@4pm/cli 0.8.0 → 0.8.2

package/dist/index.js

@@ -11,7 +11,7 @@ import {
   __require,
   __toESM,
   wrapper_default
-} from "./chunk-YRQBADPD.js";
+} from "./chunk-I7WQWC33.js";
 
 // ../../node_modules/.pnpm/react@18.3.1/node_modules/react/cjs/react.production.min.js
 var require_react_production_min = __commonJS({
@@ -1995,14 +1995,14 @@ var require_react_development = __commonJS({
               var thenableResult = result;
               var wasAwaited = false;
               var thenable = {
-                then: function(resolve7, reject) {
+                then: function(resolve8, reject) {
                   wasAwaited = true;
                   thenableResult.then(function(returnValue2) {
                     popActScope(prevActScopeDepth);
                     if (actScopeDepth === 0) {
-                      recursivelyFlushAsyncActWork(returnValue2, resolve7, reject);
+                      recursivelyFlushAsyncActWork(returnValue2, resolve8, reject);
                     } else {
-                      resolve7(returnValue2);
+                      resolve8(returnValue2);
                     }
                   }, function(error2) {
                     popActScope(prevActScopeDepth);
@@ -2032,20 +2032,20 @@ var require_react_development = __commonJS({
                   ReactCurrentActQueue.current = null;
                 }
                 var _thenable = {
-                  then: function(resolve7, reject) {
+                  then: function(resolve8, reject) {
                     if (ReactCurrentActQueue.current === null) {
                       ReactCurrentActQueue.current = [];
-                      recursivelyFlushAsyncActWork(returnValue, resolve7, reject);
+                      recursivelyFlushAsyncActWork(returnValue, resolve8, reject);
                     } else {
-                      resolve7(returnValue);
+                      resolve8(returnValue);
                     }
                   }
                 };
                 return _thenable;
               } else {
                 var _thenable2 = {
-                  then: function(resolve7, reject) {
-                    resolve7(returnValue);
+                  then: function(resolve8, reject) {
+                    resolve8(returnValue);
                   }
                 };
                 return _thenable2;
@@ -2061,7 +2061,7 @@ var require_react_development = __commonJS({
             actScopeDepth = prevActScopeDepth;
           }
         }
-        function recursivelyFlushAsyncActWork(returnValue, resolve7, reject) {
+        function recursivelyFlushAsyncActWork(returnValue, resolve8, reject) {
           {
             var queue = ReactCurrentActQueue.current;
             if (queue !== null) {
@@ -2070,16 +2070,16 @@ var require_react_development = __commonJS({
                 enqueueTask(function() {
                   if (queue.length === 0) {
                     ReactCurrentActQueue.current = null;
-                    resolve7(returnValue);
+                    resolve8(returnValue);
                   } else {
-                    recursivelyFlushAsyncActWork(returnValue, resolve7, reject);
+                    recursivelyFlushAsyncActWork(returnValue, resolve8, reject);
                   }
                 });
               } catch (error2) {
                 reject(error2);
               }
             } else {
-              resolve7(returnValue);
+              resolve8(returnValue);
             }
           }
         }
@@ -24691,8 +24691,8 @@ async function runLink(serverUrl, explicitProfile) {
 }
 
 // src/commands/start.ts
-import { spawn as spawn5 } from "child_process";
-import { join as join19 } from "path";
+import { spawn as spawn6 } from "child_process";
+import { join as join23 } from "path";
 
 // src/core/update.ts
 import { execSync as execSync2 } from "child_process";
@@ -24863,7 +24863,7 @@ async function checkAndUpdate(serverUrl, autoUpdate) {
 
 // src/core/ws-client.ts
 import { randomUUID } from "crypto";
-import { basename as basename3, join as join15 } from "path";
+import { basename as basename4, join as join19 } from "path";
 
 // ../../22-packages/11-shared/51-utils/src/helpers.ts
 function backoffJitterMs(attempt, baseMs = 500, maxMs = 1e4) {
@@ -24972,6 +24972,12 @@ var PermissionCode = {
   PROJECT_GIT_WRITE: "project.git_write",
   // Autonomous mode (ADR-0152): settings/start-pause/VERIFY-approve/post-USER_TODO
   PROJECT_AUTONOMOUS: "project.autonomous",
+  // Subagents & skills management (ADR-0153): create/edit/delete .claude/agents + skills
+  PROJECT_AGENTS: "project.agents",
+  // Security & placeholder management (ADR-0154): AI_SECURITY/AI_PLACEHOLDER docs + write-only secrets
+  PROJECT_SECRETS: "project.secrets",
+  // RAG capability install (ADR-0156): install/manage the worker's RAG engine
+  PROJECT_RAG: "project.rag",
   // permission
   PERMISSION_LIST: "permission.list",
   PERMISSION_READ: "permission.read",
@@ -25074,6 +25080,9 @@ var ROLE_DEFAULT_PERMISSIONS = {
     P.PROJECT_GIT,
     P.PROJECT_GIT_WRITE,
     P.PROJECT_AUTONOMOUS,
+    P.PROJECT_AGENTS,
+    P.PROJECT_SECRETS,
+    P.PROJECT_RAG,
     P.PERMISSION_LIST,
     P.PERMISSION_READ,
     P.MACHINE_PAIR,
@@ -25099,6 +25108,12 @@ var ROLE_DEFAULT_PERMISSIONS = {
     P.PROJECT_MEMO_READ,
     P.PROJECT_MEMO_WRITE,
     P.PROJECT_GIT,
+    // manage subagents/skills (dev artifacts) — ADR-0153
+    P.PROJECT_AGENTS,
+    // manage security/placeholder + set (write-only) secrets — ADR-0154
+    P.PROJECT_SECRETS,
+    // install/manage the worker RAG engine — ADR-0156
+    P.PROJECT_RAG,
     P.INTEGRATION_READ
   ],
   [Role.QA]: [
@@ -25133,6 +25148,8 @@ var ROLE_DEFAULT_PERMISSIONS = {
     P.PROJECT_GIT_WRITE,
     // autonomous mode control on its own physic project (ADR-0152)
     P.PROJECT_AUTONOMOUS,
+    // manage its own subagents/skills (ADR-0153)
+    P.PROJECT_AGENTS,
     // view one's own worker/cli + configure the physic project
     P.MACHINE_LIST,
     P.MACHINE_PHYSIC_MANAGE,
@@ -25163,7 +25180,10 @@ var PROJECT_SCOPE_CHECKED_CODES = [
   P.PROJECT_AI_ASSIST,
   P.PROJECT_GIT,
   P.PROJECT_GIT_WRITE,
-  P.PROJECT_AUTONOMOUS
+  P.PROJECT_AUTONOMOUS,
+  P.PROJECT_AGENTS,
+  P.PROJECT_SECRETS,
+  P.PROJECT_RAG
 ];
 var SELF_SERVICE_CODES = [
   P.AUTH_LOGOUT,
@@ -25206,6 +25226,9 @@ var TEAM_GRANTABLE_CODES = [
   P.PROJECT_GIT,
   P.PROJECT_GIT_WRITE,
   P.PROJECT_AUTONOMOUS,
+  P.PROJECT_AGENTS,
+  P.PROJECT_SECRETS,
+  P.PROJECT_RAG,
   P.COMMAND_EXECUTE,
   P.COMMAND_READ,
   P.MACHINE_LIST,
@@ -25230,6 +25253,9 @@ var PROJECT_GRANTABLE_CODES = [
   P.PROJECT_GIT,
   P.PROJECT_GIT_WRITE,
   P.PROJECT_AUTONOMOUS,
+  P.PROJECT_AGENTS,
+  P.PROJECT_SECRETS,
+  P.PROJECT_RAG,
   P.COMMAND_EXECUTE,
   P.COMMAND_READ,
   P.MACHINE_PHYSIC_MANAGE
@@ -29342,7 +29368,7 @@ var pinnedFilterSchema = external_exports.enum(["true", "false"]).transform((v)
 var deletedFilterSchema = external_exports.enum(["true", "false"]).transform((v) => v === "true").optional();
 
