vibe64 0.1.39 → 0.1.40

package/node_modules/@local/vibe64-execution/src/host/execHelper.js

@@ -17,8 +17,8 @@ opt/vibe64/runtime-packs/python/bin","/opt/vibe64/runtime-packs/ruby/bin","/opt/
 4/runtime-packs/java/bin","/opt/vibe64/runtime-packs/kotlin/bin","/opt/vibe64/runtime-packs/csharp/bin","/opt/vibe64/run\
 time-packs/rust/bin","/opt/vibe64/runtime-packs/mariadb/bin","/opt/vibe64/runtime-packs/postgresql/bin","/opt/vibe64/run\
 time-packs/sqlite/bin","/opt/vibe64/runtime-packs/playwright/bin","/opt/vibe64/runtime-packs/guard-bin","/usr/local/sbin",
-"/usr/local/bin","/usr/sbin","/usr/bin","/sbin","/bin"].join(":"),mt=/^[a-z][a-z0-9_-]{0,61}[a-z0-9]$/u,j="vibe64",re="v\
-64d_",lt="/var/lib/vibe64",dt=new Set(["root"]),pt=/^[a-f0-9]{8}-[a-f0-9]{4}-[1-8][a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}$/iu,
+"/usr/local/bin","/usr/sbin","/usr/bin","/sbin","/bin"].join(":"),lt=/^[a-z][a-z0-9_-]{0,61}[a-z0-9]$/u,j="vibe64",re="v\
+64d_",mt="/var/lib/vibe64",dt=new Set(["root"]),pt=/^[a-f0-9]{8}-[a-f0-9]{4}-[1-8][a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}$/iu,
 ft=new Set(["assistant","browser","control","job","preview","service","terminal"]),wt=new Set(["capture","detached","pty"]),
 F=64*1024*1024,$e=1024*1024*1024*1024,yt=256*1024*1024,we=1024*1024*1024*1024,de=8,pe=8192,gt=15e3;import.meta.main&&ht().
 catch(e=>{w.stderr.write(`${String(e?.message||e)}
@@ -29,8 +29,8 @@ Ht(e);return}if(t==="managed-service"){Kt(e);return}if(t==="managed-execution"){
 if(t==="create-system-user"||t==="enable-system-user"){Wt(t,e,r);return}Se(r);let n=String(e.command||"").trim();if(!je.
 has(n))throw new Error("Vibe64 exec helper rejected an unknown command.");let o=X(r);ne("uid",e.uid,o.uid),ne("gid",e.gid,
 o.gid);let i=q();Ke(i,r),Ue(o.username,j);let s=Fe(e.cwd||"",i.username,{operation:t,targetUser:o}),a=be(e.env||{},o,i.username,
-t),c=Array.isArray(e.args)?e.args.map(d=>String(d)):[],m=e.inputBase64?Buffer.from(String(e.inputBase64),"base64"):void 0;
-w.umask(7);let p=Et(o,n,c,{cwd:s,env:a,...m===void 0?{stdio:"inherit"}:{input:m,stdio:["pipe","inherit","inherit"]}});if(p.
+t),c=Array.isArray(e.args)?e.args.map(m=>String(m)):[],l=e.inputBase64?Buffer.from(String(e.inputBase64),"base64"):void 0;
+w.umask(7);let p=Et(o,n,c,{cwd:s,env:a,...l===void 0?{stdio:"inherit"}:{input:l,stdio:["pipe","inherit","inherit"]}});if(p.
 error)throw p.error;w.exit(typeof p.status=="number"?p.status:1)}function Et(e,t,r,n){return I("/usr/sbin/runuser",["-u",
 e.username,"--","/usr/bin/env","--",`PATH=${n.env.PATH}`,t,...r],{...n,env:{...n.env,PATH:ie}})}function St(e={},t=""){let r=q();
 vt(t,r),ae(j);let n=String(e.action||"").trim();if(n.startsWith("workflow-")){let O=Ot(e,r);w.stdout.write(`${JSON.stringify(
@@ -39,11 +39,11 @@ O)}
 i,o,r);return}if(n!=="start")throw new Error("Vibe64 exec helper rejected an unknown managed execution action.");let s=It(
 e.mode),a=Tt(e.kind),c=String(e.lifecycle||"").trim();if(c!==(s==="capture"?"finite":s==="pty"?"interactive":"service"))
 throw new Error("Vibe64 exec helper rejected a managed execution lifecycle mismatch.");let p=Re(e.controllerLeaseName,c),
-d=Nt(e,r),l=String(e.commandOperation||"").trim(),f=Fe(e.cwd||"",r.username,{operation:l,targetUser:d}),g=String(e.command||
+m=Nt(e,r),d=String(e.commandOperation||"").trim(),f=Fe(e.cwd||"",r.username,{operation:d,targetUser:m}),g=String(e.command||
 "").trim();if(!g||/[\r\n]/u.test(g))throw new Error("Vibe64 exec helper rejected an invalid managed execution command.");
-if(d.username!==r.username&&!je.has(u.basename(g)))throw new Error("Vibe64 exec helper rejected an unsupported real-user\
- managed command.");let x=Array.isArray(e.args)?e.args.map(O=>String(O)):[],M=be(e.env||{},d,r.username,l),y="";if(e.releaseEnvironmentFile){
-if(s!=="capture"||d.username!==r.username)throw new Error("Release environment requires finite owner execution.");y=ee(e.
+if(m.username!==r.username&&!je.has(u.basename(g)))throw new Error("Vibe64 exec helper rejected an unsupported real-user\
+ managed command.");let x=Array.isArray(e.args)?e.args.map(O=>String(O)):[],M=be(e.env||{},m,r.username,d),y="";if(e.releaseEnvironmentFile){
+if(s!=="capture"||m.username!==r.username)throw new Error("Release environment requires finite owner execution.");y=ee(e.
 releaseEnvironmentFile,r,"environmentFile");let O=fe(y),B=u.join(u.dirname(u.dirname(y)),"workspace");if(u.basename(y)!==
 "environment"||u.basename(u.dirname(y))!=="service"||!O.isFile()||O.uid!==r.uid||(O.mode&63)!==0||te(y)!==y||te(f)!==f||
 f!==B&&C(B,f).length===0)throw new Error("Release environment must belong to the selected private release.")}let D=U(e.memoryMaxBytes,
@@ -52,12 +52,12 @@ workTasksMax,de,pe,"work-slice task limit");if(D>H||V>v)throw new Error("Vibe64
 above its work-slice limit.");let k=he(r);if(e.workflow){let O=Ce(e.workflow,r),B=P(O);if(B.activeState!=="active"||!B.controlGroup||
 B.finishedAt)throw new Error("Vibe64 exec helper rejected an execution without its active workflow group.");if(D>B.memoryMaxBytes||
 V>B.tasksMax)throw new Error("Vibe64 exec helper rejected an execution limit above its workflow limit.");k=O.unitName}else
-Mt(r,{memoryMaxBytes:H,tasksMax:v});jt(r);let J=Ee(r,o),Z=u.join(J,"command.json");_e(J,{mode:448,recursive:!0}),xe(J,d.
-uid,d.gid),oe(Z,`${JSON.stringify({args:x,command:g,controllerLeaseName:p,cwd:f,env:M,inputBase64:String(e.inputBase64||
+Mt(r,{memoryMaxBytes:H,tasksMax:v});jt(r);let J=Ee(r,o),Z=u.join(J,"command.json");_e(J,{mode:448,recursive:!0}),xe(J,m.
