D9cYzZOq.cjs');
-var sync = require('./sync-Bn-idAoy.cjs');
+var startFileWatcher = require('./startFileWatcher-gKQTstR6.cjs');
+var sync = require('./sync-BxMdnZzz.cjs');
 var types = require('./types-CRS-srZK.cjs');
 var tmuxSocket = require('./tmuxSocket-D-Xt6Vn-.cjs');
-var sessionLock = require('./sessionLock-DRZUcKHT.cjs');
+var sessionLock = require('./sessionLock-Dc0fadGG.cjs');
 var doctor$1 = require('./doctor-u46qYYKX.cjs');
-var resources = require('./resources-CvIlkzpP.cjs');
+var resources = require('./resources-BPyN59Iv.cjs');
 var node_util = require('node:util');
 var template = require('./template-BaHAmH2K.cjs');
 var daemonSupervisor = require('./daemonSupervisor-B-SPSqhs.cjs');
 var loginShellEnv = require('./loginShellEnv-BkuYtExZ.cjs');
-require('./acpSessionResume-CR5pmgVo.cjs');
-require('./lidState-DWGnm2H4.cjs');
+require('./acpSessionResume-Dxo8222T.cjs');
+require('./lidState-DcPvwniz.cjs');
 require('node:events');
 require('socket.io-client');
-require('./pushNotifications-DI92havG.cjs');
+require('./pushNotifications-CyQVDThC.cjs');
 require('./contentLogMetadata-ZSFk_NjQ.cjs');
 require('./limits-C-a7gr04.cjs');
-require('./time-Cjv0zxQO.cjs');
-require('./registerCommonHandlers-C7a_dUWs.cjs');
+require('./time-DNLeIRgR.cjs');
+require('./registerCommonHandlers-DbNoM39q.cjs');
 require('util');
 require('cross-spawn');
 require('@paralleldrive/cuid2');
 require('chalk');
 require('tweetnacl');
-require('./browser-DZ6qRtfH.cjs');
+require('./browser-CZlA9AkO.cjs');
 require('open');
 require('./ids-B6ZC0HGt.cjs');
 require('url');
-require('./localHappyAgentAuth-DZHQnIW9.cjs');
+require('./localHappyAgentAuth-SD6GM97y.cjs');
 require('./processTreeSnapshot-mDbnuojn.cjs');
 require('ps-list');
 
@@ -114,6 +117,87 @@ async function resolveRelaunchMetadata(snapshot, fetchServer) {
   return { metadata: snapshot, source: "snapshot" };
 }
 
+function receiptPath(home, operationId) {
+  if (!/^[a-zA-Z0-9_-]{1,128}$/.test(operationId)) throw new Error("Invalid team operation id");
+  return path.join(home, "teams", "effects", `${operationId}.json`);
+}
+function readReceipt(home, id) {
+  try {
+    const value = JSON.parse(node_fs.readFileSync(receiptPath(home, id), "utf8"));
+    if (value.operationId !== id || typeof value.claimId !== "string" || !["prepared", "spawning", "spawned", "delivered", "completed"].includes(value.phase)) throw new Error("Invalid team effect receipt");
+    return value;
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  }
+}
+function writeReceipt$1(home, receipt) {
+  configuration.ensurePrivateDirectorySync(path.join(home, "teams", "effects"));
+  const target = receiptPath(home, receipt.operationId);
+  const tmp = `${target}.${process.pid}.tmp`;
+  configuration.writePrivateFileSync(tmp, JSON.stringify(receipt));
+  const file = node_fs.openSync(tmp, "r");
+  try {
+    node_fs.fsyncSync(file);
+  } finally {
+    node_fs.closeSync(file);
+  }
+  node_fs.renameSync(tmp, target);
+  if (process.platform !== "win32") {
+    const directory = node_fs.openSync(path.join(home, "teams", "effects"), "r");
+    try {
+      node_fs.fsyncSync(directory);
+    } finally {
+      node_fs.closeSync(directory);
+    }
+  }
+}
+
+const OPERATION_ID = /^[a-zA-Z0-9_-]{1,128}$/;
+function teamScopeFilePath(home, operationId) {
+  if (!OPERATION_ID.test(operationId)) throw new Error("Invalid team operation id");
+  return path.join(home, "teams", "scopes", `${operationId}.json`);
+}
+function relaunchTeamOperationId(home, sessionId, metadata) {
+  const fromMetadata = metadata?.teamOperationId;
+  if (typeof fromMetadata === "string" && OPERATION_ID.test(fromMetadata)) return fromMetadata;
+  let names;
+  try {
+    names = node_fs.readdirSync(path.join(home, "teams", "effects"));
+  } catch {
+    return null;
+  }
+  let newest = null;
+  for (const name of names) {
+    if (!name.endsWith(".json")) continue;
+    const id = name.slice(0, -".json".length);
+    if (!OPERATION_ID.test(id)) continue;
+    try {
+      const receipt = readReceipt(home, id);
+      if (receipt?.sessionId !== sessionId || !receipt.scopeFile) continue;
+      const at = node_fs.statSync(receiptPath(home, id)).mtimeMs;
+      if (!newest || at > newest.at) newest = { id, at };
+    } catch {
+    }
+  }
+  return newest?.id ?? null;
+}
+async function teamRelaunchEnv(input) {
+  const operationId = relaunchTeamOperationId(input.home, input.sessionId, input.metadata);
+  if (!operationId) return {};
+  const scopeFile = teamScopeFilePath(input.home, operationId);
+  if (!node_fs.existsSync(scopeFile) && input.recover) {
+    try {
+      await input.recover(operationId, scopeFile);
+      input.log(`Teams scope for ${input.sessionId} rebuilt from operation ${operationId}`);
+    } catch (error) {
+      input.log(`Teams scope for ${input.sessionId} could not be rebuilt: ${error instanceof Error ? error.message : "unknown error"}`);
+    }
+  }
+  if (!node_fs.existsSync(scopeFile)) input.log(`Teams scope for ${input.sessionId} is missing; team tools will refuse until the owner restores it`);
+  return { VH_TEAM_SCOPE_FILE: scopeFile, VH_TEAM_OPERATION_ID: operationId, HAPPY_SPAWNED_BY: "teams" };
+}
+
 const DEFAULT_LOG_PRUNE_POLICY = {
   maxAgeMs: 14 * 24 * 60 * 6e4,
   maxTotalBytes: 200 * 1024 * 1024,
@@ -2194,196 +2278,6 @@ function unifiedDiff(oldText, newText, label, context = 3) {
 `;
 }
 
-const SECRET_KEY_PATTERN = /(api[_-]?key|apikey|token|secret|password|passwd|authorization|bearer|credential|cookie|private[_-]?key)/i;
-const EXTRA_SECRET_KEYS = /* @__PURE__ */ new Set(["ANTHROPIC_CUSTOM_HEADERS"]);
-function isSecretKey(key) {
-  return SECRET_KEY_PATTERN.test(key) || EXTRA_SECRET_KEYS.has(key);
-}
-function maskSecret(value) {
-  const v = value.trim();
-  if (!v) return "";
-  if (v.length < 16) return "\u2022\u2022\u2022\u2022";
-  return `${v.slice(0, 4)}\u2026${v.slice(-4)}`;
-}
-function collectSecretValues(value, out = /* @__PURE__ */ new Set(), parentKey = "") {
-  if (typeof value === "string") {
-    if (parentKey && isSecretKey(parentKey) && value.length >= 4) out.add(value);
-    return out;
-  }
-  if (Array.isArray(value)) {
-    for (const item of value) collectSecretValues(item, out, parentKey);
-    return out;
-  }
-  if (value && typeof value === "object") {
-    for (const [key, child] of Object.entries(value)) {
-      collectSecretValues(child, out, key);
-    }
-  }
-  return out;
-}
-function redactText(text, secrets) {
-  const list = [...new Set(secrets)].filter((s) => s.length >= 4).sort((a, b) => b.length - a.length);
-  let out = text;
-  for (const secret of list) {
-    out = out.split(secret).join(maskSecret(secret));
-  }
-  return out;
-}
-const ENV_NAME_PATTERN = /^[A-Za-z_][A-Za-z0-9_]{0,127}$/;
-function isValidEnvName(name) {
-  return typeof name === "string" && ENV_NAME_PATTERN.test(name);
-}
-
-function parseJsonObject$1(text, label) {
-  if (text.trim() === "") return {};
-  let value;
-  try {
-    value = JSON.parse(text);
-  } catch (error) {
-    const hasComments = /^\s*\/\/|\/\*/m.test(text);
-    throw new mirrorProtocol.ModelConfigError(
-      hasComments ? "json-has-comments" : "invalid-json",
-      hasComments ? `${label} contains comments; Very Happy only edits strict JSON so it never drops them. Edit it by hand or remove the comments.` : `${label} is not valid JSON: ${error instanceof Error ? error.message : String(error)}`
-    );
-  }
-  if (!value || typeof value !== "object" || Array.isArray(value)) {
-    throw new mirrorProtocol.ModelConfigError("invalid-json", `${label} must contain a JSON object`);
-  }
-  return value;
-}
-function detectIndent(text) {
-  const m = /^([ \t]+)"/m.exec(text);
-  return m ? m[1] : 2;
-}
-function stringifyLike(original, value) {
-  const compact = original.trim() !== "" && !original.trim().includes("\n");
-  const body = compact ? JSON.stringify(value) : JSON.stringify(value, null, detectIndent(original));
-  const eol = original.includes("\r\n") ? "\r\n" : "\n";
-  const withEol = eol === "\r\n" ? body.replace(/\n/g, "\r\n") : body;
-  return original === "" || /\r?\n$/.test(original) ? withEol + eol : withEol;
-}
-function setOrDelete(obj, key, value) {
-  if (value === void 0 || value === null || value === "") delete obj[key];
-  else obj[key] = value;
-}
-function childObject(obj, key, label) {
-  const current = obj[key];
-  if (current === void 0) {
-    const created = {};
-    obj[key] = created;
-    return created;
-  }
-  if (!current || typeof current !== "object" || Array.isArray(current)) {
-    throw new mirrorProtocol.ModelConfigError("unexpected-shape", `${label}.${key} is not an object; refusing to overwrite it`);
-  }
-  return current;
-}
-
-const MODEL_ID = /^[A-Za-z0-9._:/@+\-[\]]{1,200}$/;
-const PROVIDER_ID = /^[A-Za-z0-9_-]{1,64}$/;
-function fail(code, message) {
-  throw new mirrorProtocol.ModelConfigError(code, message);
-}
-function normalizeBaseUrl(value, field = "baseUrl") {
-  if (value === void 0) return void 0;
-  if (value === null) return null;
-  if (typeof value !== "string") fail("invalid-input", `${field} must be a string`);
-  const v = value.trim();
-  if (v === "") return null;
-  if (v.length > 2048 || /\s/.test(v)) fail("invalid-input", `${field} is not a valid URL`);
-  let url;
-  try {
-    url = new URL(v);
-  } catch {
-    fail("invalid-input", `${field} is not a valid URL`);
-  }
-  if (url.protocol !== "http:" && url.protocol !== "https:") fail("invalid-input", `${field} must be http(s)`);
-  if (url.username || url.password) fail("invalid-input", `${field} must not embed credentials; use the API key field`);
-  return v;
-}
-function normalizeModelId(value, field = "model") {
-  if (value === void 0) return void 0;
-  if (value === null) return null;
-  if (typeof value !== "string") fail("invalid-input", `${field} must be a string`);
-  const v = value.trim();
-  if (v === "") return null;
-  if (!MODEL_ID.test(v)) fail("invalid-input", `${field} contains unsupported characters`);
-  return v;
-}
-function normalizeModelList(value, field = "models") {
-  if (value === void 0) return void 0;
-  if (!Array.isArray(value)) fail("invalid-input", `${field} must be an array`);
-  if (value.length > 64) fail("invalid-input", `${field} has too many entries`);
-  const out = [];
-  for (const item of value) {
-    const id = normalizeModelId(item, field);
-    if (id && !out.includes(id)) out.push(id);
-  }
-  return out;
-}
-function normalizeProviderId(value, reserved = []) {
-  if (typeof value !== "string" || !PROVIDER_ID.test(value.trim())) fail("invalid-input", "providerId must be 1-64 letters, digits, - or _");
-  const v = value.trim();
-  if (reserved.includes(v)) fail("invalid-input", `providerId "${v}" is reserved by the harness`);
-  return v;
-}
-function normalizeSecret(value, allowed = ["keep", "clear", "literal", "env"]) {
-  if (value === void 0) return { mode: "keep" };
-  if (!value || typeof value !== "object") fail("invalid-input", "apiKey must be an object");
-  const v = value;
