vibe64 0.1.39 → 0.1.41

package/node_modules/@local/vibe64-execution/src/host/execHelper.js

@@ -17,8 +17,8 @@ opt/vibe64/runtime-packs/python/bin","/opt/vibe64/runtime-packs/ruby/bin","/opt/
 4/runtime-packs/java/bin","/opt/vibe64/runtime-packs/kotlin/bin","/opt/vibe64/runtime-packs/csharp/bin","/opt/vibe64/run\
 time-packs/rust/bin","/opt/vibe64/runtime-packs/mariadb/bin","/opt/vibe64/runtime-packs/postgresql/bin","/opt/vibe64/run\
 time-packs/sqlite/bin","/opt/vibe64/runtime-packs/playwright/bin","/opt/vibe64/runtime-packs/guard-bin","/usr/local/sbin",
-"/usr/local/bin","/usr/sbin","/usr/bin","/sbin","/bin"].join(":"),mt=/^[a-z][a-z0-9_-]{0,61}[a-z0-9]$/u,j="vibe64",re="v\
-64d_",lt="/var/lib/vibe64",dt=new Set(["root"]),pt=/^[a-f0-9]{8}-[a-f0-9]{4}-[1-8][a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}$/iu,
+"/usr/local/bin","/usr/sbin","/usr/bin","/sbin","/bin"].join(":"),lt=/^[a-z][a-z0-9_-]{0,61}[a-z0-9]$/u,j="vibe64",re="v\
+64d_",mt="/var/lib/vibe64",dt=new Set(["root"]),pt=/^[a-f0-9]{8}-[a-f0-9]{4}-[1-8][a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}$/iu,
 ft=new Set(["assistant","browser","control","job","preview","service","terminal"]),wt=new Set(["capture","detached","pty"]),
 F=64*1024*1024,$e=1024*1024*1024*1024,yt=256*1024*1024,we=1024*1024*1024*1024,de=8,pe=8192,gt=15e3;import.meta.main&&ht().
 catch(e=>{w.stderr.write(`${String(e?.message||e)}
@@ -29,8 +29,8 @@ Ht(e);return}if(t==="managed-service"){Kt(e);return}if(t==="managed-execution"){
 if(t==="create-system-user"||t==="enable-system-user"){Wt(t,e,r);return}Se(r);let n=String(e.command||"").trim();if(!je.
 has(n))throw new Error("Vibe64 exec helper rejected an unknown command.");let o=X(r);ne("uid",e.uid,o.uid),ne("gid",e.gid,
 o.gid);let i=q();Ke(i,r),Ue(o.username,j);let s=Fe(e.cwd||"",i.username,{operation:t,targetUser:o}),a=be(e.env||{},o,i.username,
-t),c=Array.isArray(e.args)?e.args.map(d=>String(d)):[],m=e.inputBase64?Buffer.from(String(e.inputBase64),"base64"):void 0;
-w.umask(7);let p=Et(o,n,c,{cwd:s,env:a,...m===void 0?{stdio:"inherit"}:{input:m,stdio:["pipe","inherit","inherit"]}});if(p.
+t),c=Array.isArray(e.args)?e.args.map(m=>String(m)):[],l=e.inputBase64?Buffer.from(String(e.inputBase64),"base64"):void 0;
+w.umask(7);let p=Et(o,n,c,{cwd:s,env:a,...l===void 0?{stdio:"inherit"}:{input:l,stdio:["pipe","inherit","inherit"]}});if(p.
 error)throw p.error;w.exit(typeof p.status=="number"?p.status:1)}function Et(e,t,r,n){return I("/usr/sbin/runuser",["-u",
 e.username,"--","/usr/bin/env","--",`PATH=${n.env.PATH}`,t,...r],{...n,env:{...n.env,PATH:ie}})}function St(e={},t=""){let r=q();
 vt(t,r),ae(j);let n=String(e.action||"").trim();if(n.startsWith("workflow-")){let O=Ot(e,r);w.stdout.write(`${JSON.stringify(
@@ -39,11 +39,11 @@ O)}
 i,o,r);return}if(n!=="start")throw new Error("Vibe64 exec helper rejected an unknown managed execution action.");let s=It(
 e.mode),a=Tt(e.kind),c=String(e.lifecycle||"").trim();if(c!==(s==="capture"?"finite":s==="pty"?"interactive":"service"))
 throw new Error("Vibe64 exec helper rejected a managed execution lifecycle mismatch.");let p=Re(e.controllerLeaseName,c),
-d=Nt(e,r),l=String(e.commandOperation||"").trim(),f=Fe(e.cwd||"",r.username,{operation:l,targetUser:d}),g=String(e.command||
+m=Nt(e,r),d=String(e.commandOperation||"").trim(),f=Fe(e.cwd||"",r.username,{operation:d,targetUser:m}),g=String(e.command||
 "").trim();if(!g||/[\r\n]/u.test(g))throw new Error("Vibe64 exec helper rejected an invalid managed execution command.");
-if(d.username!==r.username&&!je.has(u.basename(g)))throw new Error("Vibe64 exec helper rejected an unsupported real-user\
- managed command.");let x=Array.isArray(e.args)?e.args.map(O=>String(O)):[],M=be(e.env||{},d,r.username,l),y="";if(e.releaseEnvironmentFile){
-if(s!=="capture"||d.username!==r.username)throw new Error("Release environment requires finite owner execution.");y=ee(e.
+if(m.username!==r.username&&!je.has(u.basename(g)))throw new Error("Vibe64 exec helper rejected an unsupported real-user\
+ managed command.");let x=Array.isArray(e.args)?e.args.map(O=>String(O)):[],M=be(e.env||{},m,r.username,d),y="";if(e.releaseEnvironmentFile){
+if(s!=="capture"||m.username!==r.username)throw new Error("Release environment requires finite owner execution.");y=ee(e.
 releaseEnvironmentFile,r,"environmentFile");let O=fe(y),B=u.join(u.dirname(u.dirname(y)),"workspace");if(u.basename(y)!==
 "environment"||u.basename(u.dirname(y))!=="service"||!O.isFile()||O.uid!==r.uid||(O.mode&63)!==0||te(y)!==y||te(f)!==f||
 f!==B&&C(B,f).length===0)throw new Error("Release environment must belong to the selected private release.")}let D=U(e.memoryMaxBytes,
@@ -52,12 +52,12 @@ workTasksMax,de,pe,"work-slice task limit");if(D>H||V>v)throw new Error("Vibe64
 above its work-slice limit.");let k=he(r);if(e.workflow){let O=Ce(e.workflow,r),B=P(O);if(B.activeState!=="active"||!B.controlGroup||
 B.finishedAt)throw new Error("Vibe64 exec helper rejected an execution without its active workflow group.");if(D>B.memoryMaxBytes||
 V>B.tasksMax)throw new Error("Vibe64 exec helper rejected an execution limit above its workflow limit.");k=O.unitName}else
-Mt(r,{memoryMaxBytes:H,tasksMax:v});jt(r);let J=Ee(r,o),Z=u.join(J,"command.json");_e(J,{mode:448,recursive:!0}),xe(J,d.
-uid,d.gid),oe(Z,`${JSON.stringify({args:x,command:g,controllerLeaseName:p,cwd:f,env:M,inputBase64:String(e.inputBase64||
+Mt(r,{memoryMaxBytes:H,tasksMax:v});jt(r);let J=Ee(r,o),Z=u.join(J,"command.json");_e(J,{mode:448,recursive:!0}),xe(J,m.