+uid,m.gid),oe(Z,`${JSON.stringify({args:x,command:g,controllerLeaseName:p,cwd:f,env:M,inputBase64:String(e.inputBase64||
 ""),inputPresent:e.inputPresent===!0,...y?{releaseEnvironment:!0}:{},executionId:o,schema:"vibe64.managed-execution.comm\
 and",schemaVersion:1})}
-`,{flag:"wx",mode:384}),Je(Z,384),xe(Z,d.uid,d.gid);let Xe=u.resolve(w.argv[1]),qe=["--quiet",`--unit=${i}`,"--service-t\
-ype=exec",`--slice=${k}`,`--property=Description=Vibe64 ${a} execution`,`--property=User=${d.username}`,`--property=Grou\
+`,{flag:"wx",mode:384}),Je(Z,384),xe(Z,m.uid,m.gid);let Xe=u.resolve(w.argv[1]),qe=["--quiet",`--unit=${i}`,"--service-t\
+ype=exec",`--slice=${k}`,`--property=Description=Vibe64 ${a} execution`,`--property=User=${m.username}`,`--property=Grou\
 p=${j}`,"--property=SupplementaryGroups=nix-users","--property=UMask=0007",`--property=WorkingDirectory=${f}`,...y?[`--p\
 roperty=EnvironmentFile=${y}`]:[],"--property=KillMode=control-group","--property=ExitType=cgroup","--property=OOMPolicy\
 =stop","--property=MemoryAccounting=yes","--property=IOAccounting=yes","--property=TasksAccounting=yes",`--property=Memo\
@@ -69,15 +69,15 @@ length!==1)throw new Error("Vibe64 exec helper rejected an unsafe managed execut
 let t=u.resolve(String(e||"")),r=h(t,"utf8");G(t);let n=JSON.parse(r);if(n?.schema!=="vibe64.managed-execution.command"||
 n?.schemaVersion!==1)throw new Error("Vibe64 managed execution runner rejected an invalid payload.");let o=String(n.command||
 "").trim();if(!o||/[\r\n]/u.test(o))throw new Error("Vibe64 managed execution runner rejected an invalid command.");let i=Re(
-n.controllerLeaseName,n.controllerLeaseName?"service":""),s=i?await xt(i):null;w.umask(7);let a=null,c=null,m=!1,p=()=>{
-m=!0,a&&c===null&&(c=Me(a))};s?.once("close",p);let d=new Date().toISOString();try{a=Ye(o,Array.isArray(n.args)?n.args.map(
+n.controllerLeaseName,n.controllerLeaseName?"service":""),s=i?await xt(i):null;w.umask(7);let a=null,c=null,l=!1,p=()=>{
+l=!0,a&&c===null&&(c=Me(a))};s?.once("close",p);let m=new Date().toISOString();try{a=Ye(o,Array.isArray(n.args)?n.args.map(
 String):[],{cwd:String(n.cwd||"/"),detached:!!s,env:n.releaseEnvironment===!0?be({...w.env,...n.env},{username:n.env.USER,
 home:n.env.HOME},n.env.USER):n.env&&typeof n.env=="object"&&!Array.isArray(n.env)?n.env:{},stdio:n.inputPresent===!0?["p\
 ipe","inherit","inherit"]:"inherit"}),n.inputPresent===!0&&a.stdin.end(Buffer.from(String(n.inputBase64||""),"base64")),
-m&&(c=Me(a));let l=await new Promise((g,x)=>{let M="";a.once("exit",()=>{M=new Date().toISOString()}),a.once("error",x),
-a.once("close",(y,D)=>g({signal:D,status:y,exitObservedAt:M}))}),f=typeof l.status=="number"?l.status:1;Ct(u.dirname(t),
-{...Dt(),executionId:W(n.executionId),startedAt:d,exitObservedAt:l.exitObservedAt,execMainCode:l.signal?"killed":"exited",
-execMainStatus:l.signal||String(f),result:l.signal?"signal":f===0?"success":"exit-code",signal:String(l.signal||"")}),w.
+l&&(c=Me(a));let d=await new Promise((g,x)=>{let M="";a.once("exit",()=>{M=new Date().toISOString()}),a.once("error",x),
+a.once("close",(y,D)=>g({signal:D,status:y,exitObservedAt:M}))}),f=typeof d.status=="number"?d.status:1;Ct(u.dirname(t),
+{...Dt(),executionId:W(n.executionId),startedAt:m,exitObservedAt:d.exitObservedAt,execMainCode:d.signal?"killed":"exited",
+execMainStatus:d.signal||String(f),result:d.signal?"signal":f===0?"success":"exit-code",signal:String(d.signal||"")}),w.
 exitCode=f}finally{c!==null&&clearTimeout(c),s?.off("close",p),s?.destroy()}}function Re(e="",t=""){let r=String(e||"");
 if(t!=="service"){if(r)throw new Error("Vibe64 exec helper rejected a controller lease on a finite execution.");return""}
 if(!/^\0vibe64-resource-controller-[a-z][a-z0-9-]{0,62}$/u.test(r))throw new Error("Vibe64 exec helper rejected an inval\
@@ -113,7 +113,7 @@ r.MemoryMax),tasksMax:E(r.TasksMax),...ge(n?u.join("/sys/fs/cgroup",n):"")};t.st
 "string"&&/^[0-9]+$/u.test(e.trim())&&Number.isSafeInteger(Number(e))?Number(e):null}function ge(e=""){function t(a){if(!e)
 return"";try{return h(u.join(e,a),"utf8")}catch(c){if(c.code==="ENOENT"||c.code==="ENODEV")return"";throw c}}function r(a){
 return Object.fromEntries(t(a).trim().split(`
-`).map(c=>{let[m,p]=c.trim().split(/\s+/u);return[m,E(p)]}))}let n=r("memory.events"),o=r("memory.stat"),i=r("cgroup.eve\
+`).map(c=>{let[l,p]=c.trim().split(/\s+/u);return[l,E(p)]}))}let n=r("memory.events"),o=r("memory.stat"),i=r("cgroup.eve\
 nts"),s=t("memory.pressure");return{sampledAt:new Date().toISOString(),sampledMonotonicMs:Number(w.hrtime.bigint()/1000000n),
 scopeEmpty:i.populated===0?!0:i.populated===1?!1:null,memoryCurrentBytes:E(t("memory.current")),memoryPeakBytes:E(t("mem\
 ory.peak")),memorySwapCurrentBytes:E(t("memory.swap.current")),memoryAnonBytes:o.anon??null,memoryFileBytes:o.file??null,
@@ -137,35 +137,35 @@ empty",...o};At(r,{...o,finishedAt:new Date().toISOString()})}let i=A("systemctl
 "inactive"||s.controlGroup||s.scopeEmpty!==!0)throw new Error(String(i.stderr||"Managed workflow group did not stop.").trim());
 return{ok:!0,...s}}throw new Error("Vibe64 exec helper rejected an unknown workflow action.")}function ue(e,t,r,n){let o=Object.
 fromEntries(S("systemctl",["show",e,"--no-pager","--property=ActiveState,ControlGroup,MemoryMax"]).split(`
-`).map(c=>{let m=c.indexOf("=");return[c.slice(0,m),c.slice(m+1)]}));if(o.ActiveState!=="active"||o.ControlGroup!==t)throw new Error(
+`).map(c=>{let l=c.indexOf("=");return[c.slice(0,l),c.slice(l+1)]}));if(o.ActiveState!=="active"||o.ControlGroup!==t)throw new Error(
 "Memory growth requires the same active, owned accounting group.");let i=E(h(u.join("/sys/fs/cgroup",t,"memory.max"),"ut\
 f8")),s=E(o.MemoryMax);if(s===null||i!==Math.floor(s/r)*r)throw new Error("The effective memory limit could not be verif\
 ied.");let a=h(u.join("/sys/fs/cgroup",t,"memory.high"),"utf8").trim();if(a!=="max"&&(E(a)===null||n>Number(a)))throw Object.
 assign(new Error("Memory growth is blocked by the target's memory.high limit."),{limitingGroup:{controlGroup:t,limit:"me\
 mory.high",maximumBytes:E(a),requestedBytes:n??null}});return{unitName:e,controlGroup:t,memoryMaxBytes:s,effectiveMemoryMaxBytes:i,
-memoryHighBytes:a==="max"?null:E(a)}}function me(e,t){let r=[];for(let n=u.posix.dirname(e);n!=="/";n=u.posix.dirname(n)){
+memoryHighBytes:a==="max"?null:E(a)}}function le(e,t){let r=[];for(let n=u.posix.dirname(e);n!=="/";n=u.posix.dirname(n)){
 let o={controlGroup:n};for(let[i,s]of[["memory.max","memoryMaxBytes"],["memory.high","memoryHighBytes"]]){let a=h(u.join(
 "/sys/fs/cgroup",n,i),"utf8").trim(),c=a==="max"?null:E(a);if(a!=="max"&&(c===null||t>c))throw Object.assign(new Error(`\
 Memory growth is blocked by an ancestor ${i} limit.`),{limitingGroup:{controlGroup:n,limit:i,maximumBytes:c,requestedBytes:t}});
-o[s]=c}r.push(o)}return r}function _t(e,t,r){let n=e.action==="workflow-limits",o=!1,i=[],s=[],a=[],c=[],m=null;try{let p=P(
+o[s]=c}r.push(o)}return r}function _t(e,t,r){let n=e.action==="workflow-limits",o=!1,i=[],s=[],a=[],c=[],l=null;try{let p=P(
 t);if(p.activeState!=="active"||!p.controlGroup||p.finishedAt)throw new Error("Memory growth requires an active workflow\
-.");let d=U(e.memoryMaxBytes,F,we,"workflow memory limit");if(!Array.isArray(e.executions)||e.executions.length>128)throw new Error(
-"Memory growth requires a bounded list of owned executions.");if(m=E(S("getconf",["PAGESIZE"])),!m||m>F)throw new Error(
+.");let m=U(e.memoryMaxBytes,F,we,"workflow memory limit");if(!Array.isArray(e.executions)||e.executions.length>128)throw new Error(
+"Memory growth requires a bounded list of owned executions.");if(l=E(S("getconf",["PAGESIZE"])),!l||l>F)throw new Error(
 "The kernel memory limit granularity is unavailable.");a=[{unitName:t.unitName,controlGroup:p.controlGroup,memoryMaxBytes:Math.
