zelari-code 2.43.1 → 2.45.0

package/dist/cli/main.bundled.js

@@ -807,7 +807,7 @@ async function openBrowser(url2) {
         return { bin: "xdg-open", args: [url2] };
     }
   })();
-  return new Promise((resolve10, reject) => {
+  return new Promise((resolve11, reject) => {
     try {
       const child = spawn19(cmd.bin, cmd.args, {
         stdio: "ignore",
@@ -816,9 +816,9 @@ async function openBrowser(url2) {
       child.on("error", (err) => reject(err));
       child.on("spawn", () => {
         child.unref();
-        resolve10();
+        resolve11();
       });
-      setTimeout(() => resolve10(), 100);
+      setTimeout(() => resolve11(), 100);
     } catch (err) {
       reject(err);
     }
@@ -867,7 +867,7 @@ async function waitForLoopbackCallback(options) {
   const host = options.host ?? "127.0.0.1";
   const timeoutMs2 = options.timeoutMs ?? 3e5;
   const expectedPath = options.path.startsWith("/") ? options.path : `/${options.path}`;
-  return new Promise((resolve10, reject) => {
+  return new Promise((resolve11, reject) => {
     let settled = false;
     const server = createServer((req, res) => {
       const url2 = new URL(req.url ?? "/", `http://${host}`);
@@ -896,7 +896,7 @@ async function waitForLoopbackCallback(options) {
       clearTimeout(timer);
       server.close(() => {
         if (err) reject(err);
-        else resolve10(value ?? {});
+        else resolve11(value ?? {});
       });
     };
     server.on("error", (err) => finish2(void 0, err));
@@ -19086,7 +19086,7 @@ function createBashTool(spawnSeam) {
     timeoutMs: 6e4,
     inputSchema: BashArgsSchema,
     execute: async (args, ctx) => {
-      return new Promise((resolve10) => {
+      return new Promise((resolve11) => {
         const start = Date.now();
         const cwd = args.cwd ?? ctx.cwd;
         const resolved = resolveShell();
@@ -19113,7 +19113,7 @@ function createBashTool(spawnSeam) {
         if (spawnSeam) {
           const seamResult = spawnSeam({ program, argv, cwd, env, signal: ctx.signal });
           if (seamResult.outcome !== "spawned") {
-            resolve10(typedErr(seamResult.reason));
+            resolve11(typedErr(seamResult.reason));
             return;
           }
           child = seamResult.child;
@@ -19140,14 +19140,14 @@ function createBashTool(spawnSeam) {
         });
         const timer = setTimeout(() => {
           child.kill("SIGTERM");
-          resolve10(typedErr(`Bash command timed out after ${args.timeoutMs}ms. If it was waiting for interactive input: stdin is closed \u2014 pass non-interactive flags or create the files directly instead of retrying.`));
+          resolve11(typedErr(`Bash command timed out after ${args.timeoutMs}ms. If it was waiting for interactive input: stdin is closed \u2014 pass non-interactive flags or create the files directly instead of retrying.`));
         }, args.timeoutMs);
         child.on("close", (code) => {
           clearTimeout(timer);
           const cappedStdout = stdout.slice(0, maxBuffer);
           const cappedStderr = stderr.slice(0, maxBuffer);
           const interactive = INTERACTIVE_CANCEL_RE.test(cappedStdout) || INTERACTIVE_CANCEL_RE.test(cappedStderr);
-          resolve10(typedOk({
+          resolve11(typedOk({
             stdout: cappedStdout,
             stderr: cappedStderr,
             exitCode: code ?? -1,
@@ -19159,7 +19159,7 @@ function createBashTool(spawnSeam) {
         });
         child.on("error", (err) => {
           clearTimeout(timer);
-          resolve10(typedErr(err.message));
+          resolve11(typedErr(err.message));
         });
       });
     }
@@ -22296,7 +22296,7 @@ var init_nodeProviders = __esm({
         const isWindows = process.platform === "win32";
         const file2 = isWindows ? "cmd.exe" : "/bin/sh";
         const args = isWindows ? ["/d", "/s", "/c", command] : ["-c", command];
-        return await new Promise((resolve10) => {
+        return await new Promise((resolve11) => {
           const child = spawn2(file2, args, {
             cwd,
             shell: false,
@@ -22329,7 +22329,7 @@ var init_nodeProviders = __esm({
           });
           child.on("error", (err) => {
             clearTimeout(timer);
-            resolve10({
+            resolve11({
               exitCode: null,
               stdout,
               stderr: `${stderr}${err.message}`,
@@ -22339,7 +22339,7 @@ var init_nodeProviders = __esm({
           });
           child.on("close", (code) => {
             clearTimeout(timer);
-            resolve10({ exitCode: code, stdout, stderr, durationMs: Date.now() - started, timedOut });
+            resolve11({ exitCode: code, stdout, stderr, durationMs: Date.now() - started, timedOut });
           });
         });
       }
@@ -22417,7 +22417,7 @@ import path16 from "node:path";
 import crypto2 from "node:crypto";
 import { spawn as spawn3 } from "node:child_process";
 async function git(cwd, args) {
-  return await new Promise((resolve10, reject) => {
+  return await new Promise((resolve11, reject) => {
     const child = spawn3("git", args, { cwd, shell: false });
     let stdout = "";
     let stderr = "";
@@ -22426,7 +22426,7 @@ async function git(cwd, args) {
     child.on("error", (err) => reject(err));
     child.on("close", (code) => {
       if (code === 0)
-        resolve10(stdout);
+        resolve11(stdout);
       else
         reject(new Error(`git ${args.join(" ")} failed (${code}): ${stderr.trim()}`));
     });
@@ -30565,8 +30565,8 @@ function wrapLegacyStream(legacyStream, params, _messages, _tools) {
       }
       if (done)
         break;
-      await new Promise((resolve10) => {
-        resolveNext = resolve10;
+      await new Promise((resolve11) => {
+        resolveNext = resolve11;
       });
     }
     await promise2;
@@ -30699,11 +30699,11 @@ var init_sessionJsonl = __esm({
        */
       scheduleFlush() {
         if (this.pending.length > 0 && !this.flushDeferred) {
-          let resolve10;
+          let resolve11;
           const promise2 = new Promise((r) => {
-            resolve10 = r;
+            resolve11 = r;
           });
-          this.flushDeferred = { promise: promise2, resolve: resolve10 };
+          this.flushDeferred = { promise: promise2, resolve: resolve11 };
         }
         if (this.flushTimer === null && this.pending.length > 0) {
           this.flushTimer = setTimeout(() => {
@@ -31010,7 +31010,7 @@ var init_lifecycleHookRunner = __esm({
       }
       /** Spawn `command`, write JSON payload to stdin, read stdout until close. */
       execCommand(command, payload, timeoutMs2, cwd) {
-        return new Promise((resolve10, reject) => {
+        return new Promise((resolve11, reject) => {
           const argv = splitHookCommandLine(command);
           if (argv.length === 0) {
             reject(new Error("empty hook command"));
@@ -31044,7 +31044,7 @@ var init_lifecycleHookRunner = __esm({
               reject(new Error(`exited ${code}: ${stderr.trim().slice(0, 200)}`));
               return;
             }
-            resolve10(stdout);
+            resolve11(stdout);
           });
           child.stdin?.on("error", () => {
           });
@@ -38898,7 +38898,7 @@ var CORE_VERSION;
 var init_version = __esm({
   "packages/core/dist/version.js"() {
     "use strict";
-    CORE_VERSION = "2.43.1";
+    CORE_VERSION = "2.45.0";
   }
 });
 
@@ -40116,15 +40116,48 @@ __export(updater_exports, {
   fetchLatestVersion: () => fetchLatestVersion,
   getCurrentVersion: () => getCurrentVersion,
   looksLikeBrokenShim: () => looksLikeBrokenShim,
+  nonGlobalUpdateAdvisory: () => nonGlobalUpdateAdvisory,
   performUpdate: () => performUpdate,
   registryUrlForTag: () => registryUrlForTag,
-  resolveBundledNpmCli: () => resolveBundledNpmCli
+  resolveBundledNpmCli: () => resolveBundledNpmCli,
+  resolveInstallKind: () => resolveInstallKind
 });
 import { createRequire } from "node:module";
-import { spawn as spawn6 } from "node:child_process";
+import { execSync, spawn as spawn6 } from "node:child_process";
 import { existsSync as existsSync14 } from "node:fs";
+import os2 from "node:os";
 import path32 from "node:path";
 import { fileURLToPath } from "node:url";
+function getGlobalPrefix() {
+  try {
+    const out = execSync("npm prefix -g", {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+    return out || null;
+  } catch {
+    return null;
+  }
+}
+function normalizeForMatch2(p3) {
+  return path32.resolve(p3).replace(/\\/g, "/").replace(/\/+$/, "").toLowerCase();
+}
+function resolveInstallKind(npmPrefix = getGlobalPrefix(), packageRoot2 = PKG_ROOT) {
+  const root = normalizeForMatch2(packageRoot2);
+  const tmp = normalizeForMatch2(os2.tmpdir());
+  const inTmp = tmp !== "" && (root === tmp || root.startsWith(`${tmp}/`));
+  if (root.split("/").includes("_npx") || inTmp) return "npx";
+  if (!npmPrefix) return "unknown";
+  const prefix = normalizeForMatch2(npmPrefix);
+  if (root === prefix || root.startsWith(`${prefix}/`)) return "global";
+  return "local";
+}
+function nonGlobalUpdateAdvisory(kind2) {
+  const where = kind2 === "npx" ? "was started via npx (from npm's cache)" : "is a local/source install";
+  return `[update] this zelari-code ${where}, not a global install \u2014 self-update is disabled.
