@4pm/cli 1.31.0 → 1.32.0-b

package/dist/index.js

@@ -28708,6 +28708,16 @@ var ErrorCode = {
   WORKER_POOL_NAME_TAKEN: "WORKER_POOL_NAME_TAKEN",
   WORKER_POOL_ATTACHED: "WORKER_POOL_ATTACHED",
   WORKER_POOL_ALREADY_ATTACHED: "WORKER_POOL_ALREADY_ATTACHED",
+  // A pool can't be both a project pool and the org AI pool (ADR-0376 mutual exclusivity).
+  AI_POOL_CONFLICT: "AI_POOL_CONFLICT",
+  // No org AI pool configured (Settings) for a project-less org AI task (ADR-0376).
+  AI_POOL_NOT_CONFIGURED: "AI_POOL_NOT_CONFIGURED",
+  // Change-request (ADR-0379) not found / already resolved.
+  CHANGE_REQUEST_NOT_FOUND: "CHANGE_REQUEST_NOT_FOUND",
+  CHANGE_REQUEST_ALREADY_RESOLVED: "CHANGE_REQUEST_ALREADY_RESOLVED",
+  // org AI Research (ADR-0380): question refused by the content policy / research-guard; row not found.
+  RESEARCH_REFUSED: "RESEARCH_REFUSED",
+  RESEARCH_NOT_FOUND: "RESEARCH_NOT_FOUND",
   MACHINE_ALREADY_IN_POOL: "MACHINE_ALREADY_IN_POOL",
   NOT_MACHINE_USER: "NOT_MACHINE_USER",
   // worker · physic project
@@ -29925,8 +29935,8 @@ async function runLink(serverUrl, explicitProfile, token = null) {
 }
 
 // src/commands/start.ts
-import { spawn as spawn11 } from "child_process";
-import { join as join42 } from "path";
+import { spawn as spawn12 } from "child_process";
+import { join as join43 } from "path";
 
 // src/core/update.ts
 import { execSync as execSync2 } from "child_process";
@@ -33145,7 +33155,7 @@ async function checkAndUpdate(serverUrl, autoUpdate) {
 // src/core/ws-client.ts
 init_wrapper();
 import { randomUUID as randomUUID4 } from "crypto";
-import { basename as basename7, join as join37 } from "path";
+import { basename as basename7, join as join38 } from "path";
 import { existsSync as existsSync19, mkdirSync as mkdirSync9 } from "fs";
 
 // vendor/@4pm/utils/helpers.ts
@@ -39010,6 +39020,20 @@ var WsChannels = {
   // entries, commits, pushes a branch, opens a PR, then wipes the token/clone, and replies with the
   // PR URL. The write token never persists on the worker (leak-safety on release/reassign).
   FAQ_COMPOSE: "faq.compose",
+  // Org-level "AI author checklist items" (ADR-0376): server (picks an idle cli of the org AI pool) →
+  // cli request–reply. The server forwards a ready-built prompt; the worker runs claude one-shot (no
+  // tools, empty dir — like support-answer) and replies with the raw output for the web to parse. No
+  // project is involved (checklists are org-scoped).
+  CHECKLIST_AUTHOR: "checklist.author",
+  // Org-level "AI Research" (ADR-0380): server (picks an idle cli of the org AI pool) → cli
+  // request–reply. The server forwards the user's question; the worker runs a one-shot research agent
+  // (read-only web/search tools) under a content policy + a research-guard post-check, and replies with
+  // the markdown answer (or a structured refusal) plus the run's token usage so the server meters it to
+  // the org (projectId=null). No project is involved.
+  RESEARCH_ASK: "research.ask",
+  // Org AI Research live progress (ADR-0380): cli → server one-way stream of answer chunks / status for
+  // a running research question, keyed by the query id, relayed to the web over SSE.
+  RESEARCH_PROGRESS: "research.progress",
   // Shared AI memory (ADR-0245): cli → server one-way write-back of the compacted rolling memory for
   // the project it serves (persisted per project × machine-user link). The read direction rides
   // `ws_token` (seeds the cli cache on connect); this channel only carries updates.
@@ -39961,7 +39985,8 @@ function planUnifiedRun(prompt, config, workingCredential, resume, oneShot, over
     key,
     args: buildRunArgs(cred, cmd, resume.get(key), oneShot, override, readOnly, bypass, [...allAiProfileDirs(config), dir2]),
     stdin: prompt,
-    env: envVar ? { ...baseEnv, [envVar]: dir2, ...overrideEnv(cmd, override) } : { ...baseEnv, ...overrideEnv(cmd, override) }
+    env: envVar ? { ...baseEnv, [envVar]: dir2, ...overrideEnv(cmd, override) } : { ...baseEnv, ...overrideEnv(cmd, override) },
+    ...cred.apiKey ? { apiKey: cred.apiKey } : {}
   }));
   return { cmd: attempts[0]?.cmd ?? DEFAULT_AI_CLI, attempts };
 }
@@ -39991,7 +40016,8 @@ function planLegacyRun(prompt, config, workingDir, resume, oneShot, override, re
       key,
       args: buildRunArgs(profile, cmd, resume.get(key), oneShot, override, readOnly, bypass, [...allAiProfileDirs(config), dir2]),
       stdin: prompt,
-      env: { ...baseEnv, [envVar]: dir2, ...overrideEnv(cmd, override) }
+      env: { ...baseEnv, [envVar]: dir2, ...overrideEnv(cmd, override) },
+      ...profile.apiKey ? { apiKey: profile.apiKey } : {}
     };
   });
   return { cmd, attempts };
@@ -40807,6 +40833,16 @@ async function runClaudeWithFailover(prompt, ai2, imageDir, timeoutMs = ANSWER_T
   }
   throw new Error(`claude ${lastReason}`);
 }
+async function runChecklistAuthor(req, ai2) {
+  try {
+    const { text, usage } = await runClaudeWithFailover(req.prompt, ai2);
+    if (!text) return { reply: { error: "empty output" }, usage };
+    return { reply: { output: text }, usage };
+  } catch (err) {
+    logger.warn("checklist.author.failed", { error: String(err) });
+    return { reply: { error: String(err) }, usage: { ...NO_USAGE } };
+  }
+}
 async function runSupportAnswer(req, ai2, profileDir2) {
   let imageDir;
   let question = req.question;
@@ -42211,6 +42247,58 @@ async function runCommand(dispatch, emitRaw, opts) {
   });
 }
 
