@4pm/cli 1.5.17 → 1.5.25

package/dist/index.js

@@ -5713,14 +5713,14 @@ var require_react_development = __commonJS({
               var thenableResult = result;
               var wasAwaited = false;
               var thenable = {
-                then: function(resolve8, reject) {
+                then: function(resolve9, reject) {
                   wasAwaited = true;
                   thenableResult.then(function(returnValue2) {
                     popActScope(prevActScopeDepth);
                     if (actScopeDepth === 0) {
-                      recursivelyFlushAsyncActWork(returnValue2, resolve8, reject);
+                      recursivelyFlushAsyncActWork(returnValue2, resolve9, reject);
                     } else {
-                      resolve8(returnValue2);
+                      resolve9(returnValue2);
                     }
                   }, function(error2) {
                     popActScope(prevActScopeDepth);
@@ -5750,20 +5750,20 @@ var require_react_development = __commonJS({
                   ReactCurrentActQueue.current = null;
                 }
                 var _thenable = {
-                  then: function(resolve8, reject) {
+                  then: function(resolve9, reject) {
                     if (ReactCurrentActQueue.current === null) {
                       ReactCurrentActQueue.current = [];
-                      recursivelyFlushAsyncActWork(returnValue, resolve8, reject);
+                      recursivelyFlushAsyncActWork(returnValue, resolve9, reject);
                     } else {
-                      resolve8(returnValue);
+                      resolve9(returnValue);
                     }
                   }
                 };
                 return _thenable;
               } else {
                 var _thenable2 = {
-                  then: function(resolve8, reject) {
-                    resolve8(returnValue);
+                  then: function(resolve9, reject) {
+                    resolve9(returnValue);
                   }
                 };
                 return _thenable2;
@@ -5779,7 +5779,7 @@ var require_react_development = __commonJS({
             actScopeDepth = prevActScopeDepth;
           }
         }
-        function recursivelyFlushAsyncActWork(returnValue, resolve8, reject) {
+        function recursivelyFlushAsyncActWork(returnValue, resolve9, reject) {
           {
             var queue = ReactCurrentActQueue.current;
             if (queue !== null) {
@@ -5788,16 +5788,16 @@ var require_react_development = __commonJS({
                 enqueueTask(function() {
                   if (queue.length === 0) {
                     ReactCurrentActQueue.current = null;
-                    resolve8(returnValue);
+                    resolve9(returnValue);
                   } else {
-                    recursivelyFlushAsyncActWork(returnValue, resolve8, reject);
+                    recursivelyFlushAsyncActWork(returnValue, resolve9, reject);
                   }
                 });
               } catch (error2) {
                 reject(error2);
               }
             } else {
-              resolve8(returnValue);
+              resolve9(returnValue);
             }
           }
         }
@@ -28775,7 +28775,7 @@ async function checkAndUpdate(serverUrl, autoUpdate) {
 // src/core/ws-client.ts
 init_wrapper();
 import { randomUUID } from "crypto";
-import { basename as basename4, join as join26 } from "path";
+import { basename as basename5, join as join26 } from "path";
 
 // vendor/@4pm/utils/helpers.ts
 function backoffJitterMs(attempt, baseMs = 500, maxMs = 1e4) {
@@ -28807,6 +28807,24 @@ function prettyResult(text) {
   return trimmed;
 }
 