+         update with: npx zelari-code@latest        (always fetches the latest)
+         or install persistently: npm install -g zelari-code   (enables /update)`;
+}
 function resolveBundledNpmCli(execPath = process.execPath) {
   const dir = path32.dirname(execPath);
   const candidates = [
@@ -40218,7 +40251,16 @@ async function checkForUpdate(fetcher = fetch, registryUrl) {
     updateAvailable: cmp < 0
   };
 }
-async function performUpdate(packageName = "zelari-code", executor = spawn6, resolveNpmCli = resolveBundledNpmCli, channel) {
+async function performUpdate(packageName = "zelari-code", executor = spawn6, resolveNpmCli = resolveBundledNpmCli, channel, installKind = resolveInstallKind()) {
+  if (installKind === "npx" || installKind === "local") {
+    return {
+      ok: false,
+      output: nonGlobalUpdateAdvisory(installKind),
+      error: "self-update skipped: non-global install",
+      exitCode: null,
+      installKind
+    };
+  }
   const tag = channel ?? distTagForVersion(getCurrentVersion());
   const args = ["install", "-g", `${packageName}@${tag}`];
   const primary = await runNpm(executor, args, "shim");
@@ -40235,7 +40277,7 @@ ${fallback.output}`
   return primary;
 }
 function runNpm(executor, args, mode, npmCliPath) {
-  return new Promise((resolve10) => {
+  return new Promise((resolve11) => {
     let stdout = "";
     let stderr = "";
     const stdio = ["ignore", "pipe", "pipe"];
@@ -40247,7 +40289,7 @@ function runNpm(executor, args, mode, npmCliPath) {
       stderr += chunk.toString();
     });
     child.on("error", (err) => {
-      resolve10({
+      resolve11({
         ok: false,
         output: stdout + stderr,
         error: err.message,
@@ -40256,7 +40298,7 @@ function runNpm(executor, args, mode, npmCliPath) {
     });
     child.on("close", (code) => {
       const ok = code === 0;
-      resolve10({
+      resolve11({
         ok,
         output: stdout + stderr,
         error: ok ? void 0 : `npm exited with code ${code}`,
@@ -40265,13 +40307,14 @@ function runNpm(executor, args, mode, npmCliPath) {
     });
   });
 }
-var require2, __dirname2, REGISTRY_URL;
+var require2, __dirname2, PKG_ROOT, REGISTRY_URL;
 var init_updater = __esm({
   "src/cli/updater.ts"() {
     "use strict";
     init_cmdline();
     require2 = createRequire(import.meta.url);
     __dirname2 = path32.dirname(fileURLToPath(import.meta.url));
+    PKG_ROOT = path32.resolve(__dirname2, "..", "..");
     REGISTRY_URL = "https://registry.npmjs.org/zelari-code/latest";
   }
 });
@@ -42278,8 +42321,8 @@ var init_storage = __esm({
         const prev2 = this.chains.get(key) ?? Promise.resolve();
         let release = () => {
         };
-        const next = new Promise((resolve10) => {
-          release = resolve10;
+        const next = new Promise((resolve11) => {
+          release = resolve11;
         });
         const chained = prev2.then(() => next);
         this.chains.set(key, chained);
@@ -43075,14 +43118,14 @@ var init_engine2 = __esm({
         parse: parseRuffJson
       }
     ];
-    defaultRunner = (cmd, args, opts) => new Promise((resolve10) => {
+    defaultRunner = (cmd, args, opts) => new Promise((resolve11) => {
       let stdout = "";
       let stderr = "";
       let settled = false;
       const done = (r) => {
         if (settled) return;
         settled = true;
-        resolve10(r);
+        resolve11(r);
       };
       let child;
       try {
@@ -44137,7 +44180,7 @@ async function readChecks(cwd) {
   }
 }
 function runShell(command, cwd, timeoutMs2, signal) {
-  return new Promise((resolve10) => {
+  return new Promise((resolve11) => {
     const isWin = process.platform === "win32";
     const child = spawn8(isWin ? "cmd.exe" : "/bin/sh", isWin ? ["/c", command] : ["-c", command], {
       cwd,
@@ -44151,7 +44194,7 @@ function runShell(command, cwd, timeoutMs2, signal) {
     const finish2 = (exitCode) => {
       if (settled) return;
       settled = true;
-      resolve10({ exitCode, stdout, stderr });
+      resolve11({ exitCode, stdout, stderr });
     };
     const timer = setTimeout(() => {
       try {
@@ -46862,8 +46905,8 @@ ${upstream}` : node.prompt,
         if (ms <= 0) return promise2;
         let timer;
         const TIMED_OUT = Symbol("timeout");
-        const timeout = new Promise((resolve10) => {
-          timer = setTimeout(() => resolve10(TIMED_OUT), ms);
+        const timeout = new Promise((resolve11) => {
+          timer = setTimeout(() => resolve11(TIMED_OUT), ms);
         });
         const raced = await Promise.race([promise2, timeout]).finally(() => {
           if (timer) clearTimeout(timer);
@@ -46872,8 +46915,8 @@ ${upstream}` : node.prompt,
         controller?.abort();
         const graceMs = this.cancelGraceMs ?? resolveCancelGraceMs();
         let graceTimer;
-        const grace = new Promise((resolve10) => {
-          graceTimer = setTimeout(() => resolve10(TIMED_OUT), graceMs);
+        const grace = new Promise((resolve11) => {
+          graceTimer = setTimeout(() => resolve11(TIMED_OUT), graceMs);
         });
         const settled = await Promise.race([promise2, grace]).finally(() => {
           if (graceTimer) clearTimeout(graceTimer);
@@ -47640,13 +47683,13 @@ ${findings || "(the reviewer reported FAIL without detail)"}`;
 async function runAutoVerifyAfterGeneral(opts) {
   const g = globalThis;
   g.__zelariGeneralVerifyDebt = { description: opts.original.description };
-  const emitVerifyPhase = (detail2, ok) => {
+  const emitVerifyPhase = (detail2, ok, terminal) => {
     const agentId = opts.general.agentId;
     if (agentId) {
       opts.deps.onTentacleEvent?.({
         type: "agent_status",
         agentId,
-        status: "running",
+        status: terminal ?? "running",
         message: detail2,
         id: randomUUID4(),
         sessionId: opts.sessionId,
@@ -47714,6 +47757,7 @@ async function runAutoVerifyAfterGeneral(opts) {
           detail: detail2,
           ok: false
         });
+        emitVerifyPhase(`rework round ${round2} failed`, false, "failed");
         return `
 
 [kraken:auto-verify] verify FAIL \u2014 rework round ${round2} failed to run (${rework.error}). Work stays UNVERIFIED; strict done will close this turn blocked.`;
@@ -47725,14 +47769,15 @@ async function runAutoVerifyAfterGeneral(opts) {
   }
   if (verdict === "pass") {
     g.__zelariGeneralVerifyDebt = null;
-    emitVerifyPhase("verify PASS", true);
+    emitVerifyPhase("verify PASS", true, "completed");
     return `
 
 [kraken:auto-verify] verify PASS \u2014 general\u21D2verify obligation satisfied.`;
   }
   emitVerifyPhase(
     verdict === "fail" ? "verify FAIL" : verify.ok ? "verify unknown" : "verify failed",
-    verdict === "fail" || !verify.ok ? false : void 0
+    verdict === "fail" || !verify.ok ? false : void 0,
+    "failed"
   );
   const detail = verdict === "fail" ? `verify FAIL unresolved (rework budget spent): ${findings || "no findings reported"}` : verify.ok ? "verify produced no parseable VERDICT \u2014 unverified" : `verify tentacle failed: ${verify.error}`;
   g.__zelariGeneralVerifyDebt = { description: opts.original.description, detail };
@@ -50772,13 +50817,13 @@ async function scanTsbuildinfo(root) {
   return found;
 }
 async function gitStatusPorcelain(root) {
-  return new Promise((resolve10) => {
+  return new Promise((resolve11) => {
     const child = spawn9("git", ["status", "--porcelain"], { cwd: root, shell: false });
     let out = "";
     child.stdout.on("data", (d) => out += d.toString());
     child.stderr.on("data", (d) => out += d.toString());
-    child.on("error", () => resolve10("<git-unavailable>"));
-    child.on("close", (code) => resolve10(code === 0 ? out : `<git-exit-${code ?? "none"}>`));
+    child.on("error", () => resolve11("<git-unavailable>"));
+    child.on("close", (code) => resolve11(code === 0 ? out : `<git-exit-${code ?? "none"}>`));
   });
 }
 async function fingerprintWorkspace(root) {
@@ -50826,7 +50871,7 @@ var init_inspectTypecheckSafety = __esm({
 import { spawn as spawn10 } from "node:child_process";
 import { createHash as createHash14 } from "node:crypto";
 import { existsSync as existsSync30, promises as fs23 } from "node:fs";
-import os2 from "node:os";
+import os3 from "node:os";
 import path52 from "node:path";
 function resolveNodeModuleBin(start, rel2) {
   let dir = path52.resolve(start);
@@ -50912,7 +50957,7 @@ function buildInspectCommand(op, ctx) {
     case "typecheck": {
       const project = path52.resolve(ctx.cwd, op.project ?? "tsconfig.json");
       const hash3 = createHash14("sha256").update(project).digest("hex").slice(0, 16);
-      const tsBuildInfoFile = path52.join(os2.tmpdir(), "zelari-inspect", `${hash3}.tsbuildinfo`);
+      const tsBuildInfoFile = path52.join(os3.tmpdir(), "zelari-inspect", `${hash3}.tsbuildinfo`);
       return {
         ok: true,
         command: process.execPath,
@@ -50936,12 +50981,12 @@ function buildInspectCommand(op, ctx) {
   }
 }
 function runSpawn(command, argv, opts) {
-  return new Promise((resolve10) => {
+  return new Promise((resolve11) => {
     let child;
     try {
       child = spawn10(command, argv, { cwd: opts.cwd, shell: false });
     } catch (err) {
-      resolve10({ code: null, stdout: "", stderr: String(err), timedOut: false, spawnError: String(err) });
+      resolve11({ code: null, stdout: "", stderr: String(err), timedOut: false, spawnError: String(err) });
       return;
     }
     let stdout = "";
@@ -50963,14 +51008,14 @@ function runSpawn(command, argv, opts) {
       if (settled) return;
       settled = true;
       clearTimeout(timer);
-      resolve10({ code: null, stdout, stderr, timedOut, spawnError: err.message });
+      resolve11({ code: null, stdout, stderr, timedOut, spawnError: err.message });
     });
     child.on("close", (code) => {
       if (settled) return;
       settled = true;
       clearTimeout(timer);
       opts.signal?.removeEventListener("abort", onAbort);
-      resolve10({ code, stdout, stderr, timedOut });
+      resolve11({ code, stdout, stderr, timedOut });
     });
   });
 }
@@ -51255,7 +51300,7 @@ function createExecProcessTool(root, opts = {}) {
         const msg = err instanceof SandboxViolationError ? err.message : String(err);
         return typedErr(`[sandbox] ${msg}`);
       }
-      return new Promise((resolve10) => {
+      return new Promise((resolve11) => {
         const start = Date.now();
         const spec = { ...baseSpec, network: opts.resolveNetwork?.(input) ?? baseSpec.network };
         const res = spawnJailed(spec, {
@@ -51267,11 +51312,11 @@ function createExecProcessTool(root, opts = {}) {
           envExtras: { CI: process.env.CI ?? "1" }
         });
         if (res.outcome === "denied") {
-          resolve10(typedErr(res.reason));
+          resolve11(typedErr(res.reason));
           return;
         }
         if (res.outcome === "failed") {
-          resolve10(typedErr(`exec_process could not launch ${input.program}: ${res.reason}`));
+          resolve11(typedErr(`exec_process could not launch ${input.program}: ${res.reason}`));
           return;
         }
         const meta3 = res.notice ? { status: "complete", warnings: [`os-jail: ${res.notice}`] } : void 0;
@@ -51287,7 +51332,7 @@ function createExecProcessTool(root, opts = {}) {
         const timeoutMs2 = typeof input.timeoutMs === "number" && input.timeoutMs > 0 ? input.timeoutMs : 3e4;
         const timer = setTimeout(() => {
           child.kill("SIGTERM");
-          resolve10(
+          resolve11(
             typedErr(
               `exec_process timed out after ${timeoutMs2}ms running: ${[input.program, ...argv].join(" ")}`
             )
@@ -51295,11 +51340,11 @@ function createExecProcessTool(root, opts = {}) {
         }, timeoutMs2);
         child.on("error", (err) => {
           clearTimeout(timer);
-          resolve10(typedErr(`exec_process could not launch ${input.program}: ${err.message}`));
+          resolve11(typedErr(`exec_process could not launch ${input.program}: ${err.message}`));