+// src/core/resolve-api-key.ts
+var cache = /* @__PURE__ */ new Map();
+async function loadAws(pkg) {
+  const spec = pkg;
+  return await import(spec);
+}
+async function fetchSsm(d) {
+  const aws = await loadAws("@aws-sdk/client-ssm");
+  const SSMClient = aws.SSMClient;
+  const GetParameterCommand = aws.GetParameterCommand;
+  const client = new SSMClient(d.region ? { region: d.region } : {});
+  const res = await client.send(new GetParameterCommand({ Name: d.name, WithDecryption: true }));
+  return res.Parameter?.Value?.trim() || null;
+}
+async function fetchSecretsManager(d) {
+  const aws = await loadAws("@aws-sdk/client-secrets-manager");
+  const SecretsManagerClient = aws.SecretsManagerClient;
+  const GetSecretValueCommand = aws.GetSecretValueCommand;
+  const client = new SecretsManagerClient(d.region ? { region: d.region } : {});
+  const res = await client.send(new GetSecretValueCommand({ SecretId: d.secretId }));
+  const raw = (res.SecretString ?? "").trim();
+  if (!raw) return null;
+  if (d.jsonKey) {
+    try {
+      const obj = JSON.parse(raw);
+      const v2 = obj[d.jsonKey];
+      return typeof v2 === "string" && v2.trim() ? v2.trim() : null;
+    } catch {
+      return null;
+    }
+  }
+  return raw;
+}
+async function resolveApiKey(desc) {
+  if (!desc || !desc.source) return null;
+  if (desc.source === "inline") return desc.value?.trim() || null;
+  const cacheKey = JSON.stringify(desc);
+  const hit = cache.get(cacheKey);
+  if (hit) return hit;
+  try {
+    const val = desc.source === "ssm" ? await fetchSsm(desc) : desc.source === "secretsManager" ? await fetchSecretsManager(desc) : null;
+    if (val) {
+      cache.set(cacheKey, val);
+      return val;
+    }
+    return null;
+  } catch (err) {
+    logger.warn("ai.apiKey.resolve.failed", { source: desc.source, error: String(err) });
+    return null;
+  }
+}
+
 // src/core/ai-runner.ts
 var TIMEOUT_EXIT = 124;
 function isAuthFailure(text) {
@@ -42259,7 +42347,9 @@ async function runAiFailover(plan, commandId, cwd2, handlers, timeoutMs = 0, sig
         handlers.onChunk(text);
       }
     };
-    finalExit = await runAttempt(commandId, attempt.cmd, attempt.args, attempt.stdin, cwd2, attempt.env, emit, timeoutMs, signal);
+    const resolvedKey = attempt.apiKey ? await resolveApiKey(attempt.apiKey) : null;
+    const attemptEnv = resolvedKey ? { ...attempt.env, ANTHROPIC_API_KEY: resolvedKey } : attempt.env;
+    finalExit = await runAttempt(commandId, attempt.cmd, attempt.args, attempt.stdin, cwd2, attemptEnv, emit, timeoutMs, signal);
     const tail = parser.flush();
     if (tail) {
       captured += tail;
@@ -42941,10 +43031,10 @@ function activeAiRunCount() {
   return activeRuns.size;
 }
 function cancelActiveRun(commandId) {
-  const run15 = activeRuns.get(commandId);
-  if (!run15) return { ok: false, state: "unknown" };
-  run15.controller.abort();
-  return { ok: true, state: run15.state };
+  const run16 = activeRuns.get(commandId);
+  if (!run16) return { ok: false, state: "unknown" };
+  run16.controller.abort();
+  return { ok: true, state: run16.state };
 }
 function handleCommandChannels(ctx, message, payload) {
   if (message.channel === WsChannels.COMMAND_CANCEL) {
@@ -43042,16 +43132,16 @@ async function runLocalCommand(ctx, input) {
 }
 var REFUSED = { exitCode: 1, cancelled: false, exhausted: false, neverStarted: true, output: "" };
 async function runAiPrompt(ctx, prompt, commandId, origin, oneShot = false, images, aiConfig, readOnly = false, bypass = false) {
-  const run15 = { controller: new AbortController(), state: "queued" };
-  activeRuns.set(commandId, run15);
+  const run16 = { controller: new AbortController(), state: "queued" };
+  activeRuns.set(commandId, run16);
   try {
-    return await runAiPromptInner(ctx, prompt, commandId, origin, run15, oneShot, images, aiConfig, readOnly, bypass);
+    return await runAiPromptInner(ctx, prompt, commandId, origin, run16, oneShot, images, aiConfig, readOnly, bypass);
   } finally {
     activeRuns.delete(commandId);
     if (!readOnly) requestGitSnapshot("ai-run");
   }
 }
-async function runAiPromptInner(ctx, prompt, commandId, origin, run15, oneShot = false, images, aiConfig, readOnly = false, bypass = false) {
+async function runAiPromptInner(ctx, prompt, commandId, origin, run16, oneShot = false, images, aiConfig, readOnly = false, bypass = false) {
   const config = readProfileConfig(ctx.profileDir);
   const projectTimeoutSec = config.projectAiRunTimeoutSec ?? 0;
   const machineTimeoutSec = config.aiRunTimeoutSec ?? 0;
@@ -43234,7 +43324,7 @@ ${guardedPrompt}`;
           queue: { position, limit, running: running2 }
         });
       },
-      run15.controller.signal
+      run16.controller.signal
     );
     if (slot.kind === "timeout") {
       neverStarted = true;
@@ -43255,9 +43345,9 @@ ${guardedPrompt}`;
       result = { exitCode: COMMAND_CANCELLED_EXIT_CODE, workedDir: null, workedKey: null, workedCmd: null, usage: { tokens: 0, input: 0, output: 0, cacheRead: 0, cacheCreation: 0 }, sessionId: "", cancelled: true };
     } else {
       if (slot.queued) ctx.send(WsChannels.COMMAND_OUTPUT, { commandId, seq: seq++, chunk: "", log: true, queue: null });
-      run15.state = "running";
+      run16.state = "running";
       try {
-        result = await runAiFailover(plan, commandId, cwd2, handlers, aiRunTimeoutMs, run15.controller.signal);
+        result = await runAiFailover(plan, commandId, cwd2, handlers, aiRunTimeoutMs, run16.controller.signal);
       } finally {
         slot.handle.release();
       }
@@ -45509,8 +45599,258 @@ function applyGitAuth(ctx, method, host) {
   );
 }
 