+// vendor/@4pm/constants/project-template.ts
+var PROJECT_TEMPLATE = {
+  version: "1.0.0",
+  changelog: [
+    {
+      version: "1.0.0",
+      date: "2026-09-12",
+      summary: "Baseline scaffold template with version tracking.",
+      notes: [
+        "Initial CLAUDE.md, .claude config (settings, hooks, skills, agents, autonomous).",
+        "Standard docs/tests/reports/src layout and placeholder files.",
+        "Introduces .4pm/.4pm.json template-version tracking."
+      ],
+      files: []
+    }
+  ]
+};
+
 // vendor/@4pm/constants/quota.ts
 var UsageMetric = {
   AI_TOKENS: "ai_tokens",
@@ -32939,6 +32957,14 @@ var commandImageRefSchema = external_exports.object({
   name: external_exports.string().max(255),
   mime: external_exports.enum(COMMAND_IMAGE_MIME_TYPES)
 });
+var aiRunConfigSchema = external_exports.object({
+  /** `--model` override for this run (must match the resolved provider's model id). */
+  model: external_exports.string().trim().max(120).optional(),
+  /** Coarse reasoning-budget level, mapped to the provider's own mechanism. */
+  thinking: external_exports.enum(["off", "low", "medium", "high"]).optional(),
+  /** Sampling temperature 0..1 (best-effort per provider). */
+  temperature: external_exports.number().min(0).max(1).optional()
+});
 var dispatchCommandRequestSchema = external_exports.object({
   projectId: external_exports.string().uuid(),
   // Target cli. Required unless `pick` is set — with `pick:"idle"` the server chooses the
@@ -32986,7 +33012,22 @@ var dispatchCommandRequestSchema = external_exports.object({
    * the repo / edit files / loop forever. Only meaningful with `ai:true`; absent ⇒ a full
    * agent run (the Console tab + Git merge, which legitimately use tools).
    */
-  aiOneShot: external_exports.boolean().optional()
+  aiOneShot: external_exports.boolean().optional(),
+  /**
+   * Read-only agent AI mode (ADR-0265): the prompt is a task that must **read + inspect the repo
+   * but write nothing** (the project-template "Analyze impact"). Unlike `aiOneShot` it keeps the
+   * read/search tools (`Read`/`Glob`/`Grep`/`Bash`) and runs multi-turn, but the cli blocks the
+   * write/orchestration tools and runs claude under `--permission-mode plan` (codex `--sandbox
+   * read-only`) so it can diff files without editing them. Only meaningful with `ai:true`;
+   * **mutually exclusive with `aiOneShot`** (a run is one-shot | read-only | full-agent).
+   */
+  aiReadOnly: external_exports.boolean().optional(),
+  /**
+   * Per-run AI execution overrides (ADR-0261): model/thinking/temperature chosen in the web
+   * "AI settings" modal (per-user localStorage), layered over the profile default by the cli.
+   * Only meaningful with `ai:true`.
+   */
+  aiConfig: aiRunConfigSchema.optional()
 }).superRefine((v, ctx) => {
   if (v.machineLinkId == null === (v.pick == null)) {
     ctx.addIssue({
@@ -32995,6 +33036,13 @@ var dispatchCommandRequestSchema = external_exports.object({
       message: "Provide exactly one of machineLinkId or pick."
     });
   }
+  if (v.aiOneShot && v.aiReadOnly) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["aiReadOnly"],
+      message: "aiOneShot and aiReadOnly are mutually exclusive."
+    });
+  }
   if (!v.ai && v.command.length > COMMAND_MAX_LEN) {
     ctx.addIssue({
       code: external_exports.ZodIssueCode.too_big,
@@ -33129,6 +33177,17 @@ var fsWriteRequestSchema = external_exports.object({
   /** Full new UTF-8 content (replaces the file wholesale). */
   content: external_exports.string().max(FILE_WRITE_MAX_BYTES)
 });
+var fsMutateRequestSchema = external_exports.object({
+  op: external_exports.enum(["mkdir", "create", "move", "delete"]),
+  path: external_exports.string().max(1024).optional(),
+  content: external_exports.string().max(FILE_WRITE_MAX_BYTES).optional(),
+  from: external_exports.string().max(1024).optional(),
+  to: external_exports.string().max(1024).optional()
+});
+var taskApproveRequestSchema = external_exports.object({
+  taskId: external_exports.string().min(1).max(64),
+  approved: external_exports.boolean()
+});
 var autonomousWriteRequestSchema = external_exports.discriminatedUnion("kind", [
   external_exports.object({ kind: external_exports.literal("settings"), settings: external_exports.string().max(64 * 1024) }),
   external_exports.object({ kind: external_exports.literal("approvals"), taskId: external_exports.string().min(1).max(64), approved: external_exports.boolean() }),
@@ -33275,16 +33334,6 @@ var MEMO_MAX_LENGTH = 65536;
 var putMemoRequestSchema = external_exports.object({
   content: external_exports.string().max(MEMO_MAX_LENGTH)
 });
-var MEMO_ITEM_MAX_LENGTH = 2e3;
-var createMemoItemSchema = external_exports.object({
-  content: external_exports.string().trim().min(1).max(MEMO_ITEM_MAX_LENGTH)
-});
-var updateMemoItemSchema = external_exports.object({
-  content: external_exports.string().trim().min(1).max(MEMO_ITEM_MAX_LENGTH).optional(),
-  done: external_exports.boolean().optional()
-}).refine((v) => v.content !== void 0 || v.done !== void 0, {
-  message: "content or done required"
-});
 var HTTP_JSON_BODY_LIMIT_BYTES = 2 * 1048576;
 var putSpecDraftRequestSchema = external_exports.object({
   spec: external_exports.record(external_exports.unknown()),
@@ -33710,6 +33759,9 @@ var WsChannels = {
   // ADR-0151) — the Git tab's manual conflict resolution (`project.git_write`); the only
   // git-tab write not carried by a git command over command dispatch.
   FS_WRITE: "fs.write",
+  // server → cli (reply): create/rename/move/delete a file or folder in the project tree,
+  // each op path-clamped to the physic root (machine-0059, ADR-0260, `project.files_write`).
+  FS_MUTATE: "fs.mutate",
   GIT_DIFF: "git.diff",
   GIT_ENV: "git.env",
   // server → cli (reply): read/write the paired profile's config.json (machine-0025/0026,
@@ -34026,8 +34078,8 @@ function resolveInstallTimeoutMs(sec) {
   return sec && sec > 0 ? sec * 1e3 : TOOL_INSTALL_TIMEOUT_DEFAULT_MS;
 }
 function sleep(ms) {
-  return new Promise((resolve8) => {
-    const t = setTimeout(resolve8, ms);
+  return new Promise((resolve9) => {
+    const t = setTimeout(resolve9, ms);
     t.unref?.();
   });
 }
@@ -34049,14 +34101,14 @@ function classifyToolFailure(code, out) {
   return { reason: "other", retryable: false };
 }
 function run(cmd, args, onLine, timeoutMs = 18e4) {
-  return new Promise((resolve8) => {
+  return new Promise((resolve9) => {
     let out = "";
     let buf = "";
     let child = null;
     const done = (code) => {
       clearTimeout(timer);
       if (onLine && buf.trim()) onLine(buf.trim());
-      resolve8({ code, out });
+      resolve9({ code, out });
     };
     const timer = setTimeout(() => {
       child?.kill();
@@ -34437,7 +34489,7 @@ async function runCommand(dispatch, emit, opts) {
   });
   child.stdout?.on("data", (data) => batcher.push(data.toString("utf8")));
   child.stderr?.on("data", (data) => batcher.push(data.toString("utf8")));
-  await new Promise((resolve8) => {
+  await new Promise((resolve9) => {
     child.on("close", (exitCode) => {
       clearTimers();
       batcher.flush();
@@ -34450,7 +34502,7 @@ async function runCommand(dispatch, emit, opts) {
         // server settles the command as failed and the web surfaces the note instead of spinning.
         exitCode: timedOut ? 124 : exitCode ?? -1
       });
-      resolve8();
+      resolve9();
     });
     child.on("error", (err) => {
       clearTimers();
@@ -34462,7 +34514,7 @@ async function runCommand(dispatch, emit, opts) {
         done: true,
         exitCode: -1
       });
-      resolve8();
+      resolve9();
     });
   });
 }
@@ -34599,15 +34651,15 @@ function isOutOfCredits(text) {
   );
 }
 function runAttempt(commandId, cmd, args, stdin, cwd2, env3, onChunk, timeoutMs) {
-  return new Promise((resolve8) => {
+  return new Promise((resolve9) => {
     runCommand(
       { commandId, cmd, args, path: cwd2, env: env3 },
       (out) => {
         if (out.chunk) onChunk(out.chunk);
-        if (out.done) resolve8(out.exitCode ?? -1);
+        if (out.done) resolve9(out.exitCode ?? -1);
       },
       { stdin, ...timeoutMs > 0 ? { timeoutMs } : {} }
-    ).catch(() => resolve8(-1));
+    ).catch(() => resolve9(-1));
   });
 }
 async function runAiFailover(plan, commandId, cwd2, handlers, timeoutMs = 0) {
@@ -34797,6 +34849,48 @@ function oneShotArgs(cmd) {
   if (!cmd.includes("claude")) return [];
   return ["--max-turns=1", "--disallowedTools", ONE_SHOT_DISALLOWED_CLAUDE_TOOLS, "--permission-mode", "default"];
 }
+var READ_ONLY_DISALLOWED_CLAUDE_TOOLS = [
+  "Edit",
+  "Write",
+  "NotebookEdit",
+  "Task",
+  "SlashCommand",
+  "Skill",
+  "WebSearch",
+  "WebFetch",
+  "TaskCreate",
+  "TaskGet",
+  "TaskList",
+  "TaskOutput",
+  "TaskStop",
+  "TaskUpdate",
+  "Monitor",
+  "DesignSync",
+  "CronCreate",
+  "CronDelete",
+  "CronList",
+  "EnterWorktree",
+  "ExitWorktree",
+  "RemoteTrigger",
+  "ScheduleWakeup",
+  "SendMessage",
+  "PushNotification"
+].join(",");
+var READ_ONLY_MAX_TURNS = 40;
+function readOnlyArgs(cmd, profileMaxTurns) {
+  if (cmd.includes("claude")) {
+    const turns = typeof profileMaxTurns === "number" && profileMaxTurns > 0 ? Math.floor(profileMaxTurns) : READ_ONLY_MAX_TURNS;
+    return [
+      `--max-turns=${turns}`,
+      "--disallowedTools",
+      READ_ONLY_DISALLOWED_CLAUDE_TOOLS,
+      "--permission-mode",
+      "plan"
+    ];
+  }
+  if (cmd.includes("codex")) return ["--sandbox", "read-only"];
+  return [];
+}
 function requiredArgs(cmd) {
   if (cmd.includes("claude")) return REQUIRED_AI_ARGS.claude;
   if (cmd.includes("codex")) return REQUIRED_AI_ARGS.codex;
@@ -34856,15 +34950,36 @@ function folderScopeGuard(folder, prompt) {
     prompt
   ].join("\n");
 }
-function buildRunArgs(profile, cmd, resumeId, oneShot = false) {
+var THINKING_TOKENS = { low: 4e3, medium: 1e4, high: 31999 };
+function overrideArgs(cmd, o) {
+  if (!o || !cmd.includes("codex")) return [];
+  const args = [];
+  if (o.thinking && o.thinking !== "off") args.push("-c", `model_reasoning_effort="${o.thinking}"`);
+  if (typeof o.temperature === "number") args.push("-c", `model_temperature=${o.temperature}`);
+  return args;
+}
+function overrideEnv(cmd, o) {
+  if (!o || !cmd.includes("claude")) return {};
+  if (!o.thinking || o.thinking === "off") return {};
+  const budget = THINKING_TOKENS[o.thinking];
+  return budget ? { MAX_THINKING_TOKENS: String(budget) } : {};
+}
+function buildRunArgs(profile, cmd, resumeId, oneShot = false, override, readOnly = false) {
   const extras = profile.args ?? [];
-  const model = profile.model?.trim();
+  const model = override?.model?.trim() || profile.model?.trim();
   const modelArgs = model ? ["--model", model] : [];
   const resumeArgs = resumeId && cmd.includes("claude") ? ["--resume", resumeId] : [];
   const turns = profile.maxTurns;
-  const perProfileTurns = !oneShot && cmd.includes("claude") && typeof turns === "number" && turns > 0 ? [`--max-turns=${Math.floor(turns)}`] : [];
-  const oneShotExtra = oneShot ? oneShotArgs(cmd) : perProfileTurns;
-  return [...requiredArgs(cmd), ...resumeArgs, ...extras, ...modelArgs, ...oneShotExtra];
+  const perProfileTurns = !oneShot && !readOnly && cmd.includes("claude") && typeof turns === "number" && turns > 0 ? [`--max-turns=${Math.floor(turns)}`] : [];
+  const modeExtra = oneShot ? oneShotArgs(cmd) : readOnly ? readOnlyArgs(cmd, turns) : perProfileTurns;
+  return [
+    ...requiredArgs(cmd),
+    ...resumeArgs,
+    ...extras,
+    ...modelArgs,
+    ...overrideArgs(cmd, override),
+    ...modeExtra
+  ];
 }
 function claudeHomeDirs(config) {
   const dirs = profileDirs(claudeProfilesOf(config));
@@ -34903,10 +35018,10 @@ function resolveClaudeProfiles(config, workingDir) {
   if (idx > 0) profiles.unshift(profiles.splice(idx, 1)[0]);
   return profiles;
 }
-function planAiRun(prompt, config, hint = {}, resume = /* @__PURE__ */ new Map(), oneShot = false) {
-  return isUnifiedConfig(config) ? planUnifiedRun(prompt, config, hint.credential ?? null, resume, oneShot) : planLegacyRun(prompt, config, hint.dir ?? null, resume, oneShot);
+function planAiRun(prompt, config, hint = {}, resume = /* @__PURE__ */ new Map(), oneShot = false, override, readOnly = false) {
+  return isUnifiedConfig(config) ? planUnifiedRun(prompt, config, hint.credential ?? null, resume, oneShot, override, readOnly) : planLegacyRun(prompt, config, hint.dir ?? null, resume, oneShot, override, readOnly);
 }
-function planUnifiedRun(prompt, config, workingCredential, resume, oneShot) {
+function planUnifiedRun(prompt, config, workingCredential, resume, oneShot, override, readOnly = false) {
   const baseEnv = config.aiEnv ?? {};
   const active = activeProvider(config);
   const usable = config.aiProfiles.filter(isUsableCredential);
@@ -34915,7 +35030,7 @@ function planUnifiedRun(prompt, config, workingCredential, resume, oneShot) {
     return {
       cmd: active,
       attempts: [
-        { cmd: active, label: "default", dir: null, key: null, args: buildRunArgs({ profile: "" }, active, void 0, oneShot), stdin: prompt, env: { ...baseEnv } }
+        { cmd: active, label: "default", dir: null, key: null, args: buildRunArgs({ profile: "" }, active, void 0, oneShot, override, readOnly), stdin: prompt, env: { ...baseEnv, ...overrideEnv(active, override) } }
       ]
     };
   }
@@ -34933,20 +35048,20 @@ function planUnifiedRun(prompt, config, workingCredential, resume, oneShot) {
     label: cred.label?.trim() || profileDisplayLabel(dir2),
     dir: dir2,
     key,
-    args: buildRunArgs(cred, cmd, resume.get(key), oneShot),
+    args: buildRunArgs(cred, cmd, resume.get(key), oneShot, override, readOnly),
     stdin: prompt,
-    env: envVar ? { ...baseEnv, [envVar]: dir2 } : { ...baseEnv }
+    env: envVar ? { ...baseEnv, [envVar]: dir2, ...overrideEnv(cmd, override) } : { ...baseEnv, ...overrideEnv(cmd, override) }
   }));
   return { cmd: attempts[0]?.cmd ?? DEFAULT_AI_CLI, attempts };
 }
-function planLegacyRun(prompt, config, workingDir, resume, oneShot) {
+function planLegacyRun(prompt, config, workingDir, resume, oneShot, override, readOnly = false) {
   const cmd = config.aiCli || DEFAULT_AI_CLI;
   const baseEnv = config.aiEnv ?? {};
   const envVar = profileEnvVar(cmd);
   const defaultPlan = {
     cmd,
     attempts: [
-      { cmd, label: "default", dir: null, key: null, args: buildRunArgs({ profile: "" }, cmd, void 0, oneShot), stdin: prompt, env: { ...baseEnv } }
+      { cmd, label: "default", dir: null, key: null, args: buildRunArgs({ profile: "" }, cmd, void 0, oneShot, override, readOnly), stdin: prompt, env: { ...baseEnv, ...overrideEnv(cmd, override) } }
     ]
   };
   if (!envVar) return defaultPlan;
@@ -34963,9 +35078,9 @@ function planLegacyRun(prompt, config, workingDir, resume, oneShot) {
       label: profileDisplayLabel(dir2),
       dir: dir2,
       key,
-      args: buildRunArgs(profile, cmd, resume.get(key), oneShot),
+      args: buildRunArgs(profile, cmd, resume.get(key), oneShot, override, readOnly),
       stdin: prompt,
-      env: { ...baseEnv, [envVar]: dir2 }
+      env: { ...baseEnv, [envVar]: dir2, ...overrideEnv(cmd, override) }
     };
   });
   return { cmd, attempts };
@@ -35006,16 +35121,16 @@ async function fetchUsage(token) {
   }
 }
 function runUsageCli(dir2, aiCli2) {
-  return new Promise((resolve8) => {
+  return new Promise((resolve9) => {
     let out = "";
     let child = null;
     const finish = () => {
       clearTimeout(timer);
-      resolve8(out);
+      resolve9(out);
     };
     const timer = setTimeout(() => {
       child?.kill();
-      resolve8(out);
+      resolve9(out);
     }, 3e4);
     timer.unref?.();
     try {
@@ -35537,6 +35652,80 @@ async function writeWorkerFile(root, relPath, content) {
   }
 }
 