         });
         child.on("close", (code) => {
           clearTimeout(timer);
-          resolve10(
+          resolve11(
             typedOk(
               {
                 exitCode: code ?? -1,
@@ -51828,12 +51873,12 @@ var init_client = __esm({
         if (this.closed) return Promise.reject(new Error("LSP transport is closed"));
         const id3 = this.nextId++;
         const msg = { jsonrpc: "2.0", id: id3, method, ...params !== void 0 ? { params } : {} };
-        return new Promise((resolve10, reject) => {
+        return new Promise((resolve11, reject) => {
           const timer = setTimeout(() => {
             this.pending.delete(id3);
             reject(new Error(`LSP request "${method}" timed out after ${this.timeoutMs}ms`));
           }, this.timeoutMs);
-          this.pending.set(id3, { resolve: resolve10, reject, timer });
+          this.pending.set(id3, { resolve: resolve11, reject, timer });
           this.transport.send(encodeMessage(msg));
         });
       }
@@ -52110,8 +52155,8 @@ var init_manager = __esm({
         if (cached2 !== void 0) return cached2;
         let resolveInit;
         let rejectInit;
-        const initialized = new Promise((resolve10, reject) => {
-          resolveInit = resolve10;
+        const initialized = new Promise((resolve11, reject) => {
+          resolveInit = resolve11;
           rejectInit = reject;
         });
         let entry = null;
@@ -52636,14 +52681,14 @@ function resolveStreamTimeouts(capabilities) {
   };
 }
 function abortableSleep(ms, signal) {
-  return new Promise((resolve10) => {
-    if (signal?.aborted) return resolve10();
-    const t = setTimeout(resolve10, ms);
+  return new Promise((resolve11) => {
+    if (signal?.aborted) return resolve11();
+    const t = setTimeout(resolve11, ms);
     signal?.addEventListener(
       "abort",
       () => {
         clearTimeout(t);
-        resolve10();
+        resolve11();
       },
       { once: true }
     );
@@ -53517,8 +53562,8 @@ async function runBrowserCheck(options, loader) {
   const failedRequests = [];
   const evaluateResults = [];
   const base2 = { ok: false, consoleErrors, pageErrors, failedRequests };
-  const resolve10 = loader ?? (() => loadPlaywright(options.cwd ?? process.cwd()));
-  const pw = await resolve10();
+  const resolve11 = loader ?? (() => loadPlaywright(options.cwd ?? process.cwd()));
+  const pw = await resolve11();
   if (!pw) {
     return {
       ...base2,
@@ -53681,7 +53726,7 @@ var init_driver = __esm({
 
 // src/cli/browser/tools.ts
 import path58 from "node:path";
-import os3 from "node:os";
+import os4 from "node:os";
 import { readFile as readFile8 } from "node:fs/promises";
 async function loadImageBlock(filePath) {
   try {
@@ -53708,7 +53753,7 @@ function createBrowserTool(deps = {}) {
     }),
     execute: async (args, ctx) => {
       const a = args;
-      const dir = deps.screenshotDir ?? os3.tmpdir();
+      const dir = deps.screenshotDir ?? os4.tmpdir();
       const screenshotPath = a.screenshot === false ? void 0 : path58.join(dir, `zelari-browser-${Date.now()}.png`);
       const result = await runBrowserCheck(
         {
@@ -54111,9 +54156,9 @@ exec node "$(dirname "$0")/askpass.cjs"
   return sh;
 }
 function runSsh(target, remoteCommand, timeoutMs2 = 6e4) {
-  return new Promise((resolve10) => {
+  return new Promise((resolve11) => {
     if (target.auth === "password" && !getSshPassword(target.id)) {
-      resolve10({
+      resolve11({
         code: 1,
         stdout: "",
         stderr: "No password stored for this target \u2014 edit target and set password"
@@ -54145,7 +54190,7 @@ function runSsh(target, remoteCommand, timeoutMs2 = 6e4) {
     });
     const timer = setTimeout(() => {
       child.kill("SIGTERM");
-      resolve10({
+      resolve11({
         code: 124,
         stdout,
         stderr: stderr + "\n[ssh] timeout"
@@ -54153,7 +54198,7 @@ function runSsh(target, remoteCommand, timeoutMs2 = 6e4) {
     }, timeoutMs2);
     child.on("error", (err) => {
       clearTimeout(timer);
-      resolve10({
+      resolve11({
         code: 127,
         stdout,
         stderr: err.message.includes("ENOENT") ? "ssh not found on PATH \u2014 install OpenSSH client" : err.message
@@ -54161,7 +54206,7 @@ function runSsh(target, remoteCommand, timeoutMs2 = 6e4) {
     });
     child.on("close", (code) => {
       clearTimeout(timer);
-      resolve10({ code: code ?? 1, stdout, stderr });
+      resolve11({ code: code ?? 1, stdout, stderr });
     });
   });
 }
@@ -54938,14 +54983,14 @@ function backoffDelay2(attempt, retryAfterHeader) {
   return Math.min(BACKOFF_BASE_MS2 * 2 ** attempt, BACKOFF_CAP_MS2);
 }
 function abortableSleep2(ms, signal) {
-  return new Promise((resolve10) => {
-    if (signal?.aborted) return resolve10();
-    const t = setTimeout(resolve10, ms);
+  return new Promise((resolve11) => {
+    if (signal?.aborted) return resolve11();
+    const t = setTimeout(resolve11, ms);
     signal?.addEventListener(
       "abort",
       () => {
         clearTimeout(t);
-        resolve10();
+        resolve11();
       },
       { once: true }
     );
@@ -55346,6 +55391,45 @@ var init_crossProviderFailover = __esm({
   }
 });
 
+// src/cli/serve/sessionControl.ts
+import { AsyncLocalStorage } from "node:async_hooks";
+function runWithSession(sessionId2, fn) {
+  return dispatchContext.run({ sessionId: sessionId2, token: {} }, fn);
+}
+function getCurrentHarnessSessionId() {
+  return dispatchContext.getStore()?.sessionId;
+}
+function registerLiveTurnControl(control) {
+  const store6 = dispatchContext.getStore();
+  if (!store6) return void 0;
+  const registered = { ...control, token: store6.token };
+  liveTurns.set(store6.sessionId, registered);
+  return () => {
+    if (liveTurns.get(store6.sessionId) === registered) {
+      liveTurns.delete(store6.sessionId);
+    }
+  };
+}
+function getLiveTurnControl(sessionId2) {
+  return liveTurns.get(sessionId2);
+}
+function clearSessionTurnControl(sessionId2) {
+  const store6 = dispatchContext.getStore();
+  if (!store6 || store6.sessionId !== sessionId2) return;
+  const registered = liveTurns.get(sessionId2);
+  if (registered && registered.token === store6.token) {
+    liveTurns.delete(sessionId2);
+  }
+}
+var dispatchContext, liveTurns;
+var init_sessionControl = __esm({
+  "src/cli/serve/sessionControl.ts"() {
+    "use strict";
+    dispatchContext = new AsyncLocalStorage();
+    liveTurns = /* @__PURE__ */ new Map();
+  }
+});
+
 // src/cli/safety/toolPermissions.ts
 var toolPermissions_exports = {};
 __export(toolPermissions_exports, {
@@ -55362,27 +55446,42 @@ __export(toolPermissions_exports, {
   parsePermissionPreset: () => parsePermissionPreset,
   resolveToolPermission: () => resolveToolPermission
 });
-function grantSessionTool(toolName) {
+function grantsBucket(sessionId2) {
+  const key = sessionId2 && sessionId2.trim() ? sessionId2 : GLOBAL_BUCKET;
+  let bucket = grantsBySession.get(key);
+  if (!bucket) {
+    bucket = { tools: /* @__PURE__ */ new Set(), categories: /* @__PURE__ */ new Set() };
+    grantsBySession.set(key, bucket);
+  }
+  return bucket;
+}
+function grantSessionTool(toolName, sessionId2) {
   const n = toolName.trim();
-  if (n) sessionToolGrants.add(n);
+  if (n) grantsBucket(sessionId2).tools.add(n);
 }
-function grantSessionCategory(cat) {
-  sessionCategoryGrants.add(cat);
+function grantSessionCategory(cat, sessionId2) {
+  grantsBucket(sessionId2).categories.add(cat);
 }
-function clearSessionPermissionGrants() {
-  sessionToolGrants.clear();
-  sessionCategoryGrants.clear();
+function clearSessionPermissionGrants(sessionId2) {
+  if (sessionId2 === void 0) {
+    grantsBySession.clear();
+    return;
+  }
+  grantsBySession.delete(sessionId2 && sessionId2.trim() ? sessionId2 : GLOBAL_BUCKET);
 }
-function listSessionPermissionGrants() {
+function listSessionPermissionGrants(sessionId2) {
+  const bucket = grantsBucket(sessionId2);
   return {
-    tools: [...sessionToolGrants].sort(),
-    categories: [...sessionCategoryGrants]
+    tools: [...bucket.tools].sort(),
+    categories: [...bucket.categories]
   };
 }
-function isSessionGranted(toolName, required2) {
-  if (sessionToolGrants.has(toolName)) return true;
+function isSessionGranted(toolName, required2, sessionId2) {
+  const scope = sessionId2 ?? getCurrentHarnessSessionId();
+  const bucket = grantsBucket(scope);
+  if (bucket.tools.has(toolName)) return true;
   if (!required2.length) return false;
-  return required2.every((c) => sessionCategoryGrants.has(c));
+  return required2.every((c) => bucket.categories.has(c));
 }
 function parseAction(raw, fallback) {
   const v = raw?.trim().toLowerCase();
@@ -55464,12 +55563,13 @@ function resolveToolPermission(toolName, required2, policy) {
     categories: hit
   };
 }
-var sessionToolGrants, sessionCategoryGrants, PERMISSION_PRESETS, ACTION_RANK2;
+var GLOBAL_BUCKET, grantsBySession, PERMISSION_PRESETS, ACTION_RANK2;
 var init_toolPermissions = __esm({
   "src/cli/safety/toolPermissions.ts"() {
     "use strict";
-    sessionToolGrants = /* @__PURE__ */ new Set();
-    sessionCategoryGrants = /* @__PURE__ */ new Set();
+    init_sessionControl();
+    GLOBAL_BUCKET = "";
+    grantsBySession = /* @__PURE__ */ new Map();
     PERMISSION_PRESETS = {
       standard: { read: "allow", write: "allow", execute: "ask", network: "ask" },
       strict: { read: "allow", write: "ask", execute: "ask", network: "deny" },
@@ -56980,6 +57080,9 @@ function wrapWithPermissions(original, policy, onAsk, agentLayers, precedence =
       }
       const claimHit = claims && claims.effect !== void 0 ? claims.matchedRules.find((x) => x.effect === claims.effect) : void 0;
       const rulePrefix = contractRule ? `[contract] rule '${contractRule.match}'${contractRule.reason ? ` \u2014 ${contractRule.reason}` : ""}` : rule ? `[policy] rule '${rule.match}'${rule.reason ? ` \u2014 ${rule.reason}` : ""}` : claimHit ? `[policy] claim '${claimHit.match}'${claimHit.reason ? ` \u2014 ${claimHit.reason}` : ""}` : "";
+      if (action === "ask" && activePermissionPreset() === "yolo") {
+        action = "allow";
+      }
       if (action === "deny") {
         return typedErr(`[permission] ${rulePrefix || decision.reason}`);
       }
@@ -57510,12 +57613,12 @@ var init_metrics3 = __esm({
       }
       /** Append a single record synchronously (file I/O). */
       append(rec) {
-        return new Promise((resolve10, reject) => {
+        return new Promise((resolve11, reject) => {
           try {
             this.maybeRotate();
             const line = JSON.stringify(rec) + "\n";
             appendFileSync3(this.file, line, { encoding: "utf-8" });
-            resolve10();
+            resolve11();
           } catch (err) {
             reject(err);
           }
@@ -58900,8 +59003,8 @@ var init_sqliteRpc = __esm({
         const worker = this.worker;
         if (!worker) return Promise.reject(new Error("SQLite worker is not open."));
         const id3 = this.nextId++;
-        return new Promise((resolve10, reject) => {
-          this.pending.set(id3, { resolve: resolve10, reject });
+        return new Promise((resolve11, reject) => {
+          this.pending.set(id3, { resolve: resolve11, reject });
           worker.postMessage({ id: id3, operation, args });
         });
       }
@@ -58912,7 +59015,7 @@ var init_sqliteRpc = __esm({
             return await this.request(operation, args);
           } catch (error51) {
             if (!isBusy(error51) || attempt >= 3) throw error51;
-            await new Promise((resolve10) => setTimeout(resolve10, 25 * 2 ** attempt));
+            await new Promise((resolve11) => setTimeout(resolve11, 25 * 2 ** attempt));
             attempt += 1;
           }
         }
@@ -61831,13 +61934,13 @@ __export(claudeProvider_exports, {
 });
 import { spawn as spawn13 } from "node:child_process";
 function waitForExit(child, timeoutMs2 = 2e3) {
-  return new Promise((resolve10) => {