-// src/core/knowledge-compose.ts
+// src/core/research-run.ts
 import { spawn as spawn8 } from "child_process";
+import { mkdtempSync as mkdtempSync3, rmSync as rmSync8 } from "fs";
+import { tmpdir as tmpdir5 } from "os";
+import { join as join29 } from "path";
+var RESEARCH_TIMEOUT_MS = 9 * 60 * 1e3;
+var RESEARCH_MAX_TURNS = 16;
+var NO_USAGE2 = { tokens: 0, input: 0, output: 0, cacheRead: 0, cacheCreation: 0 };
+var RESEARCH_ALLOWED_TOOLS = "WebSearch,WebFetch";
+var RESEARCH_DENIED_TOOLS = [
+  "Bash",
+  "Edit",
+  "Write",
+  "Read",
+  "Glob",
+  "Grep",
+  "NotebookEdit",
+  "Task",
+  "SlashCommand",
+  "Skill",
+  "ToolSearch",
+  "TaskCreate",
+  "TaskGet",
+  "TaskList",
+  "TaskOutput",
+  "TaskStop",
+  "TaskUpdate",
+  "Monitor",
+  "DesignSync",
+  "CronCreate",
+  "CronDelete",
+  "CronList",
+  "EnterWorktree",
+  "ExitWorktree",
+  "RemoteTrigger",
+  "ScheduleWakeup",
+  "SendMessage",
+  "PushNotification"
+].join(",");
+function buildResearchPrompt(question) {
+  return [
+    "You are a research assistant for the 4PM platform. Answer the user's question thoroughly and",
+    "accurately, in Markdown. Use the read-only web tools (WebSearch / WebFetch) to find current, factual",
+    "information when helpful, and cite sources inline where relevant.",
+    "",
+    "STRICT CONTENT POLICY \u2014 you MUST refuse, and must not answer, if the question (or a faithful answer",
+    "to it) would involve any of:",
+    "- sexual, abusive, hateful, or illegal content;",
+    "- political persuasion, campaigning, or partisan advocacy;",
+    "- discrimination or demeaning content targeting a race, ethnicity, religion, gender, nationality, or",
+    "  other protected group;",
+    "- probing, scanning, exploiting, or attacking the security of ANY system, network, account, device,",
+    "  or person you do not own (no vulnerability hunting, no exploit/malware creation, no credential or",
+    "  PII harvesting, no evasion of security controls). General defensive-security education is allowed.",
+    "- any other seriously harmful activity.",
+    "",
+    'When you must refuse, reply with EXACTLY one line starting with "REFUSED:" followed by a short,',
+    "neutral reason, and output nothing else.",
+    "",
+    "You have READ-ONLY web tools only. Never attempt to read local files, run shell commands, or interact",
+    "with other systems.",
+    "",
+    "---",
+    "",
+    "Question:",
+    question
+  ].join("\n");
+}
+function runClaudeOnce2(cmd, profile, prompt, extraEnv, onChunk, denyDirs) {
+  return new Promise((resolve13, reject) => {
+    const isClaude = cmd.includes("claude");
+    const args = [
+      "-p",
+      ...profile?.model ? ["--model", profile.model] : [],
+      ...isClaude ? ["--output-format", "stream-json", "--verbose"] : [],
+      // Secret-path deny rules (ADR-0347) — reads are not confined to the working dir.
+      ...denySettingsArgs(cmd, [...denyDirs, profile?.dir]),
+      // Web-only agent: allow WebSearch/WebFetch (auto-approved), deny everything else, bound the loop.
+      // `--permission-mode default` is the non-variadic terminator (so the variadic tool flags consume
+      // only their own comma-token — same trick as the one-shot/read-only runners).
+      ...isClaude ? [
+        `--max-turns=${RESEARCH_MAX_TURNS}`,
+        "--allowedTools",
+        RESEARCH_ALLOWED_TOOLS,
+        "--disallowedTools",
+        RESEARCH_DENIED_TOOLS,
+        "--permission-mode",
+        "default"
+      ] : []
+    ];
+    const env3 = agentEnv(extraEnv, profile ? { CLAUDE_CONFIG_DIR: profile.dir } : void 0);
+    const cwd2 = mkdtempSync3(join29(tmpdir5(), "4pm-research-"));
+    const cleanup = () => {
+      try {
+        rmSync8(cwd2, { recursive: true, force: true });
+      } catch {
+      }
+    };
+    const child = spawn8(cmd, args, { stdio: ["pipe", "pipe", "pipe"], env: env3, cwd: cwd2 });
+    const parser = createAiStreamParser(cmd);
+    let out = "";
+    let err = "";
+    const timer = setTimeout(() => {
+      child.kill("SIGKILL");
+      reject(new Error("research run timed out"));
+    }, RESEARCH_TIMEOUT_MS);
+    timer.unref();
+    child.stdout.on("data", (d) => {
+      const delta = parser.push(d.toString());
+      if (delta) {
+        out += delta;
+        onChunk(delta);
+      }
+    });
+    child.stderr.on("data", (d) => err += d.toString());
+    child.on("error", (e) => {
+      clearTimeout(timer);
+      cleanup();
+      reject(e);
+    });
+    child.on("close", (code) => {
+      clearTimeout(timer);
+      cleanup();
+      const tail = parser.flush();
+      if (tail) {
+        out += tail;
+        onChunk(tail);
+      }
+      resolve13({ code: code ?? -1, out, err, usage: parser.usage() });
+    });
+    child.stdin.write(prompt);
+    child.stdin.end();
+  });
+}
+async function runResearch(question, ai2, onChunk) {
+  const prompt = buildResearchPrompt(question);
+  const denyDirs = ai2.profiles.map((p2) => p2.dir);
+  const attempts = ai2.profiles.length > 0 ? ai2.profiles : [null];
+  let lastReason = "no attempt";
+  for (let i = 0; i < attempts.length; i++) {
+    try {
+      const { code, out, err, usage } = await runClaudeOnce2(ai2.cmd, attempts[i], prompt, ai2.env, onChunk, denyDirs);
+      if (code === 0 && out.trim()) {
+        const u2 = usage.tokens > 0 ? usage : { ...NO_USAGE2, tokens: estimateTokens(out) };
+        return { text: out.trim(), usage: u2 };
+      }
+      lastReason = `exited ${code}: ${(err || out).slice(0, 300)}`;
+    } catch (e) {
+      lastReason = e instanceof Error ? e.message : String(e);
+    }
+  }
+  return { text: "", usage: { ...NO_USAGE2 }, error: lastReason };
+}
+
+// src/core/research-guard.ts
+var REFUSAL_PREFIX = "REFUSED:";
+var ATTACK_INTENT = [
+  /\b(hack|break|breare|breach|compromise|exploit|gain (unauthorized )?access to|take over|take control of|ddos|dos attack)\b[^.?!]{0,60}\b(into|someone|their|his|her|another|the victim'?s|a target|account|server|network|website|wifi|camera|phone|system|database)\b/i,
+  /\b(write|create|build|generate|give me)\b[^.?!]{0,40}\b(malware|ransomware|a virus|a keylogger|a trojan|spyware|a rootkit|a worm|a botnet|an exploit|a phishing (kit|page|email|site))\b/i,
+  /\bbypass\b[^.?!]{0,40}\b(authentication|login|the firewall|a paywall|security|2fa|mfa|licen[sc]e|drm)\b/i,
+  /\b(steal|harvest|exfiltrate|dump|crack)\b[^.?!]{0,40}\b(credentials|passwords|password hashes|credit cards?|personal data|pii|session tokens)\b/i,
+  /\bbrute[- ]?force\b[^.?!]{0,40}\b(login|password|account|credential)/i
+];
+function isModelRefusal(text) {
+  return text.trimStart().toUpperCase().startsWith(REFUSAL_PREFIX);
+}
+function refusalReasonOf(text) {
+  const after = text.trim().slice(REFUSAL_PREFIX.length).trim();
+  return (after || "This question is outside what Research can answer.").slice(0, 300);
+}
+function screenQuestion(question) {
+  if (ATTACK_INTENT.some((re2) => re2.test(question))) {
+    return { blocked: true, reason: "The question asks to attack or compromise a system, which Research does not do." };
+  }
+  return { blocked: false };
+}
+function screenAnswer(answer) {
+  if (isModelRefusal(answer)) return { blocked: true, reason: refusalReasonOf(answer) };
+  if (ATTACK_INTENT.some((re2) => re2.test(answer))) {
+    return { blocked: true, reason: "The answer was withheld by the content policy." };
+  }
+  return { blocked: false };
+}
+
+// src/core/ws-client/handlers/research.ts
+function handleResearchChannels(ctx, message, payload) {
+  if (message.channel !== WsChannels.RESEARCH_ASK) return false;
+  const req = payload;
+  const config = readProfileConfig(ctx.profileDir);
+  const cmd = config.aiCli || "claude";
+  ctx.bus.push({ source: "server", kind: "aireq", text: `${cmd} \u2039 research` });
+  ctx.bus.startBusy("research");
+  void run14(ctx, message, req, config, cmd).finally(() => ctx.bus.endBusy("research"));
+  return true;
+}
+async function run14(ctx, message, req, config, cmd) {
+  const emit = (p2) => ctx.send(WsChannels.RESEARCH_PROGRESS, { queryId: req.queryId, ...p2 });
+  const reply = (r) => ctx.send(WsChannels.RESEARCH_ASK, r, message.id);
+  const pre = screenQuestion(req.question);
+  if (pre.blocked) {
+    reply({ refused: true, refusalReason: pre.reason });
+    return;
+  }
+  const slot = await acquireRunSlot(ctx, (info) => emit({ message: `queued #${info.position}` }));
+  if (slot.kind !== "granted") {
+    reply({ error: slot.kind === "denied" ? "storage full" : "no idle run slot" });
+    return;
+  }
+  try {
+    const ai2 = {
+      cmd,
+      profiles: resolveClaudeProfiles(config, getWorkingProfile(ctx.profileDir, cmd)),
+      env: config.aiEnv
+    };
+    const result = await runResearch(req.question, ai2, (delta) => emit({ chunk: delta }));
+    const occurredAt = (/* @__PURE__ */ new Date()).toISOString();
+    const events = [{ metric: UsageMetric.COMMANDS, amount: 1, occurredAt }];
+    if (result.usage.tokens > 0) {
+      events.push({
+        metric: UsageMetric.AI_TOKENS,
+        amount: result.usage.tokens,
+        occurredAt,
+        inputTokens: result.usage.input,
+        outputTokens: result.usage.output,
+        cacheReadTokens: result.usage.cacheRead,
+        cacheCreationTokens: result.usage.cacheCreation,
+        provider: aiProviderOf(cmd),
+        authMode: resolveClaudeAuthMode(config)
+      });
+    }
+    ctx.reportUsage(events, null);
+    if (result.error || !result.text) {
+      ctx.bus.push({ source: "server", kind: "log", text: `research failed: ${result.error ?? "empty"}`, level: "warn" });
+      reply({ error: result.error || "empty answer", tokens: result.usage.tokens });
+      return;
+    }
+    const post2 = screenAnswer(result.text);
+    if (post2.blocked) {
+      reply({ refused: true, refusalReason: post2.reason, tokens: result.usage.tokens });
+      return;
+    }
+    ctx.bus.push({ source: "server", kind: "aires", text: `${cmd} \u203A` });
+    reply({ answer: result.text, tokens: result.usage.tokens });
+  } catch (err) {
+    reply({ error: err instanceof Error ? err.message : String(err) });
+  } finally {
+    slot.handle.release();
+  }
+}
+
+// src/core/knowledge-compose.ts
+import { spawn as spawn9 } from "child_process";
 var COMPOSE_TIMEOUT_MS = 18e4;
 function buildPrompt3(req) {
   const focus = req.prompt ? `
@@ -45536,7 +45876,7 @@ function runOnce2(cmd, profile, prompt, cwd2, extraEnv, denyDirs = []) {
       ...extraEnv,
       ...profile ? { CLAUDE_CONFIG_DIR: profile.dir } : {}
     };
-    const child = spawn8(cmd, args, { stdio: ["pipe", "pipe", "pipe"], cwd: cwd2, env: env3 });
+    const child = spawn9(cmd, args, { stdio: ["pipe", "pipe", "pipe"], cwd: cwd2, env: env3 });
     let out = "";
     let err = "";
     const timer = setTimeout(() => {
@@ -45582,14 +45922,14 @@ async function runKnowledgeCompose(req, ai2, physicRoot) {
 }
 