+// src/core/fs-mutate.ts
+import { mkdir as mkdir3, writeFile as writeFile2, rename, rm, stat } from "fs/promises";
+import { basename as basename2, dirname as dirname4, resolve as resolve4, sep as sep4 } from "path";
+var MAX_BYTES3 = 2 * 1024 * 1024;
+function resolveInRoot2(root, rel) {
+  const base = resolve4(root);
+  const target = resolve4(base, rel || ".");
+  return target === base || target.startsWith(base + sep4) ? target : null;
+}
+async function isDir(p) {
+  try {
+    return (await stat(p)).isDirectory();
+  } catch {
+    return false;
+  }
+}
+async function exists(p) {
+  try {
+    await stat(p);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function mutateFs(root, req) {
+  if (!root) return { ok: false, path: req.path ?? req.from ?? "", error: "no project served" };
+  const escaped = (p) => ({ ok: false, path: p, error: "path escapes the project root" });
+  try {
+    switch (req.op) {
+      case "mkdir": {
+        const target = resolveInRoot2(root, req.path ?? "");
+        if (!target || target === resolve4(root)) return escaped(req.path ?? "");
+        await mkdir3(target, { recursive: true });
+        return { ok: true, path: target };
+      }
+      case "create": {
+        const target = resolveInRoot2(root, req.path ?? "");
+        if (!target || target === resolve4(root)) return escaped(req.path ?? "");
+        if (await exists(target)) return { ok: false, path: target, error: "already exists" };
+        const content = req.content ?? "";
+        if (Buffer.byteLength(content, "utf8") > MAX_BYTES3) {
+          return { ok: false, path: target, error: `content too large (max ${MAX_BYTES3} bytes)` };
+        }
+        await mkdir3(dirname4(target), { recursive: true });
+        await writeFile2(target, content, "utf8");
+        return { ok: true, path: target };
+      }
+      case "move": {
+        const from = resolveInRoot2(root, req.from ?? "");
+        let to = resolveInRoot2(root, req.to ?? "");
+        if (!from || !to) return escaped(req.from ?? req.to ?? "");
+        if (from === resolve4(root)) return { ok: false, path: from, error: "cannot move the project root" };
+        if (await isDir(to)) to = resolve4(to, basename2(from));
+        if (to !== resolve4(root) && !to.startsWith(resolve4(root) + sep4)) return escaped(req.to ?? "");
+        if (await exists(to)) return { ok: false, path: to, error: "destination already exists" };
+        await mkdir3(dirname4(to), { recursive: true });
+        await rename(from, to);
+        return { ok: true, path: to };
+      }
+      case "delete": {
+        const target = resolveInRoot2(root, req.path ?? "");
+        if (!target) return escaped(req.path ?? "");
+        if (target === resolve4(root)) return { ok: false, path: target, error: "cannot delete the project root" };
+        await rm(target, { recursive: true, force: true });
+        return { ok: true, path: target };
+      }
+      default:
+        return { ok: false, path: "", error: "unknown op" };
+    }
+  } catch (err) {
+    return { ok: false, path: req.path ?? req.from ?? "", error: err instanceof Error ? err.message : String(err) };
+  }
+}
+
 // src/core/support-answer.ts
 import { spawn as spawn5 } from "child_process";
 import { execFile as execFile2 } from "child_process";
@@ -35661,7 +35850,7 @@ function parseModeratedAnswer(text) {
   return { body: text.trim() };
 }
 function runClaudeOnce(cmd, profile, prompt, extraEnv) {
-  return new Promise((resolve8, reject) => {
+  return new Promise((resolve9, reject) => {
     const isClaude = cmd.includes("claude");
     const args = [
       "-p",
@@ -35691,7 +35880,7 @@ function runClaudeOnce(cmd, profile, prompt, extraEnv) {
     child.on("close", (code) => {
       clearTimeout(timer);
       out += parser.flush();
-      resolve8({ code: code ?? -1, out, err, usage: parser.usage() });
+      resolve9({ code: code ?? -1, out, err, usage: parser.usage() });
     });
     child.stdin.write(prompt);
     child.stdin.end();
@@ -35762,7 +35951,7 @@ Extra focus from the author: ${req.prompt}` : "";
   ].join("\n");
 }
 function runOnce(cmd, profile, prompt, cwd2, extraEnv) {
-  return new Promise((resolve8, reject) => {
+  return new Promise((resolve9, reject) => {
     const args = ["-p", ...profile?.model ? ["--model", profile.model] : []];
     const env3 = {
       ...process.env,
@@ -35785,7 +35974,7 @@ function runOnce(cmd, profile, prompt, cwd2, extraEnv) {
     });
     child.on("close", (code) => {
       clearTimeout(timer);
-      resolve8({ code: code ?? -1, out, err });
+      resolve9({ code: code ?? -1, out, err });
     });
     child.stdin.write(prompt);
     child.stdin.end();
@@ -35815,7 +36004,7 @@ async function runKnowledgeCompose(req, ai, physicRoot) {
 }
 