-    if (child.exitCode != null) return resolve10(child.exitCode);
-    const timer = setTimeout(() => resolve10(child.exitCode ?? null), timeoutMs2);
+  return new Promise((resolve11) => {
+    if (child.exitCode != null) return resolve11(child.exitCode);
+    const timer = setTimeout(() => resolve11(child.exitCode ?? null), timeoutMs2);
     timer.unref?.();
     child.once("exit", (code) => {
       clearTimeout(timer);
-      resolve10(code ?? null);
+      resolve11(code ?? null);
     });
   });
 }
@@ -63752,7 +63855,7 @@ var init_mcpClient = __esm({
         if (!transport && !child)
           return Promise.reject(new Error(`[mcp:${this.serverName}] not started`));
         const id3 = this.nextId++;
-        return new Promise((resolve10, reject) => {
+        return new Promise((resolve11, reject) => {
           const timer = setTimeout(() => {
             this.pending.delete(id3);
             reject(
@@ -63761,7 +63864,7 @@ var init_mcpClient = __esm({
               )
             );
           }, timeoutMs2);
-          this.pending.set(id3, { resolve: resolve10, reject, timer });
+          this.pending.set(id3, { resolve: resolve11, reject, timer });
           if (transport) {
             void transport.send({ id: id3, method, params }, timeoutMs2);
           } else {
@@ -66947,12 +67050,12 @@ function startPermissionBroker(socketPath, handlers, opts) {
       });
     }
   }
-  return new Promise((resolve10, reject) => {
+  return new Promise((resolve11, reject) => {
     const onError = (err) => reject(err);
     server.once("error", onError);
     server.listen(path104, () => {
       server.removeListener("error", onError);
-      resolve10({
+      resolve11({
         socketPath: path104,
         stop: () => new Promise((res) => {
           for (const s of sockets) s.destroy();
@@ -66980,7 +67083,7 @@ function requestBrokerAsk(socketPath, ask, opts) {
   const path104 = safeSocketPath(socketPath);
   const requestTimeoutMs = opts?.requestTimeoutMs ?? PERMISSION_BROKER_DEFAULT_TIMEOUT_MS;
   const connectTimeoutMs = opts?.connectTimeoutMs ?? PERMISSION_BROKER_DEFAULT_CONNECT_TIMEOUT_MS;
-  return new Promise((resolve10, reject) => {
+  return new Promise((resolve11, reject) => {
     const socket = connect(path104);
     let buffer = "";
     let settled = false;
@@ -67033,7 +67136,7 @@ function requestBrokerAsk(socketPath, ask, opts) {
         }
         if (msg?.t === "answer" && msg.id === ask.id) {
           const { t: _t, id: _id, ...answer } = msg;
-          settle(() => resolve10(answer));
+          settle(() => resolve11(answer));
           return;
         }
       }
@@ -67812,7 +67915,7 @@ __export(prereqChecks_exports, {
   isWslBashPath: () => isWslBashPath2,
   runPrereqChecks: () => runPrereqChecks
 });
-import { execSync, spawnSync as spawnSync2 } from "node:child_process";
+import { execSync as execSync2, spawnSync as spawnSync2 } from "node:child_process";
 import { existsSync as existsSync54 } from "node:fs";
 import { dirname as dirname13 } from "node:path";
 function isWslBashPath2(p3) {
@@ -67972,7 +68075,7 @@ function probeTool(tool) {
     }
   } else if (process.platform === "win32") {
     try {
-      stdout = execSync(`${tool} --version`, {
+      stdout = execSync2(`${tool} --version`, {
         encoding: "utf8",
         stdio: ["ignore", "pipe", "ignore"],
         env
@@ -67981,7 +68084,7 @@ function probeTool(tool) {
     }
   } else {
     try {
-      stdout = execSync(`${tool} --version`, {
+      stdout = execSync2(`${tool} --version`, {
         encoding: "utf8",
         stdio: ["ignore", "pipe", "ignore"],
         env
@@ -68106,7 +68209,7 @@ function checkAgentBash() {
 }
 function checkMainNode() {
   try {
-    const raw = execSync("node --version", {
+    const raw = execSync2("node --version", {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"]
     }).trim();
@@ -68166,7 +68269,7 @@ var MIN_NODE_MAJOR, STANDARD_BASH_PATHS2, POWERSHELL_EXES2, STANDARD_POWERSHELL_
 var init_prereqChecks = __esm({
   "src/cli/utils/prereqChecks.ts"() {
     "use strict";
-    MIN_NODE_MAJOR = 24;
+    MIN_NODE_MAJOR = 20;
     STANDARD_BASH_PATHS2 = [
       "C:\\Program Files\\Git\\bin\\bash.exe",
       "C:\\Program Files\\Git\\usr\\bin\\bash.exe",
@@ -69697,42 +69800,6 @@ var init_harnessStateEmit = __esm({
   }
 });
 
-// src/cli/serve/sessionControl.ts
-import { AsyncLocalStorage } from "node:async_hooks";
-function runWithSession(sessionId2, fn) {
-  return dispatchContext.run({ sessionId: sessionId2, token: {} }, fn);
-}
-function registerLiveTurnControl(control) {
-  const store6 = dispatchContext.getStore();
-  if (!store6) return void 0;
-  const registered = { ...control, token: store6.token };
-  liveTurns.set(store6.sessionId, registered);
-  return () => {
-    if (liveTurns.get(store6.sessionId) === registered) {
-      liveTurns.delete(store6.sessionId);
-    }
-  };
-}
-function getLiveTurnControl(sessionId2) {
-  return liveTurns.get(sessionId2);
-}
-function clearSessionTurnControl(sessionId2) {
-  const store6 = dispatchContext.getStore();
-  if (!store6 || store6.sessionId !== sessionId2) return;
-  const registered = liveTurns.get(sessionId2);
-  if (registered && registered.token === store6.token) {
-    liveTurns.delete(sessionId2);
-  }
-}
-var dispatchContext, liveTurns;
-var init_sessionControl = __esm({
-  "src/cli/serve/sessionControl.ts"() {
-    "use strict";
-    dispatchContext = new AsyncLocalStorage();
-    liveTurns = /* @__PURE__ */ new Map();
-  }
-});
-
 // src/cli/headless/controlReader.ts
 function parseControlEvent(raw) {
   if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
@@ -74117,8 +74184,8 @@ async function startMemoryMcpServer(options) {
   let stopped = false;
   let finalizePromise;
   let resolveClosed = () => void 0;
-  const closed = new Promise((resolve10) => {
-    resolveClosed = resolve10;
+  const closed = new Promise((resolve11) => {
+    resolveClosed = resolve11;
   });
   const adapter = new MemoryMcpAdapter({
     service,
@@ -74265,8 +74332,8 @@ function startPermissionMcpServer(opts) {
   });
   let closedResolve = () => {
   };
-  const closed = new Promise((resolve10) => {
-    closedResolve = resolve10;
+  const closed = new Promise((resolve11) => {
+    closedResolve = resolve11;
   });
   let stopped = false;
   const send = (obj) => {
@@ -74522,9 +74589,10 @@ import {
   existsSync as existsSync61,
   mkdirSync as mkdirSync24,
   readFileSync as readFileSync45,
+  statSync as statSync10,
   writeFileSync as writeFileSync26
 } from "node:fs";
-import { join as join48 } from "node:path";
+import { join as join48, resolve as resolve9 } from "node:path";
 import { createHash as createHash26, randomBytes as randomBytes7, timingSafeEqual } from "node:crypto";
 function getZelariHome() {
   return zelariHome();
@@ -74613,6 +74681,30 @@ function slugFromPath(p3) {
   const base2 = p3.replace(/[/\\]+$/, "").split(/[/\\]/).pop() || "project";
   return base2.toLowerCase().replace(/[^a-z0-9-_]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 48) || "project";
 }
+function resolveFsDirectory(rawPath) {
+  const trimmed = rawPath.trim();
+  if (!trimmed) return { ok: false, error: "cwd is required" };
+  const norm = trimmed.replace(/\\/g, "/");
+  const absolute = /^([a-zA-Z]:\/|\/)/.test(norm);
+  if (!absolute || norm.split("/").includes("..")) {
+    return {
+      ok: false,
+      error: `cwd must be an absolute path without '..': ${trimmed}`
+    };
+  }
+  let stat8;
+  try {
+    stat8 = statSync10(trimmed);
+  } catch {
+    return { ok: false, error: `path not found: ${trimmed}` };
+  }
+  if (!stat8.isDirectory()) {
+    return { ok: false, error: `not a directory: ${trimmed}` };
+  }
+  const abs = resolve9(trimmed);
+  const slug = slugFromPath(abs);
+  return { ok: true, project: { id: slug, name: slug, path: abs } };
+}
 function mergeProjects(cfg, extraPaths) {
   const byId = /* @__PURE__ */ new Map();
   for (const p3 of cfg.projects) {
@@ -74634,24 +74726,24 @@ function mergeProjects(cfg, extraPaths) {
   }
   return [...byId.values()];
 }
-function resolveProjectPath(projects, cwdOrId) {
-  if (!projects.length) {
+function resolveProjectPath(projects, cwdOrId, opts = {}) {
+  const key = String(cwdOrId ?? "").trim();
+  if (!projects.length && !(opts.fullFs && key)) {
     return {
       ok: false,
       error: "No projects configured. Pass --project <path> or edit ~/.zelari-code/companion.json"
     };
   }
-  if (!cwdOrId || !String(cwdOrId).trim()) {
-    return { ok: true, project: projects[0] };
+  if (!key) {
+    return { ok: true, project: projects[0], trusted: true };
   }
-  const key = String(cwdOrId).trim();
   const byId = projects.find((p3) => p3.id === key || p3.name === key);
-  if (byId) return { ok: true, project: byId };
+  if (byId) return { ok: true, project: byId, trusted: true };
   const norm = key.replace(/\\/g, "/").toLowerCase();
   const byPath = projects.find(
     (p3) => p3.path.replace(/\\/g, "/").toLowerCase() === norm
   );
-  if (byPath) return { ok: true, project: byPath };
+  if (byPath) return { ok: true, project: byPath, trusted: true };
   const under = projects.find((p3) => {
     const root = p3.path.replace(/\\/g, "/").toLowerCase().replace(/\/$/, "");
     return norm === root || norm.startsWith(root + "/");
@@ -74659,14 +74751,31 @@ function resolveProjectPath(projects, cwdOrId) {
   if (under) {
     return {
       ok: true,
-      project: { ...under, path: key }
+      project: { ...under, path: key },
+      trusted: true
     };
   }
+  if (opts.fullFs) {
+    const dir = resolveFsDirectory(key);
+    if (dir.ok) return { ok: true, project: dir.project, trusted: false };
+    return { ok: false, error: dir.error };
+  }
   return {
     ok: false,
     error: `cwd/project not in allowlist: ${key}. Allowed: ${projects.map((p3) => p3.id).join(", ")}`
   };
 }
+function isUnderRoots(rawPath, projects) {
+  const norm = rawPath.replace(/\\/g, "/").toLowerCase().replace(/\/+$/, "");
+  if (!norm || norm.split("/").includes("..")) return { ok: false };
+  for (const p3 of projects) {
+    const root = p3.path.replace(/\\/g, "/").toLowerCase().replace(/\/+$/, "");
+    if (norm === root || norm.startsWith(root + "/")) {
+      return { ok: true, root: p3, normalized: norm };
+    }
+  }
+  return { ok: false };
+}
 var DEFAULT_COMPANION_PORT, DEFAULT_COMPANION_BIND;
 var init_config = __esm({
   "src/cli/companion/config.ts"() {
@@ -74705,6 +74814,7 @@ function createServePermissionBridge(write, timeoutMs2 = 12e4) {
         type: "permission.settled",
         requestId,
         decision,
+        ...entry.sessionId ? { sessionId: entry.sessionId } : {},
         ...timedOut ? { timedOut: true } : {}
       })
     );
@@ -74715,15 +74825,17 @@ function createServePermissionBridge(write, timeoutMs2 = 12e4) {
     onPermissionAsk(payload) {
       const requestId = `perm-${Date.now()}-${++seq}`;
       const categories = payload.categories && payload.categories.length > 0 ? payload.categories : payload.category ? payload.category.split(",").map((c) => c.trim()).filter(Boolean) : [];
-      return new Promise((resolve10) => {
+      return new Promise((resolve11) => {
         const timer = setTimeout(() => {
           settle(requestId, "deny", true);
         }, timeoutMs2);
-        pending.set(requestId, { resolve: resolve10, timer, payload });
+        const sessionId2 = getCurrentHarnessSessionId();
+        pending.set(requestId, { resolve: resolve11, timer, payload, sessionId: sessionId2 });
         write(
           JSON.stringify({
             type: "permission.request",
             requestId,
+            ...sessionId2 ? { sessionId: sessionId2 } : {},
             tool: payload.tool,
             category: payload.category,
             categories,
@@ -74733,12 +74845,19 @@ function createServePermissionBridge(write, timeoutMs2 = 12e4) {
         );
       });
     },
-    respond: (requestId, decision) => settle(requestId, decision, false),
+    respond: (requestId, decision, scopeSessionId) => {