 // src/core/faq-compose.ts
-import { spawn as spawn9, execFile as execFile14 } from "child_process";
-import { existsSync as existsSync16, mkdirSync as mkdirSync8, rmSync as rmSync8 } from "fs";
+import { spawn as spawn10, execFile as execFile14 } from "child_process";
+import { existsSync as existsSync16, mkdirSync as mkdirSync8, rmSync as rmSync9 } from "fs";
 import { randomUUID as randomUUID3 } from "crypto";
-import { join as join29 } from "path";
-import { tmpdir as tmpdir5 } from "os";
+import { join as join30 } from "path";
+import { tmpdir as tmpdir6 } from "os";
 import { promisify as promisify14 } from "util";
 var execFileAsync2 = promisify14(execFile14);
-var NO_USAGE2 = { tokens: 0, input: 0, output: 0, cacheRead: 0, cacheCreation: 0 };
+var NO_USAGE3 = { tokens: 0, input: 0, output: 0, cacheRead: 0, cacheCreation: 0 };
 var COMPOSE_TIMEOUT_MS2 = 10 * 60 * 1e3;
 var AGENT_DENIED_TOOLS = ["Bash", "WebFetch", "WebSearch", "NotebookEdit", "Task"];
 function buildPrompt4(tickets, customPrompt) {
@@ -45652,7 +45992,7 @@ function parsePerTicket(text) {
   }
   return [];
 }
-function runClaudeOnce2(cmd, profile, prompt, cwd2, extraEnv, denyDirs = []) {
+function runClaudeOnce3(cmd, profile, prompt, cwd2, extraEnv, denyDirs = []) {
   return new Promise((resolve13, reject) => {
     const isClaude = cmd.includes("claude");
     const args = [
@@ -45668,7 +46008,7 @@ function runClaudeOnce2(cmd, profile, prompt, cwd2, extraEnv, denyDirs = []) {
       ...cmd.includes("codex") ? ["--sandbox", "workspace-write"] : []
     ];
     const env3 = agentEnv(extraEnv, profile ? { CLAUDE_CONFIG_DIR: profile.dir } : void 0);
-    const child = spawn9(cmd, args, { stdio: ["pipe", "pipe", "pipe"], cwd: cwd2, env: env3 });
+    const child = spawn10(cmd, args, { stdio: ["pipe", "pipe", "pipe"], cwd: cwd2, env: env3 });
     const parser = createAiStreamParser(cmd);
     let out = "";
     let err = "";
@@ -45696,7 +46036,7 @@ async function runClaudeWithFailover2(prompt, cwd2, ai2) {
   const attempts = ai2.profiles.length > 0 ? ai2.profiles : [null];
   let lastReason = "no attempt";
   for (let i = 0; i < attempts.length; i++) {
-    const { code, out, err, usage } = await runClaudeOnce2(ai2.cmd, attempts[i], prompt, cwd2, ai2.env, ai2.profiles.map((p2) => p2.dir));
+    const { code, out, err, usage } = await runClaudeOnce3(ai2.cmd, attempts[i], prompt, cwd2, ai2.env, ai2.profiles.map((p2) => p2.dir));
     if (code === 0) return { usage, text: out.trim() };
     lastReason = `exited ${code}: ${(err || out).slice(0, 500)}`;
     if (i === attempts.length - 1) break;
@@ -45706,7 +46046,7 @@ async function runClaudeWithFailover2(prompt, cwd2, ai2) {
 var MAX_OUTPUT_CHARS = 8e3;
 async function runFaqCompose(req, ai2) {
   if (!req.repo.token) return { prUrl: "", error: "no write token" };
-  const workDir = join29(tmpdir5(), "4pm-faq-sync", randomUUID3());
+  const workDir = join30(tmpdir6(), "4pm-faq-sync", randomUUID3());
   const gitEnv = { ...process.env, GIT_TERMINAL_PROMPT: "0" };
   const auth = gitAuthArgs("x-access-token", req.repo.token);
   try {
@@ -45736,7 +46076,7 @@ async function runFaqCompose(req, ai2) {
     } catch (err) {
       logger.warn("faq.compose.pr.failed", { error: String(err) });
     }
-    const u2 = usage.tokens > 0 ? usage : { ...NO_USAGE2 };
+    const u2 = usage.tokens > 0 ? usage : { ...NO_USAGE3 };
     return {
       prUrl,
       branch: req.headBranch,
@@ -45752,7 +46092,7 @@ async function runFaqCompose(req, ai2) {
   } finally {
     if (existsSync16(workDir)) {
       try {
-        rmSync8(workDir, { recursive: true, force: true });
+        rmSync9(workDir, { recursive: true, force: true });
       } catch {
       }
     }
@@ -45837,6 +46177,58 @@ function handleSupportChannels(ctx, message, payload) {
       }).finally(() => ctx.bus.endBusy("faq-compose"));
       return true;
     }
+    case WsChannels.CHECKLIST_AUTHOR: {
+      const creq = payload;
+      const ccfg = readProfileConfig(ctx.profileDir);
+      const ccmd = ccfg.aiCli || "claude";
+      const cai = {
+        cmd: ccmd,
+        profiles: resolveClaudeProfiles(ccfg, getWorkingProfile(ctx.profileDir, ccmd)),
+        env: ccfg.aiEnv
+      };
+      ctx.bus.push({ source: "server", kind: "aireq", text: `${ccmd} \u2039 author checklist items` });
+      ctx.bus.startBusy("checklist-author");
+      void (async () => {
+        const slot = await acquireRunSlot(ctx, () => void 0);
+        if (slot.kind !== "granted") {
+          ctx.send(
+            WsChannels.CHECKLIST_AUTHOR,
+            { error: slot.kind === "denied" ? "storage full" : "no idle run slot" },
+            message.id
+          );
+          return;
+        }
+        try {
+          const { reply, usage } = await runChecklistAuthor(creq, cai);
+          const occurredAt = (/* @__PURE__ */ new Date()).toISOString();
+          const events = [{ metric: UsageMetric.COMMANDS, amount: 1, occurredAt }];
+          if (usage.tokens > 0) {
+            events.push({
+              metric: UsageMetric.AI_TOKENS,
+              amount: usage.tokens,
+              occurredAt,
+              inputTokens: usage.input,
+              outputTokens: usage.output,
+              cacheReadTokens: usage.cacheRead,
+              cacheCreationTokens: usage.cacheCreation,
+              provider: aiProviderOf(ccmd),
+              authMode: resolveClaudeAuthMode(ccfg)
+            });
+          }
+          ctx.reportUsage(events, null);
+          if (reply.error) {
+            ctx.bus.push({ source: "server", kind: "log", text: `checklist-author failed: ${reply.error}`, level: "warn" });
+          } else {
+            ctx.bus.push({ source: "server", kind: "aires", text: `${ccmd} \u203A` });
+          }
+          reportToolResult(ccmd, !reply.error, reply.error);
+          ctx.send(WsChannels.CHECKLIST_AUTHOR, reply, message.id);
+        } finally {
+          slot.handle.release();
+        }
+      })().finally(() => ctx.bus.endBusy("checklist-author"));
+      return true;
+    }
     default:
       return false;
   }
@@ -45935,7 +46327,7 @@ function handleToolsChannels(ctx, message, payload) {
 