+uid,m.gid),oe(Z,`${JSON.stringify({args:x,command:g,controllerLeaseName:p,cwd:f,env:M,inputBase64:String(e.inputBase64||
 ""),inputPresent:e.inputPresent===!0,...y?{releaseEnvironment:!0}:{},executionId:o,schema:"vibe64.managed-execution.comm\
 and",schemaVersion:1})}
-`,{flag:"wx",mode:384}),Je(Z,384),xe(Z,d.uid,d.gid);let Xe=u.resolve(w.argv[1]),qe=["--quiet",`--unit=${i}`,"--service-t\
-ype=exec",`--slice=${k}`,`--property=Description=Vibe64 ${a} execution`,`--property=User=${d.username}`,`--property=Grou\
+`,{flag:"wx",mode:384}),Je(Z,384),xe(Z,m.uid,m.gid);let Xe=u.resolve(w.argv[1]),qe=["--quiet",`--unit=${i}`,"--service-t\
+ype=exec",`--slice=${k}`,`--property=Description=Vibe64 ${a} execution`,`--property=User=${m.username}`,`--property=Grou\
 p=${j}`,"--property=SupplementaryGroups=nix-users","--property=UMask=0007",`--property=WorkingDirectory=${f}`,...y?[`--p\
 roperty=EnvironmentFile=${y}`]:[],"--property=KillMode=control-group","--property=ExitType=cgroup","--property=OOMPolicy\
 =stop","--property=MemoryAccounting=yes","--property=IOAccounting=yes","--property=TasksAccounting=yes",`--property=Memo\
@@ -69,15 +69,15 @@ length!==1)throw new Error("Vibe64 exec helper rejected an unsafe managed execut
 let t=u.resolve(String(e||"")),r=h(t,"utf8");G(t);let n=JSON.parse(r);if(n?.schema!=="vibe64.managed-execution.command"||
 n?.schemaVersion!==1)throw new Error("Vibe64 managed execution runner rejected an invalid payload.");let o=String(n.command||
 "").trim();if(!o||/[\r\n]/u.test(o))throw new Error("Vibe64 managed execution runner rejected an invalid command.");let i=Re(
-n.controllerLeaseName,n.controllerLeaseName?"service":""),s=i?await xt(i):null;w.umask(7);let a=null,c=null,m=!1,p=()=>{
-m=!0,a&&c===null&&(c=Me(a))};s?.once("close",p);let d=new Date().toISOString();try{a=Ye(o,Array.isArray(n.args)?n.args.map(
+n.controllerLeaseName,n.controllerLeaseName?"service":""),s=i?await xt(i):null;w.umask(7);let a=null,c=null,l=!1,p=()=>{
+l=!0,a&&c===null&&(c=Me(a))};s?.once("close",p);let m=new Date().toISOString();try{a=Ye(o,Array.isArray(n.args)?n.args.map(
 String):[],{cwd:String(n.cwd||"/"),detached:!!s,env:n.releaseEnvironment===!0?be({...w.env,...n.env},{username:n.env.USER,
 home:n.env.HOME},n.env.USER):n.env&&typeof n.env=="object"&&!Array.isArray(n.env)?n.env:{},stdio:n.inputPresent===!0?["p\
 ipe","inherit","inherit"]:"inherit"}),n.inputPresent===!0&&a.stdin.end(Buffer.from(String(n.inputBase64||""),"base64")),
-m&&(c=Me(a));let l=await new Promise((g,x)=>{let M="";a.once("exit",()=>{M=new Date().toISOString()}),a.once("error",x),
-a.once("close",(y,D)=>g({signal:D,status:y,exitObservedAt:M}))}),f=typeof l.status=="number"?l.status:1;Ct(u.dirname(t),
-{...Dt(),executionId:W(n.executionId),startedAt:d,exitObservedAt:l.exitObservedAt,execMainCode:l.signal?"killed":"exited",
-execMainStatus:l.signal||String(f),result:l.signal?"signal":f===0?"success":"exit-code",signal:String(l.signal||"")}),w.
+l&&(c=Me(a));let d=await new Promise((g,x)=>{let M="";a.once("exit",()=>{M=new Date().toISOString()}),a.once("error",x),
+a.once("close",(y,D)=>g({signal:D,status:y,exitObservedAt:M}))}),f=typeof d.status=="number"?d.status:1;Ct(u.dirname(t),
+{...Dt(),executionId:W(n.executionId),startedAt:m,exitObservedAt:d.exitObservedAt,execMainCode:d.signal?"killed":"exited",
+execMainStatus:d.signal||String(f),result:d.signal?"signal":f===0?"success":"exit-code",signal:String(d.signal||"")}),w.
 exitCode=f}finally{c!==null&&clearTimeout(c),s?.off("close",p),s?.destroy()}}function Re(e="",t=""){let r=String(e||"");
 if(t!=="service"){if(r)throw new Error("Vibe64 exec helper rejected a controller lease on a finite execution.");return""}
 if(!/^\0vibe64-resource-controller-[a-z][a-z0-9-]{0,62}$/u.test(r))throw new Error("Vibe64 exec helper rejected an inval\
@@ -113,7 +113,7 @@ r.MemoryMax),tasksMax:E(r.TasksMax),...ge(n?u.join("/sys/fs/cgroup",n):"")};t.st
 "string"&&/^[0-9]+$/u.test(e.trim())&&Number.isSafeInteger(Number(e))?Number(e):null}function ge(e=""){function t(a){if(!e)
 return"";try{return h(u.join(e,a),"utf8")}catch(c){if(c.code==="ENOENT"||c.code==="ENODEV")return"";throw c}}function r(a){
 return Object.fromEntries(t(a).trim().split(`
-`).map(c=>{let[m,p]=c.trim().split(/\s+/u);return[m,E(p)]}))}let n=r("memory.events"),o=r("memory.stat"),i=r("cgroup.eve\
+`).map(c=>{let[l,p]=c.trim().split(/\s+/u);return[l,E(p)]}))}let n=r("memory.events"),o=r("memory.stat"),i=r("cgroup.eve\
 nts"),s=t("memory.pressure");return{sampledAt:new Date().toISOString(),sampledMonotonicMs:Number(w.hrtime.bigint()/1000000n),
 scopeEmpty:i.populated===0?!0:i.populated===1?!1:null,memoryCurrentBytes:E(t("memory.current")),memoryPeakBytes:E(t("mem\
 ory.peak")),memorySwapCurrentBytes:E(t("memory.swap.current")),memoryAnonBytes:o.anon??null,memoryFileBytes:o.file??null,
@@ -137,35 +137,35 @@ empty",...o};At(r,{...o,finishedAt:new Date().toISOString()})}let i=A("systemctl
 "inactive"||s.controlGroup||s.scopeEmpty!==!0)throw new Error(String(i.stderr||"Managed workflow group did not stop.").trim());
 return{ok:!0,...s}}throw new Error("Vibe64 exec helper rejected an unknown workflow action.")}function ue(e,t,r,n){let o=Object.
 fromEntries(S("systemctl",["show",e,"--no-pager","--property=ActiveState,ControlGroup,MemoryMax"]).split(`
-`).map(c=>{let m=c.indexOf("=");return[c.slice(0,m),c.slice(m+1)]}));if(o.ActiveState!=="active"||o.ControlGroup!==t)throw new Error(
+`).map(c=>{let l=c.indexOf("=");return[c.slice(0,l),c.slice(l+1)]}));if(o.ActiveState!=="active"||o.ControlGroup!==t)throw new Error(
 "Memory growth requires the same active, owned accounting group.");let i=E(h(u.join("/sys/fs/cgroup",t,"memory.max"),"ut\
 f8")),s=E(o.MemoryMax);if(s===null||i!==Math.floor(s/r)*r)throw new Error("The effective memory limit could not be verif\
 ied.");let a=h(u.join("/sys/fs/cgroup",t,"memory.high"),"utf8").trim();if(a!=="max"&&(E(a)===null||n>Number(a)))throw Object.
 assign(new Error("Memory growth is blocked by the target's memory.high limit."),{limitingGroup:{controlGroup:t,limit:"me\
 mory.high",maximumBytes:E(a),requestedBytes:n??null}});return{unitName:e,controlGroup:t,memoryMaxBytes:s,effectiveMemoryMaxBytes:i,
-memoryHighBytes:a==="max"?null:E(a)}}function me(e,t){let r=[];for(let n=u.posix.dirname(e);n!=="/";n=u.posix.dirname(n)){
+memoryHighBytes:a==="max"?null:E(a)}}function le(e,t){let r=[];for(let n=u.posix.dirname(e);n!=="/";n=u.posix.dirname(n)){
 let o={controlGroup:n};for(let[i,s]of[["memory.max","memoryMaxBytes"],["memory.high","memoryHighBytes"]]){let a=h(u.join(
 "/sys/fs/cgroup",n,i),"utf8").trim(),c=a==="max"?null:E(a);if(a!=="max"&&(c===null||t>c))throw Object.assign(new Error(`\
 Memory growth is blocked by an ancestor ${i} limit.`),{limitingGroup:{controlGroup:n,limit:i,maximumBytes:c,requestedBytes:t}});
-o[s]=c}r.push(o)}return r}function _t(e,t,r){let n=e.action==="workflow-limits",o=!1,i=[],s=[],a=[],c=[],m=null;try{let p=P(
+o[s]=c}r.push(o)}return r}function _t(e,t,r){let n=e.action==="workflow-limits",o=!1,i=[],s=[],a=[],c=[],l=null;try{let p=P(
 t);if(p.activeState!=="active"||!p.controlGroup||p.finishedAt)throw new Error("Memory growth requires an active workflow\
-.");let d=U(e.memoryMaxBytes,F,we,"workflow memory limit");if(!Array.isArray(e.executions)||e.executions.length>128)throw new Error(
-"Memory growth requires a bounded list of owned executions.");if(m=E(S("getconf",["PAGESIZE"])),!m||m>F)throw new Error(
+.");let m=U(e.memoryMaxBytes,F,we,"workflow memory limit");if(!Array.isArray(e.executions)||e.executions.length>128)throw new Error(
+"Memory growth requires a bounded list of owned executions.");if(l=E(S("getconf",["PAGESIZE"])),!l||l>F)throw new Error(
 "The kernel memory limit granularity is unavailable.");a=[{unitName:t.unitName,controlGroup:p.controlGroup,memoryMaxBytes:Math.
-floor(d/m)*m,expectedMemoryMaxBytes:e.expectedMemoryMaxBytes}];for(let l of e.executions){let f=De(l?.id,r);if(a.some(x=>x.