-floor(d/m)*m,expectedMemoryMaxBytes:e.expectedMemoryMaxBytes}];for(let l of e.executions){let f=De(l?.id,r);if(a.some(x=>x.
-unitName===f))throw new Error("Duplicate memory growth execution.");let g=U(l.memoryMaxBytes,F,$e,"execution memory limi\
-t");if(g>d)throw new Error("Execution memory growth exceeds its workflow allowance.");a.push({unitName:f,controlGroup:`${p.
-controlGroup}/${f}`,memoryMaxBytes:Math.floor(g/m)*m,expectedMemoryMaxBytes:l.expectedMemoryMaxBytes})}if(i=a.map(l=>ue(
-l.unitName,l.controlGroup,m,n?void 0:l.memoryMaxBytes)),n)return{ok:!0,id:t.id,pageSizeBytes:m,before:i,after:i,ancestors:me(
-p.controlGroup)};for(let[l,f]of a.entries())if(f.expectedMemoryMaxBytes!==i[l].memoryMaxBytes||f.memoryMaxBytes<i[l].effectiveMemoryMaxBytes)
-throw new Error("Memory growth cannot lower a live limit or apply to stale limits.");c=me(p.controlGroup,a[0].memoryMaxBytes);
-for(let[l,f]of a.entries())i[l].memoryMaxBytes!==f.memoryMaxBytes&&(o=!0,S("systemctl",["set-property","--runtime",f.unitName,
-`MemoryMax=${f.memoryMaxBytes}`]));if(s=a.map(l=>ue(l.unitName,l.controlGroup,m,l.memoryMaxBytes)),c=me(p.controlGroup,a[0].
-memoryMaxBytes),!s.every((l,f)=>l.memoryMaxBytes===a[f].memoryMaxBytes))throw new Error("Memory growth readback did not \
-match the requested limits.");return{ok:!0,id:t.id,changeState:o?"applied":"unchanged",pageSizeBytes:m,before:i,after:s,
-ancestors:c}}catch(p){let d="unchanged";return o&&(s=a.map(l=>{try{return ue(l.unitName,l.controlGroup,m)}catch{return null}}),
-d=s.some(l=>l===null)?"unknown":s.every((l,f)=>l.memoryMaxBytes===i[f].memoryMaxBytes)?"unchanged":"partial"),{ok:!1,id:t.
-id,code:"workflow_memory_growth_failed",changeState:d,error:String(p?.message||p),limitingGroup:p?.limitingGroup??null,pageSizeBytes:m,
+floor(m/l)*l,expectedMemoryMaxBytes:e.expectedMemoryMaxBytes}];for(let d of e.executions){let f=De(d?.id,r);if(a.some(x=>x.
+unitName===f))throw new Error("Duplicate memory growth execution.");let g=U(d.memoryMaxBytes,F,$e,"execution memory limi\
+t");if(g>m)throw new Error("Execution memory growth exceeds its workflow allowance.");a.push({unitName:f,controlGroup:`${p.
+controlGroup}/${f}`,memoryMaxBytes:Math.floor(g/l)*l,expectedMemoryMaxBytes:d.expectedMemoryMaxBytes})}if(i=a.map(d=>ue(
+d.unitName,d.controlGroup,l,n?void 0:d.memoryMaxBytes)),n)return{ok:!0,id:t.id,pageSizeBytes:l,before:i,after:i,ancestors:le(
+p.controlGroup)};for(let[d,f]of a.entries())if(f.expectedMemoryMaxBytes!==i[d].memoryMaxBytes||f.memoryMaxBytes<i[d].effectiveMemoryMaxBytes)
+throw new Error("Memory growth cannot lower a live limit or apply to stale limits.");c=le(p.controlGroup,a[0].memoryMaxBytes);
+for(let[d,f]of a.entries())i[d].memoryMaxBytes!==f.memoryMaxBytes&&(o=!0,S("systemctl",["set-property","--runtime",f.unitName,
+`MemoryMax=${f.memoryMaxBytes}`]));if(s=a.map(d=>ue(d.unitName,d.controlGroup,l,d.memoryMaxBytes)),c=le(p.controlGroup,a[0].
+memoryMaxBytes),!s.every((d,f)=>d.memoryMaxBytes===a[f].memoryMaxBytes))throw new Error("Memory growth readback did not \
+match the requested limits.");return{ok:!0,id:t.id,changeState:o?"applied":"unchanged",pageSizeBytes:l,before:i,after:s,
+ancestors:c}}catch(p){let m="unchanged";return o&&(s=a.map(d=>{try{return ue(d.unitName,d.controlGroup,l)}catch{return null}}),
+m=s.some(d=>d===null)?"unknown":s.every((d,f)=>d.memoryMaxBytes===i[f].memoryMaxBytes)?"unchanged":"partial"),{ok:!1,id:t.
+id,code:"workflow_memory_growth_failed",changeState:m,error:String(p?.message||p),limitingGroup:p?.limitingGroup??null,pageSizeBytes:l,
 before:i,after:s,ancestors:c}}}function Nt(e={},t={}){let r=N(e.username||t.username),n=X(r);return ne("uid",e.uid,n.uid),
 ne("gid",e.gid,n.gid),n.username!==t.username&&(Se(n.username),Ke(t,n.username)),Ue(n.username,j),n}function W(e=""){let t=String(
 e||"").trim();if(!pt.test(t))throw new Error("Vibe64 exec helper rejected an invalid managed execution id.");return t.toLowerCase()}
@@ -201,51 +201,51 @@ pager","--timestamp=us+utc","--property=LoadState,ActiveState,SubState,Result,Ex
 imestamp,ExecMainExitTimestamp,MainPID,ControlGroup,MemoryCurrent,MemoryPeak,MemorySwapCurrent,TasksCurrent,TasksMax,CPU\
 UsageNSec,IOReadBytes,IOWriteBytes"]),s={};for(let M of String(i.stdout||"").split(/\r?\n/u)){let y=M.indexOf("=");y>0&&
 (s[M.slice(0,y)]=M.slice(y+1))}s.LoadState==="not-found"&&(s={LoadState:"not-found"});let a=String(s.ControlGroup||"").trim(),
-c=a?u.join("/sys/fs/cgroup",a.replace(/^\/+/,"")):"",m=ge(c),p=c&&T(c)?m.scopeEmpty:!0,d=t?o(r,t):{},l=Date.parse(d.exitObservedAt||
-""),f=Number.isFinite(l)?"runner":"systemd",g=Number.isFinite(l)?l:Date.parse(s.ExecMainExitTimestamp||""),x=Number.isFinite(
-g)&&g>0&&g<=Date.now()?new Date(g).toISOString():"";return{resourceCounters:d.resourceCounters||m,activeState:String(s.ActiveState||
-(d.executionId?"inactive":"unknown")),controlGroup:a,cpuUsageNSec:R(s.CPUUsageNSec,d.cpuUsageNSec),execMainCode:String(s.
-ExecMainCode||d.execMainCode||""),execMainStatus:String(s.ExecMainStatus||d.execMainStatus||""),exitObservedAt:x,exitTimeSource:x?
-f:"",ioReadBytes:R(s.IOReadBytes,d.ioReadBytes),ioWriteBytes:R(s.IOWriteBytes,d.ioWriteBytes),loadState:String(s.LoadState&&
-s.LoadState!=="not-found"?s.LoadState:d.executionId?"recorded":"not-found"),mainPid:String(s.MainPID||"0"),memoryCurrent:R(
-s.MemoryCurrent,d.memoryCurrent),memoryPeak:R(s.MemoryPeak,d.memoryPeak),memorySwapCurrent:R(s.MemorySwapCurrent,d.memorySwapCurrent),
-oomKillCount:R(d.oomKillCount),taskLimit:d.taskLimit||Be(c),result:String(s.Result||d.result||""),signal:String(d.signal||
-""),scopeEmpty:p,startedAt:s.ExecMainStartTimestamp||d.startedAt||"",subState:String(s.SubState||"unknown"),tasksCurrent:R(
-s.TasksCurrent,d.tasksCurrent),tasksPeak:R(d.tasksPeak),tasksMax:String(s.TasksMax||"0"),unitName:e}}function R(...e){return String(
+c=a?u.join("/sys/fs/cgroup",a.replace(/^\/+/,"")):"",l=ge(c),p=c&&T(c)?l.scopeEmpty:!0,m=t?o(r,t):{},d=Date.parse(m.exitObservedAt||
+""),f=Number.isFinite(d)?"runner":"systemd",g=Number.isFinite(d)?d:Date.parse(s.ExecMainExitTimestamp||""),x=Number.isFinite(
+g)&&g>0&&g<=Date.now()?new Date(g).toISOString():"";return{resourceCounters:m.resourceCounters||l,activeState:String(s.ActiveState||
+(m.executionId?"inactive":"unknown")),controlGroup:a,cpuUsageNSec:R(s.CPUUsageNSec,m.cpuUsageNSec),execMainCode:String(s.