+      const entry = pending.get(requestId);
+      if (entry && scopeSessionId && entry.sessionId !== scopeSessionId) {
+        return false;
+      }
+      return settle(requestId, decision, false);
+    },
+    sessionOf: (requestId) => pending.get(requestId)?.sessionId,
     releaseGranted() {
       let n = 0;
       for (const [id3, entry] of [...pending]) {
         const cats = entry.payload.categories && entry.payload.categories.length > 0 ? entry.payload.categories : entry.payload.category ? entry.payload.category.split(",").map((c) => c.trim()).filter(Boolean) : [];
-        if (isSessionGranted(entry.payload.tool, cats)) {
+        if (isSessionGranted(entry.payload.tool, cats, entry.sessionId)) {
           if (settle(id3, "allow", false)) n += 1;
         }
       }
@@ -74751,7 +74870,7 @@ function servePermissionRespond(bridge, params) {
   if (!params || typeof params !== "object") {
     return { accepted: false, reason: "permission.respond requires an object params" };
   }
-  const { requestId, decision } = params;
+  const { requestId, decision, sessionId: sessionId2 } = params;
   if (typeof requestId !== "string" || requestId.length === 0) {
     return { accepted: false, reason: "permission.respond requires a non-empty string requestId" };
   }
@@ -74761,7 +74880,11 @@ function servePermissionRespond(bridge, params) {
       reason: "permission.respond decision must be 'allow' | 'deny' | 'always-tool' | 'always-category'"
     };
   }
-  return { accepted: bridge.respond(requestId, decision) };
+  const scope = typeof sessionId2 === "string" && sessionId2.length > 0 ? sessionId2 : void 0;
+  if (scope && bridge.sessionOf(requestId) !== scope) {
+    return { accepted: false, reason: "session_mismatch: requestId belongs to another session" };
+  }
+  return { accepted: bridge.respond(requestId, decision, scope) };
 }
 function asRegistryAskHandler(bridge) {
   return async (req) => {
@@ -74774,14 +74897,15 @@ function asRegistryAskHandler(bridge) {
       ...req.claims && req.claims.length > 0 ? { inputPreview: req.claims.map((c) => c.summary).join(" \xB7 ") } : {}
     });
     if (decision === "deny") return false;
+    const sessionId2 = getCurrentHarnessSessionId();
     if (decision === "always-tool") {
-      grantSessionTool(req.toolName);
+      grantSessionTool(req.toolName, sessionId2);
       bridge.releaseGranted();
     } else if (decision === "always-category") {
       for (const cat of req.categories) {
-        grantSessionCategory(cat);
+        grantSessionCategory(cat, sessionId2);
       }
-      grantSessionTool(req.toolName);
+      grantSessionTool(req.toolName, sessionId2);
       bridge.releaseGranted();
     }
     return true;
@@ -74792,6 +74916,7 @@ var init_permissionBridge = __esm({
   "src/cli/serve/permissionBridge.ts"() {
     "use strict";
     init_toolPermissions();
+    init_sessionControl();
     SERVE_PERMISSION_PRESETS = ["standard", "strict", "yolo"];
     PRESET_ENV = "ZELARI_PERMISSION_PRESET";
     PERMISSION_DECISIONS = [
@@ -74817,6 +74942,7 @@ function createServeAskUserBridge(write, timeoutMs2 = askUserTimeoutMs()) {
         type: "ask_user.settled",
         requestId,
         answer,
+        ...entry.sessionId ? { sessionId: entry.sessionId } : {},
         ...timedOut ? { timedOut: true } : {}
       })
     );
@@ -74829,15 +74955,17 @@ function createServeAskUserBridge(write, timeoutMs2 = askUserTimeoutMs()) {
       const choices = req.choices.map((c) => c.trim()).filter(Boolean);
       if (choices.length < 2) return Promise.resolve(null);
       const requestId = `ask-${Date.now()}-${++seq}`;
-      return new Promise((resolve10) => {
+      return new Promise((resolve11) => {
         const timer = setTimeout(() => {
           settle(requestId, null, true);
         }, timeoutMs2);
-        pending.set(requestId, { resolve: resolve10, timer });
+        const sessionId2 = getCurrentHarnessSessionId();
+        pending.set(requestId, { resolve: resolve11, timer, sessionId: sessionId2 });
         write(
           JSON.stringify({
             type: "ask_user.request",
             requestId,
+            ...sessionId2 ? { sessionId: sessionId2 } : {},
             question,
             choices,
             ...req.context ? { context: req.context } : {}
@@ -74845,7 +74973,14 @@ function createServeAskUserBridge(write, timeoutMs2 = askUserTimeoutMs()) {
         );
       });
     },
-    respond: (requestId, answer) => settle(requestId, answer, false),
+    respond: (requestId, answer, scopeSessionId) => {
+      const entry = pending.get(requestId);
+      if (entry && scopeSessionId && entry.sessionId && entry.sessionId !== scopeSessionId) {
+        return false;
+      }
+      return settle(requestId, answer, false);
+    },
+    sessionOf: (requestId) => pending.get(requestId)?.sessionId,
     pendingCount: () => pending.size
   };
 }
@@ -74853,20 +74988,25 @@ function serveAskUserRespond(bridge, params) {
   if (!params || typeof params !== "object") {
     return { accepted: false, reason: "ask_user.respond requires an object params" };
   }
-  const { requestId, answer } = params;
+  const { requestId, answer, sessionId: sessionId2 } = params;
   if (typeof requestId !== "string" || requestId.length === 0) {
     return { accepted: false, reason: "ask_user.respond requires a non-empty string requestId" };
   }
   if (answer !== null && typeof answer !== "string") {
     return { accepted: false, reason: "ask_user.respond answer must be a string or null" };
   }
+  const scope = typeof sessionId2 === "string" && sessionId2.length > 0 ? sessionId2 : void 0;
+  if (scope && bridge.sessionOf(requestId) && bridge.sessionOf(requestId) !== scope) {
+    return { accepted: false, reason: "session_mismatch: requestId belongs to another session" };
+  }
   const text = typeof answer === "string" ? answer.trim() : null;
-  return { accepted: bridge.respond(requestId, text && text.length > 0 ? text : null) };
+  return { accepted: bridge.respond(requestId, text && text.length > 0 ? text : null, scope) };
 }
 var init_askUserBridge = __esm({
   "src/cli/serve/askUserBridge.ts"() {
     "use strict";
     init_askUserTimeout();
+    init_sessionControl();
   }
 });
 
@@ -75030,17 +75170,23 @@ function createCliRunTurn(onPermissionAsk, onAskUser) {
     const opts = bindHarnessTurnOptions(input, deps.session.workspaceRoot);
     if (onPermissionAsk) opts.onPermissionAsk = onPermissionAsk;
     if (onAskUser) opts.onAskUser = onAskUser;
+    const priorPreset = process.env[PRESET_ENV2];
     applyTurnPermissionPreset(input);
-    const lspProvider = resolveTurnLspProvider(deps.services);
-    const exitCode = await dispatchHeadlessTurn(
-      opts,
-      provider,
-      model,
-      stream,
-      void 0,
-      lspProvider ? { lspProvider } : void 0
-    );
-    return { exitCode };
+    try {
+      const lspProvider = resolveTurnLspProvider(deps.services);
+      const exitCode = await dispatchHeadlessTurn(
+        opts,
+        provider,
+        model,
+        stream,
+        void 0,
+        lspProvider ? { lspProvider } : void 0
+      );
+      return { exitCode };
+    } finally {
+      if (priorPreset === void 0) delete process.env[PRESET_ENV2];
+      else process.env[PRESET_ENV2] = priorPreset;
+    }
   };
 }
 function unknownSessionEnvelope(id3, rawSessionId) {
@@ -75121,6 +75267,7 @@ function startHarnessServer(options = {}) {
           return { id: req.id ?? null, ok: false, error: { code: "unknown_session", message: `no session '${String(params.sessionId ?? "")}'` } };
         }
         await session.dispose();
+        clearSessionPermissionGrants(session.id);
         return { id: req.id ?? null, ok: true, result: { disposed: true } };
       }
       // t32: session-scoped steer/cancel over the SAME protocol v2 — no new
@@ -75236,6 +75383,7 @@ async function runHarnessServer() {
     process.once("SIGTERM", finish2);
   });
 }
+var PRESET_ENV2;
 var init_harnessServer = __esm({
   "src/cli/serve/harnessServer.ts"() {
     "use strict";
@@ -75251,8 +75399,10 @@ var init_harnessServer = __esm({
     init_policyGate();
     init_policyLoadMode();
     init_permissionBridge();
+    init_toolPermissions();
     init_askUserBridge();
     init_spineLockSweep();
+    PRESET_ENV2 = "ZELARI_PERMISSION_PRESET";
   }
 });
 
@@ -75314,8 +75464,8 @@ var init_harnessClient = __esm({
           );
         }
         const id3 = this.nextId++;
-        return new Promise((resolve10, reject) => {
-          this.pending.set(id3, { resolve: resolve10, reject });
+        return new Promise((resolve11, reject) => {
+          this.pending.set(id3, { resolve: resolve11, reject });
           this.transport.write(JSON.stringify({ id: id3, method, params }));
         });
       }
@@ -75341,6 +75491,18 @@ var init_harnessClient = __esm({
         if (reason !== void 0) params["reason"] = reason;
         return await this.request("session.cancel", params);
       }
+      /** t63: settle a permission.request (allow/deny/always-tool/always-category). */
+      async permissionRespond(requestId, decision, sessionId2) {
+        const params = { requestId, decision };
+        if (sessionId2 !== void 0) params["sessionId"] = sessionId2;
+        return await this.request("permission.respond", params);
+      }
+      /** t63: settle an ask_user.request (null = dismiss). */
+      async askUserRespond(requestId, answer, sessionId2) {
+        const params = { requestId, answer };
+        if (sessionId2 !== void 0) params["sessionId"] = sessionId2;
+        return await this.request("ask_user.respond", params);
+      }
       async disposeSession(sessionId2) {
         await this.request("session.dispose", { sessionId: sessionId2 });
       }
@@ -75370,6 +75532,9 @@ import { tmpdir as tmpdir4 } from "node:os";
 function harnessServerMode() {
   return process.env[HARNESS_SERVER_ENV] === "1";
 }
+function isPermissionRequestEvent(ev) {
+  return typeof ev === "object" && ev !== null && ev.type === "permission.request";
+}
 var HARNESS_SERVER_ENV, RunManager;
 var init_runManager = __esm({
   "src/cli/companion/runManager.ts"() {
@@ -75427,6 +75592,13 @@ var init_runManager = __esm({
       }
       emit(ev) {
         if (!this.active) return;
+        if (this.active.permissionPreset === "yolo" && isPermissionRequestEvent(ev)) {
+          const requestId = ev.requestId;
+          if (typeof requestId === "string" && requestId.trim()) {
+            void this.permissionRespond(this.active.run.id, requestId, "allow");
+            return;
+          }
+        }
         this.active.run.events.push(ev);
         if (this.active.run.events.length > 5e3) {
           this.active.run.events.splice(0, this.active.run.events.length - 4e3);
@@ -75438,7 +75610,7 @@ var init_runManager = __esm({
           }
         }
       }
-      start(args) {
+      start(args, gate) {
         if (this.active) {
           return {
             ok: false,
@@ -75460,9 +75632,79 @@ var init_runManager = __esm({
           createdAt: Date.now(),
           events: []
         };
+        if (gate?.awaitingTrust) {
+          run.status = "awaiting_trust";
+          this.active = {
+            run,
+            listeners: /* @__PURE__ */ new Set(),
+            trustArgs: args,
+            trustMode: this.clientMode ? "harness" : "spawn",
+            permissionPreset: args.permissionPreset
+          };
+          this.emit({
+            type: "trust.pending",
+            runId: id3,
+            path: args.cwd,
+            message: `[companion] run ${id3} awaiting desktop trust approval for ${args.cwd}`
+          });
+          return { ok: true, run, awaitingTrust: true };
+        }
         if (this.clientMode) {
           return this.startViaHarness(run, args, mode, phase2);
         }
+        return this.launchSpawn(run, args);
+      }
+      /**
+       * t66: desktop approved the parked run — launch it now, preserving the
+       * listeners (phone SSE) attached while it was awaiting trust.