-unitName===f))throw new Error("Duplicate memory growth execution.");let g=U(l.memoryMaxBytes,F,$e,"execution memory limi\
-t");if(g>d)throw new Error("Execution memory growth exceeds its workflow allowance.");a.push({unitName:f,controlGroup:`${p.
-controlGroup}/${f}`,memoryMaxBytes:Math.floor(g/m)*m,expectedMemoryMaxBytes:l.expectedMemoryMaxBytes})}if(i=a.map(l=>ue(
-l.unitName,l.controlGroup,m,n?void 0:l.memoryMaxBytes)),n)return{ok:!0,id:t.id,pageSizeBytes:m,before:i,after:i,ancestors:me(
-p.controlGroup)};for(let[l,f]of a.entries())if(f.expectedMemoryMaxBytes!==i[l].memoryMaxBytes||f.memoryMaxBytes<i[l].effectiveMemoryMaxBytes)
-throw new Error("Memory growth cannot lower a live limit or apply to stale limits.");c=me(p.controlGroup,a[0].memoryMaxBytes);
-for(let[l,f]of a.entries())i[l].memoryMaxBytes!==f.memoryMaxBytes&&(o=!0,S("systemctl",["set-property","--runtime",f.unitName,
-`MemoryMax=${f.memoryMaxBytes}`]));if(s=a.map(l=>ue(l.unitName,l.controlGroup,m,l.memoryMaxBytes)),c=me(p.controlGroup,a[0].
-memoryMaxBytes),!s.every((l,f)=>l.memoryMaxBytes===a[f].memoryMaxBytes))throw new Error("Memory growth readback did not \
-match the requested limits.");return{ok:!0,id:t.id,changeState:o?"applied":"unchanged",pageSizeBytes:m,before:i,after:s,
-ancestors:c}}catch(p){let d="unchanged";return o&&(s=a.map(l=>{try{return ue(l.unitName,l.controlGroup,m)}catch{return null}}),
-d=s.some(l=>l===null)?"unknown":s.every((l,f)=>l.memoryMaxBytes===i[f].memoryMaxBytes)?"unchanged":"partial"),{ok:!1,id:t.
-id,code:"workflow_memory_growth_failed",changeState:d,error:String(p?.message||p),limitingGroup:p?.limitingGroup??null,pageSizeBytes:m,
+floor(m/l)*l,expectedMemoryMaxBytes:e.expectedMemoryMaxBytes}];for(let d of e.executions){let f=De(d?.id,r);if(a.some(x=>x.
+unitName===f))throw new Error("Duplicate memory growth execution.");let g=U(d.memoryMaxBytes,F,$e,"execution memory limi\
+t");if(g>m)throw new Error("Execution memory growth exceeds its workflow allowance.");a.push({unitName:f,controlGroup:`${p.
+controlGroup}/${f}`,memoryMaxBytes:Math.floor(g/l)*l,expectedMemoryMaxBytes:d.expectedMemoryMaxBytes})}if(i=a.map(d=>ue(
+d.unitName,d.controlGroup,l,n?void 0:d.memoryMaxBytes)),n)return{ok:!0,id:t.id,pageSizeBytes:l,before:i,after:i,ancestors:le(
+p.controlGroup)};for(let[d,f]of a.entries())if(f.expectedMemoryMaxBytes!==i[d].memoryMaxBytes||f.memoryMaxBytes<i[d].effectiveMemoryMaxBytes)
+throw new Error("Memory growth cannot lower a live limit or apply to stale limits.");c=le(p.controlGroup,a[0].memoryMaxBytes);
+for(let[d,f]of a.entries())i[d].memoryMaxBytes!==f.memoryMaxBytes&&(o=!0,S("systemctl",["set-property","--runtime",f.unitName,
+`MemoryMax=${f.memoryMaxBytes}`]));if(s=a.map(d=>ue(d.unitName,d.controlGroup,l,d.memoryMaxBytes)),c=le(p.controlGroup,a[0].
+memoryMaxBytes),!s.every((d,f)=>d.memoryMaxBytes===a[f].memoryMaxBytes))throw new Error("Memory growth readback did not \
+match the requested limits.");return{ok:!0,id:t.id,changeState:o?"applied":"unchanged",pageSizeBytes:l,before:i,after:s,
+ancestors:c}}catch(p){let m="unchanged";return o&&(s=a.map(d=>{try{return ue(d.unitName,d.controlGroup,l)}catch{return null}}),
+m=s.some(d=>d===null)?"unknown":s.every((d,f)=>d.memoryMaxBytes===i[f].memoryMaxBytes)?"unchanged":"partial"),{ok:!1,id:t.
+id,code:"workflow_memory_growth_failed",changeState:m,error:String(p?.message||p),limitingGroup:p?.limitingGroup??null,pageSizeBytes:l,
 before:i,after:s,ancestors:c}}}function Nt(e={},t={}){let r=N(e.username||t.username),n=X(r);return ne("uid",e.uid,n.uid),
 ne("gid",e.gid,n.gid),n.username!==t.username&&(Se(n.username),Ke(t,n.username)),Ue(n.username,j),n}function W(e=""){let t=String(
 e||"").trim();if(!pt.test(t))throw new Error("Vibe64 exec helper rejected an invalid managed execution id.");return t.toLowerCase()}
@@ -201,51 +201,51 @@ pager","--timestamp=us+utc","--property=LoadState,ActiveState,SubState,Result,Ex
 imestamp,ExecMainExitTimestamp,MainPID,ControlGroup,MemoryCurrent,MemoryPeak,MemorySwapCurrent,TasksCurrent,TasksMax,CPU\
 UsageNSec,IOReadBytes,IOWriteBytes"]),s={};for(let M of String(i.stdout||"").split(/\r?\n/u)){let y=M.indexOf("=");y>0&&
 (s[M.slice(0,y)]=M.slice(y+1))}s.LoadState==="not-found"&&(s={LoadState:"not-found"});let a=String(s.ControlGroup||"").trim(),
-c=a?u.join("/sys/fs/cgroup",a.replace(/^\/+/,"")):"",m=ge(c),p=c&&T(c)?m.scopeEmpty:!0,d=t?o(r,t):{},l=Date.parse(d.exitObservedAt||
-""),f=Number.isFinite(l)?"runner":"systemd",g=Number.isFinite(l)?l:Date.parse(s.ExecMainExitTimestamp||""),x=Number.isFinite(
-g)&&g>0&&g<=Date.now()?new Date(g).toISOString():"";return{resourceCounters:d.resourceCounters||m,activeState:String(s.ActiveState||
-(d.executionId?"inactive":"unknown")),controlGroup:a,cpuUsageNSec:R(s.CPUUsageNSec,d.cpuUsageNSec),execMainCode:String(s.
-ExecMainCode||d.execMainCode||""),execMainStatus:String(s.ExecMainStatus||d.execMainStatus||""),exitObservedAt:x,exitTimeSource:x?
-f:"",ioReadBytes:R(s.IOReadBytes,d.ioReadBytes),ioWriteBytes:R(s.IOWriteBytes,d.ioWriteBytes),loadState:String(s.LoadState&&
-s.LoadState!=="not-found"?s.LoadState:d.executionId?"recorded":"not-found"),mainPid:String(s.MainPID||"0"),memoryCurrent:R(
-s.MemoryCurrent,d.memoryCurrent),memoryPeak:R(s.MemoryPeak,d.memoryPeak),memorySwapCurrent:R(s.MemorySwapCurrent,d.memorySwapCurrent),
-oomKillCount:R(d.oomKillCount),taskLimit:d.taskLimit||Be(c),result:String(s.Result||d.result||""),signal:String(d.signal||
-""),scopeEmpty:p,startedAt:s.ExecMainStartTimestamp||d.startedAt||"",subState:String(s.SubState||"unknown"),tasksCurrent:R(
-s.TasksCurrent,d.tasksCurrent),tasksPeak:R(d.tasksPeak),tasksMax:String(s.TasksMax||"0"),unitName:e}}function R(...e){return String(
+c=a?u.join("/sys/fs/cgroup",a.replace(/^\/+/,"")):"",l=ge(c),p=c&&T(c)?l.scopeEmpty:!0,m=t?o(r,t):{},d=Date.parse(m.exitObservedAt||
+""),f=Number.isFinite(d)?"runner":"systemd",g=Number.isFinite(d)?d:Date.parse(s.ExecMainExitTimestamp||""),x=Number.isFinite(
+g)&&g>0&&g<=Date.now()?new Date(g).toISOString():"";return{resourceCounters:m.resourceCounters||l,activeState:String(s.ActiveState||
+(m.executionId?"inactive":"unknown")),controlGroup:a,cpuUsageNSec:R(s.CPUUsageNSec,m.cpuUsageNSec),execMainCode:String(s.
+ExecMainCode||m.execMainCode||""),execMainStatus:String(s.ExecMainStatus||m.execMainStatus||""),exitObservedAt:x,exitTimeSource:x?