 // src/core/autonomous.ts
-import { readFile as readFile3, writeFile as writeFile2, chmod } from "fs/promises";
+import { readFile as readFile3, writeFile as writeFile3, chmod } from "fs/promises";
 import { readFileSync as readFileSync13 } from "fs";
 import { execFile as execFile3, spawn as spawn7 } from "child_process";
 import { join as join14 } from "path";
@@ -35861,10 +36050,10 @@ async function crontabList() {
   }
 }
 async function crontabSet(content) {
-  return new Promise((resolve8) => {
+  return new Promise((resolve9) => {
     const child = spawn7("crontab", ["-"], { stdio: ["pipe", "ignore", "ignore"] });
-    child.on("error", () => resolve8(false));
-    child.on("close", (code) => resolve8(code === 0));
+    child.on("error", () => resolve9(false));
+    child.on("close", (code) => resolve9(code === 0));
     child.stdin.end(content.endsWith("\n") ? content : content + "\n");
   });
 }
@@ -35940,14 +36129,14 @@ async function writeAutonomous(root, req, by) {
     switch (req.kind) {
       case "settings": {
         if (!parseJson(req.settings)) return { ok: false, error: "settings is not valid JSON" };
-        await writeFile2(join14(root, SETTINGS_REL), req.settings, "utf8");
+        await writeFile3(join14(root, SETTINGS_REL), req.settings, "utf8");
         break;
       }
       case "approvals": {
         const map = parseJson(await readText(join14(root, APPROVALS_REL), "{}")) ?? {};
         if (req.approved) map[req.taskId] = { approved: true, by, at: (/* @__PURE__ */ new Date()).toISOString() };
         else delete map[req.taskId];
-        await writeFile2(join14(root, APPROVALS_REL), JSON.stringify(map, null, 2) + "\n", "utf8");
+        await writeFile3(join14(root, APPROVALS_REL), JSON.stringify(map, null, 2) + "\n", "utf8");
         break;
       }
       case "userTodo": {
@@ -35957,7 +36146,7 @@ async function writeAutonomous(root, req, by) {
 > posted by ${by} at ${(/* @__PURE__ */ new Date()).toISOString()}
 ${req.content.trim()}
 `;
-        await writeFile2(join14(root, BOOK_FILES.userTodo), cur.trimEnd() + block, "utf8");
+        await writeFile3(join14(root, BOOK_FILES.userTodo), cur.trimEnd() + block, "utf8");
         break;
       }
       case "cron": {
@@ -35973,7 +36162,7 @@ ${req.content.trim()}
 }
 
 // src/core/agents.ts
-import { readFile as readFile4, writeFile as writeFile3, mkdir as mkdir3, readdir as readdir3, rm } from "fs/promises";
+import { readFile as readFile4, writeFile as writeFile4, mkdir as mkdir4, readdir as readdir3, rm as rm2 } from "fs/promises";
 import { join as join15 } from "path";
 var AGENTS_REL = ".claude/agents";
 var SKILLS_REL = ".claude/skills";
@@ -36036,14 +36225,14 @@ async function writeAgent(root, req) {
   if (!n) return { ok: false, error: "invalid name" };
   try {
     if (req.action === "delete") {
-      if (req.kind === "subagent") await rm(itemPath(root, "subagent", n), { force: true });
-      else await rm(join15(root, SKILLS_REL, n), { recursive: true, force: true });
+      if (req.kind === "subagent") await rm2(itemPath(root, "subagent", n), { force: true });
+      else await rm2(join15(root, SKILLS_REL, n), { recursive: true, force: true });
       return { ok: true };
     }
     if (req.content === void 0) return { ok: false, error: "content is required" };
     const path = itemPath(root, req.kind, n);
-    await mkdir3(join15(path, ".."), { recursive: true });
-    await writeFile3(path, req.content, "utf8");
+    await mkdir4(join15(path, ".."), { recursive: true });
+    await writeFile4(path, req.content, "utf8");
     return { ok: true };
   } catch (err) {
     return { ok: false, error: err instanceof Error ? err.message : String(err) };
@@ -36052,8 +36241,8 @@ async function writeAgent(root, req) {
 