+ExecMainCode||m.execMainCode||""),execMainStatus:String(s.ExecMainStatus||m.execMainStatus||""),exitObservedAt:x,exitTimeSource:x?
+f:"",ioReadBytes:R(s.IOReadBytes,m.ioReadBytes),ioWriteBytes:R(s.IOWriteBytes,m.ioWriteBytes),loadState:String(s.LoadState&&
+s.LoadState!=="not-found"?s.LoadState:m.executionId?"recorded":"not-found"),mainPid:String(s.MainPID||"0"),memoryCurrent:R(
+s.MemoryCurrent,m.memoryCurrent),memoryPeak:R(s.MemoryPeak,m.memoryPeak),memorySwapCurrent:R(s.MemorySwapCurrent,m.memorySwapCurrent),
+oomKillCount:R(m.oomKillCount),taskLimit:m.taskLimit||Be(c),result:String(s.Result||m.result||""),signal:String(m.signal||
+""),scopeEmpty:p,startedAt:s.ExecMainStartTimestamp||m.startedAt||"",subState:String(s.SubState||"unknown"),tasksCurrent:R(
+s.TasksCurrent,m.tasksCurrent),tasksPeak:R(m.tasksPeak),tasksMax:String(s.TasksMax||"0"),unitName:e}}function R(...e){return String(
 e.reduce((t,r)=>{let n=Number(r);return Number.isFinite(n)&&n>t?n:t},0))}function Pt(e="",t="",r={}){let n=K(e,t,r),o=null,
 i=n.taskLimit,s=Date.parse(n.startedAt),a=Date.parse(n.exitObservedAt);if((n.result==="oom-kill"||Number(n.oomKillCount)>
-0)&&s>0&&a>=s){let c=Math.min(Date.now(),a+1e3),m=I("journalctl",["-k","--boot=0","--no-pager","--output=json","--output\
+0)&&s>0&&a>=s){let c=Math.min(Date.now(),a+1e3),l=I("journalctl",["-k","--boot=0","--no-pager","--output=json","--output\
 -fields=__REALTIME_TIMESTAMP,__SEQNUM_ID,__SEQNUM,_BOOT_ID,_SOURCE_MONOTONIC_TIMESTAMP,MESSAGE","--lines=65","--case-sen\
 sitive=yes",`--since=@${s/1e3}`,`--until=@${c/1e3}`,`--grep=^oom-kill:|^/[^,]*/${e.replaceAll(".","\\.")}(?:/[^,]*)?,tas\
-k=`],{encoding:"utf8",timeout:2e3,maxBuffer:128*1024});!m.error&&m.status===0&&(o=Vt(m.stdout,{unitName:e,workspace:$(r.
-username),startedAt:s,until:c}))}if(!i&&n.result&&n.result!=="success"&&s>0&&a>=s){let c=Math.min(Date.now(),a+1e3),m=I(
+k=`],{encoding:"utf8",timeout:2e3,maxBuffer:128*1024});!l.error&&l.status===0&&(o=Vt(l.stdout,{unitName:e,workspace:$(r.
+username),startedAt:s,until:c}))}if(!i&&n.result&&n.result!=="success"&&s>0&&a>=s){let c=Math.min(Date.now(),a+1e3),l=I(
 "journalctl",["-k","--boot=0","--no-pager","--output=json","--output-fields=__REALTIME_TIMESTAMP,MESSAGE","--lines=65","\
 --case-sensitive=yes",`--since=@${s/1e3}`,`--until=@${c/1e3}`,`--grep=^cgroup: fork rejected by pids controller in /.*${e.
-replaceAll(".","\\.")}(?:/|$)`],{encoding:"utf8",timeout:2e3,maxBuffer:128*1024});!m.error&&m.status===0&&(i=Ut(m.stdout,
+replaceAll(".","\\.")}(?:/|$)`],{encoding:"utf8",timeout:2e3,maxBuffer:128*1024});!l.error&&l.status===0&&(i=Ut(l.stdout,
 {unitName:e,workspace:$(r.username),startedAt:s,until:c}))}w.stdout.write(`${JSON.stringify({executionId:t,ok:!0,...n,oomBoundary:o,
 taskLimit:i})}
 `)}function Ut(e,{unitName:t,workspace:r,startedAt:n,until:o}){if(typeof e!="string"||Buffer.byteLength(e)>128*1024)return null;
 let i=e.trim().split(/\r?\n/u);if(i.length>64)return null;for(let s of i){let a;try{a=JSON.parse(s)}catch{continue}let c=Number(
-a?.__REALTIME_TIMESTAMP)/1e3;if(!Number.isFinite(c)||c<n||c>o)continue;let m=typeof a.MESSAGE=="string"&&/^cgroup: fork rejected by pids controller in (\/[a-zA-Z0-9_./-]{1,2048})$/u.
-exec(a.MESSAGE)?.[1];if(!m)continue;let p=m.split("/"),d=p.indexOf(`vibe64-${r}-work.slice`);if(!(p[1]!=="vibe64.slice"||
-d<2||p.indexOf(t)<=d||p.some((l,f)=>f>0&&(!l||l==="."||l===".."))))return{source:"kernel-journal",scope:"unknown",count:null,
+a?.__REALTIME_TIMESTAMP)/1e3;if(!Number.isFinite(c)||c<n||c>o)continue;let l=typeof a.MESSAGE=="string"&&/^cgroup: fork rejected by pids controller in (\/[a-zA-Z0-9_./-]{1,2048})$/u.
+exec(a.MESSAGE)?.[1];if(!l)continue;let p=l.split("/"),m=p.indexOf(`vibe64-${r}-work.slice`);if(!(p[1]!=="vibe64.slice"||
+m<2||p.indexOf(t)<=m||p.some((d,f)=>f>0&&(!d||d==="."||d===".."))))return{source:"kernel-journal",scope:"unknown",count:null,
 recordedAt:new Date(c).toISOString()}}return null}function Vt(e,{unitName:t,workspace:r,startedAt:n,until:o}){if(typeof e!=
 "string"||Buffer.byteLength(e)>128*1024)return null;let i=e.trim().split(/\r?\n/u);if(i.length>64)return null;let s=i.flatMap(
-c=>{try{return[JSON.parse(c)]}catch{return[]}}),a=null;for(let c of s){let m=Number(c?.__REALTIME_TIMESTAMP)/1e3;if(!Number.
-isFinite(m)||m<n||m>o)continue;let p=c.MESSAGE;if(typeof p=="string"&&p.startsWith("oom-kill:")&&p.endsWith(",task_memcg\
+c=>{try{return[JSON.parse(c)]}catch{return[]}}),a=null;for(let c of s){let l=Number(c?.__REALTIME_TIMESTAMP)/1e3;if(!Number.