+f:"",ioReadBytes:R(s.IOReadBytes,m.ioReadBytes),ioWriteBytes:R(s.IOWriteBytes,m.ioWriteBytes),loadState:String(s.LoadState&&
+s.LoadState!=="not-found"?s.LoadState:m.executionId?"recorded":"not-found"),mainPid:String(s.MainPID||"0"),memoryCurrent:R(
+s.MemoryCurrent,m.memoryCurrent),memoryPeak:R(s.MemoryPeak,m.memoryPeak),memorySwapCurrent:R(s.MemorySwapCurrent,m.memorySwapCurrent),
+oomKillCount:R(m.oomKillCount),taskLimit:m.taskLimit||Be(c),result:String(s.Result||m.result||""),signal:String(m.signal||
+""),scopeEmpty:p,startedAt:s.ExecMainStartTimestamp||m.startedAt||"",subState:String(s.SubState||"unknown"),tasksCurrent:R(
+s.TasksCurrent,m.tasksCurrent),tasksPeak:R(m.tasksPeak),tasksMax:String(s.TasksMax||"0"),unitName:e}}function R(...e){return String(
 e.reduce((t,r)=>{let n=Number(r);return Number.isFinite(n)&&n>t?n:t},0))}function Pt(e="",t="",r={}){let n=K(e,t,r),o=null,
 i=n.taskLimit,s=Date.parse(n.startedAt),a=Date.parse(n.exitObservedAt);if((n.result==="oom-kill"||Number(n.oomKillCount)>
-0)&&s>0&&a>=s){let c=Math.min(Date.now(),a+1e3),m=I("journalctl",["-k","--boot=0","--no-pager","--output=json","--output\
+0)&&s>0&&a>=s){let c=Math.min(Date.now(),a+1e3),l=I("journalctl",["-k","--boot=0","--no-pager","--output=json","--output\
 -fields=__REALTIME_TIMESTAMP,__SEQNUM_ID,__SEQNUM,_BOOT_ID,_SOURCE_MONOTONIC_TIMESTAMP,MESSAGE","--lines=65","--case-sen\
 sitive=yes",`--since=@${s/1e3}`,`--until=@${c/1e3}`,`--grep=^oom-kill:|^/[^,]*/${e.replaceAll(".","\\.")}(?:/[^,]*)?,tas\
-k=`],{encoding:"utf8",timeout:2e3,maxBuffer:128*1024});!m.error&&m.status===0&&(o=Vt(m.stdout,{unitName:e,workspace:$(r.
-username),startedAt:s,until:c}))}if(!i&&n.result&&n.result!=="success"&&s>0&&a>=s){let c=Math.min(Date.now(),a+1e3),m=I(
+k=`],{encoding:"utf8",timeout:2e3,maxBuffer:128*1024});!l.error&&l.status===0&&(o=Vt(l.stdout,{unitName:e,workspace:$(r.
+username),startedAt:s,until:c}))}if(!i&&n.result&&n.result!=="success"&&s>0&&a>=s){let c=Math.min(Date.now(),a+1e3),l=I(
 "journalctl",["-k","--boot=0","--no-pager","--output=json","--output-fields=__REALTIME_TIMESTAMP,MESSAGE","--lines=65","\
 --case-sensitive=yes",`--since=@${s/1e3}`,`--until=@${c/1e3}`,`--grep=^cgroup: fork rejected by pids controller in /.*${e.
-replaceAll(".","\\.")}(?:/|$)`],{encoding:"utf8",timeout:2e3,maxBuffer:128*1024});!m.error&&m.status===0&&(i=Ut(m.stdout,
+replaceAll(".","\\.")}(?:/|$)`],{encoding:"utf8",timeout:2e3,maxBuffer:128*1024});!l.error&&l.status===0&&(i=Ut(l.stdout,
 {unitName:e,workspace:$(r.username),startedAt:s,until:c}))}w.stdout.write(`${JSON.stringify({executionId:t,ok:!0,...n,oomBoundary:o,
 taskLimit:i})}
 `)}function Ut(e,{unitName:t,workspace:r,startedAt:n,until:o}){if(typeof e!="string"||Buffer.byteLength(e)>128*1024)return null;
 let i=e.trim().split(/\r?\n/u);if(i.length>64)return null;for(let s of i){let a;try{a=JSON.parse(s)}catch{continue}let c=Number(
-a?.__REALTIME_TIMESTAMP)/1e3;if(!Number.isFinite(c)||c<n||c>o)continue;let m=typeof a.MESSAGE=="string"&&/^cgroup: fork rejected by pids controller in (\/[a-zA-Z0-9_./-]{1,2048})$/u.
-exec(a.MESSAGE)?.[1];if(!m)continue;let p=m.split("/"),d=p.indexOf(`vibe64-${r}-work.slice`);if(!(p[1]!=="vibe64.slice"||
-d<2||p.indexOf(t)<=d||p.some((l,f)=>f>0&&(!l||l==="."||l===".."))))return{source:"kernel-journal",scope:"unknown",count:null,
+a?.__REALTIME_TIMESTAMP)/1e3;if(!Number.isFinite(c)||c<n||c>o)continue;let l=typeof a.MESSAGE=="string"&&/^cgroup: fork rejected by pids controller in (\/[a-zA-Z0-9_./-]{1,2048})$/u.
+exec(a.MESSAGE)?.[1];if(!l)continue;let p=l.split("/"),m=p.indexOf(`vibe64-${r}-work.slice`);if(!(p[1]!=="vibe64.slice"||
+m<2||p.indexOf(t)<=m||p.some((d,f)=>f>0&&(!d||d==="."||d===".."))))return{source:"kernel-journal",scope:"unknown",count:null,
 recordedAt:new Date(c).toISOString()}}return null}function Vt(e,{unitName:t,workspace:r,startedAt:n,until:o}){if(typeof e!=
 "string"||Buffer.byteLength(e)>128*1024)return null;let i=e.trim().split(/\r?\n/u);if(i.length>64)return null;let s=i.flatMap(
-c=>{try{return[JSON.parse(c)]}catch{return[]}}),a=null;for(let c of s){let m=Number(c?.__REALTIME_TIMESTAMP)/1e3;if(!Number.
-isFinite(m)||m<n||m>o)continue;let p=c.MESSAGE;if(typeof p=="string"&&p.startsWith("oom-kill:")&&p.endsWith(",task_memcg\
+c=>{try{return[JSON.parse(c)]}catch{return[]}}),a=null;for(let c of s){let l=Number(c?.__REALTIME_TIMESTAMP)/1e3;if(!Number.
+isFinite(l)||l<n||l>o)continue;let p=c.MESSAGE;if(typeof p=="string"&&p.startsWith("oom-kill:")&&p.endsWith(",task_memcg\
 =")){let v=s.find(k=>/^[a-f0-9]{32}$/u.test(c.__SEQNUM_ID||"")&&k?.__SEQNUM_ID===c.__SEQNUM_ID&&k?._BOOT_ID===c._BOOT_ID&&
 /^[a-f0-9]{32}$/u.test(c._BOOT_ID||"")&&Number.isSafeInteger(Number(c.__SEQNUM))&&Number(k.__SEQNUM)===Number(c.__SEQNUM)+
 1&&Number(k._SOURCE_MONOTONIC_TIMESTAMP)>=Number(c._SOURCE_MONOTONIC_TIMESTAMP)&&Number(k._SOURCE_MONOTONIC_TIMESTAMP)-Number(
 c._SOURCE_MONOTONIC_TIMESTAMP)<=1e6&&/^\/[a-zA-Z0-9_./-]+,task=[^,]+,pid=\d+,uid=\d+$/u.test(k.MESSAGE||""));v&&(p+=v.MESSAGE)}
-let d=typeof p=="string"&&p.match(/^oom-kill:constraint=(CONSTRAINT_[A-Z_]+),.*?,(?:oom_memcg=(\/[^,]+)|(global_oom)),task_memcg=(\/[^,]+),task=/u);
-if(!d)continue;let[,l,f,g,x]=d,M=x.split("/"),y=M.indexOf(`vibe64-${r}-work.slice`),D=M.indexOf(t);if(M[1]!=="vibe64.sli\
-ce"||y<2||D<=y||M.some((v,k)=>k>0&&(v==="."||v===".."||!/^[a-zA-Z0-9_.-]+$/u.test(v))))continue;let V;if(l==="CONSTRAINT\
-_NONE"&&g)V="host";else if(l==="CONSTRAINT_MEMCG"&&f&&(x===f||x.startsWith(`${f}/`))){let v=f.split("/").at(-1),k=M.slice(
+let m=typeof p=="string"&&p.match(/^oom-kill:constraint=(CONSTRAINT_[A-Z_]+),.*?,(?:oom_memcg=(\/[^,]+)|(global_oom)),task_memcg=(\/[^,]+),task=/u);
+if(!m)continue;let[,d,f,g,x]=m,M=x.split("/"),y=M.indexOf(`vibe64-${r}-work.slice`),D=M.indexOf(t);if(M[1]!=="vibe64.sli\
+ce"||y<2||D<=y||M.some((v,k)=>k>0&&(v==="."||v===".."||!/^[a-zA-Z0-9_.-]+$/u.test(v))))continue;let V;if(d==="CONSTRAINT\
+_NONE"&&g)V="host";else if(d==="CONSTRAINT_MEMCG"&&f&&(x===f||x.startsWith(`${f}/`))){let v=f.split("/").at(-1),k=M.slice(
 0,D+1).join("/");V=f===k||f.startsWith(`${k}/`)?"execution":v===`vibe64-${r}-work.slice`?"workspace_work":v===`vibe64-${r}\
 .slice`?"workspace":v==="vibe64.slice"?"platform":/-work-p[a-f0-9]{64}-s[a-f0-9]{64}-w[a-f0-9]{32}\.slice$/u.test(v)?"wo\
 rkflow":/-work-p[a-f0-9]{64}-s[a-f0-9]{64}\.slice$/u.test(v)?"session":/-work-p[a-f0-9]{64}\.slice$/u.test(v)?"project":
-"ancestor"}else return null;let H=f||"";if(a&&a.cgroup!==H)return null;(!a||m>Date.parse(a.recordedAt))&&(a={source:"ker\
-nel-journal",scope:V,cgroup:H,recordedAt:new Date(m).toISOString()})}return a}function Gt(e="",t="",r={}){let n=K(e,t,r);
+"ancestor"}else return null;let H=f||"";if(a&&a.cgroup!==H)return null;(!a||l>Date.parse(a.recordedAt))&&(a={source:"ker\
+nel-journal",scope:V,cgroup:H,recordedAt:new Date(l).toISOString()})}return a}function Gt(e="",t="",r={}){let n=K(e,t,r);
 n.scopeEmpty||A("systemctl",["stop",e]);let o=Date.now()+gt,i=K(e,t,r),s=new Int32Array(new SharedArrayBuffer(4));for(;!i.