 // ../../22-packages/11-shared/41-validation/src/schemas.ts
-var passwordSchema = external_exports.string().min(8, "password: at least 8 characters").max(72, "password: at most 72 characters").regex(/[a-zA-Z]/, "password: needs at least 1 letter").regex(/[0-9]/, "password: needs at least 1 digit");
+var passwordSchema = external_exports.string().min(8, "password: at least 8 characters").max(32, "password: at most 32 characters").regex(/[a-zA-Z]/, "password: needs at least 1 letter").regex(/[0-9]/, "password: needs at least 1 digit");
 var usernameSchema = external_exports.string().min(3).max(32).regex(/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/, "username: invalid characters");
 var emailSchema = external_exports.string().email().max(254).toLowerCase();
 var phoneSchema = external_exports.string().regex(/^\+?[0-9]{8,15}$/, "phone: invalid format");
@@ -29371,6 +29397,9 @@ var registerRequestSchema = external_exports.object({
 var mailTokenRequestSchema = external_exports.object({
   token: hexTokenSchema
 });
+var resendVerifyRequestSchema = external_exports.object({
+  email: emailSchema
+});
 var loginRequestSchema = external_exports.object({
   identifier: external_exports.string().min(1).max(254),
   password: external_exports.string().min(1).max(72),
@@ -29762,6 +29791,38 @@ var autonomousWriteRequestSchema = external_exports.discriminatedUnion("kind", [
 var autonomousLogsQuerySchema = external_exports.object({
   date: external_exports.string().regex(/^\d{4}-\d{2}-\d{2}$/).optional()
 });
+var agentNameSchema = external_exports.string().min(1).max(64).regex(/^[\w.-]+$/);
+var agentReadQuerySchema = external_exports.object({
+  kind: external_exports.enum(["subagent", "skill"]),
+  name: agentNameSchema
+});
+var ragInstallRequestSchema = external_exports.object({
+  model: external_exports.string().min(1).max(200)
+});
+var ragQueryQuerySchema = external_exports.object({
+  q: external_exports.string().min(1).max(2e3),
+  k: external_exports.coerce.number().int().min(1).max(20).optional()
+});
+var graphBuildQuerySchema = external_exports.object({
+  mode: external_exports.enum(["docs", "code"])
+});
+var secretKeySchema = external_exports.string().min(1).max(128).regex(/^[\w.-]+$/);
+var secretsWriteRequestSchema = external_exports.discriminatedUnion("kind", [
+  external_exports.object({ kind: external_exports.literal("security"), content: external_exports.string().max(128 * 1024) }),
+  external_exports.object({ kind: external_exports.literal("placeholder"), content: external_exports.string().max(128 * 1024) }),
+  external_exports.object({ kind: external_exports.literal("secret"), key: secretKeySchema, value: external_exports.string().max(8192) }),
+  external_exports.object({ kind: external_exports.literal("secretDelete"), key: secretKeySchema })
+]);
+var agentWriteRequestSchema = external_exports.object({
+  kind: external_exports.enum(["subagent", "skill"]),
+  name: agentNameSchema,
+  action: external_exports.enum(["write", "delete"]),
+  content: external_exports.string().max(128 * 1024).optional()
+}).superRefine((v, ctx) => {
+  if (v.action === "write" && (v.content === void 0 || v.content.length === 0)) {
+    ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["content"], message: "content is required for write" });
+  }
+});
 
 // ../../22-packages/11-shared/31-dto/src/command.ts
 var COMMAND_MAX_LEN = 8e3;
@@ -30021,6 +30082,21 @@ var WsChannels = {
   AUTONOMOUS_READ: "autonomous.read",
   AUTONOMOUS_WRITE: "autonomous.write",
   AUTONOMOUS_LOGS: "autonomous.logs",
+  // subagents & skills management (ADR-0153): list/read/write .claude/agents + .claude/skills
+  AGENTS_LIST: "agents.list",
+  AGENTS_READ: "agents.read",
+  AGENTS_WRITE: "agents.write",
+  // security & placeholder management (ADR-0154): AI_SECURITY/AI_PLACEHOLDER + write-only secrets
+  SECRETS_READ: "secrets.read",
+  SECRETS_WRITE: "secrets.write",
+  // docs & code dependency graph (ADR-0155): build a {nodes,edges,orphans} graph per mode
+  GRAPH_BUILD: "graph.build",
+  // RAG capability + install (ADR-0156): probe the worker + install a worker-tuned model
+  RAG_STATUS: "rag.status",
+  RAG_INSTALL: "rag.install",
+  // RAG index + query (ADR-0157): reindex docs into sqlite-vec, semantic query
+  RAG_REINDEX: "rag.reindex",
+  RAG_QUERY: "rag.query",
   // git history browse (read-through cli — ADR-0089): repos on the physic project,
   // commit log, changed files of a commit, parent↔commit diff of one file.
   GIT_REPOS: "git.repos",
@@ -30180,7 +30256,7 @@ var OutputBatcher = class {
 };
 
 // src/core/ws-client.ts
-import { existsSync as existsSync8, mkdirSync as mkdirSync4, rmSync as rmSync4 } from "fs";
+import { existsSync as existsSync9, mkdirSync as mkdirSync4, rmSync as rmSync4 } from "fs";
 import { randomUUID as randomCommandId } from "crypto";
 
 // src/core/update-scheduler.ts
@@ -30423,7 +30499,7 @@ async function runCommand(dispatch, emit) {
   });
   child.stdout?.on("data", (data) => batcher.push(data.toString("utf8")));
   child.stderr?.on("data", (data) => batcher.push(data.toString("utf8")));
-  await new Promise((resolve7) => {
+  await new Promise((resolve8) => {
     child.on("close", (exitCode) => {
       batcher.flush();
       emit({
@@ -30433,7 +30509,7 @@ async function runCommand(dispatch, emit) {
         done: true,
         exitCode: exitCode ?? -1
       });
-      resolve7();
+      resolve8();
     });
     child.on("error", (err) => {
       emit({
@@ -30444,7 +30520,7 @@ async function runCommand(dispatch, emit) {
         done: true,
         exitCode: -1
       });
-      resolve7();
+      resolve8();
     });
   });
 }
@@ -30524,10 +30600,10 @@ function isSessionLimit(text) {
   );
 }
 function runAttempt(commandId, cmd, args, cwd2, env3, onChunk) {
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     void runCommand({ commandId, cmd, args, path: cwd2, env: env3 }, (out) => {
       if (out.chunk) onChunk(out.chunk);
-      if (out.done) resolve7(out.exitCode ?? -1);
+      if (out.done) resolve8(out.exitCode ?? -1);
     });
   });
 }
@@ -30705,16 +30781,16 @@ async function fetchUsage(token) {
   }
 }
 function runUsageCli(dir2, aiCli2) {
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     let out = "";
     let child = null;
     const finish = () => {
       clearTimeout(timer);
-      resolve7(out);
+      resolve8(out);
     };
     const timer = setTimeout(() => {
       child?.kill();
-      resolve7(out);
+      resolve8(out);
     }, 3e4);
     timer.unref?.();
     try {
@@ -31220,10 +31296,10 @@ async function crontabList() {
   }
 }
 async function crontabSet(content) {
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     const child = spawn4("crontab", ["-"], { stdio: ["pipe", "ignore", "ignore"] });
-    child.on("error", () => resolve7(false));
-    child.on("close", (code) => resolve7(code === 0));
+    child.on("error", () => resolve8(false));
+    child.on("close", (code) => resolve8(code === 0));
     child.stdin.end(content.endsWith("\n") ? content : content + "\n");
   });
 }
@@ -31331,24 +31407,552 @@ ${req.content.trim()}
   }
 }
 