+isFinite(l)||l<n||l>o)continue;let p=c.MESSAGE;if(typeof p=="string"&&p.startsWith("oom-kill:")&&p.endsWith(",task_memcg\
 =")){let v=s.find(k=>/^[a-f0-9]{32}$/u.test(c.__SEQNUM_ID||"")&&k?.__SEQNUM_ID===c.__SEQNUM_ID&&k?._BOOT_ID===c._BOOT_ID&&
 /^[a-f0-9]{32}$/u.test(c._BOOT_ID||"")&&Number.isSafeInteger(Number(c.__SEQNUM))&&Number(k.__SEQNUM)===Number(c.__SEQNUM)+
 1&&Number(k._SOURCE_MONOTONIC_TIMESTAMP)>=Number(c._SOURCE_MONOTONIC_TIMESTAMP)&&Number(k._SOURCE_MONOTONIC_TIMESTAMP)-Number(
 c._SOURCE_MONOTONIC_TIMESTAMP)<=1e6&&/^\/[a-zA-Z0-9_./-]+,task=[^,]+,pid=\d+,uid=\d+$/u.test(k.MESSAGE||""));v&&(p+=v.MESSAGE)}
-let d=typeof p=="string"&&p.match(/^oom-kill:constraint=(CONSTRAINT_[A-Z_]+),.*?,(?:oom_memcg=(\/[^,]+)|(global_oom)),task_memcg=(\/[^,]+),task=/u);
-if(!d)continue;let[,l,f,g,x]=d,M=x.split("/"),y=M.indexOf(`vibe64-${r}-work.slice`),D=M.indexOf(t);if(M[1]!=="vibe64.sli\
-ce"||y<2||D<=y||M.some((v,k)=>k>0&&(v==="."||v===".."||!/^[a-zA-Z0-9_.-]+$/u.test(v))))continue;let V;if(l==="CONSTRAINT\
-_NONE"&&g)V="host";else if(l==="CONSTRAINT_MEMCG"&&f&&(x===f||x.startsWith(`${f}/`))){let v=f.split("/").at(-1),k=M.slice(
+let m=typeof p=="string"&&p.match(/^oom-kill:constraint=(CONSTRAINT_[A-Z_]+),.*?,(?:oom_memcg=(\/[^,]+)|(global_oom)),task_memcg=(\/[^,]+),task=/u);
+if(!m)continue;let[,d,f,g,x]=m,M=x.split("/"),y=M.indexOf(`vibe64-${r}-work.slice`),D=M.indexOf(t);if(M[1]!=="vibe64.sli\
+ce"||y<2||D<=y||M.some((v,k)=>k>0&&(v==="."||v===".."||!/^[a-zA-Z0-9_.-]+$/u.test(v))))continue;let V;if(d==="CONSTRAINT\
+_NONE"&&g)V="host";else if(d==="CONSTRAINT_MEMCG"&&f&&(x===f||x.startsWith(`${f}/`))){let v=f.split("/").at(-1),k=M.slice(
 0,D+1).join("/");V=f===k||f.startsWith(`${k}/`)?"execution":v===`vibe64-${r}-work.slice`?"workspace_work":v===`vibe64-${r}\
 .slice`?"workspace":v==="vibe64.slice"?"platform":/-work-p[a-f0-9]{64}-s[a-f0-9]{64}-w[a-f0-9]{32}\.slice$/u.test(v)?"wo\
 rkflow":/-work-p[a-f0-9]{64}-s[a-f0-9]{64}\.slice$/u.test(v)?"session":/-work-p[a-f0-9]{64}\.slice$/u.test(v)?"project":
-"ancestor"}else return null;let H=f||"";if(a&&a.cgroup!==H)return null;(!a||m>Date.parse(a.recordedAt))&&(a={source:"ker\
-nel-journal",scope:V,cgroup:H,recordedAt:new Date(m).toISOString()})}return a}function Gt(e="",t="",r={}){let n=K(e,t,r);
+"ancestor"}else return null;let H=f||"";if(a&&a.cgroup!==H)return null;(!a||l>Date.parse(a.recordedAt))&&(a={source:"ker\
+nel-journal",scope:V,cgroup:H,recordedAt:new Date(l).toISOString()})}return a}function Gt(e="",t="",r={}){let n=K(e,t,r);
 n.scopeEmpty||A("systemctl",["stop",e]);let o=Date.now()+gt,i=K(e,t,r),s=new Int32Array(new SharedArrayBuffer(4));for(;!i.
 scopeEmpty&&Date.now()<o;)Atomics.wait(s,0,0,25),i=K(e,t,r);i.scopeEmpty||(A("systemctl",["kill","--kill-who=all","--sig\
 nal=SIGKILL",e]),A("systemctl",["stop",e]),i=K(e,t,r)),i.scopeEmpty&&(Te(Ee(r,t),{force:!0,recursive:!0}),A("systemctl",
@@ -257,24 +257,24 @@ r,String(t.password||"")):X(r),rr(r,j)}function Ht(e={}){let t=q();ae(j);let r=S
 if(r==="inspect"){zt(n);return}if(r==="remove"){Yt(n);return}if(r!=="install-start")throw new Error("Vibe64 exec helper \
 rejected an unknown deployment service action.");let o=ee(e.workingDirectory,t,"workingDirectory"),i=ee(e.environmentFile,
 t,"environmentFile"),s=ee(e.startScript,t,"startScript"),a=[...new Set((Array.isArray(e.requiredUnits)?e.requiredUnits:[]).
-map(p=>ve(p,t)))],c=We(n),m=sr({environmentFile:i,owner:t,requiredUnits:a,startScript:s,unitName:n,workingDirectory:o});
-Pe({activation:"restart",unit:m,unitName:n,unitPath:c})}function zt(e=""){ce(e);let t=S("systemctl",["show",e,"--no-page\
+map(p=>ve(p,t)))],c=We(n),l=sr({environmentFile:i,owner:t,requiredUnits:a,startScript:s,unitName:n,workingDirectory:o});
+Pe({activation:"restart",unit:l,unitName:n,unitPath:c})}function zt(e=""){ce(e);let t=S("systemctl",["show",e,"--no-page\
 r","--property=ActiveState,SubState,Result,ExecMainCode,ExecMainStatus,NRestarts"]),r=A("journalctl",["--unit",e,"--no-p\
 ager","--output=cat","--lines=80"]),n=String(r.stdout||r.stderr||"").trim();w.stdout.write(["Service state:",t,...n?["",
 "Recent service output:",n]:[]].join(`
 `)+`
 `)}function Kt(e={}){let t=q();ae(j);let r=String(e.action||"").trim(),n=ve(e.unitName,t);if(r!=="install-start")throw new Error(
 "Vibe64 exec helper rejected an unknown managed service action.");let o=Oe(e.workingDirectory,t,"workingDirectory"),i=Oe(
-e.startScript,t,"startScript"),s=Le(e.processModel),a=s==="forking"?Ge(e.pidFile,t):"",c=ir(n,t),m=ar({owner:t,pidFile:a,
-processModel:s,startScript:i,unitName:n,workingDirectory:o});Ft({owner:t,pidFile:a,unitName:n}),Pe({activation:"start",unit:m,
+e.startScript,t,"startScript"),s=Le(e.processModel),a=s==="forking"?Ge(e.pidFile,t):"",c=ir(n,t),l=ar({owner:t,pidFile:a,
+processModel:s,startScript:i,unitName:n,workingDirectory:o});Ft({owner:t,pidFile:a,unitName:n}),Pe({activation:"start",unit:l,
 unitName:n,unitPath:c})}function Ft({owner:e={},pidFile:t="",unitName:r=""}={}){if(!t||!T(t))return;let n=String(h(t,"ut\
 f8")||"").trim();if(!/^[1-9][0-9]*$/u.test(n))throw new Error("Vibe64 managed service PID file is invalid.");let o=Number(
-n);if(!Number.isSafeInteger(o)||o<=1)throw new Error("Vibe64 managed service PID is invalid.");if(!le(o)){Q(t,n);return}
+n);if(!Number.isSafeInteger(o)||o<=1)throw new Error("Vibe64 managed service PID is invalid.");if(!me(o)){Q(t,n);return}
 let i=Xt(o);if(i===null){Q(t,n);return}if(i!==e.uid)throw new Error("Vibe64 managed service PID belongs to another OS us\
 er.");if(qt(o,r))return;try{w.kill(o,"SIGTERM")}catch(c){if(c?.code==="ESRCH"){Q(t,n);return}throw c}let s=Date.now()+3e4,
-a=new Int32Array(new SharedArrayBuffer(4));for(;le(o)&&Date.now()<s;)Atomics.wait(a,0,0,100);if(le(o))throw new Error("V\
+a=new Int32Array(new SharedArrayBuffer(4));for(;me(o)&&Date.now()<s;)Atomics.wait(a,0,0,100);if(me(o))throw new Error("V\
 ibe64 managed service process did not stop cleanly during ownership transfer.");Q(t,n)}function Q(e="",t=""){T(e)&&String(
-h(e,"utf8")||"").trim()===t&&G(e)}function le(e=0){try{return w.kill(e,0),!0}catch(t){if(t?.code==="ESRCH")return!1;throw t}}
+h(e,"utf8")||"").trim()===t&&G(e)}function me(e=0){try{return w.kill(e,0),!0}catch(t){if(t?.code==="ESRCH")return!1;throw t}}
 function Xt(e=0){let t="";try{t=h(`/proc/${e}/status`,"utf8")}catch(o){if(o?.code==="ENOENT")return null;throw o}let r=String(
 t||"").match(/^Uid:\s+([0-9]+)/mu),n=Number(r?.[1]);if(!Number.isSafeInteger(n))throw new Error("Vibe64 managed service \
 process UID is unavailable.");return n}function qt(e=0,t=""){let r=`/${t}`,n="";try{n=h(`/proc/${e}/cgroup`,"utf8")}catch(o){
@@ -293,7 +293,7 @@ push(Buffer.from(t.subarray(0,i)))}catch(i){if(i?.code==="EINTR")continue;if((i?
