vibe64 0.1.32 → 0.1.34

package/node_modules/@local/vibe64-execution/src/host/execHelper.js

@@ -1,369 +1,377 @@
 #!/opt/vibe64/runtime-packs/node26/bin/node
 import { createRequire as __vibe64CreateRequire } from 'node:module';const require=__vibe64CreateRequire(import.meta.url);
-import{spawn as Ye,spawnSync as N}from"node:child_process";import{chmodSync as Je,chownSync as xe,closeSync as Ze,existsSync as $,
-lstatSync as fe,mkdirSync as _e,openSync as Qe,readFileSync as y,readSync as et,realpathSync as te,renameSync as Ne,rmSync as Te,
-unlinkSync as V,writeFileSync as oe}from"node:fs";import u from"node:path";import{createConnection as tt}from"node:net";
-import w from"node:process";var Ie=1024*1024,rt=64*1024,nt=10,ot=15e3,it="vibe64.exec-helper.payload",st=1,ct=new Set(["\
+import{spawn as Ye,spawnSync as I}from"node:child_process";import{chmodSync as Je,chownSync as xe,closeSync as Ze,existsSync as T,
+lstatSync as fe,mkdirSync as _e,openSync as Qe,readFileSync as h,readSync as et,realpathSync as te,renameSync as Ne,rmSync as Te,
+unlinkSync as G,writeFileSync as oe}from"node:fs";import u from"node:path";import{createConnection as tt}from"node:net";
+import w from"node:process";var Ie=1024*1024,rt=64*1024,nt=10,ot=15e3,it="vibe64.exec-helper.payload",st=1,at=new Set(["\
 account-auth-terminal","account-status","codex-app-server","create-system-user","deployment-service","enable-system-user",
 "github-api-command","github-toolchain","github-workflow-command","health-status","managed-execution","managed-service",
-"opencode-app-server","vibe64-command"]),je=new Set(["bash","gh","git"]),at=/^[A-Za-z_][A-Za-z0-9_]*$/u,ut=new Set(["BAS\
-H_ENV","ENV","GCONV_PATH","GETCONF_DIR","GLIBC_TUNABLES","HOSTALIASES","LOCALDOMAIN","LD_AUDIT","LD_LIBRARY_PATH","LD_PR\
-ELOAD","LOCPATH","MALLOC_TRACE","NIS_PATH","NLSPATH","NODE_OPTIONS","RESOLV_HOST_CONF","RES_OPTIONS","TZDIR"]),ie=["/opt\
-/vibe64/runtime-packs/policy-bin","/opt/vibe64/runtime-packs/operator-clis/bin","/opt/vibe64/runtime-packs/node26/bin","\
-/opt/vibe64/runtime-packs/git/bin","/opt/vibe64/runtime-packs/gh/bin","/opt/vibe64/runtime-packs/ripgrep/bin","/opt/vibe\
-64/runtime-packs/bubblewrap/bin","/opt/vibe64/runtime-packs/bun/bin","/opt/vibe64/runtime-packs/php/bin","/opt/vibe64/ru\
-ntime-packs/composer/bin","/opt/vibe64/runtime-packs/mariadb/bin","/opt/vibe64/runtime-packs/postgresql/bin","/opt/vibe6\
-4/runtime-packs/sqlite/bin","/opt/vibe64/runtime-packs/playwright/bin","/opt/vibe64/runtime-packs/guard-bin","/usr/local\
-/sbin","/usr/local/bin","/usr/sbin","/usr/bin","/sbin","/bin"].join(":"),lt=/^[a-z][a-z0-9_-]{0,61}[a-z0-9]$/u,T="vibe64",
-re="v64d_",mt="/var/lib/vibe64",dt=new Set(["root"]),pt=/^[a-f0-9]{8}-[a-f0-9]{4}-[1-8][a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}$/iu,
+"opencode-app-server","vibe64-command","workspace-cache-command"]),je=new Set(["bash","gh","git"]),ct=/^[A-Za-z_][A-Za-z0-9_]*$/u,
+ut=new Set(["BASH_ENV","ENV","GCONV_PATH","GETCONF_DIR","GLIBC_TUNABLES","HOSTALIASES","LOCALDOMAIN","LD_AUDIT","LD_LIBR\
+ARY_PATH","LD_PRELOAD","LOCPATH","MALLOC_TRACE","NIS_PATH","NLSPATH","NODE_OPTIONS","RESOLV_HOST_CONF","RES_OPTIONS","TZ\
+DIR"]),ie=["/opt/vibe64/runtime-packs/policy-bin","/opt/vibe64/runtime-packs/operator-clis/bin","/opt/vibe64/runtime-pac\
+ks/node26/bin","/opt/vibe64/runtime-packs/git/bin","/opt/vibe64/runtime-packs/gh/bin","/opt/vibe64/runtime-packs/ripgrep\
+/bin","/opt/vibe64/runtime-packs/bubblewrap/bin","/opt/vibe64/runtime-packs/bun/bin","/opt/vibe64/runtime-packs/php/bin",
+"/opt/vibe64/runtime-packs/composer/bin","/opt/vibe64/runtime-packs/awsebcli/bin","/opt/vibe64/runtime-packs/cpp/bin","/\
+opt/vibe64/runtime-packs/python/bin","/opt/vibe64/runtime-packs/ruby/bin","/opt/vibe64/runtime-packs/go/bin","/opt/vibe6\
+4/runtime-packs/java/bin","/opt/vibe64/runtime-packs/kotlin/bin","/opt/vibe64/runtime-packs/csharp/bin","/opt/vibe64/run\
+time-packs/rust/bin","/opt/vibe64/runtime-packs/mariadb/bin","/opt/vibe64/runtime-packs/postgresql/bin","/opt/vibe64/run\
+time-packs/sqlite/bin","/opt/vibe64/runtime-packs/playwright/bin","/opt/vibe64/runtime-packs/guard-bin","/usr/local/sbin",
+"/usr/local/bin","/usr/sbin","/usr/bin","/sbin","/bin"].join(":"),mt=/^[a-z][a-z0-9_-]{0,61}[a-z0-9]$/u,j="vibe64",re="v\
+64d_",lt="/var/lib/vibe64",dt=new Set(["root"]),pt=/^[a-f0-9]{8}-[a-f0-9]{4}-[1-8][a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}$/iu,
 ft=new Set(["assistant","browser","control","job","preview","service","terminal"]),wt=new Set(["capture","detached","pty"]),
-z=64*1024*1024,Re=1024*1024*1024*1024,yt=256*1024*1024,we=1024*1024*1024*1024,de=8,pe=8192,gt=15e3;import.meta.main&&ht().
+F=64*1024*1024,$e=1024*1024*1024*1024,yt=256*1024*1024,we=1024*1024*1024*1024,de=8,pe=8192,gt=15e3;import.meta.main&&ht().
 catch(e=>{w.stderr.write(`${String(e?.message||e)}
 `),w.exit(2)});async function ht(){if(w.argv[2]==="run-managed"){await bt(w.argv[3]||"");return}if(w.argv[2]!=="execute")
 throw new Error("Usage: vibe64-exec-helper execute [payload-json-file]");let e=Jt(w.argv[3]||"");Lt(e);let t=String(e.operation||
-"").trim();if(!ct.has(t))throw new Error("Vibe64 exec helper rejected an unknown operation.");if(t==="deployment-service"){
-Ht(e);return}if(t==="managed-service"){Ft(e);return}if(t==="managed-execution"){St(e,w.argv[3]||"");return}let r=_(e.username);
+"").trim();if(!at.has(t))throw new Error("Vibe64 exec helper rejected an unknown operation.");if(t==="deployment-service"){
+Ht(e);return}if(t==="managed-service"){Kt(e);return}if(t==="managed-execution"){St(e,w.argv[3]||"");return}let r=N(e.username);
 if(t==="create-system-user"||t==="enable-system-user"){Wt(t,e,r);return}Se(r);let n=String(e.command||"").trim();if(!je.
 has(n))throw new Error("Vibe64 exec helper rejected an unknown command.");let o=X(r);ne("uid",e.uid,o.uid),ne("gid",e.gid,
-o.gid);let i=q();Fe(i,r),Ue(o.username,T);let s=ze(e.cwd||"",i.username,{operation:t,targetUser:o}),c=be(e.env||{},o,i.username,
-t),a=Array.isArray(e.args)?e.args.map(p=>String(p)):[],l=e.inputBase64?Buffer.from(String(e.inputBase64),"base64"):void 0;
-w.umask(7);let d=Et(o,n,a,{cwd:s,env:c,...l===void 0?{stdio:"inherit"}:{input:l,stdio:["pipe","inherit","inherit"]}});if(d.
-error)throw d.error;w.exit(typeof d.status=="number"?d.status:1)}function Et(e,t,r,n){return N("/usr/sbin/runuser",["-u",
+o.gid);let i=q();Ke(i,r),Ue(o.username,j);let s=Fe(e.cwd||"",i.username,{operation:t,targetUser:o}),a=be(e.env||{},o,i.username,
+t),c=Array.isArray(e.args)?e.args.map(d=>String(d)):[],m=e.inputBase64?Buffer.from(String(e.inputBase64),"base64"):void 0;
+w.umask(7);let p=Et(o,n,c,{cwd:s,env:a,...m===void 0?{stdio:"inherit"}:{input:m,stdio:["pipe","inherit","inherit"]}});if(p.
+error)throw p.error;w.exit(typeof p.status=="number"?p.status:1)}function Et(e,t,r,n){return I("/usr/sbin/runuser",["-u",
 e.username,"--","/usr/bin/env","--",`PATH=${n.env.PATH}`,t,...r],{...n,env:{...n.env,PATH:ie}})}function St(e={},t=""){let r=q();
-vt(t,r),ce(T);let n=String(e.action||"").trim();if(n.startsWith("workflow-")){let A=Ot(e,r);w.stdout.write(`${JSON.stringify(
-A)}
-`),A.ok!==!0&&(w.exitCode=1);return}let o=W(e.executionId),i=De(o,r);if(n==="inspect"){Pt(i,o,r);return}if(n==="stop"){Gt(
+vt(t,r),ae(j);let n=String(e.action||"").trim();if(n.startsWith("workflow-")){let O=Ot(e,r);w.stdout.write(`${JSON.stringify(
+O)}
+`),O.ok!==!0&&(w.exitCode=1);return}let o=W(e.executionId),i=De(o,r);if(n==="inspect"){Pt(i,o,r);return}if(n==="stop"){Gt(
 i,o,r);return}if(n!=="start")throw new Error("Vibe64 exec helper rejected an unknown managed execution action.");let s=It(
-e.mode),c=Tt(e.kind),a=String(e.lifecycle||"").trim();if(a!==(s==="capture"?"finite":s==="pty"?"interactive":"service"))
-throw new Error("Vibe64 exec helper rejected a managed execution lifecycle mismatch.");let d=$e(e.controllerLeaseName,a),
-p=Nt(e,r),m=String(e.commandOperation||"").trim(),f=ze(e.cwd||"",r.username,{operation:m,targetUser:p}),g=String(e.command||
+e.mode),a=Tt(e.kind),c=String(e.lifecycle||"").trim();if(c!==(s==="capture"?"finite":s==="pty"?"interactive":"service"))
+throw new Error("Vibe64 exec helper rejected a managed execution lifecycle mismatch.");let p=Re(e.controllerLeaseName,c),
+d=Nt(e,r),l=String(e.commandOperation||"").trim(),f=Fe(e.cwd||"",r.username,{operation:l,targetUser:d}),g=String(e.command||
 "").trim();if(!g||/[\r\n]/u.test(g))throw new Error("Vibe64 exec helper rejected an invalid managed execution command.");
-if(p.username!==r.username&&!je.has(u.basename(g)))throw new Error("Vibe64 exec helper rejected an unsupported real-user\
- managed command.");let S=Array.isArray(e.args)?e.args.map(A=>String(A)):[],j=be(e.env||{},p,r.username,m),b="";if(e.releaseEnvironmentFile){
-if(s!=="capture"||p.username!==r.username)throw new Error("Release environment requires finite owner execution.");b=ee(e.
-releaseEnvironmentFile,r,"environmentFile");let A=fe(b),C=u.join(u.dirname(u.dirname(b)),"workspace");if(u.basename(b)!==
-"environment"||u.basename(u.dirname(b))!=="service"||!A.isFile()||A.uid!==r.uid||(A.mode&63)!==0||te(b)!==b||te(f)!==f||
-f!==C&&U(C,f).length===0)throw new Error("Release environment must belong to the selected private release.")}let G=B(e.memoryMaxBytes,
-z,Re,"memory limit"),P=B(e.tasksMax,de,pe,"task limit"),H=B(e.workMemoryMaxBytes,yt,we,"work-slice memory limit"),v=B(e.
-workTasksMax,de,pe,"work-slice task limit");if(G>H||P>v)throw new Error("Vibe64 exec helper rejected an execution limit \
-above its work-slice limit.");let x=he(r);if(e.workflow){let A=Ce(e.workflow,r),C=D(A);if(C.activeState!=="active"||!C.controlGroup||
-C.finishedAt)throw new Error("Vibe64 exec helper rejected an execution without its active workflow group.");if(G>C.memoryMaxBytes||
-P>C.tasksMax)throw new Error("Vibe64 exec helper rejected an execution limit above its workflow limit.");x=A.unitName}else
-Mt(r,{memoryMaxBytes:H,tasksMax:v});jt(r);let J=Ee(r,o),Z=u.join(J,"command.json");_e(J,{mode:448,recursive:!0}),xe(J,p.