-// src/core/git-diff.ts
-import { readFile as readFile3 } from "fs/promises";
-import { execFile as execFile3 } from "child_process";
-import { basename as basename2, dirname as dirname4, resolve as resolve4 } from "path";
+// src/core/agents.ts
+import { readFile as readFile3, writeFile as writeFile3, mkdir as mkdir3, readdir as readdir3, rm } from "fs/promises";
+import { join as join13 } from "path";
+var AGENTS_REL = ".claude/agents";
+var SKILLS_REL = ".claude/skills";
+var MEMORY_DIRS = /* @__PURE__ */ new Set(["short-memory", "long-memory"]);
+function safeName(name) {
+  return name.replace(/[^\w.-]+/g, "-").replace(/^[-.]+|[-.]+$/g, "");
+}
+async function readText2(path, fallback = "") {
+  try {
+    return await readFile3(path, "utf8");
+  } catch {
+    return fallback;
+  }
+}
+function frontmatter(text) {
+  const m = text.match(/^---\r?\n([\s\S]*?)\r?\n---/);
+  const body = m?.[1] ?? "";
+  const get = (key) => body.match(new RegExp(`^${key}:\\s*(.+)$`, "m"))?.[1]?.trim().replace(/^["']|["']$/g, "") ?? "";
+  return { name: get("name"), description: get("description") };
+}
+async function listAgents(root) {
+  const subagents = [];
+  const skills = [];
+  try {
+    for (const e of await readdir3(join13(root, AGENTS_REL), { withFileTypes: true })) {
+      if (!e.isFile() || !e.name.endsWith(".md") || MEMORY_DIRS.has(e.name)) continue;
+      const fm = frontmatter(await readText2(join13(root, AGENTS_REL, e.name)));
+      subagents.push({ name: e.name.replace(/\.md$/, ""), description: fm.description });
+    }
+  } catch {
+  }
+  try {
+    for (const e of await readdir3(join13(root, SKILLS_REL), { withFileTypes: true })) {
+      if (!e.isDirectory()) continue;
+      const fm = frontmatter(await readText2(join13(root, SKILLS_REL, e.name, "SKILL.md")));
+      skills.push({ name: e.name, description: fm.description });
+    }
+  } catch {
+  }
+  subagents.sort((a, b) => a.name.localeCompare(b.name));
+  skills.sort((a, b) => a.name.localeCompare(b.name));
+  return { subagents, skills };
+}
+function itemPath(root, kind, name) {
+  const n = safeName(name);
+  return kind === "subagent" ? join13(root, AGENTS_REL, `${n}.md`) : join13(root, SKILLS_REL, n, "SKILL.md");
+}
+async function readAgent(root, kind, name) {
+  const content = await readText2(itemPath(root, kind, name));
+  if (kind !== "subagent") return { content };
+  const n = safeName(name);
+  const [short, long] = await Promise.all([
+    readText2(join13(root, AGENTS_REL, "short-memory", `${n}.md`)),
+    readText2(join13(root, AGENTS_REL, "long-memory", `${n}.md`))
+  ]);
+  return { content, memory: { short, long } };
+}
+async function writeAgent(root, req) {
+  const n = safeName(req.name);
+  if (!n) return { ok: false, error: "invalid name" };
+  try {
+    if (req.action === "delete") {
+      if (req.kind === "subagent") await rm(itemPath(root, "subagent", n), { force: true });
+      else await rm(join13(root, SKILLS_REL, n), { recursive: true, force: true });
+      return { ok: true };
+    }
+    if (req.content === void 0) return { ok: false, error: "content is required" };
+    const path = itemPath(root, req.kind, n);
+    await mkdir3(join13(path, ".."), { recursive: true });
+    await writeFile3(path, req.content, "utf8");
+    return { ok: true };
+  } catch (err) {
+    return { ok: false, error: err instanceof Error ? err.message : String(err) };
+  }
+}
+
+// src/core/secrets.ts
+import { readFile as readFile4, writeFile as writeFile4 } from "fs/promises";
+import { join as join14 } from "path";
+var SECURITY_REL = "AI_SECURITY.md";
+var PLACEHOLDER_REL = "AI_PLACEHOLDER.md";
+var SECRETS_REL = "project.secrets.json";
+async function readText3(path, fallback = "") {
+  try {
+    return await readFile4(path, "utf8");
+  } catch {
+    return fallback;
+  }
+}
+async function readSecretsObject(root) {
+  try {
+    const v = JSON.parse(await readFile4(join14(root, SECRETS_REL), "utf8"));
+    return v && typeof v === "object" ? v : {};
+  } catch {
+    return {};
+  }
+}
+function placeholderKeys(text) {
+  const keys = [];
+  for (const line of text.split("\n")) {
+    const s = line.trim();
+    if (!s.startsWith("|")) continue;
+    if (/^\|[\s:|-]+\|?$/.test(s)) continue;
+    const first = s.replace(/^\|/, "").split("|")[0]?.trim() ?? "";
+    if (/^[\w.-]+$/.test(first) && first.toLowerCase() !== "key") keys.push(first);
+  }
+  return keys;
+}
+async function readSecrets(root) {
+  const [security, placeholder, secrets] = await Promise.all([
+    readText3(join14(root, SECURITY_REL)),
+    readText3(join14(root, PLACEHOLDER_REL)),
+    readSecretsObject(root)
+  ]);
+  const names = /* @__PURE__ */ new Set([...placeholderKeys(placeholder), ...Object.keys(secrets)]);
+  const keys = [...names].sort().map((name) => ({
+    name,
+    set: secrets[name] !== void 0 && String(secrets[name]).length > 0
+  }));
+  return { security, placeholder, keys };
+}
+async function writeSecrets(root, req) {
+  try {
+    if (req.kind === "security") {
+      await writeFile4(join14(root, SECURITY_REL), req.content, "utf8");
+    } else if (req.kind === "placeholder") {
+      await writeFile4(join14(root, PLACEHOLDER_REL), req.content, "utf8");
+    } else {
+      const secrets = await readSecretsObject(root);
+      if (req.kind === "secret") secrets[req.key] = req.value;
+      else delete secrets[req.key];
+      await writeFile4(join14(root, SECRETS_REL), JSON.stringify(secrets, null, 2) + "\n", "utf8");
+    }
+    return { ok: true };
+  } catch (err) {
+    return { ok: false, error: err instanceof Error ? err.message : String(err) };
+  }
+}
+
+// src/core/graph.ts
+import { readFile as readFile5, readdir as readdir4 } from "fs/promises";
+import { join as join15, relative, dirname as dirname4, resolve as resolve4, extname, basename as basename2 } from "path";
+var MAX_FILES = 2e3;
+var MAX_NODES = 3e3;
+var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", "build", ".next", "out", "coverage", ".turbo"]);
+var CODE_EXT = /* @__PURE__ */ new Set([".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs", ".py", ".go", ".rs", ".java", ".rb", ".php"]);
+async function walk(root, accept) {
+  const out = [];
+  const stack = [root];
+  while (stack.length && out.length < MAX_FILES) {
+    const dir2 = stack.pop();
+    let entries2;
+    try {
+      entries2 = await readdir4(dir2, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const e of entries2) {
+      if (e.name.startsWith(".") && e.name !== ".claude") {
+        if (e.isDirectory()) continue;
+      }
+      const full = join15(dir2, e.name);
+      if (e.isDirectory()) {
+        if (!SKIP_DIRS.has(e.name)) stack.push(full);
+      } else if (accept(full)) {
+        out.push(full);
+        if (out.length >= MAX_FILES) break;
+      }
+    }
+  }
+  return out;
+}
+function orphansOf(nodes, edges) {
+  const hasInbound = new Set(edges.map((e) => e.to));
+  return nodes.filter((n) => !hasInbound.has(n.id)).map((n) => n.id);
+}
+async function buildDocs(root) {
+  const files = await walk(root, (p) => extname(p) === ".md");
+  const ids = new Set(files.map((f) => relative(root, f).split("\\").join("/")));
+  const nodes = files.map((f) => {
+    const rel = relative(root, f).split("\\").join("/");
+    return { id: rel, label: basename2(rel), kind: "doc", file: rel };
+  });
+  const edges = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const f of files) {
+    const rel = relative(root, f).split("\\").join("/");
+    let text = "";
+    try {
+      text = await readFile5(f, "utf8");
+    } catch {
+      continue;
+    }
+    for (const m of text.matchAll(/\[[^\]]*\]\(([^)]+)\)/g)) {
+      const href = (m[1] ?? "").split("#")[0].trim();
+      if (!href || !href.endsWith(".md") || href.startsWith("http")) continue;
+      const target = relative(root, resolve4(dirname4(f), href)).split("\\").join("/");
+      if (ids.has(target) && target !== rel) {
+        const key = `${rel}->${target}`;
+        if (!seen.has(key)) {
+          seen.add(key);
+          edges.push({ from: rel, to: target });
+        }
+      }
+    }
+  }
+  return { nodes, edges, orphans: orphansOf(nodes, edges) };
+}
+var DEF_PATTERNS = [
+  /\bfunction\s+([A-Za-z_$][\w$]*)/g,
+  // JS/TS function decl
+  /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*(?:async\s*)?(?:function\b|\([^)]*\)\s*=>|[A-Za-z_$][\w$]*\s*=>)/g,
+  // arrow/func expr
+  /^\s*def\s+([A-Za-z_]\w*)/gm,
+  // Python
+  /\bfunc\s+(?:\([^)]*\)\s*)?([A-Za-z_]\w*)/g
+  // Go
+];
+async function buildCode(root) {
+  const files = await walk(root, (p) => CODE_EXT.has(extname(p)));
+  const nodes = [];
+  const nameToIds = /* @__PURE__ */ new Map();
+  const fileDefs = /* @__PURE__ */ new Map();
+  for (const f of files) {
+    if (nodes.length >= MAX_NODES) break;
+    const rel = relative(root, f).split("\\").join("/");
+    let text = "";
+    try {
+      text = await readFile5(f, "utf8");
+    } catch {
+      continue;
+    }
+    const defs = [];
+    for (const re of DEF_PATTERNS) {
+      for (const m of text.matchAll(re)) {
+        const name = m[1] ?? "";
+        if (!name || name.length < 2) continue;
+        const id = `${rel}#${name}`;
+        if (nameToIds.has(name) && (nameToIds.get(name) ?? []).includes(id)) continue;
+        if (nodes.length >= MAX_NODES) break;
+        defs.push({ name, id, start: m.index ?? 0 });
+        nodes.push({ id, label: name, kind: "fn", file: rel });
+        nameToIds.set(name, [...nameToIds.get(name) ?? [], id]);
+      }
+    }
+    defs.sort((a, b) => a.start - b.start);
+    fileDefs.set(rel, { rel, text, defs });
+  }
+  const edges = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const { text, defs } of fileDefs.values()) {
+    for (let i = 0; i < defs.length; i++) {
+      const def = defs[i];
+      const end = i + 1 < defs.length ? defs[i + 1].start : text.length;
+      const body = text.slice(def.start, end);
+      for (const m of body.matchAll(/([A-Za-z_$][\w$]*)\s*\(/g)) {
+        const callee = m[1] ?? "";
+        if (callee === def.name) continue;
+        for (const targetId of nameToIds.get(callee) ?? []) {
+          if (targetId === def.id) continue;
+          const key = `${def.id}->${targetId}`;
+          if (!seen.has(key)) {
+            seen.add(key);
+            edges.push({ from: def.id, to: targetId });
+          }
+        }
+      }
+    }
+  }
+  return { nodes, edges, orphans: orphansOf(nodes, edges) };
+}
+async function buildGraph(root, mode) {
+  try {
+    return mode === "docs" ? await buildDocs(root) : await buildCode(root);