 Date.now()<n){Atomics.wait(r,0,0,nt);continue}throw i?.code==="EAGAIN"||i?.code==="EWOULDBLOCK"?new Error("Vibe64 exec h\
 elper timed out waiting for its payload."):i}return Buffer.concat(e,o).toString("utf8")}function N(e=""){let t=String(e||
 "").trim();if(!t||/[/:\\\r\n]/u.test(t))throw new Error("Vibe64 exec helper rejected an unsafe username.");return t}function Qt(e=""){
-if(!mt.test(e))throw new Error("Vibe64 exec helper rejected an unsupported username.")}function Se(e=""){if(Qt(e),e.startsWith(
+if(!lt.test(e))throw new Error("Vibe64 exec helper rejected an unsupported username.")}function Se(e=""){if(Qt(e),e.startsWith(
 re))throw new Error("Vibe64 daemon Unix accounts cannot be managed as app users.");if(dt.has(e))throw new Error("Privile\
 ged Unix accounts cannot be managed as Vibe64 app users.")}function X(e=""){let t=I("getent",["passwd",e],{encoding:"utf\
 8"});if(t.status!==0)throw new Error(`OS user was not found: ${e}`);let n=String(t.stdout||"").split(/\r?\n/u)[0].split(
@@ -352,21 +352,22 @@ return Y(t);if(r==="workspace-cache-command"){let i=u.join(n.home,".local/state/
 s);if(n.username!==t||b(i)!==i||s!==e||a.length!==1||!/^[a-z][a-z0-9-]*-[A-Za-z0-9]{6}$/u.test(a[0]))throw new Error("Ca\
 che maintenance requires an owned workspace scratch directory.");return s}let o=String(e||"").trim();if(!o)return"/";if(r===
 "account-auth-terminal"||r==="account-status"||r==="github-api-command")return ur(o,n);if(r==="vibe64-command"&&n.username===
-t){let i=b(o),s=u.join(n.home,".local","state","vibe64","projects");if(T(s)){let m=b(s);if(i===m||i.startsWith(`${m}${u.
-sep}`))return i}let a=u.join(n.home,".local","state","vibe64","colleague");if(T(a)){let m=C(b(a),i);if(m.length===2&&/^[A-Za-z0-9_-]+$/u.
-test(m[0])&&/^colleague_[a-f0-9]{32}$/u.test(m[1]))return i}let c=u.join(n.home,".local","state","vibe64","training-sour\
-ces");if(T(c)){let m=C(b(c),i);if(m.length===1&&/^(catalogue|topic)-[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/u.
-test(m[0]))return i}}if(r==="codex-app-server"||r==="opencode-app-server"){let i=b(o),s=Number(n.uid),a=[se({username:t})];
-Number.isSafeInteger(s)&&s>=0&&a.push(u.join("/run/user",String(s)));for(let c of a){let m=u.join(c,"vibe64","agent-prov\
-iders");if(!T(m))continue;let p=b(m),d=C(p,i),l=d[0],f=r==="opencode-app-server"?l==="opencode":l==="codex-app-server"||
-/^codex-app-server-[a-f0-9]{12}$/u.test(l),g=r==="codex-app-server"&&d.length===1,x=d.length===2&&d[1]==="workspace";if(f&&
+t){let i=b(o),s=u.join(n.home,".local","state","vibe64","projects");if(T(s)){let l=b(s);if(i===l||i.startsWith(`${l}${u.
+sep}`))return i}let a=u.join(n.home,".local","state","vibe64","colleague");if(T(a)){let l=C(b(a),i),p=l.at(-1)||"",m=l.length===
+4&&l[1]==="learn"&&/^(lobby|[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})$/u.test(l[2]);if((l.length===2||
+m)&&/^[A-Za-z0-9_-]+$/u.test(l[0])&&/^colleague_[a-f0-9]{32}$/u.test(p))return i}let c=u.join(n.home,".local","state","v\
+ibe64","training-sources");if(T(c)){let l=C(b(c),i);if(l.length===1&&/^(catalogue|topic)-[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/u.
+test(l[0]))return i}}if(r==="codex-app-server"||r==="opencode-app-server"){let i=b(o),s=Number(n.uid),a=[se({username:t})];
+Number.isSafeInteger(s)&&s>=0&&a.push(u.join("/run/user",String(s)));for(let c of a){let l=u.join(c,"vibe64","agent-prov\
+iders");if(!T(l))continue;let p=b(l),m=C(p,i),d=m[0],f=r==="opencode-app-server"?d==="opencode":d==="codex-app-server"||
+/^codex-app-server-[a-f0-9]{12}$/u.test(d),g=r==="codex-app-server"&&m.length===1,x=m.length===2&&m[1]==="workspace";if(f&&
 (g||x))return i}}return cr(o,t)}function cr(e="",t=""){let r=String(e||"").trim();if(!r)throw new Error("Vibe64 exec hel\
 per rejected an empty managed project path.");let n=b(r),o=b(u.join("/var/lib/vibe64",$(t),"projects"));if(n.startsWith(
 `${o}${u.sep}`))return n;throw new Error("Vibe64 exec helper rejected a command path outside the owner project root.")}function ur(e="",t={}){
 let r=String(e||"").trim(),n=String(t.home||"").trim();if(!r||!n)throw new Error("Vibe64 exec helper rejected an empty u\
 ser command path.");let o=b(r),i=b(n);if(o===i||o.startsWith(`${i}${u.sep}`))return o;throw new Error("Vibe64 exec helpe\
 r rejected a command path outside the target user home.")}function $(e=""){return e.startsWith(re)?e.slice(re.length):e}
-function Y(e=""){return u.join(lt,$(N(e)),"tmp")}function be(e={},t={},r="",n=""){let o={PATH:ie,TERM:w.env.TERM||"xterm\
+function Y(e=""){return u.join(mt,$(N(e)),"tmp")}function be(e={},t={},r="",n=""){let o={PATH:ie,TERM:w.env.TERM||"xterm\
 -256color"};for(let[i,s]of Object.entries(e))!ct.test(i)||ut.has(i)||i.startsWith("LD_")||i.startsWith("DYLD_")||(o[i]=String(
 s));if(n==="opencode-app-server"){let i=u.join(se({username:r}),"vibe64","agent-providers","opencode");for(let s of["HOM\
 E","XDG_CACHE_HOME","XDG_CONFIG_HOME","XDG_DATA_HOME","XDG_STATE_HOME"]){let a=String(e[s]||"").trim();if(!u.isAbsolute(

package/node_modules/@local/vibe64-genesis/bin/vibe64-genesis-host-context

@@ -560,12 +560,12 @@ startTimeTicks,version:c}}return Object.freeze({normalize:N,isValid:F,normalizeI
 isProcessAlive:x})}var Tt=(t,e,r,n={})=>Object.freeze({id:t,contextWindow:e,variants:Object.freeze(r),...n}),Ga=Object.freeze([Object.freeze(
 {id:"deepseek",baseUrl:"https://api.deepseek.com/",claudeBaseUrl:"https://api.deepseek.com/anthropic",claudeAutoCompactWindow:786432,
 webSearch:!1,models:Object.freeze([Tt("deepseek-flash",1048576,["low","high","max"],{images:!0,freeformPatch:!0,codexHistoryRouting:!0}),
-Tt("deepseek-v4-pro",1048576,["low","high","max"],{freeformPatch:!0})])}),Object.freeze({id:"zai-coding-plan",baseUrl:"h\
-ttps://api.z.ai/api/v1",claudeBaseUrl:"https://api.z.ai/api/anthropic",claudeAutoCompactWindow:1e6,webSearch:!1,models:Object.
