wayang-ai 0.7.2 → 0.8.0

package/dist/cli.js

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 
 // src/cli.ts
-import * as path6 from "path";
+import * as path8 from "path";
 
 // src/cli-args.ts
 import meow from "meow";
 var CLI_HELP_TEXT = `
   Usage
     $ wayang                       Resume latest session for this workspace (or new)
-    $ wayang --fresh               Start a brand-new session (ignore prior context)
+    $ wayang --new                 Start a brand-new session (ignore prior context)
     $ wayang --resume              Interactive session select
     $ wayang --resume <id>         Resume specific session
     $ wayang --resume --all        Show all workspaces
@@ -17,8 +17,13 @@ var CLI_HELP_TEXT = `
   Options
     --home-dir <path>       Root directory for sessions and config (default: $HOME)
     --workspace-dir, -w     Working directory for tools (default: pwd)
+                            Alias: --workspace.
+                            New session: recorded as its initial workspace.
+                            --resume: never rewrites the session's recorded
+                            workspaces; it only filters the picker (and picks
+                            the default when resuming without an id).
     --config, -c            Config file path
-    --fresh, -n             Start a new session (do not inherit prior context)
+    --new, -n               Start a new session (do not inherit prior context)
     --resume, -r            Pick a session to resume (interactive, or <id>)
     --all                   List sessions across all workspaces (with --resume)
     --verbose               Enable debug logging
@@ -27,12 +32,21 @@ var CLI_HELP_TEXT = `
     --session <mode>        (server) "new" or "resume:<id>"
     --inject-previous-tasks (server) surface unfinished tasks on resume
     --log-level <level>     (server) log level
+
+  Deprecated
+    --fresh                 Alias of --new (same behavior); use --new instead
 `;
 var CLI_FLAGS = {
   homeDir: { type: "string" },
-  workspaceDir: { type: "string", shortFlag: "w" },
+  // `aliases` is asserted mutable because meow types it as `string[]`; the
+  // surrounding `as const` would otherwise make the array readonly.
+  workspaceDir: { type: "string", shortFlag: "w", aliases: ["workspace"] },
   config: { type: "string", shortFlag: "c" },
-  fresh: { type: "boolean", shortFlag: "n", default: false },
+  new: { type: "boolean", shortFlag: "n", default: false },
+  // Deprecated alias of `--new` (the pre-0.8 spelling). Registered as its own
+  // key so the parser accepts it and the unknown-flag/negation passes cover
+  // it; the result is folded back into `new` (see parseCliArgs).
+  fresh: { type: "boolean", default: false },
   resume: { type: "boolean", shortFlag: "r", default: false },
   all: { type: "boolean", default: false },
   verbose: { type: "boolean", default: false },
@@ -46,6 +60,13 @@ var FLAG_ENTRIES = Object.entries(CLI_FLAGS);
 var CANONICAL_KEYS = new Set(FLAG_ENTRIES.map(([key]) => key));
 var SHORT_KEYS = new Set(FLAG_ENTRIES.flatMap(([, flag]) => flag.shortFlag ? [flag.shortFlag] : []));
 var LONG_NAMES = new Set(FLAG_ENTRIES.map(([key]) => decamelizeKey(key)));
+var ALIAS_LONG_NAMES = new Set(
+  FLAG_ENTRIES.flatMap(([, flag]) => (flag.aliases ?? []).map(decamelizeKey))
+);
+var ALIAS_KEYS = new Set(
+  FLAG_ENTRIES.flatMap(([, flag]) => (flag.aliases ?? []).flatMap((name) => [name, camelizeKey(name)]))
+);
+var KNOWN_LONG_NAMES = /* @__PURE__ */ new Set([...LONG_NAMES, ...ALIAS_LONG_NAMES]);
 var BOOLEAN_LONG_NAMES = new Set(
   FLAG_ENTRIES.filter(([, flag]) => flag.type === "boolean").map(([key]) => decamelizeKey(key))
 );
@@ -57,10 +78,13 @@ for (const [key, flag] of FLAG_ENTRIES) {
 function fold(name) {
   return name.toLowerCase().replace(/[-_]/g, "");
 }
-var FOLDED_LONG_NAMES = new Set([...LONG_NAMES].map(fold));
+var FOLDED_LONG_NAMES = new Set([...KNOWN_LONG_NAMES].map(fold));
 function decamelizeKey(key) {
   return key.replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase();
 }
+function camelizeKey(name) {
+  return name.replace(/-([a-z0-9])/g, (_match, char) => char.toUpperCase());
+}
 function renderUnknownKey(argv, key) {
   const keyFolded = fold(key);
   for (const token of argv) {
@@ -85,13 +109,13 @@ function scanArgvForSwallowedFlags(argv, problems) {
     if (token.startsWith("--")) {
       const long = (eqIndex === -1 ? token : token.slice(0, eqIndex)).slice(2);
       if (!long) continue;
-      if (LONG_NAMES.has(long)) {
+      if (KNOWN_LONG_NAMES.has(long)) {
         if (eqIndex !== -1 && BOOLEAN_LONG_NAMES.has(long)) {
           problems.add(`Option --${long} does not accept a value`);
         }
         continue;
       }
-      if (FOLDED_LONG_NAMES.has(fold(long)) || long.startsWith("no-") && LONG_NAMES.has(long.slice(3))) {
+      if (FOLDED_LONG_NAMES.has(fold(long)) || long.startsWith("no-") && KNOWN_LONG_NAMES.has(long.slice(3))) {
         problems.add(`Unknown option: --${long}`);
       }
       continue;
@@ -105,6 +129,23 @@ function scanArgvForSwallowedFlags(argv, problems) {
     }
   }
 }
+var NEW_FLAG_LONG_NAMES = /* @__PURE__ */ new Set(["new", "fresh"]);
+function countNewFlagOccurrences(argv) {
+  let count = 0;
+  for (const token of argv) {
+    if (token === "--") break;
+    if (!token.startsWith("-") || token === "-") continue;
+    const isLong = token.startsWith("--");
+    const name = (isLong ? token.slice(2) : token.slice(1)).split("=")[0];
+    if (!name) continue;
+    if (isLong) {
+      if (NEW_FLAG_LONG_NAMES.has(name)) count += 1;
+    } else {
+      count += [...name].filter((ch) => ch === "n").length;
+    }
+  }
+  return count;
+}
 function parseCliArgs(argv) {
   let cli;
   try {
@@ -117,9 +158,12 @@ function parseCliArgs(argv) {
     };
   }
   const problems = /* @__PURE__ */ new Set();
+  if (countNewFlagOccurrences(argv) > 1) {
+    problems.add("The flag --new can only be set once.");
+  }
   const unnormalized = cli.unnormalizedFlags;
   for (const key of Object.keys(unnormalized)) {
-    if (!CANONICAL_KEYS.has(key) && !SHORT_KEYS.has(key)) {
+    if (!CANONICAL_KEYS.has(key) && !SHORT_KEYS.has(key) && !ALIAS_KEYS.has(key)) {
       problems.add(`Unknown option: ${renderUnknownKey(argv, key)}`);
     }
   }
@@ -146,7 +190,9 @@ function parseCliArgs(argv) {
       homeDir: readString(flags2.homeDir),
       workspaceDir: readString(flags2.workspaceDir),
       config: readString(flags2.config),
-      fresh: flags2.fresh === true,
+      // `--fresh` is the deprecated alias, so either key means the same flag.
+      // A double set is already rejected above, never reaching this point.
+      new: flags2.new === true || flags2.fresh === true,
       resume: flags2.resume === true,
       all: flags2.all === true,
       verbose: flags2.verbose === true,
@@ -175,7 +221,8 @@ function renderHelp() {
 }
 
 // src/bootstrap.ts
-import * as path4 from "path";
+import * as fs6 from "fs";
+import * as path7 from "path";
 
 // src/client/connect.ts
 import { spawn } from "child_process";
@@ -362,9 +409,9 @@ var RpcClient = class {
       return Promise.reject(new Error("RPC transport closed: cannot send request"));
     }
     const id = this.nextId++;
-    return new Promise((resolve12, reject) => {
+    return new Promise((resolve13, reject) => {
       this.pending.set(id, {
-        resolve: (v) => resolve12(v),
+        resolve: (v) => resolve13(v),
         reject
       });
       this.transport.send({ id, method, params });
@@ -416,11 +463,11 @@ var RemoteStateStore = class {
   rpc;
   entries = /* @__PURE__ */ new Map();
   byId = /* @__PURE__ */ new Map();
-  subscribe(target, path7, callback) {
-    const key = `${target}:${path7}`;
+  subscribe(target, path9, callback) {
+    const key = `${target}:${path9}`;
     let entry = this.entries.get(key);
     if (!entry) {
-      entry = { subscriptionId: "", target, path: path7, data: void 0, listeners: /* @__PURE__ */ new Set(), settled: false };
+      entry = { subscriptionId: "", target, path: path9, data: void 0, listeners: /* @__PURE__ */ new Set(), settled: false };
       this.entries.set(key, entry);
       this.connect(entry, key);
     }
@@ -430,8 +477,8 @@ var RemoteStateStore = class {
       if (entry.listeners.size === 0) this.teardown(entry, key);
     };
   }
-  getSnapshot(target, path7) {
-    return this.entries.get(`${target}:${path7}`)?.data;
+  getSnapshot(target, path9) {
+    return this.entries.get(`${target}:${path9}`)?.data;
   }
   connect(entry, key) {
     this.rpc.request(METHOD.SUBSCRIBE, { target: entry.target, path: entry.path }).then((res) => {
@@ -469,21 +516,21 @@ var RemoteSubscribable = class {
   }
   store;
   target;
-  subscribe(path7, callback) {
-    return this.store.subscribe(this.target, path7, callback);
+  subscribe(path9, callback) {
+    return this.store.subscribe(this.target, path9, callback);
   }
-  getSnapshot(path7) {
-    return this.store.getSnapshot(this.target, path7);
+  getSnapshot(path9) {
+    return this.store.getSnapshot(this.target, path9);
   }
 };
 
 // src/client/remote-supervisor.ts
 var CONTEXT_USAGE_STATE_PATH = "dynamicState.contextUsage";
 var RemoteSupervisor = class {
-  constructor(rpc, store, workspaceDir2, hooks) {
+  constructor(rpc, store, workspaceDir2, hooks, workspaces = []) {
     this.rpc = rpc;
     this.hooks = hooks;
-    this.ctx = { workspaceDir: workspaceDir2 };
+    this.ctx = { workspaceDir: workspaceDir2, workspaces };
     this.controllerAgent = Object.assign(new RemoteSubscribable(store, "controllerAgent"), {
       abort: () => {
         void this.rpc.request(METHOD.ABORT_CONTROLLER).catch(() => {
@@ -568,8 +615,8 @@ async function connectRemoteServer(options) {
   child.stderr?.on("data", (chunk) => {
     stderrTail = (stderrTail + chunk).slice(-4e3);
   });
-  const exited = new Promise((resolve12) => {
-    child.on("exit", (code) => resolve12(code));
+  const exited = new Promise((resolve13) => {
+    child.on("exit", (code) => resolve13(code));
   });
   const transport = createStreamTransport(child.stdout, child.stdin);
   const rpc = new RpcClient(transport);
@@ -588,10 +635,10 @@ async function connectRemoteServer(options) {
     }
     const exitOrKill = Promise.race([
       exited,
-      new Promise((resolve12) => {
+      new Promise((resolve13) => {
         setTimeout(() => {
           child.kill("SIGKILL");
-          resolve12(null);
+          resolve13(null);
         }, SHUTDOWN_GRACE_MS);
       })
     ]);
@@ -605,11 +652,11 @@ ${stderrTail}`);
       process.exit(1);
     }
   });
-  const remote = new RemoteSupervisor(rpc, store, options.workspaceDir, { stop });
+  const remote = new RemoteSupervisor(rpc, store, options.workspaceDir, { stop }, options.workspaces);
   return { remote, stop };
 }
 function waitForReady(child, rpc, exited, getStderrTail, timeoutMs) {
-  return new Promise((resolve12, reject) => {
+  return new Promise((resolve13, reject) => {
     let settled = false;
     const finish = (err) => {
       if (settled) return;
@@ -617,7 +664,7 @@ function waitForReady(child, rpc, exited, getStderrTail, timeoutMs) {
       clearTimeout(timer);
       offReady();
       if (err) reject(err);
-      else resolve12();
+      else resolve13();
     };
     const timer = setTimeout(() => {
       child.kill("SIGKILL");
@@ -635,139 +682,1110 @@ ${getStderrTail()}`));
 }
 
 // src/infra/session-helpers.ts
+import * as fs3 from "fs";
+import * as path3 from "path";
+
+// src/infra/session-index.ts
 import * as fs2 from "fs";
 import * as path2 from "path";
 