+  } catch {
+    return { nodes: [], edges: [], orphans: [] };
+  }
+}
+
+// src/core/rag.ts
+import { readFile as readFile6, writeFile as writeFile5, statfs, mkdir as mkdir4 } from "fs/promises";
+import { existsSync as existsSync7 } from "fs";
+import { execFile as execFile3, spawn as spawn5 } from "child_process";
+import { totalmem, cpus } from "os";
+import { join as join16 } from "path";
 import { promisify as promisify3 } from "util";
 var run3 = promisify3(execFile3);
+var RAG_REL = ".claude/rag";
+async function tryRun(cmd, args) {
+  try {
+    const { stdout } = await run3(cmd, args, { timeout: 8e3 });
+    return { ok: true, out: stdout.trim() };
+  } catch {
+    return { ok: false, out: "" };
+  }
+}
+async function detectPython() {
+  for (const bin of ["python3", "python"]) {
+    const r = await tryRun(bin, ["--version"]);
+    if (r.ok) return { bin, found: true, version: r.out.replace(/^Python\s*/i, "") };
+  }
+  return { bin: "python3", found: false, version: "" };
+}
+async function installLog(root) {
+  try {
+    const text = await readFile6(join16(root, RAG_REL, "install.log"), "utf8");
+    return text.split("\n").filter((l) => l.length > 0).slice(-200);
+  } catch {
+    return [];
+  }
+}
+function optionsFor(m) {
+  const opts = [
+    {
+      id: "small",
+      label: "Small (bge-small, EN) \xB7 ~130 MB",
+      model: "BAAI/bge-small-en-v1.5",
+      sizeMB: 130,
+      recommended: m.ramGB < 8,
+      note: "Lightweight, low RAM."
+    }
+  ];
+  if (m.diskFreeGB > 1.5) {
+    opts.push({
+      id: "multilingual",
+      label: "Multilingual (MiniLM, incl. Vietnamese) \xB7 ~470 MB",
+      model: "sentence-transformers/paraphrase-multilingual-MiniLM-L12-v2",
+      sizeMB: 470,
+      recommended: m.ramGB >= 8 && m.diskFreeGB > 2,
+      note: "Best for mixed VI/EN content."
+    });
+  }
+  if (m.ramGB >= 8 && m.diskFreeGB > 2) {
+    opts.push({
+      id: "base",
+      label: "Base (bge-base, EN) \xB7 ~440 MB",
+      model: "BAAI/bge-base-en-v1.5",
+      sizeMB: 440,
+      recommended: false,
+      note: "Higher quality EN, needs \u2265 8 GB RAM."
+    });
+  }
+  return opts;
+}
+async function ragStatus(root) {
+  const py = await detectPython();
+  const [pip, fastembed, sqliteVec] = py.found ? await Promise.all([
+    tryRun(py.bin, ["-m", "pip", "--version"]).then((r) => r.ok),
+    tryRun(py.bin, ["-c", "import fastembed"]).then((r) => r.ok),
+    tryRun(py.bin, ["-c", "import sqlite_vec"]).then((r) => r.ok)
+  ]) : [false, false, false];
+  let diskFreeGB = 0;
+  try {
+    const s = await statfs(root);
+    diskFreeGB = Math.round(s.bavail * s.bsize / 1e9 * 10) / 10;
+  } catch {
+    diskFreeGB = 0;
+  }
+  const gpu = (await tryRun("nvidia-smi", ["-L"])).ok;
+  const machine = {
+    ramGB: Math.round(totalmem() / 1e9 * 10) / 10,
+    cpus: cpus().length,
+    diskFreeGB,
+    gpu
+  };
+  let modelName = "";
+  try {
+    modelName = (await readFile6(join16(root, RAG_REL, ".installed"), "utf8")).trim();
+  } catch {
+    modelName = "";
+  }
+  const modelPresent = modelName.length > 0;
+  return {
+    installed: fastembed && sqliteVec && modelPresent,
+    installing: existsSync7(join16(root, RAG_REL, ".installing")),
+    python: { found: py.found, version: py.version },
+    deps: { pip, fastembed, sqliteVec },
+    model: { present: modelPresent, name: modelName },
+    machine,
+    options: optionsFor(machine),
+    installLog: await installLog(root),
+    index: await readIndexMeta(root)
+  };
+}
+async function readIndexMeta(root) {
+  const indexing = existsSync7(join16(root, RAG_REL, ".indexing"));
+  try {
+    const m = JSON.parse(await readFile6(join16(root, RAG_REL, ".index.json"), "utf8"));
+    return {
+      present: true,
+      indexing,
+      chunks: typeof m.chunks === "number" ? m.chunks : 0,
+      indexedAt: typeof m.indexedAt === "string" ? m.indexedAt : ""
+    };
+  } catch {
+    return { present: false, indexing, chunks: 0, indexedAt: "" };
+  }
+}
+var RAG_ENGINE_PY = `import sys, os, json, glob, sqlite3, datetime
+BASE = os.path.join(".claude", "rag")
+DB = os.path.join(BASE, "index.db")
+def model_name():
+    return open(os.path.join(BASE, ".installed"), encoding="utf-8").read().strip()
+def connect():
+    import sqlite_vec
+    db = sqlite3.connect(DB)
+    db.enable_load_extension(True)
+    sqlite_vec.load(db)
+    db.enable_load_extension(False)
+    return db
+def embedder():
+    from fastembed import TextEmbedding
+    return TextEmbedding(model_name())
+def reindex():
+    import sqlite_vec
+    emb = embedder()
+    chunks = []
+    for p in glob.glob("**/*.md", recursive=True):
+        parts = p.split(os.sep)
+        if "node_modules" in parts or ".git" in parts: continue
+        try: txt = open(p, encoding="utf-8").read()
+        except Exception: continue
+        for i in range(0, len(txt), 800):
+            c = txt[i:i+1000].strip()
+            if len(c) > 20: chunks.append((p, c))
+        if len(chunks) >= 5000: break
+    vectors = list(emb.embed([c for _, c in chunks])) if chunks else []
+    dim = len(vectors[0]) if vectors else 384
+    os.makedirs(BASE, exist_ok=True)
+    db = connect()
+    db.execute("DROP TABLE IF EXISTS chunks")
+    db.execute("CREATE VIRTUAL TABLE chunks USING vec0(embedding float[%d], +path text, +snippet text)" % dim)
+    for (p, c), v in zip(chunks, vectors):
+        db.execute("INSERT INTO chunks(embedding, path, snippet) VALUES (?, ?, ?)",
+                   (sqlite_vec.serialize_float32(list(v)), p, c[:400]))
+    db.commit(); db.close()
+    json.dump({"chunks": len(chunks), "indexedAt": datetime.datetime.now().isoformat(timespec="seconds"), "model": model_name()},
+              open(os.path.join(BASE, ".index.json"), "w", encoding="utf-8"))
+    print("[reindex] DONE %d chunks" % len(chunks))
+def query(q, k):
+    import sqlite_vec
+    v = list(embedder().embed([q]))[0]
+    db = connect()
+    rows = db.execute("SELECT path, snippet, distance FROM chunks WHERE embedding MATCH ? ORDER BY distance LIMIT ?",
+                      (sqlite_vec.serialize_float32(list(v)), k)).fetchall()
+    db.close()
+    out = [{"path": r[0], "snippet": r[1], "score": round(1.0/(1.0+float(r[2])), 4)} for r in rows]
+    print(json.dumps({"results": out}, ensure_ascii=False))
+if __name__ == "__main__":
+    cmd = sys.argv[1] if len(sys.argv) > 1 else ""
+    if cmd == "reindex": reindex()
+    elif cmd == "query": query(sys.argv[2], int(sys.argv[3]) if len(sys.argv) > 3 else 8)
+`;
+async function ensureEngine(root) {
+  await mkdir4(join16(root, RAG_REL), { recursive: true }).catch(() => void 0);
+  await writeFile5(join16(root, RAG_REL, "rag_engine.py"), RAG_ENGINE_PY, "utf8");
+}
+async function ragReindex(root) {
+  const py = await detectPython();
+  if (!py.found) return { ok: false, started: false, error: "python3 not found" };
+  if (!existsSync7(join16(root, RAG_REL, ".installed"))) return { ok: false, started: false, error: "RAG is not installed" };
+  if (existsSync7(join16(root, RAG_REL, ".indexing"))) return { ok: true, started: true };
+  await ensureEngine(root);
+  const script = `
+set +e
+touch "${RAG_REL}/.indexing"
+{ echo "[reindex] $(date)"; "$RAG_PY" "${RAG_REL}/rag_engine.py" reindex 2>&1; } >> "${RAG_REL}/index.log" 2>&1
+rm -f "${RAG_REL}/.indexing"
+`;
+  const child = spawn5("bash", ["-c", script], {
+    cwd: root,
+    env: { ...process.env, RAG_PY: py.bin },
+    detached: true,
+    stdio: "ignore"
+  });
+  child.unref();
+  return { ok: true, started: true };
+}
+async function ragQuery(root, queryText, k = 8) {
+  const py = await detectPython();
+  if (!py.found) return { results: [], error: "python3 not found" };
+  if (!existsSync7(join16(root, RAG_REL, "index.db"))) return { results: [], error: "no index \u2014 reindex first" };
+  await ensureEngine(root);
+  try {
+    const { stdout } = await run3(
+      py.bin,
+      [join16(RAG_REL, "rag_engine.py"), "query", queryText, String(Math.min(Math.max(k, 1), 20))],
+      { cwd: root, timeout: 3e4, maxBuffer: 4 * 1024 * 1024 }
+    );
+    const parsed = JSON.parse(stdout.trim() || '{"results":[]}');
+    return { results: Array.isArray(parsed.results) ? parsed.results : [] };
+  } catch (err) {
+    return { results: [], error: err instanceof Error ? err.message : String(err) };
+  }
+}
+async function ragInstall(root, model) {
+  const py = await detectPython();
+  if (!py.found) return { ok: false, started: false, error: "python3 not found on the worker" };
+  if (existsSync7(join16(root, RAG_REL, ".installing"))) return { ok: true, started: true };
+  try {
+    await mkdir4(join16(root, RAG_REL), { recursive: true });
+  } catch {
+  }
+  const script = `
+set +e
+touch "${RAG_REL}/.installing"
+rm -f "${RAG_REL}/.installed"
+{
+  echo "[install] $(date) pip install fastembed sqlite-vec"
+  "$RAG_PY" -m pip install --quiet --user fastembed sqlite-vec 2>&1
+  echo "[install] warming model: $RAG_MODEL (first run downloads it)"
+  "$RAG_PY" -c "from fastembed import TextEmbedding; TextEmbedding('$RAG_MODEL'); print('[install] model ready')" 2>&1
+  if [ $? -eq 0 ]; then printf '%s' "$RAG_MODEL" > "${RAG_REL}/.installed"; echo "[install] DONE"; else echo "[install] FAILED"; fi
+} >> "${RAG_REL}/install.log" 2>&1
+rm -f "${RAG_REL}/.installing"
+`;
+  const child = spawn5("bash", ["-c", script], {
+    cwd: root,
+    env: { ...process.env, RAG_PY: py.bin, RAG_MODEL: model },
+    detached: true,
+    stdio: "ignore"
+  });
+  child.unref();
+  return { ok: true, started: true };
+}
+
+// src/core/git-diff.ts
+import { readFile as readFile7 } from "fs/promises";
+import { execFile as execFile4 } from "child_process";
+import { basename as basename3, dirname as dirname5, resolve as resolve5 } from "path";
+import { promisify as promisify4 } from "util";
+var run4 = promisify4(execFile4);
 async function gitDiff(path) {
-  const target = resolve4(path);
-  const dir2 = dirname4(target);
-  const base = basename2(target);
+  const target = resolve5(path);
+  const dir2 = dirname5(target);
+  const base = basename3(target);
   let newContent = "";
   try {
-    newContent = await readFile3(target, "utf8");
+    newContent = await readFile7(target, "utf8");
   } catch {
   }
   let oldContent = "";
   try {
-    const { stdout } = await run3("git", ["show", `HEAD:./${base}`], {
+    const { stdout } = await run4("git", ["show", `HEAD:./${base}`], {
       cwd: dir2,
       timeout: 15e3,
       maxBuffer: 4 * 1024 * 1024
@@ -31360,12 +31964,12 @@ async function gitDiff(path) {
 }
 