 scopeEmpty&&Date.now()<o;)Atomics.wait(s,0,0,25),i=K(e,t,r);i.scopeEmpty||(A("systemctl",["kill","--kill-who=all","--sig\
 nal=SIGKILL",e]),A("systemctl",["stop",e]),i=K(e,t,r)),i.scopeEmpty&&(Te(Ee(r,t),{force:!0,recursive:!0}),A("systemctl",
@@ -257,24 +257,24 @@ r,String(t.password||"")):X(r),rr(r,j)}function Ht(e={}){let t=q();ae(j);let r=S
 if(r==="inspect"){zt(n);return}if(r==="remove"){Yt(n);return}if(r!=="install-start")throw new Error("Vibe64 exec helper \
 rejected an unknown deployment service action.");let o=ee(e.workingDirectory,t,"workingDirectory"),i=ee(e.environmentFile,
 t,"environmentFile"),s=ee(e.startScript,t,"startScript"),a=[...new Set((Array.isArray(e.requiredUnits)?e.requiredUnits:[]).
-map(p=>ve(p,t)))],c=We(n),m=sr({environmentFile:i,owner:t,requiredUnits:a,startScript:s,unitName:n,workingDirectory:o});
-Pe({activation:"restart",unit:m,unitName:n,unitPath:c})}function zt(e=""){ce(e);let t=S("systemctl",["show",e,"--no-page\
+map(p=>ve(p,t)))],c=We(n),l=sr({environmentFile:i,owner:t,requiredUnits:a,startScript:s,unitName:n,workingDirectory:o});
+Pe({activation:"restart",unit:l,unitName:n,unitPath:c})}function zt(e=""){ce(e);let t=S("systemctl",["show",e,"--no-page\
 r","--property=ActiveState,SubState,Result,ExecMainCode,ExecMainStatus,NRestarts"]),r=A("journalctl",["--unit",e,"--no-p\
 ager","--output=cat","--lines=80"]),n=String(r.stdout||r.stderr||"").trim();w.stdout.write(["Service state:",t,...n?["",
 "Recent service output:",n]:[]].join(`
 `)+`
 `)}function Kt(e={}){let t=q();ae(j);let r=String(e.action||"").trim(),n=ve(e.unitName,t);if(r!=="install-start")throw new Error(
 "Vibe64 exec helper rejected an unknown managed service action.");let o=Oe(e.workingDirectory,t,"workingDirectory"),i=Oe(
-e.startScript,t,"startScript"),s=Le(e.processModel),a=s==="forking"?Ge(e.pidFile,t):"",c=ir(n,t),m=ar({owner:t,pidFile:a,
-processModel:s,startScript:i,unitName:n,workingDirectory:o});Ft({owner:t,pidFile:a,unitName:n}),Pe({activation:"start",unit:m,
+e.startScript,t,"startScript"),s=Le(e.processModel),a=s==="forking"?Ge(e.pidFile,t):"",c=ir(n,t),l=ar({owner:t,pidFile:a,
+processModel:s,startScript:i,unitName:n,workingDirectory:o});Ft({owner:t,pidFile:a,unitName:n}),Pe({activation:"start",unit:l,
 unitName:n,unitPath:c})}function Ft({owner:e={},pidFile:t="",unitName:r=""}={}){if(!t||!T(t))return;let n=String(h(t,"ut\
 f8")||"").trim();if(!/^[1-9][0-9]*$/u.test(n))throw new Error("Vibe64 managed service PID file is invalid.");let o=Number(
-n);if(!Number.isSafeInteger(o)||o<=1)throw new Error("Vibe64 managed service PID is invalid.");if(!le(o)){Q(t,n);return}
+n);if(!Number.isSafeInteger(o)||o<=1)throw new Error("Vibe64 managed service PID is invalid.");if(!me(o)){Q(t,n);return}
 let i=Xt(o);if(i===null){Q(t,n);return}if(i!==e.uid)throw new Error("Vibe64 managed service PID belongs to another OS us\
 er.");if(qt(o,r))return;try{w.kill(o,"SIGTERM")}catch(c){if(c?.code==="ESRCH"){Q(t,n);return}throw c}let s=Date.now()+3e4,
-a=new Int32Array(new SharedArrayBuffer(4));for(;le(o)&&Date.now()<s;)Atomics.wait(a,0,0,100);if(le(o))throw new Error("V\
+a=new Int32Array(new SharedArrayBuffer(4));for(;me(o)&&Date.now()<s;)Atomics.wait(a,0,0,100);if(me(o))throw new Error("V\
 ibe64 managed service process did not stop cleanly during ownership transfer.");Q(t,n)}function Q(e="",t=""){T(e)&&String(
-h(e,"utf8")||"").trim()===t&&G(e)}function le(e=0){try{return w.kill(e,0),!0}catch(t){if(t?.code==="ESRCH")return!1;throw t}}
+h(e,"utf8")||"").trim()===t&&G(e)}function me(e=0){try{return w.kill(e,0),!0}catch(t){if(t?.code==="ESRCH")return!1;throw t}}
 function Xt(e=0){let t="";try{t=h(`/proc/${e}/status`,"utf8")}catch(o){if(o?.code==="ENOENT")return null;throw o}let r=String(
 t||"").match(/^Uid:\s+([0-9]+)/mu),n=Number(r?.[1]);if(!Number.isSafeInteger(n))throw new Error("Vibe64 managed service \
 process UID is unavailable.");return n}function qt(e=0,t=""){let r=`/${t}`,n="";try{n=h(`/proc/${e}/cgroup`,"utf8")}catch(o){
@@ -293,7 +293,7 @@ push(Buffer.from(t.subarray(0,i)))}catch(i){if(i?.code==="EINTR")continue;if((i?
 Date.now()<n){Atomics.wait(r,0,0,nt);continue}throw i?.code==="EAGAIN"||i?.code==="EWOULDBLOCK"?new Error("Vibe64 exec h\
 elper timed out waiting for its payload."):i}return Buffer.concat(e,o).toString("utf8")}function N(e=""){let t=String(e||
 "").trim();if(!t||/[/:\\\r\n]/u.test(t))throw new Error("Vibe64 exec helper rejected an unsafe username.");return t}function Qt(e=""){
-if(!mt.test(e))throw new Error("Vibe64 exec helper rejected an unsupported username.")}function Se(e=""){if(Qt(e),e.startsWith(
+if(!lt.test(e))throw new Error("Vibe64 exec helper rejected an unsupported username.")}function Se(e=""){if(Qt(e),e.startsWith(
 re))throw new Error("Vibe64 daemon Unix accounts cannot be managed as app users.");if(dt.has(e))throw new Error("Privile\
 ged Unix accounts cannot be managed as Vibe64 app users.")}function X(e=""){let t=I("getent",["passwd",e],{encoding:"utf\
 8"});if(t.status!==0)throw new Error(`OS user was not found: ${e}`);let n=String(t.stdout||"").split(/\r?\n/u)[0].split(
@@ -352,21 +352,22 @@ return Y(t);if(r==="workspace-cache-command"){let i=u.join(n.home,".local/state/
 s);if(n.username!==t||b(i)!==i||s!==e||a.length!==1||!/^[a-z][a-z0-9-]*-[A-Za-z0-9]{6}$/u.test(a[0]))throw new Error("Ca\
 che maintenance requires an owned workspace scratch directory.");return s}let o=String(e||"").trim();if(!o)return"/";if(r===
 "account-auth-terminal"||r==="account-status"||r==="github-api-command")return ur(o,n);if(r==="vibe64-command"&&n.username===
-t){let i=b(o),s=u.join(n.home,".local","state","vibe64","projects");if(T(s)){let m=b(s);if(i===m||i.startsWith(`${m}${u.