+       */
+      releaseTrust() {
+        const a = this.active;
+        if (!a || a.run.status !== "awaiting_trust" || !a.trustArgs) {
+          return { ok: false, error: "no run awaiting trust" };
+        }
+        const args = a.trustArgs;
+        a.run.status = "running";
+        this.emit({ type: "trust.settled", runId: a.run.id, approved: true });
+        if (a.trustMode === "harness") {
+          return this.startViaHarness(a.run, args, a.run.mode, a.run.phase);
+        }
+        return this.launchSpawn(a.run, args);
+      }
+      /** t66: desktop denied the parked run — fail it, fail-closed. */
+      denyTrust(reason) {
+        const a = this.active;
+        if (!a || a.run.status !== "awaiting_trust") {
+          return { ok: false, error: "no run awaiting trust" };
+        }
+        a.run.status = "error";
+        a.run.error = reason;
+        a.run.finishedAt = Date.now();
+        this.emit({ type: "trust.settled", runId: a.run.id, approved: false });
+        this.emit({
+          type: "error",
+          severity: "fatal",
+          message: reason,
+          code: "trust_denied"
+        });
+        this.emit({
+          type: "run_finished",
+          runId: a.run.id,
+          status: "error",
+          exitCode: null
+        });
+        this.finishActive();
+        return { ok: true };
+      }
+      /** t66: current awaiting_trust run (if any) for GET /v1/trust/pending. */
+      pendingTrust() {
+        const a = this.active;
+        if (!a || a.run.status !== "awaiting_trust") return null;
+        return { runId: a.run.id, path: a.run.cwd };
+      }
+      /** t66: spawn-path launch, extracted from start() so releaseTrust can
+       * launch a parked run. Preserves parked listeners (same run id). */
+      launchSpawn(run, args) {
         const cliEntry = process.argv[1];
         if (!cliEntry) {
           return { ok: false, error: "Cannot resolve CLI entry (process.argv[1])" };
@@ -75471,13 +75713,13 @@ var init_runManager = __esm({
           cliEntry,
           "--headless",
           "--task",
-          prompt,
+          run.prompt,
           "--output",
           "json",
           "--mode",
-          mode === "council" || mode === "zelari" ? mode : "kraken",
+          run.mode === "council" || run.mode === "zelari" ? run.mode : "kraken",
           "--phase",
-          phase2 === "plan" ? "plan" : "build"
+          run.phase === "plan" ? "plan" : "build"
         ];
         if (args.provider?.trim()) {
           argv.push("--provider", args.provider.trim());
@@ -75485,9 +75727,14 @@ var init_runManager = __esm({
         if (args.model?.trim()) {
           argv.push("--model", args.model.trim());
         }
+        if (args.strictDone === true) argv.push("--strict-done");
+        else if (args.strictDone === false) argv.push("--no-strict-done");
+        if (args.permissionPreset) {
+          argv.push("--permissions", args.permissionPreset);
+        }
         let historyFile;
         if (args.history && Array.isArray(args.history) && args.history.length > 0) {
-          historyFile = join49(tmpdir4(), `zelari-companion-hist-${id3}.json`);
+          historyFile = join49(tmpdir4(), `zelari-companion-hist-${run.id}.json`);
           try {
             writeFileSync27(historyFile, JSON.stringify(args.history), "utf8");
             argv.push("--history-file", historyFile);
@@ -75501,15 +75748,26 @@ var init_runManager = __esm({
             ...process.env,
             ZELARI_SKIP_PREFLIGHT: "1",
             ANATHEMA_DEV: "1",
-            FORCE_COLOR: "0"
+            FORCE_COLOR: "0",
+            // t65: belt-and-suspenders — the long-lived headless child reads the
+            // preset straight from env even if it never re-parses --permissions;
+            // mirrors main.ts's --permissions → ZELARI_PERMISSION_PRESET promotion.
+            ...args.permissionPreset ? { ZELARI_PERMISSION_PRESET: args.permissionPreset } : {}
           },
           stdio: ["ignore", "pipe", "pipe"],
           windowsHide: true
         });
-        this.active = { run, child, listeners: /* @__PURE__ */ new Set(), historyFile };
+        const parked = this.active?.run.id === run.id ? this.active : null;
+        this.active = {
+          run,
+          child,
+          listeners: parked?.listeners ?? /* @__PURE__ */ new Set(),
+          historyFile,
+          permissionPreset: args.permissionPreset
+        };
         this.emit({
           type: "log",
-          message: `[companion] run ${id3} started mode=${mode} phase=${phase2} cwd=${args.cwd}`
+          message: `[companion] run ${run.id} started mode=${run.mode} phase=${run.phase} cwd=${args.cwd}`
         });
         if (child.stdout) {
           const rl = createInterface4({ input: child.stdout });
@@ -75556,7 +75814,7 @@ var init_runManager = __esm({
           }
           this.emit({
             type: "run_finished",
-            runId: id3,
+            runId: run.id,
             status: run.status,
             exitCode: code
           });
@@ -75571,7 +75829,12 @@ var init_runManager = __esm({
        * reports through the usual run status + emit path.
        */
       startViaHarness(run, args, mode, phase2) {
-        this.active = { run, listeners: /* @__PURE__ */ new Set() };
+        const parked = this.active?.run.id === run.id ? this.active : null;
+        this.active = {
+          run,
+          listeners: parked?.listeners ?? /* @__PURE__ */ new Set(),
+          permissionPreset: args.permissionPreset
+        };
         this.emit({
           type: "log",
           message: `[companion] run ${run.id} started mode=${mode} phase=${phase2} cwd=${args.cwd}`
@@ -75619,6 +75882,9 @@ var init_runManager = __esm({
           if (Array.isArray(args.history) && args.history.length > 0) {
             turnInput["history"] = args.history;
           }
+          if (args.permissionPreset) turnInput["permissionPreset"] = args.permissionPreset;
+          if (args.strictDone !== void 0) turnInput["strictDone"] = args.strictDone;
+          if (args.verifyPack !== void 0) turnInput["verifyPack"] = args.verifyPack;
           const result = await client.runTurn(sessionId2, turnInput);
           const stillOwner = this.active?.run.id === run.id;
           if (stillOwner && run.status === "running") {
@@ -75719,6 +75985,51 @@ var init_runManager = __esm({
           return { ok: false, error: err instanceof Error ? err.message : String(err) };
         }
       }
+      /** t63: settle a permission.request on the active client-mode run. */
+      async permissionRespond(runId, requestId, decision) {
+        if (!this.active) return { ok: false, error: "No active run" };
+        if (runId && this.active.run.id !== runId) {
+          return { ok: false, error: `Run ${runId} is not active` };
+        }
+        const id3 = requestId?.trim();
+        if (!id3) return { ok: false, error: "requestId is required" };
+        if (!this.active.harnessSessionId || !this.harnessClient) {
+          return {
+            ok: false,
+            error: `permission respond requires harness server mode (${HARNESS_SERVER_ENV}=1)`
+          };
+        }
+        try {
+          const result = await this.harnessClient.permissionRespond(id3, decision);
+          return { ok: true, result };
+        } catch (err) {
+          return { ok: false, error: err instanceof Error ? err.message : String(err) };
+        }
+      }
+      /** t63: settle an ask_user.request (answer null = dismiss). */
+      async askUserRespond(runId, requestId, answer) {
+        if (!this.active) return { ok: false, error: "No active run" };
+        if (runId && this.active.run.id !== runId) {
+          return { ok: false, error: `Run ${runId} is not active` };
+        }
+        const id3 = requestId?.trim();
+        if (!id3) return { ok: false, error: "requestId is required" };
+        if (answer != null && typeof answer !== "string") {
+          return { ok: false, error: "answer must be a string or null" };
+        }
+        if (!this.active.harnessSessionId || !this.harnessClient) {
+          return {
+            ok: false,
+            error: `ask respond requires harness server mode (${HARNESS_SERVER_ENV}=1)`
+          };
+        }
+        try {
+          const result = await this.harnessClient.askUserRespond(id3, answer);
+          return { ok: true, result };
+        } catch (err) {
+          return { ok: false, error: err instanceof Error ? err.message : String(err) };
+        }
+      }
       cancel(runId) {
         if (!this.active) {
           return { ok: false, error: "No active run" };
@@ -75810,8 +76121,8 @@ __export(serve_exports, {
   runCompanionServe: () => runCompanionServe
 });
 import { createServer as createServer3 } from "node:http";
-import { existsSync as existsSync62 } from "node:fs";
-import { resolve as resolve9 } from "node:path";
+import { existsSync as existsSync62, readdirSync as readdirSync13 } from "node:fs";
+import { join as join50, resolve as resolve10 } from "node:path";
 function readBody(req, max = 2e6) {
   return new Promise((resolveBody, reject) => {
     const chunks = [];
@@ -75858,7 +76169,7 @@ async function runCompanionServe(opts = {}) {
   const { token, created } = loadOrCreateToken(opts.token);
   let projects = mergeProjects(fileCfg, opts.projects ?? []);
   projects = projects.filter((p3) => {
-    const abs = resolve9(p3.path);
+    const abs = resolve10(p3.path);
     if (!existsSync62(abs)) {
       process.stderr.write(
         `[zelari-code serve] skip missing project path: ${p3.path}
@@ -75878,7 +76189,7 @@ async function runCompanionServe(opts = {}) {
     });
   }
   if (projects.length === 0) {
-    const cwd = resolve9(process.cwd());
+    const cwd = resolve10(process.cwd());
     projects = [
       {
         id: "default",
@@ -75894,6 +76205,7 @@ async function runCompanionServe(opts = {}) {
     );
   }
   const runs = new RunManager();
+  const fsFull = (opts.fsMode ?? "full") === "full";
   const allowedOrigins = [
     ...loopbackOrigins(port),
     ...parseAllowedOrigins(process.env[COMPANION_ALLOWED_ORIGINS_ENV])
@@ -75935,6 +76247,65 @@ async function runCompanionServe(opts = {}) {
         sendJson2(res, 200, { ok: true, ...snap });
         return;
       }
+      if (req.method === "GET" && path104 === "/v1/fs") {
+        const listFsRootsInline = () => {
+          if (process.platform === "win32") {
+            const roots = [];
+            for (let code = 65; code <= 90; code++) {
+              const letter = String.fromCharCode(code);
+              const drive = `${letter}:\\`;
+              if (existsSync62(drive)) {
+                roots.push({
+                  id: `fs-${letter.toLowerCase()}`,
+                  name: drive,
+                  path: drive
+                });
+              }
+            }
+            return roots;
+          }
+          return [{ id: "fs-root", name: "/", path: "/" }];
+        };
+        const rawParam = url2.searchParams.get("path")?.trim() ?? "";
+        if (!rawParam) {
+          sendJson2(res, 200, {
+            ok: true,
+            roots: fsFull ? listFsRootsInline() : projects,
+            entries: []
+          });
+          return;
+        }
+        const norm = rawParam.replace(/\\/g, "/").replace(/\/+$/, "");
+        const absolute = /^([a-zA-Z]:\/|\/)/.test(norm);
+        const allowed = fsFull && absolute && !norm.split("/").includes("..") ? true : isUnderRoots(rawParam, projects).ok;
+        if (!allowed) {