-  const mode = v.mode;
-  if (typeof mode !== "string" || !allowed.includes(mode)) fail("invalid-input", `apiKey.mode must be one of ${allowed.join(", ")}`);
-  if (mode === "literal") {
-    if (typeof v.value !== "string") fail("invalid-input", "apiKey.value must be a string");
-    const key = v.value.trim();
-    if (!key || key.length > 4096 || /[\s\u0000-\u001f\u007f]/.test(key)) fail("invalid-input", "apiKey.value must be a single line without spaces");
-    return { mode: "literal", value: key };
-  }
-  if (mode === "env") {
-    if (!isValidEnvName(v.name)) fail("invalid-input", "apiKey.name must be an environment variable name");
-    return { mode: "env", name: v.name };
-  }
-  return { mode };
-}
-function baseUrlWarnings(url, kind) {
-  if (!url) return [];
-  const path = (() => {
-    try {
-      return new URL(url).pathname.replace(/\/+$/, "");
-    } catch {
-      return "";
-    }
-  })();
-  const out = [];
-  if (/\/(chat\/completions|responses|messages|completions)$/.test(path)) {
-    out.push({ code: "base-url-has-endpoint", message: "The base URL ends with an API endpoint path; harnesses append that themselves." });
-  }
-  if (kind === "anthropic" && /\/v1$/.test(path)) {
-    out.push({ code: "base-url-v1", message: "Claude Code appends /v1/messages; a base URL ending in /v1 usually produces /v1/v1/messages." });
-  }
-  if (kind === "openai" && !/\/v\d/.test(path)) {
-    out.push({ code: "base-url-no-version", message: "OpenAI-compatible base URLs usually end in /v1." });
-  }
-  return out;
-}
-
-function getPath$1(obj, path) {
-  let cur = obj;
-  for (const p of path) {
-    if (!cur || typeof cur !== "object" || Array.isArray(cur)) return void 0;
-    cur = cur[p];
-  }
-  return cur;
-}
-function changedPaths(before, after, paths) {
-  return paths.filter((path) => JSON.stringify(getPath$1(before, path)) !== JSON.stringify(getPath$1(after, path))).map((path) => path.join("."));
-}
-function uniq(values) {
-  const out = [];
-  for (const v of values) if (v && !out.includes(v)) out.push(v);
-  return out;
-}
-
 const ROLE$1 = "settings";
 const AUTH_TOKEN = "ANTHROPIC_AUTH_TOKEN";
 const API_KEY$1 = "ANTHROPIC_API_KEY";
@@ -2408,7 +2302,7 @@ function claudeSettingsPath(ctx) {
   const dir = ctx.env.CLAUDE_CONFIG_DIR?.trim() || path.join(ctx.home, ".claude");
   return path.join(dir, "settings.json");
 }
-function str$4(v) {
+function str$3(v) {
   return typeof v === "string" && v.trim() ? v : null;
 }
 function envOf(settings) {
@@ -2421,11 +2315,11 @@ function pickerOptions(settings) {
   const options = picker.options;
   return Array.isArray(options) ? options.filter((o) => !!o && typeof o === "object" && typeof o.model === "string") : [];
 }
-function secretView$2(settings, ctx) {
+function secretView$1(settings, ctx) {
   const env = envOf(settings);
-  const literal = str$4(env[AUTH_TOKEN]) ?? str$4(env[API_KEY$1]);
-  if (literal) return { mode: "literal", masked: maskSecret(literal) };
-  const helper = str$4(settings.apiKeyHelper);
+  const literal = str$3(env[AUTH_TOKEN]) ?? str$3(env[API_KEY$1]);
+  if (literal) return { mode: "literal", masked: pi.maskSecret(literal) };
+  const helper = str$3(settings.apiKeyHelper);
   if (helper) {
     const ours = OUR_HELPER.exec(helper.trim());
     if (ours) return { mode: "env", envName: ours[1], envPresent: !!ctx.env[ours[1]] };
@@ -2433,26 +2327,26 @@ function secretView$2(settings, ctx) {
   }
   return { mode: "none" };
 }
-function currentOf$3(settings, ctx) {
+function currentOf$2(settings, ctx) {
   const env = envOf(settings);
   return {
-    baseUrl: str$4(env.ANTHROPIC_BASE_URL),
-    authHeader: !str$4(env[AUTH_TOKEN]) && str$4(env[API_KEY$1]) ? "x-api-key" : "bearer",
-    apiKey: secretView$2(settings, ctx),
-    model: str$4(settings.model),
-    opusModel: str$4(env[ALIAS_VARS.opusModel]),
-    sonnetModel: str$4(env[ALIAS_VARS.sonnetModel]),
-    haikuModel: str$4(env[ALIAS_VARS.haikuModel]),
+    baseUrl: str$3(env.ANTHROPIC_BASE_URL),
+    authHeader: !str$3(env[AUTH_TOKEN]) && str$3(env[API_KEY$1]) ? "x-api-key" : "bearer",
+    apiKey: secretView$1(settings, ctx),
+    model: str$3(settings.model),
+    opusModel: str$3(env[ALIAS_VARS.opusModel]),
+    sonnetModel: str$3(env[ALIAS_VARS.sonnetModel]),
+    haikuModel: str$3(env[ALIAS_VARS.haikuModel]),
     pickerModels: pickerOptions(settings).map((o) => o.model)
   };
 }
-function pickerModelsOf$1(current) {
-  return uniq([current.model, current.opusModel, current.sonnetModel, current.haikuModel, ...current.pickerModels ?? []]);
+function pickerModelsOf(current) {
+  return pi.uniq([current.model, current.opusModel, current.sonnetModel, current.haikuModel, ...current.pickerModels ?? []]);
 }
-function warningsOf$3(settings, current, ctx) {
+function warningsOf$2(settings, current, ctx) {
   const env = envOf(settings);
-  const out = [...baseUrlWarnings(current.baseUrl, "anthropic")];
-  if (str$4(env.ANTHROPIC_MODEL)) {
+  const out = [...pi.baseUrlWarnings(current.baseUrl, "anthropic")];
+  if (str$3(env.ANTHROPIC_MODEL)) {
     out.push({ code: "env-model-overrides", message: "env.ANTHROPIC_MODEL is set in settings.json and overrides the default model." });
   }
   const daemonOther = current.authHeader === "bearer" ? API_KEY$1 : AUTH_TOKEN;
@@ -2464,24 +2358,24 @@ function warningsOf$3(settings, current, ctx) {
   }
   if (Array.isArray(settings.availableModels)) {
     const allowed = settings.availableModels;
-    const missing = pickerModelsOf$1(current).filter((id) => !allowed.includes(id));
+    const missing = pickerModelsOf(current).filter((id) => !allowed.includes(id));
     if (missing.length) out.push({ code: "available-models-filter", message: `availableModels does not list ${missing.join(", ")}; Claude Code hides them.` });
   }
   return out;
 }
 function parsePatch$1(raw) {
   const p = raw;
-  if (p.authHeader !== void 0 && p.authHeader !== "bearer" && p.authHeader !== "x-api-key") fail("invalid-input", "authHeader must be bearer or x-api-key");
+  if (p.authHeader !== void 0 && p.authHeader !== "bearer" && p.authHeader !== "x-api-key") pi.fail("invalid-input", "authHeader must be bearer or x-api-key");
   return {
     harness: "claude",
-    baseUrl: normalizeBaseUrl(p.baseUrl),
+    baseUrl: pi.normalizeBaseUrl(p.baseUrl),
     authHeader: p.authHeader,
-    apiKey: normalizeSecret(p.apiKey),
-    model: normalizeModelId(p.model),
-    opusModel: normalizeModelId(p.opusModel, "opusModel"),
-    sonnetModel: normalizeModelId(p.sonnetModel, "sonnetModel"),
-    haikuModel: normalizeModelId(p.haikuModel, "haikuModel"),
-    pickerModels: normalizeModelList(p.pickerModels, "pickerModels")
+    apiKey: pi.normalizeSecret(p.apiKey),
+    model: pi.normalizeModelId(p.model),
+    opusModel: pi.normalizeModelId(p.opusModel, "opusModel"),
+    sonnetModel: pi.normalizeModelId(p.sonnetModel, "sonnetModel"),
+    haikuModel: pi.normalizeModelId(p.haikuModel, "haikuModel"),
+    pickerModels: pi.normalizeModelList(p.pickerModels, "pickerModels")
   };
 }
 const claudeAdapter = {
@@ -2489,19 +2383,19 @@ const claudeAdapter = {
   binary: "claude",
   files: (ctx) => [{ role: ROLE$1, path: claudeSettingsPath(ctx) }],
   view(files, ctx) {
-    const settings = parseJsonObject$1(files[ROLE$1].content, "settings.json");
-    const current = currentOf$3(settings, ctx);
-    return { current, pickerModels: pickerModelsOf$1(current), warnings: warningsOf$3(settings, current, ctx) };
+    const settings = pi.parseJsonObject(files[ROLE$1].content, "settings.json");
+    const current = currentOf$2(settings, ctx);
+    return { current, pickerModels: pickerModelsOf(current), warnings: warningsOf$2(settings, current, ctx) };
   },
   plan(files, raw, ctx) {
     const patch = parsePatch$1(raw);
     const original = files[ROLE$1].content;
-    const before = parseJsonObject$1(original, "settings.json");
+    const before = pi.parseJsonObject(original, "settings.json");
     const settings = structuredClone(before);
     const hadEnv = settings.env !== void 0;
-    const env = childObject(settings, "env", "settings");
-    if (patch.baseUrl !== void 0) setOrDelete(env, "ANTHROPIC_BASE_URL", patch.baseUrl);
-    const currentHeader = !str$4(env[AUTH_TOKEN]) && str$4(env[API_KEY$1]) ? "x-api-key" : "bearer";
+    const env = pi.childObject(settings, "env", "settings");
+    if (patch.baseUrl !== void 0) pi.setOrDelete(env, "ANTHROPIC_BASE_URL", patch.baseUrl);
+    const currentHeader = !str$3(env[AUTH_TOKEN]) && str$3(env[API_KEY$1]) ? "x-api-key" : "bearer";
     const header = patch.authHeader ?? currentHeader;
     const target = header === "bearer" ? AUTH_TOKEN : API_KEY$1;
     const other = header === "bearer" ? API_KEY$1 : AUTH_TOKEN;
@@ -2525,19 +2419,19 @@ const claudeAdapter = {
         if (helperIsOurs) delete settings.apiKeyHelper;
         break;
       case "keep":
-        if (header !== currentHeader && str$4(env[other]) && !str$4(env[target])) {
+        if (header !== currentHeader && str$3(env[other]) && !str$3(env[target])) {
           env[target] = env[other];
           delete env[other];
         }
         break;
     }
-    if (patch.model !== void 0) setOrDelete(settings, "model", patch.model);
+    if (patch.model !== void 0) pi.setOrDelete(settings, "model", patch.model);
     for (const [field, variable] of Object.entries(ALIAS_VARS)) {
-      if (patch[field] !== void 0) setOrDelete(env, variable, patch[field]);
+      if (patch[field] !== void 0) pi.setOrDelete(env, variable, patch[field]);
     }
     if (patch.pickerModels !== void 0) {
       const hadPicker = settings.modelPicker !== void 0;
-      const picker = childObject(settings, "modelPicker", "settings");
+      const picker = pi.childObject(settings, "modelPicker", "settings");
       const existing = pickerOptions(settings);
       const next = patch.pickerModels.map((id) => existing.find((o) => o.model === id) ?? { model: id });
       if (next.length) picker.options = next;
@@ -2545,19 +2439,19 @@ const claudeAdapter = {
       if (!hadPicker && Object.keys(picker).length === 0) delete settings.modelPicker;
     }
     if (!hadEnv && Object.keys(env).length === 0) delete settings.env;
-    const current = currentOf$3(settings, ctx);
+    const current = currentOf$2(settings, ctx);
     if (Array.isArray(settings.availableModels)) {
       const allowed = settings.availableModels;
-      const add = pickerModelsOf$1(current).filter((id) => !allowed.includes(id));
+      const add = pickerModelsOf(current).filter((id) => !allowed.includes(id));
       if (add.length) settings.availableModels = [...allowed, ...add];
     }
-    const changedKeys = changedPaths(before, settings, OWNED_PATHS);
-    const content = changedKeys.length === 0 ? void 0 : stringifyLike(original, settings);
-    return { contents: { [ROLE$1]: content }, warnings: warningsOf$3(settings, current, ctx), changedKeys, secrets };
+    const changedKeys = pi.changedPaths(before, settings, OWNED_PATHS);