-uid,p.gid),oe(Z,`${JSON.stringify({args:S,command:g,controllerLeaseName:d,cwd:f,env:j,inputBase64:String(e.inputBase64||
-""),inputPresent:e.inputPresent===!0,...b?{releaseEnvironment:!0}:{},executionId:o,schema:"vibe64.managed-execution.comm\
+if(d.username!==r.username&&!je.has(u.basename(g)))throw new Error("Vibe64 exec helper rejected an unsupported real-user\
+ managed command.");let x=Array.isArray(e.args)?e.args.map(O=>String(O)):[],M=be(e.env||{},d,r.username,l),y="";if(e.releaseEnvironmentFile){
+if(s!=="capture"||d.username!==r.username)throw new Error("Release environment requires finite owner execution.");y=ee(e.
+releaseEnvironmentFile,r,"environmentFile");let O=fe(y),B=u.join(u.dirname(u.dirname(y)),"workspace");if(u.basename(y)!==
+"environment"||u.basename(u.dirname(y))!=="service"||!O.isFile()||O.uid!==r.uid||(O.mode&63)!==0||te(y)!==y||te(f)!==f||
+f!==B&&C(B,f).length===0)throw new Error("Release environment must belong to the selected private release.")}let D=U(e.memoryMaxBytes,
+F,$e,"memory limit"),V=U(e.tasksMax,de,pe,"task limit"),H=U(e.workMemoryMaxBytes,yt,we,"work-slice memory limit"),v=U(e.
+workTasksMax,de,pe,"work-slice task limit");if(D>H||V>v)throw new Error("Vibe64 exec helper rejected an execution limit \
+above its work-slice limit.");let k=he(r);if(e.workflow){let O=Ce(e.workflow,r),B=P(O);if(B.activeState!=="active"||!B.controlGroup||
+B.finishedAt)throw new Error("Vibe64 exec helper rejected an execution without its active workflow group.");if(D>B.memoryMaxBytes||
+V>B.tasksMax)throw new Error("Vibe64 exec helper rejected an execution limit above its workflow limit.");k=O.unitName}else
+Mt(r,{memoryMaxBytes:H,tasksMax:v});jt(r);let J=Ee(r,o),Z=u.join(J,"command.json");_e(J,{mode:448,recursive:!0}),xe(J,d.
+uid,d.gid),oe(Z,`${JSON.stringify({args:x,command:g,controllerLeaseName:p,cwd:f,env:M,inputBase64:String(e.inputBase64||
+""),inputPresent:e.inputPresent===!0,...y?{releaseEnvironment:!0}:{},executionId:o,schema:"vibe64.managed-execution.comm\
 and",schemaVersion:1})}
-`,{flag:"wx",mode:384}),Je(Z,384),xe(Z,p.uid,p.gid);let Xe=u.resolve(w.argv[1]),qe=["--quiet",`--unit=${i}`,"--service-t\
-ype=exec",`--slice=${x}`,`--property=Description=Vibe64 ${c} execution`,`--property=User=${p.username}`,`--property=Grou\
-p=${T}`,"--property=SupplementaryGroups=nix-users","--property=UMask=0007",`--property=WorkingDirectory=${f}`,...b?[`--p\
-roperty=EnvironmentFile=${b}`]:[],"--property=KillMode=control-group","--property=ExitType=cgroup","--property=OOMPolicy\
+`,{flag:"wx",mode:384}),Je(Z,384),xe(Z,d.uid,d.gid);let Xe=u.resolve(w.argv[1]),qe=["--quiet",`--unit=${i}`,"--service-t\
+ype=exec",`--slice=${k}`,`--property=Description=Vibe64 ${a} execution`,`--property=User=${d.username}`,`--property=Grou\
+p=${j}`,"--property=SupplementaryGroups=nix-users","--property=UMask=0007",`--property=WorkingDirectory=${f}`,...y?[`--p\
+roperty=EnvironmentFile=${y}`]:[],"--property=KillMode=control-group","--property=ExitType=cgroup","--property=OOMPolicy\
 =stop","--property=MemoryAccounting=yes","--property=IOAccounting=yes","--property=TasksAccounting=yes",`--property=Memo\
-ryMax=${G}`,`--property=TasksMax=${P}`,"--property=TimeoutStopSec=10s",...s==="capture"?["--wait","--pipe"]:[],...s==="p\
-ty"?["--wait","--pty"]:[],Xe,"run-managed",Z],L=N("systemd-run",qe,{stdio:"inherit"});if((s!=="detached"||L.error||L.status!==
+ryMax=${D}`,`--property=TasksMax=${V}`,"--property=TimeoutStopSec=10s",...s==="capture"?["--wait","--pipe"]:[],...s==="p\
+ty"?["--wait","--pty"]:[],Xe,"run-managed",Z],L=I("systemd-run",qe,{stdio:"inherit"});if((s!=="detached"||L.error||L.status!==
 0)&&Te(J,{force:!0,recursive:!0}),L.error)throw L.error;w.exit(typeof L.status=="number"?L.status:1)}function vt(e="",t={}){
-let r=String(e||"").trim();if(!r)return;let n=u.resolve(r),o=u.join(Y(t.username),"managed-execution-payloads");if(U(o,n).
-length!==1)throw new Error("Vibe64 exec helper rejected an unsafe managed execution payload path.");V(n)}async function bt(e=""){
-let t=u.resolve(String(e||"")),r=y(t,"utf8");V(t);let n=JSON.parse(r);if(n?.schema!=="vibe64.managed-execution.command"||
+let r=String(e||"").trim();if(!r)return;let n=u.resolve(r),o=u.join(Y(t.username),"managed-execution-payloads");if(C(o,n).
+length!==1)throw new Error("Vibe64 exec helper rejected an unsafe managed execution payload path.");G(n)}async function bt(e=""){
+let t=u.resolve(String(e||"")),r=h(t,"utf8");G(t);let n=JSON.parse(r);if(n?.schema!=="vibe64.managed-execution.command"||
 n?.schemaVersion!==1)throw new Error("Vibe64 managed execution runner rejected an invalid payload.");let o=String(n.command||
-"").trim();if(!o||/[\r\n]/u.test(o))throw new Error("Vibe64 managed execution runner rejected an invalid command.");let i=$e(
-n.controllerLeaseName,n.controllerLeaseName?"service":""),s=i?await xt(i):null;w.umask(7);let c=null,a=null,l=!1,d=()=>{
-l=!0,c&&a===null&&(a=Me(c))};s?.once("close",d);try{c=Ye(o,Array.isArray(n.args)?n.args.map(String):[],{cwd:String(n.cwd||
-"/"),detached:!!s,env:n.releaseEnvironment===!0?be({...w.env,...n.env},{username:n.env.USER,home:n.env.HOME},n.env.USER):
-n.env&&typeof n.env=="object"&&!Array.isArray(n.env)?n.env:{},stdio:n.inputPresent===!0?["pipe","inherit","inherit"]:"in\
-herit"}),n.inputPresent===!0&&c.stdin.end(Buffer.from(String(n.inputBase64||""),"base64")),l&&(a=Me(c));let p=await new Promise(
-(f,g)=>{let S="";c.once("exit",()=>{S=new Date().toISOString()}),c.once("error",g),c.once("close",(j,b)=>f({signal:b,status:j,
-exitObservedAt:S}))}),m=typeof p.status=="number"?p.status:1;Ct(u.dirname(t),{...Dt(),executionId:W(n.executionId),exitObservedAt:p.
-exitObservedAt,execMainCode:p.signal?"killed":"exited",execMainStatus:p.signal||String(m),result:p.signal?"signal":m===0?
-"success":"exit-code",signal:String(p.signal||"")}),w.exitCode=m}finally{a!==null&&clearTimeout(a),s?.off("close",d),s?.
-destroy()}}function $e(e="",t=""){let r=String(e||"");if(t!=="service"){if(r)throw new Error("Vibe64 exec helper rejecte\
-d a controller lease on a finite execution.");return""}if(!/^\0vibe64-resource-controller-[a-z][a-z0-9-]{0,62}$/u.test(r))
-throw new Error("Vibe64 exec helper rejected an invalid managed service controller lease.");return r}function xt(e=""){return new Promise(
-(t,r)=>{let n=tt({path:e}),o=setTimeout(()=>{n.destroy(),r(new Error("Vibe64 managed service could not attach to its con\
-troller lease."))},3e3);o.unref?.(),n.once("connect",()=>{clearTimeout(o),n.removeListener("error",i),n.on("error",()=>n.
-destroy()),t(n)}),n.once("error",i);function i(s){clearTimeout(o),n.destroy(),r(new Error(`Vibe64 managed service contro\
-ller lease is unavailable: ${s?.code||s}`))}})}function Me(e=null){ke(e,"SIGTERM");let t=setTimeout(()=>ke(e,"SIGKILL"),
-5e3);return t.unref?.(),t}function ke(e=null,t="SIGTERM"){let r=Number(e?.pid);if(!(!Number.isSafeInteger(r)||r<=1))try{
-w.kill(-r,t)}catch(n){if(n?.code==="ESRCH")return;try{e.kill(t)}catch(o){o?.code!=="ESRCH"&&w.stderr.write(`Vibe64 manag\
-ed service process tree could not be stopped.
-`)}}}function Mt(e={},{memoryMaxBytes:t=0,tasksMax:r=0}={}){let n=he(e);E("systemctl",["start",n]),E("systemctl",["set-p\
+"").trim();if(!o||/[\r\n]/u.test(o))throw new Error("Vibe64 managed execution runner rejected an invalid command.");let i=Re(
+n.controllerLeaseName,n.controllerLeaseName?"service":""),s=i?await xt(i):null;w.umask(7);let a=null,c=null,m=!1,p=()=>{
+m=!0,a&&c===null&&(c=Me(a))};s?.once("close",p);let d=new Date().toISOString();try{a=Ye(o,Array.isArray(n.args)?n.args.map(
+String):[],{cwd:String(n.cwd||"/"),detached:!!s,env:n.releaseEnvironment===!0?be({...w.env,...n.env},{username:n.env.USER,
+home:n.env.HOME},n.env.USER):n.env&&typeof n.env=="object"&&!Array.isArray(n.env)?n.env:{},stdio:n.inputPresent===!0?["p\
+ipe","inherit","inherit"]:"inherit"}),n.inputPresent===!0&&a.stdin.end(Buffer.from(String(n.inputBase64||""),"base64")),
+m&&(c=Me(a));let l=await new Promise((g,x)=>{let M="";a.once("exit",()=>{M=new Date().toISOString()}),a.once("error",x),
+a.once("close",(y,D)=>g({signal:D,status:y,exitObservedAt:M}))}),f=typeof l.status=="number"?l.status:1;Ct(u.dirname(t),
+{...Dt(),executionId:W(n.executionId),startedAt:d,exitObservedAt:l.exitObservedAt,execMainCode:l.signal?"killed":"exited",
+execMainStatus:l.signal||String(f),result:l.signal?"signal":f===0?"success":"exit-code",signal:String(l.signal||"")}),w.
+exitCode=f}finally{c!==null&&clearTimeout(c),s?.off("close",p),s?.destroy()}}function Re(e="",t=""){let r=String(e||"");
+if(t!=="service"){if(r)throw new Error("Vibe64 exec helper rejected a controller lease on a finite execution.");return""}
+if(!/^\0vibe64-resource-controller-[a-z][a-z0-9-]{0,62}$/u.test(r))throw new Error("Vibe64 exec helper rejected an inval\
+id managed service controller lease.");return r}function xt(e=""){return new Promise((t,r)=>{let n=tt({path:e}),o=setTimeout(
+()=>{n.destroy(),r(new Error("Vibe64 managed service could not attach to its controller lease."))},3e3);o.unref?.(),n.once(
+"connect",()=>{clearTimeout(o),n.removeListener("error",i),n.on("error",()=>n.destroy()),t(n)}),n.once("error",i);function i(s){
+clearTimeout(o),n.destroy(),r(new Error(`Vibe64 managed service controller lease is unavailable: ${s?.code||s}`))}})}function Me(e=null){
+ke(e,"SIGTERM");let t=setTimeout(()=>ke(e,"SIGKILL"),5e3);return t.unref?.(),t}function ke(e=null,t="SIGTERM"){let r=Number(
+e?.pid);if(!(!Number.isSafeInteger(r)||r<=1))try{w.kill(-r,t)}catch(n){if(n?.code==="ESRCH")return;try{e.kill(t)}catch(o){
+o?.code!=="ESRCH"&&w.stderr.write(`Vibe64 managed service process tree could not be stopped.
+`)}}}function Mt(e={},{memoryMaxBytes:t=0,tasksMax:r=0}={}){let n=he(e);S("systemctl",["start",n]),S("systemctl",["set-p\
 roperty","--runtime",n,`MemoryMax=${t}`,`TasksMax=${r}`,"MemoryAccounting=yes","IOAccounting=yes","TasksAccounting=yes"])}
-function Ce(e={},t={}){let r=W(e.id);for(let c of[e.projectKey,e.sessionKey])if(typeof c!="string"||!/^[a-f0-9]{64}$/u.test(
-c))throw new Error("Vibe64 exec helper rejected an invalid workflow accounting identity.");let n=_(t.username);if(!n.startsWith(
-re))throw new Error("Managed workflow accounting requires a workspace daemon owner.");let o=I(n);if(!/^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$/u.