 // src/core/packages.ts
 import { createHash as createHash4 } from "crypto";
-import { readFile as readFile5, writeFile as writeFile4, mkdir as mkdir4, readdir as readdir4, rm as rm2, stat } from "fs/promises";
-import { dirname as dirname4, join as join16, relative } from "path";
+import { readFile as readFile5, writeFile as writeFile5, mkdir as mkdir5, readdir as readdir4, rm as rm3, stat as stat2 } from "fs/promises";
+import { dirname as dirname5, join as join16, relative } from "path";
 var AGENTS_REL2 = ".claude/agents";
 var SKILLS_REL2 = ".claude/skills";
 var MANIFEST_REL = ".claude/.4pm-packages.json";
@@ -36117,7 +36306,7 @@ async function artifactSha256(root, kind, slug) {
 async function artifactExists(root, kind, slug) {
   const target = kind === "subagent" ? join16(root, AGENTS_REL2, `${slug}.md`) : join16(root, SKILLS_REL2, slug);
   try {
-    await stat(target);
+    await stat2(target);
     return true;
   } catch {
     return false;
@@ -36134,34 +36323,34 @@ async function readManifest(root) {
 }
 async function writeManifest(root, manifest) {
   const path = join16(root, MANIFEST_REL);
-  await mkdir4(dirname4(path), { recursive: true });
-  await writeFile4(path, JSON.stringify(manifest, null, 2), "utf8");
+  await mkdir5(dirname5(path), { recursive: true });
+  await writeFile5(path, JSON.stringify(manifest, null, 2), "utf8");
 }
 async function writeArtifactFiles(root, kind, slug, files) {
   const byPath = new Map(files.map((f) => [f.path, Buffer.from(f.contentBase64, "base64")]));
   if (kind === "subagent") {
     const agent = byPath.get("agent.md");
     if (agent) {
-      await mkdir4(join16(root, AGENTS_REL2), { recursive: true });
-      await writeFile4(join16(root, AGENTS_REL2, `${slug}.md`), agent);
+      await mkdir5(join16(root, AGENTS_REL2), { recursive: true });
+      await writeFile5(join16(root, AGENTS_REL2, `${slug}.md`), agent);
     }
     const short = byPath.get("short-memory.md");
     if (short) {
-      await mkdir4(join16(root, AGENTS_REL2, "short-memory"), { recursive: true });
-      await writeFile4(join16(root, AGENTS_REL2, "short-memory", `${slug}.md`), short);
+      await mkdir5(join16(root, AGENTS_REL2, "short-memory"), { recursive: true });
+      await writeFile5(join16(root, AGENTS_REL2, "short-memory", `${slug}.md`), short);
     }
     const long = byPath.get("long-memory.md");
     if (long) {
-      await mkdir4(join16(root, AGENTS_REL2, "long-memory"), { recursive: true });
-      await writeFile4(join16(root, AGENTS_REL2, "long-memory", `${slug}.md`), long);
+      await mkdir5(join16(root, AGENTS_REL2, "long-memory"), { recursive: true });
+      await writeFile5(join16(root, AGENTS_REL2, "long-memory", `${slug}.md`), long);
     }
   } else {
     const base = join16(root, SKILLS_REL2, slug);
     for (const [rel, buf] of byPath) {
       if (rel.includes("..") || rel.startsWith("/")) continue;
       const dest = join16(base, rel);
-      await mkdir4(dirname4(dest), { recursive: true });
-      await writeFile4(dest, buf);
+      await mkdir5(dirname5(dest), { recursive: true });
+      await writeFile5(dest, buf);
     }
   }
 }
@@ -36225,11 +36414,11 @@ async function removePackage(root, slug) {
     const entry = manifest[n];
     if (!entry) return { ok: false, error: "not installed" };
     if (entry.kind === "subagent") {
-      await rm2(join16(root, AGENTS_REL2, `${n}.md`), { force: true });
-      await rm2(join16(root, AGENTS_REL2, "short-memory", `${n}.md`), { force: true });
-      await rm2(join16(root, AGENTS_REL2, "long-memory", `${n}.md`), { force: true });
+      await rm3(join16(root, AGENTS_REL2, `${n}.md`), { force: true });
+      await rm3(join16(root, AGENTS_REL2, "short-memory", `${n}.md`), { force: true });
+      await rm3(join16(root, AGENTS_REL2, "long-memory", `${n}.md`), { force: true });
     } else {
-      await rm2(join16(root, SKILLS_REL2, n), { recursive: true, force: true });
+      await rm3(join16(root, SKILLS_REL2, n), { recursive: true, force: true });
     }
     delete manifest[n];
     await writeManifest(root, manifest);
@@ -36257,14 +36446,14 @@ function detectContainerized() {
   }
 }
 function canReach(host, port) {
-  return new Promise((resolve8) => {
+  return new Promise((resolve9) => {
     const socket = connect({ host, port });
     let done = false;
     const finish = (ok) => {
       if (done) return;
       done = true;
       socket.destroy();
-      resolve8(ok);
+      resolve9(ok);
     };
     socket.setTimeout(PROBE_TIMEOUT_MS);
     socket.once("connect", () => finish(true));
@@ -36345,7 +36534,7 @@ function applyGitAuth(method) {
 }
 
 // src/core/secrets.ts
-import { readFile as readFile6, writeFile as writeFile5 } from "fs/promises";
+import { readFile as readFile6, writeFile as writeFile6 } from "fs/promises";
 import { join as join18 } from "path";
 var SECURITY_REL = "AI_SECURITY.md";
 var PLACEHOLDER_REL = "AI_PLACEHOLDER.md";
@@ -36392,14 +36581,14 @@ async function readSecrets(root) {
 async function writeSecrets(root, req) {
   try {
     if (req.kind === "security") {
-      await writeFile5(join18(root, SECURITY_REL), req.content, "utf8");
+      await writeFile6(join18(root, SECURITY_REL), req.content, "utf8");
     } else if (req.kind === "placeholder") {
-      await writeFile5(join18(root, PLACEHOLDER_REL), req.content, "utf8");
+      await writeFile6(join18(root, PLACEHOLDER_REL), req.content, "utf8");
     } else {
       const secrets = await readSecretsObject(root);
       if (req.kind === "secret") secrets[req.key] = req.value;
       else delete secrets[req.key];
-      await writeFile5(join18(root, SECRETS_REL), JSON.stringify(secrets, null, 2) + "\n", "utf8");
+      await writeFile6(join18(root, SECRETS_REL), JSON.stringify(secrets, null, 2) + "\n", "utf8");
     }
     return { ok: true };
   } catch (err) {
@@ -36408,8 +36597,8 @@ async function writeSecrets(root, req) {
 }
 
 // src/core/agent-tools.ts
-import { readFile as readFile7, writeFile as writeFile6, mkdir as mkdir5 } from "fs/promises";
-import { dirname as dirname5, join as join19 } from "path";
+import { readFile as readFile7, writeFile as writeFile7, mkdir as mkdir6 } from "fs/promises";
+import { dirname as dirname6, join as join19 } from "path";
 var SHARED_REL = ".claude/settings.json";
 var LOCAL_REL = ".claude/settings.local.json";
 var SECRETS_DENY = "Read(./project.secrets.json)";
@@ -36442,8 +36631,8 @@ async function writeAgentTools(root, scope, permissions) {
     const next = normalizePermissions(permissions);
     if (scope === "shared" && !next.deny.includes(SECRETS_DENY)) next.deny = [...next.deny, SECRETS_DENY];
     obj.permissions = next;
-    await mkdir5(dirname5(path), { recursive: true });
-    await writeFile6(path, JSON.stringify(obj, null, 2) + "\n", "utf8");
+    await mkdir6(dirname6(path), { recursive: true });
+    await writeFile7(path, JSON.stringify(obj, null, 2) + "\n", "utf8");
     return { ok: true };
   } catch (err) {
     return { ok: false, error: err instanceof Error ? err.message : String(err) };
@@ -36452,7 +36641,7 @@ async function writeAgentTools(root, scope, permissions) {
 
 // src/core/graph.ts
 import { readFile as readFile8, readdir as readdir5 } from "fs/promises";
-import { join as join20, relative as relative2, dirname as dirname6, resolve as resolve4, extname, basename as basename2 } from "path";
+import { join as join20, relative as relative2, dirname as dirname7, resolve as resolve5, extname, basename as basename3 } from "path";
 var MAX_FILES = 2e3;
 var MAX_NODES = 3e3;
 var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", "build", ".next", "out", "coverage", ".turbo"]);
@@ -36492,7 +36681,7 @@ async function buildDocs(root) {
   const ids = new Set(files.map((f) => relative2(root, f).split("\\").join("/")));
   const nodes = files.map((f) => {
     const rel = relative2(root, f).split("\\").join("/");
-    return { id: rel, label: basename2(rel), kind: "doc", file: rel };
+    return { id: rel, label: basename3(rel), kind: "doc", file: rel };
   });
   const edges = [];
   const seen = /* @__PURE__ */ new Set();
@@ -36507,7 +36696,7 @@ async function buildDocs(root) {
     for (const m of text.matchAll(/\[[^\]]*\]\(([^)]+)\)/g)) {
       const href = (m[1] ?? "").split("#")[0].trim();
       if (!href || !href.endsWith(".md") || href.startsWith("http")) continue;
-      const target = relative2(root, resolve4(dirname6(f), href)).split("\\").join("/");
+      const target = relative2(root, resolve5(dirname7(f), href)).split("\\").join("/");
       if (ids.has(target) && target !== rel) {
         const key = `${rel}->${target}`;
         if (!seen.has(key)) {
@@ -36591,7 +36780,7 @@ async function buildGraph(root, mode) {
 }
 