+    const content = changedKeys.length === 0 ? void 0 : pi.stringifyLike(original, settings);
+    return { contents: { [ROLE$1]: content }, warnings: warningsOf$2(settings, current, ctx), changedKeys, secrets };
   },
   secretsIn(_role, content) {
     try {
-      return collectSecretValues(parseJsonObject$1(content, "settings.json"));
+      return pi.collectSecretValues(pi.parseJsonObject(content, "settings.json"));
     } catch {
       return /* @__PURE__ */ new Set();
     }
@@ -3531,7 +3425,7 @@ function parseToml(text) {
     return parse(text);
   } catch (error) {
     const message = error instanceof Error ? error.message.split("\n")[0] : String(error);
-    throw new mirrorProtocol.ModelConfigError("invalid-toml", `Not valid TOML: ${message}`);
+    throw new fileStore.ModelConfigError("invalid-toml", `Not valid TOML: ${message}`);
   }
 }
 function getPath(obj, path) {
@@ -3581,20 +3475,20 @@ function verifyTomlEdit(oldText, newText, edits) {
   try {
     after = parse(newText);
   } catch (error) {
-    throw new mirrorProtocol.ModelConfigError("unsafe-edit", `Edit would produce invalid TOML (${error instanceof Error ? error.message.split("\n")[0] : String(error)}); the file layout is not one this editor can change safely`);
+    throw new fileStore.ModelConfigError("unsafe-edit", `Edit would produce invalid TOML (${error instanceof Error ? error.message.split("\n")[0] : String(error)}); the file layout is not one this editor can change safely`);
   }
   const owned = edits.map((e) => "removeTable" in e ? e.table : [...e.table, e.key]);
   for (const edit of edits) {
     if ("removeTable" in edit) {
-      if (getPath(after, edit.table) !== void 0) throw new mirrorProtocol.ModelConfigError("unsafe-edit", `Table ${edit.table.join(".")} is still present after removal`);
+      if (getPath(after, edit.table) !== void 0) throw new fileStore.ModelConfigError("unsafe-edit", `Table ${edit.table.join(".")} is still present after removal`);
       continue;
     }
     const got = getPath(after, [...edit.table, edit.key]);
     const want = edit.value === null ? void 0 : edit.value;
-    if (got !== want) throw new mirrorProtocol.ModelConfigError("unsafe-edit", `Key ${[...edit.table, edit.key].join(".")} did not take the requested value`);
+    if (got !== want) throw new fileStore.ModelConfigError("unsafe-edit", `Key ${[...edit.table, edit.key].join(".")} did not take the requested value`);
   }
   if (stableStringify(pruneEmpty(withoutPaths(before, owned))) !== stableStringify(pruneEmpty(withoutPaths(after, owned)))) {
-    throw new mirrorProtocol.ModelConfigError("unsafe-edit", "Edit would change settings outside the keys Very Happy manages");
+    throw new fileStore.ModelConfigError("unsafe-edit", "Edit would change settings outside the keys Very Happy manages");
   }
 }
 function editToml(text, edits) {
@@ -3613,68 +3507,68 @@ function codexConfigPath(ctx) {
   const dir = ctx.env.CODEX_HOME?.trim() || path.join(ctx.home, ".codex");
   return path.join(dir, "config.toml");
 }
-const str$3 = (v) => typeof v === "string" && v.trim() ? v : null;
-function providersOf$1(doc) {
+const str$2 = (v) => typeof v === "string" && v.trim() ? v : null;
+function providersOf(doc) {
   const table = doc.model_providers;
   if (!table || typeof table !== "object" || Array.isArray(table)) return {};
   return Object.fromEntries(Object.entries(table).filter(([, v]) => v && typeof v === "object" && !Array.isArray(v)));
 }
-function secretView$1(provider, ctx) {
+function secretView(provider, ctx) {
   if (!provider) return { mode: "none" };
-  const token = str$3(provider.experimental_bearer_token);
-  if (token) return { mode: "literal", masked: maskSecret(token) };
-  const envKey = str$3(provider.env_key);
+  const token = str$2(provider.experimental_bearer_token);
+  if (token) return { mode: "literal", masked: pi.maskSecret(token) };
+  const envKey = str$2(provider.env_key);
   if (envKey) return { mode: "env", envName: envKey, envPresent: !!ctx.env[envKey] };
   if (provider.auth && typeof provider.auth === "object") return { mode: "command" };
   return { mode: "none" };
 }
 function selectProvider(doc, requested) {
-  const providers = providersOf$1(doc);
+  const providers = providersOf(doc);
   if (requested) return requested;
-  const active = str$3(doc.model_provider);
+  const active = str$2(doc.model_provider);
   if (active && providers[active]) return active;
   return Object.keys(providers)[0] ?? null;
 }
-function currentOf$2(doc, providerId, ctx) {
-  const provider = providerId ? providersOf$1(doc)[providerId] : void 0;
-  const activeProvider = str$3(doc.model_provider);
+function currentOf$1(doc, providerId, ctx) {
+  const provider = providerId ? providersOf(doc)[providerId] : void 0;
+  const activeProvider = str$2(doc.model_provider);
   return {
     providerId,
-    providerName: str$3(provider?.name),
-    baseUrl: str$3(provider?.base_url),
-    apiKey: secretView$1(provider, ctx),
-    model: str$3(doc.model),
+    providerName: str$2(provider?.name),
+    baseUrl: str$2(provider?.base_url),
+    apiKey: secretView(provider, ctx),
+    model: str$2(doc.model),
     activeProvider,
     active: !!providerId && activeProvider === providerId
   };
 }
-function warningsOf$2(doc, current) {
-  const out = [...baseUrlWarnings(current.baseUrl, "openai")];
-  const provider = current.providerId ? providersOf$1(doc)[current.providerId] : void 0;
-  if (provider && str$3(provider.wire_api) && provider.wire_api !== "responses") {
+function warningsOf$1(doc, current) {
+  const out = [...pi.baseUrlWarnings(current.baseUrl, "openai")];
+  const provider = current.providerId ? providersOf(doc)[current.providerId] : void 0;
+  if (provider && str$2(provider.wire_api) && provider.wire_api !== "responses") {
     out.push({ code: "wire-api-unsupported", message: `wire_api = "${String(provider.wire_api)}" is rejected by current Codex; only "responses" is supported.` });
   }
   if (current.apiKey?.mode === "env" && !current.apiKey.envPresent) {
     out.push({ code: "env-missing", message: `${current.apiKey.envName} is not set in the daemon's environment, so sessions will not get a key.` });
   }
   const active = current.activeProvider;
-  if (active && !CODEX_RESERVED_PROVIDERS.includes(active) && !providersOf$1(doc)[active]) {
+  if (active && !CODEX_RESERVED_PROVIDERS.includes(active) && !providersOf(doc)[active]) {
     out.push({ code: "active-provider-missing", message: `model_provider = "${active}" has no [model_providers.${active}] table.` });
   }
   return out;
 }
 function parsePatch(raw) {
   const p = raw;
-  if (p.activate !== void 0 && typeof p.activate !== "boolean") fail("invalid-input", "activate must be a boolean");
+  if (p.activate !== void 0 && typeof p.activate !== "boolean") pi.fail("invalid-input", "activate must be a boolean");
   if (p.providerName !== void 0 && (typeof p.providerName !== "string" || p.providerName.length > 120 || /[\u0000-\u001f]/.test(p.providerName))) {
-    fail("invalid-input", "providerName must be a short single-line string");
+    pi.fail("invalid-input", "providerName must be a short single-line string");
   }
   return {
-    providerId: normalizeProviderId(p.providerId, CODEX_RESERVED_PROVIDERS),
+    providerId: pi.normalizeProviderId(p.providerId, CODEX_RESERVED_PROVIDERS),
     providerName: p.providerName?.trim(),
-    baseUrl: normalizeBaseUrl(p.baseUrl),
-    apiKey: normalizeSecret(p.apiKey),
-    model: normalizeModelId(p.model),
+    baseUrl: pi.normalizeBaseUrl(p.baseUrl),
+    apiKey: pi.normalizeSecret(p.apiKey),
+    model: pi.normalizeModelId(p.model),
     activate: p.activate
   };
 }
@@ -3684,25 +3578,25 @@ const codexAdapter = {
   files: (ctx) => [{ role: ROLE, path: codexConfigPath(ctx) }],
   view(files, ctx, opts) {
     const doc = parseToml(files[ROLE].content);
-    const current = currentOf$2(doc, selectProvider(doc, opts.providerId), ctx);
-    return { current, providers: Object.keys(providersOf$1(doc)), pickerModels: uniq([current.model]), warnings: warningsOf$2(doc, current) };
+    const current = currentOf$1(doc, selectProvider(doc, opts.providerId), ctx);
+    return { current, providers: Object.keys(providersOf(doc)), pickerModels: pi.uniq([current.model]), warnings: warningsOf$1(doc, current) };
   },
   plan(files, raw, ctx) {
     const patch = parsePatch(raw);
     const original = files[ROLE].content;
     const before = parseToml(original);
-    const existing = providersOf$1(before)[patch.providerId];
+    const existing = providersOf(before)[patch.providerId];
     const table = ["model_providers", patch.providerId];
     const edits = [];
     const secrets = [];
-    if (!existing && !patch.baseUrl) fail("invalid-input", "A new provider needs a base URL");
-    const name = patch.providerName || str$3(existing?.name) || patch.providerId;
-    if (!existing || patch.providerName && patch.providerName !== existing.name || !str$3(existing.name)) edits.push({ table, key: "name", value: name });
+    if (!existing && !patch.baseUrl) pi.fail("invalid-input", "A new provider needs a base URL");
+    const name = patch.providerName || str$2(existing?.name) || patch.providerId;
+    if (!existing || patch.providerName && patch.providerName !== existing.name || !str$2(existing.name)) edits.push({ table, key: "name", value: name });
     if (patch.baseUrl !== void 0) {
-      if (patch.baseUrl === null && existing) fail("invalid-input", "A provider needs a base URL; remove the provider instead");
+      if (patch.baseUrl === null && existing) pi.fail("invalid-input", "A provider needs a base URL; remove the provider instead");
       edits.push({ table, key: "base_url", value: patch.baseUrl });
     }
-    if (!existing || str$3(existing.wire_api) && existing.wire_api !== "responses") edits.push({ table, key: "wire_api", value: "responses" });
+    if (!existing || str$2(existing.wire_api) && existing.wire_api !== "responses") edits.push({ table, key: "wire_api", value: "responses" });
     switch (patch.apiKey.mode) {
       case "literal":
         edits.push({ table, key: "experimental_bearer_token", value: patch.apiKey.value }, { table, key: "env_key", value: null });
@@ -3717,19 +3611,19 @@ const codexAdapter = {
     }
     if (patch.model !== void 0) edits.push({ table: [], key: "model", value: patch.model });
     if (patch.activate === true) edits.push({ table: [], key: "model_provider", value: patch.providerId });
-    if (patch.activate === false && str$3(before.model_provider) === patch.providerId) edits.push({ table: [], key: "model_provider", value: null });
-    const effective = edits.filter((e) => "removeTable" in e || getPath$1(before, [...e.table, e.key]) !== (e.value ?? void 0));
+    if (patch.activate === false && str$2(before.model_provider) === patch.providerId) edits.push({ table: [], key: "model_provider", value: null });
+    const effective = edits.filter((e) => "removeTable" in e || pi.getPath(before, [...e.table, e.key]) !== (e.value ?? void 0));