-// src/infra/session-index.ts
+// src/infra/workspace-registry.ts
 import * as fs from "fs";
 import * as path from "path";
+
+// src/infra/state/persistence/atomic-write.ts
+import { openSync, writeSync, fsyncSync, closeSync, renameSync, unlinkSync, mkdirSync, existsSync } from "fs";
+import { dirname, join, basename } from "path";
+function tempPathFor(filePath) {
+  tempCounter += 1;
+  return join(dirname(filePath), `.${basename(filePath)}.${process.pid}.${tempCounter}.tmp`);
+}
+var tempCounter = 0;
+function atomicWriteFileSync(filePath, content) {
+  mkdirSync(dirname(filePath), { recursive: true });
+  const tmp = tempPathFor(filePath);
+  let fd = null;
+  try {
+    fd = openSync(tmp, "w");
+    writeSync(fd, content);
+    fsyncSync(fd);
+    closeSync(fd);
+    fd = null;
+    renameSync(tmp, filePath);
+  } catch (err) {
+    if (fd !== null) {
+      try {
+        closeSync(fd);
+      } catch {
+      }
+    }
+    try {
+      if (existsSync(tmp)) unlinkSync(tmp);
+    } catch {
+    }
+    throw err;
+  }
+}
+
+// src/infra/workspace-registry.ts
+var REGISTRY_VERSION = 1;
+var REGISTRY_FILENAME = "workspaces.json";
+var FALLBACK_SLUG = "workspace";
+var MAX_COLLISION_ATTEMPTS = 1e4;
+function registryFilePath(wayangDir) {
+  return path.join(wayangDir, REGISTRY_FILENAME);
+}
+function normalizeWorkspacePath(rawPath) {
+  try {
+    return fs.realpathSync(rawPath);
+  } catch {
+    return path.resolve(rawPath);
+  }
+}
+function workspaceSlugFromPath(workspacePath) {
+  const basename10 = path.basename(workspacePath);
+  const slug = basename10.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+  return slug.length > 0 ? slug : FALLBACK_SLUG;
+}
+function emptyRegistry() {
+  return { version: REGISTRY_VERSION, workspaces: {} };
+}
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+var WorkspaceRegistryCorruptionError = class extends Error {
+  filePath;
+  backupPath;
+  constructor(message, filePath, backupPath) {
+    super(message);
+    this.name = "WorkspaceRegistryCorruptionError";
+    this.filePath = filePath;
+    this.backupPath = backupPath;
+  }
+};
+function plannedBackupPath(filePath) {
+  const primaryBackup = `${filePath}.corrupt`;
+  return fs.existsSync(primaryBackup) ? `${filePath}.${Date.now()}.corrupt` : primaryBackup;
+}
+function quarantineCorruptFile(filePath, detail) {
+  const backupPath = plannedBackupPath(filePath);
+  try {
+    fs.renameSync(filePath, backupPath);
+  } catch (renameErr) {
+    throw new WorkspaceRegistryCorruptionError(
+      `Workspace registry at ${filePath} is corrupt (${detail}) and could not be moved to ${backupPath}: ${renameErr.message}`,
+      filePath,
+      backupPath
+    );
+  }
+  return new WorkspaceRegistryCorruptionError(
+    `Workspace registry at ${filePath} is corrupt (${detail}); original moved to ${backupPath}`,
+    filePath,
+    backupPath
+  );
+}
+function reportCorruptFile(filePath, detail) {
+  const backupPath = plannedBackupPath(filePath);
+  return new WorkspaceRegistryCorruptionError(
+    `Workspace registry at ${filePath} is corrupt (${detail}); file left untouched (a later write will quarantine it to ${backupPath})`,
+    filePath,
+    backupPath
+  );
+}
+function unsupportedVersionError(filePath, found) {
+  return new WorkspaceRegistryCorruptionError(
+    `Workspace registry at ${filePath} has an unsupported version (${String(found)}); file left untouched`,
+    filePath
+  );
+}
+function corruptionError(mode, filePath, detail) {
+  return mode === "write" ? quarantineCorruptFile(filePath, detail) : reportCorruptFile(filePath, detail);
+}
+function parseRegistry(filePath, raw, mode) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    throw corruptionError(mode, filePath, `invalid JSON: ${err.message}`);
+  }
+  if (!isPlainObject(parsed)) {
+    throw corruptionError(mode, filePath, "top-level value is not an object");
+  }
+  if (parsed.version !== REGISTRY_VERSION) {
+    throw unsupportedVersionError(filePath, parsed.version);
+  }
+  if (!isPlainObject(parsed.workspaces)) {
+    throw corruptionError(mode, filePath, '"workspaces" is not an object');
+  }
+  const workspaces = {};
+  for (const [key, value] of Object.entries(parsed.workspaces)) {
+    if (!isPlainObject(value) || typeof value.slug !== "string" || value.slug.length === 0 || typeof value.path !== "string") {
+      throw corruptionError(mode, filePath, `malformed entry for ${JSON.stringify(key)}`);
+    }
+    workspaces[key] = {
+      slug: value.slug,
+      path: value.path,
+      firstSeenAt: typeof value.firstSeenAt === "string" ? value.firstSeenAt : "",
+      lastSeenAt: typeof value.lastSeenAt === "string" ? value.lastSeenAt : "",
+      reserved: value.reserved === true
+    };
+  }
+  return { version: REGISTRY_VERSION, workspaces };
+}
+function readRegistry(wayangDir, mode) {
+  const filePath = registryFilePath(wayangDir);
+  let raw;
+  try {
+    raw = fs.readFileSync(filePath, "utf-8");
+  } catch (err) {
+    if (err.code === "ENOENT") return emptyRegistry();
+    throw err;
+  }
+  return parseRegistry(filePath, raw, mode);
+}
+function writeRegistry(wayangDir, registry) {
+  atomicWriteFileSync(registryFilePath(wayangDir), `${JSON.stringify(registry, null, 2)}
+`);
+}
+function allocateSlug(registry, base) {
+  const taken = new Set(Object.values(registry.workspaces).map((entry) => entry.slug));
+  if (!taken.has(base)) return base;
+  for (let suffix = 2; suffix <= MAX_COLLISION_ATTEMPTS; suffix += 1) {
+    const candidate = `${base}-${suffix}`;
+    if (!taken.has(candidate)) return candidate;
+  }
+  throw new Error(`Could not allocate a unique slug for "${base}" after ${MAX_COLLISION_ATTEMPTS} attempts`);
+}
+function getOrCreateWorkspace(wayangDir, rawPath) {
+  const resolvedPath = normalizeWorkspacePath(rawPath);
+  const registry = readRegistry(wayangDir, "write");
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const existing = registry.workspaces[resolvedPath];
+  if (existing) {
+    existing.path = resolvedPath;
+    existing.lastSeenAt = now;
+    writeRegistry(wayangDir, registry);
+    return { path: resolvedPath, slug: existing.slug };
+  }
+  const slug = allocateSlug(registry, workspaceSlugFromPath(resolvedPath));
+  registry.workspaces[resolvedPath] = {
+    slug,
+    path: resolvedPath,
+    firstSeenAt: now,
+    lastSeenAt: now,
+    reserved: false
+  };
+  writeRegistry(wayangDir, registry);
+  return { path: resolvedPath, slug };
+}
+function resolveWorkspaceRef(wayangDir, rawPath) {
+  const resolvedPath = normalizeWorkspacePath(rawPath);
+  const fallbackSlug = workspaceSlugFromPath(resolvedPath);
+  if (!wayangDir) {
+    return { path: resolvedPath, slug: fallbackSlug, degraded: true };
+  }
+  try {
+    const registered = findWorkspace(wayangDir, resolvedPath);
+    if (registered) return { path: registered.path, slug: registered.slug };
+    return getOrCreateWorkspace(wayangDir, resolvedPath);
+  } catch (err) {
+    const corruption = err instanceof WorkspaceRegistryCorruptionError ? err : void 0;
+    const backupNote = corruption?.backupPath ? ` (backup path: ${corruption.backupPath})` : "";
+    console.error(
+      `[workspace-registry] resolveWorkspaceRef could not read the registry for ${resolvedPath}: ${err.message}${backupNote}; degrading to rule-based slug "${fallbackSlug}"`
+    );
+    return { path: resolvedPath, slug: fallbackSlug, degraded: true };
+  }
+}
+function findWorkspace(wayangDir, rawPath) {
+  const registry = readRegistry(wayangDir, "read");
+  const entry = registry.workspaces[normalizeWorkspacePath(rawPath)];
+  return entry ? { ...entry } : void 0;
+}
+
+// src/infra/session-index.ts
 function sortNewestFirst(entries) {
   return entries.sort((a, b) => b.meta.createdAt - a.meta.createdAt);
 }
+function sessionWorkspacePaths(meta) {
+  if (meta.workspaces && meta.workspaces.length > 0) {
+    return meta.workspaces.map((w) => w.path).filter((p) => typeof p === "string" && p.length > 0);
+  }
+  return meta.workspace ? [meta.workspace] : [];
+}
+function matchesWorkspace(meta, normalizedTarget) {
+  return sessionWorkspacePaths(meta).some((p) => normalizeWorkspacePath(p) === normalizedTarget);
+}
 function readEntriesFromDisk(homeDir2) {
-  const sessionsDir = path.join(homeDir2, "sessions");
+  const sessionsDir = path2.join(homeDir2, "sessions");
   let names;
   try {
-    names = fs.readdirSync(sessionsDir);
+    names = fs2.readdirSync(sessionsDir);
   } catch {
     return [];
   }
-  const entries = [];
-  for (const name of names) {
-    const sessionDir = path.join(sessionsDir, name);
-    const metaPath = path.join(sessionDir, "meta.json");
-    try {
-      const raw = fs.readFileSync(metaPath, "utf-8");
-      const meta = JSON.parse(raw);
-      if (!meta || typeof meta.sessionId !== "string") continue;
-      entries.push({ sessionId: meta.sessionId, sessionDir, meta });
-    } catch {
-    }
+  const entries = [];
+  for (const name of names) {
+    const sessionDir = path2.join(sessionsDir, name);
+    const metaPath = path2.join(sessionDir, "meta.json");
+    try {
+      const raw = fs2.readFileSync(metaPath, "utf-8");
+      const meta = JSON.parse(raw);
+      if (!meta || typeof meta.sessionId !== "string") continue;
+      entries.push({ sessionId: meta.sessionId, sessionDir, meta });
+    } catch {
+    }
+  }
+  return sortNewestFirst(entries);
+}
+function buildCache(homeDir2) {
+  const entries = readEntriesFromDisk(homeDir2);
+  return {
+    entries,
+    byId: new Map(entries.map((e) => [e.sessionId, e]))
+  };
+}
+var InMemorySessionIndex = class {
+  constructor(homeDir2) {
+    this.homeDir = homeDir2;
+  }
+  homeDir;
+  cache = null;
+  ensureCache() {
+    if (!this.cache) {
+      this.cache = buildCache(this.homeDir);
+    }
+    return this.cache;
+  }
+  list(query2 = {}) {
+    const { entries } = this.ensureCache();
+    const includeArchived = query2.includeArchived ?? false;
+    let result2 = entries;
+    if (query2.workspace !== void 0) {
+      const target = normalizeWorkspacePath(query2.workspace);
+      result2 = result2.filter((e) => matchesWorkspace(e.meta, target));
+    }
+    if (!includeArchived) {
+      result2 = result2.filter((e) => !e.meta.archived);
+    }
+    if (query2.cursor) {
+      const idx = result2.findIndex((e) => e.sessionId === query2.cursor);
+      if (idx >= 0) {
+        result2 = result2.slice(idx + 1);
+      }
+    }
+    if (query2.limit !== void 0 && query2.limit >= 0) {
+      result2 = result2.slice(0, query2.limit);
+    }
+    return result2;
+  }
+  get(sessionId) {
+    return this.ensureCache().byId.get(sessionId) ?? null;
+  }
+  latestForWorkspace(workspace, opts = {}) {
+    const matches = this.list({ workspace, includeArchived: opts.includeArchived });
+    return matches[0] ?? null;
+  }
+  upsert(entry) {
+    const cache = this.ensureCache();
+    const existingIndex = cache.entries.findIndex((e) => e.sessionId === entry.sessionId);
+    if (existingIndex >= 0) {
+      cache.entries[existingIndex] = entry;
+    } else {
+      cache.entries.push(entry);
+    }
+    sortNewestFirst(cache.entries);
+    cache.byId.set(entry.sessionId, entry);
+  }
+  invalidate() {
+    this.cache = null;
+  }
+};
+function createSessionIndex(homeDir2) {
+  return new InMemorySessionIndex(homeDir2);
+}
+
+// src/infra/session-helpers.ts
+function sessionDisplayTitle(meta) {
+  if (meta.title && meta.title.trim().length > 0) return meta.title;
+  return meta.firstInput;
+}
+var SESSIONS_DIRNAME = "sessions";
+function wayangDirForSessionDir(sessionDir) {
+  const sessionsDir = path3.dirname(path3.resolve(sessionDir));
+  return path3.basename(sessionsDir) === SESSIONS_DIRNAME ? path3.dirname(sessionsDir) : null;
+}
+function listSessions(homeDir2, query2 = {}) {
+  return createSessionIndex(homeDir2).list(query2).map((e) => e.meta);
+}
+function getSession(homeDir2, sessionId) {
+  return createSessionIndex(homeDir2).get(sessionId);
+}
+function getLatestSessionForWorkspace(homeDir2, workspaceDir2) {
+  return createSessionIndex(homeDir2).latestForWorkspace(workspaceDir2);
+}
+function readSessionUnfinishedTasks(sessionDir) {
+  const tasksPath = path3.join(sessionDir, "tasks.json");
+  if (!fs3.existsSync(tasksPath)) return null;
+  try {
+    const data = JSON.parse(fs3.readFileSync(tasksPath, "utf-8"));
+    const pending = data.tasks?.pending ?? [];
+    const running = data.tasks?.running ?? [];
+    const pick = (status) => (t) => ({
+      id: t.id,
+      title: t.title,
+      description: t.description,
+      status
+    });
+    const tagged = [
+      ...running.filter(Boolean).map(pick("running")),
+      ...pending.filter(Boolean).map(pick("pending"))
+    ];
+    return tagged.filter((t) => typeof t.id === "string" && typeof t.title === "string");
+  } catch {
+    return null;
+  }
+}
+
+// src/infra/session-lock.ts
+import * as fs4 from "fs";
+import * as os from "os";
+import * as path4 from "path";
+import { randomUUID } from "crypto";
+var SESSION_OWNER_FILE = ".owner.json";
+var DEFAULT_STALE_MS = 6e4;
+var DEFAULT_HEARTBEAT_MS = 2e4;
+var SESSION_LOCKED_MARKER = "[SESSION_LOCKED]";
+var SessionLockedError = class extends Error {
+  holder;
+  sessionDir;
+  constructor(holder, sessionDir) {
+    super(
+      `${SESSION_LOCKED_MARKER} Session "${sessionDir}" is already in use by another wayang process (pid ${holder.pid} on ${holder.hostname}, holding since ${new Date(holder.startedAt).toISOString()})`
+    );
+    this.name = "SessionLockedError";
+    this.holder = holder;
+    this.sessionDir = sessionDir;
+  }
+};
+function formatSessionLockHint(err) {
+  return [
+    err.message,
+    "That process may still be working in this session; wait for it to finish and retry.",
+    "To use a different session instead: wayang --resume",
+    "To start a new session instead: wayang --new"
+  ].join("\n");
+}
+var SessionLock = class {
+  sessionDir;
+  ownerFile;
+  staleMs;
+  heartbeatMs;
+  hostname;
+  pid;
+  now;
+  /** Currently held identity, or null when not holding. */
+  owner = null;
+  timer = null;
+  constructor(sessionDir, options = {}) {
+    this.sessionDir = sessionDir;
+    this.ownerFile = path4.join(sessionDir, SESSION_OWNER_FILE);
+    this.staleMs = options.staleMs ?? DEFAULT_STALE_MS;
+    this.heartbeatMs = options.heartbeatMs ?? DEFAULT_HEARTBEAT_MS;
+    this.hostname = options.hostname ?? os.hostname();
+    this.pid = options.pid ?? process.pid;
+    this.now = options.now ?? Date.now;
+  }
+  /** Whether this instance currently holds the lock. */
+  get held() {
+    return this.owner !== null;
+  }
+  /** Copy of the held identity (null when not holding). */
+  get ownerInfo() {
+    return this.owner ? { ...this.owner } : null;
+  }
+  /**
+   * Take ownership of the session directory.
+   *
+   * @throws SessionLockedError when a live process already owns it.
+   * @throws Error when the file system refuses the write for another reason.
+   */
+  acquire() {
+    if (this.owner) {
+      throw new Error(`SessionLock for ${this.sessionDir} is already held by this instance`);
+    }
+    const existing = this.readOwner();
+    let staleTakeover = false;
+    if (existing.kind === "owner") {
+      if (!this.isStale(existing.owner)) {
+        throw new SessionLockedError(existing.owner, this.sessionDir);
+      }
+      staleTakeover = true;
+    } else if (existing.kind === "unreadable") {
+      staleTakeover = true;
+    }
+    const owner = this.claim();
+    this.owner = owner;
+    this.startHeartbeat();
+    return { owner: { ...owner }, staleTakeover };
+  }
+  /**
+   * Refresh `heartbeatAt` on disk. Called by the heartbeat timer; exposed so
+   * callers and tests can tick it explicitly.
+   *
+   * If the file on disk no longer carries our token, our lease was taken over
+   * (e.g. this process was suspended past `staleMs`): stop writing and drop
+   * ownership instead of clobbering the new owner's heartbeat.
+   */
+  heartbeat() {
+    const owner = this.owner;
+    if (!owner) return;
+    const current = this.readOwner();
+    if (current.kind !== "owner" || current.owner.token !== owner.token) {
+      this.owner = null;
+      this.stopHeartbeat();
+      return;
+    }
+    const next = { ...owner, heartbeatAt: this.now() };
+    this.writeOwner(next);
+    this.owner = next;
+  }
+  /**
+   * Drop the lock. Idempotent: safe to call repeatedly, and safe to call
+   * without ever having acquired (a no-op).
+   *
+   * The file is deleted only when the token on disk is still ours, so a release
+   * delayed past a takeover cannot delete the new owner's lock.
+   */
+  release() {
+    this.stopHeartbeat();
+    const owner = this.owner;
+    if (!owner) return;
+    this.owner = null;
+    const current = this.readOwner();
+    if (current.kind !== "owner" || current.owner.token !== owner.token) return;
+    try {
+      fs4.unlinkSync(this.ownerFile);
+    } catch (err) {
+      if (err.code === "ENOENT") return;
+      throw err;
+    }
+  }
+  // --- Internals ---
+  /**
+   * Write our owner document atomically and confirm it survived any concurrent
+   * claimant. Two processes can both pass the "does not exist" check, so after
+   * the rename each reads the file back: whoever reads a foreign token lost.
+   */
+  claim() {
+    const at = this.now();
+    const owner = {
+      pid: this.pid,
+      hostname: this.hostname,
+      startedAt: at,
+      heartbeatAt: at,
+      token: randomUUID()
+    };
+    this.writeOwner(owner);
+    const readback = this.readOwner();
+    if (readback.kind !== "owner" || readback.owner.token !== owner.token) {
+      if (readback.kind === "owner") {
+        throw new SessionLockedError(readback.owner, this.sessionDir);
+      }
+      throw new Error(`Failed to claim session lock at ${this.ownerFile}`);
+    }
+    return owner;
+  }
+  /** Temp-file + rename, so readers never observe a partially written document. */
+  writeOwner(owner) {
+    fs4.mkdirSync(this.sessionDir, { recursive: true });
+    const tmp = path4.join(this.sessionDir, `${SESSION_OWNER_FILE}.${owner.pid}.${randomUUID()}.tmp`);
+    fs4.writeFileSync(tmp, `${JSON.stringify(owner, null, 2)}
+`, "utf-8");
+    try {
+      fs4.renameSync(tmp, this.ownerFile);
+    } catch (err) {
+      try {
+        fs4.unlinkSync(tmp);
+      } catch {
+      }
+      throw err;
+    }
+  }
+  readOwner() {
+    let raw;
+    try {
+      raw = fs4.readFileSync(this.ownerFile, "utf-8");
+    } catch (err) {
+      if (err.code === "ENOENT") return { kind: "missing" };
+      throw err;
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      return { kind: "unreadable" };
+    }
+    if (!isSessionOwner(parsed)) return { kind: "unreadable" };
+    return { kind: "owner", owner: parsed };
+  }
+  /** See the zombie rules in the module docstring. */
+  isStale(owner) {
+    const heartbeatFresh = this.now() - owner.heartbeatAt < this.staleMs;
+    if (owner.hostname !== this.hostname) {
+      return !heartbeatFresh;
+    }
+    return !heartbeatFresh || !isProcessAlive(owner.pid);
+  }
+  startHeartbeat() {
+    this.stopHeartbeat();
+    const timer = setInterval(() => this.heartbeat(), this.heartbeatMs);
+    timer.unref?.();
+    this.timer = timer;
+  }
+  stopHeartbeat() {
+    if (!this.timer) return;
+    clearInterval(this.timer);
+    this.timer = null;
+  }
+};
+function isSessionOwner(value) {
+  if (!value || typeof value !== "object") return false;
+  const v = value;
+  return typeof v.pid === "number" && Number.isInteger(v.pid) && v.pid > 0 && typeof v.hostname === "string" && v.hostname.length > 0 && typeof v.startedAt === "number" && Number.isFinite(v.startedAt) && typeof v.heartbeatAt === "number" && Number.isFinite(v.heartbeatAt) && typeof v.token === "string" && v.token.length > 0;
+}
+function isProcessAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    return err.code === "EPERM";
+  }
+}
+
+// src/services/session/session-manager.ts
+import * as path5 from "path";
+
+// src/utils/id.ts
+function generateId(prefix) {
+  return `${prefix}-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
+}
+function formatTimestamp(date = /* @__PURE__ */ new Date()) {
+  const Y = date.getFullYear();
+  const M = String(date.getMonth() + 1).padStart(2, "0");
+  const D = String(date.getDate()).padStart(2, "0");
+  const h = String(date.getHours()).padStart(2, "0");
+  const m = String(date.getMinutes()).padStart(2, "0");
+  const s = String(date.getSeconds()).padStart(2, "0");
+  return `${Y}${M}${D}-${h}${m}${s}`;
+}
+
+// src/services/session/session-state.ts
+import { join as join7 } from "path";
+
+// src/infra/state/base-state.ts
+import { get, set, cloneDeep } from "lodash-es";
+
+// src/types/config.ts
+function validateConfig(config) {
+  for (const [name, provider] of Object.entries(config.providers)) {
+    if (!provider.endpoint) return `providers.${name}.endpoint is required`;
+    if (!provider.apiKey) return `providers.${name}.apiKey is required (set WAYANG_LLM_API_KEY or configure in config file)`;
+    if (!provider.modelName) return `providers.${name}.modelName is required`;
+    const window = provider.contextWindowTokens;
+    if (window !== void 0 && !(Number.isInteger(window) && window > 0)) {
+      return `providers.${name}.contextWindowTokens must be a positive integer (got ${JSON.stringify(window)})`;
+    }
+  }
+  const cp = config.controller.provider;
+  if (!config.providers[cp]) return `controller.provider "${cp}" not found`;
+  const wp = config.worker.provider;
+  if (!config.providers[wp]) return `worker.provider "${wp}" not found`;
+  const permission = config.permission;
+  if (permission !== void 0 && permission !== null) {
+    const keys = ["allowedDirs", "autoAllowRoots", "deniedDirs"];
+    for (const key of keys) {
+      const value = permission[key];
+      if (value === void 0) continue;
+      if (!Array.isArray(value) || value.some((entry) => typeof entry !== "string")) {
+        return `permission.${key} must be an array of strings (got ${JSON.stringify(value)})`;
+      }
+    }
+  }
+  return null;
+}
+
+// src/types/conversation.ts
+function isCompactMarker(entry) {
+  return entry.type === "system" /* System */ && entry.subtype === "compact" /* Compact */ && entry.compactMeta !== void 0;
+}
+
+// src/types/signal.ts
+function getSignalField(sig, field) {
+  return sig.payload[field];
+}
+
+// src/types/inquiry.ts
+var INQUIRE_OTHER_OPTION = "\u5176\u4ED6\uFF08\u81EA\u884C\u8F93\u5165\uFF09";
+var INQUIRE_CUSTOM_ANSWER_PREFIX = "[Other] ";
+function buildSelectChoices(options, allowOther) {
+  return allowOther === false ? options : [...options, INQUIRE_OTHER_OPTION];
+}
+function isOtherChoice(choice) {
+  return choice === INQUIRE_OTHER_OPTION;
+}
+function formatCustomAnswer(text) {
+  return `${INQUIRE_CUSTOM_ANSWER_PREFIX}${text}`;
+}
+
+// src/infra/state/conversation-envelope.ts
+var ENVELOPE_VERSION = 1;
+function applyAppendEnvelope(entry, conversation) {
+  if (entry === null || typeof entry !== "object") return entry;
+  if (entry.v === void 0) entry.v = ENVELOPE_VERSION;
+  if (entry.parentId === void 0) {
+    const last = conversation.length > 0 ? conversation[conversation.length - 1] : void 0;
+    const lastIsMarker = last !== null && typeof last === "object" && isCompactMarker(last);
+    entry.parentId = !last || lastIsMarker || isCompactMarker(entry) || typeof last.uuid !== "string" ? null : last.uuid;
+  }
+  return entry;
+}
+
+// src/infra/state/base-state.ts
+var BaseWayangState = class {
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- state-tree root is intentionally untyped at this layer; typed reads happen via get<T>() at call sites (changing the default cascades across every bare get() in the repo)
+  data;
+  persistMappings;
+  subscriptions = /* @__PURE__ */ new Map();
+  constructor(initialData, persistMappings = []) {
+    this.data = initialData;
+    this.persistMappings = persistMappings;
+  }
+  // --- Read ---
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- public default generic: bare get() callers across the repo rely on it; per-call sites pass an explicit T
+  get(path9) {
+    return get(this.data, path9);
+  }
+  // --- Write operations ---
+  set(path9, value) {
+    const prev = get(this.data, path9);
+    set(this.data, path9, value);
+    this.persist(path9, "set");
+    this.notify(path9, "set", prev);
+  }
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- partial update merges an untyped object into the state tree root (see `data`)
+  update(path9, partial) {
+    const prev = cloneDeep(get(this.data, path9));
+    const target = get(this.data, path9);
+    if (target && typeof target === "object") {
+      Object.assign(target, partial);
+    } else {
+      set(this.data, path9, partial);
+    }
+    this.persist(path9, "update");
+    this.notify(path9, "update", prev);
+  }
+  append(path9, entry) {
+    const arr = get(this.data, path9);
+    if (!Array.isArray(arr)) {
+      throw new Error(`State.append: path "${path9}" is not an array`);
+    }
+    const stamped = path9 === "conversation" ? applyAppendEnvelope(entry, arr) : entry;
+    arr.push(stamped);
+    set(this.data, path9, [...arr]);
+    this.persist(path9, "append", stamped);
+    this.notify(path9, "append", void 0);
+  }
+  remove(path9, idx) {
+    const arr = get(this.data, path9);
+    if (!Array.isArray(arr)) {
+      throw new Error(`State.remove: path "${path9}" is not an array`);
+    }
+    const prev = idx !== void 0 ? arr[idx] : arr[arr.length - 1];
+    if (idx === void 0) {
+      arr.pop();
+    } else {
+      arr.splice(idx, 1);
+    }
+    this.persist(path9, "remove");
+    this.notify(path9, "remove", prev);
+  }
+  // --- Subscription ---
+  on(path9, callback) {
+    if (!this.subscriptions.has(path9)) {
+      this.subscriptions.set(path9, /* @__PURE__ */ new Set());
+    }
+    this.subscriptions.get(path9).add(callback);
+    return () => this.subscriptions.get(path9)?.delete(callback);
+  }
+  // --- Persistence ---
+  /**
+   * Hand the change to whichever helper owns this field, with enough context
+   * for the helper to pick its own strategy. Snapshot helpers replace the
+   * file; append helpers write only the new entry and ignore window edits.
+   */
+  persist(path9, op, entry) {
+    const topKey = path9.split(".")[0];
+    for (const mapping of this.persistMappings) {
+      if (mapping.path !== topKey) continue;
+      mapping.helper.write({
+        path: topKey,
+        op,
+        value: this.data[topKey],
+        entry
+      });
+    }
+  }
+  // --- Notification ---
+  notify(changePath, type, prev) {
+    const event = { type, path: changePath, data: get(this.data, changePath), prev };
+    for (const [subPath, callbacks] of this.subscriptions) {
+      if (changePath === subPath) {
+        for (const cb of callbacks) cb(event);
+        continue;
+      }
+      if (changePath.startsWith(subPath + ".")) {
+        for (const cb of callbacks) {
+          cb({ ...event, data: get(this.data, subPath) });
+        }
+        continue;
+      }
+      if (subPath.startsWith(changePath + ".")) {
+        const newVal = get(this.data, subPath);
+        for (const cb of callbacks) {
+          cb({ ...event, data: newVal });
+        }
+      }
+    }
+  }
+};
+
+// src/infra/state/persistence/json-file.ts
+import {
+  readFileSync as readFileSync5,
+  existsSync as existsSync4,
+  mkdirSync as mkdirSync3,
+  renameSync as renameSync4,
+  openSync as openSync2,
+  writeSync as writeSync2,
+  fsyncSync as fsyncSync2,
+  closeSync as closeSync2,
+  unlinkSync as unlinkSync3,
+  copyFileSync
+} from "fs";
+import { dirname as dirname3, basename as basename4, join as join6 } from "path";
+var tempSeq = 0;
+var JSONFileHelper = class {
+  constructor(filePath) {
+    this.filePath = filePath;
+  }
+  filePath;
+  mode = "save";
+  /** Absolute path of the backing file. */
+  get path() {
+    return this.filePath;
+  }
+  /** Whether the backing file exists, regardless of parseability. */
+  exists() {
+    return existsSync4(this.filePath);
+  }
+  write(change) {
+    this.writeValue(change.value);
+  }
+  /** Write an arbitrary value atomically. Used by migration paths. */
+  writeValue(value) {
+    mkdirSync3(dirname3(this.filePath), { recursive: true });
+    const tmp = this.tempPath();
+    let fd = null;
+    try {
+      fd = openSync2(tmp, "w");
+      writeSync2(fd, JSON.stringify(value, null, 2));
+      fsyncSync2(fd);
+      closeSync2(fd);
+      fd = null;
+      renameSync4(tmp, this.filePath);
+    } catch (err) {
+      if (fd !== null) {
+        try {
+          closeSync2(fd);
+        } catch {
+        }
+      }
+      try {
+        if (existsSync4(tmp)) unlinkSync3(tmp);
+      } catch {
+      }
+      throw err;
+    }
+  }
+  readonly() {
+    if (!existsSync4(this.filePath)) return null;
+    let raw;
+    try {
+      raw = readFileSync5(this.filePath, "utf-8");
+    } catch (err) {
+      throw new Error(
+        `Failed to read snapshot "${this.filePath}": ${err.message}`
+      );
+    }
+    if (raw.trim().length === 0) return null;
+    try {
+      return JSON.parse(raw);
+    } catch (err) {
+      const quarantine = this.quarantineCorrupt();
+      throw new Error(
+        `Corrupt snapshot "${this.filePath}" (${err.message}). The damaged file was moved to "${quarantine}". Refusing to treat it as empty state.`
+      );
+    }
+  }
+  read() {
+    return this.readonly();
+  }
+  /**
+   * Read without throwing on corruption — returns null instead.
+   * Only for callers that can tolerate absence (e.g. optional side files).
+   * State-critical reads must use readonly()/read().
+   */
+  raw() {
+    if (!existsSync4(this.filePath)) return null;
+    const text = readFileSync5(this.filePath, "utf-8");
+    if (text.trim().length === 0) return null;
+    try {
+      return JSON.parse(text);
+    } catch {
+      return null;
+    }
+  }
+  clear() {
+    mkdirSync3(dirname3(this.filePath), { recursive: true });
+    this.writeValue(null);
+  }
+  tempPath() {
+    tempSeq += 1;
+    return join6(dirname3(this.filePath), `.${basename4(this.filePath)}.${process.pid}.${tempSeq}.tmp`);
+  }
+  quarantineCorrupt() {
+    const target = `${this.filePath}.corrupt.${Date.now()}`;
+    try {
+      copyFileSync(this.filePath, target);
+    } catch {
+    }
+    return target;
+  }
+};
+
+// src/services/session/session-state.ts
+var SessionState = class extends BaseWayangState {
+  jsonFile;
+  constructor(sessionDir) {
+    const jsonFile = new JSONFileHelper(join7(sessionDir, "meta.json"));
+    super(
+      {
+        meta: {
+          sessionId: "",
+          workspace: "",
+          firstInput: null,
+          createdAt: 0,
+          lastActiveAt: 0,
+          title: void 0,
+          archived: false,
+          archivedAt: void 0
+        }
+      },
+      [{ path: "meta", helper: jsonFile }]
+    );
+    this.jsonFile = jsonFile;
+  }
+  async restore() {
+    const data = this.jsonFile.read();
+    if (data) {
+      this.data.meta = data;
+    }
+  }
+  /**
+   * Attach a synthesized `workspaces` entry to the in-memory meta only — no
+   * write happens here, so reading a legacy session never rewrites its file.
+   * The value reaches disk with the next normal meta write (input, rename,
+   * archive), because snapshot persistence serializes the whole meta object.
+   */
+  fillWorkspacesInMemory(workspace) {
+    const meta = this.data.meta;
+    if (!meta) return;
+    meta.workspaces = [workspace];
+  }
+};
+
+// src/services/session/session-manager.ts
+var SessionManager = class _SessionManager {
+  sessionId;
+  sessionDir;
+  isResume;
+  /** Wayang home dir (parent of `sessions/`), or null for ad-hoc session dirs. */
+  wayangDir;
+  state;
+  constructor(sessionId, sessionDir, isResume, wayangDir) {
+    this.sessionId = sessionId;
+    this.sessionDir = sessionDir;
+    this.isResume = isResume;
+    this.wayangDir = wayangDir;
+    this.state = new SessionState(sessionDir);
+  }
+  /** Create a new session: generates ID, initializes meta via WayangState (auto mkdir + write). */
+  static create(homeDir2, workspaceDir2) {
+    const sessionId = `${formatTimestamp()}-${Math.random().toString(36).slice(2, 6)}`;
+    const sessionDir = path5.join(homeDir2, "sessions", sessionId);
+    const mgr = new _SessionManager(sessionId, sessionDir, false, homeDir2);
+    mgr.state.set("meta", {
+      sessionId,
+      workspace: workspaceDir2,
+      workspaces: [resolveWorkspaceRef(homeDir2, workspaceDir2)],
+      firstInput: null,
+      createdAt: Date.now(),
+      lastActiveAt: Date.now()
+    });
+    return mgr;
+  }
+  /**
+   * Resume an existing session. State is restored in restore().
+   *
+   * @param wayangDir  Wayang home dir, used to resolve workspace slugs. Omitted
+   *   callers fall back to the layout-derived parent of `sessions/`.
+   */
+  static resume(sessionId, sessionDir, wayangDir) {
+    return new _SessionManager(sessionId, sessionDir, true, wayangDir ?? wayangDirForSessionDir(sessionDir));
   }
-  return sortNewestFirst(entries);
-}
-function buildCache(homeDir2) {
-  const entries = readEntriesFromDisk(homeDir2);
-  return {
-    entries,
-    byId: new Map(entries.map((e) => [e.sessionId, e]))
-  };
-}
-var InMemorySessionIndex = class {
-  constructor(homeDir2) {
-    this.homeDir = homeDir2;
+  /** Restore state from disk (resume only, no-op for new sessions). */
+  async restore() {
+    if (!this.isResume) return;
+    await this.state.restore();
+    this.backfillWorkspaces();
   }
-  homeDir;
-  cache = null;
-  ensureCache() {
-    if (!this.cache) {
-      this.cache = buildCache(this.homeDir);
-    }
-    return this.cache;
+  /** Workspace directory of this session. */
+  get workspace() {
+    return this.state.get("meta.workspace");
   }
-  list(query2 = {}) {
-    const { entries } = this.ensureCache();
-    const includeArchived = query2.includeArchived ?? false;
-    let result2 = entries;
-    if (query2.workspace !== void 0) {
-      result2 = result2.filter((e) => e.meta.workspace === query2.workspace);
-    }
-    if (!includeArchived) {
-      result2 = result2.filter((e) => !e.meta.archived);
-    }
-    if (query2.cursor) {
-      const idx = result2.findIndex((e) => e.sessionId === query2.cursor);
-      if (idx >= 0) {
-        result2 = result2.slice(idx + 1);
-      }
+  /**
+   * Workspace identities of this session, always including the one matching
+   * `workspace`. Legacy meta (written before `workspaces` existed) is
+   * synthesized on read — see `backfillWorkspaces`.
+   */
+  get workspaces() {
+    this.backfillWorkspaces();
+    return this.state.get("meta.workspaces") ?? [];
+  }
+  /**
+   * Workspace this session was *started* in — the backfill target for records
+   * that predate workspace attribution (e.g. legacy tasks.json entries).
+   *
+   * Deliberately not `workspaces[0]`: once a session accumulates more than one
+   * workspace, the first array element is merely "the oldest one we happen to
+   * have", not necessarily the startup workspace, and stamping old tasks with
+   * it would point them at the wrong directory. `meta.workspace` stays
+   * authoritative for "where this session was started" (see SessionMeta), so we
+   * look up the entry that matches it after canonicalization — the array's
+   * `path` is canonical, while `meta.workspace` keeps the original spelling
+   * (symlinks, trailing slash).
+   *
+   * Falls back to the first entry when nothing matches (the startup directory
+   * was renamed or removed since), and returns undefined when the session has
+   * no workspace identity at all — callers then simply skip the backfill.
+   */
+  get startupWorkspace() {
+    const workspaces = this.workspaces;
+    if (workspaces.length === 0) return void 0;
+    const current = this.state.get("meta.workspace");
+    if (current) {
+      const normalized = normalizeWorkspacePath(current);
+      const match = workspaces.find((ws) => normalizeWorkspacePath(ws.path) === normalized);
+      if (match) return match;
     }
-    if (query2.limit !== void 0 && query2.limit >= 0) {
-      result2 = result2.slice(0, query2.limit);
+    return workspaces[0];
+  }
+  /**
+   * Record a workspace this session has touched at runtime.
+   *
+   * Called when a task is accepted for a workspace other than the one the
+   * session was started in, so the session stays discoverable through every
+   * directory it dispatched work into — `getLatestSessionForWorkspace`, the
+   * interactive session picker and the TUI's "first + N" banner all read
+   * `meta.workspaces`. Without this, dispatching into a second workspace left
+   * the array frozen at creation time and those readers blind to it.
+   *
+   * Idempotent by canonical path: re-declaring an already-recorded directory
+   * is a no-op (no write, slug untouched). The `slug` always comes from the
+   * caller's registry-resolved ref, so one directory keeps one handle for the
+   * lifetime of the session. `meta.workspace` (the startup directory) is never
+   * rewritten here.
+   *
+   * Persists through the normal meta write path — a whole-meta snapshot — so
+   * the array lands together with every other meta field, exactly like an
+   * ordinary input/rename/archive write. Returns true when a new entry was
+   * appended (and the write happened).
+   */
+  addWorkspace(workspace) {
+    const canonical = normalizeWorkspacePath(workspace.path);
+    const existing = this.workspaces;
+    if (existing.some((w) => normalizeWorkspacePath(w.path) === canonical)) {
+      return false;
     }
-    return result2;
+    this.state.set("meta.workspaces", [...existing, { path: canonical, slug: workspace.slug }]);
+    return true;
   }
-  get(sessionId) {
-    return this.ensureCache().byId.get(sessionId) ?? null;
+  /**
+   * Synthesize `meta.workspaces` from the single-valued `meta.workspace` when a
+   * session predates the array. Memory only: nothing is written, so neither
+   * resume nor `workspaces` ever rewrites a historical meta.json.
+   *
+   * Idempotent — a filled array short-circuits, and `resolveWorkspaceRef`
+   * returns the same slug for the same canonical path, so repeated reads of one
+   * legacy session yield an identical result.
+   */
+  backfillWorkspaces() {
+    const existing = this.state.get("meta.workspaces");
+    if (existing && existing.length > 0) return;
+    const workspace = this.state.get("meta.workspace");
+    if (!workspace) return;
+    this.state.fillWorkspacesInMemory(resolveWorkspaceRef(this.wayangDir, workspace));
   }
-  latestForWorkspace(workspace, opts = {}) {
-    const matches = this.list({ workspace, includeArchived: opts.includeArchived });
-    return matches[0] ?? null;
+  /** Whether firstInput has already been recorded. */
+  get hasFirstInput() {
+    return !!this.state.get("meta.firstInput");
   }
-  upsert(entry) {
-    const cache = this.ensureCache();
-    const existingIndex = cache.entries.findIndex((e) => e.sessionId === entry.sessionId);
-    if (existingIndex >= 0) {
-      cache.entries[existingIndex] = entry;
-    } else {
-      cache.entries.push(entry);
+  /**
+   * Notify that a user input occurred.
+   * Records firstInput (idempotent) and updates lastActiveAt.
+   */
+  onUserInput(text) {
+    if (!this.hasFirstInput) {
+      this.state.set("meta.firstInput", text);
     }
-    sortNewestFirst(cache.entries);
-    cache.byId.set(entry.sessionId, entry);
+    this.state.set("meta.lastActiveAt", Date.now());
   }
-  invalidate() {
-    this.cache = null;
+  /** Current display label: explicit title, else first input. */
+  get displayTitle() {
+    return sessionDisplayTitle(this.state.get("meta"));
   }
-};
-function createSessionIndex(homeDir2) {
-  return new InMemorySessionIndex(homeDir2);
-}
-
-// src/infra/session-helpers.ts
-function sessionDisplayTitle(meta) {
-  if (meta.title && meta.title.trim().length > 0) return meta.title;
-  return meta.firstInput;
-}
-function listSessions(homeDir2, query2 = {}) {
-  return createSessionIndex(homeDir2).list(query2).map((e) => e.meta);
-}
-function getSession(homeDir2, sessionId) {
-  return createSessionIndex(homeDir2).get(sessionId);
-}
-function getLatestSessionForWorkspace(homeDir2, workspaceDir2) {
-  return createSessionIndex(homeDir2).latestForWorkspace(workspaceDir2);
-}
-function readSessionUnfinishedTasks(sessionDir) {
-  const tasksPath = path2.join(sessionDir, "tasks.json");
-  if (!fs2.existsSync(tasksPath)) return null;
-  try {
-    const data = JSON.parse(fs2.readFileSync(tasksPath, "utf-8"));
-    const pending = data.tasks?.pending ?? [];
-    const running = data.tasks?.running ?? [];
-    const pick = (status) => (t) => ({
-      id: t.id,
-      title: t.title,
-      description: t.description,
-      status
-    });
-    const tagged = [
-      ...running.filter(Boolean).map(pick("running")),
-      ...pending.filter(Boolean).map(pick("pending"))
-    ];
-    return tagged.filter((t) => typeof t.id === "string" && typeof t.title === "string");
-  } catch {
-    return null;
+  /** Whether this session is archived (hidden from the default list). */
+  get archived() {
+    return this.state.get("meta.archived") ?? false;
   }
-}
+  /**
+   * Rename the session. Passing null/empty clears the explicit title, so the
+   * session falls back to showing its first input.
+   */
+  rename(title) {
+    const trimmed = title?.trim();
+    this.state.set("meta.title", trimmed && trimmed.length > 0 ? trimmed : void 0);
+  }
+  /**
+   * Toggle the archived flag. Archiving hides the session from the default
+   * list without deleting its transcript; unarchiving restores visibility.
+   */
+  setArchived(archived) {
+    this.state.set("meta.archived", archived);
+    this.state.set("meta.archivedAt", archived ? Date.now() : void 0);
+  }
+};
 