 // src/core/git-env.ts
-import { execFile as execFile4 } from "child_process";
-import { promisify as promisify4 } from "util";
-var run4 = promisify4(execFile4);
+import { execFile as execFile5 } from "child_process";
+import { promisify as promisify5 } from "util";
+var run5 = promisify5(execFile5);
 async function hasBinary(bin, args = ["--version"]) {
   try {
-    await run4(bin, args, { timeout: 5e3 });
+    await run5(bin, args, { timeout: 5e3 });
     return true;
   } catch {
     return false;
@@ -31378,7 +31982,7 @@ async function checkGitEnv(provider) {
   let account = null;
   if (installed) {
     try {
-      const { stdout, stderr } = await run4(bin, ["auth", "status"], { timeout: 8e3 });
+      const { stdout, stderr } = await run5(bin, ["auth", "status"], { timeout: 8e3 });
       const out = `${stdout}
 ${stderr}`;
       authenticated = /logged in|logged into|✓/i.test(out);
@@ -31391,22 +31995,22 @@ ${stderr}`;
 }
 
 // src/core/git-history.ts
-import { readdir as readdir3 } from "fs/promises";
-import { execFile as execFile5 } from "child_process";
-import { resolve as resolve5, sep as sep4 } from "path";
-import { promisify as promisify5 } from "util";
-var run5 = promisify5(execFile5);
+import { readdir as readdir5 } from "fs/promises";
+import { execFile as execFile6 } from "child_process";
+import { resolve as resolve6, sep as sep4 } from "path";
+import { promisify as promisify6 } from "util";
+var run6 = promisify6(execFile6);
 var FS = "";
 var RS = "";
 function resolveRepo(root, repo) {
   if (!root) return null;
-  const base = resolve5(root);
-  const requested = resolve5(base, repo && repo.trim() ? repo : ".");
+  const base = resolve6(root);
+  const requested = resolve6(base, repo && repo.trim() ? repo : ".");
   return requested === base || requested.startsWith(base + sep4) ? requested : base;
 }
 async function git(cwd2, args) {
   try {
-    const { stdout } = await run5("git", args, {
+    const { stdout } = await run6("git", args, {
       cwd: cwd2,
       timeout: 15e3,
       maxBuffer: 8 * 1024 * 1024
@@ -31418,7 +32022,7 @@ async function git(cwd2, args) {
 }
 async function gitRepos(root) {
   if (!root) return { repos: [] };
-  const base = resolve5(root);
+  const base = resolve6(root);
   const found = /* @__PURE__ */ new Set();
   const repos = [];
   const add = async (dir2) => {
@@ -31432,16 +32036,16 @@ async function gitRepos(root) {
   };
   await add(base);
   try {
-    const lvl1 = await readdir3(base, { withFileTypes: true });
+    const lvl1 = await readdir5(base, { withFileTypes: true });
     for (const d of lvl1) {
       if (!d.isDirectory() || d.name === ".git" || d.name === "node_modules") continue;
-      const p1 = resolve5(base, d.name);
+      const p1 = resolve6(base, d.name);
       await add(p1);
       try {
-        const lvl2 = await readdir3(p1, { withFileTypes: true });
+        const lvl2 = await readdir5(p1, { withFileTypes: true });
         for (const d2 of lvl2) {
           if (!d2.isDirectory() || d2.name === ".git" || d2.name === "node_modules") continue;
-          await add(resolve5(p1, d2.name));
+          await add(resolve6(p1, d2.name));
         }
       } catch {
       }
@@ -31508,24 +32112,24 @@ async function gitCommitDiff(root, repo, hash, path) {
 }
 
 // src/core/git-commit-identity.ts
-import { execFile as execFile6 } from "child_process";
-import { promisify as promisify6 } from "util";
-var run6 = promisify6(execFile6);
+import { execFile as execFile7 } from "child_process";
+import { promisify as promisify7 } from "util";
+var run7 = promisify7(execFile7);
 async function setCommitAuthor(cwd2, machineUsername) {
   if (!machineUsername) return;
   try {
-    await run6("git", ["config", "--local", "user.name", machineUsername], { cwd: cwd2, timeout: 8e3 });
+    await run7("git", ["config", "--local", "user.name", machineUsername], { cwd: cwd2, timeout: 8e3 });
   } catch {
   }
 }
 