     const content = effective.length ? editToml(original, effective) : void 0;
     const after = content === void 0 ? before : parseToml(content);
-    const current = currentOf$2(after, patch.providerId, ctx);
+    const current = currentOf$1(after, patch.providerId, ctx);
     const changedKeys = effective.map((e) => [...e.table, "removeTable" in e ? "*" : e.key].join("."));
-    return { contents: { [ROLE]: content }, warnings: warningsOf$2(after, current), changedKeys, secrets };
+    return { contents: { [ROLE]: content }, warnings: warningsOf$1(after, current), changedKeys, secrets };
   },
   secretsIn(_role, content) {
     try {
-      return collectSecretValues(parseToml(content));
+      return pi.collectSecretValues(parseToml(content));
     } catch (error) {
-      if (error instanceof mirrorProtocol.ModelConfigError) return /* @__PURE__ */ new Set();
+      if (error instanceof fileStore.ModelConfigError) return /* @__PURE__ */ new Set();
       throw error;
     }
   }
@@ -4065,35 +3959,35 @@ function editDotenv(text, edits) {
   const before = mainExports.parse(text);
   const after = mainExports.parse(out);
   for (const edit of edits) {
-    if ((after[edit.key] ?? null) !== edit.value) throw new mirrorProtocol.ModelConfigError("unsafe-edit", `.env edit did not produce ${edit.key} as requested`);
+    if ((after[edit.key] ?? null) !== edit.value) throw new fileStore.ModelConfigError("unsafe-edit", `.env edit did not produce ${edit.key} as requested`);
     delete before[edit.key];
     delete after[edit.key];
   }
   if (JSON.stringify(Object.entries(before).sort()) !== JSON.stringify(Object.entries(after).sort())) {
-    throw new mirrorProtocol.ModelConfigError("unsafe-edit", ".env edit would change other variables");
+    throw new fileStore.ModelConfigError("unsafe-edit", ".env edit would change other variables");
   }
   return out;
 }
 
-const SETTINGS$1 = "settings";
+const SETTINGS = "settings";
 const ENV = "env";
 const BASE_URL = "GOOGLE_GEMINI_BASE_URL";
 const API_KEY = "GEMINI_API_KEY";
 function geminiDir(ctx) {
   return path.join(ctx.env.GEMINI_CLI_HOME?.trim() || ctx.home, ".gemini");
 }
-const str$2 = (v) => typeof v === "string" && v.trim() ? v : null;
-function currentOf$1(settings, env, ctx) {
-  const literal = str$2(env[API_KEY]);
-  const apiKey = literal ? { mode: "literal", masked: maskSecret(literal) } : ctx.env[API_KEY] ? { mode: "env", envName: API_KEY, envPresent: true } : { mode: "none" };
-  return { baseUrl: str$2(env[BASE_URL]), apiKey, model: str$2(getPath$1(settings, ["model", "name"])) };
+const str$1 = (v) => typeof v === "string" && v.trim() ? v : null;
+function currentOf(settings, env, ctx) {
+  const literal = str$1(env[API_KEY]);
+  const apiKey = literal ? { mode: "literal", masked: pi.maskSecret(literal) } : ctx.env[API_KEY] ? { mode: "env", envName: API_KEY, envPresent: true } : { mode: "none" };
+  return { baseUrl: str$1(env[BASE_URL]), apiKey, model: str$1(pi.getPath(settings, ["model", "name"])) };
 }
-function warningsOf$1(settings, current) {
-  const out = [...baseUrlWarnings(current.baseUrl, "gemini")];
+function warningsOf(settings, current) {
+  const out = [...pi.baseUrlWarnings(current.baseUrl, "gemini")];
   if (current.baseUrl || current.apiKey?.mode === "literal") {
     out.push({ code: "project-env-shadows", message: "~/.gemini/.env is used only when the session folder (or a parent) has no .gemini/.env or .env of its own." });
   }
-  const selected = str$2(getPath$1(settings, ["security", "auth", "selectedType"]));
+  const selected = str$1(pi.getPath(settings, ["security", "auth", "selectedType"]));
   if (current.baseUrl && selected && selected !== "gateway") {
     out.push({ code: "auth-type-pinned", message: `security.auth.selectedType is "${selected}"; Gemini only uses GOOGLE_GEMINI_BASE_URL with the gateway auth type.` });
   }
@@ -4105,28 +3999,28 @@ function warningsOf$1(settings, current) {
 const geminiAdapter = {
   id: "gemini",
   binary: "gemini",
-  files: (ctx) => [{ role: SETTINGS$1, path: path.join(geminiDir(ctx), "settings.json") }, { role: ENV, path: path.join(geminiDir(ctx), ".env") }],
+  files: (ctx) => [{ role: SETTINGS, path: path.join(geminiDir(ctx), "settings.json") }, { role: ENV, path: path.join(geminiDir(ctx), ".env") }],
   view(files, ctx) {
-    const settings = parseJsonObject$1(files[SETTINGS$1].content, "settings.json");
-    const current = currentOf$1(settings, parseDotenv(files[ENV].content), ctx);
-    return { current, pickerModels: uniq([current.model]), warnings: warningsOf$1(settings, current) };
+    const settings = pi.parseJsonObject(files[SETTINGS].content, "settings.json");
+    const current = currentOf(settings, parseDotenv(files[ENV].content), ctx);
+    return { current, pickerModels: pi.uniq([current.model]), warnings: warningsOf(settings, current) };
   },
   plan(files, raw, ctx) {
     const p = raw;
-    const baseUrl = normalizeBaseUrl(p.baseUrl);
-    const apiKey = normalizeSecret(p.apiKey, ["keep", "clear", "literal"]);
-    const model = normalizeModelId(p.model);
-    const settingsText = files[SETTINGS$1].content;
-    const before = parseJsonObject$1(settingsText, "settings.json");
+    const baseUrl = pi.normalizeBaseUrl(p.baseUrl);
+    const apiKey = pi.normalizeSecret(p.apiKey, ["keep", "clear", "literal"]);
+    const model = pi.normalizeModelId(p.model);
+    const settingsText = files[SETTINGS].content;
+    const before = pi.parseJsonObject(settingsText, "settings.json");
     const settings = structuredClone(before);
     const changedKeys = [];
     let settingsOut;
-    if (model !== void 0 && (str$2(getPath$1(before, ["model", "name"])) ?? null) !== model) {
+    if (model !== void 0 && (str$1(pi.getPath(before, ["model", "name"])) ?? null) !== model) {
       const hadModel = settings.model !== void 0;
-      const modelObj = childObject(settings, "model", "settings");
-      setOrDelete(modelObj, "name", model);
+      const modelObj = pi.childObject(settings, "model", "settings");
+      pi.setOrDelete(modelObj, "name", model);
       if (!hadModel && Object.keys(modelObj).length === 0) delete settings.model;
-      settingsOut = stringifyLike(settingsText, settings);
+      settingsOut = pi.stringifyLike(settingsText, settings);
       changedKeys.push("settings.model.name");
     }
     const envText = files[ENV].content;
@@ -4138,160 +4032,17 @@ const geminiAdapter = {
     const envOut = edits.length ? editDotenv(envText, edits) : void 0;
     changedKeys.push(...edits.map((e) => `.env.${e.key}`));
     const afterEnv = envOut === void 0 ? env : parseDotenv(envOut);
-    const current = currentOf$1(settings, afterEnv, ctx);
+    const current = currentOf(settings, afterEnv, ctx);
     return {
-      contents: { [SETTINGS$1]: settingsOut, [ENV]: envOut },
-      warnings: warningsOf$1(settings, current),
+      contents: { [SETTINGS]: settingsOut, [ENV]: envOut },
+      warnings: warningsOf(settings, current),
       changedKeys,
       secrets: apiKey.mode === "literal" ? [apiKey.value] : []
     };
   },
   secretsIn(role, content) {
     try {
-      return role === ENV ? collectSecretValues(parseDotenv(content)) : collectSecretValues(parseJsonObject$1(content, "settings.json"));
-    } catch {
-      return /* @__PURE__ */ new Set();
-    }
-  }
-};
-
-const MODELS = "models";
-const SETTINGS = "settings";
-const PI_APIS = ["openai-completions", "openai-responses", "anthropic-messages", "google-generative-ai", "mistral-conversations"];
-const ENV_REF = /^\$\{?([A-Za-z_][A-Za-z0-9_]*)\}?$/;
-function piAgentDir(ctx) {
-  return ctx.env.PI_CODING_AGENT_DIR?.trim() || path.join(ctx.home, ".pi", "agent");
-}
-const str$1 = (v) => typeof v === "string" && v.trim() ? v : null;
-function providersOf(models) {
-  const p = models.providers;
-  if (!p || typeof p !== "object" || Array.isArray(p)) return {};
-  return Object.fromEntries(Object.entries(p).filter(([, v]) => v && typeof v === "object" && !Array.isArray(v)));
-}
-function modelIds(provider) {
-  const list = provider?.models;
-  return Array.isArray(list) ? list.flatMap((m) => m && typeof m === "object" && typeof m.id === "string" ? [m.id] : []) : [];
-}
-function secretView(provider, ctx) {
-  const key = str$1(provider?.apiKey);
-  if (!key) return { mode: "none" };
-  const ref = ENV_REF.exec(key.trim());
-  if (ref) return { mode: "env", envName: ref[1], envPresent: !!ctx.env[ref[1]] };
-  if (key.trim().startsWith("!")) return { mode: "command" };
-  return { mode: "literal", masked: maskSecret(key) };
-}
-function currentOf(models, settings, providerId, ctx) {
-  const provider = providerId ? providersOf(models)[providerId] : void 0;
-  const activeProvider = str$1(settings.defaultProvider);
-  return {
-    providerId,
-    baseUrl: str$1(provider?.baseUrl),
-    api: str$1(provider?.api),
-    apiKey: secretView(provider, ctx),
-    models: modelIds(provider),
-    activeProvider,
-    defaultModel: str$1(settings.defaultModel),
-    active: !!providerId && activeProvider === providerId
-  };
-}
-function pickerModelsOf(models) {
-  return uniq(Object.entries(providersOf(models)).flatMap(([id, p]) => modelIds(p).map((m) => `${id}/${m}`)));
-}
-function warningsOf(settings, current) {
-  const out = [...baseUrlWarnings(current.baseUrl, current.api === "anthropic-messages" ? "anthropic" : "openai")].filter((w) => w.code !== "base-url-v1");
-  if (current.apiKey?.mode === "env" && !current.apiKey.envPresent) {
-    out.push({ code: "env-missing", message: `${current.apiKey.envName} is not set in the daemon's environment; pi hides models whose key cannot be resolved.` });
-  }
-  if (current.providerId && current.apiKey?.mode === "none") {
-    out.push({ code: "no-key", message: "pi hides models whose provider has no resolvable API key." });
-  }
-  if (Array.isArray(settings.enabledModels) && current.providerId) {
-    const enabled = settings.enabledModels;
-    const hidden = (current.models ?? []).filter((m) => !enabled.includes(`${current.providerId}/${m}`) && !enabled.includes(m));
-    if (hidden.length) out.push({ code: "enabled-models-filter", message: `settings.json enabledModels does not include ${hidden.join(", ")}.` });
-  }
-  return out;
-}
-const piAdapter = {
-  id: "pi",
-  binary: "pi",
-  files: (ctx) => [{ role: MODELS, path: path.join(piAgentDir(ctx), "models.json") }, { role: SETTINGS, path: path.join(piAgentDir(ctx), "settings.json") }],
-  view(files, ctx, opts) {
-    const models = parseJsonObject$1(files[MODELS].content, "models.json");
-    const settings = parseJsonObject$1(files[SETTINGS].content, "settings.json");
-    const providers = providersOf(models);
-    const active = str$1(settings.defaultProvider);
-    const selected = opts.providerId ?? (active && providers[active] ? active : Object.keys(providers)[0] ?? null);
-    const current = currentOf(models, settings, selected, ctx);
-    return { current, providers: Object.keys(providers), pickerModels: pickerModelsOf(models), warnings: warningsOf(settings, current) };
-  },