 // src/core/agents.ts
 import { readFile as readFile14, writeFile as writeFile10, mkdir as mkdir8, readdir as readdir6, rm as rm7 } from "fs/promises";
-import { join as join30 } from "path";
+import { join as join31 } from "path";
 var AGENTS_REL = ".claude/agents";
 var SKILLS_REL = ".claude/skills";
 var MEMORY_DIRS = /* @__PURE__ */ new Set(["short-memory", "long-memory"]);
@@ -45959,17 +46351,17 @@ async function listAgents(root) {
   const subagents = [];
   const skills = [];
   try {
-    for (const e of await readdir6(join30(root, AGENTS_REL), { withFileTypes: true })) {
+    for (const e of await readdir6(join31(root, AGENTS_REL), { withFileTypes: true })) {
       if (!e.isFile() || !e.name.endsWith(".md") || MEMORY_DIRS.has(e.name)) continue;
-      const fm = frontmatter(await readText2(join30(root, AGENTS_REL, e.name)));
+      const fm = frontmatter(await readText2(join31(root, AGENTS_REL, e.name)));
       subagents.push({ name: e.name.replace(/\.md$/, ""), description: fm.description });
     }
   } catch {
   }
   try {
-    for (const e of await readdir6(join30(root, SKILLS_REL), { withFileTypes: true })) {
+    for (const e of await readdir6(join31(root, SKILLS_REL), { withFileTypes: true })) {
       if (!e.isDirectory()) continue;
-      const fm = frontmatter(await readText2(join30(root, SKILLS_REL, e.name, "SKILL.md")));
+      const fm = frontmatter(await readText2(join31(root, SKILLS_REL, e.name, "SKILL.md")));
       skills.push({ name: e.name, description: fm.description });
     }
   } catch {
@@ -45980,15 +46372,15 @@ async function listAgents(root) {
 }
 function itemPath(root, kind, name) {
   const n = safeName(name);
-  return kind === "subagent" ? join30(root, AGENTS_REL, `${n}.md`) : join30(root, SKILLS_REL, n, "SKILL.md");
+  return kind === "subagent" ? join31(root, AGENTS_REL, `${n}.md`) : join31(root, SKILLS_REL, n, "SKILL.md");
 }
 async function readAgent(root, kind, name) {
   const content = await readText2(itemPath(root, kind, name));
   if (kind !== "subagent") return { content };
   const n = safeName(name);
   const [short, long] = await Promise.all([
-    readText2(join30(root, AGENTS_REL, "short-memory", `${n}.md`)),
-    readText2(join30(root, AGENTS_REL, "long-memory", `${n}.md`))
+    readText2(join31(root, AGENTS_REL, "short-memory", `${n}.md`)),
+    readText2(join31(root, AGENTS_REL, "long-memory", `${n}.md`))
   ]);
   return { content, memory: { short, long } };
 }
@@ -45998,12 +46390,12 @@ async function writeAgent(root, req) {
   try {
     if (req.action === "delete") {
       if (req.kind === "subagent") await rm7(itemPath(root, "subagent", n), { force: true });
-      else await rm7(join30(root, SKILLS_REL, n), { recursive: true, force: true });
+      else await rm7(join31(root, SKILLS_REL, n), { recursive: true, force: true });
       return { ok: true };
     }
     if (req.content === void 0) return { ok: false, error: "content is required" };
     const path = itemPath(root, req.kind, n);
-    await mkdir8(join30(path, ".."), { recursive: true });
+    await mkdir8(join31(path, ".."), { recursive: true });
     await writeFile10(path, req.content, "utf8");
     return { ok: true };
   } catch (err) {
@@ -46013,7 +46405,7 @@ async function writeAgent(root, req) {
 
 // src/core/secrets.ts
 import { readFile as readFile15, writeFile as writeFile11 } from "fs/promises";
-import { join as join31 } from "path";
+import { join as join32 } from "path";
 var SECURITY_REL = "AI_SECURITY.md";
 var PLACEHOLDER_REL = "AI_PLACEHOLDER.md";
 var SECRETS_REL = "project.secrets.json";
@@ -46026,7 +46418,7 @@ async function readText3(path, fallback = "") {
 }
 async function readSecretsObject(root) {
   try {
-    const v2 = JSON.parse(await readFile15(join31(root, SECRETS_REL), "utf8"));
+    const v2 = JSON.parse(await readFile15(join32(root, SECRETS_REL), "utf8"));
     return v2 && typeof v2 === "object" ? v2 : {};
   } catch {
     return {};
@@ -46045,8 +46437,8 @@ function placeholderKeys(text) {
 }
 async function readSecrets(root) {
   const [security, placeholder, secrets] = await Promise.all([
-    readText3(join31(root, SECURITY_REL)),
-    readText3(join31(root, PLACEHOLDER_REL)),
+    readText3(join32(root, SECURITY_REL)),
+    readText3(join32(root, PLACEHOLDER_REL)),
     readSecretsObject(root)
   ]);
   const names = /* @__PURE__ */ new Set([...placeholderKeys(placeholder), ...Object.keys(secrets)]);
@@ -46059,14 +46451,14 @@ async function readSecrets(root) {
 async function writeSecrets(root, req) {
   try {
     if (req.kind === "security") {
-      await writeFile11(join31(root, SECURITY_REL), req.content, "utf8");
+      await writeFile11(join32(root, SECURITY_REL), req.content, "utf8");
     } else if (req.kind === "placeholder") {
-      await writeFile11(join31(root, PLACEHOLDER_REL), req.content, "utf8");
+      await writeFile11(join32(root, PLACEHOLDER_REL), req.content, "utf8");
     } else {
       const secrets = await readSecretsObject(root);
       if (req.kind === "secret") secrets[req.key] = req.value;
       else delete secrets[req.key];
-      await writeFile11(join31(root, SECRETS_REL), JSON.stringify(secrets, null, 2) + "\n", "utf8");
+      await writeFile11(join32(root, SECRETS_REL), JSON.stringify(secrets, null, 2) + "\n", "utf8");
     }
     return { ok: true };
   } catch (err) {
@@ -46076,12 +46468,12 @@ async function writeSecrets(root, req) {
 