+function Ce(e={},t={}){let r=W(e.id);for(let a of[e.projectKey,e.sessionKey])if(typeof a!="string"||!/^[a-f0-9]{64}$/u.test(
+a))throw new Error("Vibe64 exec helper rejected an invalid workflow accounting identity.");let n=N(t.username);if(!n.startsWith(
+re))throw new Error("Managed workflow accounting requires a workspace daemon owner.");let o=$(n);if(!/^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$/u.
 test(o))throw new Error("Invalid managed workflow workspace identity.");let i=`vibe64-${o}-work-p${e.projectKey}.slice`,
 s=`${i.slice(0,-6)}-s${e.sessionKey}.slice`;return{id:r,workspace:o,projectKey:e.projectKey,sessionKey:e.sessionKey,projectUnit:i,
 sessionUnit:s,unitName:`${s.slice(0,-6)}-w${r.replaceAll("-","")}.slice`}}function ye(e){return u.join("/run/vibe64-work\
-flows",e.workspace,`${e.id}.json`)}function kt(e){try{let t=JSON.parse(y(ye(e),"utf8"));if(t.schema!=="vibe64.managed-wo\
+flows",e.workspace,`${e.id}.json`)}function kt(e){try{let t=JSON.parse(h(ye(e),"utf8"));if(t.schema!=="vibe64.managed-wo\
 rkflow.result.v1"||t.unitName!==e.unitName||t.id!==e.id)throw new Error("Invalid managed workflow result identity.");return t}catch(t){
 if(t.code==="ENOENT")return null;throw t}}function At(e,t){let r=ye(e);for(let i of["/run/vibe64-workflows",u.dirname(r)]){
-try{_e(i,{mode:448})}catch(c){if(c.code!=="EEXIST")throw c}let s=fe(i);if(!s.isDirectory()||s.isSymbolicLink()||s.uid!==
+try{_e(i,{mode:448})}catch(a){if(a.code!=="EEXIST")throw a}let s=fe(i);if(!s.isDirectory()||s.isSymbolicLink()||s.uid!==
 0||(s.mode&63)!==0)throw new Error("Unsafe managed workflow result directory.")}let n=`${r}.tmp-${w.pid}`,o=Qe(n,"wx",384);
 try{try{oe(o,`${JSON.stringify({...t,schema:"vibe64.managed-workflow.result.v1"})}
-`)}finally{Ze(o)}Ne(n,r)}catch(i){try{V(n)}catch(s){if(s.code!=="ENOENT")throw new AggregateError([i,s],"Workflow receip\
-t write and cleanup failed.")}throw i}}function D(e){let t=M("systemctl",["show",e.unitName,"--no-pager","--property=Loa\
+`)}finally{Ze(o)}Ne(n,r)}catch(i){try{G(n)}catch(s){if(s.code!=="ENOENT")throw new AggregateError([i,s],"Workflow receip\
+t write and cleanup failed.")}throw i}}function P(e){let t=A("systemctl",["show",e.unitName,"--no-pager","--property=Loa\
 dState,ActiveState,ControlGroup,MemoryMax,TasksMax"]),r=Object.fromEntries(String(t.stdout||"").trim().split(`
-`).map(s=>{let c=s.indexOf("=");return[s.slice(0,c),s.slice(c+1)]})),n=String(r.ControlGroup||"");if(n&&(u.posix.basename(
+`).map(s=>{let a=s.indexOf("=");return[s.slice(0,a),s.slice(a+1)]})),n=String(r.ControlGroup||"");if(n&&(u.posix.basename(
 n)!==e.unitName||!n.includes(`/vibe64-${e.workspace}-work.slice/`)))throw new Error("Managed workflow group does not bel\
-ong to its workspace.");let o={id:e.id,unitName:e.unitName,activeState:r.ActiveState||"unknown",controlGroup:n,memoryMaxBytes:h(
-r.MemoryMax),tasksMax:h(r.TasksMax),...ge(n?u.join("/sys/fs/cgroup",n):"")};t.status===0&&r.ActiveState==="inactive"&&!n&&
-(o.scopeEmpty=!0);let i=kt(e);return i?{...i,activeState:o.activeState,controlGroup:o.controlGroup}:o}function h(e){return typeof e==
-"string"&&/^[0-9]+$/u.test(e.trim())&&Number.isSafeInteger(Number(e))?Number(e):null}function ge(e=""){function t(c){if(!e)
-return"";try{return y(u.join(e,c),"utf8")}catch(a){if(a.code==="ENOENT"||a.code==="ENODEV")return"";throw a}}function r(c){
-return Object.fromEntries(t(c).trim().split(`
-`).map(a=>{let[l,d]=a.trim().split(/\s+/u);return[l,h(d)]}))}let n=r("memory.events"),o=r("memory.stat"),i=r("cgroup.eve\
+ong to its workspace.");let o={id:e.id,unitName:e.unitName,activeState:r.ActiveState||"unknown",controlGroup:n,memoryMaxBytes:E(
+r.MemoryMax),tasksMax:E(r.TasksMax),...ge(n?u.join("/sys/fs/cgroup",n):"")};t.status===0&&r.ActiveState==="inactive"&&!n&&
+(o.scopeEmpty=!0);let i=kt(e);return i?{...i,activeState:o.activeState,controlGroup:o.controlGroup}:o}function E(e){return typeof e==
+"string"&&/^[0-9]+$/u.test(e.trim())&&Number.isSafeInteger(Number(e))?Number(e):null}function ge(e=""){function t(a){if(!e)
+return"";try{return h(u.join(e,a),"utf8")}catch(c){if(c.code==="ENOENT"||c.code==="ENODEV")return"";throw c}}function r(a){
+return Object.fromEntries(t(a).trim().split(`
+`).map(c=>{let[m,p]=c.trim().split(/\s+/u);return[m,E(p)]}))}let n=r("memory.events"),o=r("memory.stat"),i=r("cgroup.eve\
 nts"),s=t("memory.pressure");return{sampledAt:new Date().toISOString(),sampledMonotonicMs:Number(w.hrtime.bigint()/1000000n),
-scopeEmpty:i.populated===0?!0:i.populated===1?!1:null,memoryCurrentBytes:h(t("memory.current")),memoryPeakBytes:h(t("mem\
-ory.peak")),memorySwapCurrentBytes:h(t("memory.swap.current")),memoryAnonBytes:o.anon??null,memoryFileBytes:o.file??null,
-memoryKernelBytes:o.kernel??null,swapInPages:o.pswpin??null,swapOutPages:o.pswpout??null,memoryPressureSomeTotalUsec:h(/^some\s+.*\btotal=([0-9]+)(?:\s|$)/mu.
-exec(s)?.[1]),oomCount:n.oom??null,oomKillCount:n.oom_kill??null,limitHitCount:n.max??null,reclaimCount:n.high??null,tasksCurrent:h(
+scopeEmpty:i.populated===0?!0:i.populated===1?!1:null,memoryCurrentBytes:E(t("memory.current")),memoryPeakBytes:E(t("mem\
+ory.peak")),memorySwapCurrentBytes:E(t("memory.swap.current")),memoryAnonBytes:o.anon??null,memoryFileBytes:o.file??null,
+memoryKernelBytes:o.kernel??null,swapInPages:o.pswpin??null,swapOutPages:o.pswpout??null,memoryPressureSomeTotalUsec:E(/^some\s+.*\btotal=([0-9]+)(?:\s|$)/mu.
+exec(s)?.[1]),oomCount:n.oom??null,oomKillCount:n.oom_kill??null,limitHitCount:n.max??null,reclaimCount:n.high??null,tasksCurrent:E(
 t("pids.current")),peakScope:"workflow-lifetime"}}function Ot(e,t){let r=Ce(e.workflow,t),n=String(e.action||"");if(n===
-"workflow-inspect")return{ok:!0,...D(r)};if(n==="workflow-grow"||n==="workflow-limits")return _t(e,r,t);if(n==="workflow\
--forget"){let o=D(r);if(o.scopeEmpty!==!0||o.activeState!=="inactive")throw new Error("Only a completed workflow receipt\
- can be acknowledged.");try{V(ye(r))}catch(i){if(i.code!=="ENOENT")throw i}return{ok:!0,id:r.id}}if(n==="workflow-create"){
-let o=B(e.memoryMaxBytes,z,we,"workflow memory limit"),i=B(e.tasksMax,de,pe,"workflow task limit"),s=h(E("systemctl",["s\
+"workflow-inspect")return{ok:!0,...P(r)};if(n==="workflow-grow"||n==="workflow-limits")return _t(e,r,t);if(n==="workflow\
+-forget"){let o=P(r);if(o.scopeEmpty!==!0||o.activeState!=="inactive")throw new Error("Only a completed workflow receipt\
+ can be acknowledged.");try{G(ye(r))}catch(i){if(i.code!=="ENOENT")throw i}return{ok:!0,id:r.id}}if(n==="workflow-create"){
+let o=U(e.memoryMaxBytes,F,we,"workflow memory limit"),i=U(e.tasksMax,de,pe,"workflow task limit"),s=E(S("systemctl",["s\
 how",he(t),"--property=MemoryMax","--value"]));if(s===null||o>s)throw new Error("Vibe64 exec helper rejected a workflow \
-above its proven work-slice memory limit.");let c=D(r);if(c.finishedAt)throw new Error("A completed workflow identity ca\
-nnot be reused.");if(c.activeState==="active"){if(c.memoryMaxBytes!==o||c.tasksMax!==i)throw new Error("An active workfl\
-ow cannot be reconfigured by retrying creation.");return{ok:!0,...c}}E("busctl",["--system","call","org.freedesktop.syst\
+above its proven work-slice memory limit.");let a=P(r);if(a.finishedAt)throw new Error("A completed workflow identity ca\
+nnot be reused.");if(a.activeState==="active"){if(a.memoryMaxBytes!==o||a.tasksMax!==i)throw new Error("An active workfl\
+ow cannot be reconfigured by retrying creation.");return{ok:!0,...a}}S("busctl",["--system","call","org.freedesktop.syst\
 emd1","/org/freedesktop/systemd1","org.freedesktop.systemd1.Manager","StartTransientUnit","ssa(sv)a(sa(sv))",r.unitName,
 "fail","5","MemoryMax","t",String(o),"TasksMax","t",String(i),"MemoryAccounting","b","true","IOAccounting","b","true","T\
-asksAccounting","b","true","0"]),E("systemctl",["start",r.unitName]);let a=D(r);if(a.memoryMaxBytes!==o||a.tasksMax!==i||
-a.scopeEmpty!==!0)throw new Error("Managed workflow creation could not prove its limits and empty accounting group.");return{
-ok:!0,...a}}if(n==="workflow-finish"){let o=D(r);if(!o.finishedAt){if(o.scopeEmpty!==!0)return{ok:!1,code:"workflow_not_\
-empty",...o};At(r,{...o,finishedAt:new Date().toISOString()})}let i=M("systemctl",["stop",r.unitName]),s=D(r);if(s.activeState!==
+asksAccounting","b","true","0"]),S("systemctl",["start",r.unitName]);let c=P(r);if(c.memoryMaxBytes!==o||c.tasksMax!==i||
+c.scopeEmpty!==!0)throw new Error("Managed workflow creation could not prove its limits and empty accounting group.");return{
+ok:!0,...c}}if(n==="workflow-finish"){let o=P(r);if(!o.finishedAt){if(o.scopeEmpty!==!0)return{ok:!1,code:"workflow_not_\
+empty",...o};At(r,{...o,finishedAt:new Date().toISOString()})}let i=A("systemctl",["stop",r.unitName]),s=P(r);if(s.activeState!==
 "inactive"||s.controlGroup||s.scopeEmpty!==!0)throw new Error(String(i.stderr||"Managed workflow group did not stop.").trim());
 return{ok:!0,...s}}throw new Error("Vibe64 exec helper rejected an unknown workflow action.")}function ue(e,t,r,n){let o=Object.
-fromEntries(E("systemctl",["show",e,"--no-pager","--property=ActiveState,ControlGroup,MemoryMax"]).split(`
-`).map(a=>{let l=a.indexOf("=");return[a.slice(0,l),a.slice(l+1)]}));if(o.ActiveState!=="active"||o.ControlGroup!==t)throw new Error(
-"Memory growth requires the same active, owned accounting group.");let i=h(y(u.join("/sys/fs/cgroup",t,"memory.max"),"ut\
-f8")),s=h(o.MemoryMax);if(s===null||i!==Math.floor(s/r)*r)throw new Error("The effective memory limit could not be verif\
-ied.");let c=y(u.join("/sys/fs/cgroup",t,"memory.high"),"utf8").trim();if(c!=="max"&&(h(c)===null||n>Number(c)))throw Object.