 // src/tui/render.ts
 import React6 from "react";
@@ -1019,6 +2037,18 @@ function truncateToWidth(s, maxWidth) {
   }
   return out + "\u2026";
 }
+function sliceToWidth(s, maxWidth) {
+  if (maxWidth <= 0) return "";
+  let w = 0;
+  let out = "";
+  for (const ch of s) {
+    const cw = charWidth(ch.codePointAt(0) ?? 0);
+    if (w + cw > maxWidth) break;
+    out += ch;
+    w += cw;
+  }
+  return out;
+}
 function collapseWhitespace(s) {
   return s.replace(/\s+/g, " ").trim();
 }
@@ -1113,27 +2143,27 @@ function toolTarget(toolName, args, budget) {
       return fitWithSuffix(lines[0].trim(), note, budget);
     }
     case "write_file": {
-      const path7 = argString(args, ["path", "file_path"]);
-      if (!path7) return "";
+      const path9 = argString(args, ["path", "file_path"]);
+      if (!path9) return "";
       const lines = lineCount(args.content);
       const note = lines > 0 ? ` (+${lines})` : "";
-      return fitWithSuffix(shortenPath(path7), note, budget);
+      return fitWithSuffix(shortenPath(path9), note, budget);
     }
     case "edit_file": {
-      const path7 = argString(args, ["path", "file_path"]);
-      if (!path7) return "";
+      const path9 = argString(args, ["path", "file_path"]);
+      if (!path9) return "";
       const oldLines = lineCount(args.old_string);
       const newLines = lineCount(args.new_string);
       const note = oldLines > 0 || newLines > 0 ? ` (${oldLines}\u2192${newLines} \u884C)` : "";
-      return fitWithSuffix(shortenPath(path7), note, budget);
+      return fitWithSuffix(shortenPath(path9), note, budget);
     }
     case "read_file": {
-      const path7 = argString(args, ["path", "file_path"]);
-      if (!path7) return "";
+      const path9 = argString(args, ["path", "file_path"]);
+      if (!path9) return "";
       const offset = argNumber(args, ["offset"]);
       const limit = argNumber(args, ["limit"]);
       const range = offset !== void 0 ? `:${offset}${limit !== void 0 ? `+${limit}` : ""}` : "";
-      return truncateToWidth(shortenPath(path7) + range, budget);
+      return truncateToWidth(shortenPath(path9) + range, budget);
     }
     case "search_files":
       return truncateToWidth(argString(args, ["pattern"]) ?? "", budget);
@@ -1603,13 +2633,6 @@ function AddTaskRow({ section: section2, result: result2, lookups }) {
 
 // src/tui/components/chat-area/signal-row.tsx
 import { Box as Box3, Text as Text3 } from "ink";
-
-// src/types/conversation.ts
-function isCompactMarker(entry) {
-  return entry.type === "system" /* System */ && entry.subtype === "compact" /* Compact */ && entry.compactMeta !== void 0;
-}
-
-// src/tui/components/chat-area/signal-row.tsx
 import { jsx as jsx4, jsxs as jsxs3 } from "react/jsx-runtime";
 var MAX_CONTENT_LINES = 2;
 function trimContent(text, maxLines) {
@@ -1952,6 +2975,25 @@ function renderShortcutList() {
   return lines.join("\n");
 }
 
+// src/tui/utils/workspace-display.ts
+function formatWorkspaceSlug(workspace) {
+  const slug = workspace?.slug?.trim();
+  return slug ? slug : null;
+}
+function formatWorkspaceSummary(workspaces) {
+  if (!workspaces || workspaces.length === 0) return null;
+  const slugs = workspaces.map((workspace) => workspace?.slug?.trim()).filter((slug) => !!slug);
+  if (slugs.length === 0) return null;
+  if (slugs.length === 1) return slugs[0];
+  return `${slugs[0]} +${slugs.length - 1}`;
+}
+function formatWorkspaceDetail(workspace) {
+  const path9 = workspace?.path?.trim();
+  const slug = workspace?.slug?.trim();
+  if (path9 && slug) return `${slug} (${path9})`;
+  return path9 || slug || null;
+}
+
 // src/tui/hooks/use-slash-commands.ts
 var SLASH_COMMANDS = [
   { name: "tasks", args: "[status]", description: "List tasks" },
@@ -1976,9 +3018,11 @@ function useSlashCommands(supervisor) {
         const status = parts[1];
         const tasks = await supervisor.engine.list(status);
         if (tasks.length === 0) return { handled: true, output: "No tasks" };
-        const lines = tasks.map(
-          (t) => `[${t.status}] ${t.id}: ${t.description}${t.result ? ` \u2192 ${t.result}` : ""}`
-        );
+        const lines = tasks.map((t) => {
+          const workspace = formatWorkspaceDetail(t.workspace);
+          const workspacePart = workspace ? ` \u2014 ${workspace}` : "";
+          return `[${t.status}] ${t.id}: ${t.description}${workspacePart}${t.result ? ` \u2192 ${t.result}` : ""}`;
+        });
         return { handled: true, output: lines.join("\n") };
       }
       case "workers": {
@@ -2549,81 +3593,43 @@ function InputArea({ onSubmit, onExit, onEscape, busy, width }) {
           cmd.description
         ] })
       ] }, cmd.name);
-    }) }),
-    /* @__PURE__ */ jsx9(
-      Box6,
-      {
-        borderStyle: "single",
-        borderColor: "gray",
-        borderLeft: false,
-        borderRight: false,
-        paddingX: 1,
-        children: /* @__PURE__ */ jsx9(Box6, { flexDirection: "column", children: layout.lines.map((line, i) => {
-          const isCursorLine = i === layout.cursorLine;
-          const col = layout.cursorCol;
-          const charLen = isCursorLine ? nextCodePointLength(line.text, col) : 0;
-          const before = isCursorLine ? line.text.slice(0, col) : line.text;
-          const cursorCell = isCursorLine && charLen > 0 ? line.text.slice(col, col + charLen) : " ";
-          const after = isCursorLine ? line.text.slice(col + charLen) : "";
-          return /* @__PURE__ */ jsxs6(Box6, { children: [
-            i === 0 ? /* @__PURE__ */ jsx9(Text7, { color: theme.user.prefixColor, bold: true, children: theme.user.prefix }) : /* @__PURE__ */ jsx9(Text7, { children: " ".repeat(PREFIX_WIDTH2) }),
-            visibleSelection ? /* @__PURE__ */ jsxs6(Fragment3, { children: [
-              i === 0 && /* @__PURE__ */ jsx9(Text7, { children: " " }),
-              splitLineBySelection(line, sel).map((seg, j) => /* @__PURE__ */ jsx9(Text7, { inverse: seg.selected, children: seg.text }, j))
-            ] }) : /* @__PURE__ */ jsxs6(Fragment3, { children: [
-              /* @__PURE__ */ jsx9(Text7, { children: i === 0 ? ` ${before}` : before }),
-              isCursorLine && /* @__PURE__ */ jsx9(Text7, { color: "white", inverse: true, children: cursorCell }),
-              /* @__PURE__ */ jsx9(Text7, { children: after })
-            ] }),
-            isCursorLine && busy && /* @__PURE__ */ jsx9(Text7, { dimColor: true, children: " (thinking...)" })
-          ] }, i);
-        }) })
-      }
-    )
-  ] });
-}
-
-// src/tui/components/inquiry-prompt.tsx
-import React4, { useState as useState3 } from "react";
-import { Box as Box7, Text as Text8, useInput as useInput2 } from "ink";
-
-// src/types/config.ts
-function validateConfig(config) {
-  for (const [name, provider] of Object.entries(config.providers)) {
-    if (!provider.endpoint) return `providers.${name}.endpoint is required`;
-    if (!provider.apiKey) return `providers.${name}.apiKey is required (set WAYANG_LLM_API_KEY or configure in config file)`;
-    if (!provider.modelName) return `providers.${name}.modelName is required`;
-    const window = provider.contextWindowTokens;
-    if (window !== void 0 && !(Number.isInteger(window) && window > 0)) {
-      return `providers.${name}.contextWindowTokens must be a positive integer (got ${JSON.stringify(window)})`;
-    }
-  }
-  const cp = config.controller.provider;
-  if (!config.providers[cp]) return `controller.provider "${cp}" not found`;
-  const wp = config.worker.provider;
-  if (!config.providers[wp]) return `worker.provider "${wp}" not found`;
-  return null;
-}
-
-// src/types/signal.ts
-function getSignalField(sig, field) {
-  return sig.payload[field];
-}
-
-// src/types/inquiry.ts
-var INQUIRE_OTHER_OPTION = "\u5176\u4ED6\uFF08\u81EA\u884C\u8F93\u5165\uFF09";
-var INQUIRE_CUSTOM_ANSWER_PREFIX = "[Other] ";
-function buildSelectChoices(options, allowOther) {
-  return allowOther === false ? options : [...options, INQUIRE_OTHER_OPTION];
-}
-function isOtherChoice(choice) {
-  return choice === INQUIRE_OTHER_OPTION;
-}
-function formatCustomAnswer(text) {
-  return `${INQUIRE_CUSTOM_ANSWER_PREFIX}${text}`;
+    }) }),
+    /* @__PURE__ */ jsx9(
+      Box6,
+      {
+        borderStyle: "single",
+        borderColor: "gray",
+        borderLeft: false,
+        borderRight: false,
+        paddingX: 1,
+        children: /* @__PURE__ */ jsx9(Box6, { flexDirection: "column", children: layout.lines.map((line, i) => {
+          const isCursorLine = i === layout.cursorLine;
+          const col = layout.cursorCol;
+          const charLen = isCursorLine ? nextCodePointLength(line.text, col) : 0;
+          const before = isCursorLine ? line.text.slice(0, col) : line.text;
+          const cursorCell = isCursorLine && charLen > 0 ? line.text.slice(col, col + charLen) : " ";
+          const after = isCursorLine ? line.text.slice(col + charLen) : "";
+          return /* @__PURE__ */ jsxs6(Box6, { children: [
+            i === 0 ? /* @__PURE__ */ jsx9(Text7, { color: theme.user.prefixColor, bold: true, children: theme.user.prefix }) : /* @__PURE__ */ jsx9(Text7, { children: " ".repeat(PREFIX_WIDTH2) }),
+            visibleSelection ? /* @__PURE__ */ jsxs6(Fragment3, { children: [
+              i === 0 && /* @__PURE__ */ jsx9(Text7, { children: " " }),
+              splitLineBySelection(line, sel).map((seg, j) => /* @__PURE__ */ jsx9(Text7, { inverse: seg.selected, children: seg.text }, j))
+            ] }) : /* @__PURE__ */ jsxs6(Fragment3, { children: [
+              /* @__PURE__ */ jsx9(Text7, { children: i === 0 ? ` ${before}` : before }),
+              isCursorLine && /* @__PURE__ */ jsx9(Text7, { color: "white", inverse: true, children: cursorCell }),
+              /* @__PURE__ */ jsx9(Text7, { children: after })
+            ] }),
+            isCursorLine && busy && /* @__PURE__ */ jsx9(Text7, { dimColor: true, children: " (thinking...)" })
+          ] }, i);
+        }) })
+      }
+    )
+  ] });
 }
 
 // src/tui/components/inquiry-prompt.tsx
+import React4, { useState as useState3 } from "react";
+import { Box as Box7, Text as Text8, useInput as useInput2 } from "ink";
 import { jsx as jsx10, jsxs as jsxs7 } from "react/jsx-runtime";
 function InquiryPrompt({ inquiry, onAnswer }) {
   if (inquiry.type === "confirm") {
@@ -2762,21 +3768,23 @@ import { Box as Box8, Text as Text9, useStdout } from "ink";
 
 // src/tui/hooks/use-wayang-state.ts
 import { useState as useState4, useEffect as useEffect3 } from "react";
-function useWayangState(source, path7) {
-  const [value, setValue] = useState4(() => source.getSnapshot(path7));
+function useWayangState(source, path9) {
+  const [value, setValue] = useState4(() => source.getSnapshot(path9));
   useEffect3(() => {
-    const unSub = source.subscribe(path7, () => {
-      setValue(source.getSnapshot(path7));
+    const unSub = source.subscribe(path9, () => {
+      setValue(source.getSnapshot(path9));
     });
-    setValue(source.getSnapshot(path7));
+    setValue(source.getSnapshot(path9));
     return unSub;
-  }, [source, path7]);
+  }, [source, path9]);
   return value;
 }
 
 // src/tui/components/status-bar.tsx
 import { jsx as jsx11, jsxs as jsxs8 } from "react/jsx-runtime";
 var CONTEXT_SEGMENT_MAX_WIDTH = 22;
+var LABEL_MAX_WIDTH = 20;
+var ROW_SEPARATOR = " \xB7 ";
 function formatContextUsage(usedTokens, contextWindowTokens) {
   const percent = contextWindowTokens > 0 ? Math.round(usedTokens / contextWindowTokens * 100) : 0;
   const text = `${formatTokenCount(usedTokens)}/${formatTokenCount(contextWindowTokens)} (${percent}%)`;
@@ -2827,28 +3835,48 @@ function buildWorkerRows(activeWorkers, runningTasks, now) {
     return {
       workerId: w.workerId,
       taskId: w.taskId,
-      label: text ? text.slice(0, 20) : `${w.workerType || "worker"} ${idTail(w.taskId)}`,
+      // Cap by DISPLAY columns, not code units: a 20-code-unit Chinese title is
+      // 40 columns wide and would blow the row budget before fitting even runs.
+      label: text ? sliceToWidth(text, LABEL_MAX_WIDTH) : `${w.workerType || "worker"} ${idTail(w.taskId)}`,
       elapsed,
-      idle
+      idle,
+      workspaceSlug: formatWorkspaceSlug(task?.workspace) ?? void 0
     };
   });
   disambiguateRowLabels(rows);
   return rows;
 }
+function rowSuffix(row) {
+  return ` (${row.idle ? "idle " : ""}${formatElapsedSeconds(row.elapsed)})`;
+}
+function workerRowText(row, withSlug) {
+  const slug = withSlug && row.workspaceSlug ? ` [${row.workspaceSlug}]` : "";
+  return `${row.label}${slug}${rowSuffix(row)}`;
+}
 function fitWorkerRows(rows, budget) {
   if (budget <= 0) return [];
   const fitted = [];
   let used = 0;
   for (const row of rows) {
-    const text = `${row.label} (${row.idle ? "idle " : ""}${formatElapsedSeconds(row.elapsed)})`;
-    const sep = fitted.length > 0 ? 3 : 0;
-    if (used + sep + text.length <= budget) {
-      fitted.push(text);
-      used += sep + text.length;
+    const sep2 = fitted.length > 0 ? stringWidth(ROW_SEPARATOR) : 0;
+    const full = workerRowText(row, true);
+    const fullWidth = stringWidth(full);
+    if (used + sep2 + fullWidth <= budget) {
+      fitted.push(full);
+      used += sep2 + fullWidth;
       continue;
     }
-    const remaining = budget - used - sep;
-    if (remaining > 0) fitted.push(text.slice(0, remaining));
+    const compact = workerRowText(row, false);
+    const compactWidth = stringWidth(compact);
+    if (used + sep2 + compactWidth <= budget) {
+      fitted.push(compact);
+      used += sep2 + compactWidth;
+      continue;
+    }
+    const remaining = budget - used - sep2;
+    if (remaining > 0) {
+      fitted.push(fitWithSuffix(row.label, rowSuffix(row), remaining));
+    }
     break;
   }
   return fitted;
@@ -2860,8 +3888,8 @@ function buildStatusSegments(input2) {
   if (activeCount > 0) parts.push(`active workers:${activeCount}`);
   const countsText = parts.length > 0 ? parts.join(" \u2502 ") : "idle";
   const contextText = contextUsage ? formatContextUsage(contextUsage.usedTokens, contextUsage.contextWindowTokens) : "";
-  const contextWidth = contextText ? contextText.length + 3 : 0;
-  const workerBudget = Math.max(0, terminalCols - 4 - countsText.length - contextWidth);
+  const contextWidth = contextText ? stringWidth(contextText) + 3 : 0;
+  const workerBudget = Math.max(0, terminalCols - 4 - stringWidth(countsText) - contextWidth);
   return {
     countsText,
     workerTexts: fitWorkerRows(workerRows, workerBudget),
@@ -2983,6 +4011,8 @@ var signalSubtypeMap = {
   completed: "worker_completed" /* WorkerCompleted */,
   failed: "worker_failed" /* WorkerFailed */,
   progress: "worker_progress" /* WorkerProgress */,
+  task_queued: "task_queued" /* TaskQueued */,
+  worker_started: "worker_started" /* WorkerStarted */,
   heartbeat: "heartbeat" /* Heartbeat */,
   cancelled: "worker_failed" /* WorkerFailed */,
   task_cancelled: "task_cancelled" /* TaskCancelled */,
@@ -3238,7 +4268,7 @@ function AppContent() {
 // package.json
 var package_default = {
   name: "wayang-ai",
-  version: "0.7.2",
+  version: "0.8.0",
   description: "Multi-agent orchestration platform",
   type: "module",
   license: "MIT",
@@ -3323,7 +4353,11 @@ var logo3d = `
    \u255A\u2550\u2550\u255D\u255A\u2550\u2550\u255D \u255A\u2550\u255D  \u255A\u2550\u255D   \u255A\u2550\u255D   \u255A\u2550\u255D  \u255A\u2550\u255D\u255A\u2550\u255D  \u255A\u2550\u2550\u2550\u255D \u255A\u2550\u2550\u2550\u2550\u2550\u255D                                                                                             
 `;
 var pkgVersion = package_default.version;
-function writeWelcome(workspace) {
+function formatSessionWorkspaceLabel(workspace, workspaces) {
+  if (!workspaces || workspaces.length <= 1) return workspace;
+  return formatWorkspaceSummary(workspaces) ?? workspace;
+}
+function writeWelcome(workspace, workspaces) {
   const GREEN = "\x1B[32m";
   const BOLD = "\x1B[1m";
   const DIM = "\x1B[2m";
@@ -3333,16 +4367,16 @@ function writeWelcome(workspace) {
   process.stdout.write("\n");
   process.stdout.write(`  Welcome to play with ${BOLD}Wayang${RESET}
 `);
-  process.stdout.write(`  ${DIM}${pkgVersion} \xB7 ${workspace}${RESET}
+  process.stdout.write(`  ${DIM}${pkgVersion} \xB7 ${formatSessionWorkspaceLabel(workspace, workspaces)}${RESET}
 `);
   process.stdout.write("\n");
 }
 
 // src/tui/render.ts
 function renderInkUI(supervisor) {
-  return new Promise((resolve12) => {
+  return new Promise((resolve13) => {
     process.stdout.write("\x1B[2J\x1B[H");
-    writeWelcome(supervisor.ctx.workspaceDir);
+    writeWelcome(supervisor.ctx.workspaceDir, supervisor.ctx.workspaces);
     const { waitUntilExit } = render(
       React6.createElement(App, { supervisor }),
       // Ctrl+C ownership belongs to AppContent's useInput handler. Ctrl+C
@@ -3352,13 +4386,13 @@ function renderInkUI(supervisor) {
       // app-level handler ever sees the key.
       { exitOnCtrlC: false }
     );
-    waitUntilExit().then(() => resolve12());
+    waitUntilExit().then(() => resolve13());
   });
 }
 
 // src/onboard.ts
-import * as fs3 from "fs";
-import * as path3 from "path";
+import * as fs5 from "fs";
+import * as path6 from "path";
 import * as childProcess from "child_process";
 import prompts from "prompts";
 function fillApiKeys(config) {
@@ -3479,9 +4513,9 @@ async function buildConfigInteractive() {
 async function loadConfig(configPath2, options = {}) {
   const { nonInteractive = false } = options;
   let config;
-  if (fs3.existsSync(configPath2)) {
+  if (fs5.existsSync(configPath2)) {
     try {
-      config = JSON.parse(fs3.readFileSync(configPath2, "utf-8"));
+      config = JSON.parse(fs5.readFileSync(configPath2, "utf-8"));
     } catch (err2) {
       if (nonInteractive) throw new Error(`Invalid config JSON at ${configPath2}: ${err2 instanceof Error ? err2.message : String(err2)}`);
       throw err2;
@@ -3510,8 +4544,8 @@ async function loadConfig(configPath2, options = {}) {
       config = await buildConfigInteractive();
     }
     if (!nonInteractive) {
-      fs3.mkdirSync(path3.dirname(configPath2), { recursive: true });
-      fs3.writeFileSync(configPath2, JSON.stringify(config, null, 2));
+      fs5.mkdirSync(path6.dirname(configPath2), { recursive: true });
+      fs5.writeFileSync(configPath2, JSON.stringify(config, null, 2));
     }
   }
   fillApiKeys(config);
@@ -3527,12 +4561,46 @@ async function loadConfig(configPath2, options = {}) {
 