+          sendJson2(res, 403, { ok: false, error: "path outside allowed roots" });
+          return;
+        }
+        if (!existsSync62(rawParam)) {
+          sendJson2(res, 404, { ok: false, error: "path not found" });
+          return;
+        }
+        const dirs = readdirSync13(rawParam, { withFileTypes: true }).filter((d) => d.isDirectory() && !d.name.startsWith(".")).sort((a, b) => a.name.localeCompare(b.name));
+        const slash = norm.lastIndexOf("/");
+        let parent = slash > 0 ? norm.slice(0, slash) : null;
+        const rootHit = isUnderRoots(rawParam, projects);
+        if (rootHit.ok) {
+          const rootNorm = rootHit.root.path.replace(/\\/g, "/").toLowerCase().replace(/\/+$/, "");
+          if (rootHit.normalized === rootNorm) parent = null;
+        }
+        sendJson2(res, 200, {
+          ok: true,
+          path: rawParam,
+          parent,
+          entries: dirs.map((d) => ({
+            name: d.name,
+            path: join50(rawParam, d.name),
+            dir: true
+          }))
+        });
+        return;
+      }
       if (req.method === "GET" && path104 === "/v1/projects") {
         sendJson2(res, 200, {
           ok: true,
@@ -75977,27 +76348,37 @@ async function runCompanionServe(opts = {}) {
         const mode = String(body.mode ?? "kraken");
         const phase2 = String(body.phase ?? "build");
         const cwdArg = body.cwd != null ? String(body.cwd) : body.projectId != null ? String(body.projectId) : null;
-        const resolved = resolveProjectPath(projects, cwdArg);
+        const resolved = resolveProjectPath(projects, cwdArg, { fullFs: fsFull });
         if (!resolved.ok) {
           sendJson2(res, 400, { ok: false, error: resolved.error });
           return;
         }
         const history2 = Array.isArray(body.history) ? body.history : void 0;
-        const result = runs.start({
+        const presetRaw = typeof body.permissionPreset === "string" ? body.permissionPreset.trim().toLowerCase() : "";
+        const permissionPreset = ["standard", "strict", "yolo"].includes(presetRaw) ? presetRaw : void 0;
+        const strictDone = typeof body.strictDone === "boolean" ? body.strictDone : void 0;
+        const verifyPack = typeof body.verifyPack === "boolean" ? body.verifyPack : void 0;
+        const startArgs = {
           prompt,
           mode,
           phase: phase2,
           cwd: resolved.project.path,
           provider: body.provider != null ? String(body.provider) : void 0,
           model: body.model != null ? String(body.model) : void 0,
-          history: history2
-        });
+          history: history2,
+          permissionPreset,
+          strictDone,
+          verifyPack
+        };
+        const gate = fsFull && !resolved.trusted ? { awaitingTrust: true } : void 0;
+        const result = runs.start(startArgs, gate);
         if (!result.ok) {
           sendJson2(res, 409, { ok: false, error: result.error });
           return;
         }
         sendJson2(res, 201, {
           ok: true,
+          awaitingTrust: gate ? true : void 0,
           run: {
             id: result.run.id,
             status: result.run.status,
@@ -76008,10 +76389,57 @@ async function runCompanionServe(opts = {}) {
           },
           eventsUrl: `/v1/runs/${result.run.id}/events`,
           cancelUrl: `/v1/runs/${result.run.id}/cancel`,
-          steerUrl: `/v1/runs/${result.run.id}/steer`
+          steerUrl: `/v1/runs/${result.run.id}/steer`,
+          permissionUrl: `/v1/runs/${result.run.id}/permission`,
+          askUrl: `/v1/runs/${result.run.id}/ask`
         });
         return;
       }
+      if (req.method === "POST" && path104 === "/v1/trust") {
+        const raw = await readBody(req);
+        let body = {};
+        try {
+          body = raw ? JSON.parse(raw) : {};
+        } catch {
+          sendJson2(res, 400, { ok: false, error: "invalid JSON body" });
+          return;
+        }
+        const runId = typeof body.runId === "string" ? body.runId.trim() : "";
+        if (!runId) {
+          sendJson2(res, 400, { ok: false, error: "runId is required" });
+          return;
+        }
+        const current = runs.pendingTrust();
+        if (!current || current.runId !== runId) {
+          sendJson2(res, 409, { ok: false, error: "no such awaiting_trust run" });
+          return;
+        }
+        if (body.approve === true) {
+          projects = mergeProjects({ ...fileCfg, projects }, [current.path]);
+          try {
+            saveCompanionConfig({ ...fileCfg, bind, port, projects });
+          } catch {
+          }
+          const released = runs.releaseTrust();
+          if (!released.ok) {
+            sendJson2(res, 409, { ok: false, error: released.error });
+            return;
+          }
+          sendJson2(res, 200, { ok: true, approved: runId, path: current.path });
+          return;
+        }
+        const denied = runs.denyTrust("Trust negato sul desktop");
+        if (!denied.ok) {
+          sendJson2(res, 409, { ok: false, error: denied.error });
+          return;
+        }
+        sendJson2(res, 200, { ok: true, denied: runId });
+        return;
+      }
+      if (req.method === "GET" && path104 === "/v1/trust/pending") {
+        sendJson2(res, 200, { ok: true, pending: runs.pendingTrust() });
+        return;
+      }
       const eventsMatch = /^\/v1\/runs\/([^/]+)\/events$/.exec(path104);
       if (req.method === "GET" && eventsMatch) {
         const runId = eventsMatch[1];
@@ -76039,7 +76467,7 @@ async function runCompanionServe(opts = {}) {
           }
         };
         const unsub = runs.subscribe(runId, writeEv);
-        if (run.status !== "running" && run.status !== "queued") {
+        if (run.status !== "running" && run.status !== "queued" && run.status !== "awaiting_trust") {
           writeEv({
             type: "run_finished",
             runId,
@@ -76065,7 +76493,7 @@ async function runCompanionServe(opts = {}) {
         req.on("close", onClose);
         const check2 = setInterval(() => {
           const r = runs.getRun(runId);
-          if (!r || r.status !== "running" && r.status !== "queued") {
+          if (!r || r.status !== "running" && r.status !== "queued" && r.status !== "awaiting_trust") {
             clearInterval(check2);
             clearInterval(heartbeat);
             unsub();
@@ -76112,6 +76540,53 @@ async function runCompanionServe(opts = {}) {
         sendJson2(res, 200, { ok: true, steered: runId, result: result.result });
         return;
       }
+      const askMatch = /^\/v1\/runs\/([^/]+)\/(permission|ask)$/.exec(path104);
+      if (req.method === "POST" && askMatch) {
+        const runId = askMatch[1];
+        const kind2 = askMatch[2];
+        const raw = await readBody(req);
+        let body = {};
+        try {
+          body = raw ? JSON.parse(raw) : {};
+        } catch {
+          sendJson2(res, 400, { ok: false, error: "invalid JSON body" });
+          return;
+        }
+        const requestId = typeof body.requestId === "string" ? body.requestId.trim() : "";
+        if (!requestId) {
+          sendJson2(res, 400, { ok: false, error: "requestId is required" });
+          return;
+        }
+        if (kind2 === "permission") {
+          const decision = typeof body.decision === "string" ? body.decision.trim() : "";
+          if (!["allow", "deny", "always-tool", "always-category"].includes(decision)) {
+            sendJson2(res, 400, {
+              ok: false,
+              error: "decision must be allow|deny|always-tool|always-category"
+            });
+            return;
+          }
+          const result2 = await runs.permissionRespond(runId, requestId, decision);
+          if (!result2.ok) {
+            sendJson2(res, 404, { ok: false, error: result2.error });
+            return;
+          }
+          sendJson2(res, 200, { ok: true, runId, requestId, result: result2.result });
+          return;
+        }
+        const answer = body.answer == null ? null : typeof body.answer === "string" ? body.answer : void 0;
+        if (answer === void 0) {
+          sendJson2(res, 400, { ok: false, error: "answer must be a string or null" });
+          return;
+        }
+        const result = await runs.askUserRespond(runId, requestId, answer);
+        if (!result.ok) {
+          sendJson2(res, 404, { ok: false, error: result.error });
+          return;
+        }
+        sendJson2(res, 200, { ok: true, runId, requestId, result: result.result });
+        return;
+      }
       sendJson2(res, 404, { ok: false, error: "not found" });
     } catch (err) {
       sendJson2(res, 500, {
@@ -76187,12 +76662,14 @@ function parseServeFlags(argv) {
   }
   const portRaw = get("--port");
   const port = portRaw ? Number.parseInt(portRaw, 10) : void 0;
+  const fsRaw = get("--fs");
   return {
     bind: get("--bind"),
     port: Number.isFinite(port) ? port : void 0,
     token: get("--token"),
     projects,
-    persistProjects: argv.includes("--save-projects")
+    persistProjects: argv.includes("--save-projects"),
+    fsMode: fsRaw === "allowlist" ? "allowlist" : fsRaw === "full" ? "full" : void 0
   };
 }
 var init_serve = __esm({
@@ -76253,8 +76730,8 @@ __export(doctor_exports, {
   firstBlockingRed: () => firstBlockingRed,
   runDoctor: () => runDoctor
 });
-import { execSync as execSync2 } from "node:child_process";
-import { existsSync as existsSync63, readFileSync as readFileSync46, readlinkSync, statSync as statSync10 } from "node:fs";
+import { execSync as execSync3 } from "node:child_process";
+import { existsSync as existsSync63, readFileSync as readFileSync46, readlinkSync, statSync as statSync11 } from "node:fs";
 import { createRequire as createRequire3 } from "node:module";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 import path100 from "node:path";
@@ -76277,7 +76754,7 @@ function findPackageRoot(start) {
 }
 function tryExec(cmd) {
   try {
-    return execSync2(cmd, {
+    return execSync3(cmd, {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"]
     }).trim();
@@ -76293,7 +76770,7 @@ function readPackageJson4() {
     return null;
   }
 }
-function getGlobalPrefix() {
+function getGlobalPrefix2() {
   const fromNpm = tryExec("npm prefix -g");
   if (fromNpm) return fromNpm;
   return (process.env.npm_config_prefix || process.env.NPM_CONFIG_PREFIX || "").trim();
@@ -76302,7 +76779,7 @@ function isSourceCheckout() {
   return existsSync63(path100.join(packageRoot, "src", "cli", "main.ts")) && existsSync63(path100.join(packageRoot, "apps", "desktop", "package.json"));
 }
 function checkShim(pkgName) {
-  const prefix = getGlobalPrefix();
+  const prefix = getGlobalPrefix2();
   if (!prefix) {
     return WARN("npm global prefix not detectable (run inside an npm context)");
   }
@@ -76318,13 +76795,21 @@ function checkShim(pkgName) {
          optional: npm install -g ${pkgName}@latest --force`
       );
     }
+    const installKind = resolveInstallKind();
+    if (installKind === "npx" || installKind === "local") {
+      return WARN(
+        `non-global install (${installKind}) \u2014 no global shim at ${shimPath}
+         PATH/shim expectations do not apply to an npx or local run
+         for a persistent install: npm install -g ${pkgName}@latest`
+      );
+    }
     return FAIL(
       `shim not found at ${shimPath}
          fix:  npm install -g ${pkgName}@latest --force`
     );
   }
   try {
-    const st = statSync10(shimPath);
+    const st = statSync11(shimPath);
     if (isWin) {
       const content = readFileSync46(shimPath, "utf8");