+fromEntries(S("systemctl",["show",e,"--no-pager","--property=ActiveState,ControlGroup,MemoryMax"]).split(`
+`).map(c=>{let m=c.indexOf("=");return[c.slice(0,m),c.slice(m+1)]}));if(o.ActiveState!=="active"||o.ControlGroup!==t)throw new Error(
+"Memory growth requires the same active, owned accounting group.");let i=E(h(u.join("/sys/fs/cgroup",t,"memory.max"),"ut\
+f8")),s=E(o.MemoryMax);if(s===null||i!==Math.floor(s/r)*r)throw new Error("The effective memory limit could not be verif\
+ied.");let a=h(u.join("/sys/fs/cgroup",t,"memory.high"),"utf8").trim();if(a!=="max"&&(E(a)===null||n>Number(a)))throw Object.
 assign(new Error("Memory growth is blocked by the target's memory.high limit."),{limitingGroup:{controlGroup:t,limit:"me\
-mory.high",maximumBytes:h(c),requestedBytes:n??null}});return{unitName:e,controlGroup:t,memoryMaxBytes:s,effectiveMemoryMaxBytes:i,
-memoryHighBytes:c==="max"?null:h(c)}}function le(e,t){let r=[];for(let n=u.posix.dirname(e);n!=="/";n=u.posix.dirname(n)){
-let o={controlGroup:n};for(let[i,s]of[["memory.max","memoryMaxBytes"],["memory.high","memoryHighBytes"]]){let c=y(u.join(
-"/sys/fs/cgroup",n,i),"utf8").trim(),a=c==="max"?null:h(c);if(c!=="max"&&(a===null||t>a))throw Object.assign(new Error(`\
-Memory growth is blocked by an ancestor ${i} limit.`),{limitingGroup:{controlGroup:n,limit:i,maximumBytes:a,requestedBytes:t}});
-o[s]=a}r.push(o)}return r}function _t(e,t,r){let n=e.action==="workflow-limits",o=!1,i=[],s=[],c=[],a=[],l=null;try{let d=D(
-t);if(d.activeState!=="active"||!d.controlGroup||d.finishedAt)throw new Error("Memory growth requires an active workflow\
-.");let p=B(e.memoryMaxBytes,z,we,"workflow memory limit");if(!Array.isArray(e.executions)||e.executions.length>128)throw new Error(
-"Memory growth requires a bounded list of owned executions.");if(l=h(E("getconf",["PAGESIZE"])),!l||l>z)throw new Error(
-"The kernel memory limit granularity is unavailable.");c=[{unitName:t.unitName,controlGroup:d.controlGroup,memoryMaxBytes:Math.
-floor(p/l)*l,expectedMemoryMaxBytes:e.expectedMemoryMaxBytes}];for(let m of e.executions){let f=De(m?.id,r);if(c.some(S=>S.
-unitName===f))throw new Error("Duplicate memory growth execution.");let g=B(m.memoryMaxBytes,z,Re,"execution memory limi\
-t");if(g>p)throw new Error("Execution memory growth exceeds its workflow allowance.");c.push({unitName:f,controlGroup:`${d.
-controlGroup}/${f}`,memoryMaxBytes:Math.floor(g/l)*l,expectedMemoryMaxBytes:m.expectedMemoryMaxBytes})}if(i=c.map(m=>ue(
-m.unitName,m.controlGroup,l,n?void 0:m.memoryMaxBytes)),n)return{ok:!0,id:t.id,pageSizeBytes:l,before:i,after:i,ancestors:le(
-d.controlGroup)};for(let[m,f]of c.entries())if(f.expectedMemoryMaxBytes!==i[m].memoryMaxBytes||f.memoryMaxBytes<i[m].effectiveMemoryMaxBytes)
-throw new Error("Memory growth cannot lower a live limit or apply to stale limits.");a=le(d.controlGroup,c[0].memoryMaxBytes);
-for(let[m,f]of c.entries())i[m].memoryMaxBytes!==f.memoryMaxBytes&&(o=!0,E("systemctl",["set-property","--runtime",f.unitName,
-`MemoryMax=${f.memoryMaxBytes}`]));if(s=c.map(m=>ue(m.unitName,m.controlGroup,l,m.memoryMaxBytes)),a=le(d.controlGroup,c[0].
-memoryMaxBytes),!s.every((m,f)=>m.memoryMaxBytes===c[f].memoryMaxBytes))throw new Error("Memory growth readback did not \
-match the requested limits.");return{ok:!0,id:t.id,changeState:o?"applied":"unchanged",pageSizeBytes:l,before:i,after:s,
-ancestors:a}}catch(d){let p="unchanged";return o&&(s=c.map(m=>{try{return ue(m.unitName,m.controlGroup,l)}catch{return null}}),
-p=s.some(m=>m===null)?"unknown":s.every((m,f)=>m.memoryMaxBytes===i[f].memoryMaxBytes)?"unchanged":"partial"),{ok:!1,id:t.
-id,code:"workflow_memory_growth_failed",changeState:p,error:String(d?.message||d),limitingGroup:d?.limitingGroup??null,pageSizeBytes:l,
-before:i,after:s,ancestors:a}}}function Nt(e={},t={}){let r=_(e.username||t.username),n=X(r);return ne("uid",e.uid,n.uid),
-ne("gid",e.gid,n.gid),n.username!==t.username&&(Se(n.username),Fe(t,n.username)),Ue(n.username,T),n}function W(e=""){let t=String(
+mory.high",maximumBytes:E(a),requestedBytes:n??null}});return{unitName:e,controlGroup:t,memoryMaxBytes:s,effectiveMemoryMaxBytes:i,
+memoryHighBytes:a==="max"?null:E(a)}}function me(e,t){let r=[];for(let n=u.posix.dirname(e);n!=="/";n=u.posix.dirname(n)){
+let o={controlGroup:n};for(let[i,s]of[["memory.max","memoryMaxBytes"],["memory.high","memoryHighBytes"]]){let a=h(u.join(
+"/sys/fs/cgroup",n,i),"utf8").trim(),c=a==="max"?null:E(a);if(a!=="max"&&(c===null||t>c))throw Object.assign(new Error(`\
+Memory growth is blocked by an ancestor ${i} limit.`),{limitingGroup:{controlGroup:n,limit:i,maximumBytes:c,requestedBytes:t}});
+o[s]=c}r.push(o)}return r}function _t(e,t,r){let n=e.action==="workflow-limits",o=!1,i=[],s=[],a=[],c=[],m=null;try{let p=P(
+t);if(p.activeState!=="active"||!p.controlGroup||p.finishedAt)throw new Error("Memory growth requires an active workflow\
+.");let d=U(e.memoryMaxBytes,F,we,"workflow memory limit");if(!Array.isArray(e.executions)||e.executions.length>128)throw new Error(
+"Memory growth requires a bounded list of owned executions.");if(m=E(S("getconf",["PAGESIZE"])),!m||m>F)throw new Error(
+"The kernel memory limit granularity is unavailable.");a=[{unitName:t.unitName,controlGroup:p.controlGroup,memoryMaxBytes:Math.
+floor(d/m)*m,expectedMemoryMaxBytes:e.expectedMemoryMaxBytes}];for(let l of e.executions){let f=De(l?.id,r);if(a.some(x=>x.
+unitName===f))throw new Error("Duplicate memory growth execution.");let g=U(l.memoryMaxBytes,F,$e,"execution memory limi\
+t");if(g>d)throw new Error("Execution memory growth exceeds its workflow allowance.");a.push({unitName:f,controlGroup:`${p.
+controlGroup}/${f}`,memoryMaxBytes:Math.floor(g/m)*m,expectedMemoryMaxBytes:l.expectedMemoryMaxBytes})}if(i=a.map(l=>ue(
+l.unitName,l.controlGroup,m,n?void 0:l.memoryMaxBytes)),n)return{ok:!0,id:t.id,pageSizeBytes:m,before:i,after:i,ancestors:me(
+p.controlGroup)};for(let[l,f]of a.entries())if(f.expectedMemoryMaxBytes!==i[l].memoryMaxBytes||f.memoryMaxBytes<i[l].effectiveMemoryMaxBytes)
+throw new Error("Memory growth cannot lower a live limit or apply to stale limits.");c=me(p.controlGroup,a[0].memoryMaxBytes);
+for(let[l,f]of a.entries())i[l].memoryMaxBytes!==f.memoryMaxBytes&&(o=!0,S("systemctl",["set-property","--runtime",f.unitName,
+`MemoryMax=${f.memoryMaxBytes}`]));if(s=a.map(l=>ue(l.unitName,l.controlGroup,m,l.memoryMaxBytes)),c=me(p.controlGroup,a[0].
+memoryMaxBytes),!s.every((l,f)=>l.memoryMaxBytes===a[f].memoryMaxBytes))throw new Error("Memory growth readback did not \
+match the requested limits.");return{ok:!0,id:t.id,changeState:o?"applied":"unchanged",pageSizeBytes:m,before:i,after:s,
+ancestors:c}}catch(p){let d="unchanged";return o&&(s=a.map(l=>{try{return ue(l.unitName,l.controlGroup,m)}catch{return null}}),
+d=s.some(l=>l===null)?"unknown":s.every((l,f)=>l.memoryMaxBytes===i[f].memoryMaxBytes)?"unchanged":"partial"),{ok:!1,id:t.
+id,code:"workflow_memory_growth_failed",changeState:d,error:String(p?.message||p),limitingGroup:p?.limitingGroup??null,pageSizeBytes:m,
+before:i,after:s,ancestors:c}}}function Nt(e={},t={}){let r=N(e.username||t.username),n=X(r);return ne("uid",e.uid,n.uid),
+ne("gid",e.gid,n.gid),n.username!==t.username&&(Se(n.username),Ke(t,n.username)),Ue(n.username,j),n}function W(e=""){let t=String(
 e||"").trim();if(!pt.test(t))throw new Error("Vibe64 exec helper rejected an invalid managed execution id.");return t.toLowerCase()}
 function Tt(e=""){let t=String(e||"").trim();if(!ft.has(t))throw new Error("Vibe64 exec helper rejected an unknown manag\
 ed execution kind.");return t}function It(e=""){let t=String(e||"").trim();if(!wt.has(t))throw new Error("Vibe64 exec he\
-lper rejected an unknown managed execution mode.");return t}function B(e,t,r,n="value"){let o=Number(e);if(!Number.isSafeInteger(
+lper rejected an unknown managed execution mode.");return t}function U(e,t,r,n="value"){let o=Number(e);if(!Number.isSafeInteger(
 o)||o<t||o>r)throw new Error(`Vibe64 exec helper rejected an invalid managed execution ${n}.`);return o}function De(e="",t={}){
-return`vibe64-exec-${I(_(t.username))}-${W(e).replaceAll("-","")}.service`}function he(e={}){return`vibe64-${I(_(e.username))}\
--work.slice`}function Ee(e={},t=""){return u.join(se(e),"executions",W(t))}function se(e={}){return`/run/vibe64-${I(_(e.
-username))}`}function jt(e={}){let t=se(e);E("install",["-d","-o",_(e.username),"-g",T,"-m","2750",t,u.join(t,"execution\
-s")])}function Rt(e={},t=""){return u.join(Ee(e,t),"result.json")}function $t(e={},t=""){let r=Rt(e,t);try{let n=JSON.parse(
-y(r,"utf8"));return n?.schema==="vibe64.managed-execution.result"&&n.schemaVersion===1&&n.executionId===W(t)?n:{}}catch(n){
+return`vibe64-exec-${$(N(t.username))}-${W(e).replaceAll("-","")}.service`}function he(e={}){return`vibe64-${$(N(e.username))}\
+-work.slice`}function Ee(e={},t=""){return u.join(se(e),"executions",W(t))}function se(e={}){return`/run/vibe64-${$(N(e.
+username))}`}function jt(e={}){let t=se(e);S("install",["-d","-o",N(e.username),"-g",j,"-m","2750",t,u.join(t,"execution\
+s")])}function $t(e={},t=""){return u.join(Ee(e,t),"result.json")}function Rt(e={},t=""){let r=$t(e,t);try{let n=JSON.parse(
+h(r,"utf8"));return n?.schema==="vibe64.managed-execution.result"&&n.schemaVersion===1&&n.executionId===W(t)?n:{}}catch(n){
 if(n?.code==="ENOENT"||n instanceof SyntaxError)return{};throw n}}function Ct(e="",t={}){let r=u.join(e,"result.json"),n=`${r}\
 .tmp-${w.pid}`;oe(n,`${JSON.stringify({...t,schema:"vibe64.managed-execution.result",schemaVersion:1})}
-`,{flag:"wx",mode:384}),Ne(n,r)}function Dt(){let e=String(y("/proc/self/cgroup","utf8")||"").split(`
-`).find(s=>s.startsWith("0::")),t=String(e||"").slice(3).replace(/^\/+/,""),r=t?u.join("/sys/fs/cgroup",t):"";if(!r||!$(
+`,{flag:"wx",mode:384}),Ne(n,r)}function Dt(){let e=String(h("/proc/self/cgroup","utf8")||"").split(`
+`).find(s=>s.startsWith("0::")),t=String(e||"").slice(3).replace(/^\/+/,""),r=t?u.join("/sys/fs/cgroup",t):"";if(!r||!T(
 r))return{};let n=Ae(u.join(r,"cpu.stat")),o=Ae(u.join(r,"memory.events")),i=Bt(u.join(r,"io.stat"));return{resourceCounters:ge(
-r),cpuUsageNSec:String(Number(n.usage_usec||0)*1e3),ioReadBytes:String(i.readBytes),ioWriteBytes:String(i.writeBytes),memoryCurrent:K(
-u.join(r,"memory.current")),memoryPeak:K(u.join(r,"memory.peak")),memorySwapCurrent:K(u.join(r,"memory.swap.current")),oomKillCount:String(
-Number(o.oom_kill||0)),taskLimit:Be(r),tasksCurrent:K(u.join(r,"pids.current")),tasksPeak:K(u.join(r,"pids.peak"))}}function K(e=""){
-try{let t=String(y(e,"utf8")||"0").trim();return/^[0-9]+$/u.test(t)?t:"0"}catch(t){if(t?.code==="ENOENT")return"0";throw t}}
-function Be(e,t=y){if(!e)return null;try{let r=c=>{try{return h(/^max\s+(\d+)$/mu.exec(t(u.join(e,c),"utf8"))?.[1])}catch{
+r),cpuUsageNSec:String(Number(n.usage_usec||0)*1e3),ioReadBytes:String(i.readBytes),ioWriteBytes:String(i.writeBytes),memoryCurrent:z(
+u.join(r,"memory.current")),memoryPeak:z(u.join(r,"memory.peak")),memorySwapCurrent:z(u.join(r,"memory.swap.current")),oomKillCount:String(
+Number(o.oom_kill||0)),taskLimit:Be(r),tasksCurrent:z(u.join(r,"pids.current")),tasksPeak:z(u.join(r,"pids.peak"))}}function z(e=""){
+try{let t=String(h(e,"utf8")||"0").trim();return/^[0-9]+$/u.test(t)?t:"0"}catch(t){if(t?.code==="ENOENT")return"0";throw t}}
+function Be(e,t=h){if(!e)return null;try{let r=a=>{try{return E(/^max\s+(\d+)$/mu.exec(t(u.join(e,a),"utf8"))?.[1])}catch{
 return null}},n=r("pids.events.local"),o=r("pids.events"),i=n>0?n:o;if(!(i>0))return null;let s=t("/proc/self/mountinfo",
 "utf8").split(`
-`).find(c=>c.split(" ")[4]==="/sys/fs/cgroup"&&c.includes(" - cgroup2 "));return{source:"cgroup-pids-events",count:i,scope:n>
+`).find(a=>a.split(" ")[4]==="/sys/fs/cgroup"&&a.includes(" - cgroup2 "));return{source:"cgroup-pids-events",count:i,scope:n>
 0&&s&&!s.split(/[ ,]/u).includes("pids_localevents")?"execution":"unknown"}}catch{return null}}function Ae(e=""){try{return Object.