 // src/session-select.ts
 import prompts2 from "prompts";
-function formatSessionChoice(meta, showWorkspace) {
+var MINUTE_MS = 6e4;
+var HOUR_MS = 60 * MINUTE_MS;
+var DAY_MS = 24 * HOUR_MS;
+function sessionWorkspaceRefs(meta) {
+  if (meta.workspaces && meta.workspaces.length > 0) {
+    return meta.workspaces.filter((w) => typeof w.path === "string" && w.path.length > 0);
+  }
+  return meta.workspace ? [{ path: meta.workspace }] : [];
+}
+function workspaceHandle(ref) {
+  return ref.slug && ref.slug.length > 0 ? ref.slug : workspaceSlugFromPath(ref.path);
+}
+function formatSessionWorkspaces(meta) {
+  const refs = sessionWorkspaceRefs(meta);
+  if (refs.length === 0) return "(no workspace)";
+  const first = workspaceHandle(refs[0]);
+  return refs.length > 1 ? `${first} (+${refs.length - 1})` : first;
+}
+function formatRelativeLastActive(lastActiveAt, now = Date.now()) {
+  const elapsed = Math.max(0, now - lastActiveAt);
+  if (elapsed < MINUTE_MS) return "just now";
+  if (elapsed < HOUR_MS) return `${Math.floor(elapsed / MINUTE_MS)}m ago`;
+  if (elapsed < DAY_MS) return `${Math.floor(elapsed / HOUR_MS)}h ago`;
+  const days = Math.floor(elapsed / DAY_MS);
+  if (days < 30) return `${days}d ago`;
+  const months = Math.floor(days / 30);
+  if (months < 12) return `${months}mo ago`;
+  return `${Math.floor(months / 12)}y ago`;
+}
+function formatSessionChoice(meta, now = Date.now()) {
   const date = new Date(meta.createdAt).toLocaleString();
   const display = sessionDisplayTitle(meta);
   const label = display ? `"${display}"` : "(no input yet)";
-  const ws = showWorkspace ? `  [${meta.workspace}]` : "";
-  return `${meta.sessionId}  ${date}  ${label}${ws}`;
+  const workspaces = formatSessionWorkspaces(meta);
+  const lastActive = formatRelativeLastActive(meta.lastActiveAt, now);
+  return `${meta.sessionId}  ${date}  ${label}  [${workspaces}]  active ${lastActive}`;
+}
+function isWorkspaceMismatch(meta, workspaceDir2) {
+  const target = normalizeWorkspacePath(workspaceDir2);
+  return !sessionWorkspacePaths(meta).some((p) => normalizeWorkspacePath(p) === target);
 }
 async function selectSessionInteractive(homeDir2, workspaceDir2, showAll) {
   const sessions = listSessions(homeDir2, showAll ? {} : { workspace: workspaceDir2 });
@@ -3546,7 +4614,7 @@ async function selectSessionInteractive(homeDir2, workspaceDir2, showAll) {
     name: "selected",
     message: "Select a session to resume",
     choices: sessions.map((m) => ({
-      title: formatSessionChoice(m, showAll),
+      title: formatSessionChoice(m),
       value: m.sessionId
     }))
   });
@@ -3558,11 +4626,11 @@ async function selectSessionInteractive(homeDir2, workspaceDir2, showAll) {
     console.error(`Error: Session "${selected}" not found.`);
     process.exit(1);
   }
-  if (result2.meta.workspace !== workspaceDir2) {
+  if (isWorkspaceMismatch(result2.meta, workspaceDir2)) {
     const { confirm } = await prompts2({
       type: "confirm",
       name: "confirm",
-      message: `Session workspace is ${result2.meta.workspace}, current dir is ${workspaceDir2}. Switch?`,
+      message: `Session workspace is ${formatSessionWorkspaces(result2.meta)}, current dir is ${workspaceDir2}. Switch?`,
       initial: true
     });
     if (!confirm) {
@@ -3577,40 +4645,86 @@ function die(msg) {
   console.error(`Error: ${msg}`);
   process.exit(1);
 }
+async function connectToServer(options) {
+  try {
+    return await connectRemoteServer(options);
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    const markerAt = message.indexOf(SESSION_LOCKED_MARKER);
+    if (markerAt === -1) throw err;
+    die(message.slice(markerAt).trim());
+  }
+}
+async function resolveStartupWorkspace(sessionId, sessionDir, wayangHome) {
+  const manager = SessionManager.resume(sessionId, sessionDir, wayangHome);
+  await manager.restore();
+  return manager.startupWorkspace;
+}
+function assertRecoverableWorkspace(resolved, sessionId) {
+  if (fs6.existsSync(resolved.path)) return;
+  die(
+    `Cannot resume session "${sessionId}": its startup workspace ${resolved.path} no longer exists (the directory was moved or deleted). Resume a different session with --resume (or --new to start a new one).`
+  );
+}
+function dedupeDisplayWorkspaces(refs) {
+  const seen = /* @__PURE__ */ new Set();
+  const result2 = [];
+  for (const ref of refs) {
+    const normalized = normalizeWorkspacePath(ref.path);
+    if (seen.has(normalized)) continue;
+    seen.add(normalized);
+    result2.push({ ...ref, path: normalized });
+  }
+  return result2;
+}
 async function bootstrap(options) {
-  const wayangHome = path4.join(options.homeDir, ".wayang");
+  const wayangHome = path7.join(options.homeDir, ".wayang");
   await loadConfig(options.configPath);
   let session = "new";
   let injectPreviousTasks = false;
   let workspaceDir2 = options.workspaceDir;
-  if (options.fresh) {
+  let sessionWorkspaces = [];
+  if (options.new) {
   } else if (options.resume === void 0) {
     const latest = getLatestSessionForWorkspace(wayangHome, options.workspaceDir);
     if (latest) {
       session = { resume: latest.sessionId };
       injectPreviousTasks = true;
+      sessionWorkspaces = latest.meta.workspaces ?? [];
       console.log(`  Resuming session ${latest.sessionId}`);
     }
   } else if (options.resume === "") {
     const result2 = await selectSessionInteractive(wayangHome, options.workspaceDir, options.showAll ?? false);
-    workspaceDir2 = result2.meta.workspace;
+    const startup = await resolveStartupWorkspace(result2.sessionId, result2.sessionDir, wayangHome);
+    if (startup) assertRecoverableWorkspace(startup, result2.sessionId);
+    workspaceDir2 = startup?.path ?? (result2.meta.workspace || workspaceDir2);
     session = { resume: result2.sessionId };
+    sessionWorkspaces = result2.meta.workspaces ?? [];
     console.log(`  Resuming session ${result2.sessionId}`);
   } else {
     const existing = getSession(wayangHome, options.resume);
     if (!existing) {
       die(`Session "${options.resume}" not found.`);
     }
-    workspaceDir2 = existing.meta.workspace;
+    const startup = await resolveStartupWorkspace(existing.sessionId, existing.sessionDir, wayangHome);
+    if (startup) assertRecoverableWorkspace(startup, existing.sessionId);
+    workspaceDir2 = startup?.path ?? (existing.meta.workspace || workspaceDir2);
     session = { resume: existing.sessionId };
+    sessionWorkspaces = existing.meta.workspaces ?? [];
     console.log(`  Resuming session ${existing.sessionId}`);
   }
-  const { remote, stop } = await connectRemoteServer({
+  workspaceDir2 = normalizeWorkspacePath(workspaceDir2);
+  sessionWorkspaces = dedupeDisplayWorkspaces(sessionWorkspaces);
+  if (sessionWorkspaces.length === 0) {
+    sessionWorkspaces = [resolveWorkspaceRef(wayangHome, workspaceDir2)];
+  }
+  const { remote, stop } = await connectToServer({
     configPath: options.configPath,
     // Pass the ROOT dir: the server's `--home-dir` flag expects it and joins
     // `.wayang` itself. Passing the pre-joined dir caused a double join.
     homeDir: options.homeDir,
     workspaceDir: workspaceDir2,
+    workspaces: sessionWorkspaces,
     session,
     injectPreviousTasks,
     logLevel: options.logLevel
@@ -3625,14 +4739,14 @@ async function bootstrap(options) {
 // src/infra/logger.ts
 import pino from "pino";
 function closeTransport(transport) {
-  return new Promise((resolve12) => {
+  return new Promise((resolve13) => {
     transport.on("error", () => {
     });
     if (transport.closed || transport.destroyed) {
-      resolve12();
+      resolve13();
       return;
     }
-    transport.once("close", () => resolve12());
+    transport.once("close", () => resolve13());
     try {
       transport.end();
     } catch {
@@ -3692,297 +4806,58 @@ var SystemContext = class {
   sessionId;
   sessionDir;
   workspaceDir;
-  startedAt;
-  logLevel;
-  logger;
-  abortController;
-  config;
-  hooks;
-  /** The log sink this context owns; `logger` above is a child of it. */
-  logSink;
-  closeLoggerPromise;
-  constructor(config, sessionId, sessionDir, workspaceDir2, logLevel) {
-    this.config = config;
-    this.sessionId = sessionId;
-    this.sessionDir = sessionDir;
-    this.workspaceDir = workspaceDir2;
-    this.startedAt = Date.now();
-    this.logLevel = logLevel ?? "info";
-    this.abortController = new AbortController();
-    this.hooks = new LifecycleHooks();
-    this.logSink = createFileLogger(this.logLevel, `${sessionDir}/wayang.log`);
-    this.logger = this.logSink.logger.child({
-      session: sessionId
-    });
-  }
-  /**
-   * Flush and close the log sink, ending its transport worker thread.
-   *
-   * Once the returned promise resolves, this context's logger will never
-   * touch the session directory again: the log file is fully flushed and
-   * the worker thread has exited. Idempotent — repeated calls return the
-   * same promise — and log calls made afterwards are safely ignored.
-   */
-  closeLogger() {
-    this.closeLoggerPromise ??= this.logSink.close();
-    return this.closeLoggerPromise;
-  }
-  get controllerProvider() {
-    return this.config.providers[this.config.controller.provider];
-  }
-  get workerProvider() {
-    return this.config.providers[this.config.worker.provider];
-  }
-  get maxConcurrency() {
-    return this.config.worker.maxConcurrency;
-  }
-};
-
-// src/services/signal/signal-state.ts
-import { join as join5 } from "path";
-
-// src/infra/state/base-state.ts
-import { get, set, cloneDeep } from "lodash-es";
-
-// src/infra/state/conversation-envelope.ts
-var ENVELOPE_VERSION = 1;
-function applyAppendEnvelope(entry, conversation) {
-  if (entry === null || typeof entry !== "object") return entry;
-  if (entry.v === void 0) entry.v = ENVELOPE_VERSION;
-  if (entry.parentId === void 0) {
-    const last = conversation.length > 0 ? conversation[conversation.length - 1] : void 0;
-    const lastIsMarker = last !== null && typeof last === "object" && isCompactMarker(last);
-    entry.parentId = !last || lastIsMarker || isCompactMarker(entry) || typeof last.uuid !== "string" ? null : last.uuid;
-  }
-  return entry;
-}
-
-// src/infra/state/base-state.ts
-var BaseWayangState = class {
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- state-tree root is intentionally untyped at this layer; typed reads happen via get<T>() at call sites (changing the default cascades across every bare get() in the repo)
-  data;
-  persistMappings;
-  subscriptions = /* @__PURE__ */ new Map();
-  constructor(initialData, persistMappings = []) {
-    this.data = initialData;
-    this.persistMappings = persistMappings;
-  }
-  // --- Read ---
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- public default generic: bare get() callers across the repo rely on it; per-call sites pass an explicit T
-  get(path7) {
-    return get(this.data, path7);
-  }
-  // --- Write operations ---
-  set(path7, value) {
-    const prev = get(this.data, path7);
-    set(this.data, path7, value);
-    this.persist(path7, "set");
-    this.notify(path7, "set", prev);
-  }
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- partial update merges an untyped object into the state tree root (see `data`)
-  update(path7, partial) {
-    const prev = cloneDeep(get(this.data, path7));
-    const target = get(this.data, path7);
-    if (target && typeof target === "object") {
-      Object.assign(target, partial);
-    } else {
-      set(this.data, path7, partial);
-    }
-    this.persist(path7, "update");
-    this.notify(path7, "update", prev);
-  }
-  append(path7, entry) {
-    const arr = get(this.data, path7);
-    if (!Array.isArray(arr)) {
-      throw new Error(`State.append: path "${path7}" is not an array`);
-    }
-    const stamped = path7 === "conversation" ? applyAppendEnvelope(entry, arr) : entry;
-    arr.push(stamped);
-    set(this.data, path7, [...arr]);
-    this.persist(path7, "append", stamped);
-    this.notify(path7, "append", void 0);
-  }
-  remove(path7, idx) {
-    const arr = get(this.data, path7);
-    if (!Array.isArray(arr)) {
-      throw new Error(`State.remove: path "${path7}" is not an array`);
-    }
-    const prev = idx !== void 0 ? arr[idx] : arr[arr.length - 1];
-    if (idx === void 0) {
-      arr.pop();
-    } else {
-      arr.splice(idx, 1);
-    }
-    this.persist(path7, "remove");
-    this.notify(path7, "remove", prev);
-  }
-  // --- Subscription ---
-  on(path7, callback) {
-    if (!this.subscriptions.has(path7)) {
-      this.subscriptions.set(path7, /* @__PURE__ */ new Set());
-    }
-    this.subscriptions.get(path7).add(callback);
-    return () => this.subscriptions.get(path7)?.delete(callback);
-  }
-  // --- Persistence ---
-  /**
-   * Hand the change to whichever helper owns this field, with enough context
-   * for the helper to pick its own strategy. Snapshot helpers replace the
-   * file; append helpers write only the new entry and ignore window edits.
-   */
-  persist(path7, op, entry) {
-    const topKey = path7.split(".")[0];
-    for (const mapping of this.persistMappings) {
-      if (mapping.path !== topKey) continue;
-      mapping.helper.write({
-        path: topKey,
-        op,
-        value: this.data[topKey],
-        entry
-      });
-    }
-  }
-  // --- Notification ---
-  notify(changePath, type, prev) {
-    const event = { type, path: changePath, data: get(this.data, changePath), prev };
-    for (const [subPath, callbacks] of this.subscriptions) {
-      if (changePath === subPath) {
-        for (const cb of callbacks) cb(event);
-        continue;
-      }
-      if (changePath.startsWith(subPath + ".")) {
-        for (const cb of callbacks) {
-          cb({ ...event, data: get(this.data, subPath) });
-        }
-        continue;
-      }
-      if (subPath.startsWith(changePath + ".")) {
-        const newVal = get(this.data, subPath);
-        for (const cb of callbacks) {
-          cb({ ...event, data: newVal });
-        }
-      }
-    }
-  }
-};
-
-// src/infra/state/persistence/json-file.ts
-import {
-  readFileSync as readFileSync4,
-  existsSync as existsSync3,
-  mkdirSync as mkdirSync2,
-  renameSync,
-  openSync,
-  writeSync,
-  fsyncSync,
-  closeSync,
-  unlinkSync,
-  copyFileSync
-} from "fs";
-import { dirname as dirname2, basename, join as join4 } from "path";
-var tempSeq = 0;
-var JSONFileHelper = class {
-  constructor(filePath) {
-    this.filePath = filePath;
-  }
-  filePath;
-  mode = "save";
-  /** Absolute path of the backing file. */
-  get path() {
-    return this.filePath;
-  }
-  /** Whether the backing file exists, regardless of parseability. */
-  exists() {
-    return existsSync3(this.filePath);
-  }
-  write(change) {
-    this.writeValue(change.value);
-  }
-  /** Write an arbitrary value atomically. Used by migration paths. */
-  writeValue(value) {
-    mkdirSync2(dirname2(this.filePath), { recursive: true });
-    const tmp = this.tempPath();
-    let fd = null;
-    try {
-      fd = openSync(tmp, "w");
-      writeSync(fd, JSON.stringify(value, null, 2));
-      fsyncSync(fd);
-      closeSync(fd);
-      fd = null;
-      renameSync(tmp, this.filePath);
-    } catch (err) {
-      if (fd !== null) {
-        try {
-          closeSync(fd);
-        } catch {
-        }
-      }
-      try {
-        if (existsSync3(tmp)) unlinkSync(tmp);
-      } catch {
-      }
-      throw err;
-    }
-  }
-  readonly() {
-    if (!existsSync3(this.filePath)) return null;
-    let raw;
-    try {
-      raw = readFileSync4(this.filePath, "utf-8");
-    } catch (err) {
-      throw new Error(
-        `Failed to read snapshot "${this.filePath}": ${err.message}`
-      );
-    }
-    if (raw.trim().length === 0) return null;
-    try {
-      return JSON.parse(raw);
-    } catch (err) {
-      const quarantine = this.quarantineCorrupt();
-      throw new Error(
-        `Corrupt snapshot "${this.filePath}" (${err.message}). The damaged file was moved to "${quarantine}". Refusing to treat it as empty state.`
-      );
-    }
-  }
-  read() {
-    return this.readonly();
+  startedAt;
+  logLevel;
+  logger;
+  abortController;
+  config;
+  hooks;
+  /** The log sink this context owns; `logger` above is a child of it. */
+  logSink;
+  closeLoggerPromise;
+  constructor(config, sessionId, sessionDir, workspaceDir2, logLevel) {
+    this.config = config;
+    this.sessionId = sessionId;
+    this.sessionDir = sessionDir;
+    this.workspaceDir = workspaceDir2;
+    this.startedAt = Date.now();
+    this.logLevel = logLevel ?? "info";
+    this.abortController = new AbortController();
+    this.hooks = new LifecycleHooks();
+    this.logSink = createFileLogger(this.logLevel, `${sessionDir}/wayang.log`);
+    this.logger = this.logSink.logger.child({
+      session: sessionId
+    });
   }
   /**
-   * Read without throwing on corruption — returns null instead.
-   * Only for callers that can tolerate absence (e.g. optional side files).
-   * State-critical reads must use readonly()/read().
+   * Flush and close the log sink, ending its transport worker thread.
+   *
+   * Once the returned promise resolves, this context's logger will never
+   * touch the session directory again: the log file is fully flushed and
+   * the worker thread has exited. Idempotent — repeated calls return the
+   * same promise — and log calls made afterwards are safely ignored.
    */
-  raw() {
-    if (!existsSync3(this.filePath)) return null;
-    const text = readFileSync4(this.filePath, "utf-8");
-    if (text.trim().length === 0) return null;
-    try {
-      return JSON.parse(text);
-    } catch {
-      return null;
-    }
+  closeLogger() {
+    this.closeLoggerPromise ??= this.logSink.close();
+    return this.closeLoggerPromise;
   }
-  clear() {
-    mkdirSync2(dirname2(this.filePath), { recursive: true });
-    this.writeValue(null);
+  get controllerProvider() {
+    return this.config.providers[this.config.controller.provider];
   }
-  tempPath() {
-    tempSeq += 1;
-    return join4(dirname2(this.filePath), `.${basename(this.filePath)}.${process.pid}.${tempSeq}.tmp`);
+  get workerProvider() {
+    return this.config.providers[this.config.worker.provider];
   }
-  quarantineCorrupt() {
-    const target = `${this.filePath}.corrupt.${Date.now()}`;
-    try {
-      copyFileSync(this.filePath, target);
-    } catch {
-    }
-    return target;
+  get maxConcurrency() {
+    return this.config.worker.maxConcurrency;
   }
 };
 
+// src/services/signal/signal-state.ts
+import { join as join10 } from "path";
+
 // src/infra/state/persistence/jsonl-file.ts
-import { readFileSync as readFileSync5, writeFileSync as writeFileSync2, appendFileSync, existsSync as existsSync4, mkdirSync as mkdirSync3 } from "fs";
-import { dirname as dirname3 } from "path";
+import { readFileSync as readFileSync7, writeFileSync as writeFileSync3, appendFileSync, existsSync as existsSync7, mkdirSync as mkdirSync5 } from "fs";
+import { dirname as dirname5 } from "path";
 var JSONLFileHelper = class {
   constructor(filePath) {
     this.filePath = filePath;
@@ -3999,12 +4874,12 @@ var JSONLFileHelper = class {
   }
   /** Append a single entry to history. */
   append(entry) {
-    mkdirSync3(dirname3(this.filePath), { recursive: true });
+    mkdirSync5(dirname5(this.filePath), { recursive: true });
     appendFileSync(this.filePath, JSON.stringify(entry) + "\n");
   }
   read() {
-    if (!existsSync4(this.filePath)) return [];
-    const text = readFileSync5(this.filePath, "utf-8");
+    if (!existsSync7(this.filePath)) return [];
+    const text = readFileSync7(this.filePath, "utf-8");
     if (text.length === 0) return [];
     const entries = [];
     for (const line of text.split("\n")) {
@@ -4027,8 +4902,8 @@ var JSONLFileHelper = class {
     return result2;
   }
   clear() {
-    mkdirSync3(dirname3(this.filePath), { recursive: true });
-    writeFileSync2(this.filePath, "");
+    mkdirSync5(dirname5(this.filePath), { recursive: true });
+    writeFileSync3(this.filePath, "");
   }
 };
 
@@ -4074,8 +4949,8 @@ var SignalState = class extends BaseWayangState {
   historyPath;
   historySeq = 0;
   constructor(ctx) {
-    const snapshotPath = join5(ctx.sessionDir, "signals.json");
-    const historyPath = join5(ctx.sessionDir, "signals.jsonl");
+    const snapshotPath = join10(ctx.sessionDir, "signals.json");
+    const historyPath = join10(ctx.sessionDir, "signals.jsonl");
     const snapshotFile = new JSONFileHelper(snapshotPath);
     const snapshotHelper = new SignalSnapshotHelper(snapshotFile);
     const historyFile = new JSONLFileHelper(historyPath);
@@ -4228,7 +5103,7 @@ var SignalState = class extends BaseWayangState {
    * whole signals array after a `set`.
    */
   replayLegacyStateEvents(byId) {
-    const eventsPath = join5(this.snapshotPath, "..", "state-events.jsonl");
+    const eventsPath = join10(this.snapshotPath, "..", "state-events.jsonl");
     const eventsFile = new JSONLFileHelper(eventsPath);
     const events = eventsFile.read();
     if (events.length === 0) return;
@@ -4262,11 +5137,11 @@ var SignalQueue = class {
     this.counter = Math.max(mark, this.maxIdInWindow());
   }
   // --- Subscribable ---
-  subscribe(path7, callback) {
-    return this.state.on(path7, callback);
+  subscribe(path9, callback) {
+    return this.state.on(path9, callback);
   }
-  getSnapshot(path7) {
-    return this.state.get(path7);
+  getSnapshot(path9) {
+    return this.state.get(path9);
   }
   enqueue(sig) {
     const id = `sig-${++this.counter}`;
@@ -4322,10 +5197,10 @@ var SignalQueue = class {
   waitForSignal() {
     const unread = this.state.get("signals").filter((s) => s.status === "unread");
     if (unread.length > 0) return Promise.resolve();
-    return new Promise((resolve12) => {
+    return new Promise((resolve13) => {
       this.resolveWait = () => {
         this.logger.debug("waitForSignal resolved");
-        resolve12();
+        resolve13();
       };
     });
   }
@@ -4386,11 +5261,11 @@ var SignalQueue = class {
 };
 
 // src/services/worker-transcript.ts
-import { closeSync as closeSync2, existsSync as existsSync5, openSync as openSync2, readSync, statSync } from "fs";
-import { join as join7 } from "path";
+import { closeSync as closeSync3, existsSync as existsSync8, openSync as openSync3, readSync, statSync } from "fs";
+import { join as join12 } from "path";
 
 // src/services/agents/worker-state.ts
-import { join as join6 } from "path";
+import { join as join11 } from "path";
 
 // src/services/agents/utils/conversation-to-sdk-messages.ts
 var USER_INTERRUPT_REPLAY = "[USER INTERRUPT] The user aborted the previous response while it was streaming (ESC in the TUI). Any assistant text immediately before this marker is a truncated partial \u2014 treat it as incomplete context, not as a finished answer or instructions.";
@@ -4467,9 +5342,10 @@ function conversationToSdkMessages(entries) {
         const sig = entry;
         const label = sig.subtype.replace("worker_", "").toUpperCase();
         const taskTag = sig.taskId ? ` task=${sig.taskId}` : "";
+        const workerTag = sig.workerId ? ` worker=${sig.workerId}` : "";
         messages.push({
           role: "system",
-          content: `[WORKER PROGRESS SIGNAL: ${label}${taskTag}] ${sig.content}`
+          content: `[WORKER PROGRESS SIGNAL: ${label}${taskTag}${workerTag}] ${sig.content}`
         });
         break;
       }
@@ -4568,20 +5444,6 @@ function toolOutputText(output) {
   return toolPayloadText(output);
 }
 
-// src/utils/id.ts
-function generateId(prefix) {
-  return `${prefix}-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
-}
-function formatTimestamp(date = /* @__PURE__ */ new Date()) {
-  const Y = date.getFullYear();
-  const M = String(date.getMonth() + 1).padStart(2, "0");
-  const D = String(date.getDate()).padStart(2, "0");
-  const h = String(date.getHours()).padStart(2, "0");
-  const m = String(date.getMinutes()).padStart(2, "0");
-  const s = String(date.getSeconds()).padStart(2, "0");
-  return `${Y}${M}${D}-${h}${m}${s}`;
-}
-
 // src/utils/time.ts
 function nowISO() {
   const now = /* @__PURE__ */ new Date();
@@ -4834,17 +5696,23 @@ ${this.compactSummary}` : "";
 
 // src/services/agents/worker-state.ts
 function workerDir(sessionDir, workerId) {
-  return join6(sessionDir, "workers", workerId);
+  return join11(sessionDir, "workers", workerId);
 }
 var WorkerState = class extends BaseWayangState {
-  constructor(sessionDir, workerId, logger) {
+  /**
+   * @param workspace  Workspace identity for this worker, resolved by the
+   *   caller (see `resolveWorkspaceRef`). Stamped into runtime-state on the
+   *   first write, so a worker records where it ran for later inspection.
+   */
+  constructor(sessionDir, workerId, logger, workspace) {
     const dir = workerDir(sessionDir, workerId);
-    const jsonFile = new JSONFileHelper(join6(dir, "runtime-state.json"));
-    const jsonlFile = new JSONLFileHelper(join6(dir, "conversation.jsonl"));
+    const jsonFile = new JSONFileHelper(join11(dir, "runtime-state.json"));
+    const jsonlFile = new JSONLFileHelper(join11(dir, "conversation.jsonl"));
     const initialData = {
       runtimeState: {
         session: { id: workerId, startedAt: Date.now() },
-        task: { id: "", description: "" }
+        task: { id: "", description: "" },
+        ...workspace ? { workspace } : {}
       },
       conversation: [],
       inbox: []
@@ -4856,14 +5724,17 @@ var WorkerState = class extends BaseWayangState {
     this.logger = logger;
     this.jsonFile = jsonFile;
     this.jsonlFile = jsonlFile;
+    this.workspace = workspace;
   }
   logger;
   jsonFile;
   jsonlFile;
+  /** Identity stamped on construction, re-applied if a restored file lacks it. */
+  workspace;
   async restore() {
     const runtimeState = this.jsonFile.read();
     if (runtimeState) {
-      this.data.runtimeState = runtimeState;
+      this.data.runtimeState = runtimeState.workspace || !this.workspace ? runtimeState : { ...runtimeState, workspace: this.workspace };
     }
     const allEntries = this.jsonlFile.read();
     const compactIdx = allEntries.findLastIndex(isCompactMarker);
@@ -4895,13 +5766,13 @@ function isValidWorkerId(workerId) {
   return WORKER_ID_PATTERN.test(workerId) && workerId !== "." && workerId !== "..";
 }
 function workerTranscriptPath(sessionDir, workerId) {
-  return join7(workerDir(sessionDir, workerId), WORKER_TRANSCRIPT_FILE);
+  return join12(workerDir(sessionDir, workerId), WORKER_TRANSCRIPT_FILE);
 }
 function readWorkerTranscript(sessionDir, workerId) {
   if (!isValidWorkerId(workerId)) return null;
-  const path7 = workerTranscriptPath(sessionDir, workerId);
-  if (!existsSync5(path7)) return null;
-  return new JSONLFileHelper(path7).read();
+  const path9 = workerTranscriptPath(sessionDir, workerId);
+  if (!existsSync8(path9)) return null;
+  return new JSONLFileHelper(path9).read();
 }
 var MAX_TRANSCRIPT_WINDOW_BYTES = 2 * 1024 * 1024;
 var MIN_WINDOW_BYTES = 64 * 1024;
@@ -4931,10 +5802,10 @@ function parseWindow(text, startsAtFileHead) {
 }
 function readWorkerTranscriptWindow(sessionDir, workerId, opts = {}) {
   if (!isValidWorkerId(workerId)) return null;
-  const path7 = workerTranscriptPath(sessionDir, workerId);
+  const path9 = workerTranscriptPath(sessionDir, workerId);
   let size;
   try {
-    size = statSync(path7).size;
+    size = statSync(path9).size;
   } catch {
     return null;
   }
@@ -4948,11 +5819,11 @@ function readWorkerTranscriptWindow(sessionDir, workerId, opts = {}) {
     const readLen = Math.min(size, windowBytes);
     const start = size - readLen;
     const chunk = Buffer.alloc(readLen);
-    const fd = openSync2(path7, "r");
+    const fd = openSync3(path9, "r");
     try {
       readSync(fd, chunk, 0, readLen, start);
     } finally {
-      closeSync2(fd);
+      closeSync3(fd);
     }
     const parsed = parseWindow(chunk.toString("utf8"), start === 0);
     const enough = parsed.entries.filter(matches).length >= need;
@@ -5170,12 +6041,12 @@ function buildTranscriptHeader(meta) {
 }
 
 // src/services/task/task-pool-state.ts
-import { join as join8 } from "path";
+import { join as join13 } from "path";
 var TaskPoolState = class extends BaseWayangState {
   jsonFile;
   logger;
   constructor(ctx) {
-    const jsonFile = new JSONFileHelper(join8(ctx.sessionDir, "tasks.json"));
+    const jsonFile = new JSONFileHelper(join13(ctx.sessionDir, "tasks.json"));
     super(
       {
         tasks: {
@@ -5196,6 +6067,29 @@ var TaskPoolState = class extends BaseWayangState {
     }
     this.logger.info("TaskPoolState restored");
   }
+  /**
+   * Stamp `workspace` onto restored tasks that predate task workspace
+   * attribution, using the session's own workspace as the fallback.
+   *
+   * Memory only — no persist call, so restoring a legacy session never rewrites
+   * its tasks.json (the value reaches disk with the next normal task write,
+   * exactly like `SessionState.fillWorkspacesInMemory`).
+   *
+   * Idempotent and non-destructive: a task that already carries a workspace is
+   * left untouched, so repeated restores (and tasks stamped at add time) are
+   * unaffected.
+   */
+  fillWorkspaceInMemory(fallback) {
+    const buckets = this.data.tasks;
+    if (!buckets) return;
+    for (const bucket of [buckets.pending, buckets.running, buckets.history]) {
+      if (!Array.isArray(bucket)) continue;
+      for (const task of bucket) {
+        if (!task || task.workspace) continue;
+        task.workspace = { path: fallback.path, slug: fallback.slug };
+      }
+    }
+  }
 };
 
 // src/services/agents/base-agent.ts
@@ -5594,6 +6488,7 @@ function applyTurnEnvelope(entry, env) {
   if (entry.rootTurnId === void 0 && env.rootTurnId !== void 0) entry.rootTurnId = env.rootTurnId;
   if (entry.causationId === void 0 && env.causationId !== void 0) entry.causationId = env.causationId;
   if (entry.actor === void 0 && env.actor !== void 0) entry.actor = env.actor;
+  if (entry.workspaceSlug === void 0 && env.workspaceSlug !== void 0) entry.workspaceSlug = env.workspaceSlug;
   return entry;
 }
 function syncStepTimestamps(entry) {
@@ -5729,12 +6624,7 @@ import { z } from "zod";
 
 // src/services/tools/common.ts
 import { tool } from "ai";
-import { resolve, relative } from "path";
 var MAX_RESULT_CHARS = 8e3;
-function isInsideWorkspace(resolved, workspace) {
-  const rel = relative(workspace, resolved);
-  return !rel.startsWith("..") && resolve(workspace, rel) === resolved;
-}
 function truncate(result2, maxChars = MAX_RESULT_CHARS) {
   if (result2.length <= maxChars) return result2;
   return result2.slice(0, maxChars) + "\n...(truncated)";
@@ -5792,7 +6682,7 @@ function getWorkerMeta(workerType, workerConfigs) {
 }
 
 // src/services/agents/prompts/prompt-utils.ts
-import os from "os";
+import os2 from "os";
 function assemble(...sections) {
   return sections.filter((s) => typeof s === "string" && s.length > 0).join("\n\n");
 }
@@ -5813,10 +6703,10 @@ function buildEnvironment(ctx, opts) {
   const shellName = shell.split("/").pop() ?? shell;
   const pairs = {
     "Date": `${date} (${weekday})`,
-    "OS": `${os.platform()} (${os.arch()})`,
+    "OS": `${os2.platform()} (${os2.arch()})`,
     "Shell": `${shellName} (${shell})`,
-    "Home": os.homedir(),
-    "WorkspaceDir": ctx.workspaceDir ?? process.cwd(),
+    "Home": os2.homedir(),
+    "WorkspaceDir": opts?.workspaceDir ?? ctx.workspaceDir ?? process.cwd(),
     ...opts?.extras
   };
   return section("Environment", kvBlock(pairs));
@@ -5853,7 +6743,7 @@ Always respond to user input \u2014 never leave the user without a reply.
 