 // src/core/scaffold.ts
-import { cp, mkdir as mkdir3, writeFile as writeFile3 } from "fs/promises";
-import { execFile as execFile7 } from "child_process";
-import { dirname as dirname5, join as join13, resolve as resolve6 } from "path";
+import { cp, mkdir as mkdir5, writeFile as writeFile6 } from "fs/promises";
+import { execFile as execFile8 } from "child_process";
+import { dirname as dirname6, join as join17, resolve as resolve7 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
-import { promisify as promisify7 } from "util";
-var run7 = promisify7(execFile7);
+import { promisify as promisify8 } from "util";
+var run8 = promisify8(execFile8);
 function reposOf(spec) {
   const repos = spec?.repos;
   return Array.isArray(repos) ? repos : [];
@@ -31539,46 +32143,46 @@ async function provisionRepos(target, repos, emit, opts = {}) {
     if (repo.primary) {
       if (opts.clonePrimary && repo.op === "existing" && repo.url) {
         emit("git", `Cloning ${repo.url}\u2026`);
-        await run7("git", ["clone", repo.url, target], { timeout: 12e4 });
+        await run8("git", ["clone", repo.url, target], { timeout: 12e4 });
         continue;
       }
       emit("git", "Initializing the primary repo\u2026");
-      await run7("git", ["init"], { cwd: target, timeout: 2e4 });
+      await run8("git", ["init"], { cwd: target, timeout: 2e4 });
       if (repo.op === "existing" && repo.url) {
-        await run7("git", ["remote", "add", "origin", repo.url], { cwd: target, timeout: 2e4 }).catch(
+        await run8("git", ["remote", "add", "origin", repo.url], { cwd: target, timeout: 2e4 }).catch(
           () => void 0
         );
       }
       continue;
     }
-    const dir2 = join13(target, subDirName(repo));
+    const dir2 = join17(target, subDirName(repo));
     if (repo.op === "existing" && repo.url) {
       emit("git", `Cloning sub-repo ${repo.url}\u2026`);
-      await run7("git", ["clone", repo.url, dir2], { timeout: 12e4 });
+      await run8("git", ["clone", repo.url, dir2], { timeout: 12e4 });
     } else {
       emit("git", `Initializing sub-repo ${subDirName(repo)}\u2026`);
-      await mkdir3(dir2, { recursive: true });
-      await run7("git", ["init"], { cwd: dir2, timeout: 2e4 });
+      await mkdir5(dir2, { recursive: true });
+      await run8("git", ["init"], { cwd: dir2, timeout: 2e4 });
     }
   }
 }
 function sampleDir() {
   if (process.env.SCAFFOLD_SAMPLE_DIR) return process.env.SCAFFOLD_SAMPLE_DIR;
-  const here = dirname5(fileURLToPath3(import.meta.url));
-  return resolve6(here, "../../project-sample");
+  const here = dirname6(fileURLToPath3(import.meta.url));
+  return resolve7(here, "../../project-sample");
 }
 async function scaffoldProject(payload, profileDir2, onProgress) {
   const emit = (step, message) => onProgress?.({ projectId: payload.projectId, step, message });
   try {
-    const root = process.env.SCAFFOLD_ROOT ? resolve6(process.env.SCAFFOLD_ROOT) : resolve6(profileDir2);
-    const target = join13(root, payload.projectName);
-    await mkdir3(target, { recursive: true });
+    const root = process.env.SCAFFOLD_ROOT ? resolve7(process.env.SCAFFOLD_ROOT) : resolve7(profileDir2);
+    const target = join17(root, payload.projectName);
+    await mkdir5(target, { recursive: true });
     emit("copy", "Copying the sample template\u2026");
     await cp(sampleDir(), target, { recursive: true, force: false, errorOnExist: false });
     if (payload.spec) {
       emit("spec", "Writing project.spec.json\u2026");
-      await writeFile3(
-        join13(target, "project.spec.json"),
+      await writeFile6(
+        join17(target, "project.spec.json"),
         JSON.stringify(payload.spec, null, 2),
         "utf8"
       );
@@ -31596,7 +32200,7 @@ async function aiInit(target, spec, emit) {
   emit("ai-init", "AI init: subagents, README, CLAUDE.md\u2026");
   const subagents = Array.isArray(spec.subagents) ? spec.subagents : [];
   if (subagents.length > 0) {
-    await mkdir3(join13(target, ".claude", "agents"), { recursive: true });
+    await mkdir5(join17(target, ".claude", "agents"), { recursive: true });
     for (const sa of subagents) {
       const name = (sa.name || "").trim().replace(/[^\w.-]+/g, "-").replace(/^-+|-+$/g, "");
       if (!name) continue;
@@ -31606,17 +32210,17 @@ name: ${name}
 
 ${(sa.description || "").trim()}
 `;
-      await writeFile3(join13(target, ".claude", "agents", `${name}.md`), body, "utf8");
+      await writeFile6(join17(target, ".claude", "agents", `${name}.md`), body, "utf8");
     }
   }
   const specJson = JSON.stringify(spec);
   await generateFile(
-    join13(target, "README.md"),
+    join17(target, "README.md"),
     `Write a concise README.md (Markdown only, no preamble) for this project from its spec JSON:
 ${specJson}`
   );
   await generateFile(
-    join13(target, "CLAUDE.md"),
+    join17(target, "CLAUDE.md"),
     `Write a CLAUDE.md (Markdown only, no preamble) with guidance/conventions for AI agents working in this project, derived from its spec JSON:
 ${specJson}`
   );
@@ -31624,16 +32228,16 @@ ${specJson}`
 async function generateFile(path, prompt) {
   try {
     const text = await aiGenerate(prompt);
-    if (text.trim()) await writeFile3(path, text.trim() + "\n", "utf8");
+    if (text.trim()) await writeFile6(path, text.trim() + "\n", "utf8");
   } catch {
   }
 }
 async function addProject(payload, profileDir2, onProgress) {
   const emit = (step, message) => onProgress?.({ projectId: payload.projectId, step, message });
   try {
-    const root = process.env.SCAFFOLD_ROOT ? resolve6(process.env.SCAFFOLD_ROOT) : resolve6(profileDir2);
-    const target = join13(root, payload.projectName);
-    await mkdir3(target, { recursive: true });
+    const root = process.env.SCAFFOLD_ROOT ? resolve7(process.env.SCAFFOLD_ROOT) : resolve7(profileDir2);
+    const target = join17(root, payload.projectName);
+    await mkdir5(target, { recursive: true });
     const repos = payload.repos ?? [];
     if (repos.length > 0) await provisionRepos(target, repos, emit, { clonePrimary: true });
     onProgress?.({ projectId: payload.projectId, step: "done", message: "Project added.", done: true });
@@ -31644,12 +32248,12 @@ async function addProject(payload, profileDir2, onProgress) {
 }
 