 // src/core/rag.ts
-import { readFile as readFile9, writeFile as writeFile7, statfs as statfs2, mkdir as mkdir6 } from "fs/promises";
+import { readFile as readFile9, writeFile as writeFile8, statfs as statfs2, mkdir as mkdir7 } from "fs/promises";
 import { existsSync as existsSync11 } from "fs";
 import { execFile as execFile4, spawn as spawn8 } from "child_process";
 import { totalmem as totalmem2, cpus as cpus2 } from "os";
@@ -36765,8 +36954,8 @@ if __name__ == "__main__":
     elif cmd == "query": query(sys.argv[2], int(sys.argv[3]) if len(sys.argv) > 3 else 8)
 `;
 async function ensureEngine(root) {
-  await mkdir6(join21(root, RAG_REL), { recursive: true }).catch(() => void 0);
-  await writeFile7(join21(root, RAG_REL, "rag_engine.py"), RAG_ENGINE_PY, "utf8");
+  await mkdir7(join21(root, RAG_REL), { recursive: true }).catch(() => void 0);
+  await writeFile8(join21(root, RAG_REL, "rag_engine.py"), RAG_ENGINE_PY, "utf8");
 }
 async function ragReindex(root) {
   const py = await detectPython();
@@ -36814,7 +37003,7 @@ async function ragInstall(root, model) {
   if (!py.found) return { ok: false, started: false, error: "python3 not found on the worker" };
   if (existsSync11(join21(root, RAG_REL, ".installing"))) return { ok: true, started: true };
   try {
-    await mkdir6(join21(root, RAG_REL), { recursive: true });
+    await mkdir7(join21(root, RAG_REL), { recursive: true });
   } catch {
   }
   const script = `
@@ -36843,13 +37032,13 @@ rm -f "${RAG_REL}/.installing"
 // src/core/git-diff.ts
 import { readFile as readFile10 } from "fs/promises";
 import { execFile as execFile5 } from "child_process";
-import { basename as basename3, dirname as dirname7, resolve as resolve5 } from "path";
+import { basename as basename4, dirname as dirname8, resolve as resolve6 } from "path";
 import { promisify as promisify5 } from "util";
 var run5 = promisify5(execFile5);
 async function gitDiff(path) {
-  const target = resolve5(path);
-  const dir2 = dirname7(target);
-  const base = basename3(target);
+  const target = resolve6(path);
+  const dir2 = dirname8(target);
+  const base = basename4(target);
   let newContent = "";
   try {
     newContent = await readFile10(target, "utf8");
@@ -36901,7 +37090,7 @@ ${stderr}`;
 
 // src/core/git-ssh-key.ts
 import { execFile as execFile7 } from "child_process";
-import { readFile as readFile11, rm as rm3, mkdir as mkdir7 } from "fs/promises";
+import { readFile as readFile11, rm as rm4, mkdir as mkdir8 } from "fs/promises";
 import { join as join22 } from "path";
 import { promisify as promisify7 } from "util";
 var run7 = promisify7(execFile7);
@@ -36934,9 +37123,9 @@ async function configureGit(key) {
 }
 async function generate(profileDir2) {
   const { dir: dir2, key, pub } = keyPaths(profileDir2);
-  await mkdir7(dir2, { recursive: true });
-  await rm3(key, { force: true });
-  await rm3(pub, { force: true });
+  await mkdir8(dir2, { recursive: true });
+  await rm4(key, { force: true });
+  await rm4(pub, { force: true });
   await run7("ssh-keygen", ["-t", "ed25519", "-f", key, "-N", "", "-C", "4pm-deploy-key"], {
     timeout: 15e3
   });
@@ -36945,8 +37134,8 @@ async function generate(profileDir2) {
 }
 async function remove(profileDir2) {
   const { key, pub } = keyPaths(profileDir2);
-  await rm3(key, { force: true });
-  await rm3(pub, { force: true });
+  await rm4(key, { force: true });
+  await rm4(pub, { force: true });
   await run7("git", ["config", "--global", "--unset", "core.sshCommand"], { timeout: 5e3 }).catch(
     () => void 0
   );
@@ -36970,16 +37159,16 @@ async function manageSshKey(op, profileDir2) {
 // src/core/git-history.ts
 import { readdir as readdir6 } from "fs/promises";
 import { execFile as execFile8 } from "child_process";
-import { resolve as resolve6, sep as sep4 } from "path";
+import { resolve as resolve7, sep as sep5 } from "path";
 import { promisify as promisify8 } from "util";
 var run8 = promisify8(execFile8);
 var FS = "";
 var RS = "";
 function resolveRepo(root, repo) {
   if (!root) return null;
-  const base = resolve6(root);
-  const requested = resolve6(base, repo && repo.trim() ? repo : ".");
-  return requested === base || requested.startsWith(base + sep4) ? requested : base;
+  const base = resolve7(root);
+  const requested = resolve7(base, repo && repo.trim() ? repo : ".");
+  return requested === base || requested.startsWith(base + sep5) ? requested : base;
 }
 async function git(cwd2, args) {
   try {
@@ -36995,13 +37184,13 @@ async function git(cwd2, args) {
 }
 async function gitRepos(root) {
   if (!root) return { repos: [] };
-  const base = resolve6(root);
+  const base = resolve7(root);
   const found = /* @__PURE__ */ new Set();
   const repos = [];
   const add = async (dir2) => {
     const inside = await git(dir2, ["rev-parse", "--show-toplevel"]);
     const top = inside.trim();
-    if (!top || found.has(top) || !(top === base || top.startsWith(base + sep4))) return;
+    if (!top || found.has(top) || !(top === base || top.startsWith(base + sep5))) return;
     found.add(top);
     const subdir = top === base ? "" : top.slice(base.length + 1);
     const remote = (await git(top, ["remote", "get-url", "origin"])).trim();
@@ -37012,13 +37201,13 @@ async function gitRepos(root) {
     const lvl1 = await readdir6(base, { withFileTypes: true });
     for (const d of lvl1) {
       if (!d.isDirectory() || d.name === ".git" || d.name === "node_modules") continue;
-      const p1 = resolve6(base, d.name);
+      const p1 = resolve7(base, d.name);
       await add(p1);
       try {
         const lvl2 = await readdir6(p1, { withFileTypes: true });
         for (const d2 of lvl2) {
           if (!d2.isDirectory() || d2.name === ".git" || d2.name === "node_modules") continue;
-          await add(resolve6(p1, d2.name));
+          await add(resolve7(p1, d2.name));
         }
       } catch {
       }
@@ -37097,10 +37286,10 @@ async function setCommitAuthor(cwd2, machineUsername) {
 }
 