 ## Responding to worker signals
 Worker signals are NOT user messages. Do NOT respond to them the same way.
-See the "Handling signals" section for detailed rules. In short: stay silent on PROGRESS, speak only on COMPLETED or FAILED.
+See the "Handling signals" section for detailed rules. In short: stay silent on TASK_QUEUED, STARTED and PROGRESS, speak only on COMPLETED or FAILED.
 
 Examples of ideal responses to user messages:
 
@@ -5916,7 +6806,7 @@ Give the user a brief one-line acknowledgement, then STOP. Do not speculate abou
 
 Some work proceeds in stages with a checkpoint in between (e.g. draft a design \u2192 user/you review \u2192 implement). For these, create the first task with \`multiStage: true\`. When that task completes, its worker parks in **idle** instead of being destroyed, keeping its accumulated context.
 
-To continue the work on the SAME worker, create the follow-up task with \`assignToWorker: "<workerId>"\` (the workerId from the completion). The worker resumes with full context \u2014 no need to re-explain what was already done.
+To continue the work on the SAME worker, create the follow-up task with \`assignToWorker: "<workerId>"\` (the worker id from the completed task \u2014 the \`worker=\u2026\` segment of its completion signal header, or the workerId returned by add_task). The worker resumes with full context \u2014 no need to re-explain what was already done.
 
 When to use multiStage:
 - The next stage genuinely depends on the worker's prior context (explored files, partial artifacts, decisions made).
@@ -6009,7 +6899,7 @@ Use sparingly \u2014 only when you need to:
 ## Handling permission requests (respond_permission)
 
 Workers may request permission for sensitive operations (shell commands, file writes, file edits).
-You will see a [PERMISSION REQUEST] message with the worker ID, tool name, arguments, and a request ID.
+You will see a [WORKER PROGRESS SIGNAL: PERMISSION_REQUEST \u2026] message whose header carries the worker id (worker=\u2026), with the tool name, a description, and a request ID.
 Use respond_permission(requestId, approved, reason) to approve or deny.
 - If the operation seems safe and aligned with the task, approve it.
 - If it seems risky or unnecessary, deny it with a reason explaining what the worker should do differently.
@@ -6044,9 +6934,19 @@ var SIGNAL_HANDLING = section(
   "Handling signals",
   `Worker signals are delivered as messages with a special prefix. They are NOT from the user.
 
-Format: [WORKER SIGNAL: TYPE task=TASK_ID] content
+Format: [WORKER PROGRESS SIGNAL: TYPE task=TASK_ID worker=WORKER_ID] content
+- task=TASK_ID \u2014 present when the signal concerns a dispatched task.
+- worker=WORKER_ID \u2014 present once a worker is assigned. This is the worker id you use for chat_worker / get_worker_status / read_worker_conversation / dispose_worker, and as the assignToWorker of a follow-up multi-stage task. It is absent while the task is still queued (TASK_QUEUED) and on signals that are not about one specific worker (e.g. HEARTBEAT).
+
+## [WORKER PROGRESS SIGNAL: TASK_QUEUED ...] \u2014 task is waiting for a slot
+
+All concurrency slots are busy, so the task has not started yet. It will start automatically when a slot frees \u2014 a STARTED signal follows. Informational: call \`skip_reply()\` and do NOT re-dispatch or poll.
+
+## [WORKER PROGRESS SIGNAL: STARTED ...] \u2014 worker began the task
 
-## [WORKER SIGNAL: PROGRESS ...] \u2014 task is still running
+The task is now running on the identified worker. Informational: call \`skip_reply()\`. Only speak up if you must tell the user something right now (e.g. you changed your mind and want to cancel).
+
+## [WORKER PROGRESS SIGNAL: PROGRESS ...] \u2014 task is still running
 
 Call \`skip_reply()\` as your ONLY action. Do NOT output any text in the same response.
 
@@ -6062,16 +6962,16 @@ WHY: skip_reply terminates the turn immediately. Any text you generate in the sa
 
 The ONLY exception: speak up if the progress indicates an unexpected error or problem.
 
-## [WORKER SIGNAL: COMPLETED ...] \u2014 task is finished
+## [WORKER PROGRESS SIGNAL: COMPLETED ...] \u2014 task is finished
 
 NOW report the result to the user. Summarize concisely.
 If the result says "(max steps reached)" or is empty, be honest \u2014 the task did not fully complete.
 
-## [WORKER SIGNAL: FAILED ...] \u2014 task failed
+## [WORKER PROGRESS SIGNAL: FAILED ...] \u2014 task failed
 
 Explain the error. Suggest a retry or alternative.
 
-## [HEARTBEAT] \u2014 periodic check-in while workers are running
+## [WORKER PROGRESS SIGNAL: HEARTBEAT] \u2014 periodic check-in while workers are running
 
 You were woken up because workers are running but no events arrived for a while.
 Review the worker status in the heartbeat message (runningForMs, last activity, current tool):
@@ -6079,18 +6979,18 @@ Review the worker status in the heartbeat message (runningForMs, last activity,
 - A worker has been running unusually long but activity is recent \u2192 inform the user proactively
 - Everything looks normal \u2192 call skip_reply()
 
-## [PERMISSION REQUEST ...] \u2014 worker needs approval
+## [WORKER PROGRESS SIGNAL: PERMISSION_REQUEST ...] \u2014 worker needs approval
 
 A worker wants to execute a sensitive operation (shell command, file write/edit).
 Review the requested operation carefully. Use respond_permission(requestId, approved, reason) to decide.
 Do NOT call skip_reply for permission requests \u2014 you MUST respond with respond_permission.
 
 CRITICAL RULES:
-- PROGRESS \u2260 COMPLETED. Even if the progress text says "\u5B8C\u6210" or "done", it is still just a progress update. Only [WORKER SIGNAL: COMPLETED] means the task actually finished.
+- PROGRESS \u2260 COMPLETED. Even if the progress text says "\u5B8C\u6210" or "done", it is still just a progress update. Only [WORKER PROGRESS SIGNAL: COMPLETED] means the task actually finished.
 - Do NOT call list_tasks or get_task_detail after receiving a signal. The signal already contains the information.
 - skip_reply is a TERMINAL action \u2014 it ends the turn. You MUST NOT generate any text content in the same response. Your response must contain ONLY the skip_reply tool call and nothing else.
 
-## [PREVIOUS SESSION ...] \u2014 unfinished tasks from the last run
+## [WORKER PROGRESS SIGNAL: PREVIOUS_SESSION_TASKS] \u2014 unfinished tasks from the last run
 
 You resumed a previous session that had unfinished tasks. Workers were NOT automatically resumed \u2014 these tasks are informational only. Decide for each:
 - Still relevant \u2192 re-dispatch with add_task (you can reuse the description).
@@ -6166,18 +7066,18 @@ function buildControllerSystemPrompt(ctx, skills) {
 }
 
 // src/services/agents/prompts/project-rules.ts
-import { existsSync as existsSync6, readFileSync as readFileSync6, statSync as statSync2 } from "fs";
-import { basename as basename2, dirname as dirname4, join as join9, resolve as resolve2 } from "path";
+import { existsSync as existsSync9, readFileSync as readFileSync8, statSync as statSync2 } from "fs";
+import { basename as basename5, dirname as dirname6, join as join14, resolve as resolve3 } from "path";
 var RULE_FILE_NAMES = ["AGENTS.md", "CLAUDE.md"];
 var MAX_LEVELS = 5;
 var PROJECT_RULES_MAX_LENGTH = 8e3;
 function findProjectRules(startDir) {
-  let current = resolve2(startDir);
+  let current = resolve3(startDir);
   for (let level = 0; level < MAX_LEVELS; level++) {
     const found = readRuleFile(current);
     if (found) return found;
-    if (existsSync6(join9(current, ".git"))) break;
-    const parent = dirname4(current);
+    if (existsSync9(join14(current, ".git"))) break;
+    const parent = dirname6(current);
     if (parent === current) break;
     current = parent;
   }
@@ -6185,12 +7085,12 @@ function findProjectRules(startDir) {
 }
 function readRuleFile(dir) {
   for (const name of RULE_FILE_NAMES) {
-    const path7 = join9(dir, name);
+    const path9 = join14(dir, name);
     try {
-      if (!statSync2(path7).isFile()) continue;
-      const content = readFileSync6(path7, "utf8");
+      if (!statSync2(path9).isFile()) continue;
+      const content = readFileSync8(path9, "utf8");
       if (!content.trim()) continue;
-      return { path: path7, content };
+      return { path: path9, content };
     } catch {
     }
   }
@@ -6198,7 +7098,7 @@ function readRuleFile(dir) {
 }
 function buildProjectRulesSection(rules) {
   if (!rules) return "";
-  const name = basename2(rules.path);
+  const name = basename5(rules.path);
   const truncated = rules.content.length > PROJECT_RULES_MAX_LENGTH;
   const content = truncated ? `${rules.content.slice(0, PROJECT_RULES_MAX_LENGTH).trimEnd()}
 
@@ -6357,7 +7257,8 @@ Good: "Created sanwen.txt (218 words, prose about autumn rain)"
 Bad: "Failed"
 Good: "Failed: npm install timed out after 30s, network may be unreachable"`
 );
-function buildWorkerSystemPrompt(ctx, skills) {
+function buildWorkerSystemPrompt(ctx, skills, workspaceDir2) {
+  const workspaceRoot = workspaceDir2 ?? ctx.workspaceDir ?? process.cwd();
   return assemble(
     IDENTITY2,
     LANGUAGE_RULES,
@@ -6367,13 +7268,13 @@ function buildWorkerSystemPrompt(ctx, skills) {
     // Project rules discovered near the task workspace (AGENTS.md, falling
     // back to CLAUDE.md). Empty when no rules file exists — assemble() drops
     // the section, so no empty paragraph leaks into the prompt.
-    buildProjectRulesSection(findProjectRules(ctx.workspaceDir ?? process.cwd())),
+    buildProjectRulesSection(findProjectRules(workspaceRoot)),
     QUALITY_RULES,
     HARD_CONSTRAINTS2,
     CONTROLLER_COMMUNICATION,
     PROGRESS_REPORTING,
     buildSkillCatalog(skills),
-    buildEnvironment(ctx)
+    buildEnvironment(ctx, { workspaceDir: workspaceRoot })
   );
 }
 
@@ -6415,6 +7316,7 @@ var WorkerAgent = class extends BaseAgent {
   state;
   logger;
   _terminalResult = null;
+  /** Workspace this worker executes in — fixed at construction (IWorkerInstance). */
   workspaceDir;
   toolChoice;
   provider;
@@ -6422,17 +7324,30 @@ var WorkerAgent = class extends BaseAgent {
   ctx;
   /** Live tool execution records — merged into entries at step finish. */
   recorder = new ToolCallRecorder();
-  constructor(provider, ctx, skills, toolChoice) {
+  /**
+   * Registry identity of the workspace this worker executes in. Reused for the
+   * `workspaceSlug` stamped on turn envelopes, so a conversation entry is
+   * attributable to a directory even when the task carried no explicit
+   * workspace stamp.
+   */
+  workspaceRef;
+  constructor(provider, ctx, skills, toolChoice, workspaceDir2) {
     super(provider);
     this.provider = provider;
     this.ctx = ctx;
     this.logger = ctx.logger;
-    this.workspaceDir = ctx.workspaceDir;
+    this.workspaceDir = workspaceDir2 ?? ctx.workspaceDir;
     this.toolChoice = toolChoice;
-    this.state = new WorkerState(ctx.sessionDir, this.id, ctx.logger);
+    this.workspaceRef = resolveWorkspaceRef(wayangDirForSessionDir(ctx.sessionDir), this.workspaceDir);
+    this.state = new WorkerState(
+      ctx.sessionDir,
+      this.id,
+      ctx.logger,
+      this.workspaceRef
+    );
     this.contextManager = new ContextManager(
       this.state,
-      buildWorkerSystemPrompt(this.ctx, skills)
+      buildWorkerSystemPrompt(this.ctx, skills, this.workspaceDir)
     );
   }
   /**
@@ -6447,11 +7362,13 @@ var WorkerAgent = class extends BaseAgent {
     this.logger.debug({ task }, "WorkerAgent run called");
     this.state.set("runtimeState.task", { id: task.id, description: task.description });
     this._terminalResult = null;
+    const workspaceSlug = task.workspace?.slug ?? this.workspaceRef?.slug;
     const turnEnv = {
       turnId: task.executionTurnId ?? generateId("turn"),
       ...(task.rootTurnId ?? task.turnId) !== void 0 && { rootTurnId: task.rootTurnId ?? task.turnId },
       causationId: task.id,
-      actor: { kind: "worker", id: task.workerId, taskId: task.id }
+      actor: { kind: "worker", id: task.workerId, taskId: task.id },
+      ...workspaceSlug !== void 0 && { workspaceSlug }
     };
     this.recorder.beginTurn();
     const promptTs = nowISO();
@@ -6560,11 +7477,11 @@ var WorkerAgent = class extends BaseAgent {
     return this.state.get("conversation") ?? [];
   }
   // --- Subscribable ---
-  subscribe(path7, callback) {
-    return this.state.on(path7, callback);
+  subscribe(path9, callback) {
+    return this.state.on(path9, callback);
   }
-  getSnapshot(path7) {
-    return this.state.get(path7);
+  getSnapshot(path9) {
+    return this.state.get(path9);
   }
   /**
    * Accept a message from the controller — writes to internal inbox. The
@@ -6667,6 +7584,257 @@ function toolResultBlockToRecord(block, toolName, endedAt) {
   };
 }
 
+// src/services/tools/permission-rules.ts
+import { resolve as resolve5 } from "path";
+
+// src/infra/permission/policy.ts
+import { realpathSync as realpathSync2 } from "fs";
+import { basename as basename6, dirname as dirname7, isAbsolute, join as join15, resolve as resolve4, sep } from "path";
+var DEFAULT_DENIED_RELATIVE_PATHS = [
+  ".ssh",
+  ".gnupg",
+  ".aws",
+  ".azure",
+  ".gcloud",
+  ".kube",
+  ".docker/config.json",
+  ".netrc",
+  ".git-credentials",
+  ".npmrc",
+  ".pypirc",
+  ".config/gh",
+  ".wayang.config.json",
+  ".wayang"
+];
+var SENSITIVE_SEGMENTS = /* @__PURE__ */ new Set([
+  ".ssh",
+  ".gnupg",
+  ".aws",
+  ".azure",
+  ".gcloud",
+  ".kube",
+  ".netrc",
+  ".git-credentials",
+  ".npmrc",
+  ".pypirc",
+  // The wayang data dir (sessions/conversations) — same intent as the
+  // home-anchored `.wayang` entry, but applied wherever it appears.
+  ".wayang"
+]);
+var SENSITIVE_FILENAMES = /* @__PURE__ */ new Set([
+  ".wayang.config.json"
+]);
+var MAX_ANCESTOR_DEPTH = 32;
+function normalizePath(p, opts = {}) {
+  const base = opts.base ?? process.cwd();
+  const lexical = isAbsolute(p) ? resolve4(p) : resolve4(base, p);
+  try {
+    return realpathSync2(lexical);
+  } catch {
+    return resolveDeepestExistingAncestor(lexical);
+  }
+}
+function resolveDeepestExistingAncestor(lexical) {
+  const peeled = [];
+  let candidate = lexical;
+  for (let depth = 0; depth <= MAX_ANCESTOR_DEPTH; depth += 1) {
+    try {
+      const resolved = realpathSync2(candidate);
+      return peeled.length === 0 ? resolved : resolve4(join15(resolved, ...peeled));
+    } catch {
+    }
+    const parent = dirname7(candidate);
+    if (parent === candidate) break;
+    peeled.unshift(basename6(candidate));
+    candidate = parent;
+  }
+  return lexical;
+}
+function defaultDeniedPaths(homeDir2) {
+  return DEFAULT_DENIED_RELATIVE_PATHS.map((rel) => resolve4(homeDir2, rel));
+}
+function isPathWithin(parent, child) {
+  if (parent === sep) return child.startsWith(sep);
+  if (child === parent) return true;
+  const prefix = parent.endsWith(sep) ? parent : parent + sep;
+  return child.startsWith(prefix);
+}
+function isDenied(absPath, deniedPaths) {
+  return deniedPaths.some((denied) => isPathWithin(denied, absPath));
+}
+function isSensitiveSegmentPath(absPath) {
+  const segments = absPath.split(sep).filter((s) => s.length > 0);
+  for (let i = 0; i < segments.length; i += 1) {
+    const segment = segments[i];
+    if (SENSITIVE_SEGMENTS.has(segment) || SENSITIVE_FILENAMES.has(segment)) {
+      return true;
+    }
+    if (segment === ".docker" && segments[i + 1] === "config.json") {
+      return true;
+    }
+  }
+  return false;
+}
+function normalizeDirs(dirs, base) {
+  if (!dirs) return [];
+  return dirs.filter((d) => typeof d === "string" && d.length > 0).map((d) => normalizePath(d, { base }));
+}
+function findContaining(dirs, target) {
+  return dirs.find((dir) => isPathWithin(dir, target));
+}
+function decideAccess(input2) {
+  const resolvedPath = normalizePath(input2.path, { base: input2.cwd });
+  const homeDir2 = normalizePath(input2.homeDir);
+  const taskWorkspace = input2.taskWorkspace ? normalizePath(input2.taskWorkspace, { base: homeDir2 }) : void 0;
+  const taskAllowedDirs = normalizeDirs(input2.taskAllowedDirs, taskWorkspace ?? homeDir2);
+  const configAllowedDirs = normalizeDirs(input2.configAllowedDirs, homeDir2);
+  const autoAllowRoots = normalizeDirs(input2.autoAllowRoots, homeDir2);
+  const deniedPaths = [
+    ...defaultDeniedPaths(homeDir2),
+    ...normalizeDirs(input2.extraDeniedDirs, homeDir2)
+  ].map((d) => normalizePath(d));
+  if (isSensitiveSegmentPath(resolvedPath)) {
+    return { decision: "deny", matchedRule: "denylist", resolvedPath };
+  }
+  if (isDenied(resolvedPath, deniedPaths)) {
+    return { decision: "deny", matchedRule: "denylist", resolvedPath };
+  }
+  if (findContaining(configAllowedDirs, resolvedPath) !== void 0) {
+    return { decision: "allow", matchedRule: "config-allowed", resolvedPath };
+  }
+  if (findContaining(autoAllowRoots, resolvedPath) !== void 0) {
+    return { decision: "allow", matchedRule: "auto-allow-root", resolvedPath };
+  }
+  if (findContaining(taskAllowedDirs, resolvedPath) !== void 0) {
+    return { decision: "allow", matchedRule: "task-allowed", resolvedPath };
+  }
+  if (taskWorkspace !== void 0 && isPathWithin(taskWorkspace, resolvedPath)) {
+    return { decision: "allow", matchedRule: "task-workspace", resolvedPath };
+  }
+  if (input2.access === "read" && isPathWithin(homeDir2, resolvedPath)) {
+    return { decision: "allow", matchedRule: "read-within-home", resolvedPath, withinReadScope: true };
+  }
+  return { decision: "ask", matchedRule: "outside-all", resolvedPath };
+}
+
+// src/services/tools/permission-rules.ts
+var FILE_TOOL_NAMES = ["read_file", "write_file", "edit_file", "search_files", "search_content"];
+var READ_ONLY_FILE_TOOLS = /* @__PURE__ */ new Set(["read_file", "search_files", "search_content"]);
+var DANGEROUS_BASH_PATTERN = /(?:^|\||;|&&)\s*(?:rm\s|sudo\b|chmod\b|chown\b|mkfs\b|dd\s|shutdown\b|reboot\b|kill\s+-9)/;
+var URL_RE = /[a-zA-Z][a-zA-Z0-9+.-]*:\/\/\S+/g;
+function expandHome(p, homeDir2) {
+  if (p === "~") return { path: homeDir2, unresolvable: false };
+  if (p.startsWith("~/")) return { path: resolve5(homeDir2, p.slice(2)), unresolvable: false };
+  if (p.startsWith("~")) return { path: p, unresolvable: true };
+  return { path: p, unresolvable: false };
+}
+function expandHomeVars(command, homeDir2) {
+  return command.replace(/\$\{HOME\}/g, homeDir2).replace(/\$HOME(?![A-Za-z0-9_])/g, homeDir2);
+}
+function detectUnsafeDynamicTarget(command) {
+  if (command.includes("`")) return "command substitution (backticks)";
+  if (/\$\(/.test(command)) return "command substitution ($(...))";
+  if (hasOutputRedirection(command)) return "output redirection";
+  return void 0;
+}
+function hasOutputRedirection(command) {
+  return /(?:^|[^<>])>>?\s*(?!&)\S/.test(command);
+}
+function extractPathCandidates(command) {
+  const withoutUrls = command.replace(URL_RE, " ");
+  const candidates = [];
+  for (const raw of withoutUrls.split(/[\s=;|&]+/)) {
+    const word = raw.replace(/^['"]+/, "").replace(/['",;|&()<>'`]+$/, "");
+    if (word.startsWith("/") || word.startsWith("~")) candidates.push(word);
+  }
+  return candidates;
+}
+function decidePath(scope, path9, access) {
+  return decideAccess({
+    path: path9,
+    access,
+    cwd: scope.workspace,
+    homeDir: scope.homeDir,
+    taskWorkspace: scope.workspace,
+    taskAllowedDirs: scope.taskAllowedDirs,
+    configAllowedDirs: scope.permission?.allowedDirs,
+    autoAllowRoots: scope.permission?.autoAllowRoots,
+    extraDeniedDirs: scope.permission?.deniedDirs
+  });
+}
+function evaluateFileAccess(scope, toolName, args) {
+  const rawPath = args.path;
+  if (typeof rawPath !== "string" || !rawPath) return { decision: "allow", matchedRule: "no-path" };
+  const access = READ_ONLY_FILE_TOOLS.has(toolName) ? "read" : "write";
+  const expanded = expandHome(rawPath, scope.homeDir);
+  if (expanded.unresolvable) {
+    return {
+      decision: "ask",
+      matchedRule: "home-other-user",
+      reason: "`~user` names another user's home directory, which cannot be resolved safely"
+    };
+  }
+  const verdict = decidePath(scope, expanded.path, access);
+  if (verdict.decision === "allow" && verdict.withinReadScope) {
+    return { decision: "ask", matchedRule: "read-within-home" };
+  }
+  return { decision: verdict.decision, matchedRule: verdict.matchedRule };
+}
+function evaluateBashAccess(scope, command) {
+  const expandedCommand = expandHomeVars(command, scope.homeDir);
+  const candidates = [];
+  let hasUnresolvableHome = false;
+  for (const raw of extractPathCandidates(expandedCommand)) {
+    const expanded = expandHome(raw, scope.homeDir);
+    if (expanded.unresolvable) {
+      hasUnresolvableHome = true;
+      continue;
+    }
+    candidates.push(expanded.path);
+  }
+  let firstAsk;
+  let firstAllow;
+  for (const candidate of candidates) {
+    const verdict = decidePath(scope, candidate, "write");
+    if (verdict.decision === "deny") return verdict;
+    if (verdict.decision === "ask") firstAsk ??= verdict;
+    else firstAllow ??= verdict;
+  }
+  if (DANGEROUS_BASH_PATTERN.test(expandedCommand)) {
+    return { decision: "ask", matchedRule: "dangerous-bash" };
+  }
+  const dynamic = detectUnsafeDynamicTarget(expandedCommand);
+  if (dynamic) return { decision: "ask", matchedRule: "dynamic-shell", reason: dynamic };
+  if (hasUnresolvableHome) {
+    return {
+      decision: "ask",
+      matchedRule: "home-other-user",
+      reason: "`~user` names another user's home directory, which cannot be resolved safely"
+    };
+  }
+  if (firstAsk) return firstAsk;
+  return firstAllow ?? { decision: "allow", matchedRule: "no-path" };
+}
+function denyMessage(toolName, requestedPath) {
+  if (toolName === "bash") {
+    return "[ERROR] bash: refusing to run this command \u2014 it touches a path on the deny list (a sensitive location).";
+  }
+  const target = requestedPath ? ` "${requestedPath}"` : "";
+  return `[ERROR] ${toolName}: refusing access to${target} \u2014 the path is on the deny list (a sensitive location).`;
+}
+function decideToolAccess(scope, toolName, args) {
+  let verdict;
+  if (toolName === "bash") {
+    verdict = evaluateBashAccess(scope, typeof args.command === "string" ? args.command : "");
+  } else if (FILE_TOOL_NAMES.includes(toolName)) {
+    verdict = evaluateFileAccess(scope, toolName, args);
+  } else {
+    return { decision: "allow", matchedRule: "no-path" };
+  }
+  if (verdict.decision !== "deny") return verdict;
+  return { ...verdict, message: denyMessage(toolName, typeof args.path === "string" ? args.path : void 0) };
+}
+
 // src/infra/blocking-requests.ts
 var BlockingRequestMap = class {
   pending = /* @__PURE__ */ new Map();
@@ -6678,14 +7846,14 @@ var BlockingRequestMap = class {
     if (this.pending.has(id)) {
       throw new Error(`BlockingRequestMap: duplicate wait id "${id}"`);
     }
-    return new Promise((resolve12) => {
+    return new Promise((resolve13) => {
       const settle = (value) => {
         this.pending.delete(id);
-        resolve12(value);
+        resolve13(value);
       };
       const timer = setTimeout(() => {
         this.pending.delete(id);
-        resolve12(makeTimeoutValue());
+        resolve13(makeTimeoutValue());
       }, timeoutMs);
       if (typeof timer === "object" && timer && "unref" in timer) {
         timer.unref();
@@ -6713,11 +7881,14 @@ var BlockingRequestMap = class {
 };
 