-sep}`))return i}let a=u.join(n.home,".local","state","vibe64","colleague");if(T(a)){let m=C(b(a),i);if(m.length===2&&/^[A-Za-z0-9_-]+$/u.
-test(m[0])&&/^colleague_[a-f0-9]{32}$/u.test(m[1]))return i}let c=u.join(n.home,".local","state","vibe64","training-sour\
-ces");if(T(c)){let m=C(b(c),i);if(m.length===1&&/^(catalogue|topic)-[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/u.
-test(m[0]))return i}}if(r==="codex-app-server"||r==="opencode-app-server"){let i=b(o),s=Number(n.uid),a=[se({username:t})];
-Number.isSafeInteger(s)&&s>=0&&a.push(u.join("/run/user",String(s)));for(let c of a){let m=u.join(c,"vibe64","agent-prov\
-iders");if(!T(m))continue;let p=b(m),d=C(p,i),l=d[0],f=r==="opencode-app-server"?l==="opencode":l==="codex-app-server"||
-/^codex-app-server-[a-f0-9]{12}$/u.test(l),g=r==="codex-app-server"&&d.length===1,x=d.length===2&&d[1]==="workspace";if(f&&
+t){let i=b(o),s=u.join(n.home,".local","state","vibe64","projects");if(T(s)){let l=b(s);if(i===l||i.startsWith(`${l}${u.
+sep}`))return i}let a=u.join(n.home,".local","state","vibe64","colleague");if(T(a)){let l=C(b(a),i),p=l.at(-1)||"",m=l.length===
+4&&l[1]==="learn"&&/^(lobby|[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})$/u.test(l[2]);if((l.length===2||
+m)&&/^[A-Za-z0-9_-]+$/u.test(l[0])&&/^colleague_[a-f0-9]{32}$/u.test(p))return i}let c=u.join(n.home,".local","state","v\
+ibe64","training-sources");if(T(c)){let l=C(b(c),i);if(l.length===1&&/^(catalogue|topic)-[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/u.
+test(l[0]))return i}}if(r==="codex-app-server"||r==="opencode-app-server"){let i=b(o),s=Number(n.uid),a=[se({username:t})];
+Number.isSafeInteger(s)&&s>=0&&a.push(u.join("/run/user",String(s)));for(let c of a){let l=u.join(c,"vibe64","agent-prov\
+iders");if(!T(l))continue;let p=b(l),m=C(p,i),d=m[0],f=r==="opencode-app-server"?d==="opencode":d==="codex-app-server"||
+/^codex-app-server-[a-f0-9]{12}$/u.test(d),g=r==="codex-app-server"&&m.length===1,x=m.length===2&&m[1]==="workspace";if(f&&
 (g||x))return i}}return cr(o,t)}function cr(e="",t=""){let r=String(e||"").trim();if(!r)throw new Error("Vibe64 exec hel\
 per rejected an empty managed project path.");let n=b(r),o=b(u.join("/var/lib/vibe64",$(t),"projects"));if(n.startsWith(
 `${o}${u.sep}`))return n;throw new Error("Vibe64 exec helper rejected a command path outside the owner project root.")}function ur(e="",t={}){
 let r=String(e||"").trim(),n=String(t.home||"").trim();if(!r||!n)throw new Error("Vibe64 exec helper rejected an empty u\
 ser command path.");let o=b(r),i=b(n);if(o===i||o.startsWith(`${i}${u.sep}`))return o;throw new Error("Vibe64 exec helpe\
 r rejected a command path outside the target user home.")}function $(e=""){return e.startsWith(re)?e.slice(re.length):e}
-function Y(e=""){return u.join(lt,$(N(e)),"tmp")}function be(e={},t={},r="",n=""){let o={PATH:ie,TERM:w.env.TERM||"xterm\
+function Y(e=""){return u.join(mt,$(N(e)),"tmp")}function be(e={},t={},r="",n=""){let o={PATH:ie,TERM:w.env.TERM||"xterm\
 -256color"};for(let[i,s]of Object.entries(e))!ct.test(i)||ut.has(i)||i.startsWith("LD_")||i.startsWith("DYLD_")||(o[i]=String(
 s));if(n==="opencode-app-server"){let i=u.join(se({username:r}),"vibe64","agent-providers","opencode");for(let s of["HOM\
 E","XDG_CACHE_HOME","XDG_CONFIG_HOME","XDG_DATA_HOME","XDG_STATE_HOME"]){let a=String(e[s]||"").trim();if(!u.isAbsolute(

package/node_modules/@local/vibe64-genesis/bin/vibe64-genesis-host-context

@@ -560,12 +560,12 @@ startTimeTicks,version:c}}return Object.freeze({normalize:N,isValid:F,normalizeI
 isProcessAlive:x})}var Tt=(t,e,r,n={})=>Object.freeze({id:t,contextWindow:e,variants:Object.freeze(r),...n}),Ga=Object.freeze([Object.freeze(
 {id:"deepseek",baseUrl:"https://api.deepseek.com/",claudeBaseUrl:"https://api.deepseek.com/anthropic",claudeAutoCompactWindow:786432,
 webSearch:!1,models:Object.freeze([Tt("deepseek-flash",1048576,["low","high","max"],{images:!0,freeformPatch:!0,codexHistoryRouting:!0}),
-Tt("deepseek-v4-pro",1048576,["low","high","max"],{freeformPatch:!0})])}),Object.freeze({id:"zai-coding-plan",baseUrl:"h\
-ttps://api.z.ai/api/v1",claudeBaseUrl:"https://api.z.ai/api/anthropic",claudeAutoCompactWindow:1e6,webSearch:!1,models:Object.
-freeze([Tt("glm-5.3",1048576,["low","high","max"],{freeformPatch:!0,codexHistoryRouting:!0})])}),Object.freeze({id:"zai",
-baseUrl:"https://api.z.ai/api/v1",claudeBaseUrl:"https://api.z.ai/api/anthropic",claudeAutoCompactWindow:1e6,webSearch:!1,
-models:Object.freeze([Tt("glm-5.3",1048576,["low","high","max"],{freeformPatch:!0,codexHistoryRouting:!0})])})]);function Ie(t){
-return Ga.find(e=>e.id===t)||null}var lp=32*1024*1024,pp=Object.freeze({chatgpt:"https://chatgpt.com/backend-api/codex",apiKey:"https://api.openai.com/v1",
+Tt("deepseek-v4-pro",1048576,["low","high","max"],{freeformPatch:!0,codexHistoryRouting:!0})])}),Object.freeze({id:"zai-\
+coding-plan",baseUrl:"https://api.z.ai/api/v1",claudeBaseUrl:"https://api.z.ai/api/anthropic",claudeAutoCompactWindow:1e6,
+webSearch:!1,models:Object.freeze([Tt("glm-5.3",1048576,["low","high","max"],{freeformPatch:!0,codexHistoryRouting:!0})])}),
+Object.freeze({id:"zai",baseUrl:"https://api.z.ai/api/v1",claudeBaseUrl:"https://api.z.ai/api/anthropic",claudeAutoCompactWindow:1e6,
+webSearch:!1,models:Object.freeze([Tt("glm-5.3",1048576,["low","high","max"],{freeformPatch:!0,codexHistoryRouting:!0})])})]);
+function Ie(t){return Ga.find(e=>e.id===t)||null}var lp=32*1024*1024,pp=Object.freeze({chatgpt:"https://chatgpt.com/backend-api/codex",apiKey:"https://api.openai.com/v1",
 deepseek:Ie("deepseek").baseUrl.replace(/\/$/u,""),"zai-coding-plan":Ie("zai-coding-plan").baseUrl,zai:Ie("zai").baseUrl});var vp=new URL("./../../../@jskit-ai/assistant-core/src/server/conversation/codexProcess.js",import.meta.url).href;var bp=Object.freeze({HELPER:"helper",INTERACTIVE:"interactive"}),_p=mr();var Ka=Object.freeze({UNIX:"unix"});var Ap=process.platform==="linux"?107:103,Cp=Object.freeze({MISSING:"missing",RESPONSIVE:"responsive",TIMEOUT:"timeout",
 UNREACHABLE:"unreachable"}),Ep=Object.freeze({EXITED:"exited",INCOMPATIBLE:"incompatible",LIVE:"live",MISSING:"missing",
 SUSPECT:"suspect"}),Ja=Object.freeze({RUNNING:"running",STOPPED:"stopped"}),Op=Object.freeze({ABSENT:"absent",AMBIGUOUS:"\
@@ -988,82 +988,83 @@ Possible answers:
 start a duplicate or replacement server. If it is unavailable, report that blocker. Describe only rendered browser evide\
 nce.","When adopting an authenticated app, or when its login blocks Preview inspection, inspect identity support/names w\
 ith `vibe64-helper preview status`; prefer `vibe64-helper preview browser identity <configured-name>` to requesting pass\
-words. If unconfigured, ask which existing accounts (email/login/user ID) represent admin and other required roles, and \
-the default. Reuse prior answers; wait for their choices before configuring access. Never infer admin rights from names \
-or the Vibe64 viewer.","Offer an application-owned adapter declared in the Outputs `#### Preview identity` block (`vibe6\
-4-helper spec outputs` and `vibe64-helper spec preview-identity-command`), and save the named selectors the person gives\
- or confirms with `vibe64-helper preview identities save` (`vibe64-helper spec preview-identities`); you may propose the\
-m from existing app accounts, then verify each with `vibe64-helper preview browser identity <name>`. Use existing sessio\
-ns/permissions, reject missing/disabled accounts, and disable the adapter without Vibe64\u2019s per-run enable flag and secre\
-t. Do not create users, change roles, reset passwords or weaken production auth for import. Verify the selected account\u2019\
-s actual Preview access; a saved selector is insufficient. If deferred/declined, explain access remains unconfigured and\