-  plan(files, raw, ctx) {
-    const p = raw;
-    const providerId = normalizeProviderId(p.providerId);
-    const baseUrl = normalizeBaseUrl(p.baseUrl);
-    if (p.api !== void 0 && !PI_APIS.includes(p.api)) fail("invalid-input", `api must be one of ${PI_APIS.join(", ")}`);
-    const apiKey = normalizeSecret(p.apiKey);
-    if (apiKey.mode === "literal" && /^[$!]/.test(apiKey.value)) fail("invalid-input", "pi treats a key starting with $ or ! as an env reference / command; use the environment-variable mode");
-    const ids = normalizeModelList(p.models);
-    const defaultModel = normalizeModelId(p.defaultModel, "defaultModel");
-    if (p.activate !== void 0 && typeof p.activate !== "boolean") fail("invalid-input", "activate must be a boolean");
-    const modelsText = files[MODELS].content;
-    const settingsText = files[SETTINGS].content;
-    const modelsBefore = parseJsonObject$1(modelsText, "models.json");
-    const settingsBefore = parseJsonObject$1(settingsText, "settings.json");
-    const models = structuredClone(modelsBefore);
-    const settings = structuredClone(settingsBefore);
-    const providers = childObject(models, "providers", "models.json");
-    const isNew = providers[providerId] === void 0;
-    if (isNew && !baseUrl) fail("invalid-input", "A new provider needs a base URL");
-    const provider = childObject(providers, providerId, "models.json.providers");
-    if (baseUrl !== void 0) {
-      if (baseUrl === null) fail("invalid-input", "A provider needs a base URL");
-      provider.baseUrl = baseUrl;
-    }
-    if (p.api !== void 0) provider.api = p.api;
-    else if (isNew) provider.api = "openai-completions";
-    const secrets = [];
-    if (apiKey.mode === "literal") {
-      provider.apiKey = apiKey.value;
-      secrets.push(apiKey.value);
-    }
-    if (apiKey.mode === "env") provider.apiKey = `\${${apiKey.name}}`;
-    if (apiKey.mode === "clear") delete provider.apiKey;
-    if (ids !== void 0) {
-      const existing = Array.isArray(provider.models) ? provider.models : [];
-      const next = ids.map((id) => existing.find((m) => m && typeof m === "object" && m.id === id) ?? { id });
-      if (next.length) provider.models = next;
-      else delete provider.models;
-    }
-    const finalIds = modelIds(provider);
-    if (p.activate === true) {
-      settings.defaultProvider = providerId;
-      const chosen = defaultModel ?? (finalIds.includes(str$1(settings.defaultModel) ?? "") ? str$1(settings.defaultModel) : finalIds[0]);
-      setOrDelete(settings, "defaultModel", chosen);
-    } else if (p.activate === false && str$1(settings.defaultProvider) === providerId) {
-      delete settings.defaultProvider;
-      delete settings.defaultModel;
-    } else if (defaultModel !== void 0 && str$1(settings.defaultProvider) === providerId) {
-      setOrDelete(settings, "defaultModel", defaultModel);
-    }
-    if (defaultModel && !finalIds.includes(defaultModel)) fail("invalid-input", "defaultModel must be one of the provider models");
-    const modelKeys = changedPaths(modelsBefore, models, [["providers", providerId, "baseUrl"], ["providers", providerId, "api"], ["providers", providerId, "apiKey"], ["providers", providerId, "models"]]);
-    const settingsKeys = changedPaths(settingsBefore, settings, [["defaultProvider"], ["defaultModel"]]);
-    const current = currentOf(models, settings, providerId, ctx);
-    return {
-      contents: {
-        [MODELS]: modelKeys.length ? stringifyLike(modelsText, models) : void 0,
-        [SETTINGS]: settingsKeys.length ? stringifyLike(settingsText, settings) : void 0
-      },
-      warnings: warningsOf(settings, current),
-      changedKeys: [...modelKeys.map((k) => `models.json.${k}`), ...settingsKeys.map((k) => `settings.json.${k}`)],
-      secrets
-    };
-  },
-  secretsIn(_role, content) {
-    try {
-      return collectSecretValues(parseJsonObject$1(content, "pi config"));
+      return role === ENV ? pi.collectSecretValues(parseDotenv(content)) : pi.collectSecretValues(pi.parseJsonObject(content, "settings.json"));
     } catch {
       return /* @__PURE__ */ new Set();
     }
@@ -4301,17 +4052,17 @@ const piAdapter = {
 const MODEL_CONFIG_CAPABILITY_VERSION = 1;
 const HARNESS_IDS = ["claude", "codex", "gemini", "pi"];
 
-const ADAPTERS = { claude: claudeAdapter, codex: codexAdapter, gemini: geminiAdapter, pi: piAdapter };
+const ADAPTERS = { claude: claudeAdapter, codex: codexAdapter, gemini: geminiAdapter, pi: pi.piAdapter };
 function harnessOf(value) {
   if (typeof value !== "string" || !HARNESS_IDS.includes(value)) {
-    throw new mirrorProtocol.ModelConfigError("invalid-harness", `harness must be one of ${HARNESS_IDS.join(", ")}`);
+    throw new fileStore.ModelConfigError("invalid-harness", `harness must be one of ${HARNESS_IDS.join(", ")}`);
   }
   return value;
 }
 class ModelConfigService {
   constructor(opts) {
     this.opts = opts;
-    this.backups = new mirrorProtocol.BackupStore(path.join(opts.happyHomeDir, "model-config-backups"));
+    this.backups = new fileStore.BackupStore(path.join(opts.happyHomeDir, "model-config-backups"));
     this.auditPath = path.join(opts.happyHomeDir, "model-config-audit.jsonl");
   }
   backups;
@@ -4328,8 +4079,8 @@ class ModelConfigService {
   }
   async loadFiles(adapter) {
     const files = {};
-    for (const { role, path } of adapter.files(this.ctx)) files[role] = await mirrorProtocol.readConfigFile(path);
-    const baseHash = mirrorProtocol.sha256(Object.entries(files).map(([role, f]) => `${role}\0${f.exists ? f.hash : "-"}`).join("\n"));
+    for (const { role, path } of adapter.files(this.ctx)) files[role] = await fileStore.readConfigFile(path);
+    const baseHash = fileStore.sha256(Object.entries(files).map(([role, f]) => `${role}\0${f.exists ? f.hash : "-"}`).join("\n"));
     return { files, baseHash };
   }
   async readOne(harness, providerId) {
@@ -4377,7 +4128,7 @@ class ModelConfigService {
       if (target === null && !file.exists) continue;
       const secrets = [...adapter.secretsIn(role, file.content), ...target ? adapter.secretsIn(role, target) : [], ...extraSecrets];
       const raw = unifiedDiff(file.content, newText, file.path);
-      out.push({ path: file.path, diff: redactText(raw, secrets), created: !file.exists && target !== null, deleted: target === null && file.exists });
+      out.push({ path: file.path, diff: pi.redactText(raw, secrets), created: !file.exists && target !== null, deleted: target === null && file.exists });
     }
     return out;
   }
@@ -4388,7 +4139,7 @@ class ModelConfigService {
     for (const [role, target] of touched) {
       const file = files[role];
       if (target.content === null) await node_fs.promises.rm(file.path, { force: true });
-      else await mirrorProtocol.atomicWriteFile(file.path, target.content, file.mode ?? target.mode);
+      else await fileStore.atomicWriteFile(file.path, target.content, file.mode ?? target.mode);
     }
     await this.audit({ at: this.opts.now?.() ?? Date.now(), action, harness, files: touched.map(([role]) => files[role].path), keys, apiKeyMode, backupId: backup.id });
     this.opts.onChanged?.(harness);
@@ -4405,13 +4156,13 @@ class ModelConfigService {
   apply(params) {
     const run = async () => {
       const patch = params.patch;
-      if (!patch || typeof patch !== "object") throw new mirrorProtocol.ModelConfigError("invalid-input", "patch is required");
+      if (!patch || typeof patch !== "object") throw new fileStore.ModelConfigError("invalid-input", "patch is required");
       const harness = harnessOf(patch.harness);
       const adapter = ADAPTERS[harness];
       const { files, baseHash } = await this.loadFiles(adapter);
       const dryRun = params.dryRun !== false;
       if (!dryRun && params.baseHash !== baseHash) {
-        throw new mirrorProtocol.ModelConfigError("conflict", "The config files changed since the preview; review the new diff and apply again");
+        throw new fileStore.ModelConfigError("conflict", "The config files changed since the preview; review the new diff and apply again");
       }
       const plan = adapter.plan(files, patch, this.ctx);
       const diffs = this.diffs(adapter, files, plan.contents, plan.secrets);
@@ -4431,18 +4182,18 @@ class ModelConfigService {
     const run = async () => {
       const harness = harnessOf(params.harness);
       const adapter = ADAPTERS[harness];
-      if (typeof params.backupId !== "string") throw new mirrorProtocol.ModelConfigError("invalid-input", "backupId is required");
+      if (typeof params.backupId !== "string") throw new fileStore.ModelConfigError("invalid-input", "backupId is required");
       const saved = await this.backups.read(harness, params.backupId);
       const { files, baseHash } = await this.loadFiles(adapter);
       const dryRun = params.dryRun !== false;
       if (!dryRun && params.baseHash !== baseHash) {
-        throw new mirrorProtocol.ModelConfigError("conflict", "The config files changed since the preview; review the new diff and restore again");
+        throw new fileStore.ModelConfigError("conflict", "The config files changed since the preview; review the new diff and restore again");
       }
       const allowed = new Map(Object.entries(files).map(([role, f]) => [f.path, role]));
       const target = {};
       for (const file of saved) {
         const role = allowed.get(file.path);
-        if (!role) throw new mirrorProtocol.ModelConfigError("backup-mismatch", "Backup does not belong to the current config location");
+        if (!role) throw new fileStore.ModelConfigError("backup-mismatch", "Backup does not belong to the current config location");
         target[role] = { content: file.content, mode: file.mode };
       }
       const diffs = this.diffs(adapter, files, Object.fromEntries(Object.entries(target).map(([r, v]) => [r, v?.content])), []);
@@ -4457,7 +4208,7 @@ class ModelConfigService {
   }
 }
 function toError(error) {
-  if (error instanceof mirrorProtocol.ModelConfigError) return { code: error.code, message: error.message };
+  if (error instanceof fileStore.ModelConfigError) return { code: error.code, message: error.message };
   return { code: "read-failed", message: error instanceof Error ? error.message : String(error) };
 }
 
@@ -4790,26 +4541,45 @@ function createUpdateController(deps) {
   let blocked = false;
   let handoverHold;
   let lastPublished = "";
+  let autoUpdateEnabled;
+  let lastInstall = (() => {
+    try {
+      return deps.lastInstall?.read() ?? null;
+    } catch {
+      return null;
+    }
+  })();
   const now = deps.now ?? Date.now;
+  function snapshot() {
+    return {
+      ...policy,
+      retrySupported: !blocked,
+      manualUpdateSupported: !blocked,
+      handoverHold,
+      autoUpdate: outcome,
+      ...autoUpdateEnabled === void 0 ? {} : { autoUpdateEnabled },
+      ...lastInstall ? { lastInstall } : {}
+    };
+  }
   function validManualTarget(next, version) {