-freeze([Tt("glm-5.3",1048576,["low","high","max"],{freeformPatch:!0,codexHistoryRouting:!0})])}),Object.freeze({id:"zai",
-baseUrl:"https://api.z.ai/api/v1",claudeBaseUrl:"https://api.z.ai/api/anthropic",claudeAutoCompactWindow:1e6,webSearch:!1,
-models:Object.freeze([Tt("glm-5.3",1048576,["low","high","max"],{freeformPatch:!0,codexHistoryRouting:!0})])})]);function Ie(t){
-return Ga.find(e=>e.id===t)||null}var lp=32*1024*1024,pp=Object.freeze({chatgpt:"https://chatgpt.com/backend-api/codex",apiKey:"https://api.openai.com/v1",
+Tt("deepseek-v4-pro",1048576,["low","high","max"],{freeformPatch:!0,codexHistoryRouting:!0})])}),Object.freeze({id:"zai-\
+coding-plan",baseUrl:"https://api.z.ai/api/v1",claudeBaseUrl:"https://api.z.ai/api/anthropic",claudeAutoCompactWindow:1e6,
+webSearch:!1,models:Object.freeze([Tt("glm-5.3",1048576,["low","high","max"],{freeformPatch:!0,codexHistoryRouting:!0})])}),
+Object.freeze({id:"zai",baseUrl:"https://api.z.ai/api/v1",claudeBaseUrl:"https://api.z.ai/api/anthropic",claudeAutoCompactWindow:1e6,
+webSearch:!1,models:Object.freeze([Tt("glm-5.3",1048576,["low","high","max"],{freeformPatch:!0,codexHistoryRouting:!0})])})]);
+function Ie(t){return Ga.find(e=>e.id===t)||null}var lp=32*1024*1024,pp=Object.freeze({chatgpt:"https://chatgpt.com/backend-api/codex",apiKey:"https://api.openai.com/v1",
 deepseek:Ie("deepseek").baseUrl.replace(/\/$/u,""),"zai-coding-plan":Ie("zai-coding-plan").baseUrl,zai:Ie("zai").baseUrl});var vp=new URL("./../../../@jskit-ai/assistant-core/src/server/conversation/codexProcess.js",import.meta.url).href;var bp=Object.freeze({HELPER:"helper",INTERACTIVE:"interactive"}),_p=mr();var Ka=Object.freeze({UNIX:"unix"});var Ap=process.platform==="linux"?107:103,Cp=Object.freeze({MISSING:"missing",RESPONSIVE:"responsive",TIMEOUT:"timeout",
 UNREACHABLE:"unreachable"}),Ep=Object.freeze({EXITED:"exited",INCOMPATIBLE:"incompatible",LIVE:"live",MISSING:"missing",
 SUSPECT:"suspect"}),Ja=Object.freeze({RUNNING:"running",STOPPED:"stopped"}),Op=Object.freeze({ABSENT:"absent",AMBIGUOUS:"\
@@ -990,69 +990,73 @@ nce.","When adopting an authenticated app, or when its login blocks Preview insp
 ith `vibe64-helper preview status`; prefer `vibe64-helper preview browser identity <configured-name>` to requesting pass\
 words. If unconfigured, ask which existing accounts (email/login/user ID) represent admin and other required roles, and \
 the default. Reuse prior answers; wait for their choices before configuring access. Never infer admin rights from names \
-or the Vibe64 viewer.","Offer an application-owned adapter declared in the Outputs `#### Preview identity` block (`vibe6\
-4-helper spec outputs` and `vibe64-helper spec preview-identity-command`), and save the named selectors the person gives\
- or confirms with `vibe64-helper preview identities save` (`vibe64-helper spec preview-identities`); you may propose the\
-m from existing app accounts, then verify each with `vibe64-helper preview browser identity <name>`. Use existing sessio\
-ns/permissions, reject missing/disabled accounts, and disable the adapter without Vibe64\u2019s per-run enable flag and secre\
-t. Do not create users, change roles, reset passwords or weaken production auth for import. Verify the selected account\u2019\
-s actual Preview access; a saved selector is insufficient. If deferred/declined, explain access remains unconfigured and\
- continue independent setup work without repeated credential requests. Public/non-web apps need no adapter.","Use `vibe6\
-4-helper preview status`, `screenshot`, `logs`, and `browser eval` (Playwright code on stdin) for rendered inspection.",
-"The top Preview toolbar Stop and `vibe64-helper preview stop` stop this session's application and managed browser, not \
-chat or source. Status reports the saved stopped choice. A status read, screenshot, browser inspection, source edit or s\
-ession reopening is not permission to restart it; use `vibe64-helper preview ensure --wait` only for a deliberate Start.\
- Scoped browser tests restore the prior stopped choice.","For interactive navigation, use the proxy URL from `vibe64-hel\
-per preview inspect-url` or status `currentPage.url` / `endpoints.browser.url`. Inside browser eval, use `await page.got\
-o(new URL('/your-path', preview.url).href)`. The direct application endpoint under diagnostics bypasses Preview identity\
- and is not a browser-navigation URL.","Use the managed preview browser for interactive browsing and `vibe64-helper play\
-wright` only for an existing configured project suite; report a platform or project-test blocker rather than installing \
-another browser or changing its dependencies.","For browser evidence, batch related actions and assertions, return only \
-needed values and inspect relevant locators or regions; screenshot at meaningful visual checkpoints or failures, not aft\
-er every click. Reuse the managed browser when test isolation permits. Preserve required viewport, identity and security\
- checks; use existing automated cases for repeat verification.","For browser tests that write or reset data, inspect `vi\
-be64-helper preview targets --json` and the project's `genesis/stack.md` Outputs. Run `vibe64-helper playwright --target\
- <declared-test-target> test <suite arguments>` or `vibe64-helper playwright --target <declared-test-target> npm-run <sc\
-ript>`. Vibe64 starts that web target, waits for readiness, uses its declared application identity, and restores the pre\
-vious Preview when the command finishes or is cancelled; report restoration failures.","A target name is not proof of te\
-st isolation. Before running a destructive suite, the application must verify the server's actual test database and supp\
-ress real email, invoices, payments, and other external effects. Keep managed Env unchanged. The test launcher and its p\
-review-identity command must use the same database. Follow the application's declared test resources and never invent a \
-database name. Never spoof safety checks by changing only the test runner's environment.","If no suitable test target ex\
-ists, add one through the project's existing Outputs contract and application-owned test scripts within authorized scope\
-, keeping normal Preview as default. Validate the exact disposable database before resetting it, prepare fixtures before\
- reporting readiness, and make Playwright use the started target's URL, which Vibe64 supplies as PLAYWRIGHT_BASE_URL, wi\
-thout starting another server. If the required test resources or external-effect controls are missing, report that speci\
-fic blocker. Use `vibe64-helper preview ensure --target <id> --wait --json` only to deliberately select an interactive t\
-arget; it stays selected until changed. If browser startup is slow, measure migrations, fixtures and server startup befo\
-re retrying or extending deadlines.","Keep test output small: run relevant files/cases, save stdout/stderr to local arti\
-facts and preserve exit status. Report counts, duration, failed cases, actionable errors and artifact paths. Read only n\
-eeded failure excerpts, not full passing/JSON/TAP/request/trace/image output. Retain startup, resource and Preview-resto\
-ration errors even if tests pass, and trailing wrapper diagnostics separately from JSON. Do not rerun for output or rere\
-ad unchanged logs; inspect on new output, changed state or a concrete blocker.","Batch related browser tests in one mana\
-ged suite (one Preview switch and restore). Suites and live Preview actions are sequential: no browser actions, ensure/r\
-estart or target changes during a suite or restoration. Wait on the original execution, including background runs, throu\
-gh cleanup/restoration (empty polls: yield_time_ms: 30000 where supported; shorter only for interactive input or an imme\
-diate check); read-only status/logs stay available. Before live inspection, confirm `vibe64-helper playwright status` ha\
-s no active run and `vibe64-helper preview status` is ready on the restored target. To stop, read suite status then run \
-`vibe64-helper playwright cancel <run-id>`, which waits for cleanup/restoration; retry it if cleanup needs attention. Ne\
-ver kill individual test/Preview PIDs or change locks. Launcher exit alone does not prove tests stopped. Recheck current\
- status before reporting a busy blocker.","If a managed command reports kernel task denials or a resource incident, reta\
-in its diagnostic and incident ID when reporting the blocker. Ask the platform operator to inspect that resource evidenc\
-e before retrying; do not increase test timeouts or weaken assertions to work around a process/thread limit. A generic b\
-rowser timeout without resource evidence does not establish a platform cause."]),C_=Object.freeze(["Each managed shell c\
-ommand receives current development Env from Vibe64, including declared resource bindings; use them in ordinary commands\
-. Do not build environment injection or copy managed credentials into source. Resource provisioning and application migr\
-ations remain separate preparation steps.","Use `vibe64-helper env status [development|production|all]` to inspect confi\
-gured key names without revealing values.","Pipe an available value to `vibe64-helper env set <development|production> <\
-KEY> [--secret]`; never put values in arguments, logs, or repository files. Use empty stdin only when the user requested\
- an empty value.","Keep development and production values separate. Never invent credentials, copy a value between scope\
-s without explicit direction, or edit Vibe64 runtime/session storage.","After an Env mutation, report only the affected \
-scope and key names, never their values, and claim success only when the command succeeded.","Store a secret the applica\
-tion needs generated (such as an application key) by generating it with the framework's own generator and piping it to `\
-vibe64-helper env set <scope> <KEY> --secret`. Never write it into a generated `.env` file: Vibe64 regenerates that file\
- from Env."]);function Zr(t=""){return String(t??"").trim()}function en(t,e){if(!t||typeof t!="object"||Array.isArray(t))
-throw new TypeError(`${e} must be an object.`);return t}function rt(t,e,r){let n=new Set(e),o=Object.keys(t).filter(s=>!n.