- continue independent setup work without repeated credential requests. Public/non-web apps need no adapter.","Use `vibe6\
-4-helper preview status`, `screenshot`, `logs`, and `browser eval` (Playwright code on stdin) for rendered inspection.",
-"The top Preview toolbar Stop and `vibe64-helper preview stop` stop this session's application and managed browser, not \
-chat or source. Status reports the saved stopped choice. A status read, screenshot, browser inspection, source edit or s\
-ession reopening is not permission to restart it; use `vibe64-helper preview ensure --wait` only for a deliberate Start.\
- Scoped browser tests restore the prior stopped choice.","For interactive navigation, use the proxy URL from `vibe64-hel\
-per preview inspect-url` or status `currentPage.url` / `endpoints.browser.url`. Inside browser eval, use `await page.got\
-o(new URL('/your-path', preview.url).href)`. The direct application endpoint under diagnostics bypasses Preview identity\
- and is not a browser-navigation URL.","Use the managed preview browser for interactive browsing and `vibe64-helper play\
-wright` only for an existing configured project suite; report a platform or project-test blocker rather than installing \
-another browser or changing its dependencies.","For browser evidence, batch related actions and assertions, return only \
-needed values and inspect relevant locators or regions; screenshot at meaningful visual checkpoints or failures, not aft\
-er every click. Reuse the managed browser when test isolation permits. Preserve required viewport, identity and security\
- checks; use existing automated cases for repeat verification.","For browser tests that write or reset data, inspect `vi\
-be64-helper preview targets --json` and the project's `genesis/stack.md` Outputs. Run `vibe64-helper playwright --target\
- <declared-test-target> test <suite arguments>` or `vibe64-helper playwright --target <declared-test-target> npm-run <sc\
-ript>`. Vibe64 starts that web target, waits for readiness, uses its declared application identity, and restores the pre\
-vious Preview when the command finishes or is cancelled; report restoration failures.","A target name is not proof of te\
-st isolation. Before running a destructive suite, the application must verify the server's actual test database and supp\
-ress real email, invoices, payments, and other external effects. Keep managed Env unchanged. The test launcher and its p\
-review-identity command must use the same database. Follow the application's declared test resources and never invent a \
-database name. Never spoof safety checks by changing only the test runner's environment.","If no suitable test target ex\
-ists, add one through the project's existing Outputs contract and application-owned test scripts within authorized scope\
-, keeping normal Preview as default. Validate the exact disposable database before resetting it, prepare fixtures before\
- reporting readiness, and make Playwright use the started target's URL, which Vibe64 supplies as PLAYWRIGHT_BASE_URL, wi\
-thout starting another server. If the required test resources or external-effect controls are missing, report that speci\
-fic blocker. Use `vibe64-helper preview ensure --target <id> --wait --json` only to deliberately select an interactive t\
-arget; it stays selected until changed. If browser startup is slow, measure migrations, fixtures and server startup befo\
-re retrying or extending deadlines.","Keep test output small: run relevant files/cases, save stdout/stderr to local arti\
-facts and preserve exit status. Report counts, duration, failed cases, actionable errors and artifact paths. Read only n\
-eeded failure excerpts, not full passing/JSON/TAP/request/trace/image output. Retain startup, resource and Preview-resto\
-ration errors even if tests pass, and trailing wrapper diagnostics separately from JSON. Do not rerun for output or rere\
-ad unchanged logs; inspect on new output, changed state or a concrete blocker.","Batch related browser tests in one mana\
-ged suite (one Preview switch and restore). Suites and live Preview actions are sequential: no browser actions, ensure/r\
-estart or target changes during a suite or restoration. Wait on the original execution, including background runs, throu\
-gh cleanup/restoration (empty polls: yield_time_ms: 30000 where supported; shorter only for interactive input or an imme\
-diate check); read-only status/logs stay available. Before live inspection, confirm `vibe64-helper playwright status` ha\
-s no active run and `vibe64-helper preview status` is ready on the restored target. To stop, read suite status then run \
-`vibe64-helper playwright cancel <run-id>`, which waits for cleanup/restoration; retry it if cleanup needs attention. Ne\
-ver kill individual test/Preview PIDs or change locks. Launcher exit alone does not prove tests stopped. Recheck current\
- status before reporting a busy blocker.","If a managed command reports kernel task denials or a resource incident, reta\
-in its diagnostic and incident ID when reporting the blocker. Ask the platform operator to inspect that resource evidenc\
-e before retrying; do not increase test timeouts or weaken assertions to work around a process/thread limit. A generic b\
-rowser timeout without resource evidence does not establish a platform cause."]),C_=Object.freeze(["Each managed shell c\
-ommand receives current development Env from Vibe64, including declared resource bindings; use them in ordinary commands\
-. Do not build environment injection or copy managed credentials into source. Resource provisioning and application migr\
-ations remain separate preparation steps.","Use `vibe64-helper env status [development|production|all]` to inspect confi\
-gured key names without revealing values.","Pipe an available value to `vibe64-helper env set <development|production> <\
-KEY> [--secret]`; never put values in arguments, logs, or repository files. Use empty stdin only when the user requested\
- an empty value.","Keep development and production values separate. Never invent credentials, copy a value between scope\
-s without explicit direction, or edit Vibe64 runtime/session storage.","After an Env mutation, report only the affected \
-scope and key names, never their values, and claim success only when the command succeeded.","Store a secret the applica\
-tion needs generated (such as an application key) by generating it with the framework's own generator and piping it to `\
-vibe64-helper env set <scope> <KEY> --secret`. Never write it into a generated `.env` file: Vibe64 regenerates that file\
- from Env."]);function Zr(t=""){return String(t??"").trim()}function en(t,e){if(!t||typeof t!="object"||Array.isArray(t))
-throw new TypeError(`${e} must be an object.`);return t}function rt(t,e,r){let n=new Set(e),o=Object.keys(t).filter(s=>!n.
-has(s));if(o.length>0)throw new TypeError(`${r} contains unsupported fields: ${o.join(", ")}.`)}function qu(t){if(rt(t,[
-"conversationKind","scope","session","hostGuidance"],"Vibe64 session context"),t.hostGuidance!==void 0&&(typeof t.hostGuidance!=
-"string"||Buffer.byteLength(t.hostGuidance,"utf8")>1024))throw new TypeError("Vibe64 host guidance must be bounded text \
-supplied by the host.");if(!$u.includes(t.conversationKind))throw new TypeError("Vibe64 session context has an unknown c\
-onversationKind.");let e=en(t.session,"Vibe64 session capabilities");rt(e,Gs,"Vibe64 session capabilities");let r=Object.
-fromEntries(Gs.map(n=>{if(typeof e[n]!="boolean")throw new TypeError(`Vibe64 session capability ${n} must be boolean.`);
-return[n,e[n]]}));return{conversationKind:t.conversationKind,scope:"session",...t.hostGuidance?{hostGuidance:t.hostGuidance}:
-{},session:r}}function Bu(t){rt(t,["scope","stableContext"],"Vibe64 ephemeral context");let e=String(t.stableContext||"").