       if (content.includes(`${pkgName}\\bin\\`) || content.includes(`${pkgName}/bin/`)) {
@@ -76395,7 +76880,7 @@ function checkBundle() {
     );
   }
   try {
-    const st = statSync10(bundle);
+    const st = statSync11(bundle);
     return OK(`bundle OK (${(st.size / 1024 / 1024).toFixed(2)} MB)`);
   } catch (err) {
     return FAIL(
@@ -76425,7 +76910,7 @@ function checkRuntimeDeps() {
   );
 }
 function checkPath() {
-  const prefix = getGlobalPrefix();
+  const prefix = getGlobalPrefix2();
   if (!prefix) return WARN("npm global prefix not detectable");
   const pathSep = process.platform === "win32" ? ";" : ":";
   const pathDirs = (process.env.PATH || "").split(pathSep);
@@ -76643,7 +77128,7 @@ async function runDoctor() {
   console.log(`zelari-code doctor (v${pkg?.version ?? "unknown"})`);
   console.log("platform:", process.platform, process.arch);
   console.log("node:    ", process.version);
-  console.log("prefix:  ", getGlobalPrefix() || "(unknown)");
+  console.log("prefix:  ", getGlobalPrefix2() || "(unknown)");
   console.log("root:    ", packageRoot);
   console.log("");
   let criticalFails = 0;
@@ -76684,6 +77169,7 @@ var init_doctor = __esm({
     init_prereqChecks();
     init_metrics3();
     init_contextGrowthSummary();
+    init_updater();
     require3 = createRequire3(import.meta.url);
     __dirname3 = path100.dirname(fileURLToPath3(import.meta.url));
     packageRoot = findPackageRoot(__dirname3);
@@ -76711,7 +77197,7 @@ __export(fixPath_exports, {
   repairWindowsUserPath: () => repairWindowsUserPath
 });
 import { spawnSync as spawnSync3 } from "node:child_process";
-function getGlobalPrefix2() {
+function getGlobalPrefix3() {
   try {
     const fromNpm = spawnSync3("npm", ["prefix", "-g"], {
       encoding: "utf8",
@@ -76736,7 +77222,7 @@ function powershell(script) {
   }
 }
 function repairWindowsUserPath() {
-  const prefix = getGlobalPrefix2();
+  const prefix = getGlobalPrefix3();
   if (!prefix) {
     return {
       ok: false,
@@ -77146,7 +77632,7 @@ __export(inspect_exports, {
   runInspect: () => runInspect
 });
 import path103 from "node:path";
-import { existsSync as existsSync66, readFileSync as readFileSync48, readdirSync as readdirSync13 } from "node:fs";
+import { existsSync as existsSync66, readFileSync as readFileSync48, readdirSync as readdirSync14 } from "node:fs";
 async function collectInspectReport(cwd = process.cwd()) {
   ensureBuiltinSkillsLoadedSync();
   const snap = listSkillsSnapshot(cwd);
@@ -77215,7 +77701,7 @@ async function collectInspectReport(cwd = process.cwd()) {
 }
 function listJsonFiles(dir) {
   try {
-    return readdirSync13(dir).filter((f) => f.endsWith(".json")).sort();
+    return readdirSync14(dir).filter((f) => f.endsWith(".json")).sort();
   } catch {
     return [];
   }
@@ -77682,12 +78168,12 @@ function mergeChanges(unstaged, staged, untrackedPaths) {
   return [...byPath.values()].sort((a, b) => churn(b) - churn(a));
 }
 function runGit(args, cwd) {
-  return new Promise((resolve10, reject) => {
+  return new Promise((resolve11, reject) => {
     execFile(
       "git",
       args,
       { cwd, timeout: 5e3, windowsHide: true, maxBuffer: 4 * 1024 * 1024 },
-      (err, stdout) => err ? reject(err) : resolve10(stdout)
+      (err, stdout) => err ? reject(err) : resolve11(stdout)
     );
   });
 }
@@ -80266,7 +80752,7 @@ init_toolPermissions();
 init_askUserTimeout();
 function createPermissionAskHandler(opts) {
   const { setPicker: setPicker2, appendSystem: appendSystem2 } = opts;
-  return (req) => new Promise((resolve10) => {
+  return (req) => new Promise((resolve11) => {
     const cats = req.categories;
     const catLabel = cats.length === 1 ? cats[0] : cats.join("+") || "action";
     const title = `Allow tool "${req.toolName}"?`;
@@ -80292,7 +80778,7 @@ ${detail}${note}${claimsBlock}
       cancelAskTimeout();
       setPicker2(null);
       if (note2) appendSystem2?.(note2, Date.now());
-      resolve10(ok);
+      resolve11(ok);
     };
     cancelAskTimeout = armPickerTimeout(
       () => finish2(
@@ -80491,10 +80977,10 @@ function useChatTurn(params) {
           }
         } catch {
         }
-        const onAskUser = setPicker2 ? (req) => new Promise((resolve10) => {
+        const onAskUser = setPicker2 ? (req) => new Promise((resolve11) => {
           const choices = req.choices ?? [];
           if (choices.length < 2) {
-            resolve10(null);
+            resolve11(null);
             return;
           }
           setLastClarification({
@@ -80518,7 +81004,7 @@ _(${req.context})_` : "") + "\n\u2192 scegli dalla lista (il turno continua dopo
             settled = true;
             cancelAskTimeout();
             setPicker2(null);
-            resolve10(value);
+            resolve11(value);
           };
           cancelAskTimeout = armPickerTimeout(
             () => {
@@ -81464,10 +81950,10 @@ async function dispatchCouncilPromptImpl(text, deps, overrides = {}) {
   const { composeProjectContext: composeProjectContext2 } = await Promise.resolve().then(() => (init_composeContext(), composeContext_exports));
   const { FeedbackStore: FeedbackStore2 } = await Promise.resolve().then(() => (init_councilFeedback(), councilFeedback_exports));
   const workPhase = getPhase();
-  const onAskUserCouncil = setPicker2 ? (req) => new Promise((resolve10) => {
+  const onAskUserCouncil = setPicker2 ? (req) => new Promise((resolve11) => {
     const choices = req.choices ?? [];
     if (choices.length < 2) {
-      resolve10(null);
+      resolve11(null);
       return;
     }
     setLastClarification({
@@ -81491,7 +81977,7 @@ _(${req.context})_` : "") + "\n\u2192 scegli dalla lista (il membro riprende dop
       settled = true;
       cancelAskTimeout();
       setPicker2(null);
-      resolve10(value);
+      resolve11(value);
     };
     cancelAskTimeout = armPickerTimeout(
       () => {
@@ -81673,10 +82159,10 @@ _(${req.context})_` : "") + "\n\u2192 scegli dalla lista (il membro riprende dop
         appendSystem(setMessages, message, Date.now());
       },
       // v1.8.0: pause council when a member asks a structured question.
-      onClarification: setPicker2 ? (req) => new Promise((resolve10) => {
+      onClarification: setPicker2 ? (req) => new Promise((resolve11) => {
         const choices = req.choices ?? [];
         if (choices.length < 2) {
-          resolve10(null);
+          resolve11(null);
           return;
         }
         setLastClarification({
@@ -81697,7 +82183,7 @@ _(${req.context})_` : "") + "\n\u2192 scegli dalla lista (il membro riprende dop
           if (settled) return;
           settled = true;
           setPicker2(null);
-          resolve10(value);
+          resolve11(value);
         };
         setPicker2({
           kind: "clarification",
@@ -82355,10 +82841,10 @@ function usePermissionBroker(opts) {
       setPicker: setPicker2,
       appendSystem: (msg, at) => appendSystem(setMessages, msg, at ?? Date.now())
     });
-    const onQuestion = (req) => new Promise((resolve10) => {
+    const onQuestion = (req) => new Promise((resolve11) => {
       const choices = (req.choices ?? []).map((c) => String(c).trim()).filter((c) => c.length > 0);
       if (choices.length < 2) {
-        resolve10(null);
+        resolve11(null);
         return;
       }
       let settled = false;
@@ -82368,7 +82854,7 @@ function usePermissionBroker(opts) {
         settled = true;
         cancelWaitTimeout?.();
         setPicker2(null);
-        resolve10(value);
+        resolve11(value);
       };
       const waitTimeoutMs = askUserTimeoutMs();
       cancelWaitTimeout = armPickerTimeout(() => {
@@ -84622,7 +85108,8 @@ async function handleUpdateCheck(ctx) {
       appendSystem(
         ctx.setMessages,
         `[update] \u{1F195} zelari-code ${info.latestVersion} available (current: ${info.currentVersion})
-       Run \`/update --yes\` to install. You'll need to restart manually after.`
+       Run \`/update --yes\` to install (global installs only).
+       On npx/local installs, update with \`npx zelari-code@latest\` \u2014 you'll need to restart manually after.`
       );
     } else {
       appendSystem(
@@ -84639,7 +85126,18 @@ async function handleUpdateCheck(ctx) {
 }
 async function handleUpdatePerform(ctx) {
   try {
-    const { performUpdate: performUpdate2, distTagForVersion: distTagForVersion2, getCurrentVersion: getCurrentVersion2 } = await Promise.resolve().then(() => (init_updater(), updater_exports));
+    const {
+      performUpdate: performUpdate2,
+      resolveInstallKind: resolveInstallKind2,
+      nonGlobalUpdateAdvisory: nonGlobalUpdateAdvisory2,
+      distTagForVersion: distTagForVersion2,
+      getCurrentVersion: getCurrentVersion2
+    } = await Promise.resolve().then(() => (init_updater(), updater_exports));
+    const kind2 = resolveInstallKind2();
+    if (kind2 === "npx" || kind2 === "local") {
+      appendSystem(ctx.setMessages, nonGlobalUpdateAdvisory2(kind2));
+      return;
+    }
     const tag = distTagForVersion2(getCurrentVersion2());
     appendSystem(
       ctx.setMessages,
@@ -84746,7 +85244,7 @@ ${browsers.output}` : "") + (browsers.ok ? "" : `
   return result;
 }
 function runPlaywrightInstallChromium(cwd, executor) {
-  return new Promise((resolve10) => {
+  return new Promise((resolve11) => {
     let stdout = "";
     let stderr = "";
     const stdio = ["ignore", "pipe", "pipe"];
@@ -84759,7 +85257,7 @@ function runPlaywrightInstallChromium(cwd, executor) {
       stderr += chunk.toString();
     });
     child.on("error", (err) => {
-      resolve10({
+      resolve11({
         ok: false,
         output: stdout + stderr,
         error: err.message,
@@ -84768,7 +85266,7 @@ function runPlaywrightInstallChromium(cwd, executor) {
     });
     child.on("close", (code) => {
       const ok = code === 0;
-      resolve10({
+      resolve11({
         ok,
         output: stdout + stderr,
         exitCode: code,
@@ -84778,7 +85276,7 @@ function runPlaywrightInstallChromium(cwd, executor) {
   });
 }
 function runNpm2(executor, args, cwd, mode, npmCliPath) {
-  return new Promise((resolve10) => {
+  return new Promise((resolve11) => {
     let stdout = "";
     let stderr = "";
     const stdio = ["ignore", "pipe", "pipe"];
@@ -84790,7 +85288,7 @@ function runNpm2(executor, args, cwd, mode, npmCliPath) {
       stderr += chunk.toString();
     });
     child.on("error", (err) => {
-      resolve10({
+      resolve11({
         ok: false,
         output: stdout + stderr,
         error: err.message,
@@ -84799,7 +85297,7 @@ function runNpm2(executor, args, cwd, mode, npmCliPath) {
     });
     child.on("close", (code) => {
       const ok = code === 0;
-      resolve10({
+      resolve11({
         ok,
         output: stdout + stderr,
         exitCode: code,
@@ -87263,7 +87761,7 @@ function runPreflight() {
 }
 async function backgroundUpdateCheck() {
   if (process.env.ANATHEMA_DEV === "1") return;
-  await new Promise((resolve10) => setTimeout(resolve10, 3e3));
+  await new Promise((resolve11) => setTimeout(resolve11, 3e3));
   try {
     const { checkForUpdate: checkForUpdate2 } = await Promise.resolve().then(() => (init_updater(), updater_exports));
     const info = await checkForUpdate2();
@@ -88064,7 +88562,7 @@ function main() {
         closeMcpClients2();
       } catch {
       }
-      await new Promise((resolve10) => setImmediate(resolve10));
+      await new Promise((resolve11) => setImmediate(resolve11));
       process.exit(code);
     }).catch(async (err) => {
       console.error(