 // src/core/config-sync.ts
-import { existsSync as existsSync7, readFileSync as readFileSync13 } from "fs";
-import { join as join14 } from "path";
+import { existsSync as existsSync8, readFileSync as readFileSync13 } from "fs";
+import { join as join18 } from "path";
 var SERVER_MANAGED_KEYS = ["physicPath", "sessionSwitchPct", "perPromptTokenLimit"];
 function readConfigText(profileDir2) {
-  const path = join14(profileDir2, "config.json");
-  if (existsSync7(path)) {
+  const path = join18(profileDir2, "config.json");
+  if (existsSync8(path)) {
     try {
       return readFileSync13(path, "utf8");
     } catch {
@@ -31713,7 +32317,7 @@ var WsClient = class {
     context.bus.onTranscriptUpdate(
       (entry) => this.emitConsole({ kind: "update", entry: toDtoEntry(entry) })
     );
-    context.bus.onClear(() => this.emitConsole({ kind: "clear" }));
+    context.bus.onClear(() => this.emitConsoleClear());
   }
   context;
   socket = null;
@@ -31737,6 +32341,13 @@ var WsClient = class {
   wakeReconnect = null;
   /** When set, the next backoff sleep returns immediately (forced reconnect). */
   forceReconnect = false;
+  /**
+   * The single "reconnecting…" transcript line for the current outage (approach B): created on
+   * the first failed attempt and updated in place each retry, then finalized to the "connected"
+   * line on the next hello_ack — so one outage adds one line, not an error + a wait line per
+   * attempt. Null while connected / between outages.
+   */
+  reconnectEntryId = null;
   /** Org-configured reconnect cap (seconds) from the last ws_token — overrides env. */
   orgReconnectMaxSec = null;
   /** Env override for the reconnect cap (seconds); resolved once at construction. */
@@ -31805,14 +32416,14 @@ var WsClient = class {
    */
   awaitConnected(timeoutMs) {
     if (this.sessionKey && this.bus.status === "connected") return Promise.resolve(true);
-    return new Promise((resolve7) => {
+    return new Promise((resolve8) => {
       const waiter = () => {
         clearTimeout(timer);
-        resolve7(true);
+        resolve8(true);
       };
       const timer = setTimeout(() => {
         this.connectWaiters = this.connectWaiters.filter((w) => w !== waiter);
-        resolve7(false);
+        resolve8(false);
       }, timeoutMs);
       this.connectWaiters.push(waiter);
     });
@@ -31839,16 +32450,16 @@ var WsClient = class {
       this.forceReconnect = false;
       return Promise.resolve();
     }
-    return new Promise((resolve7) => {
+    return new Promise((resolve8) => {
       const timer = setTimeout(() => {
         this.wakeReconnect = null;
-        resolve7();
+        resolve8();
       }, ms);
       this.wakeReconnect = () => {
         clearTimeout(timer);
         this.wakeReconnect = null;
         this.forceReconnect = false;
-        resolve7();
+        resolve8();
       };
     });
   }
@@ -31858,6 +32469,7 @@ var WsClient = class {
   async run() {
     let hashcodeInvalidStreak = 0;
     for (let attempt = 0; !this.stopped; attempt++) {
+      let reconnectDetail = "Disconnected";
       try {
         await this.connectOnce();
         if (this.sessionEstablished) {
@@ -31875,17 +32487,14 @@ var WsClient = class {
               this.logout(err.errorCode);
               return;
             }
-            this.bus.log(
-              `Token request rejected (HASHCODE_INVALID) \u2014 retrying (${hashcodeInvalidStreak}/${MAX_HASHCODE_INVALID_RETRIES}).`,
-              "warn"
-            );
+            reconnectDetail = `Token rejected (HASHCODE_INVALID ${hashcodeInvalidStreak}/${MAX_HASHCODE_INVALID_RETRIES})`;
           } else if (err.errorCode === "USER_PAUSED") {
-            this.bus.log("This account is paused \u2014 retrying until it is resumed.", "warn");
+            reconnectDetail = "This account is paused \u2014 retrying until it is resumed";
           } else {
-            this.bus.log(`Connection error: ${err}`, "error");
+            reconnectDetail = `Connection error: ${err}`;
           }
         } else {
-          this.bus.log(`Connection error: ${err}`, "error");
+          reconnectDetail = `Connection error: ${err}`;
         }
       }
       if (this.stopped) return;
@@ -31896,7 +32505,7 @@ var WsClient = class {
       );
       logger.info("ws.reconnect", { attempt, waitMs: wait });
       this.bus.setStatus("reconnecting");
-      this.bus.log(`Reconnecting in ${Math.round(wait / 1e3)}s\u2026 (/reconnect to retry now)`);
+      this.showReconnectStatus(reconnectDetail, Math.round(wait / 1e3), attempt + 1);
       await this.interruptibleSleep(wait);
     }
   }
@@ -31904,7 +32513,7 @@ var WsClient = class {
    * One WS session: token → connect → handshake → handle messages until close.
    */
   connectOnce() {
-    return new Promise((resolve7, reject) => {
+    return new Promise((resolve8, reject) => {
       void (async () => {
         this.sessionEstablished = false;
         this.bus.setStatus("connecting");
@@ -31973,7 +32582,7 @@ var WsClient = class {
           if (code === CLOSE_DRAINING) {
             this.bus.log("Server draining \u2014 will reconnect (backoff + jitter).");
           }
-          resolve7();
+          resolve8();
         });
         socket.on("error", (err) => {
           this.clearHeartbeat();
@@ -32002,7 +32611,7 @@ var WsClient = class {
         logger.info("ws.connected", { version: CLI_VERSION });
         this.stopConsoleSync();
         this.bus.setStatus("connected");
-        this.bus.log("\u2714 Connected to the server (session encryption ready).");
+        this.finishReconnect();
         this.sendMachineStatus();
         this.flushOfflineBuffer();
         this.startHeartbeat();
@@ -32069,8 +32678,8 @@ var WsClient = class {
           const oldRoot = this.physicFolderPath(sync.oldName);
           if (oldRoot) void uninstallCron(oldRoot).catch(() => void 0);
         }
-        if (sync.oldName) rmSync4(join15(this.context.profileDir, sync.oldName), { recursive: true, force: true });
-        mkdirSync4(join15(this.context.profileDir, sync.newName), { recursive: true });
+        if (sync.oldName) rmSync4(join19(this.context.profileDir, sync.oldName), { recursive: true, force: true });
+        mkdirSync4(join19(this.context.profileDir, sync.newName), { recursive: true });
         this.physicRoot = this.physicFolderPath(sync.newName);
         this.bus.setProject(sync.newName);
         this.bus.log(`Physic project folder synced \u2192 ${sync.newName}`);
@@ -32081,7 +32690,7 @@ var WsClient = class {
         if (del.name) {
           const delRoot = this.physicFolderPath(del.name);
           if (delRoot) void uninstallCron(delRoot).catch(() => void 0);
-          rmSync4(join15(this.context.profileDir, del.name), { recursive: true, force: true });
+          rmSync4(join19(this.context.profileDir, del.name), { recursive: true, force: true });
           this.bus.log(`Physic project folder deleted (project removed) \u2192 ${del.name}`);
         }
         this.bus.setProject(null);
@@ -32178,6 +32787,88 @@ var WsClient = class {
         }
         break;
       }
+      case WsChannels.AGENTS_LIST:
+        if (this.physicRoot) {
+          void listAgents(this.physicRoot).then(
+            (reply) => this.send(WsChannels.AGENTS_LIST, reply, message.id)
+          );
+        }
+        break;
+      case WsChannels.AGENTS_READ: {
+        const req = payload;
+        if (this.physicRoot) {
+          void readAgent(this.physicRoot, req.kind, req.name).then(
+            (reply) => this.send(WsChannels.AGENTS_READ, reply, message.id)
+          );
+        }
+        break;
+      }
+      case WsChannels.AGENTS_WRITE: {
+        const req = payload;
+        if (this.physicRoot) {
+          void writeAgent(this.physicRoot, req).then(
+            (reply) => this.send(WsChannels.AGENTS_WRITE, reply, message.id)
+          );
+        }
+        break;
+      }
+      case WsChannels.SECRETS_READ:
+        if (this.physicRoot) {
+          void readSecrets(this.physicRoot).then(
+            (reply) => this.send(WsChannels.SECRETS_READ, reply, message.id)
+          );
+        }
+        break;
+      case WsChannels.SECRETS_WRITE: {
+        const req = payload;
+        if (this.physicRoot) {
+          void writeSecrets(this.physicRoot, req).then(
+            (reply) => this.send(WsChannels.SECRETS_WRITE, reply, message.id)
+          );
+        }
+        break;
+      }
+      case WsChannels.GRAPH_BUILD: {
+        const req = payload;
+        if (this.physicRoot) {
+          void buildGraph(this.physicRoot, req.mode).then(
+            (reply) => this.send(WsChannels.GRAPH_BUILD, reply, message.id)
+          );
+        }
+        break;
+      }
+      case WsChannels.RAG_STATUS:
+        if (this.physicRoot) {
+          void ragStatus(this.physicRoot).then(
+            (reply) => this.send(WsChannels.RAG_STATUS, reply, message.id)
+          );
+        }
+        break;
+      case WsChannels.RAG_INSTALL: {
+        const req = payload;
+        if (this.physicRoot) {
+          void ragInstall(this.physicRoot, req.model).then(
+            (reply) => this.send(WsChannels.RAG_INSTALL, reply, message.id)
+          );
+        }
+        break;
+      }
+      case WsChannels.RAG_REINDEX:
+        if (this.physicRoot) {
+          void ragReindex(this.physicRoot).then(
+            (reply) => this.send(WsChannels.RAG_REINDEX, reply, message.id)
+          );
+        }
+        break;
+      case WsChannels.RAG_QUERY: {
+        const req = payload;
+        if (this.physicRoot) {
+          void ragQuery(this.physicRoot, req.query, req.k).then(
+            (reply) => this.send(WsChannels.RAG_QUERY, reply, message.id)
+          );
+        }
+        break;
+      }
       case WsChannels.CONFIG_READ:
         this.send(
           WsChannels.CONFIG_READ,
@@ -32231,7 +32922,7 @@ var WsClient = class {
       }
       case WsChannels.LOG_READ: {
         const limit = Math.min(Math.max(payload.limit ?? 200, 1), 2e3);
-        const lines = readRecentLogLines(join15(this.context.profileDir, "logs"), limit);
+        const lines = readRecentLogLines(join19(this.context.profileDir, "logs"), limit);
         this.send(WsChannels.LOG_READ, { lines }, message.id);
         break;
       }
@@ -32571,6 +33262,46 @@ var WsClient = class {
     if (!this.consoleWatching) return;
     this.send(WsChannels.CONSOLE_SYNC, { ...ev, rev: ++this.consoleRev });
   }
+  /**
+   * A `/clear` (or idle auto-clear) wiped the transcript (ADR-0150). Emit it as an absolute empty
+   * **snapshot** rather than an incremental `clear` event: a snapshot is applied unconditionally on
+   * the web (no `rev`-gap check), so the clear can't be silently dropped when the web's revision
+   * drifted during a reconnect flap. No-op while unwatched — the next `console.watch` re-arm
+   * snapshots the (now empty) buffer anyway. The history is already emptied before this fires, so
+   * the snapshot carries no entries.
+   */
+  emitConsoleClear() {
+    if (!this.consoleWatching) return;
+    this.sendConsoleSnapshot();
+  }
+  /**
+   * Show the reconnect-backoff status as a SINGLE transcript line for the current outage
+   * (approach B): create it on the first failed attempt, then update it in place on every retry —
+   * so an outage adds one line instead of an error + a "reconnecting in Ns" line per attempt
+   * (which flooded the TUI and, on the next snapshot, the web Console).
+   */
+  showReconnectStatus(detail, waitSec, attempt) {
+    const text = `\u27F3 ${detail} \u2014 reconnecting in ${waitSec}s (attempt ${attempt}, /reconnect to retry now)`;
+    if (this.reconnectEntryId) {
+      this.bus.updateEntry(this.reconnectEntryId, text, "warn");
+    } else {
+      this.reconnectEntryId = this.bus.push({ source: "system", kind: "log", text, level: "warn" });
+    }
+  }
+  /**
+   * A session became ready (hello_ack): finalize any in-flight reconnect line in place to the
+   * "connected" line (so the outage's single line resolves cleanly), or — on a first connect with
+   * no prior outage — push a fresh connected line.
+   */
+  finishReconnect() {
+    const msg = "\u2714 Connected to the server (session encryption ready).";
+    if (this.reconnectEntryId) {
+      this.bus.updateEntry(this.reconnectEntryId, msg, "info");
+      this.reconnectEntryId = null;
+    } else {
+      this.bus.log(msg);
+    }
+  }
   /** Send a full transcript snapshot (on attach + the periodic self-heal — ADR-0150). */
   sendConsoleSnapshot() {
     const entries2 = this.bus.snapshot().map(toDtoEntry);
@@ -32620,7 +33351,7 @@ var WsClient = class {
    * Used for quota.check before spawning an AI cli (ADR-0020).
    */
   request(channel, data) {
-    return new Promise((resolve7, reject) => {
+    return new Promise((resolve8, reject) => {
       if (!this.socket || !this.sessionKey) {
         reject(new Error("Not connected to the server."));
         return;
@@ -32640,7 +33371,7 @@ var WsClient = class {
       }, 15e3);
       timer.unref?.();
       this.pending.set(envelope.id, {
-        resolve: (value) => resolve7(value),
+        resolve: (value) => resolve8(value),
         timer
       });
       this.socket.send(JSON.stringify(envelope));
@@ -32687,7 +33418,7 @@ var WsClient = class {
   /** Create the physic folder at an absolute path if missing (best-effort). */
   ensurePhysicFolderPath(folder) {
     try {
-      if (!existsSync8(folder)) {
+      if (!existsSync9(folder)) {
         mkdirSync4(folder, { recursive: true });
         this.bus.log(`Created physic project folder: ${folder}`);
       }
@@ -32702,7 +33433,7 @@ var WsClient = class {
    */
   physicFolderPath(projectName) {
     const safe = projectName.replace(/[/\\]/g, "_").replace(/\.\./g, "_").trim();
-    return safe ? join15(this.context.profileDir, safe) : null;
+    return safe ? join19(this.context.profileDir, safe) : null;
   }
   /**
    * Report machine.status: version + the state of the physic project being served
@@ -32716,7 +33447,7 @@ var WsClient = class {
       projects: [],
       version: CLI_VERSION,
       physicPath,
-      physicPathExists: physicPath ? existsSync8(physicPath) : void 0,
+      physicPathExists: physicPath ? existsSync9(physicPath) : void 0,
       // Real coarse state (ADR-0152): !paused and a recent tick (was hard-coded false).
       autonomousRunning: physicPath ? isAutonomousRunning(physicPath) : false
     });
@@ -32751,7 +33482,7 @@ var WsClient = class {
       const working = getWorkingProfile(this.context.profileDir, aiCli2);
       const configured = claudeHomeDirs(config);
       const dirs = working ? [working, ...configured.filter((d) => d !== working)] : configured;
-      const profile = working ? basename3(working) : dirs[0] ? basename3(dirs[0]) : "default";
+      const profile = working ? basename4(working) : dirs[0] ? basename4(dirs[0]) : "default";
       const api = await checkClaudeUsage(dirs, aiCli2);
       const snapshot = api ?? {
         plan: "?",
@@ -32788,7 +33519,7 @@ var WsClient = class {
    */
   uploadLog() {
     try {
-      const upload = readLogUpload(join15(this.context.profileDir, "logs"));
+      const upload = readLogUpload(join19(this.context.profileDir, "logs"));
       if (!upload) return;
       const sig = `${upload.fileName}:${upload.totalBytes}`;
       if (sig === this.lastLogSig) return;
@@ -32817,9 +33548,9 @@ var WsClient = class {
 