 // src/core/agent-tools.ts
 import { readFile as readFile16, writeFile as writeFile12, mkdir as mkdir9 } from "fs/promises";
-import { dirname as dirname9, join as join32 } from "path";
+import { dirname as dirname9, join as join33 } from "path";
 var SHARED_REL = ".claude/settings.json";
 var LOCAL_REL = ".claude/settings.local.json";
 var SECRETS_DENY = "Read(./project.secrets.json)";
 function fileFor(root, scope) {
-  return join32(root, scope === "shared" ? SHARED_REL : LOCAL_REL);
+  return join33(root, scope === "shared" ? SHARED_REL : LOCAL_REL);
 }
 async function readSettingsObject(path) {
   try {
@@ -46118,7 +46510,7 @@ async function writeAgentTools(root, scope, permissions) {
 // src/core/packages.ts
 import { createHash as createHash4 } from "crypto";
 import { readFile as readFile17, writeFile as writeFile13, mkdir as mkdir10, readdir as readdir7, rm as rm8, stat as stat5 } from "fs/promises";
-import { dirname as dirname10, join as join33, relative } from "path";
+import { dirname as dirname10, join as join34, relative } from "path";
 var AGENTS_REL2 = ".claude/agents";
 var SKILLS_REL2 = ".claude/skills";
 var MANIFEST_REL = ".claude/.4pm-packages.json";
@@ -46142,7 +46534,7 @@ async function listFilesRel(dir2) {
       return;
     }
     for (const e of entries2) {
-      const full = join33(d, e.name);
+      const full = join34(d, e.name);
       if (e.isDirectory()) await walk2(full);
       else if (e.isFile()) out.push(relative(dir2, full));
     }
@@ -46153,16 +46545,16 @@ async function listFilesRel(dir2) {
 async function readArtifactFiles(root, kind, slug) {
   const files = [];
   if (kind === "subagent") {
-    const agent = await readMaybe(join33(root, AGENTS_REL2, `${slug}.md`));
+    const agent = await readMaybe(join34(root, AGENTS_REL2, `${slug}.md`));
     if (agent) files.push({ path: "agent.md", contentBase64: agent.toString("base64") });
-    const short = await readMaybe(join33(root, AGENTS_REL2, "short-memory", `${slug}.md`));
+    const short = await readMaybe(join34(root, AGENTS_REL2, "short-memory", `${slug}.md`));
     if (short) files.push({ path: "short-memory.md", contentBase64: short.toString("base64") });
-    const long = await readMaybe(join33(root, AGENTS_REL2, "long-memory", `${slug}.md`));
+    const long = await readMaybe(join34(root, AGENTS_REL2, "long-memory", `${slug}.md`));
     if (long) files.push({ path: "long-memory.md", contentBase64: long.toString("base64") });
   } else {
-    const base = join33(root, SKILLS_REL2, slug);
+    const base = join34(root, SKILLS_REL2, slug);
     for (const rel of await listFilesRel(base)) {
-      const buf = await readMaybe(join33(base, rel));
+      const buf = await readMaybe(join34(base, rel));
       if (buf) files.push({ path: rel.split("\\").join("/"), contentBase64: buf.toString("base64") });
     }
   }
@@ -46180,7 +46572,7 @@ async function artifactSha256(root, kind, slug) {
   return h.digest("hex");
 }
 async function artifactExists(root, kind, slug) {
-  const target = kind === "subagent" ? join33(root, AGENTS_REL2, `${slug}.md`) : join33(root, SKILLS_REL2, slug);
+  const target = kind === "subagent" ? join34(root, AGENTS_REL2, `${slug}.md`) : join34(root, SKILLS_REL2, slug);
   try {
     await stat5(target);
     return true;
@@ -46189,7 +46581,7 @@ async function artifactExists(root, kind, slug) {
   }
 }
 async function readManifest(root) {
-  const buf = await readMaybe(join33(root, MANIFEST_REL));
+  const buf = await readMaybe(join34(root, MANIFEST_REL));
   if (!buf) return {};
   try {
     return JSON.parse(buf.toString("utf8"));
@@ -46198,7 +46590,7 @@ async function readManifest(root) {
   }
 }
 async function writeManifest(root, manifest) {
-  const path = join33(root, MANIFEST_REL);
+  const path = join34(root, MANIFEST_REL);
   await mkdir10(dirname10(path), { recursive: true });
   await writeFile13(path, JSON.stringify(manifest, null, 2), "utf8");
 }
@@ -46207,24 +46599,24 @@ async function writeArtifactFiles(root, kind, slug, files) {
   if (kind === "subagent") {
     const agent = byPath.get("agent.md");
     if (agent) {
-      await mkdir10(join33(root, AGENTS_REL2), { recursive: true });
-      await writeFile13(join33(root, AGENTS_REL2, `${slug}.md`), agent);
+      await mkdir10(join34(root, AGENTS_REL2), { recursive: true });
+      await writeFile13(join34(root, AGENTS_REL2, `${slug}.md`), agent);
     }
     const short = byPath.get("short-memory.md");
     if (short) {
-      await mkdir10(join33(root, AGENTS_REL2, "short-memory"), { recursive: true });
-      await writeFile13(join33(root, AGENTS_REL2, "short-memory", `${slug}.md`), short);
+      await mkdir10(join34(root, AGENTS_REL2, "short-memory"), { recursive: true });
+      await writeFile13(join34(root, AGENTS_REL2, "short-memory", `${slug}.md`), short);
     }
     const long = byPath.get("long-memory.md");
     if (long) {
-      await mkdir10(join33(root, AGENTS_REL2, "long-memory"), { recursive: true });
-      await writeFile13(join33(root, AGENTS_REL2, "long-memory", `${slug}.md`), long);
+      await mkdir10(join34(root, AGENTS_REL2, "long-memory"), { recursive: true });
+      await writeFile13(join34(root, AGENTS_REL2, "long-memory", `${slug}.md`), long);
     }
   } else {
-    const base = join33(root, SKILLS_REL2, slug);
+    const base = join34(root, SKILLS_REL2, slug);
     for (const [rel, buf] of byPath) {
       if (rel.includes("..") || rel.startsWith("/")) continue;
-      const dest = join33(base, rel);
+      const dest = join34(base, rel);
       await mkdir10(dirname10(dest), { recursive: true });
       await writeFile13(dest, buf);
     }
@@ -46290,11 +46682,11 @@ async function removePackage(root, slug) {
     const entry = manifest[n];
     if (!entry) return { ok: false, error: "not installed" };
     if (entry.kind === "subagent") {
-      await rm8(join33(root, AGENTS_REL2, `${n}.md`), { force: true });
-      await rm8(join33(root, AGENTS_REL2, "short-memory", `${n}.md`), { force: true });
-      await rm8(join33(root, AGENTS_REL2, "long-memory", `${n}.md`), { force: true });
+      await rm8(join34(root, AGENTS_REL2, `${n}.md`), { force: true });
+      await rm8(join34(root, AGENTS_REL2, "short-memory", `${n}.md`), { force: true });
+      await rm8(join34(root, AGENTS_REL2, "long-memory", `${n}.md`), { force: true });
     } else {
-      await rm8(join33(root, SKILLS_REL2, n), { recursive: true, force: true });
+      await rm8(join34(root, SKILLS_REL2, n), { recursive: true, force: true });
     }
     delete manifest[n];
     await writeManifest(root, manifest);
@@ -46306,7 +46698,7 @@ async function removePackage(root, slug) {
 
 // src/core/graph.ts
 import { readFile as readFile18, readdir as readdir8 } from "fs/promises";
-import { join as join34, relative as relative2, dirname as dirname11, resolve as resolve12, extname as extname2, basename as basename6 } from "path";
+import { join as join35, relative as relative2, dirname as dirname11, resolve as resolve12, extname as extname2, basename as basename6 } from "path";
 var MAX_FILES = 2e3;
 var MAX_NODES = 3e3;
 var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", "build", ".next", "out", "coverage", ".turbo"]);
@@ -46326,7 +46718,7 @@ async function walk(root, accept) {
       if (e.name.startsWith(".") && e.name !== ".claude") {
         if (e.isDirectory()) continue;
       }
-      const full = join34(dir2, e.name);
+      const full = join35(dir2, e.name);
       if (e.isDirectory()) {
         if (!SKIP_DIRS.has(e.name)) stack.push(full);
       } else if (accept(full)) {
@@ -46447,15 +46839,15 @@ async function buildGraph(root, mode) {
 // src/core/rag.ts
 import { readFile as readFile19, writeFile as writeFile14, statfs as statfs2, mkdir as mkdir11 } from "fs/promises";
 import { existsSync as existsSync17 } from "fs";
-import { execFile as execFile15, spawn as spawn10 } from "child_process";
+import { execFile as execFile15, spawn as spawn11 } from "child_process";
 import { totalmem as totalmem2, cpus as cpus2 } from "os";
-import { join as join35 } from "path";
+import { join as join36 } from "path";
 import { promisify as promisify15 } from "util";
-var run14 = promisify15(execFile15);
+var run15 = promisify15(execFile15);
 var RAG_REL = ".claude/rag";
 async function tryRun(cmd, args) {
   try {
-    const { stdout } = await run14(cmd, args, { timeout: 8e3 });
+    const { stdout } = await run15(cmd, args, { timeout: 8e3 });
     return { ok: true, out: stdout.trim() };
   } catch {
     return { ok: false, out: "" };
@@ -46470,7 +46862,7 @@ async function detectPython() {
 }
 async function installLog(root) {
   try {
-    const text = await readFile19(join35(root, RAG_REL, "install.log"), "utf8");
+    const text = await readFile19(join36(root, RAG_REL, "install.log"), "utf8");
     return text.split("\n").filter((l) => l.length > 0).slice(-200);
   } catch {
     return [];
@@ -46532,14 +46924,14 @@ async function ragStatus(root) {
   };
   let modelName = "";
   try {
-    modelName = (await readFile19(join35(root, RAG_REL, ".installed"), "utf8")).trim();
+    modelName = (await readFile19(join36(root, RAG_REL, ".installed"), "utf8")).trim();
   } catch {
     modelName = "";
   }
   const modelPresent = modelName.length > 0;
   return {
     installed: fastembed && sqliteVec && modelPresent,
-    installing: existsSync17(join35(root, RAG_REL, ".installing")),
+    installing: existsSync17(join36(root, RAG_REL, ".installing")),
     python: { found: py.found, version: py.version },
     deps: { pip, fastembed, sqliteVec },
     model: { present: modelPresent, name: modelName },
@@ -46550,9 +46942,9 @@ async function ragStatus(root) {
   };
 }
 async function readIndexMeta(root) {
-  const indexing = existsSync17(join35(root, RAG_REL, ".indexing"));
+  const indexing = existsSync17(join36(root, RAG_REL, ".indexing"));
   try {
-    const m2 = JSON.parse(await readFile19(join35(root, RAG_REL, ".index.json"), "utf8"));
+    const m2 = JSON.parse(await readFile19(join36(root, RAG_REL, ".index.json"), "utf8"));
     return {
       present: true,
       indexing,
@@ -46619,14 +47011,14 @@ if __name__ == "__main__":
     elif cmd == "query": query(sys.argv[2], int(sys.argv[3]) if len(sys.argv) > 3 else 8)
 `;
 async function ensureEngine(root) {
-  await mkdir11(join35(root, RAG_REL), { recursive: true }).catch(() => void 0);
-  await writeFile14(join35(root, RAG_REL, "rag_engine.py"), RAG_ENGINE_PY, "utf8");
+  await mkdir11(join36(root, RAG_REL), { recursive: true }).catch(() => void 0);
+  await writeFile14(join36(root, RAG_REL, "rag_engine.py"), RAG_ENGINE_PY, "utf8");
 }
 async function ragReindex(root) {
   const py = await detectPython();
   if (!py.found) return { ok: false, started: false, error: "python3 not found" };
-  if (!existsSync17(join35(root, RAG_REL, ".installed"))) return { ok: false, started: false, error: "RAG is not installed" };
-  if (existsSync17(join35(root, RAG_REL, ".indexing"))) return { ok: true, started: true };
+  if (!existsSync17(join36(root, RAG_REL, ".installed"))) return { ok: false, started: false, error: "RAG is not installed" };
+  if (existsSync17(join36(root, RAG_REL, ".indexing"))) return { ok: true, started: true };
   await ensureEngine(root);
   const script = `
 set +e
@@ -46634,7 +47026,7 @@ touch "${RAG_REL}/.indexing"
 { echo "[reindex] $(date)"; "$RAG_PY" "${RAG_REL}/rag_engine.py" reindex 2>&1; } >> "${RAG_REL}/index.log" 2>&1
 rm -f "${RAG_REL}/.indexing"
 `;
-  const child = spawn10("bash", ["-c", script], {
+  const child = spawn11("bash", ["-c", script], {
     cwd: root,
     env: { ...process.env, RAG_PY: py.bin },
     detached: true,
@@ -46646,12 +47038,12 @@ rm -f "${RAG_REL}/.indexing"
 async function ragQuery(root, queryText, k2 = 8) {
   const py = await detectPython();
   if (!py.found) return { results: [], error: "python3 not found" };
-  if (!existsSync17(join35(root, RAG_REL, "index.db"))) return { results: [], error: "no index \u2014 reindex first" };
+  if (!existsSync17(join36(root, RAG_REL, "index.db"))) return { results: [], error: "no index \u2014 reindex first" };
   await ensureEngine(root);
   try {
-    const { stdout } = await run14(
+    const { stdout } = await run15(
       py.bin,
-      [join35(RAG_REL, "rag_engine.py"), "query", queryText, String(Math.min(Math.max(k2, 1), 20))],
+      [join36(RAG_REL, "rag_engine.py"), "query", queryText, String(Math.min(Math.max(k2, 1), 20))],
       { cwd: root, timeout: 3e4, maxBuffer: 4 * 1024 * 1024 }
     );
     const parsed = JSON.parse(stdout.trim() || '{"results":[]}');
@@ -46666,9 +47058,9 @@ async function ragInstall(root, model) {
   }
   const py = await detectPython();
   if (!py.found) return { ok: false, started: false, error: "python3 not found on the worker" };
-  if (existsSync17(join35(root, RAG_REL, ".installing"))) return { ok: true, started: true };
+  if (existsSync17(join36(root, RAG_REL, ".installing"))) return { ok: true, started: true };
   try {
-    await mkdir11(join35(root, RAG_REL), { recursive: true });
+    await mkdir11(join36(root, RAG_REL), { recursive: true });
   } catch {
   }
   const script = `
@@ -46684,7 +47076,7 @@ rm -f "${RAG_REL}/.installed"
 } >> "${RAG_REL}/install.log" 2>&1
 rm -f "${RAG_REL}/.installing"
 `;
-  const child = spawn10("bash", ["-c", script], {
+  const child = spawn11("bash", ["-c", script], {
     cwd: root,
     env: { ...process.env, RAG_PY: py.bin, RAG_MODEL: model },
     detached: true,
@@ -46696,7 +47088,7 @@ rm -f "${RAG_REL}/.installing"
 