 // src/services/agents/claude-code-worker.ts
+import { basename as basename7, dirname as dirname8 } from "path";
+import { homedir } from "os";
 var INQUIRY_STREAM_CLOSE_TIMEOUT_MS = 36e4;
 var ClaudeCodeWorker = class _ClaudeCodeWorker {
   id;
   config;
   state;
+  /** Workspace this worker executes in — fixed at construction (IWorkerInstance). */
   workspaceDir;
   logger;
   abortController = new AbortController();
@@ -6773,6 +7944,16 @@ var ClaudeCodeWorker = class _ClaudeCodeWorker {
   // Signal context set during run()
   _signalQueue = null;
   _runContext = null;
+  /**
+   * Shared permission policy scope for this run (workspace, task allowedDirs,
+   * homeDir, config). Provided by the engine via setSignalContext so the
+   * canUseTool callback judges access exactly like a puppet worker's
+   * permission middleware does. Null until wired; a fallback scope derived
+   * from the worker's own directory is used when absent.
+   */
+  _accessScope = null;
+  /** Session directory this worker belongs to (fallback homeDir derivation). */
+  sessionDir;
   /** Turn lineage for permission-request signals emitted by this worker. */
   _turnLineage = {};
   /** Turn lineage stamped on entries written by the run in flight. */
@@ -6783,11 +7964,13 @@ var ClaudeCodeWorker = class _ClaudeCodeWorker {
    * the direct cause of this activation.
    */
   buildTurnEnv(task) {
+    const workspaceSlug = task.workspace?.slug ?? this.workspaceRef?.slug;
     return {
       turnId: task.executionTurnId ?? generateId("turn"),
       ...(task.rootTurnId ?? task.turnId) !== void 0 && { rootTurnId: task.rootTurnId ?? task.turnId },
       causationId: task.id,
-      actor: { kind: "worker", id: task.workerId, taskId: task.id }
+      actor: { kind: "worker", id: task.workerId, taskId: task.id },
+      ...workspaceSlug !== void 0 && { workspaceSlug }
     };
   }
   /**
@@ -6805,14 +7988,27 @@ var ClaudeCodeWorker = class _ClaudeCodeWorker {
   _pendingProgress = null;
   ctx;
   skills;
+  /**
+   * Registry identity of the workspace this worker executes in, resolved once
+   * at construction. Feeds the `workspaceSlug` on turn envelopes (and the
+   * runtime-state stamp) so entries stay attributable to a directory.
+   */
+  workspaceRef;
   constructor(config, sessionDir, workspaceDir2, ctx, skills) {
     this.id = generateId("cw");
     this.ctx = ctx;
     this.config = config;
     this.workspaceDir = workspaceDir2;
+    this.sessionDir = sessionDir;
     this.logger = ctx.logger;
     this.skills = skills;
-    this.state = new WorkerState(sessionDir, this.id, ctx.logger);
+    this.workspaceRef = resolveWorkspaceRef(wayangDirForSessionDir(sessionDir), workspaceDir2);
+    this.state = new WorkerState(
+      sessionDir,
+      this.id,
+      ctx.logger,
+      this.workspaceRef
+    );
   }
   async run(task, _tools, onProgress) {
     this._terminalResult = null;
@@ -6925,6 +8121,7 @@ var ClaudeCodeWorker = class _ClaudeCodeWorker {
     this._signalQueue = deps.signalQueue;
     this._runContext = deps;
     this._turnLineage = deps.turnLineage ?? {};
+    this._accessScope = deps.accessScope ?? null;
   }
   abort() {
     this.abortController.abort();
@@ -6949,11 +8146,11 @@ var ClaudeCodeWorker = class _ClaudeCodeWorker {
     return this.state.get("conversation") ?? [];
   }
   // --- Subscribable ---
-  subscribe(path7, callback) {
-    return this.state.on(path7, callback);
+  subscribe(path9, callback) {
+    return this.state.on(path9, callback);
   }
-  getSnapshot(path7) {
-    return this.state.get(path7);
+  getSnapshot(path9) {
+    return this.state.get(path9);
   }
   /**
    * Accept a message from the controller. The message is queued and handed
@@ -6993,18 +8190,107 @@ var ClaudeCodeWorker = class _ClaudeCodeWorker {
     this._askController = ask;
   }
   // --- Permission control via canUseTool ---
-  /** Dangerous command patterns that require controller approval. */
-  static DANGEROUS_COMMAND_PATTERN = /\b(rm\s|sudo\b|chmod\b|chown\b|mkfs\b|dd\s|shutdown\b|reboot\b|kill\s+-9)/;
+  /**
+   * SDK tool name → the canonical tool the shared permission policy judges.
+   * Claude Code's file tools carry their target in a tool-specific field; this
+   * maps each to one of the policy's file tool names plus the path key to read.
+   * `Bash` is handled separately (its command string goes through the bash rule).
+   */
+  static SDK_FILE_TOOL_MAP = {
+    Read: { policyTool: "read_file", pathKey: "file_path", pathRequired: true },
+    Write: { policyTool: "write_file", pathKey: "file_path", pathRequired: true },
+    Edit: { policyTool: "edit_file", pathKey: "file_path", pathRequired: true },
+    NotebookEdit: { policyTool: "edit_file", pathKey: "notebook_path", pathRequired: true },
+    // Search tools default to the workspace when no path is given.
+    Glob: { policyTool: "search_files", pathKey: "path", pathRequired: false },
+    Grep: { policyTool: "search_content", pathKey: "path", pathRequired: false }
+  };
+  /**
+   * SDK tools that touch no filesystem path the policy could judge (todo list,
+   * web access, sub-agents, MCP resources, worktrees). Their puppet counterparts
+   * are not gated either, so they are allowed without an approval.
+   */
+  static SDK_NON_PATH_TOOLS = /* @__PURE__ */ new Set([
+    "Agent",
+    "Task",
+    "TaskOutput",
+    "TaskStop",
+    "KillShell",
+    "KillTask",
+    "ExitPlanMode",
+    "TodoWrite",
+    "WebFetch",
+    "WebSearch",
+    "AskUserQuestion",
+    "ListMcpResources",
+    "ReadMcpResource",
+    "Mcp",
+    "Config",
+    "EnterWorktree",
+    "ExitWorktree"
+  ]);
+  /**
+   * Shared policy scope for this run. The engine injects the exact scope it
+   * applies to puppet workers; when a worker is driven directly (tests), derive
+   * a minimal scope from its own directory (no task allowedDirs / config — the
+   * conservative reading).
+   */
+  effectiveAccessScope() {
+    if (this._accessScope) return this._accessScope;
+    const wayangDir = wayangDirForSessionDir(this.sessionDir);
+    const homeDir2 = wayangDir && basename7(wayangDir) === ".wayang" ? dirname8(wayangDir) : homedir();
+    return { homeDir: homeDir2, workspace: this.workspaceDir };
+  }
+  /**
+   * Route a Claude Code tool call through the SAME access policy a puppet
+   * worker uses (`decideToolAccess`). A denylisted path is denied outright
+   * (no approval prompt); an ambiguous target asks the controller; a path
+   * inside the allowed scope runs immediately. This closes the parity gap where
+   * the old regex-only gate let denylisted paths through silently.
+   */
   async handleCanUseTool(toolName, input2) {
-    if (toolName !== "Bash" || !this._signalQueue || !this._runContext) {
+    if (!this._signalQueue || !this._runContext) {
+      return { behavior: "allow" };
+    }
+    const scope = this.effectiveAccessScope();
+    if (toolName === "Bash") {
+      const verdict = decideToolAccess(scope, "bash", { command: String(input2.command ?? "") });
+      if (verdict.decision === "deny") {
+        return { behavior: "deny", message: verdict.message ?? "Denied by the permission policy" };
+      }
+      if (verdict.decision === "ask") return this.requestPermission(toolName, input2, verdict.reason);
+      return { behavior: "allow" };
+    }
+    const fileTool = _ClaudeCodeWorker.SDK_FILE_TOOL_MAP[toolName];
+    if (fileTool) {
+      const rawPath = input2[fileTool.pathKey];
+      if (typeof rawPath !== "string" || rawPath.length === 0) {
+        if (fileTool.pathRequired) {
+          return this.requestPermission(toolName, input2, "the target path could not be determined");
+        }
+        return { behavior: "allow" };
+      }
+      const verdict = decideToolAccess(scope, fileTool.policyTool, { path: rawPath });
+      if (verdict.decision === "deny") {
+        return { behavior: "deny", message: verdict.message ?? "Denied by the permission policy" };
+      }
+      if (verdict.decision === "ask") return this.requestPermission(toolName, input2, verdict.reason);
       return { behavior: "allow" };
     }
-    const command = String(input2.command ?? "");
-    if (!_ClaudeCodeWorker.DANGEROUS_COMMAND_PATTERN.test(command)) {
+    if (_ClaudeCodeWorker.SDK_NON_PATH_TOOLS.has(toolName)) {
       return { behavior: "allow" };
     }
+    return this.requestPermission(toolName, input2, "the tool is not recognized by the permission policy");
+  }
+  /**
+   * Emit a permission_request and block until the controller answers (or it
+   * times out → deny). Shared by every `ask` verdict so the request flow stays
+   * identical to the puppet worker's.
+   */
+  async requestPermission(toolName, input2, reason) {
+    if (!this._signalQueue || !this._runContext) return { behavior: "allow" };
     const requestId = generateId("perm");
-    const description = `Execute shell command: ${command}`;
+    const description = this.describePermissionRequest(toolName, input2, reason);
     this._signalQueue.enqueue({
       source: "worker",
       type: "permission_request",
@@ -7025,6 +8311,22 @@ var ClaudeCodeWorker = class _ClaudeCodeWorker {
       return { behavior: "deny", message: "Permission request timed out" };
     });
   }
+  /** Human-readable summary of a gated call for the approval prompt. */
+  describePermissionRequest(toolName, input2, reason) {
+    let detail;
+    if (toolName === "Bash") {
+      detail = `Execute shell command: ${String(input2.command ?? "")}`;
+    } else if (typeof input2.file_path === "string") {
+      detail = `${toolName}: ${input2.file_path}`;
+    } else if (typeof input2.notebook_path === "string") {
+      detail = `${toolName}: ${input2.notebook_path}`;
+    } else if (typeof input2.path === "string") {
+      detail = `${toolName}: ${input2.path}`;
+    } else {
+      detail = `${toolName}: ${JSON.stringify(input2)}`;
+    }
+    return reason ? `${detail} (${reason})` : detail;
+  }
   // --- Prompt as AsyncIterable (supports follow-up messages) ---
   buildPromptIterable(initialPrompt) {
     return {
@@ -7059,8 +8361,8 @@ ${leftoverText}` : `${buildThirdPartyPrompt(this.skills)}${initialPrompt}`;
                   return { value: void 0, done: true };
                 }
               } else if (this._messageQueue.length === 0) {
-                await new Promise((resolve12) => {
-                  this._messageResolve = resolve12;
+                await new Promise((resolve13) => {
+                  this._messageResolve = resolve13;
                 });
                 continue;
               }
@@ -7300,9 +8602,9 @@ controller: ${answer}`,
       };
     }
     if (this._messageResolve) {
-      const resolve12 = this._messageResolve;
+      const resolve13 = this._messageResolve;
       this._messageResolve = null;
-      resolve12();
+      resolve13();
     }
     const prev = this.state.get("runtimeState");
     this.state.set("runtimeState", {
@@ -7329,6 +8631,154 @@ controller: ${answer}`,
 
 // src/services/tools/add-task.ts
 import { z as z3 } from "zod";
+
+// src/services/tools/workspace-rules.ts
+import { readFileSync as readFileSync9, statSync as statSync3 } from "fs";
+import { join as join16 } from "path";
+var RULE_FILE_NAMES2 = ["AGENTS.md", "CLAUDE.md"];
+var WORKSPACE_RULES_MAX_LINES = 40;
+var WORKSPACE_RULES_MAX_CHARS = 2e3;
+function buildWorkspaceRulesSummary(input2) {
+  const workspacePath = input2.workspacePath;
+  if (!workspacePath) return "";
+  for (const name of RULE_FILE_NAMES2) {
+    const rulesPath = join16(workspacePath, name);
+    if (!isRegularFile(rulesPath)) continue;
+    const header = `Workspace rules (from ${rulesPath}):`;
+    const refusal = describeRefusal(rulesPath, workspacePath, input2);
+    if (refusal !== null) return `${header}
+${refusal}`;
+    const content = readTextFile(rulesPath);
+    if (content === null) {
+      return `${header}
+unavailable \u2014 the file exists but could not be read.`;
+    }
+    if (content.trim() === "") continue;
+    return `${header}
+${summarizeRules(content)}`;
+  }
+  return "";
+}
+function describeRefusal(rulesPath, workspacePath, input2) {
+  const homeDir2 = input2.homeDir;
+  if (!homeDir2) {
+    return "unavailable \u2014 the permission policy cannot be evaluated here (no home directory in this context), so the file was not read.";
+  }
+  const { decision } = decideAccess({
+    access: "read",
+    path: rulesPath,
+    cwd: workspacePath,
+    homeDir: homeDir2,
+    taskWorkspace: workspacePath,
+    extraDeniedDirs: input2.permissionConfig?.deniedDirs
+  });
+  if (decision === "deny") {
+    return "unavailable \u2014 the file resolves to a denied location (a sensitive one such as credentials or tool config), so its content was not read.";
+  }
+  if (decision === "ask") {
+    return "unavailable \u2014 reading it was not approved by the permission policy (the path is outside the readable scope), so its content was not read.";
+  }
+  return null;
+}
+function summarizeRules(content) {
+  const lines = content.replace(/\r\n/g, "\n").trimEnd().split("\n");
+  let body = lines.slice(0, WORKSPACE_RULES_MAX_LINES).join("\n");
+  const cutByChars = body.length > WORKSPACE_RULES_MAX_CHARS;
+  if (cutByChars) body = body.slice(0, WORKSPACE_RULES_MAX_CHARS).trimEnd();
+  const shownLines = body === "" ? 0 : body.split("\n").length;
+  const remainingLines = lines.length - shownLines;
+  if (remainingLines > 0) {
+    const unit = remainingLines === 1 ? "line" : "lines";
+    return `${body}
+... truncated (${remainingLines} more ${unit})`;
+  }
+  if (cutByChars) {
+    return `${body}
+... truncated (content exceeded ${WORKSPACE_RULES_MAX_CHARS} characters)`;
+  }
+  return body;
+}
+function isRegularFile(p) {
+  try {
+    return statSync3(p).isFile();
+  } catch {
+    return false;
+  }
+}
+function readTextFile(p) {
+  try {
+    return readFileSync9(p, "utf8");
+  } catch {
+    return null;
+  }
+}
+
+// src/services/tools/add-task.ts
+function resolveTaskWorkspace(requested, deps) {
+  const current = deps.workspaceDir;
+  const requestedPath = requested !== void 0 && requested.trim() !== "" ? normalizeWorkspacePath(requested) : void 0;
+  if (!current) {
+    if (requestedPath !== void 0) {
+      return {
+        error: `Cannot resolve workspace ${requestedPath}: the current workspace is unknown in this context, so the task was NOT created.`
+      };
+    }
+    return {};
+  }
+  const targetPath = requestedPath ?? normalizeWorkspacePath(current);
+  const ref = resolveWorkspaceRef(deps.wayangDir ?? null, targetPath);
+  return { workspace: { path: ref.path, slug: ref.slug } };
+}
+function resolveTaskAllowedDirs(requested, workspacePath, deps) {
+  if (requested === void 0 || requested.length === 0) return {};
+  const homeDir2 = deps.homeDir;
+  if (!homeDir2) {
+    return {
+      error: "Cannot validate allowedDirs: the home directory is unknown in this context, so the task was NOT created."
+    };
+  }
+  const home = normalizePath(homeDir2);
+  const base = workspacePath !== void 0 ? normalizePath(workspacePath, { base: home }) : home;
+  const deniedPaths = [
+    ...defaultDeniedPaths(home),
+    ...(deps.permissionConfig?.deniedDirs ?? []).filter((d) => typeof d === "string" && d.length > 0).map((d) => normalizePath(d, { base: home }))
+  ].map((d) => normalizePath(d));
+  const seen = /* @__PURE__ */ new Set();
+  const allowedDirs = [];
+  for (const raw of requested) {
+    if (typeof raw !== "string" || raw.trim() === "") {
+      return {
+        error: `Invalid allowedDirs entry ${JSON.stringify(raw)}: expected a non-empty directory path. The task was NOT created.`
+      };
+    }
+    const resolved = normalizePath(raw, { base });
+    if (!isPathWithin(home, resolved)) {
+      return {
+        error: `Invalid allowedDirs entry "${raw}" (resolved to ${resolved}): it is outside the home directory (${home}). Only directories under home can be granted to a task. The task was NOT created.`
+      };
+    }
+    if (isDenied(resolved, deniedPaths)) {
+      return {
+        error: `Invalid allowedDirs entry "${raw}" (resolved to ${resolved}): it matches the denied-path list (a sensitive location such as credentials or tool config). The task was NOT created.`
+      };
+    }
+    if (!seen.has(resolved)) {
+      seen.add(resolved);
+      allowedDirs.push(resolved);
+    }
+  }
+  return allowedDirs.length > 0 ? { allowedDirs } : {};
+}
+function withWorkspaceRules(resultText, workspacePath, deps) {
+  const summary = buildWorkspaceRulesSummary({
+    workspacePath,
+    homeDir: deps.homeDir,
+    permissionConfig: deps.permissionConfig
+  });
+  return summary === "" ? resultText : `${resultText}
+
+${summary}`;
+}
 function addTaskTool(deps) {
   return defineTool({
     description: "Add a new task to the queue. A Worker will execute it automatically.",
@@ -7342,10 +8792,25 @@ function addTaskTool(deps) {
       ),
       assignToWorker: z3.string().optional().describe(
         "Dispatch this task to an existing idle worker (the workerId returned from a prior multiStage task). The worker resumes with its accumulated context. Omit for a fresh worker."
+      ),
+      workspace: z3.string().optional().describe(
+        "Target workspace path; defaults to the current workspace. A different path runs this task there \u2014 the worker, its tools and its permission checks use it as their root."
+      ),
+      allowedDirs: z3.array(z3.string()).optional().describe(
+        "Extra directories this task may access, in addition to its workspace. Only this task is affected \u2014 the grant is NOT inherited by other tasks. Each entry must be inside the user home and off the denied-path list (credentials, tool config); an invalid entry fails the whole call and no task is created. Paths are normalized; relative entries resolve against the task workspace."
       )
     }),
-    execute: safeExecute("add_task", async ({ title, description, priority, workerType, multiStage, assignToWorker }, options) => {
+    execute: safeExecute("add_task", async ({ title, description, priority, workerType, multiStage, assignToWorker, workspace, allowedDirs }, options) => {
       const resolvedType = workerType || "puppet";
+      const workspaceResolution = resolveTaskWorkspace(workspace, deps);
+      if ("error" in workspaceResolution) return workspaceResolution.error;
+      const allowedDirsResolution = resolveTaskAllowedDirs(
+        allowedDirs,
+        workspaceResolution.workspace?.path ?? deps.workspaceDir,
+        deps
+      );
+      if ("error" in allowedDirsResolution) return allowedDirsResolution.error;
+      const targetWorkspacePath = workspaceResolution.workspace?.path ?? deps.workspaceDir;
       if (deps.validateWorkerType) {
         const err = deps.validateWorkerType(resolvedType);
         if (err) return err;
@@ -7356,6 +8821,10 @@ function addTaskTool(deps) {
         }
         const err = deps.validateIdleWorker(assignToWorker);
         if (err) return err;
+        if (targetWorkspacePath !== void 0 && deps.validateWorkerWorkspace) {
+          const wsErr = deps.validateWorkerWorkspace(assignToWorker, targetWorkspacePath);
+          if (wsErr) return wsErr;
+        }
       }
       const toolCallId = options?.toolCallId;
       const turnCtx = deps.getTurnContext?.();
@@ -7369,6 +8838,8 @@ function addTaskTool(deps) {
         createdAt: Date.now(),
         multiStage,
         assignToWorker,
+        ...workspaceResolution.workspace !== void 0 && { workspace: workspaceResolution.workspace },
+        ...allowedDirsResolution.allowedDirs !== void 0 && { taskAllowedDirs: allowedDirsResolution.allowedDirs },
         ...turnCtx?.turnId !== void 0 && { turnId: turnCtx.turnId },
         ...turnCtx?.rootTurnId !== void 0 && { rootTurnId: turnCtx.rootTurnId },
         ...(toolCallId ?? turnCtx?.causationId) !== void 0 && { causationId: toolCallId ?? turnCtx?.causationId }
@@ -7377,12 +8848,27 @@ function addTaskTool(deps) {
         const ok = deps.assignToWorker(assignToWorker, task);
         if (ok) deps.onTaskDispatched?.({ toolCallId, taskId: task.id });
         else return `Worker ${assignToWorker} could not accept the task (no longer idle?).`;
-        return `Task ${task.id} assigned to worker ${assignToWorker} (reusing its context, priority: ${priority}, worker: ${resolvedType}). You will be notified when the task completes.`;
+        return withWorkspaceRules(
+          `Task ${task.id} assigned to worker ${assignToWorker} (reusing its context, priority: ${priority}, worker: ${resolvedType}). You will be notified when the task completes.`,
+          targetWorkspacePath,
+          deps
+        );
       }
-      deps.addTask(task);
+      const workerId = deps.addTask(task);
       deps.onTaskDispatched?.({ toolCallId, taskId: task.id });
       const stageNote = multiStage ? " [multi-stage: worker will idle after completion]" : "";
-      return `Task ${task.id} added (priority: ${priority}, worker: ${task.workerType})${stageNote}. You will be notified when the task completes.`;
+      if (workerId !== void 0) {
+        return withWorkspaceRules(
+          `Task ${task.id} added (priority: ${priority}, workerType: ${task.workerType}, workerId: ${workerId})${stageNote}. The worker has started; you will be notified of progress and completion.`,
+          targetWorkspacePath,
+          deps
+        );
+      }
+      return withWorkspaceRules(
+        `Task ${task.id} added (priority: ${priority}, workerType: ${task.workerType})${stageNote}. All concurrency slots are busy \u2014 the task is queued and will start automatically when a slot frees (a STARTED signal will name its worker). You will be notified when the task completes.`,
+        targetWorkspacePath,
+        deps
+      );
     })
   });
 }
@@ -7398,9 +8884,11 @@ function listTasksTool(deps) {
     execute: safeExecute("list_tasks", async ({ status }) => {
       const tasks = deps.listTasks(status);
       if (tasks.length === 0) return status ? `No ${status} tasks` : "No tasks";
-      return tasks.map(
-        (t) => `[${t.status}] ${t.id}: ${t.description}${t.result ? ` \u2192 ${t.result}` : ""}${t.error ? ` \u2717 ${t.error}` : ""}`
-      ).join("\n");
+      return tasks.map((t) => {
+        const scope = t.workspace ? `, ws: ${t.workspace.slug}` : "";
+        const dirs = t.taskAllowedDirs && t.taskAllowedDirs.length > 0 ? `, dirs: ${t.taskAllowedDirs.join(", ")}` : "";
+        return `[${t.status}] ${t.id} (worker: ${t.workerSessionId ?? "none"}${scope}${dirs}): ${t.description}${t.result ? ` \u2192 ${t.result}` : ""}${t.error ? ` \u2717 ${t.error}` : ""}`;
+      }).join("\n");
     })
   });
 }
@@ -7471,6 +8959,10 @@ function getTaskDetailTool(deps) {
       if (task.result) lines.push(`Result: ${task.result}`);
       if (task.error) lines.push(`Error: ${task.error}`);
       if (task.workerSessionId) lines.push(`Worker: ${task.workerSessionId}`);
+      if (task.workspace) lines.push(`Workspace: ${task.workspace.path} (slug: ${task.workspace.slug})`);
+      if (task.taskAllowedDirs && task.taskAllowedDirs.length > 0) {
+        lines.push(`Allowed dirs: ${task.taskAllowedDirs.join(", ")}`);
+      }
       const isFull = full === true;
       const requestedLimit = limit ?? DEFAULT_LIMIT;
       let entries = [];
@@ -7870,8 +9362,8 @@ ${detail}`;
 
 // src/services/tools/read-file.ts
 import { z as z14 } from "zod";
-import { readFileSync as readFileSync7 } from "fs";
-import { resolve as resolve3 } from "path";
+import { readFileSync as readFileSync10 } from "fs";
+import { resolve as resolve6 } from "path";
 var DEFAULT_MAX_LINES = 500;
 function readFileTool(deps = {}) {
   const workspace = deps.cwd ?? process.cwd();
@@ -7882,9 +9374,9 @@ function readFileTool(deps = {}) {
       offset: z14.number().int().min(1).optional().describe("Start line number (1-based)"),
       limit: z14.number().int().min(1).optional().describe("Number of lines to read")
     }),
-    execute: safeExecute("read_file", async ({ path: path7, offset, limit }) => {
-      const resolved = resolve3(workspace, path7);
-      const content = readFileSync7(resolved, "utf-8");
+    execute: safeExecute("read_file", async ({ path: path9, offset, limit }) => {
+      const resolved = resolve6(workspace, path9);
+      const content = readFileSync10(resolved, "utf-8");
       const lines = content.split("\n");
       const totalLines = lines.length;
       const start = offset ? offset - 1 : 0;
@@ -7904,8 +9396,8 @@ function readFileTool(deps = {}) {
 