-fromEntries(String(y(e,"utf8")||"").split(/\r?\n/u).flatMap(t=>{let[r,n]=t.trim().split(/\s+/u);return r&&/^[0-9]+$/u.test(
-n||"")?[[r,n]]:[]}))}catch(t){if(t?.code==="ENOENT")return{};throw t}}function Bt(e=""){let t="";try{t=y(e,"utf8")}catch(o){
+fromEntries(String(h(e,"utf8")||"").split(/\r?\n/u).flatMap(t=>{let[r,n]=t.trim().split(/\s+/u);return r&&/^[0-9]+$/u.test(
+n||"")?[[r,n]]:[]}))}catch(t){if(t?.code==="ENOENT")return{};throw t}}function Bt(e=""){let t="";try{t=h(e,"utf8")}catch(o){
 if(o?.code==="ENOENT")return{readBytes:0,writeBytes:0};throw o}let r=0,n=0;for(let o of String(t||"").split(/\r?\n/u))for(let i of o.
-trim().split(/\s+/u).slice(1)){let[s,c]=i.split("=");s==="rbytes"&&(r+=Number(c||0)),s==="wbytes"&&(n+=Number(c||0))}return{
-readBytes:r,writeBytes:n}}function F(e="",t="",r={}){let n=M("systemctl",["show",e,"--no-pager","--timestamp=us+utc","--\
-property=LoadState,ActiveState,SubState,Result,ExecMainCode,ExecMainStatus,ExecMainStartTimestamp,ExecMainExitTimestamp,\
-MainPID,ControlGroup,MemoryCurrent,MemoryPeak,MemorySwapCurrent,TasksCurrent,TasksMax,CPUUsageNSec,IOReadBytes,IOWriteBy\
-tes"]),o={};for(let g of String(n.stdout||"").split(/\r?\n/u)){let S=g.indexOf("=");S>0&&(o[g.slice(0,S)]=g.slice(S+1))}
-let i=String(o.ControlGroup||"").trim(),s=i?u.join("/sys/fs/cgroup",i.replace(/^\/+/,"")):"",c=ge(s),a=s&&$(s)?c.scopeEmpty:
-!0,l=t?$t(r,t):{},d=Date.parse(l.exitObservedAt||""),p=Number.isFinite(d)?"runner":"systemd",m=Number.isFinite(d)?d:Date.
-parse(o.ExecMainExitTimestamp||""),f=Number.isFinite(m)&&m>0&&m<=Date.now()?new Date(m).toISOString():"";return{resourceCounters:l.
-resourceCounters||c,activeState:String(o.ActiveState||(l.executionId?"inactive":"unknown")),controlGroup:i,cpuUsageNSec:R(
-o.CPUUsageNSec,l.cpuUsageNSec),execMainCode:String(o.ExecMainCode||l.execMainCode||""),execMainStatus:String(o.ExecMainStatus||
-l.execMainStatus||""),exitObservedAt:f,exitTimeSource:f?p:"",ioReadBytes:R(o.IOReadBytes,l.ioReadBytes),ioWriteBytes:R(o.
-IOWriteBytes,l.ioWriteBytes),loadState:String(o.LoadState&&o.LoadState!=="not-found"?o.LoadState:l.executionId?"recorded":
-"not-found"),mainPid:String(o.MainPID||"0"),memoryCurrent:R(o.MemoryCurrent,l.memoryCurrent),memoryPeak:R(o.MemoryPeak,l.
-memoryPeak),memorySwapCurrent:R(o.MemorySwapCurrent,l.memorySwapCurrent),oomKillCount:R(l.oomKillCount),taskLimit:l.taskLimit||
-Be(s),result:String(o.Result||l.result||""),signal:String(l.signal||""),scopeEmpty:a,startedAt:o.ExecMainStartTimestamp||
-"",subState:String(o.SubState||"unknown"),tasksCurrent:R(o.TasksCurrent,l.tasksCurrent),tasksPeak:R(l.tasksPeak),tasksMax:String(
-o.TasksMax||"0"),unitName:e}}function R(...e){return String(e.reduce((t,r)=>{let n=Number(r);return Number.isFinite(n)&&
-n>t?n:t},0))}function Pt(e="",t="",r={}){let n=F(e,t,r),o=null,i=n.taskLimit,s=Date.parse(n.startedAt),c=Date.parse(n.exitObservedAt);
-if((n.result==="oom-kill"||Number(n.oomKillCount)>0)&&s>0&&c>=s){let a=Math.min(Date.now(),c+1e3),l=N("journalctl",["-k",
-"--boot=0","--no-pager","--output=json","--output-fields=__REALTIME_TIMESTAMP,__SEQNUM_ID,__SEQNUM,_BOOT_ID,_SOURCE_MONO\
-TONIC_TIMESTAMP,MESSAGE","--lines=65","--case-sensitive=yes",`--since=@${s/1e3}`,`--until=@${a/1e3}`,`--grep=^oom-kill:|\
-^/[^,]*/${e.replaceAll(".","\\.")}(?:/[^,]*)?,task=`],{encoding:"utf8",timeout:2e3,maxBuffer:128*1024});!l.error&&l.status===
-0&&(o=Vt(l.stdout,{unitName:e,workspace:I(r.username),startedAt:s,until:a}))}if(!i&&n.result&&n.result!=="success"&&s>0&&
-c>=s){let a=Math.min(Date.now(),c+1e3),l=N("journalctl",["-k","--boot=0","--no-pager","--output=json","--output-fields=_\
-_REALTIME_TIMESTAMP,MESSAGE","--lines=65","--case-sensitive=yes",`--since=@${s/1e3}`,`--until=@${a/1e3}`,`--grep=^cgroup\
-: fork rejected by pids controller in /.*${e.replaceAll(".","\\.")}(?:/|$)`],{encoding:"utf8",timeout:2e3,maxBuffer:128*
-1024});!l.error&&l.status===0&&(i=Ut(l.stdout,{unitName:e,workspace:I(r.username),startedAt:s,until:a}))}w.stdout.write(
-`${JSON.stringify({executionId:t,ok:!0,...n,oomBoundary:o,taskLimit:i})}
+trim().split(/\s+/u).slice(1)){let[s,a]=i.split("=");s==="rbytes"&&(r+=Number(a||0)),s==="wbytes"&&(n+=Number(a||0))}return{
+readBytes:r,writeBytes:n}}function K(e="",t="",r={},{query:n=A,readResult:o=Rt}={}){let i=n("systemctl",["show",e,"--no-\
+pager","--timestamp=us+utc","--property=LoadState,ActiveState,SubState,Result,ExecMainCode,ExecMainStatus,ExecMainStartT\
+imestamp,ExecMainExitTimestamp,MainPID,ControlGroup,MemoryCurrent,MemoryPeak,MemorySwapCurrent,TasksCurrent,TasksMax,CPU\
+UsageNSec,IOReadBytes,IOWriteBytes"]),s={};for(let M of String(i.stdout||"").split(/\r?\n/u)){let y=M.indexOf("=");y>0&&
+(s[M.slice(0,y)]=M.slice(y+1))}s.LoadState==="not-found"&&(s={LoadState:"not-found"});let a=String(s.ControlGroup||"").trim(),
+c=a?u.join("/sys/fs/cgroup",a.replace(/^\/+/,"")):"",m=ge(c),p=c&&T(c)?m.scopeEmpty:!0,d=t?o(r,t):{},l=Date.parse(d.exitObservedAt||
+""),f=Number.isFinite(l)?"runner":"systemd",g=Number.isFinite(l)?l:Date.parse(s.ExecMainExitTimestamp||""),x=Number.isFinite(
+g)&&g>0&&g<=Date.now()?new Date(g).toISOString():"";return{resourceCounters:d.resourceCounters||m,activeState:String(s.ActiveState||
+(d.executionId?"inactive":"unknown")),controlGroup:a,cpuUsageNSec:R(s.CPUUsageNSec,d.cpuUsageNSec),execMainCode:String(s.
+ExecMainCode||d.execMainCode||""),execMainStatus:String(s.ExecMainStatus||d.execMainStatus||""),exitObservedAt:x,exitTimeSource:x?
+f:"",ioReadBytes:R(s.IOReadBytes,d.ioReadBytes),ioWriteBytes:R(s.IOWriteBytes,d.ioWriteBytes),loadState:String(s.LoadState&&
+s.LoadState!=="not-found"?s.LoadState:d.executionId?"recorded":"not-found"),mainPid:String(s.MainPID||"0"),memoryCurrent:R(
+s.MemoryCurrent,d.memoryCurrent),memoryPeak:R(s.MemoryPeak,d.memoryPeak),memorySwapCurrent:R(s.MemorySwapCurrent,d.memorySwapCurrent),
+oomKillCount:R(d.oomKillCount),taskLimit:d.taskLimit||Be(c),result:String(s.Result||d.result||""),signal:String(d.signal||
+""),scopeEmpty:p,startedAt:s.ExecMainStartTimestamp||d.startedAt||"",subState:String(s.SubState||"unknown"),tasksCurrent:R(
+s.TasksCurrent,d.tasksCurrent),tasksPeak:R(d.tasksPeak),tasksMax:String(s.TasksMax||"0"),unitName:e}}function R(...e){return String(
+e.reduce((t,r)=>{let n=Number(r);return Number.isFinite(n)&&n>t?n:t},0))}function Pt(e="",t="",r={}){let n=K(e,t,r),o=null,
+i=n.taskLimit,s=Date.parse(n.startedAt),a=Date.parse(n.exitObservedAt);if((n.result==="oom-kill"||Number(n.oomKillCount)>
+0)&&s>0&&a>=s){let c=Math.min(Date.now(),a+1e3),m=I("journalctl",["-k","--boot=0","--no-pager","--output=json","--output\
+-fields=__REALTIME_TIMESTAMP,__SEQNUM_ID,__SEQNUM,_BOOT_ID,_SOURCE_MONOTONIC_TIMESTAMP,MESSAGE","--lines=65","--case-sen\
+sitive=yes",`--since=@${s/1e3}`,`--until=@${c/1e3}`,`--grep=^oom-kill:|^/[^,]*/${e.replaceAll(".","\\.")}(?:/[^,]*)?,tas\
+k=`],{encoding:"utf8",timeout:2e3,maxBuffer:128*1024});!m.error&&m.status===0&&(o=Vt(m.stdout,{unitName:e,workspace:$(r.
+username),startedAt:s,until:c}))}if(!i&&n.result&&n.result!=="success"&&s>0&&a>=s){let c=Math.min(Date.now(),a+1e3),m=I(
+"journalctl",["-k","--boot=0","--no-pager","--output=json","--output-fields=__REALTIME_TIMESTAMP,MESSAGE","--lines=65","\
+--case-sensitive=yes",`--since=@${s/1e3}`,`--until=@${c/1e3}`,`--grep=^cgroup: fork rejected by pids controller in /.*${e.
+replaceAll(".","\\.")}(?:/|$)`],{encoding:"utf8",timeout:2e3,maxBuffer:128*1024});!m.error&&m.status===0&&(i=Ut(m.stdout,
+{unitName:e,workspace:$(r.username),startedAt:s,until:c}))}w.stdout.write(`${JSON.stringify({executionId:t,ok:!0,...n,oomBoundary:o,
+taskLimit:i})}
 `)}function Ut(e,{unitName:t,workspace:r,startedAt:n,until:o}){if(typeof e!="string"||Buffer.byteLength(e)>128*1024)return null;
-let i=e.trim().split(/\r?\n/u);if(i.length>64)return null;for(let s of i){let c;try{c=JSON.parse(s)}catch{continue}let a=Number(
-c?.__REALTIME_TIMESTAMP)/1e3;if(!Number.isFinite(a)||a<n||a>o)continue;let l=typeof c.MESSAGE=="string"&&/^cgroup: fork rejected by pids controller in (\/[a-zA-Z0-9_./-]{1,2048})$/u.