 // src/core/config-sync.ts
 import { existsSync as existsSync18, readFileSync as readFileSync16 } from "fs";
-import { join as join36 } from "path";
+import { join as join37 } from "path";
 var SERVER_MANAGED_KEYS = [
   "physicPath",
   "sessionSwitchPct",
@@ -46713,7 +47105,7 @@ var SERVER_MANAGED_KEYS = [
   "projectAiMemoryBudgetChars"
 ];
 function readConfigText(profileDir2) {
-  const path = join36(profileDir2, "config.json");
+  const path = join37(profileDir2, "config.json");
   if (existsSync18(path)) {
     try {
       return readFileSync16(path, "utf8");
@@ -47504,6 +47896,7 @@ var WsClient = class {
     if (handleToolsChannels(this.hctx, message, payload)) return;
     if (handleGitChannels(this.hctx, message, payload)) return;
     if (handleSupportChannels(this.hctx, message, payload)) return;
+    if (handleResearchChannels(this.hctx, message, payload)) return;
     if (handleMiscChannels(this.hctx, message, payload)) return;
     this.bus.log(t("error.unsupportedChannel", { channel: message.channel }), "warn");
   }
@@ -47622,7 +48015,7 @@ var WsClient = class {
    */
   physicFolderPath(projectName) {
     const safe = projectName.replace(/[/\\]/g, "_").replace(/\.\./g, "_").trim();
-    return safe ? join37(this.context.profileDir, safe) : null;
+    return safe ? join38(this.context.profileDir, safe) : null;
   }
   /**
    * Report machine.status: version + the state of the physic project being served
@@ -47734,7 +48127,7 @@ var WsClient = class {
    */
   uploadLog() {
     try {
-      const upload = readLogUpload(join37(this.context.profileDir, "logs"));
+      const upload = readLogUpload(join38(this.context.profileDir, "logs"));
       if (!upload) return;
       const sig = `${upload.fileName}:${upload.totalBytes}`;
       if (sig === this.lastLogSig) return;
@@ -47896,10 +48289,10 @@ var WsClient = class {
 };
 
 // src/core/instance-lock.ts
-import { readFileSync as readFileSync17, rmSync as rmSync9, writeFileSync as writeFileSync9 } from "fs";
-import { join as join38 } from "path";
+import { readFileSync as readFileSync17, rmSync as rmSync10, writeFileSync as writeFileSync9 } from "fs";
+import { join as join39 } from "path";
 function lockPath(profileDir2) {
-  return join38(profileDir2, "start.lock");
+  return join39(profileDir2, "start.lock");
 }
 function isAlive(pid) {
   try {
@@ -47925,7 +48318,7 @@ function acquireInstanceLock(profileDir2) {
 function releaseInstanceLock(profileDir2) {
   try {
     const pid = Number.parseInt(readFileSync17(lockPath(profileDir2), "utf8").trim(), 10);
-    if (pid === process.pid) rmSync9(lockPath(profileDir2), { force: true });
+    if (pid === process.pid) rmSync10(lockPath(profileDir2), { force: true });
   } catch {
   }
 }
@@ -48220,8 +48613,8 @@ var SessionBus = class {
 
 // src/core/control-server.ts
 import { createServer } from "net";
-import { chmodSync as chmodSync5, rmSync as rmSync10 } from "fs";
-import { join as join40 } from "path";
+import { chmodSync as chmodSync5, rmSync as rmSync11 } from "fs";
+import { join as join41 } from "path";
 
 // src/core/control-protocol.ts
 var CONTROL_SOCKET_FILE = "control.sock";
@@ -48252,9 +48645,9 @@ function createFrameParser() {
 // src/core/control-token.ts
 import { chmodSync as chmodSync4, readFileSync as readFileSync18, writeFileSync as writeFileSync10 } from "fs";
 import { randomBytes as randomBytes3, timingSafeEqual } from "crypto";
-import { join as join39 } from "path";
+import { join as join40 } from "path";
 function controlTokenPath(profileDir2) {
-  return join39(profileDir2, CONTROL_TOKEN_FILE);
+  return join40(profileDir2, CONTROL_TOKEN_FILE);
 }
 function writeControlToken(profileDir2) {
   const token = randomBytes3(32).toString("hex");
@@ -48283,9 +48676,9 @@ function tokenMatches(expected, given) {
 
 // src/core/control-server.ts
 function startControlServer(bus, profileDir2, info) {
-  const socketPath = join40(profileDir2, CONTROL_SOCKET_FILE);
+  const socketPath = join41(profileDir2, CONTROL_SOCKET_FILE);
   try {
-    rmSync10(socketPath, { force: true });
+    rmSync11(socketPath, { force: true });
   } catch {
   }
   const clients = /* @__PURE__ */ new Set();
@@ -48376,8 +48769,8 @@ function startControlServer(bus, profileDir2, info) {
     clients.clear();
     server.close();
     try {
-      rmSync10(socketPath, { force: true });
-      rmSync10(controlTokenPath(profileDir2), { force: true });
+      rmSync11(socketPath, { force: true });
+      rmSync11(controlTokenPath(profileDir2), { force: true });
     } catch {
     }
   };
@@ -50356,7 +50749,7 @@ var src_default = Yoga;
 