-trim();if(!e||e.length>Uu)throw new TypeError("Vibe64 ephemeral context requires bounded stableContext.");return{scope:"\
-ephemeral",stableContext:e}}function Hu(t){if(t.scope==="session")return qu(t);if(t.scope==="ephemeral")return Bu(t);throw new TypeError(
-"The Vibe64 driver supports session and ephemeral scopes only.")}async function Ws(t={},{readRegistry:e=Fu,workdir:r=""}={}){let n=en(t,"Vibe64 host resolver request");if(rt(n,["data","\
+words. If unconfigured, ask which existing accounts (email/login/user ID) represent admin, other required roles and the \
+default; reuse prior answers and wait for their choices before configuring access. Never infer admin rights from names o\
+r the Vibe64 viewer.","A web app with login accounts has an application-owned adapter in the Outputs `#### Preview ident\
+ity` block (`vibe64-helper spec outputs`, `vibe64-helper spec preview-identity-command`); when it is missing, set it up \
+from the app framework's own pattern as part of the work instead of merely offering it. Save selectors the person gives \
+or confirms (you may propose existing app accounts) with `vibe64-helper preview identities save` (`vibe64-helper spec pr\
+eview-identities`), then verify each with `vibe64-helper preview browser identity <name>`; a saved selector alone proves\
+ no access. Use existing sessions/permissions, reject missing/disabled accounts, and disable the adapter without Vibe64\u2019\
+s per-run enable flag and secret. Do not create users, change roles, reset passwords or weaken production auth for impor\
+t. If choices are deferred/declined, say access stays unconfigured and continue independent setup work without repeated \
+credential requests. Public/non-web apps need no adapter.","Use `vibe64-helper preview status`, `screenshot`, `logs`, an\
+d `browser eval` (Playwright code on stdin) for rendered inspection.","The top Preview toolbar Stop and `vibe64-helper p\
+review stop` stop this session's application and managed browser, not chat or source. Status reports the saved stopped c\
+hoice. A status read, screenshot, browser inspection, source edit or session reopening is not permission to restart it; \
+use `vibe64-helper preview ensure --wait` only for a deliberate Start. Scoped browser tests restore the prior stopped ch\
+oice.","For interactive navigation, use the proxy URL from `vibe64-helper preview inspect-url` or status `currentPage.ur\
+l` / `endpoints.browser.url`. Inside browser eval, use `await page.goto(new URL('/your-path', preview.url).href)`. The d\
+irect application endpoint under diagnostics bypasses Preview identity and is not a browser-navigation URL.","Use the ma\
+naged preview browser for interactive browsing and `vibe64-helper playwright` only for an existing configured project su\
+ite; report a platform or project-test blocker rather than installing another browser or changing its dependencies.","Fo\
+r browser evidence, batch related actions and assertions, return only needed values and inspect relevant locators or reg\
+ions; screenshot at meaningful checkpoints or failures, not after every click. Reuse the managed browser when isolation \
+permits, keep required viewport, identity and security checks, and use existing automated cases for repeat verification.",
+"For browser tests that write or reset data, inspect `vibe64-helper preview targets --json` and the project's `genesis/s\
+tack.md` Outputs. Run `vibe64-helper playwright --target <declared-test-target> test <suite arguments>` (or `npm-run <sc\
+ript>` in place of `test`). Vibe64 starts that web target, waits for readiness, uses its declared application identity, \
+and restores the previous Preview when the command finishes or is cancelled; report restoration failures.","A target nam\
+e is not proof of test isolation. Before running a destructive suite, the application must verify the server's actual te\
+st database and suppress real email, invoices, payments, and other external effects. Keep managed Env unchanged. The tes\
+t launcher and its preview-identity command must use the same database. Follow the application's declared test resources\
+ and never invent a database name. Never spoof safety checks by changing only the test runner's environment.","If no sui\
+table test target exists, add one through the project's existing Outputs contract and application-owned test scripts wit\
+hin authorized scope; normal Preview stays the default. Validate the exact disposable database before resetting it, prep\
+are fixtures before reporting readiness, and make Playwright use PLAYWRIGHT_BASE_URL (the started target's URL) without \
+starting another server. If test resources or external-effect controls are missing, report that blocker. `vibe64-helper \
+preview ensure --target <id> --wait --json` deliberately selects an interactive target until changed. If browser startup\
+ is slow, measure migrations, fixtures and server startup before retrying or extending deadlines.","Keep test output sma\
+ll: run relevant files/cases, save stdout/stderr to local artifacts and keep exit status. Report counts, duration, faile\
+d cases, actionable errors and artifact paths, reading only needed failure excerpts. Retain startup, resource and Previe\
+w-restoration errors even if tests pass, and trailing wrapper diagnostics separately from JSON. Do not rerun for output \
+or reread unchanged logs.","Batch related browser tests in one managed suite (one Preview switch and restore). Suites an\
+d live Preview actions are sequential: no browser actions, ensure/restart or target changes during a suite or restoratio\
+n. Wait on the original execution, including background runs, through cleanup/restoration (empty polls: yield_time_ms: 3\
+0000 where supported; shorter only for interactive input); read-only status/logs stay available. Before live inspection,\
+ confirm `vibe64-helper playwright status` shows no active run and `vibe64-helper preview status` is ready on the restor\
+ed target. To stop, run `vibe64-helper playwright cancel <run-id>`, which waits for cleanup/restoration; retry if cleanu\
+p needs attention. Never kill test/Preview PIDs or change locks; launcher exit alone does not prove tests stopped. Reche\
+ck status before reporting a busy blocker.","If a managed command reports kernel task denials or a resource incident, re\
+port the blocker with its diagnostic and incident ID and ask the platform operator to inspect that evidence before retry\
+ing; never raise test timeouts or weaken assertions to work around a process/thread limit. A generic browser timeout wit\
+hout resource evidence does not establish a platform cause."]),C_=Object.freeze(["Each managed shell command receives cu\
+rrent development Env from Vibe64, including declared resource bindings; use them in ordinary commands. Do not build env\
+ironment injection or copy managed credentials into source. Resource provisioning and application migrations remain sepa\
+rate preparation steps.","Use `vibe64-helper env status [development|production|all]` to inspect configured key names wi\
+thout revealing values.","Pipe an available value to `vibe64-helper env set <development|production> <KEY> [--secret]`; \
+never put values in arguments, logs, or repository files. Use empty stdin only when the user requested an empty value.",
+"When the person refers to a saved key, account or accounts hub, run `vibe64-helper env saved` (names, descriptions and \
+fields, never values) and link the matching field to the variable the application reads with `vibe64-helper env link <de\
+velopment|production> <KEY> <saved-id> <field-id>` instead of asking for the value.","Keep development and production va\
+lues separate. Never invent credentials, copy a value between scopes without explicit direction, or edit Vibe64 runtime/\
+session storage.","After an Env mutation, report only the affected scope and key names, never their values, and claim su\
+ccess only when the command succeeded.","Store a secret the application needs generated (such as an application key) by \
+generating it with the framework's own generator and piping it to `vibe64-helper env set <scope> <KEY> --secret`. Never \
+write it into a generated `.env` file: Vibe64 regenerates that file from Env."]);function Zr(t=""){return String(t??"").
+trim()}function en(t,e){if(!t||typeof t!="object"||Array.isArray(t))throw new TypeError(`${e} must be an object.`);return t}
+function rt(t,e,r){let n=new Set(e),o=Object.keys(t).filter(s=>!n.has(s));if(o.length>0)throw new TypeError(`${r} contai\
+ns unsupported fields: ${o.join(", ")}.`)}function qu(t){if(rt(t,["conversationKind","scope","session","hostGuidance"],"\
+Vibe64 session context"),t.hostGuidance!==void 0&&(typeof t.hostGuidance!="string"||Buffer.byteLength(t.hostGuidance,"ut\
+f8")>1024))throw new TypeError("Vibe64 host guidance must be bounded text supplied by the host.");if(!$u.includes(t.conversationKind))
+throw new TypeError("Vibe64 session context has an unknown conversationKind.");let e=en(t.session,"Vibe64 session capabi\
+lities");rt(e,Gs,"Vibe64 session capabilities");let r=Object.fromEntries(Gs.map(n=>{if(typeof e[n]!="boolean")throw new TypeError(
+`Vibe64 session capability ${n} must be boolean.`);return[n,e[n]]}));return{conversationKind:t.conversationKind,scope:"s\
+ession",...t.hostGuidance?{hostGuidance:t.hostGuidance}:{},session:r}}function Bu(t){rt(t,["scope","stableContext"],"Vib\
+e64 ephemeral context");let e=String(t.stableContext||"").trim();if(!e||e.length>Uu)throw new TypeError("Vibe64 ephemera\
+l context requires bounded stableContext.");return{scope:"ephemeral",stableContext:e}}function Hu(t){if(t.scope==="sessi\
+on")return qu(t);if(t.scope==="ephemeral")return Bu(t);throw new TypeError("The Vibe64 driver supports session and ephem\
+eral scopes only.")}async function Ws(t={},{readRegistry:e=Fu,workdir:r=""}={}){let n=en(t,"Vibe64 host resolver request");if(rt(n,["data","\
 providerSessionId","parentSessionIds","scope"],"Vibe64 host resolver request"),!["session","turn"].includes(n.scope))throw new TypeError(
 "The Vibe64 host resolver scope must be session or turn.");if(n.scope==="turn")return null;let o=en(n.data,"Vibe64 host \
 resolver data");rt(o,["registryPath"],"Vibe64 host resolver data");let s=Zr(o.registryPath);if(!Qr.isAbsolute(s))throw new TypeError(

package/node_modules/@local/vibe64-genesis/package.json

@@ -6,6 +6,7 @@
   "exports": {
     "./server": "./src/server/index.js",
     "./server/agentSpecs": "./src/server/agentSpecs.js",
+    "./server/packaging": "./src/server/packaging.js",
     "./server/promptContext": "./src/server/promptContext.js",
     "./shared/connectedPackageTypes": "./src/shared/connectedPackageTypes.js"
   }