-exec(c.MESSAGE)?.[1];if(!l)continue;let d=l.split("/"),p=d.indexOf(`vibe64-${r}-work.slice`);if(!(d[1]!=="vibe64.slice"||
-p<2||d.indexOf(t)<=p||d.some((m,f)=>f>0&&(!m||m==="."||m===".."))))return{source:"kernel-journal",scope:"unknown",count:null,
-recordedAt:new Date(a).toISOString()}}return null}function Vt(e,{unitName:t,workspace:r,startedAt:n,until:o}){if(typeof e!=
+let i=e.trim().split(/\r?\n/u);if(i.length>64)return null;for(let s of i){let a;try{a=JSON.parse(s)}catch{continue}let c=Number(
+a?.__REALTIME_TIMESTAMP)/1e3;if(!Number.isFinite(c)||c<n||c>o)continue;let m=typeof a.MESSAGE=="string"&&/^cgroup: fork rejected by pids controller in (\/[a-zA-Z0-9_./-]{1,2048})$/u.
+exec(a.MESSAGE)?.[1];if(!m)continue;let p=m.split("/"),d=p.indexOf(`vibe64-${r}-work.slice`);if(!(p[1]!=="vibe64.slice"||
+d<2||p.indexOf(t)<=d||p.some((l,f)=>f>0&&(!l||l==="."||l===".."))))return{source:"kernel-journal",scope:"unknown",count:null,
+recordedAt:new Date(c).toISOString()}}return null}function Vt(e,{unitName:t,workspace:r,startedAt:n,until:o}){if(typeof e!=
 "string"||Buffer.byteLength(e)>128*1024)return null;let i=e.trim().split(/\r?\n/u);if(i.length>64)return null;let s=i.flatMap(
-a=>{try{return[JSON.parse(a)]}catch{return[]}}),c=null;for(let a of s){let l=Number(a?.__REALTIME_TIMESTAMP)/1e3;if(!Number.
-isFinite(l)||l<n||l>o)continue;let d=a.MESSAGE;if(typeof d=="string"&&d.startsWith("oom-kill:")&&d.endsWith(",task_memcg\
-=")){let v=s.find(x=>/^[a-f0-9]{32}$/u.test(a.__SEQNUM_ID||"")&&x?.__SEQNUM_ID===a.__SEQNUM_ID&&x?._BOOT_ID===a._BOOT_ID&&
-/^[a-f0-9]{32}$/u.test(a._BOOT_ID||"")&&Number.isSafeInteger(Number(a.__SEQNUM))&&Number(x.__SEQNUM)===Number(a.__SEQNUM)+
-1&&Number(x._SOURCE_MONOTONIC_TIMESTAMP)>=Number(a._SOURCE_MONOTONIC_TIMESTAMP)&&Number(x._SOURCE_MONOTONIC_TIMESTAMP)-Number(
-a._SOURCE_MONOTONIC_TIMESTAMP)<=1e6&&/^\/[a-zA-Z0-9_./-]+,task=[^,]+,pid=\d+,uid=\d+$/u.test(x.MESSAGE||""));v&&(d+=v.MESSAGE)}
-let p=typeof d=="string"&&d.match(/^oom-kill:constraint=(CONSTRAINT_[A-Z_]+),.*?,(?:oom_memcg=(\/[^,]+)|(global_oom)),task_memcg=(\/[^,]+),task=/u);
-if(!p)continue;let[,m,f,g,S]=p,j=S.split("/"),b=j.indexOf(`vibe64-${r}-work.slice`),G=j.indexOf(t);if(j[1]!=="vibe64.sli\
-ce"||b<2||G<=b||j.some((v,x)=>x>0&&(v==="."||v===".."||!/^[a-zA-Z0-9_.-]+$/u.test(v))))continue;let P;if(m==="CONSTRAINT\
-_NONE"&&g)P="host";else if(m==="CONSTRAINT_MEMCG"&&f&&(S===f||S.startsWith(`${f}/`))){let v=f.split("/").at(-1),x=j.slice(
-0,G+1).join("/");P=f===x||f.startsWith(`${x}/`)?"execution":v===`vibe64-${r}-work.slice`?"workspace_work":v===`vibe64-${r}\
+c=>{try{return[JSON.parse(c)]}catch{return[]}}),a=null;for(let c of s){let m=Number(c?.__REALTIME_TIMESTAMP)/1e3;if(!Number.
+isFinite(m)||m<n||m>o)continue;let p=c.MESSAGE;if(typeof p=="string"&&p.startsWith("oom-kill:")&&p.endsWith(",task_memcg\
+=")){let v=s.find(k=>/^[a-f0-9]{32}$/u.test(c.__SEQNUM_ID||"")&&k?.__SEQNUM_ID===c.__SEQNUM_ID&&k?._BOOT_ID===c._BOOT_ID&&
+/^[a-f0-9]{32}$/u.test(c._BOOT_ID||"")&&Number.isSafeInteger(Number(c.__SEQNUM))&&Number(k.__SEQNUM)===Number(c.__SEQNUM)+
+1&&Number(k._SOURCE_MONOTONIC_TIMESTAMP)>=Number(c._SOURCE_MONOTONIC_TIMESTAMP)&&Number(k._SOURCE_MONOTONIC_TIMESTAMP)-Number(
+c._SOURCE_MONOTONIC_TIMESTAMP)<=1e6&&/^\/[a-zA-Z0-9_./-]+,task=[^,]+,pid=\d+,uid=\d+$/u.test(k.MESSAGE||""));v&&(p+=v.MESSAGE)}
+let d=typeof p=="string"&&p.match(/^oom-kill:constraint=(CONSTRAINT_[A-Z_]+),.*?,(?:oom_memcg=(\/[^,]+)|(global_oom)),task_memcg=(\/[^,]+),task=/u);
+if(!d)continue;let[,l,f,g,x]=d,M=x.split("/"),y=M.indexOf(`vibe64-${r}-work.slice`),D=M.indexOf(t);if(M[1]!=="vibe64.sli\
+ce"||y<2||D<=y||M.some((v,k)=>k>0&&(v==="."||v===".."||!/^[a-zA-Z0-9_.-]+$/u.test(v))))continue;let V;if(l==="CONSTRAINT\
+_NONE"&&g)V="host";else if(l==="CONSTRAINT_MEMCG"&&f&&(x===f||x.startsWith(`${f}/`))){let v=f.split("/").at(-1),k=M.slice(
+0,D+1).join("/");V=f===k||f.startsWith(`${k}/`)?"execution":v===`vibe64-${r}-work.slice`?"workspace_work":v===`vibe64-${r}\
 .slice`?"workspace":v==="vibe64.slice"?"platform":/-work-p[a-f0-9]{64}-s[a-f0-9]{64}-w[a-f0-9]{32}\.slice$/u.test(v)?"wo\
 rkflow":/-work-p[a-f0-9]{64}-s[a-f0-9]{64}\.slice$/u.test(v)?"session":/-work-p[a-f0-9]{64}\.slice$/u.test(v)?"project":
-"ancestor"}else return null;let H=f||"";if(c&&c.cgroup!==H)return null;(!c||l>Date.parse(c.recordedAt))&&(c={source:"ker\
-nel-journal",scope:P,cgroup:H,recordedAt:new Date(l).toISOString()})}return c}function Gt(e="",t="",r={}){let n=F(e,t,r);
-n.scopeEmpty||(M("systemctl",["kill","--kill-who=all","--signal=SIGTERM",e]),M("systemctl",["stop",e]));let o=Date.now()+
-gt,i=F(e,t,r),s=new Int32Array(new SharedArrayBuffer(4));for(;!i.scopeEmpty&&Date.now()<o;)Atomics.wait(s,0,0,25),i=F(e,
-t,r);i.scopeEmpty||(M("systemctl",["kill","--kill-who=all","--signal=SIGKILL",e]),M("systemctl",["stop",e]),i=F(e,t,r)),
-i.scopeEmpty&&(Te(Ee(r,t),{force:!0,recursive:!0}),M("systemctl",["reset-failed",e])),w.stdout.write(`${JSON.stringify({
-executionId:t,ok:i.scopeEmpty,scopeEmpty:i.scopeEmpty,stopped:n.scopeEmpty===!1,...i})}
+"ancestor"}else return null;let H=f||"";if(a&&a.cgroup!==H)return null;(!a||m>Date.parse(a.recordedAt))&&(a={source:"ker\
+nel-journal",scope:V,cgroup:H,recordedAt:new Date(m).toISOString()})}return a}function Gt(e="",t="",r={}){let n=K(e,t,r);
+n.scopeEmpty||A("systemctl",["stop",e]);let o=Date.now()+gt,i=K(e,t,r),s=new Int32Array(new SharedArrayBuffer(4));for(;!i.
+scopeEmpty&&Date.now()<o;)Atomics.wait(s,0,0,25),i=K(e,t,r);i.scopeEmpty||(A("systemctl",["kill","--kill-who=all","--sig\
+nal=SIGKILL",e]),A("systemctl",["stop",e]),i=K(e,t,r)),i.scopeEmpty&&(Te(Ee(r,t),{force:!0,recursive:!0}),A("systemctl",
+["reset-failed",e])),w.stdout.write(`${JSON.stringify({executionId:t,ok:i.scopeEmpty,scopeEmpty:i.scopeEmpty,stopped:n.scopeEmpty===
+!1,...i})}
 `),i.scopeEmpty||w.exit(1)}function Lt(e={}){if(e?.schema!==it||e?.schemaVersion!==st)throw new Error("Vibe64 exec helpe\
-r rejected a non-normalized execution payload.")}function Wt(e="",t={},r=""){Se(r),q(),ce(T),e==="create-system-user"?tr(
-r,String(t.password||"")):X(r),rr(r,T)}function Ht(e={}){let t=q();ce(T);let r=String(e.action||"").trim(),n=ae(e.unitName);
-if(r==="inspect"){Kt(n);return}if(r==="remove"){Yt(n);return}if(r!=="install-start")throw new Error("Vibe64 exec helper \
+r rejected a non-normalized execution payload.")}function Wt(e="",t={},r=""){Se(r),q(),ae(j),e==="create-system-user"?tr(
+r,String(t.password||"")):X(r),rr(r,j)}function Ht(e={}){let t=q();ae(j);let r=String(e.action||"").trim(),n=ce(e.unitName);
+if(r==="inspect"){zt(n);return}if(r==="remove"){Yt(n);return}if(r!=="install-start")throw new Error("Vibe64 exec helper \
 rejected an unknown deployment service action.");let o=ee(e.workingDirectory,t,"workingDirectory"),i=ee(e.environmentFile,
-t,"environmentFile"),s=ee(e.startScript,t,"startScript"),c=[...new Set((Array.isArray(e.requiredUnits)?e.requiredUnits:[]).
-map(d=>ve(d,t)))],a=We(n),l=sr({environmentFile:i,owner:t,requiredUnits:c,startScript:s,unitName:n,workingDirectory:o});
-Pe({activation:"restart",unit:l,unitName:n,unitPath:a})}function Kt(e=""){ae(e);let t=E("systemctl",["show",e,"--no-page\
-r","--property=ActiveState,SubState,Result,ExecMainCode,ExecMainStatus,NRestarts"]),r=M("journalctl",["--unit",e,"--no-p\
+t,"environmentFile"),s=ee(e.startScript,t,"startScript"),a=[...new Set((Array.isArray(e.requiredUnits)?e.requiredUnits:[]).