+or the Vibe64 viewer.","A web app with login accounts has an application-owned adapter declared in the Outputs `#### Pre\
+view identity` block (`vibe64-helper spec outputs` and `vibe64-helper spec preview-identity-command`); when it is missin\
+g, set it up from the app framework's own pattern as part of the work instead of merely offering it. Save the named sele\
+ctors the person gives or confirms with `vibe64-helper preview identities save` (`vibe64-helper spec preview-identities`\
+); you may propose them from existing app accounts, then verify each with `vibe64-helper preview browser identity <name>\
+`. Use existing sessions/permissions, reject missing/disabled accounts, and disable the adapter without Vibe64\u2019s per-run\
+ enable flag and secret. Do not create users, change roles, reset passwords or weaken production auth for import. Verify\
+ the selected account\u2019s actual Preview access; a saved selector is insufficient. If account choices are deferred/decline\
+d, explain access remains unconfigured and continue independent setup work without repeated credential requests. Public/\
+non-web apps need no adapter.","Use `vibe64-helper preview status`, `screenshot`, `logs`, and `browser eval` (Playwright\
+ code on stdin) for rendered inspection.","The top Preview toolbar Stop and `vibe64-helper preview stop` stop this sessi\
+on's application and managed browser, not chat or source. Status reports the saved stopped choice. A status read, screen\
+shot, browser inspection, source edit or session reopening is not permission to restart it; use `vibe64-helper preview e\
+nsure --wait` only for a deliberate Start. Scoped browser tests restore the prior stopped choice.","For interactive navi\
+gation, use the proxy URL from `vibe64-helper preview inspect-url` or status `currentPage.url` / `endpoints.browser.url`\
+. Inside browser eval, use `await page.goto(new URL('/your-path', preview.url).href)`. The direct application endpoint u\
+nder diagnostics bypasses Preview identity and is not a browser-navigation URL.","Use the managed preview browser for in\
+teractive browsing and `vibe64-helper playwright` only for an existing configured project suite; report a platform or pr\
+oject-test blocker rather than installing another browser or changing its dependencies.","For browser evidence, batch re\
+lated actions and assertions, return only needed values and inspect relevant locators or regions; screenshot at meaningf\
+ul visual checkpoints or failures, not after every click. Reuse the managed browser when test isolation permits. Preserv\
+e required viewport, identity and security checks; use existing automated cases for repeat verification.","For browser t\
+ests that write or reset data, inspect `vibe64-helper preview targets --json` and the project's `genesis/stack.md` Outpu\
+ts. Run `vibe64-helper playwright --target <declared-test-target> test <suite arguments>` or `vibe64-helper playwright -\
+-target <declared-test-target> npm-run <script>`. Vibe64 starts that web target, waits for readiness, uses its declared \
+application identity, and restores the previous Preview when the command finishes or is cancelled; report restoration fa\
+ilures.","A target name is not proof of test isolation. Before running a destructive suite, the application must verify \
+the server's actual test database and suppress real email, invoices, payments, and other external effects. Keep managed \
+Env unchanged. The test launcher and its preview-identity command must use the same database. Follow the application's d\
+eclared test resources and never invent a database name. Never spoof safety checks by changing only the test runner's en\
+vironment.","If no suitable test target exists, add one through the project's existing Outputs contract and application-\
+owned test scripts within authorized scope, keeping normal Preview as default. Validate the exact disposable database be\
+fore resetting it, prepare fixtures before reporting readiness, and make Playwright use the started target's URL, which \
+Vibe64 supplies as PLAYWRIGHT_BASE_URL, without starting another server. If the required test resources or external-effe\
+ct controls are missing, report that specific blocker. Use `vibe64-helper preview ensure --target <id> --wait --json` on\
+ly to deliberately select an interactive target; it stays selected until changed. If browser startup is slow, measure mi\
+grations, fixtures and server startup before retrying or extending deadlines.","Keep test output small: run relevant fil\
+es/cases, save stdout/stderr to local artifacts and preserve exit status. Report counts, duration, failed cases, actiona\
+ble errors and artifact paths. Read only needed failure excerpts, not full passing/JSON/TAP/request/trace/image output. \
+Retain startup, resource and Preview-restoration errors even if tests pass, and trailing wrapper diagnostics separately \
+from JSON. Do not rerun for output or reread unchanged logs; inspect on new output, changed state or a concrete blocker.",
+"Batch related browser tests in one managed suite (one Preview switch and restore). Suites and live Preview actions are \
+sequential: no browser actions, ensure/restart or target changes during a suite or restoration. Wait on the original exe\
+cution, including background runs, through cleanup/restoration (empty polls: yield_time_ms: 30000 where supported; short\
+er only for interactive input or an immediate check); read-only status/logs stay available. Before live inspection, conf\
+irm `vibe64-helper playwright status` has no active run and `vibe64-helper preview status` is ready on the restored targ\
+et. To stop, read suite status then run `vibe64-helper playwright cancel <run-id>`, which waits for cleanup/restoration;\
+ retry it if cleanup needs attention. Never kill individual test/Preview PIDs or change locks. Launcher exit alone does \
+not prove tests stopped. Recheck current status before reporting a busy blocker.","If a managed command reports kernel t\
+ask denials or a resource incident, retain its diagnostic and incident ID when reporting the blocker. Ask the platform o\
+perator to inspect that resource evidence before retrying; do not increase test timeouts or weaken assertions to work ar\
+ound a process/thread limit. A generic browser timeout without resource evidence does not establish a platform cause."]),
+C_=Object.freeze(["Each managed shell command receives current development Env from Vibe64, including declared resource \
+bindings; use them in ordinary commands. Do not build environment injection or copy managed credentials into source. Res\
+ource provisioning and application migrations remain separate preparation steps.","Use `vibe64-helper env status [develo\
+pment|production|all]` to inspect configured key names without revealing values.","Pipe an available value to `vibe64-he\
+lper env set <development|production> <KEY> [--secret]`; never put values in arguments, logs, or repository files. Use e\
+mpty stdin only when the user requested an empty value.","When the person refers to a saved key, account or accounts hub\
+, run `vibe64-helper env saved` (names, descriptions and fields, never values) and link the matching field to the variab\
+le the application reads with `vibe64-helper env link <development|production> <KEY> <saved-id> <field-id>` instead of a\
+sking for the value.","Keep development and production values separate. Never invent credentials, copy a value between s\
+copes without explicit direction, or edit Vibe64 runtime/session storage.","After an Env mutation, report only the affec\
+ted scope and key names, never their values, and claim success only when the command succeeded.","Store a secret the app\
+lication needs generated (such as an application key) by generating it with the framework's own generator and piping it \
+to `vibe64-helper env set <scope> <KEY> --secret`. Never write it into a generated `.env` file: Vibe64 regenerates that \
+file from Env."]);function Zr(t=""){return String(t??"").trim()}function en(t,e){if(!t||typeof t!="object"||Array.isArray(
+t))throw new TypeError(`${e} must be an object.`);return t}function rt(t,e,r){let n=new Set(e),o=Object.keys(t).filter(s=>!n.
 has(s));if(o.length>0)throw new TypeError(`${r} contains unsupported fields: ${o.join(", ")}.`)}function qu(t){if(rt(t,[
 "conversationKind","scope","session","hostGuidance"],"Vibe64 session context"),t.hostGuidance!==void 0&&(typeof t.hostGuidance!=
 "string"||Buffer.byteLength(t.hostGuidance,"utf8")>1024))throw new TypeError("Vibe64 host guidance must be bounded text \

package/node_modules/@local/vibe64-genesis/package.json

@@ -6,6 +6,7 @@
   "exports": {
     "./server": "./src/server/index.js",
     "./server/agentSpecs": "./src/server/agentSpecs.js",
+    "./server/packaging": "./src/server/packaging.js",
     "./server/promptContext": "./src/server/promptContext.js",
     "./shared/connectedPackageTypes": "./src/shared/connectedPackageTypes.js"
   }