 // src/core/instance-lock.ts
 import { readFileSync as readFileSync14, rmSync as rmSync5, writeFileSync as writeFileSync6 } from "fs";
-import { join as join16 } from "path";
+import { join as join20 } from "path";
 function lockPath(profileDir2) {
-  return join16(profileDir2, "start.lock");
+  return join20(profileDir2, "start.lock");
 }
 function isAlive(pid) {
   try {
@@ -32912,14 +33643,15 @@ var SessionBus = class {
     return [...this.history];
   }
   /**
-   * Producer → consumers: replace the text of an already-pushed entry (ADR-0108) — used to
-   * grow a streaming `result` block in place without pushing a new line per chunk. No-op if the
-   * entry has aged out of the replay window.
+   * Producer → consumers: replace the text (and optionally the level) of an already-pushed entry
+   * (ADR-0108) — used to grow a streaming `result` block in place, or to update a single reconnect
+   * status line without pushing a new line per attempt. No-op if the entry has aged out.
    */
-  updateEntry(id, text) {
+  updateEntry(id, text, level) {
     const entry = this.history.find((e) => e.id === id);
     if (!entry) return;
     entry.text = text;
+    if (level) entry.level = level;
     this.emitter.emit("transcript-update", entry);
   }
   /** Subscribe to in-place entry updates (a `result` block growing — ADR-0108). */
@@ -36128,7 +36860,7 @@ var styles_default = styles2;
 // ../../node_modules/.pnpm/ink@5.2.1_@types+react@18.3.31_react@18.3.1/node_modules/ink/build/reconciler.js
 if (process3.env["DEV"] === "true") {
   try {
-    await import("./devtools-JZIQKAXX.js");
+    await import("./devtools-ZL4ACXHE.js");
   } catch (error) {
     if (error.code === "ERR_MODULE_NOT_FOUND") {
       console.warn(`
@@ -38346,8 +39078,8 @@ var Ink = class {
     }
   }
   async waitUntilExit() {
-    this.exitPromise ||= new Promise((resolve7, reject) => {
-      this.resolveExitPromise = resolve7;
+    this.exitPromise ||= new Promise((resolve8, reject) => {
+      this.resolveExitPromise = resolve8;
       this.rejectExitPromise = reject;
     });
     return this.exitPromise;
@@ -38714,15 +39446,15 @@ var import_react21 = __toESM(require_react(), 1);
 var import_react26 = __toESM(require_react(), 1);
 
 // src/core/input-history.ts
-import { existsSync as existsSync10, readFileSync as readFileSync16, writeFileSync as writeFileSync7 } from "fs";
-import { join as join17 } from "path";
+import { existsSync as existsSync11, readFileSync as readFileSync16, writeFileSync as writeFileSync7 } from "fs";
+import { join as join21 } from "path";
 var MAX_HISTORY = 200;
 function historyPath(profileDir2) {
-  return join17(profileDir2, "input-history.json");
+  return join21(profileDir2, "input-history.json");
 }
 function loadInputHistory(profileDir2) {
   const path = historyPath(profileDir2);
-  if (!existsSync10(path)) return [];
+  if (!existsSync11(path)) return [];
   try {
     const data = JSON.parse(readFileSync16(path, "utf8"));
     return Array.isArray(data) ? data.filter((x) => typeof x === "string") : [];
@@ -38984,8 +39716,8 @@ function TranscriptLine({ line }) {
 var import_react24 = __toESM(require_react(), 1);
 
 // src/ui/slash-commands.ts
-import { existsSync as existsSync11 } from "fs";
-import { join as join18 } from "path";
+import { existsSync as existsSync12 } from "fs";
+import { join as join22 } from "path";
 var CONFIG_KEYS = [
   "aiCli",
   "claudeHome",
@@ -38997,7 +39729,7 @@ var CONFIG_KEYS = [
   "aiEnv"
 ];
 function configPath(profileDir2) {
-  return join18(profileDir2, "config.json");
+  return join22(profileDir2, "config.json");
 }
 function parseConfigAssignment(key, valueTokens) {
   const value = valueTokens.join(" ").trim();
@@ -39047,7 +39779,7 @@ function runConfig(ctx) {
       ctx.print(`\u2714 ${verb} default config: ${path}`);
       ctx.print("add claude profiles: /config set claudeHome .claude .claude-1 (tried in order)");
     };
-    if (existsSync11(path)) {
+    if (existsSync12(path)) {
       ctx.confirm(
         `config exists: ${path} \u2014 replace it with defaults? (y/N)`,
         () => writeDefaults("replaced with")
@@ -39132,7 +39864,7 @@ function runOutput(ctx) {
 }
 function runLogs(ctx) {
   const n = Math.max(1, Math.min(200, Number(ctx.args[0]) || 20));
-  const dir2 = join18(ctx.info.profileDir, "logs");
+  const dir2 = join22(ctx.info.profileDir, "logs");
   const lines = readRecentLogLines(dir2, n);
   if (lines.length === 0) {
     ctx.print("No log lines yet.");
@@ -39633,7 +40365,7 @@ async function runStart(profileDir2, profileName) {
     return;
   }
   logger.configure({
-    dir: join19(profileDir2, "logs"),
+    dir: join23(profileDir2, "logs"),
     level: resolveLogLevel(),
     base: { version: CLI_VERSION, profile: profileName, scope: credential.scope }
   });
@@ -39653,7 +40385,7 @@ async function runStart(profileDir2, profileName) {
   if (result.action === "updated") {
     logger.info("update.updated", { version: result.version });
     console.log("Restarting with the new version\u2026");
-    const child = spawn5(process.execPath, process.argv.slice(1), {
+    const child = spawn6(process.execPath, process.argv.slice(1), {
       stdio: "inherit",
       env: { ...process.env, FOURPM_NO_UPDATE: "1" }
     });
@@ -39691,7 +40423,7 @@ async function runStart(profileDir2, profileName) {
           logger.error("ws.run.crash", { message: e.message, stack: e.stack });
           if (client.isStopped) return;
           bus.log(`Recovered from an internal error \u2014 reconnecting: ${e.message}`, "error");
-          await new Promise((resolve7) => setTimeout(resolve7, 1e3));
+          await new Promise((resolve8) => setTimeout(resolve8, 1e3));
         }
       }
     };
@@ -39818,10 +40550,10 @@ function Picker({
   ] });
 }
 function selectFromList(items, title) {
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     let chosen = null;
     const app = render_default(/* @__PURE__ */ (0, import_jsx_runtime7.jsx)(Picker, { items, title, onDone: (v) => chosen = v }));
-    void app.waitUntilExit().then(() => resolve7(chosen));
+    void app.waitUntilExit().then(() => resolve8(chosen));
   });
 }