 // src/services/tools/write-file.ts
 import { z as z15 } from "zod";
-import { writeFileSync as writeFileSync3, mkdirSync as mkdirSync4, existsSync as existsSync7 } from "fs";
-import { dirname as dirname5, resolve as resolve4 } from "path";
+import { writeFileSync as writeFileSync4, mkdirSync as mkdirSync6, existsSync as existsSync10 } from "fs";
+import { dirname as dirname9, resolve as resolve7 } from "path";
 function writeFileTool(deps = {}) {
   const workspace = deps.cwd ?? process.cwd();
   return defineTool({
@@ -7914,21 +9406,21 @@ function writeFileTool(deps = {}) {
       path: z15.string().describe("File path (relative to workspace or absolute)"),
       content: z15.string().describe("File content")
     }),
-    execute: safeExecute("write_file", async ({ path: path7, content }) => {
-      const resolved = resolve4(workspace, path7);
-      if (existsSync7(resolved)) {
-        return `[ERROR] write_file: File already exists: ${path7}. Use edit_file to modify existing files.`;
+    execute: safeExecute("write_file", async ({ path: path9, content }) => {
+      const resolved = resolve7(workspace, path9);
+      if (existsSync10(resolved)) {
+        return `[ERROR] write_file: File already exists: ${path9}. Use edit_file to modify existing files.`;
       }
-      mkdirSync4(dirname5(resolved), { recursive: true });
-      writeFileSync3(resolved, content, "utf-8");
+      mkdirSync6(dirname9(resolved), { recursive: true });
+      writeFileSync4(resolved, content, "utf-8");
       return `Written ${content.length} chars to ${resolved}`;
     })
   });
 }
 
 // src/services/tools/edit-file.ts
-import { readFileSync as readFileSync8, writeFileSync as writeFileSync4 } from "fs";
-import { resolve as resolve5 } from "path";
+import { readFileSync as readFileSync11, writeFileSync as writeFileSync5 } from "fs";
+import { resolve as resolve8 } from "path";
 import { z as z16 } from "zod";
 function editFileTool(deps) {
   const workspace = deps.cwd ?? process.cwd();
@@ -7939,40 +9431,55 @@ function editFileTool(deps) {
       old_string: z16.string().describe("Exact text to find (must be unique in file)"),
       new_string: z16.string().describe("Replacement text")
     }),
-    execute: safeExecute("edit_file", async ({ path: path7, old_string, new_string }) => {
-      const resolved = resolve5(workspace, path7);
+    execute: safeExecute("edit_file", async ({ path: path9, old_string, new_string }) => {
+      const resolved = resolve8(workspace, path9);
       let content;
       try {
-        content = readFileSync8(resolved, "utf-8");
+        content = readFileSync11(resolved, "utf-8");
       } catch {
-        return `[ERROR] edit_file: File not found: ${path7}`;
+        return `[ERROR] edit_file: File not found: ${path9}`;
       }
       const count = content.split(old_string).length - 1;
       if (count === 0)
-        return `[ERROR] edit_file: old_string not found in ${path7}, read the file content and provide a correct old_string.`;
+        return `[ERROR] edit_file: old_string not found in ${path9}, read the file content and provide a correct old_string.`;
       if (count > 1)
-        return `[ERROR] edit_file: old_string found ${count} times in ${path7}. Provide more surrounding context to make it unique.`;
+        return `[ERROR] edit_file: old_string found ${count} times in ${path9}. Provide more surrounding context to make it unique.`;
       const newContent = content.replace(old_string, new_string);
-      writeFileSync4(resolved, newContent, "utf-8");
-      return `Replaced ${old_string.length} chars with ${new_string.length} chars in ${path7}`;
+      writeFileSync5(resolved, newContent, "utf-8");
+      return `Replaced ${old_string.length} chars with ${new_string.length} chars in ${path9}`;
     })
   });
 }
 
 // src/services/tools/search-files.ts
 import fg from "fast-glob";
-import { resolve as resolve6 } from "path";
 import { z as z17 } from "zod";
 function searchFilesTool(deps) {
   const workspace = deps.cwd ?? process.cwd();
+  const homeDir2 = deps.homeDir;
   return defineTool({
-    description: "Search for files matching a glob pattern. Returns matching file paths relative to workspace.",
+    description: "Search for files matching a glob pattern. Returns matching file paths relative to workspace. Reads are restricted to the home directory; sensitive locations (credentials, tool config) are blocked.",
     parameters: z17.object({
       pattern: z17.string().describe('Glob pattern (e.g. "**/*.ts", "src/**/*.test.ts")'),
       path: z17.string().optional().describe("Base directory for search (default: workspace root)")
     }),
-    execute: safeExecute("search_files", async ({ pattern, path: path7 }) => {
-      const basePath = path7 ? resolve6(workspace, path7) : workspace;
+    execute: safeExecute("search_files", async ({ pattern, path: path9 }) => {
+      const basePath = path9 ? normalizePath(path9, { base: workspace }) : normalizePath(workspace);
+      if (homeDir2) {
+        const { decision } = decideAccess({
+          access: "read",
+          homeDir: homeDir2,
+          cwd: workspace,
+          path: basePath
+        });
+        const requested = path9 ?? workspace;
+        if (decision === "deny") {
+          return `[ERROR] search_files: refusing to search "${requested}" \u2014 the path is on the read denylist (a sensitive location).`;
+        }
+        if (decision === "ask") {
+          return `[ERROR] search_files: refusing to search "${requested}" \u2014 the path is outside the home boundary (${homeDir2}). The controller can only read files under the home directory.`;
+        }
+      }
       const entries = await fg(pattern, {
         cwd: basePath,
         onlyFiles: true,
@@ -7986,7 +9493,7 @@ function searchFilesTool(deps) {
 
 // src/services/tools/search-content.ts
 import { execSync as execSync3 } from "child_process";
-import { resolve as resolve7 } from "path";
+import { resolve as resolve9 } from "path";
 import { z as z18 } from "zod";
 function shellQuote(s) {
   return `'${s.replace(/'/g, "'\\''")}'`;
@@ -8000,8 +9507,8 @@ function searchContentTool(deps) {
       path: z18.string().optional().describe("Directory to search in (default: workspace root)"),
       include: z18.string().optional().describe('File pattern to include (e.g. "*.ts", "*.py")')
     }),
-    execute: safeExecute("search_content", async ({ query: query2, path: path7, include }) => {
-      const searchDir = path7 ? resolve7(workspace, path7) : workspace;
+    execute: safeExecute("search_content", async ({ query: query2, path: path9, include }) => {
+      const searchDir = path9 ? resolve9(workspace, path9) : workspace;
       const cmd = `grep -rn${include ? ` --include=${shellQuote(include)}` : ""} -- ${shellQuote(query2)} ${shellQuote(searchDir)}`;
       try {
         const output = execSync3(cmd, {
@@ -8259,8 +9766,13 @@ function createControllerTools(deps) {
       validateWorkerType: deps.validateWorkerType,
       assignToWorker: deps.assignToWorker,
       validateIdleWorker: deps.validateIdleWorker,
+      validateWorkerWorkspace: deps.validateWorkerWorkspace,
       getTurnContext: deps.getTurnContext,
-      onTaskDispatched: deps.onTaskDispatched
+      onTaskDispatched: deps.onTaskDispatched,
+      workspaceDir: deps.workspaceDir,
+      wayangDir: deps.wayangDir,
+      homeDir: deps.homeDir,
+      permissionConfig: deps.permissionConfig
     }),
     list_tasks: listTasksTool({ listTasks: deps.listTasks }),
     cancel_task: cancelTaskTool({
@@ -8301,7 +9813,7 @@ function createControllerTools(deps) {
     skip_reply: skipReplyTool(),
     read_notebook: readNotebookTool({ getNotebook: deps.getNotebook }),
     update_notebook: updateNotebookTool({ setNotebook: deps.setNotebook }),
-    search_files: searchFilesTool({ cwd: deps.cwd }),
+    search_files: searchFilesTool({ cwd: deps.cwd, homeDir: deps.homeDir }),
     inquire: inquireTool({ inquire: deps.inquire }),
     chat_worker: chatWorkerTool({
       sendMessageToWorker: deps.sendMessageToWorker
@@ -8361,11 +9873,16 @@ function wrapWithPermissionMiddleware(tools, config, deps) {
     wrappedTools[toolName] = {
       ...tools[toolName],
       execute: async (args, options) => {
-        if (!config.needsPermission(toolName, args)) {
+        const verdict = config.decide(toolName, args);
+        if (verdict.decision === "allow") {
           return originalExecute(args, options);
         }
+        if (verdict.decision === "deny") {
+          return verdict.message ?? `[ERROR] ${toolName}: refused by the path permission policy`;
+        }
         const requestId = generateId("perm");
-        const description = config.describeCall(toolName, args);
+        const baseDescription = config.describeCall(toolName, args);
+        const description = verdict.reason ? `${baseDescription} [reason: ${verdict.reason}]` : baseDescription;
         deps.signalQueue.enqueue({
           source: "worker",
           type: "permission_request",
@@ -8382,16 +9899,16 @@ function wrapWithPermissionMiddleware(tools, config, deps) {
           },
           ...deps.turnLineage ?? {}
         });
-        const result2 = await new Promise((resolve12) => {
+        const result2 = await new Promise((resolve13) => {
           const timer = setTimeout(() => {
             pending.delete(requestId);
-            resolve12({ approved: false, reason: "timeout" });
+            resolve13({ approved: false, reason: "timeout" });
           }, timeoutMs);
           pending.set(requestId, {
             resolve: (ok, reason) => {
               clearTimeout(timer);
               pending.delete(requestId);
-              resolve12({ approved: ok, reason });
+              resolve13({ approved: ok, reason });
             },
             timer
           });
@@ -8427,38 +9944,6 @@ function wrapWithPermissionMiddleware(tools, config, deps) {
   };
 }
 
-// src/services/tools/permission-rules.ts
-import { resolve as resolve8 } from "path";
-import { homedir } from "os";
-var FILE_TOOL_NAMES = ["read_file", "write_file", "edit_file", "search_files", "search_content"];
-var DANGEROUS_BASH_PATTERN = /(?:^|\||;|&&)\s*(?:rm\s|sudo\b|chmod\b|chown\b|mkfs\b|dd\s|shutdown\b|reboot\b|kill\s+-9)/;
-var URL_RE = /[a-zA-Z][a-zA-Z0-9+.-]*:\/\/\S+/g;
-function expandHome(p) {
-  if (p === "~") return homedir();
-  if (p.startsWith("~/")) return resolve8(homedir(), p.slice(2));
-  return p;
-}
-function extractPathCandidates(command) {
-  const withoutUrls = command.replace(URL_RE, " ");
-  const candidates = [];
-  for (const raw of withoutUrls.split(/[\s=;|&]+/)) {
-    const word = raw.replace(/^['"]+/, "").replace(/['",;|&()<>'`]+$/, "");
-    if (word.startsWith("/") || word.startsWith("~")) candidates.push(word);
-  }
-  return candidates;
-}
-function needsFilePermission(workspace, args) {
-  const rawPath = args.path;
-  if (typeof rawPath !== "string" || !rawPath) return false;
-  return !isInsideWorkspace(resolve8(workspace, expandHome(rawPath)), workspace);
-}
-function needsBashPermission(workspace, command) {
-  if (DANGEROUS_BASH_PATTERN.test(command)) return true;
-  return extractPathCandidates(command).some(
-    (p) => !isInsideWorkspace(expandHome(p), workspace)
-  );
-}
-
 // src/utils/llm-error.ts
 function formatLlmError(err) {
   if (!(err instanceof Error)) return String(err);
@@ -8499,7 +9984,8 @@ function formatApiCallError(err) {
 }
 
 // src/services/task-execute-engine.ts
-import { resolve as resolve9 } from "path";
+import { basename as basename8, dirname as dirname10, resolve as resolve10 } from "path";
+import { homedir as homedir2 } from "os";
 var RuntimeState = class extends BaseWayangState {
   constructor(initialData) {
     super(initialData, []);
@@ -8508,13 +9994,20 @@ var RuntimeState = class extends BaseWayangState {
   }
 };
 var PUPPET_WORKER_TYPE = "puppet";
+function resolveUserHomeDir(sessionDir) {
+  const wayangDir = wayangDirForSessionDir(sessionDir);
+  return wayangDir && basename8(wayangDir) === ".wayang" ? dirname10(wayangDir) : homedir2();
+}
 var DEFAULT_IDLE_TIMEOUT_MS = 30 * 60 * 1e3;
 var INQUIRY_TIMEOUT_MS = 3e5;
 var TaskExecuteEngine = class {
-  constructor(ctx, signalQueue, skills) {
+  constructor(ctx, signalQueue, skills, options = {}) {
     this.ctx = ctx;
     this.signalQueue = signalQueue;
     this.logger = ctx.logger;
+    this.homeDir = options.homeDir ?? resolveUserHomeDir(ctx.sessionDir);
+    this.permission = options.permission ?? ctx.config.permission;
+    this.onTaskWorkspace = options.onTaskWorkspace;
     this.maxConcurrency = ctx.maxConcurrency;
     this.workerProvider = ctx.workerProvider;
     this.workerConfigs = ctx.config.workers;
@@ -8563,28 +10056,48 @@ var TaskExecuteEngine = class {
   idleTimers = /* @__PURE__ */ new Map();
   /** Idle TTL (ms). Idle workers are disposed after this if not reused. */
   idleTimeoutMs;
+  /** The user's home directory the path permission policy anchors on. */
+  homeDir;
+  /** User-config permission section applied to this run's worker tools. */
+  permission;
+  /** Session-side hook: remember every workspace a task is accepted for. */
+  onTaskWorkspace;
   // ---------------------------------------------------------------------------
   // Subscribable
   // ---------------------------------------------------------------------------
-  subscribe(path7, callback) {
-    if (path7.startsWith("tasks.")) return this.taskState.on(path7, callback);
-    if (path7 === "activeWorkers" || path7.startsWith("activeWorkers.")) return this.workerState.on(path7, callback);
-    throw new Error(`TaskExecuteEngine: unknown subscription path "${path7}"`);
+  subscribe(path9, callback) {
+    if (path9.startsWith("tasks.")) return this.taskState.on(path9, callback);
+    if (path9 === "activeWorkers" || path9.startsWith("activeWorkers.")) return this.workerState.on(path9, callback);
+    throw new Error(`TaskExecuteEngine: unknown subscription path "${path9}"`);
   }
-  getSnapshot(path7) {
-    if (path7.startsWith("tasks.")) return this.taskState.get(path7);
-    if (path7 === "activeWorkers" || path7.startsWith("activeWorkers.")) return this.workerState.get(path7);
-    throw new Error(`TaskExecuteEngine: unknown snapshot path "${path7}"`);
+  getSnapshot(path9) {
+    if (path9.startsWith("tasks.")) return this.taskState.get(path9);
+    if (path9 === "activeWorkers" || path9.startsWith("activeWorkers.")) return this.workerState.get(path9);
+    throw new Error(`TaskExecuteEngine: unknown snapshot path "${path9}"`);
   }
   // ---------------------------------------------------------------------------
   // Task management
   // ---------------------------------------------------------------------------
-  /** Add a task and immediately attempt to schedule it. */
+  /**
+   * Add a task and immediately attempt to schedule it.
+   *
+   * Returns the engine worker id when the task was scheduled right away (a
+   * worker_started signal follows), or undefined when every concurrency slot
+   * is busy — in that case a task_queued signal is emitted exactly once so the
+   * controller can tell "waiting for a slot" from "running" (issue #30). The
+   * task starts automatically when a slot frees.
+   */
   add(task) {
     this.taskState.append("tasks.pending", task);
+    this.recordTaskWorkspace(task);
     this.logger.info({ taskId: task.id }, "Task added");
     this.ctx.hooks.emit("task:added", task);
     this.scheduleNext();
+    const running = this.taskState.get("tasks.running");
+    const started = running.find((t) => t.id === task.id);
+    if (started?.workerSessionId) return started.workerSessionId;
+    this.emitTaskQueued(task);
+    return void 0;
   }
   get(id) {
     const all = [
@@ -8666,6 +10179,55 @@ var TaskExecuteEngine = class {
       causationId: task.id
     });
   }
+  /**
+   * Announce that a task is stuck in the pending queue — every concurrency
+   * slot is busy (issue #30). Emitted at most once per task (from add(), the
+   * only entry point into the pending queue). No worker exists yet, so the
+   * payload carries task identity only; a later worker_started signal names
+   * the worker that eventually picks the task up.
+   */
+  emitTaskQueued(task) {
+    const workerType = task.workerType ?? PUPPET_WORKER_TYPE;
+    const meta = getWorkerMeta(workerType, this.workerConfigs);
+    const payload = {
+      taskId: task.id,
+      taskTitle: task.title,
+      workerType,
+      emoji: meta.emoji,
+      message: `All concurrency slots are busy \u2014 the task is queued and will start automatically when a slot frees.`
+    };
+    this.signalQueue.enqueue({
+      source: "system",
+      type: "task_queued",
+      payload,
+      ...(task.rootTurnId ?? task.turnId) !== void 0 && { rootTurnId: task.rootTurnId ?? task.turnId },
+      causationId: task.id
+    });
+  }
+  /**
+   * Announce that a worker actually began a task (issue #30): fresh spawn or
+   * idle-worker reuse (`reused`). Called after the worker is registered and
+   * its execution turn recorded, so the signal carries the worker's lineage.
+   * If creating the worker instance throws, no started signal is emitted —
+   * the existing failed signal (handleFail) is the only outcome.
+   */
+  emitWorkerStarted(task, workerId, workerType, reused) {
+    const meta = getWorkerMeta(workerType, this.workerConfigs);
+    const payload = {
+      taskId: task.id,
+      workerId,
+      taskTitle: task.title,
+      workerType,
+      emoji: meta.emoji,
+      message: reused ? "Idle multi-stage worker reused for this stage (it kept its context)." : "Worker spawned and started the task.",
+      reused
+    };
+    this.enqueueWorkerSignal(workerId, {
+      source: "worker",
+      type: "worker_started",
+      payload
+    });
+  }
   updatePending(id, updates) {
     const pending = [...this.taskState.get("tasks.pending")];
     const idx = pending.findIndex((t) => t.id === id);
@@ -8703,6 +10265,39 @@ var TaskExecuteEngine = class {
     if (info.status !== "idle") return `Worker "${workerId}" is not idle (status: ${info.status}).`;
     return null;
   }
+  /**
+   * Validate that an idle worker may take a task executing in `workspacePath`.
+   * Returns an error message or null.
+   *
+   * A worker's workspace is fixed at construction: its state identity, the
+   * relative-path assumptions in its accumulated conversation, and the identity
+   * stamped on its records all belong to the workspace it was born in. Reuse
+   * across workspaces would silently re-point only the RUN (cwd, tools,
+   * permission gate) at the new workspace while the worker keeps the old
+   * identity — so both sides are canonicalized (realpath, resolve fallback)
+   * and compared before any reuse. A mismatch is never resolved by re-stamping
+   * the worker; the caller must create a new one.
+   *
+   * Two consumers: `assignToExistingWorker` (the single reuse choke point, so
+   * no caller can bypass it) and the add_task tool's pre-check (which turns the
+   * rejection into an explicit instruction instead of a generic failure).
+   * `workspacePath` falls back to the process workspace, mirroring
+   * `taskWorkspaceDir` for tasks without a workspace stamp.
+   */
+  validateWorkerWorkspace(workerId, workspacePath) {
+    const worker = this.workers.get(workerId);
+    if (!worker) return `Worker "${workerId}" not found.`;
+    const workerWorkspace = worker.workspaceDir;
+    if (!workerWorkspace) {
+      return `Worker "${workerId}" does not report the workspace it was created in, so reuse cannot be verified across workspaces. Create a new worker instead (drop assignToWorker).`;
+    }
+    const createdIn = normalizeWorkspacePath(workerWorkspace);
+    const target = normalizeWorkspacePath(workspacePath ?? this.ctx.workspaceDir);
+    if (createdIn !== target) {
+      return `Worker "${workerId}" was created in workspace ${createdIn} and cannot take a task in ${target}. Create a new worker for that workspace instead (drop assignToWorker).`;
+    }
+    return null;
+  }
   getWorkerState(workerId) {
     const worker = this.workers.get(workerId);
     return worker ?? null;
@@ -8945,8 +10540,20 @@ var TaskExecuteEngine = class {
   // ---------------------------------------------------------------------------
   // Persistence
   // ---------------------------------------------------------------------------
-  async restore() {
+  /**
+   * Restore persisted tasks and recover from a crashed run.
+   *
+   * @param fallbackWorkspace  The resumed session's workspace identity. Tasks
+   *   written before workspace attribution existed have no `workspace`, so it
+   *   is filled in from here (memory only) before dispatch — otherwise
+   *   `taskWorkspaceDir` would fall back to the process workspace, which for a
+   *   resumed session may be an entirely different directory.
+   */
+  async restore(fallbackWorkspace) {
     await this.taskState.restore();
+    if (fallbackWorkspace) {
+      this.taskState.fillWorkspaceInMemory(fallbackWorkspace);
+    }
     this.recoverCrashedTasks();
   }
   // ---------------------------------------------------------------------------
@@ -9106,10 +10713,40 @@ var TaskExecuteEngine = class {
   // ---------------------------------------------------------------------------
   // Private: worker spawn + lifecycle
   // ---------------------------------------------------------------------------
-  createWorker(workerType) {
+  /**
+   * Workspace a task executes in.
+   *
+   * `task.workspace.path` is canonical (add_task canonicalizes through
+   * realpath), so it is used verbatim — worker construction, tool cwd and the
+   * permission-gate boundary all read this single value, never a path
+   * re-assembled from the process workspace. Tasks without a workspace stamp
+   * (written before workspaces existed, restored from an older session, or
+   * dispatched internally) fall back to the process workspace.
+   */
+  taskWorkspaceDir(task) {
+    return task.workspace?.path ?? this.ctx.workspaceDir;
+  }
+  /**
+   * Tell the session a task was accepted for `task.workspace`, so a session
+   * accumulates every workspace it dispatches work into. Best-effort: recording
+   * the identity is bookkeeping, never a precondition for running the task, so
+   * a failure (e.g. an unreadable registry) is logged and swallowed rather than
+   * failing an accepted task. Tasks without a workspace stamp run in the
+   * process workspace, which the session already records — nothing to add.
+   */
+  recordTaskWorkspace(task) {
+    if (!this.onTaskWorkspace || !task.workspace) return;
+    try {
+      this.onTaskWorkspace(task.workspace);
+    } catch (err) {
+      this.logger.warn({ taskId: task.id, err }, "Failed to record task workspace on the session");
+    }
+  }
+  createWorker(workerType, task) {
     const type = workerType ?? PUPPET_WORKER_TYPE;
+    const workspaceDir2 = this.taskWorkspaceDir(task);
     if (type === PUPPET_WORKER_TYPE) {
-      return new WorkerAgent(this.workerProvider, this.ctx, this.skills, this.ctx.config.worker.toolChoice);
+      return new WorkerAgent(this.workerProvider, this.ctx, this.skills, this.ctx.config.worker.toolChoice, workspaceDir2);
     }
     const config = this.workerConfigs?.[type];
     if (!config) {
@@ -9120,18 +10757,19 @@ var TaskExecuteEngine = class {
     }
     switch (config.type) {
       case "claude-code":
-        return new ClaudeCodeWorker(config, this.ctx.sessionDir, this.ctx.workspaceDir, this.ctx, this.skills);
+        return new ClaudeCodeWorker(config, this.ctx.sessionDir, workspaceDir2, this.ctx, this.skills);
       default:
         throw new Error(`Unsupported worker type: "${config.type}"`);
     }
   }
   async spawnWorker(task, workerId) {
     const workerType = task.workerType ?? PUPPET_WORKER_TYPE;
-    const worker = this.createWorker(workerType);
+    const worker = this.createWorker(workerType, task);
     this.workers.set(workerId, worker);
     this.workerTaskMap.set(workerId, task.id);
     this.stampWorkerTranscriptId(task.id, worker.id);
     const executionTurnId = this.registerWorkerTurn(workerId, task);
+    this.emitWorkerStarted(task, workerId, workerType, false);
     const onProgress = this.buildProgressEmitter(workerId, task, workerType);
     const tools = this.wireWorker(worker, task, workerId, workerType);
     this.logger.info({ workerId, taskId: task.id, workerType, executionTurnId }, "Worker starting");
@@ -9140,7 +10778,8 @@ var TaskExecuteEngine = class {
   /**
    * Dispatch a follow-up task to an existing idle (multi-stage) worker.
    * Reuses the worker instance + its accumulated conversation context.
-   * Returns false if the worker is missing or not idle.
+   * Returns false if the worker is missing, not idle, or was created in a
+   * different workspace than the task executes in.
    */
   assignToExistingWorker(workerId, task) {
     const err = this.validateIdleWorker(workerId);
@@ -9153,6 +10792,15 @@ var TaskExecuteEngine = class {
       this.logger.warn({ workerId }, "Idle worker instance missing");
       return false;
     }
+    const taskWorkspace = this.taskWorkspaceDir(task);
+    const workspaceErr = this.validateWorkerWorkspace(workerId, taskWorkspace);
+    if (workspaceErr) {
+      this.logger.warn(
+        { workerId, taskId: task.id, taskWorkspace, err: workspaceErr },
+        "Refusing to reuse a worker across workspaces"
+      );
+      return false;
+    }
     const workerType = task.workerType ?? PUPPET_WORKER_TYPE;
     const meta = getWorkerMeta(workerType, this.workerConfigs);
     this.clearIdleTimer(workerId);
@@ -9166,8 +10814,10 @@ var TaskExecuteEngine = class {
       workerTranscriptId: worker.id
     };
     this.taskState.append("tasks.running", taskWithOrigin);
+    this.recordTaskWorkspace(taskWithOrigin);
     this.workerTaskMap.set(workerId, task.id);
     const executionTurnId = this.registerWorkerTurn(workerId, taskWithOrigin);
+    this.emitWorkerStarted(task, workerId, workerType, true);
     this.updateActiveWorker(workerId, {
       status: "running",
       taskId: task.id,
@@ -9217,6 +10867,13 @@ var TaskExecuteEngine = class {
    */
   wireWorker(worker, task, workerId, workerType) {
     const workerMeta = getWorkerMeta(workerType, this.workerConfigs);
+    const workspace = this.taskWorkspaceDir(task);
+    const accessScope = {
+      homeDir: this.homeDir,
+      workspace,
+      taskAllowedDirs: task.taskAllowedDirs,
+      permission: this.permission
+    };
     const inquiryRegistry = new BlockingRequestMap();
     this.inquiryRegistries.set(workerId, inquiryRegistry);
     const askAndWait = async (question, context) => {
@@ -9252,7 +10909,7 @@ var TaskExecuteEngine = class {
     let tools = workerType === PUPPET_WORKER_TYPE ? {
       ...createWorkerTools({
         listTasks: (status) => this.list(status),
-        cwd: this.ctx.workspaceDir,
+        cwd: workspace,
         tavilyApiKey: this.ctx.config.tavilyApiKey,
         registry: this.skills,
         reportProgress: (msg, _percent) => {
@@ -9285,23 +10942,17 @@ var TaskExecuteEngine = class {
       worker.setInquirySupport(askAndWait);
     }
     if (workerType === PUPPET_WORKER_TYPE) {
-      const workspace = this.ctx.workspaceDir;
       const middleware = wrapWithPermissionMiddleware(tools, {
         gatedTools: ["bash", ...FILE_TOOL_NAMES],
-        needsPermission: (toolName, args) => {
-          if (toolName === "bash") {
-            return needsBashPermission(workspace, args.command ?? "");
-          }
-          if (FILE_TOOL_NAMES.includes(toolName)) {
-            return needsFilePermission(workspace, args);
-          }
-          return false;
-        },
+        // Single decision source: the shared access policy (denylist →
+        // config roots → task allowedDirs → task workspace → read-in-home →
+        // ask). `deny` refuses here without ever emitting a permission_request.
+        decide: (toolName, args) => decideToolAccess(accessScope, toolName, args),
         describeCall: (toolName, args) => {
           if (toolName === "bash") return `Execute shell command: ${args.command}`;
           if (FILE_TOOL_NAMES.includes(toolName)) {
             const rawPath = typeof args.path === "string" ? args.path : "";
-            const resolved = rawPath ? resolve9(workspace, rawPath) : workspace;
+            const resolved = rawPath ? resolve10(workspace, rawPath) : workspace;
             return `${toolName}: ${rawPath || "(workspace root)"} (resolved: ${resolved})`;
           }
           return `${toolName}: ${JSON.stringify(args)}`;
@@ -9326,7 +10977,8 @@ var TaskExecuteEngine = class {
         taskTitle: task.title,
         workerType,
         emoji: workerMeta.emoji,
-        turnLineage: this.workerLineage(workerId)
+        turnLineage: this.workerLineage(workerId),
+        accessScope
       });
       this.permissionResolvers.set(workerId, worker.permissionHandler);
     }
@@ -9565,121 +11217,8 @@ var ControllerLoop = class {
   }
 };
 