     return version === next.recommendedVersion && Number.isFinite(next.checkedAt) && now() - next.checkedAt <= 65 * 6e4 && next.checkedAt <= now() + 6e4 && cliUpdate.compareExactVersions(next.currentVersion, version) === -1 && (!next.minimumVersion || [0, 1].includes(cliUpdate.compareExactVersions(version, next.minimumVersion) ?? -1));
   }
   function publish(state, version, detail) {
     if (!policy) return;
-    const fingerprint = JSON.stringify([policy.checkedAt, state, version, detail, manualVersion]);
+    const fingerprint = JSON.stringify([policy.checkedAt, state, version, detail, manualVersion, autoUpdateEnabled]);
     if (fingerprint === lastPublished) return;
     lastPublished = fingerprint;
     outcome = { state, version, detail, at: now(), ...manualVersion ? { source: "manual" } : {} };
-    deps.publish({ ...policy, retrySupported: !blocked, manualUpdateSupported: !blocked, handoverHold, autoUpdate: outcome });
+    deps.publish(snapshot());
   }
   async function evaluate() {
     if (!policy || running) return;
     const target = manualVersion ?? policy.autoUpdateVersion ?? null;
     if (outcome?.version === target && ["failed", "installed", "manual_required"].includes(outcome.state)) {
-      const fingerprint = JSON.stringify([policy.checkedAt, outcome.state, outcome.version, outcome.detail, manualVersion]);
+      const fingerprint = JSON.stringify([policy.checkedAt, outcome.state, outcome.version, outcome.detail, manualVersion, autoUpdateEnabled]);
       if (fingerprint !== lastPublished) {
         lastPublished = fingerprint;
-        deps.publish({ ...policy, retrySupported: !blocked, manualUpdateSupported: !blocked, handoverHold, autoUpdate: outcome });
+        deps.publish(snapshot());
       }
       return;
     }
@@ -4817,9 +4587,12 @@ function createUpdateController(deps) {
       publish("policy_stale", target);
       return;
     }
-    if (!manualVersion && !await deps.enabled()) {
-      publish("disabled", target);
-      return;
+    if (!manualVersion) {
+      autoUpdateEnabled = await deps.enabled();
+      if (!autoUpdateEnabled) {
+        publish("disabled", target);
+        return;
+      }
     }
     if (running) return;
     if (now() - policy.checkedAt > 65 * 6e4) {
@@ -4849,6 +4622,13 @@ function createUpdateController(deps) {
         return;
       }
       blocked = code === "blocked";
+      if (code === 0) {
+        lastInstall = { from: policy.currentVersion, to: target, at: now(), source: manualVersion ? "manual" : "auto" };
+        try {
+          deps.lastInstall?.write(lastInstall);
+        } catch {
+        }
+      }
       publish(
         blocked ? "manual_required" : code === 0 ? "installed" : "failed",
         target,
@@ -4950,7 +4730,224 @@ function createUpdateController(deps) {
     handoverHold = { reason, at: now() };
     publish("failed", manualVersion ?? policy?.autoUpdateVersion ?? null, "handover_preflight_failed");
   }
-  return { refresh, retry, request, tick, withHandover, holdHandover, isRunning: () => running };
+  return { refresh, retry, request, tick, withHandover, holdHandover, isRunning: () => running, currentTarget: () => policy?.autoUpdateVersion ?? null };
+}
+
+function parseLastInstall(raw) {
+  if (!raw || typeof raw !== "object") return null;
+  const { from, to, at, source } = raw;
+  if (typeof from !== "string" || typeof to !== "string" || !cliUpdate.parseExactVersion(from) || !cliUpdate.parseExactVersion(to)) return null;
+  if (typeof at !== "number" || !Number.isFinite(at) || source !== "auto" && source !== "manual") return null;
+  return { from, to, at, source };
+}
+function lastInstallStore(homeDir) {
+  const file = path.join(homeDir, "cli-update-last.json");
+  return {
+    read() {
+      try {
+        return parseLastInstall(JSON.parse(node_fs.readFileSync(file, "utf8")));
+      } catch {
+        return null;
+      }
+    },
+    write(record) {
+      const tmp = `${file}.${process.pid}.tmp`;
+      node_fs.writeFileSync(tmp, JSON.stringify(record));
+      node_fs.renameSync(tmp, file);
+    }
+  };
+}
+
+const ANNOUNCE_FIRST_DELAY_MS = 9e4;
+const ANNOUNCE_JITTER_MS = 6e4;
+const ANNOUNCE_FOLLOW_UP_MS = 5 * 6e4;
+function announcedVersion(payload) {
+  if (!payload || typeof payload !== "object") return null;
+  const raw = payload.autoUpdateVersion;
+  if (typeof raw !== "string" || raw.length > 64) return null;
+  return cliUpdate.parseExactVersion(raw)?.exact ?? null;
+}
+function createPolicyAnnouncementHandler(deps) {
+  const random = deps.random ?? Math.random;
+  const setTimer = deps.setTimer ?? ((fn, ms) => {
+    const t = setTimeout(fn, ms);
+    t.unref?.();
+    return t;
+  });
+  const clearTimer = deps.clearTimer ?? ((handle) => clearTimeout(handle));
+  let timer = null;
+  let pending = null;
+  let stopped = false;
+  function schedule(version, ms, followUp) {
+    if (timer !== null) clearTimer(timer);
+    pending = version;
+    timer = setTimer(() => {
+      timer = null;
+      void deps.refresh().catch(() => void 0).finally(() => {
+        if (stopped || pending !== version) return;
+        if (deps.currentTarget() === version || !followUp) {
+          pending = null;
+          return;
+        }
+        schedule(version, ANNOUNCE_FOLLOW_UP_MS, false);
+      });
+    }, ms);
+  }
+  return {
+    /** Socket handler. Returns the scheduled delay (ms) or null when ignored — for logs and tests. */
+    onAnnouncement(payload) {
+      if (stopped) return null;
+      const version = announcedVersion(payload);
+      if (!version || version === deps.currentTarget() || version === pending) return null;
+      const delay = ANNOUNCE_FIRST_DELAY_MS + Math.floor(random() * ANNOUNCE_JITTER_MS);
+      schedule(version, delay, true);
+      return delay;
+    },
+    stop() {
+      stopped = true;
+      if (timer !== null) clearTimer(timer);
+      timer = null;
+    }
+  };
+}
+
+const HARNESS_INSTALL_CATALOG = Object.freeze({
+  claude: Object.freeze({ packages: [{ name: "@anthropic-ai/claude-code", spec: "latest" }], commands: ["claude"], minNode: "22.0.0", scripts: true }),
+  codex: Object.freeze({ packages: [{ name: "@openai/codex", spec: "latest" }], commands: ["codex"], minNode: "16.0.0", scripts: false }),
+  gemini: Object.freeze({ packages: [{ name: "@google/gemini-cli", spec: "latest" }], commands: ["gemini"], minNode: "20.0.0", scripts: false }),
+  pi: Object.freeze({
+    packages: [{ name: "@earendil-works/pi-coding-agent", spec: "latest" }, { name: "pi-acp", spec: "0.0.33" }],
+    commands: ["pi", "pi-acp"],
+    minNode: "22.19.0",
+    scripts: false
+  })
+});
+function harnessInstallArgs(id, prefix) {
+  const entry = HARNESS_INSTALL_CATALOG[id];
+  if (!entry) throw new Error("Unknown harness");
+  const args = ["i", "-g", `--prefix=${prefix}`, "--no-fund", "--no-audit", ...entry.scripts ? [] : ["--ignore-scripts"], ...entry.packages.map((p) => `${p.name}@${p.spec}`)];
+  if (args.some((arg) => !doctor.NPM_SAFE_ARG.test(arg))) throw new Error("Unsafe npm argument");
+  return args;
+}
+function parseNode(version) {
+  const m = /^v?(\d+)\.(\d+)\.(\d+)/.exec(version.trim());
+  return m ? [Number(m[1]), Number(m[2]), Number(m[3])] : null;
+}
+function nodeSatisfies(current, minimum) {
+  const a = parseNode(current);
+  const b = parseNode(minimum);
+  if (!a || !b) return false;
+  for (let i = 0; i < 3; i++) if (a[i] !== b[i]) return a[i] > b[i];
+  return true;
+}
+
+async function defaultCanWrite(path) {
+  try {
+    await promises.access(path, promises.constants.W_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function defaultIsPlainDirectory(path) {
+  try {
+    const s = await promises.lstat(path);
+    return s.isDirectory() && !s.isSymbolicLink();
+  } catch {
+    return false;
+  }
+}
+function redactNpmText(text) {
+  return text.replace(/(_authToken|_auth|_password|token|password)\s*=\s*\S+/gi, "$1=***").replace(/Bearer\s+\S+/gi, "Bearer ***").replace(/([a-z][a-z0-9+.-]*:\/\/)[^\s/@:]+(:[^\s/@]*)?@/gi, "$1***@").replace(/\/(home|Users)\/[^/\s]+/g, "~").replace(/\/root(?=\/|\s|$)/g, "~");
+}
+function summarizeNpmFailure(result) {
+  const tail = `${result.stderr ?? ""}
+${result.stdout ?? ""}`.trim().split("\n").filter((line) => /npm (error|ERR!)|EACCES|ENOTFOUND|ETARGET|E404|engine/i.test(line)).slice(-3).join(" | ");
+  const code = result.code === null ? "npm_timeout" : `npm_exit_${result.code}`;
+  const safe = redactNpmText(tail).slice(0, 300);
+  return safe ? `${code}: ${safe}` : code;
+}
+function createHarnessInstaller(deps) {
+  const now = deps.now ?? Date.now;
+  const canWrite = deps.canWrite ?? defaultCanWrite;
+  const isPlainDirectory = deps.isPlainDirectory ?? defaultIsPlainDirectory;
+  let running = null;
+  let blocked = false;
+  const nodeVersion = deps.nodeVersion ?? process.versions.node;
+  async function installPrefix() {
+    const prefix = doctor.globalPrefixForPackage(deps.runningPackageDir);
+    if (!prefix || !await isPlainDirectory(deps.runningPackageDir)) return { error: "install_location_unverified" };
+    for (const path$1 of [path.dirname(deps.runningPackageDir), path.join(prefix, "bin")]) {
+      if (!await canWrite(path$1)) return { error: "install_location_not_writable" };
+    }
+    return { prefix };
+  }
+  async function run(harness, prefix, startedAt) {
+    const publish = (state, detail) => deps.publish({ harness, state, ...detail ? { detail } : {}, startedAt, at: now() });
+    try {
+      const args = harnessInstallArgs(harness, prefix);
+      deps.log(`[HARNESS] installing ${harness}: npm ${args.join(" ")}`);
+      const result = await deps.npm(args);
+      if (result.terminationConfirmed === false) {
+        blocked = true;
+        deps.log(`[HARNESS] ${harness} install timed out and npm could not be confirmed stopped; holding the npm tree until the daemon restarts`);
+        publish("failed", "installer_termination_unconfirmed");
+        return;
+      }
+      if (result.code !== 0) {
+        const detail = summarizeNpmFailure(result);
+        deps.log(`[HARNESS] ${harness} install failed: ${detail}`);
+        publish("failed", detail);
+        return;
+      }
+      const missing = HARNESS_INSTALL_CATALOG[harness].commands.filter((command) => !deps.commandOnPath(command));
+      if (missing.length > 0) {
+        const detail = `not_on_path: ${missing.join(", ")}`;
+        deps.log(`[HARNESS] ${harness} installed into ${prefix} but ${detail}`);
+        publish("failed", detail);
+        return;
+      }
+      await deps.afterInstall().catch((error) => deps.log(`[HARNESS] refresh after ${harness} install failed: ${String(error)}`));
+      deps.log(`[HARNESS] ${harness} installed`);
+      publish("installed");
+    } catch (error) {
+      deps.log(`[HARNESS] ${harness} install error: ${String(error)}`);
+      publish("failed", "install_error");
+    } finally {
+      if (!blocked) running = null;
+    }
+  }
+  return {
+    /** True while npm may be writing the prefix — including after an unconfirmed kill. */
+    isRunning: () => running !== null || blocked,