+map(p=>ve(p,t)))],c=We(n),m=sr({environmentFile:i,owner:t,requiredUnits:a,startScript:s,unitName:n,workingDirectory:o});
+Pe({activation:"restart",unit:m,unitName:n,unitPath:c})}function zt(e=""){ce(e);let t=S("systemctl",["show",e,"--no-page\
+r","--property=ActiveState,SubState,Result,ExecMainCode,ExecMainStatus,NRestarts"]),r=A("journalctl",["--unit",e,"--no-p\
 ager","--output=cat","--lines=80"]),n=String(r.stdout||r.stderr||"").trim();w.stdout.write(["Service state:",t,...n?["",
 "Recent service output:",n]:[]].join(`
 `)+`
-`)}function Ft(e={}){let t=q();ce(T);let r=String(e.action||"").trim(),n=ve(e.unitName,t);if(r!=="install-start")throw new Error(
+`)}function Kt(e={}){let t=q();ae(j);let r=String(e.action||"").trim(),n=ve(e.unitName,t);if(r!=="install-start")throw new Error(
 "Vibe64 exec helper rejected an unknown managed service action.");let o=Oe(e.workingDirectory,t,"workingDirectory"),i=Oe(
-e.startScript,t,"startScript"),s=Le(e.processModel),c=s==="forking"?Ge(e.pidFile,t):"",a=ir(n,t),l=cr({owner:t,pidFile:c,
-processModel:s,startScript:i,unitName:n,workingDirectory:o});zt({owner:t,pidFile:c,unitName:n}),Pe({activation:"start",unit:l,
-unitName:n,unitPath:a})}function zt({owner:e={},pidFile:t="",unitName:r=""}={}){if(!t||!$(t))return;let n=String(y(t,"ut\
+e.startScript,t,"startScript"),s=Le(e.processModel),a=s==="forking"?Ge(e.pidFile,t):"",c=ir(n,t),m=ar({owner:t,pidFile:a,
+processModel:s,startScript:i,unitName:n,workingDirectory:o});Ft({owner:t,pidFile:a,unitName:n}),Pe({activation:"start",unit:m,
+unitName:n,unitPath:c})}function Ft({owner:e={},pidFile:t="",unitName:r=""}={}){if(!t||!T(t))return;let n=String(h(t,"ut\
 f8")||"").trim();if(!/^[1-9][0-9]*$/u.test(n))throw new Error("Vibe64 managed service PID file is invalid.");let o=Number(
-n);if(!Number.isSafeInteger(o)||o<=1)throw new Error("Vibe64 managed service PID is invalid.");if(!me(o)){Q(t,n);return}
+n);if(!Number.isSafeInteger(o)||o<=1)throw new Error("Vibe64 managed service PID is invalid.");if(!le(o)){Q(t,n);return}
 let i=Xt(o);if(i===null){Q(t,n);return}if(i!==e.uid)throw new Error("Vibe64 managed service PID belongs to another OS us\
-er.");if(qt(o,r))return;try{w.kill(o,"SIGTERM")}catch(a){if(a?.code==="ESRCH"){Q(t,n);return}throw a}let s=Date.now()+3e4,
-c=new Int32Array(new SharedArrayBuffer(4));for(;me(o)&&Date.now()<s;)Atomics.wait(c,0,0,100);if(me(o))throw new Error("V\
-ibe64 managed service process did not stop cleanly during ownership transfer.");Q(t,n)}function Q(e="",t=""){$(e)&&String(
-y(e,"utf8")||"").trim()===t&&V(e)}function me(e=0){try{return w.kill(e,0),!0}catch(t){if(t?.code==="ESRCH")return!1;throw t}}
-function Xt(e=0){let t="";try{t=y(`/proc/${e}/status`,"utf8")}catch(o){if(o?.code==="ENOENT")return null;throw o}let r=String(
+er.");if(qt(o,r))return;try{w.kill(o,"SIGTERM")}catch(c){if(c?.code==="ESRCH"){Q(t,n);return}throw c}let s=Date.now()+3e4,
+a=new Int32Array(new SharedArrayBuffer(4));for(;le(o)&&Date.now()<s;)Atomics.wait(a,0,0,100);if(le(o))throw new Error("V\
+ibe64 managed service process did not stop cleanly during ownership transfer.");Q(t,n)}function Q(e="",t=""){T(e)&&String(
+h(e,"utf8")||"").trim()===t&&G(e)}function le(e=0){try{return w.kill(e,0),!0}catch(t){if(t?.code==="ESRCH")return!1;throw t}}
+function Xt(e=0){let t="";try{t=h(`/proc/${e}/status`,"utf8")}catch(o){if(o?.code==="ENOENT")return null;throw o}let r=String(
 t||"").match(/^Uid:\s+([0-9]+)/mu),n=Number(r?.[1]);if(!Number.isSafeInteger(n))throw new Error("Vibe64 managed service \
-process UID is unavailable.");return n}function qt(e=0,t=""){let r=`/${t}`,n="";try{n=y(`/proc/${e}/cgroup`,"utf8")}catch(o){
+process UID is unavailable.");return n}function qt(e=0,t=""){let r=`/${t}`,n="";try{n=h(`/proc/${e}/cgroup`,"utf8")}catch(o){
 if(o?.code==="ENOENT")return!1;throw o}return String(n||"").split(`
 `).some(o=>o.trim().endsWith(r))}function Pe({activation:e="start",unit:t="",unitName:r="",unitPath:n=""}={}){if(e!=="st\
 art"&&e!=="restart")throw new Error("Vibe64 exec helper rejected an unsupported systemd activation.");let o=`${n}.tmp-${w.
-pid}`;oe(o,t,{mode:420});try{E("mv",[o,n])}catch(i){try{V(o)}catch{}throw i}E("systemctl",["daemon-reload"]),E("systemct\
-l",["enable",r]),M("systemctl",["reset-failed",r]);try{E("systemctl",[e,r])}catch(i){throw M("systemctl",["stop",r]),i}}
-function Yt(e=""){ae(e),M("systemctl",["stop",e]),M("systemctl",["disable",e]),M("systemctl",["reset-failed",e]);try{V(We(
-e))}catch(t){if(t?.code!=="ENOENT")throw t}E("systemctl",["daemon-reload"])}function Jt(e=""){let t=e?y(u.resolve(e),"ut\
+pid}`;oe(o,t,{mode:420});try{S("mv",[o,n])}catch(i){try{G(o)}catch{}throw i}S("systemctl",["daemon-reload"]),S("systemct\
+l",["enable",r]),A("systemctl",["reset-failed",r]);try{S("systemctl",[e,r])}catch(i){throw A("systemctl",["stop",r]),i}}
+function Yt(e=""){ce(e),A("systemctl",["stop",e]),A("systemctl",["disable",e]),A("systemctl",["reset-failed",e]);try{G(We(
+e))}catch(t){if(t?.code!=="ENOENT")throw t}S("systemctl",["daemon-reload"])}function Jt(e=""){let t=e?h(u.resolve(e),"ut\
 f8"):Zt();if(Buffer.byteLength(t,"utf8")>Ie)throw new Error("Vibe64 exec helper payload is too large.");let r=JSON.parse(
 t);if(!r||typeof r!="object"||Array.isArray(r))throw new Error("Vibe64 exec helper payload must be a JSON object.");return r}
 function Zt(){let e=[],t=Buffer.allocUnsafe(rt),r=new Int32Array(new SharedArrayBuffer(4)),n=Date.now()+ot,o=0;for(;;)try{
 let i=et(0,t,0,t.length,null);if(i===0)break;if(o+=i,o>Ie)throw new Error("Vibe64 exec helper payload is too large.");e.
 push(Buffer.from(t.subarray(0,i)))}catch(i){if(i?.code==="EINTR")continue;if((i?.code==="EAGAIN"||i?.code==="EWOULDBLOCK")&&
 Date.now()<n){Atomics.wait(r,0,0,nt);continue}throw i?.code==="EAGAIN"||i?.code==="EWOULDBLOCK"?new Error("Vibe64 exec h\
-elper timed out waiting for its payload."):i}return Buffer.concat(e,o).toString("utf8")}function _(e=""){let t=String(e||
+elper timed out waiting for its payload."):i}return Buffer.concat(e,o).toString("utf8")}function N(e=""){let t=String(e||
 "").trim();if(!t||/[/:\\\r\n]/u.test(t))throw new Error("Vibe64 exec helper rejected an unsafe username.");return t}function Qt(e=""){
-if(!lt.test(e))throw new Error("Vibe64 exec helper rejected an unsupported username.")}function Se(e=""){if(Qt(e),e.startsWith(
+if(!mt.test(e))throw new Error("Vibe64 exec helper rejected an unsupported username.")}function Se(e=""){if(Qt(e),e.startsWith(
 re))throw new Error("Vibe64 daemon Unix accounts cannot be managed as app users.");if(dt.has(e))throw new Error("Privile\
-ged Unix accounts cannot be managed as Vibe64 app users.")}function X(e=""){let t=N("getent",["passwd",e],{encoding:"utf\
+ged Unix accounts cannot be managed as Vibe64 app users.")}function X(e=""){let t=I("getent",["passwd",e],{encoding:"utf\
 8"});if(t.status!==0)throw new Error(`OS user was not found: ${e}`);let n=String(t.stdout||"").split(/\r?\n/u)[0].split(
 ":");if(n.length<7||n[0]!==e)throw new Error(`OS user was not found: ${e}`);let o=Number(n[2]),i=Number(n[3]);if(!Number.
 isSafeInteger(o)||!Number.isSafeInteger(i))throw new Error(`OS user has invalid uid/gid: ${e}`);return{gid:i,home:n[5],uid:o,
-username:e}}function q(){let e=_(w.env.SUDO_USER||"");return X(e)}function Ue(e="",t=""){let r=N("id",["-nG",e],{encoding:"\
+username:e}}function q(){let e=N(w.env.SUDO_USER||"");return X(e)}function Ue(e="",t=""){let r=I("id",["-nG",e],{encoding:"\
 utf8"}),n=String(r.stdout||"").trim().split(/\s+/u);if(r.status!==0||!n.includes(t))throw new Error(`OS user is not enab\
-led for the shared Vibe64 group: ${e}`)}function er(e=""){try{return X(e)}catch{return null}}function ce(e=""){if(N("get\
+led for the shared Vibe64 group: ${e}`)}function er(e=""){try{return X(e)}catch{return null}}function ae(e=""){if(I("get\
 ent",["group",e],{encoding:"utf8"}).status!==0)throw new Error(`Required OS group was not found: ${e}`)}function tr(e="",t=""){
 if(er(e))throw new Error(`OS user already exists: ${e}`);if(!t||/[\r\n]/u.test(t))throw new Error("A valid initial passw\
-ord is required to create an OS user.");E("useradd",["--create-home","--user-group","--shell","/bin/bash",e]);let r=N("c\
+ord is required to create an OS user.");S("useradd",["--create-home","--user-group","--shell","/bin/bash",e]);let r=I("c\
 hpasswd",{encoding:"utf8",input:`${e}:${t}
 `});if(r.status!==0)throw new Error(String(r.stderr||r.stdout||"Could not set OS user password.").trim())}function rr(e="",t=""){
-E("usermod",["-a","-G",t,e])}function E(e="",t=[]){let r=N(e,t,{encoding:"utf8"});if(r.status!==0)throw new Error(String(
-r.stderr||r.stdout||`${e} failed.`).trim());return String(r.stdout||"").trim()}function M(e="",t=[]){return N(e,t,{encoding:"\
-utf8"})}function ee(e="",t={},r="path"){let n=nr(e,t);if(!$(n))throw new Error(`Vibe64 deployment service ${r} does not \
-exist.`);return n}function Oe(e="",t={},r="path"){let n=Ge(e,t);if(!$(n))throw new Error(`Vibe64 managed service ${r} do\
-es not exist.`);return n}function Ve(e={}){let t=_(e.username),r=I(t);if(!r)throw new Error("Vibe64 exec helper could no\
+S("usermod",["-a","-G",t,e])}function S(e="",t=[]){let r=I(e,t,{encoding:"utf8"});if(r.status!==0)throw new Error(String(
+r.stderr||r.stdout||`${e} failed.`).trim());return String(r.stdout||"").trim()}function A(e="",t=[]){return I(e,t,{encoding:"\
+utf8"})}function ee(e="",t={},r="path"){let n=nr(e,t);if(!T(n))throw new Error(`Vibe64 deployment service ${r} does not \
+exist.`);return n}function Oe(e="",t={},r="path"){let n=Ge(e,t);if(!T(n))throw new Error(`Vibe64 managed service ${r} do\
+es not exist.`);return n}function Ve(e={}){let t=N(e.username),r=$(t);if(!r)throw new Error("Vibe64 exec helper could no\
 t resolve the managed service workspace.");return u.join("/var/lib/vibe64",r,"services")}function Ge(e="",t={}){let r=String(
-e||"").trim();if(!r)throw new Error("Vibe64 exec helper rejected an empty managed service path.");let n=k(r,{allowMissingLeaf:!0});
-if(U(k(Ve(t)),n).length>0)return n;throw new Error("Vibe64 exec helper rejected a managed service path outside the works\
+e||"").trim();if(!r)throw new Error("Vibe64 exec helper rejected an empty managed service path.");let n=b(r,{allowMissingLeaf:!0});
+if(C(b(Ve(t)),n).length>0)return n;throw new Error("Vibe64 exec helper rejected a managed service path outside the works\
 pace service root.")}function nr(e="",t={}){let r=String(e||"").trim();if(!r)throw new Error("Vibe64 exec helper rejecte\
-d an empty deployment service path.");let n=k(r),o=k(u.join(String(t.home||"").trim(),".local","state","vibe64","project\
+d an empty deployment service path.");let n=b(r),o=b(u.join(String(t.home||"").trim(),".local","state","vibe64","project\
 s"));if(or(o,n))return n;throw new Error("Vibe64 exec helper rejected a deployment service path outside managed roots.")}
-function or(e="",t=""){let r=U(e,t);return r.length>=5&&r[1]==="deployments"&&r[2]==="releases"&&(r[4]==="artifact"||r[4]===
-"service")}function U(e="",t=""){let r=String(e||"").trim(),n=String(t||"").trim();if(!r||!n)return[];let o=u.relative(u.
-resolve(r),u.resolve(n));return!o||o.startsWith("..")||u.isAbsolute(o)?[]:o.split(u.sep).filter(Boolean)}function k(e,{allowMissingLeaf:t=!1}={}){
+function or(e="",t=""){let r=C(e,t);return r.length>=5&&r[1]==="deployments"&&r[2]==="releases"&&(r[4]==="artifact"||r[4]===
+"service")}function C(e="",t=""){let r=String(e||"").trim(),n=String(t||"").trim();if(!r||!n)return[];let o=u.relative(u.
+resolve(r),u.resolve(n));return!o||o.startsWith("..")||u.isAbsolute(o)?[]:o.split(u.sep).filter(Boolean)}function b(e,{allowMissingLeaf:t=!1}={}){
 let r=u.resolve(e);if(t)try{fe(r)}catch(n){if(n.code!=="ENOENT")throw n;return u.join(te(u.dirname(r)),u.basename(r))}return te(
-r)}function ae(e=""){let t=String(e||"").trim();if(!t.startsWith("vibe64-release-")||!t.endsWith(".service")||!/^[A-Za-z0-9_.@:-]+$/u.