 // src/core/scaffold.ts
-import { cp, mkdir as mkdir8, writeFile as writeFile8 } from "fs/promises";
+import { cp, mkdir as mkdir9, writeFile as writeFile9 } from "fs/promises";
 import { existsSync as existsSync12 } from "fs";
 import { execFile as execFile10 } from "child_process";
-import { dirname as dirname8, join as join23, resolve as resolve7 } from "path";
+import { dirname as dirname9, join as join23, resolve as resolve8 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 import { promisify as promisify10 } from "util";
 var run10 = promisify10(execFile10);
@@ -37135,31 +37324,35 @@ async function provisionRepos(target, repos, emit, opts = {}) {
       await run10("git", ["clone", repo.url, dir2], { timeout: 12e4 });
     } else {
       emit("git", `Initializing sub-repo ${subDirName(repo)}\u2026`);
-      await mkdir8(dir2, { recursive: true });
+      await mkdir9(dir2, { recursive: true });
       await run10("git", ["init"], { cwd: dir2, timeout: 2e4 });
     }
   }
 }
 function sampleDir() {
   if (process.env.SCAFFOLD_SAMPLE_DIR) return process.env.SCAFFOLD_SAMPLE_DIR;
-  const here = dirname8(fileURLToPath3(import.meta.url));
-  const bundled = resolve7(here, "project-sample");
-  for (const candidate of [bundled, resolve7(here, "../project-sample"), resolve7(here, "../../project-sample")]) {
+  const here = dirname9(fileURLToPath3(import.meta.url));
+  const bundled = resolve8(here, "project-sample");
+  for (const candidate of [bundled, resolve8(here, "../project-sample"), resolve8(here, "../../project-sample")]) {
     if (existsSync12(candidate)) return candidate;
   }
   return bundled;
 }
 async function scaffoldProject(payload, profileDir2, onProgress) {
-  const emit = (step, message) => onProgress?.({ projectId: payload.projectId, step, message });
+  let lastStep = "start";
+  const emit = (step, message) => {
+    lastStep = step;
+    onProgress?.({ projectId: payload.projectId, step, message });
+  };
   try {
-    const root = process.env.SCAFFOLD_ROOT ? resolve7(process.env.SCAFFOLD_ROOT) : resolve7(profileDir2);
+    const root = process.env.SCAFFOLD_ROOT ? resolve8(process.env.SCAFFOLD_ROOT) : resolve8(profileDir2);
     const target = join23(root, payload.projectName);
-    await mkdir8(target, { recursive: true });
+    await mkdir9(target, { recursive: true });
     emit("copy", "Copying the sample template\u2026");
     await cp(sampleDir(), target, { recursive: true, force: false, errorOnExist: false });
     if (payload.spec) {
       emit("spec", "Writing project.spec.json\u2026");
-      await writeFile8(
+      await writeFile9(
         join23(target, "project.spec.json"),
         JSON.stringify(payload.spec, null, 2),
         "utf8"
@@ -37168,17 +37361,25 @@ async function scaffoldProject(payload, profileDir2, onProgress) {
     const repos = reposOf(payload.spec);
     if (repos.length > 0) await provisionRepos(target, repos, emit);
     if (payload.spec) await aiInit(target, payload.spec, emit);
+    emit("version", "Writing .4pm/.4pm.json\u2026");
+    await writeTemplateMarker(target);
     onProgress?.({ projectId: payload.projectId, step: "done", message: "Scaffold complete.", done: true });
     return { ok: true, path: target };
   } catch (err) {
-    return { ok: false, error: err instanceof Error ? err.message : String(err) };
+    return { ok: false, error: err instanceof Error ? err.message : String(err), step: lastStep };
   }
 }
+async function writeTemplateMarker(target) {
+  const dir2 = join23(target, ".4pm");
+  await mkdir9(dir2, { recursive: true });
+  const marker = { templateVersion: PROJECT_TEMPLATE.version, scaffoldedAt: (/* @__PURE__ */ new Date()).toISOString() };
+  await writeFile9(join23(dir2, ".4pm.json"), JSON.stringify(marker, null, 2) + "\n", "utf8");
+}
 async function aiInit(target, spec, emit) {
   emit("ai-init", "AI init: subagents, README, CLAUDE.md\u2026");
   const subagents = Array.isArray(spec.subagents) ? spec.subagents : [];
   if (subagents.length > 0) {
-    await mkdir8(join23(target, ".claude", "agents"), { recursive: true });
+    await mkdir9(join23(target, ".claude", "agents"), { recursive: true });
     for (const sa of subagents) {
       const name = (sa.name || "").trim().replace(/[^\w.-]+/g, "-").replace(/^-+|-+$/g, "");
       if (!name) continue;
@@ -37188,7 +37389,7 @@ name: ${name}
 
 ${(sa.description || "").trim()}
 `;
-      await writeFile8(join23(target, ".claude", "agents", `${name}.md`), body, "utf8");
+      await writeFile9(join23(target, ".claude", "agents", `${name}.md`), body, "utf8");
     }
   }
   const specJson = JSON.stringify(spec);
@@ -37206,22 +37407,26 @@ ${specJson}`
 async function generateFile(path, prompt) {
   try {
     const text = await aiGenerate(prompt);
-    if (text.trim()) await writeFile8(path, text.trim() + "\n", "utf8");
+    if (text.trim()) await writeFile9(path, text.trim() + "\n", "utf8");
   } catch {
   }
 }
 async function addProject(payload, profileDir2, onProgress) {
-  const emit = (step, message) => onProgress?.({ projectId: payload.projectId, step, message });
+  let lastStep = "start";
+  const emit = (step, message) => {
+    lastStep = step;
+    onProgress?.({ projectId: payload.projectId, step, message });
+  };
   try {
-    const root = process.env.SCAFFOLD_ROOT ? resolve7(process.env.SCAFFOLD_ROOT) : resolve7(profileDir2);
+    const root = process.env.SCAFFOLD_ROOT ? resolve8(process.env.SCAFFOLD_ROOT) : resolve8(profileDir2);
     const target = join23(root, payload.projectName);
-    await mkdir8(target, { recursive: true });
+    await mkdir9(target, { recursive: true });
     const repos = payload.repos ?? [];
     if (repos.length > 0) await provisionRepos(target, repos, emit, { clonePrimary: true });
     onProgress?.({ projectId: payload.projectId, step: "done", message: "Project added.", done: true });
     return { ok: true, path: target };
   } catch (err) {
-    return { ok: false, error: err instanceof Error ? err.message : String(err) };
+    return { ok: false, error: err instanceof Error ? err.message : String(err), step: lastStep };
   }
 }
 
@@ -37639,7 +37844,7 @@ function buildPrompt3(input) {
   ].join("\n");
 }
 function runOnce2(cmd, profile, prompt, cwd2, extraEnv) {
-  return new Promise((resolve8, reject) => {
+  return new Promise((resolve9, reject) => {
     const args = ["-p", ...profile?.model ? ["--model", profile.model] : []];
     const env3 = {
       ...process.env,
@@ -37662,7 +37867,7 @@ function runOnce2(cmd, profile, prompt, cwd2, extraEnv) {
     });
     child.on("close", (code) => {
       clearTimeout(timer);
-      resolve8({ code: code ?? -1, out, err });
+      resolve9({ code: code ?? -1, out, err });
     });
     child.stdin.write(prompt);
     child.stdin.end();
@@ -37937,14 +38142,14 @@ var WsClient = class {
    */
   awaitConnected(timeoutMs) {
     if (this.sessionKey && this.bus.status === "connected") return Promise.resolve(true);
-    return new Promise((resolve8) => {
+    return new Promise((resolve9) => {
       const waiter = () => {
         clearTimeout(timer);
-        resolve8(true);
+        resolve9(true);
       };
       const timer = setTimeout(() => {
         this.connectWaiters = this.connectWaiters.filter((w) => w !== waiter);
-        resolve8(false);
+        resolve9(false);
       }, timeoutMs);
       this.connectWaiters.push(waiter);
     });
@@ -37971,16 +38176,16 @@ var WsClient = class {
       this.forceReconnect = false;
       return Promise.resolve();
     }
-    return new Promise((resolve8) => {
+    return new Promise((resolve9) => {
       const timer = setTimeout(() => {
         this.wakeReconnect = null;
-        resolve8();
+        resolve9();
       }, ms);
       this.wakeReconnect = () => {
         clearTimeout(timer);
         this.wakeReconnect = null;
         this.forceReconnect = false;
-        resolve8();
+        resolve9();
       };
     });
   }
@@ -38034,7 +38239,7 @@ var WsClient = class {
    * One WS session: token → connect → handshake → handle messages until close.
    */
   connectOnce() {
-    return new Promise((resolve8, reject) => {
+    return new Promise((resolve9, reject) => {
       void (async () => {
         this.sessionEstablished = false;
         this.bus.setStatus("connecting");
@@ -38128,7 +38333,7 @@ var WsClient = class {
           if (code === CLOSE_DRAINING) {
             this.bus.log("Server draining \u2014 will reconnect (backoff + jitter).");
           }
-          resolve8();
+          resolve9();
         });
         socket.on("error", (err) => {
           this.clearHeartbeat();
@@ -38285,7 +38490,9 @@ var WsClient = class {
               dispatch.commandId,
               "server",
               dispatch.aiOneShot ?? false,
-              dispatch.images
+              dispatch.images,
+              dispatch.aiConfig,
+              dispatch.aiReadOnly ?? false
             );
           }
           break;
@@ -38341,6 +38548,13 @@ var WsClient = class {
         );
         break;
       }
+      case WsChannels.FS_MUTATE: {
+        const req = payload;
+        void mutateFs(this.physicRoot, req).then(
+          (reply) => this.send(WsChannels.FS_MUTATE, reply, message.id)
+        );
+        break;
+      }
       case WsChannels.SUPPORT_ANSWER: {
         const req = payload;
         const supportConfig = readProfileConfig(this.context.profileDir);
@@ -38775,7 +38989,7 @@ var WsClient = class {
    * exactly like typing the prompt in the cli (tries profiles, meters real tokens) instead
    * of spawning the text as a raw command. Streams output to the transcript AND the server.
    */
-  async runAiPrompt(prompt, commandId, origin, oneShot = false, images) {
+  async runAiPrompt(prompt, commandId, origin, oneShot = false, images, aiConfig, readOnly = false) {
     const config = readProfileConfig(this.context.profileDir);
     const projectTimeoutSec = config.projectAiRunTimeoutSec ?? 0;
     const machineTimeoutSec = config.aiRunTimeoutSec ?? 0;
@@ -38847,7 +39061,7 @@ var WsClient = class {
     const guardedPrompt = this.restrictToFolder && this.physicRoot ? folderScopeGuard(this.physicRoot, aiBodyPrompt) : aiBodyPrompt;
     const hint = unified ? { credential: startCred ?? workingCred } : { dir: startDir ?? workingDir };
     const memCfg = resolveMemoryConfig(config);
-    const firstAttempt = planAiRun(guardedPrompt, config, hint).attempts[0];
+    const firstAttempt = planAiRun(guardedPrompt, config, hint, /* @__PURE__ */ new Map(), oneShot, aiConfig, readOnly).attempts[0];
     const resumeId = memCfg.enabled && firstAttempt?.key && firstAttempt.cmd === "claude" ? this.sessionIdByKey.get(firstAttempt.key) : void 0;
     let effectivePrompt = guardedPrompt;
     let resume = /* @__PURE__ */ new Map();
@@ -38859,7 +39073,7 @@ ${this.aiMemory}
 