+    async request(params) {
+      const harness = params && typeof params === "object" ? params.harness : void 0;
+      if (!index.isHarnessInstallId(harness)) {
+        deps.log(`[HARNESS] refused install request for an unknown harness`);
+        return { error: "unknown_harness" };
+      }
+      if (blocked) return { error: "installer_blocked" };
+      if (running) return { error: "install_in_progress" };
+      if (deps.cliUpdateBusy()) return { error: "cli_update_in_progress" };
+      const minNode = HARNESS_INSTALL_CATALOG[harness].minNode;
+      if (!nodeSatisfies(nodeVersion, minNode)) {
+        deps.log(`[HARNESS] ${harness} install refused: needs Node ${minNode}+, daemon runs ${nodeVersion}`);
+        return { error: "node_too_old", required: minNode, current: nodeVersion };
+      }
+      running = harness;
+      const location = await installPrefix();
+      if ("error" in location) {
+        running = null;
+        deps.log(`[HARNESS] ${harness} install refused: ${location.error}`);
+        return location;
+      }
+      const startedAt = now();
+      deps.log(`[HARNESS] owner requested ${harness} install`);
+      deps.publish({ harness, state: "installing", startedAt, at: startedAt });
+      void run(harness, location.prefix, startedAt);
+      return { accepted: true, harness };
+    }
+  };
 }
 
 function buildPresenceBatch(live, previous) {
@@ -5181,7 +5178,7 @@ function parseJsonObject(text) {
     return null;
   }
 }
-function resolveSdkClaudeBinary(platform = process.platform, arch = process.arch, resolver = (s) => module$1.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('run-CAOCYYfT.cjs', document.baseURI).href))).resolve(s)) {
+function resolveSdkClaudeBinary(platform = process.platform, arch = process.arch, resolver = (s) => module$1.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('run-BBNrcCfI.cjs', document.baseURI).href))).resolve(s)) {
   const platformArch = `${platform}-${arch}`;
   const candidates = [
     `@anthropic-ai/claude-agent-sdk-${platformArch}/claude`,
@@ -6262,7 +6259,10 @@ function mergeRestoreMetadata(stale, reported) {
 }
 
 function teamInitialPrompt(goal, root, directory) {
-  const role = root ? "You are the team lead. Inspect your assigned goal, arrange independent work when useful, review member results, integrate changes, and submit the final result for the user to accept. Delegate under your assigned goal using parentTaskId. You must not accept your own root goal." : "You are a team member. Inspect your assigned task and work in your assigned worktree. Delegate within your task when useful, then submit evidence for the lead to review.";
+  const role = root ? `You are the team lead. Inspect your assigned goal, arrange independent work when useful, review member results, integrate changes, and submit the final result for the user to accept. Delegate under your assigned goal using parentTaskId. You must not accept your own root goal.
+
+${resources.TEAM_LEAD_PLAYBOOK}` : `You are a team member. Inspect your assigned task and work in your assigned worktree. Delegate within your task when useful, then submit evidence for the lead to review.
+${resources.TEAM_MEMBER_RULES}`;
   return `${resources.TEAM_SKILL}
 
 ## Your role
@@ -6276,42 +6276,6 @@ Delegate from this working directory unless a different repository was explicitl
 ${goal}`;
 }
 
-function receiptPath(home, operationId) {
-  if (!/^[a-zA-Z0-9_-]{1,128}$/.test(operationId)) throw new Error("Invalid team operation id");
-  return path.join(home, "teams", "effects", `${operationId}.json`);
-}
-function readReceipt(home, id) {
-  try {
-    const value = JSON.parse(node_fs.readFileSync(receiptPath(home, id), "utf8"));
-    if (value.operationId !== id || typeof value.claimId !== "string" || !["prepared", "spawning", "spawned", "delivered", "completed"].includes(value.phase)) throw new Error("Invalid team effect receipt");
-    return value;
-  } catch (error) {
-    if (error.code === "ENOENT") return null;
-    throw error;
-  }
-}
-function writeReceipt$1(home, receipt) {
-  configuration.ensurePrivateDirectorySync(path.join(home, "teams", "effects"));
-  const target = receiptPath(home, receipt.operationId);
-  const tmp = `${target}.${process.pid}.tmp`;
-  configuration.writePrivateFileSync(tmp, JSON.stringify(receipt));
-  const file = node_fs.openSync(tmp, "r");
-  try {
-    node_fs.fsyncSync(file);
-  } finally {
-    node_fs.closeSync(file);
-  }
-  node_fs.renameSync(tmp, target);
-  if (process.platform !== "win32") {
-    const directory = node_fs.openSync(path.join(home, "teams", "effects"), "r");
-    try {
-      node_fs.fsyncSync(directory);
-    } finally {
-      node_fs.closeSync(directory);
-    }
-  }
-}
-
 const exec = node_util.promisify(node_child_process.execFile);
 const git = async (directory, args) => (await exec("git", ["-C", directory, ...args], { timeout: 3e4, maxBuffer: 2 * 1024 * 1024 })).stdout.trim();
 const gitRaw = async (directory, args) => (await exec("git", ["-C", directory, ...args], { timeout: 3e4, maxBuffer: 64 * 1024 * 1024 })).stdout;
@@ -6669,7 +6633,19 @@ Use the teams tools to inspect current task state before acting. This message is
   }, 5e3);
   timer.unref();
   void tick();
-  return { tick, report, hasSession: (id) => knownSessionIds.has(id), get busy() {
+  async function recoverScope(operationId, sessionId, scopeFile) {
+    const teams = (await http.get("/v1/teams")).data.teams ?? [];
+    const team = teams.find((candidate) => candidate.archivedAt === void 0 && candidate.operations.some((op2) => op2.id === operationId));
+    const op = team?.operations.find((candidate) => candidate.id === operationId);
+    if (!team || !op || op.type !== "spawn" || op.machineId !== deps.machineId) throw new Error("No live team launch for this session");
+    const bot = team.bots.find((candidate) => candidate.id === op.botId);
+    if (!bot || bot.sessionId !== sessionId || bot.generation !== op.generation) throw new Error("Team binding changed; not restoring its scope");
+    const claimed = await action(op.teamId, `claim-${op.id}`, { type: "claim-operation", operationId: op.id, machineId: deps.machineId, ...op.teamLaunchVersion === 1 ? { teamLaunchVersion: 1 } : {} });
+    if (!claimed.credential?.token || claimed.credential.botId !== op.botId) throw new Error("Team did not reissue the member credential");
+    configuration.ensurePrivateDirectorySync(path.join(home, "teams", "scopes"));
+    configuration.writePrivateFileSync(scopeFile, JSON.stringify({ serverUrl: server, scopeToken: claimed.credential.token, teamId: op.teamId, botId: op.botId, taskId: op.taskId, attemptId: op.attemptId }));
+  }
+  return { tick, report, recoverScope, hasSession: (id) => knownSessionIds.has(id), get busy() {
     return running;
   }, stop: () => {
     closed = true;
@@ -8189,6 +8165,13 @@ async function startDaemon() {
       }
     };
     const resumeGates = /* @__PURE__ */ new Map();
+    const teamRelaunchEnvFor = (happySessionId, metadata) => teamRelaunchEnv({
+      home: configuration.configuration.happyHomeDir,
+      sessionId: happySessionId,
+      metadata,
+      recover: teamWorker ? (operationId, scopeFile) => teamWorker.recoverScope(operationId, happySessionId, scopeFile) : void 0,
+      log: (message) => logger.logger.debug(`[DAEMON RUN] ${message}`)
+    });
     const resumeSession = async (happySessionId, options) => {
       let gate = resumeGates.get(happySessionId);
       if (!gate) {
@@ -8271,9 +8254,11 @@ async function startDaemon() {
         const permissionMode = spawnAgents.sanitizeSpawnPermissionMode(requestedMode);
         if (permissionMode) launch.args.push("--permission-mode", permissionMode);
         else if (requestedMode !== void 0) logger.logger.debug(`[DAEMON RUN] resume: ignoring invalid permission mode ${JSON.stringify(requestedMode)}`);
+        const teamEnv = await teamRelaunchEnvFor(happySessionId, metadata);
         const result = await spawnTrackedHappyProcess({
           args: launch.args,
           cwd: launch.cwd,
+          ...teamEnv.VH_TEAM_SCOPE_FILE ? { spawnedBy: "teams" } : {},
           env: {
             ...process.env,
             // B-297: the credentialStore=file shim must ride every spawn path,
@@ -8289,7 +8274,8 @@ async function startDaemon() {
             HAPPY_RECONNECT_ENCRYPTION_VARIANT: tracked.encryption.encryptionVariant,
             HAPPY_RECONNECT_SEQ: String(tracked.encryption.seq),
             HAPPY_RECONNECT_METADATA_VERSION: String(tracked.encryption.metadataVersion),
-            HAPPY_RECONNECT_AGENT_STATE_VERSION: String(tracked.encryption.agentStateVersion)
+            HAPPY_RECONNECT_AGENT_STATE_VERSION: String(tracked.encryption.agentStateVersion),
+            ...teamEnv
           }
         });
         if (result.type === "success") {
@@ -8407,9 +8393,11 @@ async function startDaemon() {
         const permissionMode = spawnAgents.sanitizeSpawnPermissionMode(options?.permissionMode);
         if (permissionMode) args.push("--permission-mode", permissionMode);
         restartCounts.set(happySessionId, recordRestartAttempt(prior));
+        const teamEnv = await teamRelaunchEnvFor(happySessionId, metadata);
         const result = await spawnTrackedHappyProcess({
           args,
           cwd,
+          ...teamEnv.VH_TEAM_SCOPE_FILE ? { spawnedBy: "teams" } : {},
           env: {
             ...process.env,
             // B-297: the credentialStore=file shim must ride every spawn path,
@@ -8424,7 +8412,8 @@ async function startDaemon() {
             HAPPY_RECONNECT_ENCRYPTION_VARIANT: tracked.encryption.encryptionVariant,
             HAPPY_RECONNECT_SEQ: String(tracked.encryption.seq),
             HAPPY_RECONNECT_METADATA_VERSION: String(tracked.encryption.metadataVersion),
-            HAPPY_RECONNECT_AGENT_STATE_VERSION: String(tracked.encryption.agentStateVersion)
+            HAPPY_RECONNECT_AGENT_STATE_VERSION: String(tracked.encryption.agentStateVersion),
+            ...teamEnv
           }
         });
         if (result.type === "success") {
@@ -8727,6 +8716,8 @@ async function startDaemon() {
       })).then(() => logger.logger.debug(`[DAEMON RUN] claimed the machine record for host ${initialMachineMetadata.host}`)).catch((error) => logger.logger.debug("[DAEMON RUN] could not refresh the recorded host:", error));
     }
     let lastUpdateLog = "";
+    let harnessInstaller = null;
+    let handoverInFlight = false;
     const updateController = createUpdateController({
       policy: () => cliUpdate.fetchCliUpdateState(configuration.configuration.serverUrl, _package.packageJson.version),
       enabled: async () => ((await persistence.readSettings()).cliAutoUpdate ?? "idle") !== "off",
@@ -8734,8 +8725,9 @@ async function startDaemon() {
       // handover (they talk to the server themselves) and web terminals live
       // in tmux, so neither is a reason to hold an update. B-507: a session
       // whose turn ended but still has background tasks is busy too.