 // ../../node_modules/.pnpm/ink@5.2.1_@types+react@18.3.31_react@18.3.1/node_modules/ink/build/reconciler.js
 var import_react_reconciler = __toESM(require_react_reconciler(), 1);
-var import_constants12 = __toESM(require_constants2(), 1);
+var import_constants14 = __toESM(require_constants2(), 1);
 import process3 from "process";
 
 // ../../node_modules/.pnpm/ansi-regex@6.2.2/node_modules/ansi-regex/index.js
@@ -50527,7 +50920,7 @@ function widestLine(string) {
 }
 
 // ../../node_modules/.pnpm/ink@5.2.1_@types+react@18.3.31_react@18.3.1/node_modules/ink/build/measure-text.js
-var cache = {};
+var cache2 = {};
 var measureText = (text) => {
   if (text.length === 0) {
     return {
@@ -50535,13 +50928,13 @@ var measureText = (text) => {
       height: 0
     };
   }
-  const cachedDimensions = cache[text];
+  const cachedDimensions = cache2[text];
   if (cachedDimensions) {
     return cachedDimensions;
   }
   const width = widestLine(text);
   const height = text.split("\n").length;
-  cache[text] = { width, height };
+  cache2[text] = { width, height };
   return { width, height };
 };
 var measure_text_default = measureText;
@@ -51066,10 +51459,10 @@ function cliTruncate(text, columns, options = {}) {
 }
 
 // ../../node_modules/.pnpm/ink@5.2.1_@types+react@18.3.31_react@18.3.1/node_modules/ink/build/wrap-text.js
-var cache2 = {};
+var cache3 = {};
 var wrapText = (text, maxWidth, wrapType) => {
   const cacheKey = text + String(maxWidth) + String(wrapType);
-  const cachedText = cache2[cacheKey];
+  const cachedText = cache3[cacheKey];
   if (cachedText) {
     return cachedText;
   }
@@ -51090,7 +51483,7 @@ var wrapText = (text, maxWidth, wrapType) => {
     }
     wrappedText = cliTruncate(text, maxWidth, { position });
   }
-  cache2[cacheKey] = wrappedText;
+  cache3[cacheKey] = wrappedText;
   return wrappedText;
 };
 var wrap_text_default = wrapText;
@@ -51598,7 +51991,7 @@ var reconciler_default = (0, import_react_reconciler.default)({
   scheduleTimeout: setTimeout,
   cancelTimeout: clearTimeout,
   noTimeout: -1,
-  getCurrentEventPriority: () => import_constants12.DefaultEventPriority,
+  getCurrentEventPriority: () => import_constants14.DefaultEventPriority,
   beforeActiveInstanceBlur() {
   },
   afterActiveInstanceBlur() {
@@ -54041,10 +54434,10 @@ var import_react26 = __toESM(require_react(), 1);
 
 // src/core/input-history.ts
 import { existsSync as existsSync21, readFileSync as readFileSync20, writeFileSync as writeFileSync11 } from "fs";
-import { join as join41 } from "path";
+import { join as join42 } from "path";
 var MAX_HISTORY = 200;
 function historyPath(profileDir2) {
-  return join41(profileDir2, "input-history.json");
+  return join42(profileDir2, "input-history.json");
 }
 function loadInputHistory(profileDir2) {
   const path = historyPath(profileDir2);
@@ -54658,7 +55051,7 @@ async function runStart(profileDir2, profileName) {
     return;
   }
   logger.configure({
-    dir: join42(profileDir2, "logs"),
+    dir: join43(profileDir2, "logs"),
     level: resolveLogLevel(),
     base: { version: CLI_VERSION, profile: profileName, scope: credential.scope }
   });
@@ -54678,7 +55071,7 @@ async function runStart(profileDir2, profileName) {
   if (result.action === "updated") {
     logger.info("update.updated", { version: result.version });
     console.log(t("start.restarting"));
-    const child = spawn11(process.execPath, process.argv.slice(1), {
+    const child = spawn12(process.execPath, process.argv.slice(1), {
       stdio: "inherit",
       env: { ...process.env, FOURPM_NO_UPDATE: "1" }
     });
@@ -54768,7 +55161,7 @@ async function runStart(profileDir2, profileName) {
 }
 
 // src/commands/attach.ts
-import { join as join43 } from "path";
+import { join as join44 } from "path";
 
 // src/core/control-client.ts
 import { connect as connect2 } from "net";
@@ -54877,7 +55270,7 @@ async function runAttach(profileDir2, profileName) {
     process.exitCode = 1;
     return;
   }
-  const socketPath = join43(profileDir2, CONTROL_SOCKET_FILE);
+  const socketPath = join44(profileDir2, CONTROL_SOCKET_FILE);
   const bus = new SessionBus();
   let conn;
   try {
@@ -54908,11 +55301,11 @@ async function runAttach(profileDir2, profileName) {
 
 // src/commands/auto-run.ts
 import { connect as connect3 } from "net";
-import { join as join44 } from "path";
+import { join as join45 } from "path";
 var AUTO_RUN_TIMEOUT_MS = 3 * 60 * 60 * 1e3;
 async function runAutoRun(profileDir2, profileName) {
   initI18n(readProfileConfig(profileDir2).locale);
-  const socketPath = join44(profileDir2, CONTROL_SOCKET_FILE);
+  const socketPath = join45(profileDir2, CONTROL_SOCKET_FILE);
   const token = readControlToken(profileDir2);
   const code = await new Promise((resolve13) => {
     let settled = false;
@@ -54969,7 +55362,7 @@ async function runAutoRun(profileDir2, profileName) {
 
 // src/commands/git-credential.ts
 import { connect as connect4 } from "net";
-import { join as join45 } from "path";
+import { join as join46 } from "path";
 var REQUEST_TIMEOUT_MS = 2e4;
 function requestToken(host, path) {
   const profileDir2 = process.env[PROFILE_DIR_ENV];
@@ -54984,7 +55377,7 @@ function requestToken(host, path) {
       socket.destroy();
       resolve13(value);
     };
-    const socket = connect4(join45(profileDir2, CONTROL_SOCKET_FILE));
+    const socket = connect4(join46(profileDir2, CONTROL_SOCKET_FILE));
     socket.setEncoding("utf8");
     const timer = setTimeout(() => finish(null), REQUEST_TIMEOUT_MS);
     socket.on("connect", () => {
@@ -55038,12 +55431,12 @@ async function runGitToken() {
 }
 
 // src/commands/ai-login.ts
-import { spawn as spawn12 } from "child_process";
+import { spawn as spawn13 } from "child_process";
 import { mkdirSync as mkdirSync10 } from "fs";
 import { basename as basename8 } from "path";
 function runProviderLogin(cmd, envVar, dir2) {
   return new Promise((resolve13) => {
-    const child = spawn12(cmd, [], {
+    const child = spawn13(cmd, [], {
       stdio: "inherit",
       env: { ...process.env, [envVar]: dir2 }
     });
@@ -55088,7 +55481,7 @@ async function runAiLogin(profileDir2, profileName, aiFilter) {
 }
 
 // src/commands/unlink.ts
-import { rmSync as rmSync11 } from "fs";
+import { rmSync as rmSync12 } from "fs";
 async function runUnlink(profileDir2, profileName) {
   initI18n(readProfileConfig(profileDir2).locale);
   const cred = readCredential(profileDir2, profileName);
@@ -55102,7 +55495,7 @@ async function runUnlink(profileDir2, profileName) {
   } catch (err) {
     console.log(t("unlink.revokeFailed", { message: err.message }));
   }
-  rmSync11(profileDir2, { recursive: true, force: true });
+  rmSync12(profileDir2, { recursive: true, force: true });
   clearDefaultProfileIf(profileName);
   console.log(t("unlink.deleted"));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@4pm/cli",
-  "version": "1.31.0",
+  "version": "1.32.0-b",
   "private": false,
   "description": "4PM CLI — drives Claude/Codex CLIs on AI worker machines (Node + TypeScript)",
   "license": "LicenseRef-4PM-Source-Available",