 ${guardedPrompt}`;
     }
-    const plan = planAiRun(effectivePrompt, config, hint, resume, oneShot);
+    const plan = planAiRun(effectivePrompt, config, hint, resume, oneShot, aiConfig, readOnly);
     const markerArgs = plan.attempts[0]?.args ?? [];
     const startStamp = formatTimestampInZone(/* @__PURE__ */ new Date(), this.orgTimezone);
     this.bus.push({ source: origin, kind: "aireq", text: `${startStamp} ${plan.cmd} \u2039 ${prompt}` });
@@ -39068,7 +39282,7 @@ ${guardedPrompt}`;
     const info = {
       version: CLI_VERSION,
       scope: this.bus.scope ?? "project",
-      profile: basename4(this.context.profileDir),
+      profile: basename5(this.context.profileDir),
       profileDir: this.context.profileDir,
       serverUrl: this.context.credential.serverUrl,
       physicPath: this.physicRoot ?? config.physicPath ?? null,
@@ -39398,7 +39612,7 @@ ${guardedPrompt}`;
    * Used for quota.check before spawning an AI cli (ADR-0020).
    */
   request(channel, data) {
-    return new Promise((resolve8, reject) => {
+    return new Promise((resolve9, reject) => {
       if (!this.socket || !this.sessionKey) {
         reject(new Error("Not connected to the server."));
         return;
@@ -39418,7 +39632,7 @@ ${guardedPrompt}`;
       }, 15e3);
       timer.unref?.();
       this.pending.set(envelope.id, {
-        resolve: (value) => resolve8(value),
+        resolve: (value) => resolve9(value),
         timer
       });
       this.socket.send(JSON.stringify(envelope));
@@ -39544,7 +39758,7 @@ ${guardedPrompt}`;
       const working = getWorkingProfile(this.context.profileDir, aiCli2);
       const configured = claudeHomeDirs(config);
       const dirs = working ? [working, ...configured.filter((d) => d !== working)] : configured;
-      const profile = working ? basename4(working) : dirs[0] ? basename4(dirs[0]) : "default";
+      const profile = working ? basename5(working) : dirs[0] ? basename5(dirs[0]) : "default";
       const api = await checkClaudeUsage(dirs, aiCli2);
       const snapshot = api ?? {
         plan: "?",
@@ -42003,7 +42217,7 @@ var src_default = Yoga;
 
 // ../../node_modules/.pnpm/ink@5.2.1_@types+react@18.3.31_react@18.3.1/node_modules/ink/build/reconciler.js
 var import_react_reconciler = __toESM(require_react_reconciler(), 1);
-var import_constants7 = __toESM(require_constants2(), 1);
+var import_constants8 = __toESM(require_constants2(), 1);
 import process3 from "process";
 
 // ../../node_modules/.pnpm/ansi-regex@6.2.2/node_modules/ansi-regex/index.js
@@ -43245,7 +43459,7 @@ var reconciler_default = (0, import_react_reconciler.default)({
   scheduleTimeout: setTimeout,
   cancelTimeout: clearTimeout,
   noTimeout: -1,
-  getCurrentEventPriority: () => import_constants7.DefaultEventPriority,
+  getCurrentEventPriority: () => import_constants8.DefaultEventPriority,
   beforeActiveInstanceBlur() {
   },
   afterActiveInstanceBlur() {
@@ -45319,8 +45533,8 @@ var Ink = class {
     }
   }
   async waitUntilExit() {
-    this.exitPromise ||= new Promise((resolve8, reject) => {
-      this.resolveExitPromise = resolve8;
+    this.exitPromise ||= new Promise((resolve9, reject) => {
+      this.resolveExitPromise = resolve9;
       this.rejectExitPromise = reject;
     });
     return this.exitPromise;
@@ -46381,7 +46595,7 @@ async function runStart(profileDir2, profileName) {
           logger.error("ws.run.crash", { message: e.message, stack: e.stack });
           if (client.isStopped) return;
           bus.log(`Recovered from an internal error \u2014 reconnecting: ${e.message}`, "error");
-          await new Promise((resolve8) => setTimeout(resolve8, 1e3));
+          await new Promise((resolve9) => setTimeout(resolve9, 1e3));
         }
       }
     };
@@ -46427,7 +46641,7 @@ import { join as join31 } from "path";
 // src/core/control-client.ts
 import { connect as connect2 } from "net";
 function connectControl(socketPath, bus) {
-  return new Promise((resolve8, reject) => {
+  return new Promise((resolve9, reject) => {
     const socket = connect2(socketPath);
     socket.setEncoding("utf8");
     let ready = false;
@@ -46474,7 +46688,7 @@ function connectControl(socketPath, bus) {
           bus.setTokens(frame.tokens);
           for (const entry of frame.transcript) bus.pushEntry(entry);
           ready = true;
-          resolve8({ info: frame.info, close });
+          resolve9({ info: frame.info, close });
           break;
         case "transcript":
           bus.pushEntry(frame.entry);
@@ -46555,18 +46769,18 @@ async function runAttach(profileDir2, profileName) {
 // src/commands/ai-login.ts
 import { spawn as spawn11 } from "child_process";
 import { mkdirSync as mkdirSync7 } from "fs";
-import { basename as basename5 } from "path";
+import { basename as basename6 } from "path";
 function runProviderLogin(cmd, envVar, dir2) {
-  return new Promise((resolve8) => {
+  return new Promise((resolve9) => {
     const child = spawn11(cmd, [], {
       stdio: "inherit",
       env: { ...process.env, [envVar]: dir2 }
     });
     child.on("error", (err) => {
       console.error(`  \u2716 Could not launch \`${cmd}\` \u2014 is it installed? (${err.message})`);
-      resolve8(1);
+      resolve9(1);
     });
-    child.on("exit", (code) => resolve8(code ?? 0));
+    child.on("exit", (code) => resolve9(code ?? 0));
   });
 }
 async function runAiLogin(profileDir2, profileName, aiFilter) {
@@ -46579,7 +46793,7 @@ async function runAiLogin(profileDir2, profileName, aiFilter) {
     return;
   }
   const selected = aiFilter ? credentials.filter(
-    (c, i) => c.profile === aiFilter || basename5(resolveHomePath(c.profile)) === aiFilter || String(i + 1) === aiFilter
+    (c, i) => c.profile === aiFilter || basename6(resolveHomePath(c.profile)) === aiFilter || String(i + 1) === aiFilter
   ) : credentials;
   if (selected.length === 0) {
     console.log(`No AI profile matches --ai "${aiFilter}". Available: ${credentials.map((c) => c.profile).join(", ")}`);
@@ -46712,10 +46926,10 @@ function Picker({
   ] });
 }
 function selectFromList(items, title) {
-  return new Promise((resolve8) => {
+  return new Promise((resolve9) => {
     let chosen = null;
     const app = render_default(/* @__PURE__ */ (0, import_jsx_runtime7.jsx)(Picker, { items, title, onDone: (v) => chosen = v }));
-    void app.waitUntilExit().then(() => resolve8(chosen));
+    void app.waitUntilExit().then(() => resolve9(chosen));
   });
 }