-      idle: () => !turnActivity.hasActiveTurn() && !backgroundTasks.hasAny(),
+      idle: () => !turnActivity.hasActiveTurn() && !backgroundTasks.hasAny() && !harnessInstaller?.isRunning(),
       install: installCliSafely,
+      lastInstall: lastInstallStore(configuration.configuration.happyHomeDir),
       publish: (state) => {
         cliUpdateStateRef = state;
         fileState = { ...fileState, cliUpdate: state };
@@ -8782,10 +8774,33 @@ async function startDaemon() {
       logger.logger.warn(`[DAEMON RUN] Ignoring invalid HAPPY_CLI_UPDATE_CHECK_INTERVAL; using ${cliUpdate.DEFAULT_CLI_UPDATE_CHECK_INTERVAL_MS}ms`);
     }
     const cliUpdateInterval = setInterval(() => void refreshCliUpdate(), cliUpdateIntervalMs);
+    const policyAnnouncements = createPolicyAnnouncementHandler({
+      refresh: refreshCliUpdate,
+      currentTarget: updateController.currentTarget
+    });
+    apiMachine.setCliUpdatePolicyHandler((payload) => {
+      const delay = policyAnnouncements.onAnnouncement(payload);
+      if (delay !== null) logger.logger.warn(`[DAEMON RUN] CLI update policy announced; re-checking in ${Math.round(delay / 1e3)}s`);
+    });
     const stopAgentVersionChecks = mirrorProtocol.startAgentVersionChecks(
       (snapshot) => apiMachine.updateDaemonState((state) => ({ ...state, status: state?.status ?? "running", agentVersions: snapshot })),
       (error) => logger.logger.debug("[DAEMON RUN] Agent version check failed", error)
     );
+    harnessInstaller = createHarnessInstaller({
+      npm: runNpm,
+      runningPackageDir: projectPath.projectPath(),
+      commandOnPath: detectCLI.commandOnPath,
+      cliUpdateBusy: () => updateController.isRunning() || handoverInFlight,
+      publish: (state) => {
+        void apiMachine.updateDaemonState((current) => ({ ...current, status: current?.status ?? "running", harnessInstall: state })).catch((error) => logger.logger.debug("[DAEMON RUN] harness install state publish failed", error));
+      },
+      afterInstall: async () => {
+        apiMachine.recheckCliAvailability();
+        await stopAgentVersionChecks.refresh();
+      },
+      log: (message) => logger.logger.warn(`[DAEMON RUN] ${message}`)
+    });
+    apiMachine.setHarnessInstallHandler((params) => harnessInstaller.request(params));
     const heartbeatIntervalMs = parseInt(process.env.HAPPY_DAEMON_HEARTBEAT_INTERVAL || "60000");
     const restartOnStaleVersionAndHeartbeat = setInterval(serialTask(async () => {
       try {
@@ -8802,53 +8817,59 @@ async function startDaemon() {
         }
         await updateController.tick();
         await updateController.withHandover(async () => {
-          let bundleReplaced = false;
-          if (initialBundleMtimeMs > 0) {
-            try {
-              const currentMtimeMs = require$$0.statSync(bundlePath).mtimeMs;
-              bundleReplaced = currentMtimeMs !== initialBundleMtimeMs;
-            } catch {
-            }
-          }
-          const relayMove = pendingRelayMove;
-          if ((bundleReplaced || relayMove) && !teamWorker?.busy && !automationRunner?.busy && !updateController.isRunning() && !turnActivity.hasActiveTurn() && !backgroundTasks.hasAny()) {
-            const preflight = bundleReplaced ? await preflightNewBundle(bundlePath) : { action: "proceed" };
-            if (preflight.action === "hold") {
-              if (lastHandoverHold !== preflight.reason) {
-                lastHandoverHold = preflight.reason;
-                logger.logger.warn(`[DAEMON RUN] holding handover: ${preflight.reason}`);
+          handoverInFlight = true;
+          try {
+            let bundleReplaced = false;
+            if (initialBundleMtimeMs > 0) {
+              try {
+                const currentMtimeMs = require$$0.statSync(bundlePath).mtimeMs;
+                bundleReplaced = currentMtimeMs !== initialBundleMtimeMs;
+              } catch {
               }
-              updateController.holdHandover(preflight.reason);
-              return;
-            }
-            if (teamWorker?.busy || automationRunner?.busy || updateController.isRunning() || turnActivity.hasActiveTurn() || backgroundTasks.hasAny()) return;
-            lastHandoverHold = null;
-            logger.logger.debug(relayMove ? `[DAEMON RUN] Relay moved to ${relayMove.serverUrl}; handing off to a new daemon on the new settings` : "[DAEMON RUN] Daemon bundle replaced on disk and verified, handing off to new daemon");
-            teamWorker?.stop();
-            automationRunner?.stop();
-            projectPresence?.stop();
-            clearInterval(restartOnStaleVersionAndHeartbeat);
-            clearInterval(cliUpdateInterval);
-            stopAgentVersionChecks();
-            claudeAuthService.stop();
-            apiMachine.shutdown();
-            await stopControlServer();
-            await controlClient.cleanupDaemonState();
-            await persistence.releaseDaemonLock(daemonLockHandle);
-            await stopCaffeinate();
-            if (daemonSupervisor$1 === "systemd") {
-              logger.logger.debug(`[DAEMON RUN] systemd-supervised: exiting ${HANDOVER_EXIT_CODE} for the unit to restart on the new bundle`);
-              process.exit(HANDOVER_EXIT_CODE);
             }
-            try {
-              spawnHappyCLI.spawnHappyCLI(["daemon", "start"], {
-                detached: true,
-                stdio: "ignore"
-              });
-            } catch (error) {
-              logger.logger.debug("[DAEMON RUN] Failed to spawn new daemon, this is quite likely to happen during integration tests as we are cleaning out dist/ directory", error);
+            const relayMove = pendingRelayMove;
+            if ((bundleReplaced || relayMove) && !teamWorker?.busy && !automationRunner?.busy && !updateController.isRunning() && !harnessInstaller?.isRunning() && !turnActivity.hasActiveTurn() && !backgroundTasks.hasAny()) {
+              const preflight = bundleReplaced ? await preflightNewBundle(bundlePath) : { action: "proceed" };
+              if (preflight.action === "hold") {
+                if (lastHandoverHold !== preflight.reason) {
+                  lastHandoverHold = preflight.reason;
+                  logger.logger.warn(`[DAEMON RUN] holding handover: ${preflight.reason}`);
+                }
+                updateController.holdHandover(preflight.reason);
+                return;
+              }
+              if (teamWorker?.busy || automationRunner?.busy || updateController.isRunning() || harnessInstaller?.isRunning() || turnActivity.hasActiveTurn() || backgroundTasks.hasAny()) return;
+              lastHandoverHold = null;
+              logger.logger.debug(relayMove ? `[DAEMON RUN] Relay moved to ${relayMove.serverUrl}; handing off to a new daemon on the new settings` : "[DAEMON RUN] Daemon bundle replaced on disk and verified, handing off to new daemon");
+              teamWorker?.stop();
+              automationRunner?.stop();
+              projectPresence?.stop();
+              clearInterval(restartOnStaleVersionAndHeartbeat);
+              clearInterval(cliUpdateInterval);
+              policyAnnouncements.stop();
+              stopAgentVersionChecks();
+              claudeAuthService.stop();
+              apiMachine.shutdown();
+              await stopControlServer();
+              await controlClient.cleanupDaemonState();
+              await persistence.releaseDaemonLock(daemonLockHandle);
+              await stopCaffeinate();
+              if (daemonSupervisor$1 === "systemd") {
+                logger.logger.debug(`[DAEMON RUN] systemd-supervised: exiting ${HANDOVER_EXIT_CODE} for the unit to restart on the new bundle`);
+                process.exit(HANDOVER_EXIT_CODE);
+              }
+              try {
+                spawnHappyCLI.spawnHappyCLI(["daemon", "start"], {
+                  detached: true,
+                  stdio: "ignore"
+                });
+              } catch (error) {
+                logger.logger.debug("[DAEMON RUN] Failed to spawn new daemon, this is quite likely to happen during integration tests as we are cleaning out dist/ directory", error);
+              }
+              process.exit(0);
             }
-            process.exit(0);
+          } finally {
+            handoverInFlight = false;
           }
         });
         const daemonState = await persistence.readDaemonState();
@@ -8915,7 +8936,8 @@ async function startDaemon() {
       log: (message) => logger.logger.debug(`[DAEMON RUN] ${message}`)
     });
     void apiMachine.updateMachineMetadata((current) => ({
-      ...current ?? initialMachineMetadata,
+      // B-718: the running CLI version, not the one that first registered the row.
+      ...machineMetadata.withRunningCliFacts(current, initialMachineMetadata),
       teamsVersion: 1,
       teamLaunchVersion: 1,
       // B-689: this daemon acts on the owner's retry-operation (web gates「重试启动」).
@@ -8923,7 +8945,11 @@ async function startDaemon() {
       // B-586: this daemon serves the worktree-* RPCs (web gates 「在新 worktree 中」 on it).
       worktreeVersion: mirrorProtocol.WORKTREE_CAPABILITY_VERSION,
       // B-688: this daemon serves the model-config-* RPCs (web gates 「模型与 Provider」 on it).
-      modelConfigVersion: MODEL_CONFIG_CAPABILITY_VERSION
+      modelConfigVersion: MODEL_CONFIG_CAPABILITY_VERSION,
+      // B-719: this daemon serves `harness-install` (web gates the Install / Update buttons on it).
+      harnessInstallVersion: index.HARNESS_INSTALL_CAPABILITY_VERSION,
+      // B-755: this daemon serves `fs-mkdir` (web gates 「新建工作目录」 on it).
+      fsMkdirVersion: fsMkdir.FS_MKDIR_CAPABILITY_VERSION
     })).catch(() => logger.logger.debug("[DAEMON RUN] Teams capability publication will retry on reconnect"));
     const cleanupAndShutdown = async (source, errorMessage) => {
       webPanelsSync.stop();
@@ -8938,6 +8964,7 @@ async function startDaemon() {
         logger.logger.debug("[DAEMON RUN] Health check interval cleared");
       }
       clearInterval(cliUpdateInterval);
+      policyAnnouncements.stop();
       stopAgentVersionChecks();
       await apiMachine.updateDaemonState((state) => ({
         ...state,