-// src/services/session/session-manager.ts
-import * as path5 from "path";
-
-// src/services/session/session-state.ts
-import { join as join10 } from "path";
-var SessionState = class extends BaseWayangState {
-  jsonFile;
-  constructor(sessionDir) {
-    const jsonFile = new JSONFileHelper(join10(sessionDir, "meta.json"));
-    super(
-      {
-        meta: {
-          sessionId: "",
-          workspace: "",
-          firstInput: null,
-          createdAt: 0,
-          lastActiveAt: 0,
-          title: void 0,
-          archived: false,
-          archivedAt: void 0
-        }
-      },
-      [{ path: "meta", helper: jsonFile }]
-    );
-    this.jsonFile = jsonFile;
-  }
-  async restore() {
-    const data = this.jsonFile.read();
-    if (data) {
-      this.data.meta = data;
-    }
-  }
-};
-
-// src/services/session/session-manager.ts
-var SessionManager = class _SessionManager {
-  sessionId;
-  sessionDir;
-  isResume;
-  state;
-  constructor(sessionId, sessionDir, isResume) {
-    this.sessionId = sessionId;
-    this.sessionDir = sessionDir;
-    this.isResume = isResume;
-    this.state = new SessionState(sessionDir);
-  }
-  /** Create a new session: generates ID, initializes meta via WayangState (auto mkdir + write). */
-  static create(homeDir2, workspaceDir2) {
-    const sessionId = `${formatTimestamp()}-${Math.random().toString(36).slice(2, 6)}`;
-    const sessionDir = path5.join(homeDir2, "sessions", sessionId);
-    const mgr = new _SessionManager(sessionId, sessionDir, false);
-    mgr.state.set("meta", {
-      sessionId,
-      workspace: workspaceDir2,
-      firstInput: null,
-      createdAt: Date.now(),
-      lastActiveAt: Date.now()
-    });
-    return mgr;
-  }
-  /** Resume an existing session. State is restored in restore(). */
-  static resume(sessionId, sessionDir) {
-    return new _SessionManager(sessionId, sessionDir, true);
-  }
-  /** Restore state from disk (resume only, no-op for new sessions). */
-  async restore() {
-    if (!this.isResume) return;
-    await this.state.restore();
-  }
-  /** Workspace directory of this session. */
-  get workspace() {
-    return this.state.get("meta.workspace");
-  }
-  /** Whether firstInput has already been recorded. */
-  get hasFirstInput() {
-    return !!this.state.get("meta.firstInput");
-  }
-  /**
-   * Notify that a user input occurred.
-   * Records firstInput (idempotent) and updates lastActiveAt.
-   */
-  onUserInput(text) {
-    if (!this.hasFirstInput) {
-      this.state.set("meta.firstInput", text);
-    }
-    this.state.set("meta.lastActiveAt", Date.now());
-  }
-  /** Current display label: explicit title, else first input. */
-  get displayTitle() {
-    return sessionDisplayTitle(this.state.get("meta"));
-  }
-  /** Whether this session is archived (hidden from the default list). */
-  get archived() {
-    return this.state.get("meta.archived") ?? false;
-  }
-  /**
-   * Rename the session. Passing null/empty clears the explicit title, so the
-   * session falls back to showing its first input.
-   */
-  rename(title) {
-    const trimmed = title?.trim();
-    this.state.set("meta.title", trimmed && trimmed.length > 0 ? trimmed : void 0);
-  }
-  /**
-   * Toggle the archived flag. Archiving hides the session from the default
-   * list without deleting its transcript; unarchiving restores visibility.
-   */
-  setArchived(archived) {
-    this.state.set("meta.archived", archived);
-    this.state.set("meta.archivedAt", archived ? Date.now() : void 0);
-  }
-};
-
 // src/services/agents/controller-state.ts
-import { join as join12 } from "path";
+import { join as join17 } from "path";
 
 // src/services/conversation/conversation-index.ts
 function emptyUsage() {
@@ -9903,8 +11442,8 @@ var ControllerAgentState = class extends BaseWayangState {
   /** In-memory resolve function for the current inquiry — never persisted. */
   inquiryResolver = null;
   constructor(ctx) {
-    const jsonFile = new JSONFileHelper(join12(ctx.sessionDir, "runtime-state.json"));
-    const jsonlFile = new JSONLFileHelper(join12(ctx.sessionDir, "conversation.jsonl"));
+    const jsonFile = new JSONFileHelper(join17(ctx.sessionDir, "runtime-state.json"));
+    const jsonlFile = new JSONLFileHelper(join17(ctx.sessionDir, "conversation.jsonl"));
     const initialData = {
       runtimeState: {
         session: { id: "", startedAt: 0 },
@@ -9929,9 +11468,9 @@ var ControllerAgentState = class extends BaseWayangState {
    * shared conversation-envelope module — the single source of truth. This
    * override only feeds the in-memory turn index incrementally.
    */
-  append(path7, entry) {
-    super.append(path7, entry);
-    if (path7 === "conversation" && this.convIndex) {
+  append(path9, entry) {
+    super.append(path9, entry);
+    if (path9 === "conversation" && this.convIndex) {
       this.convIndex.onAppend(entry);
     }
   }
@@ -9979,8 +11518,8 @@ var ControllerAgentState = class extends BaseWayangState {
   }
   /** Set a pending inquiry and return a Promise that resolves when the user answers. */
   askInquiry(question) {
-    return new Promise((resolve12) => {
-      this.inquiryResolver = resolve12;
+    return new Promise((resolve13) => {
+      this.inquiryResolver = resolve13;
       this.set("runtimeState.pendingInquiry", question);
     });
   }
@@ -10089,6 +11628,8 @@ function buildSummaryInput(entries, maxChars) {
 }
 
 // src/services/agents/controller-agent.ts
+import { basename as basename9, dirname as dirname11 } from "path";
+import { homedir as homedir3 } from "os";
 var SUMMARIZER_INPUT_RATIO = 0.5;
 var ControllerAgent = class _ControllerAgent extends BaseAgent {
   state;
@@ -10101,6 +11642,13 @@ var ControllerAgent = class _ControllerAgent extends BaseAgent {
   recorder;
   /** Turn id of the most recent run — used to stamp late error entries. */
   lastTurnId = null;
+  /**
+   * Registry slug of the workspace this controller executes in (the process
+   * workspace). Stamped on every controller turn envelope so its entries are
+   * attributable to a directory, matching worker entries. Resolved once at
+   * construction; undefined only when the context carries no workspace dir.
+   */
+  workspaceSlug;
   /**
    * True once THIS turn's interrupt record has been persisted
    * (recordUserAbort). Step finishes landing after that point would append
@@ -10122,6 +11670,7 @@ var ControllerAgent = class _ControllerAgent extends BaseAgent {
     this.recorder = recorder;
     this.tools = recordToolCalls(tools, recorder);
     this.logger = ctx.logger;
+    this.workspaceSlug = ctx.workspaceDir ? resolveWorkspaceRef(wayangDirForSessionDir(ctx.sessionDir), ctx.workspaceDir).slug : void 0;
     this.contextManager = new ContextManager(
       state,
       buildControllerSystemPrompt(this.ctx, skills),
@@ -10145,11 +11694,14 @@ var ControllerAgent = class _ControllerAgent extends BaseAgent {
     const { ctx, provider, engine, signalQueue, skills } = opts;
     const state = new ControllerAgentState(ctx);
     const recorder = new ToolCallRecorder(ctx.logger);
+    const wayangDir = wayangDirForSessionDir(ctx.sessionDir);
+    const homeDir2 = wayangDir && basename9(wayangDir) === ".wayang" ? dirname11(wayangDir) : homedir3();
     const tools = createControllerTools({
       addTask: (task) => engine.add(task),
       validateWorkerType: (type) => engine.validateWorkerType(type),
       assignToWorker: (workerId, task) => engine.assignToExistingWorker(workerId, task),
       validateIdleWorker: (workerId) => engine.validateIdleWorker(workerId),
+      validateWorkerWorkspace: (workerId, workspacePath) => engine.validateWorkerWorkspace(workerId, workspacePath),
       listTasks: (status) => engine.list(status),
       getTask: (taskId) => engine.get(taskId),
       getWorkerConversation: (taskId) => engine.getWorkerConversation(taskId),
@@ -10171,6 +11723,10 @@ var ControllerAgent = class _ControllerAgent extends BaseAgent {
       updateTask: (taskId, updates) => engine.updatePending(taskId, updates),
       queryMessages: (filter) => signalQueue.query(filter),
       cwd: ctx.workspaceDir,
+      homeDir: homeDir2,
+      // User-config permission section: add_task validates a task's allowedDirs
+      // against the built-in denylist plus these configured deniedDirs.
+      permissionConfig: opts.config.permission,
       getNotebook: () => state.get("runtimeState.notebook") ?? "",
       setNotebook: (content, mode) => {
         const current = state.get("runtimeState.notebook") ?? "";
@@ -10188,7 +11744,11 @@ var ControllerAgent = class _ControllerAgent extends BaseAgent {
       // toolCall→task audit link, consumed when the step entry is built.
       onTaskDispatched: ({ toolCallId, taskId }) => {
         if (toolCallId) recorder.attachTask(toolCallId, taskId);
-      }
+      },
+      // Default workspace for tasks created by add_task; a declared workspace
+      // is stamped instead and the engine executes the task there.
+      workspaceDir: ctx.workspaceDir,
+      wayangDir
     });
     return new _ControllerAgent(ctx, state, provider, tools, skills, recorder);
   }
@@ -10212,7 +11772,11 @@ var ControllerAgent = class _ControllerAgent extends BaseAgent {
       turnId,
       ...rootTurnId !== void 0 && { rootTurnId },
       ...causationId !== void 0 && { causationId },
-      actor: { kind: "controller", id: this.id }
+      actor: { kind: "controller", id: this.id },
+      // Controller entries carry the process workspace's slug so they are
+      // attributable to a directory just like worker entries. Undefined only
+      // when the context carries no workspace directory.
+      ...this.workspaceSlug !== void 0 && { workspaceSlug: this.workspaceSlug }
     };
     this.state.set("dynamicState.currentTurn", turnEnv);
     this.lastTurnId = turnId;
@@ -10451,11 +12015,11 @@ var ControllerAgent = class _ControllerAgent extends BaseAgent {
     return this.state.getTurn(turnId);
   }
   // --- Subscribable ---
-  subscribe(path7, callback) {
-    return this.state.on(path7, callback);
+  subscribe(path9, callback) {
+    return this.state.on(path9, callback);
   }
-  getSnapshot(path7) {
-    return this.state.get(path7);
+  getSnapshot(path9) {
+    return this.state.get(path9);
   }
   /** Check if context needs compaction. */
   needsCompaction() {
@@ -10616,7 +12180,7 @@ Pending tasks: ${p.pendingTaskCount}`
       emoji: p.emoji,
       taskId: p.taskId,
       taskTitle: p.taskTitle,
-      content: `[PERMISSION REQUEST] Worker ${p.workerId} (task: ${p.taskTitle}) wants to run ${p.toolName}.
+      content: `[PERMISSION REQUEST] The worker running task "${p.taskTitle}" wants to run ${p.toolName}.
 Description: ${p.description}
 Request ID: ${p.requestId}
 Use respond_permission to approve or deny.`,
@@ -10640,7 +12204,7 @@ Use respond_permission to approve or deny.`,
       emoji: p.emoji,
       taskId: p.taskId,
       taskTitle: p.taskTitle,
-      content: `[WORKER INQUIRY] Worker ${p.workerId} (task: ${p.taskTitle}) is blocked and asks:${"\n"}${p.question}${p.context ? `
+      content: `[WORKER INQUIRY] The worker running task "${p.taskTitle}" is blocked and asks:${"\n"}${p.question}${p.context ? `
 Context: ${p.context}` : ""}
 Inquiry ID: ${p.inquiryId}
 Use respond_inquiry to answer; the worker is waiting and will continue on its own after a 5-minute timeout.`,
@@ -10661,7 +12225,7 @@ Use respond_inquiry to answer; the worker is waiting and will continue on its ow
       emoji: p.emoji,
       taskId: p.taskId,
       taskTitle: p.taskTitle,
-      content: `[INQUIRY TIMEOUT] Worker ${p.workerId} (task: ${p.taskTitle}) got no answer within 5 minutes and continued on its own judgment. Question was: ${p.question}`
+      content: `[INQUIRY TIMEOUT] The worker running task "${p.taskTitle}" got no answer within 5 minutes and continued on its own judgment. Question was: ${p.question}`
     };
   },
   message_undelivered: (sig, ts, sessionId) => {
@@ -10675,7 +12239,7 @@ Use respond_inquiry to answer; the worker is waiting and will continue on its ow
       emoji: p.emoji,
       taskId: p.taskId,
       taskTitle: p.taskTitle ?? "message_undelivered",
-      content: `[MESSAGES NOT DELIVERED] Worker ${p.workerId} ${p.reason === "worker_disposed" ? "was disposed (idle)" : "finished its task"} before reading your message(s):${"\n"}${lines.join("\n")}
+      content: `[MESSAGES NOT DELIVERED] The worker ${p.reason === "worker_disposed" ? "was disposed (idle)" : "finished its task"} before reading your message(s):${"\n"}${lines.join("\n")}
 They were never seen by the worker. If still relevant, re-dispatch as a follow-up task.`
     };
   },
@@ -10689,7 +12253,7 @@ They were never seen by the worker. If still relevant, re-dispatch as a follow-u
       emoji: p.emoji,
       taskId: p.taskId,
       taskTitle: "worker_disposed",
-      content: `[WORKER DISPOSED] Idle (multi-stage) worker ${p.workerId} was disposed (reaped by timeout or manually). No task failed \u2014 its last stage already completed. If you still need this worker's context, create a fresh multi-stage task instead.`
+      content: `[WORKER DISPOSED] An idle (multi-stage) worker was disposed (reaped by timeout or manually). No task failed \u2014 its last stage already completed. If you still need this worker's context, create a fresh multi-stage task instead.`
     };
   },
   task_cancelled: (sig, ts, sessionId) => {
@@ -10705,6 +12269,31 @@ They were never seen by the worker. If still relevant, re-dispatch as a follow-u
       content: `[TASK CANCELLED] Task ${p.taskId}${p.taskTitle ? ` (${p.taskTitle})` : ""} was cancelled by the user/controller. This is not a failure \u2014 the task terminated as cancelled.`
     };
   },
+  task_queued: (sig, ts, sessionId) => {
+    const p = sig.payload;
+    return {
+      ...signalBase(ts, sessionId),
+      subtype: "task_queued" /* TaskQueued */,
+      workerType: p.workerType,
+      emoji: p.emoji,
+      taskId: p.taskId,
+      taskTitle: p.taskTitle,
+      content: `[TASK QUEUED] ${p.message}`
+    };
+  },
+  worker_started: (sig, ts, sessionId) => {
+    const p = sig.payload;
+    return {
+      ...signalBase(ts, sessionId),
+      subtype: "worker_started" /* WorkerStarted */,
+      workerId: p.workerId,
+      workerType: p.workerType,
+      emoji: p.emoji,
+      taskId: p.taskId,
+      taskTitle: p.taskTitle,
+      content: `[WORKER STARTED${p.reused ? " (reused idle worker)" : ""}] ${p.message}`
+    };
+  },
   previous_session_tasks: (sig, ts, sessionId) => {
     const p = sig.payload;
     const lines = p.tasks.map((t) => `- [${t.status}] ${t.title} (id: ${t.taskId}): ${t.description}`);
@@ -10758,8 +12347,8 @@ function signalToEntry(sig, ts, sessionId) {
 }
 
 // src/services/skills/registry.ts
-import { readFileSync as readFileSync9, readdirSync as readdirSync2, statSync as statSync3 } from "fs";
-import { join as join13 } from "path";
+import { readFileSync as readFileSync12, readdirSync as readdirSync2, statSync as statSync4 } from "fs";
+import { join as join18 } from "path";
 import { parse as parseYaml } from "yaml";
 var SKILL_FILE = "SKILL.md";
 function parseFrontmatter(raw) {
@@ -10794,7 +12383,7 @@ function listResources(skillDir) {
   const walk = (relDir) => {
     let entries;
     try {
-      entries = readdirSync2(join13(skillDir, relDir), { withFileTypes: true });
+      entries = readdirSync2(join18(skillDir, relDir), { withFileTypes: true });
     } catch {
       return;
     }
@@ -10841,10 +12430,10 @@ var SkillRegistry = class {
     if (existing) return existing;
     const desc = this.descriptors.get(name);
     if (!desc) return void 0;
-    const filePath = join13(desc.dir, SKILL_FILE);
+    const filePath = join18(desc.dir, SKILL_FILE);
     let raw;
     try {
-      raw = readFileSync9(filePath, "utf-8");
+      raw = readFileSync12(filePath, "utf-8");
     } catch (err) {
       this.logger?.warn({ skill: name, error: err instanceof Error ? err.message : String(err) }, "Failed to read skill file");
       return void 0;
@@ -10872,8 +12461,8 @@ var SkillRegistry = class {
     for (const entry of entries) {
       if (!entry.isDirectory()) continue;
       if (entry.name.startsWith(".") || entry.name === "node_modules") continue;
-      const skillDir = join13(dir, entry.name);
-      const skillFile = join13(skillDir, SKILL_FILE);
+      const skillDir = join18(dir, entry.name);
+      const skillFile = join18(skillDir, SKILL_FILE);
       if (!existsAsFile(skillFile)) continue;
       const { frontmatter } = safeReadFrontmatter(skillFile);
       const description = asString(frontmatter.description);
@@ -10886,37 +12475,37 @@ var SkillRegistry = class {
     }
   }
 };
-function existsAsFile(path7) {
+function existsAsFile(path9) {
   try {
-    return statSync3(path7).isFile();
+    return statSync4(path9).isFile();
   } catch {
     return false;
   }
 }
-function safeReadFrontmatter(path7) {
+function safeReadFrontmatter(path9) {
   try {
-    return parseFrontmatter(readFileSync9(path7, "utf-8"));
+    return parseFrontmatter(readFileSync12(path9, "utf-8"));
   } catch {
     return { frontmatter: {}, body: "" };
   }
 }
 
 // src/services/skills/skill-dir.ts
-import { existsSync as existsSync8 } from "fs";
-import { homedir as homedir2 } from "os";
-import { join as join14, resolve as resolve10 } from "path";
+import { existsSync as existsSync11 } from "fs";
+import { homedir as homedir4 } from "os";
+import { join as join19, resolve as resolve11 } from "path";
 function resolveSkillDirs(workspaceDir2, configDirs) {
   const candidates = [
-    join14(homedir2(), ".wayang", "skills"),
-    join14(workspaceDir2, ".wayang", "skills"),
-    ...(configDirs ?? []).map((d) => resolve10(d))
+    join19(homedir4(), ".wayang", "skills"),
+    join19(workspaceDir2, ".wayang", "skills"),
+    ...(configDirs ?? []).map((d) => resolve11(d))
   ];
   const seen = /* @__PURE__ */ new Set();
   const dirs = [];
   for (const dir of candidates) {
     if (seen.has(dir)) continue;
     seen.add(dir);
-    if (existsSync8(dir)) dirs.push(dir);
+    if (existsSync11(dir)) dirs.push(dir);
   }
   return dirs;
 }
@@ -10930,6 +12519,8 @@ var Supervisor = class {
   sessionManager;
   /** Shared skill registry — discovered at startup, used by all agents. */
   skills;
+  /** Exclusive ownership of this session's directory (see SessionLock). */
+  sessionLock;
   controllerLoop;
   resumeSessionDir;
   injectPreviousTasks;
@@ -10938,11 +12529,17 @@ var Supervisor = class {
     this.resumeSessionDir = options.resume?.sessionDir;
     this.injectPreviousTasks = options.injectPreviousTasks ?? false;
     if (options.resume) {
-      this.sessionManager = SessionManager.resume(options.resume.sessionId, options.resume.sessionDir);
+      this.sessionManager = SessionManager.resume(
+        options.resume.sessionId,
+        options.resume.sessionDir,
+        options.homeDir
+      );
     } else {
       if (!options.homeDir) throw new Error("homeDir is required for new sessions");
       this.sessionManager = SessionManager.create(options.homeDir, workspaceDir2);
     }
+    this.sessionLock = new SessionLock(this.sessionManager.sessionDir);
+    const lockResult = this.sessionLock.acquire();
     this.ctx = new SystemContext(
       config,
       this.sessionManager.sessionId,
@@ -10950,6 +12547,12 @@ var Supervisor = class {
       workspaceDir2,
       logLevel
     );
+    if (lockResult.staleTakeover) {
+      this.ctx.logger.warn(
+        { sessionDir: this.sessionManager.sessionDir },
+        "Took over a stale session lock left by an abnormally terminated process"
+      );
+    }
     this.ctx.logger.info(
       { controllerEndpoint: this.ctx.controllerProvider.endpoint, controllerModel: this.ctx.controllerProvider.modelName },
       "Provider config"
@@ -10959,7 +12562,11 @@ var Supervisor = class {
       resolveSkillDirs(workspaceDir2, config.skillsDirs),
       this.ctx.logger
     );
-    this.engine = new TaskExecuteEngine(this.ctx, this.signalQueue, this.skills);
+    this.engine = new TaskExecuteEngine(this.ctx, this.signalQueue, this.skills, {
+      onTaskWorkspace: (workspace) => {
+        this.sessionManager.addWorkspace(workspace);
+      }
+    });
     this.controllerAgent = ControllerAgent.create({
       ctx: this.ctx,
       provider: this.ctx.controllerProvider,
@@ -10986,10 +12593,11 @@ var Supervisor = class {
     if (this.resumeSessionDir && this.injectPreviousTasks) {
       previousTasks = readSessionUnfinishedTasks(this.resumeSessionDir);
     }
+    await this.sessionManager.restore();
+    const sessionWorkspace = this.sessionManager.startupWorkspace;
     await Promise.all([
-      this.sessionManager.restore(),
       this.controllerAgent.restore(),
-      this.engine.restore(),
+      this.engine.restore(sessionWorkspace),
       this.signalQueue.restore()
     ]);
     if (previousTasks && previousTasks.length > 0) {
@@ -11044,6 +12652,11 @@ var Supervisor = class {
     this.controllerLoop.shutdown();
     this.engine.abortAll();
     this.ctx.abortController.abort();
+    try {
+      this.sessionLock.release();
+    } catch (err) {
+      this.ctx.logger.warn({ error: err.message }, "Failed to release session lock");
+    }
     this.ctx.logger.info("Supervisor shutdown complete");
     await this.ctx.closeLogger();
   }
@@ -11211,11 +12824,11 @@ async function runWayangServer(options, io = process) {
   let nextSubscriptionId = 1;
   rpc.register(METHOD.SUBSCRIBE, (params) => {
     const target = resolveTarget(params.target);
-    const path7 = requiredString(params, "path");
-    const data = target.getSnapshot(path7);
+    const path9 = requiredString(params, "path");
+    const data = target.getSnapshot(path9);
     const subscriptionId = `sub-${nextSubscriptionId++}`;
-    subscriptions.set(subscriptionId, target.subscribe(path7, (event) => {
-      rpc.notify(NOTIFY.STATE_EVENT, { subscriptionId, target: params.target, path: path7, data: event.data });
+    subscriptions.set(subscriptionId, target.subscribe(path9, (event) => {
+      rpc.notify(NOTIFY.STATE_EVENT, { subscriptionId, target: params.target, path: path9, data: event.data });
     }));
     return { subscriptionId, data: data === void 0 ? null : data };
   });
@@ -11328,10 +12941,12 @@ async function runWayangServer(options, io = process) {
     sessionDir: supervisor.ctx.sessionDir,
     workspaceDir: supervisor.ctx.workspaceDir
   });
-  process.on("SIGTERM", () => {
+  const onSignal = () => {
     void supervisor.shutdown().catch(() => {
     }).finally(() => process.exit(0));
-  });
+  };
+  process.on("SIGTERM", onSignal);
+  process.on("SIGINT", onSignal);
 }
 function requiredString(params, key) {
   const value = params[key];
@@ -11394,17 +13009,21 @@ if (result.status === "error") {
   process.exit(1);
 }
 var { input, flags } = result;
-var homeDir = path6.resolve(flags.homeDir ?? (process.env.HOME || "~"));
-var workspaceDir = path6.resolve(flags.workspaceDir ?? process.cwd());
-var configPath = flags.config ? path6.resolve(flags.config) : path6.join(homeDir, ".wayang.config.json");
+var homeDir = path8.resolve(flags.homeDir ?? (process.env.HOME || "~"));
+var workspaceDir = normalizeWorkspacePath(flags.workspaceDir ?? process.cwd());
+var configPath = flags.config ? path8.resolve(flags.config) : path8.join(homeDir, ".wayang.config.json");
 function fatal(err) {
+  if (err instanceof SessionLockedError) {
+    console.error(formatSessionLockHint(err));
+    process.exit(1);
+  }
   console.error("Fatal:", err instanceof Error ? err.message : err);
   process.exit(1);
 }
 if (input[0] === "server") {
   serverMain({
     configPath,
-    homeDir: path6.join(homeDir, ".wayang"),
+    homeDir: path8.join(homeDir, ".wayang"),
     workspaceDir,
     session: flags.session ?? "new",
     injectPreviousTasks: flags.injectPreviousTasks,
@@ -11418,7 +13037,7 @@ if (input[0] === "server") {
     homeDir,
     workspaceDir,
     logLevel: flags.verbose ? "debug" : "info",
-    fresh: flags.fresh,
+    new: flags.new,
     resume: resumeFlag ? resumeId ?? "" : void 0,
     showAll: flags.all
   }).catch(fatal);