+r)}function ce(e=""){let t=String(e||"").trim();if(!t.startsWith("vibe64-release-")||!t.endsWith(".service")||!/^[A-Za-z0-9_.@:-]+$/u.
 test(t)||t.includes("/")||t.includes(".."))throw new Error("Vibe64 exec helper rejected an unsafe deployment service uni\
 t name.");return t}function ve(e="",t={}){let r=String(e||"").trim(),n=u.basename(u.dirname(Ve(t)));if(!r.startsWith(`vi\
 be64-managed-${n}-`)||!r.endsWith(".service")||!/^[A-Za-z0-9_.@:-]+$/u.test(r)||r.includes("/")||r.includes(".."))throw new Error(
 "Vibe64 exec helper rejected an unsafe managed service unit name.");return r}function Le(e=""){let t=String(e||"").trim();
 if(t!=="forking"&&t!=="simple")throw new Error("Vibe64 exec helper rejected an unsupported managed service process model\
-.");return t}function We(e=""){return u.join("/etc/systemd/system",ae(e))}function ir(e="",t={}){return u.join("/etc/sys\
-temd/system",ve(e,t))}function He(e={}){return[`User=${O(e.username)}`,`Group=${T}`,"SupplementaryGroups=nix-users","UMa\
-sk=0007"]}function Ke(e={}){return[`Slice=vibe64-${I(_(e.username))}-work.slice`,"MemoryAccounting=yes","IOAccounting=ye\
+.");return t}function We(e=""){return u.join("/etc/systemd/system",ce(e))}function ir(e="",t={}){return u.join("/etc/sys\
+temd/system",ve(e,t))}function He(e={}){return[`User=${_(e.username)}`,`Group=${j}`,"SupplementaryGroups=nix-users","UMa\
+sk=0007"]}function ze(e={}){return[`Slice=vibe64-${$(N(e.username))}-work.slice`,"MemoryAccounting=yes","IOAccounting=ye\
 s","TasksAccounting=yes","KillMode=control-group","OOMPolicy=stop"]}function sr({environmentFile:e="",owner:t={},requiredUnits:r=[],
 startScript:n="",unitName:o="",workingDirectory:i=""}={}){let s=Array.isArray(r)?r:[];return["[Unit]",`Description=Vibe6\
 4 release service ${o}`,`After=${["network-online.target",...s].join(" ")}`,"Wants=network-online.target",...s.length>0?
-[`Requires=${s.join(" ")}`]:[],"StartLimitIntervalSec=60","StartLimitBurst=5","","[Service]","Type=simple",...He(t),...Ke(
-t),`WorkingDirectory=${O(i)}`,`EnvironmentFile=${O(e)}`,`Environment=PATH=${O(ie)}`,`Environment=TMPDIR=${O(Y(t.username))}`,
-`ExecStart=${O(n)}`,"Restart=always","RestartSec=3","KillSignal=SIGTERM","TimeoutStopSec=30","","[Install]","WantedBy=mu\
+[`Requires=${s.join(" ")}`]:[],"StartLimitIntervalSec=60","StartLimitBurst=5","","[Service]","Type=simple",...He(t),...ze(
+t),`WorkingDirectory=${_(i)}`,`EnvironmentFile=${_(e)}`,`Environment=PATH=${_(ie)}`,`Environment=TMPDIR=${_(Y(t.username))}`,
+`ExecStart=${_(n)}`,"Restart=always","RestartSec=3","KillSignal=SIGTERM","TimeoutStopSec=30","","[Install]","WantedBy=mu\
 lti-user.target",""].join(`
-`)}function cr({owner:e={},pidFile:t="",processModel:r="simple",startScript:n="",unitName:o="",workingDirectory:i=""}={}){
+`)}function ar({owner:e={},pidFile:t="",processModel:r="simple",startScript:n="",unitName:o="",workingDirectory:i=""}={}){
 let s=Le(r);return["[Unit]",`Description=Vibe64 managed service ${o}`,"After=network-online.target","Wants=network-onlin\
-e.target","","[Service]",`Type=${s}`,...He(e),...Ke(e),`WorkingDirectory=${O(i)}`,`Environment=PATH=${O(ie)}`,`Environme\
-nt=TMPDIR=${O(Y(e.username))}`,`ExecStart=${O(n)}`,...s==="forking"?[`PIDFile=${O(t)}`]:[],"Restart=on-failure","Restart\
+e.target","","[Service]",`Type=${s}`,...He(e),...ze(e),`WorkingDirectory=${_(i)}`,`Environment=PATH=${_(ie)}`,`Environme\
+nt=TMPDIR=${_(Y(e.username))}`,`ExecStart=${_(n)}`,...s==="forking"?[`PIDFile=${_(t)}`]:[],"Restart=on-failure","Restart\
 Sec=3","TimeoutStartSec=90","TimeoutStopSec=30","","[Install]","WantedBy=multi-user.target",""].join(`
-`)}function O(e=""){let t=String(e||"").trim();if(!t||/[\r\n]/u.test(t))throw new Error("Vibe64 exec helper rejected an \
+`)}function _(e=""){let t=String(e||"").trim();if(!t||/[\r\n]/u.test(t))throw new Error("Vibe64 exec helper rejected an \
 unsafe systemd value.");return t.replaceAll("\\","\\\\").replaceAll('"','\\"')}function ne(e="uid",t=null,r=null){if(!Number.
-isSafeInteger(t)||t<0||t!==r)throw new Error(`Vibe64 exec helper ${e} mismatch.`)}function Fe(e={},t=""){let r=u.join(e.
-home,".local","state","vibe64","users",`${t}.json`),n=JSON.parse(y(r,"utf8"));if(n?.username!==t||n?.status!=="active")throw new Error(
-"OS user is not enabled for Vibe64.")}function ze(e="",t="",{operation:r="",targetUser:n={}}={}){if(r==="health-status")
-return Y(t);let o=String(e||"").trim();if(!o)return"/";if(r==="account-auth-terminal"||r==="account-status"||r==="github\
--api-command")return ur(o,n);if(r==="vibe64-command"&&n.username===t){let i=k(o),s=u.join(n.home,".local","state","vibe6\
-4","projects");if($(s)){let a=k(s);if(i===a||i.startsWith(`${a}${u.sep}`))return i}let c=u.join(n.home,".local","state",
-"vibe64","colleague");if($(c)){let a=U(k(c),i);if(a.length===2&&/^[A-Za-z0-9_-]+$/u.test(a[0])&&/^colleague_[a-f0-9]{32}$/u.
-test(a[1]))return i}}if(r==="codex-app-server"||r==="opencode-app-server"){let i=k(o),s=Number(n.uid),c=[se({username:t})];
-Number.isSafeInteger(s)&&s>=0&&c.push(u.join("/run/user",String(s)));for(let a of c){let l=u.join(a,"vibe64","agent-prov\
-iders");if(!$(l))continue;let d=k(l),p=U(d,i),m=p[0],f=r==="opencode-app-server"?m==="opencode":m==="codex-app-server"||
-/^codex-app-server-[a-f0-9]{12}$/u.test(m),g=r==="codex-app-server"&&p.length===1,S=p.length===2&&p[1]==="workspace";if(f&&
-(g||S))return i}}return ar(o,t)}function ar(e="",t=""){let r=String(e||"").trim();if(!r)throw new Error("Vibe64 exec hel\
-per rejected an empty managed project path.");let n=k(r),o=k(u.join("/var/lib/vibe64",I(t),"projects"));if(n.startsWith(
+isSafeInteger(t)||t<0||t!==r)throw new Error(`Vibe64 exec helper ${e} mismatch.`)}function Ke(e={},t=""){let r=u.join(e.
+home,".local","state","vibe64","users",`${t}.json`),n=JSON.parse(h(r,"utf8"));if(n?.username!==t||n?.status!=="active")throw new Error(
+"OS user is not enabled for Vibe64.")}function Fe(e="",t="",{operation:r="",targetUser:n={}}={}){if(r==="health-status")
+return Y(t);if(r==="workspace-cache-command"){let i=u.join(n.home,".local/state/vibe64/cache-maintenance"),s=b(e),a=C(i,
+s);if(n.username!==t||b(i)!==i||s!==e||a.length!==1||!/^[a-z][a-z0-9-]*-[A-Za-z0-9]{6}$/u.test(a[0]))throw new Error("Ca\
+che maintenance requires an owned workspace scratch directory.");return s}let o=String(e||"").trim();if(!o)return"/";if(r===
+"account-auth-terminal"||r==="account-status"||r==="github-api-command")return ur(o,n);if(r==="vibe64-command"&&n.username===
+t){let i=b(o),s=u.join(n.home,".local","state","vibe64","projects");if(T(s)){let m=b(s);if(i===m||i.startsWith(`${m}${u.
+sep}`))return i}let a=u.join(n.home,".local","state","vibe64","colleague");if(T(a)){let m=C(b(a),i);if(m.length===2&&/^[A-Za-z0-9_-]+$/u.
+test(m[0])&&/^colleague_[a-f0-9]{32}$/u.test(m[1]))return i}let c=u.join(n.home,".local","state","vibe64","training-sour\
+ces");if(T(c)){let m=C(b(c),i);if(m.length===1&&/^(catalogue|topic)-[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/u.
+test(m[0]))return i}}if(r==="codex-app-server"||r==="opencode-app-server"){let i=b(o),s=Number(n.uid),a=[se({username:t})];
+Number.isSafeInteger(s)&&s>=0&&a.push(u.join("/run/user",String(s)));for(let c of a){let m=u.join(c,"vibe64","agent-prov\
+iders");if(!T(m))continue;let p=b(m),d=C(p,i),l=d[0],f=r==="opencode-app-server"?l==="opencode":l==="codex-app-server"||
+/^codex-app-server-[a-f0-9]{12}$/u.test(l),g=r==="codex-app-server"&&d.length===1,x=d.length===2&&d[1]==="workspace";if(f&&
+(g||x))return i}}return cr(o,t)}function cr(e="",t=""){let r=String(e||"").trim();if(!r)throw new Error("Vibe64 exec hel\
+per rejected an empty managed project path.");let n=b(r),o=b(u.join("/var/lib/vibe64",$(t),"projects"));if(n.startsWith(
 `${o}${u.sep}`))return n;throw new Error("Vibe64 exec helper rejected a command path outside the owner project root.")}function ur(e="",t={}){
 let r=String(e||"").trim(),n=String(t.home||"").trim();if(!r||!n)throw new Error("Vibe64 exec helper rejected an empty u\
-ser command path.");let o=k(r),i=k(n);if(o===i||o.startsWith(`${i}${u.sep}`))return o;throw new Error("Vibe64 exec helpe\
-r rejected a command path outside the target user home.")}function I(e=""){return e.startsWith(re)?e.slice(re.length):e}
-function Y(e=""){return u.join(mt,I(_(e)),"tmp")}function be(e={},t={},r="",n=""){let o={PATH:ie,TERM:w.env.TERM||"xterm\
--256color"};for(let[i,s]of Object.entries(e))!at.test(i)||ut.has(i)||i.startsWith("LD_")||i.startsWith("DYLD_")||(o[i]=String(
+ser command path.");let o=b(r),i=b(n);if(o===i||o.startsWith(`${i}${u.sep}`))return o;throw new Error("Vibe64 exec helpe\
+r rejected a command path outside the target user home.")}function $(e=""){return e.startsWith(re)?e.slice(re.length):e}
+function Y(e=""){return u.join(lt,$(N(e)),"tmp")}function be(e={},t={},r="",n=""){let o={PATH:ie,TERM:w.env.TERM||"xterm\
+-256color"};for(let[i,s]of Object.entries(e))!ct.test(i)||ut.has(i)||i.startsWith("LD_")||i.startsWith("DYLD_")||(o[i]=String(
 s));if(n==="opencode-app-server"){let i=u.join(se({username:r}),"vibe64","agent-providers","opencode");for(let s of["HOM\
-E","XDG_CACHE_HOME","XDG_CONFIG_HOME","XDG_DATA_HOME","XDG_STATE_HOME"]){let c=String(e[s]||"").trim();if(!u.isAbsolute(
-c)||U(i,c).length===0)throw new Error(`Vibe64 exec helper rejected OpenCode ${s} outside its provider runtime.`);o[s]=u.
-resolve(c)}}else o.HOME=t.home,o.XDG_CACHE_HOME=u.join(t.home,".cache"),o.XDG_CONFIG_HOME=u.join(t.home,".config"),o.XDG_DATA_HOME=
-u.join(t.home,".local","share");return o.LOGNAME=t.username,o.USER=t.username,o.TMPDIR=Y(r),o}export{ne as assertExpectedId,k as canonicalPath,be as helperChildEnv,Vt as managedExecutionOomBoundary,Be as managedExecutionTaskLimitCounters,
-Ut as managedExecutionTaskLimitJournal,ge as managedWorkflowCounters,Ce as managedWorkflowIdentity,ze as resolveAllowedCwd,
-nr as resolveAllowedDeploymentServicePath,ur as resolveAllowedUserHomePath,Et as runUserCommand};
+E","XDG_CACHE_HOME","XDG_CONFIG_HOME","XDG_DATA_HOME","XDG_STATE_HOME"]){let a=String(e[s]||"").trim();if(!u.isAbsolute(
+a)||C(i,a).length===0)throw new Error(`Vibe64 exec helper rejected OpenCode ${s} outside its provider runtime.`);o[s]=u.
+resolve(a)}}else o.HOME=t.home,o.XDG_CACHE_HOME=u.join(t.home,".cache"),o.XDG_CONFIG_HOME=u.join(t.home,".config"),o.XDG_DATA_HOME=
+u.join(t.home,".local","share");return o.LOGNAME=t.username,o.USER=t.username,o.TMPDIR=Y(r),o}export{ne as assertExpectedId,b as canonicalPath,be as helperChildEnv,Vt as managedExecutionOomBoundary,K as managedExecutionState,
+Be as managedExecutionTaskLimitCounters,Ut as managedExecutionTaskLimitJournal,ge as managedWorkflowCounters,Ce as managedWorkflowIdentity,
+Fe as resolveAllowedCwd,nr as resolveAllowedDeploymentServicePath,ur as resolveAllowedUserHomePath,Et as runUserCommand};