@adhdev/daemon-core 0.9.82-rc.165 → 0.9.82-rc.166

package/dist/index.js

@@ -106,8 +106,8 @@ function normalizeGitOutput(value) {
   return String(value).replace(/\r\n/g, "\n");
 }
 function isPathInside(parent, child) {
-  const relative4 = path.relative(path.resolve(parent), path.resolve(child));
-  return relative4 === "" || !relative4.startsWith("..") && !path.isAbsolute(relative4);
+  const relative5 = path.relative(path.resolve(parent), path.resolve(child));
+  return relative5 === "" || !relative5.startsWith("..") && !path.isAbsolute(relative5);
 }
 async function validateWorkspace(workspace) {
   if (typeof workspace !== "string" || workspace.length === 0 || workspace.includes("\0")) {
@@ -770,10 +770,10 @@ function getMeshConfigPath() {
   return (0, import_path2.join)(getConfigDir(), "meshes.json");
 }
 function loadMeshConfig() {
-  const path39 = getMeshConfigPath();
-  if (!(0, import_fs2.existsSync)(path39)) return { meshes: [] };
+  const path40 = getMeshConfigPath();
+  if (!(0, import_fs2.existsSync)(path40)) return { meshes: [] };
   try {
-    const raw = JSON.parse((0, import_fs2.readFileSync)(path39, "utf-8"));
+    const raw = JSON.parse((0, import_fs2.readFileSync)(path40, "utf-8"));
     if (!raw || !Array.isArray(raw.meshes)) return { meshes: [] };
     return raw;
   } catch {
@@ -781,16 +781,16 @@ function loadMeshConfig() {
   }
 }
 function saveMeshConfig(config) {
-  const path39 = getMeshConfigPath();
-  (0, import_fs2.writeFileSync)(path39, JSON.stringify(config, null, 2), { encoding: "utf-8", mode: 384 });
+  const path40 = getMeshConfigPath();
+  (0, import_fs2.writeFileSync)(path40, JSON.stringify(config, null, 2), { encoding: "utf-8", mode: 384 });
 }
 function normalizeRepoIdentity(remoteUrl) {
   let identity = remoteUrl.trim();
   if (identity.startsWith("http://") || identity.startsWith("https://")) {
     try {
       const url = new URL(identity);
-      const path39 = url.pathname.replace(/^\//, "").replace(/\.git$/, "");
-      return `${url.hostname}/${path39}`;
+      const path40 = url.pathname.replace(/^\//, "").replace(/\.git$/, "");
+      return `${url.hostname}/${path40}`;
     } catch {
     }
   }
@@ -1718,8 +1718,8 @@ function resolveMeshCoordinatorSetup(options) {
   }
   const serverName = mcpConfig.serverName?.trim() || DEFAULT_SERVER_NAME;
   if (mcpConfig.mode === "auto_import") {
-    const path39 = mcpConfig.path?.trim();
-    if (!path39) {
+    const path40 = mcpConfig.path?.trim();
+    if (!path40) {
       return { kind: "unsupported", reason: "Provider auto-import MCP config is missing a config path" };
     }
     const mcpServer = resolveAdhdevMcpServerLaunch({
@@ -1737,7 +1737,7 @@ function resolveMeshCoordinatorSetup(options) {
     return {
       kind: "auto_import",
       serverName,
-      configPath: resolveMcpConfigPath(path39, workspace),
+      configPath: resolveMcpConfigPath(path40, workspace),
       configFormat: mcpConfig.format,
       mcpServer
     };
@@ -1894,8 +1894,8 @@ function stripCoordinatorWrapperFile(filePath) {
     const remaining = (existing.slice(0, openIdx) + existing.slice(closeIdx + CLOSE.length)).replace(/^\s*\n+/, "").replace(/\n+\s*$/, "");
     if (!remaining.trim()) {
       try {
-        const fs27 = require("fs");
-        fs27.unlinkSync(filePath);
+        const fs28 = require("fs");
+        fs28.unlinkSync(filePath);
       } catch {
       }
     } else {
@@ -2033,10 +2033,10 @@ function rotateArchiveFile(meshId, archivePath) {
   }
 }
 function readArchivedCounts(meshId) {
-  const path39 = getArchivedCountsPath(meshId);
-  if (!(0, import_fs6.existsSync)(path39)) return { taskCompleted: 0, taskFailed: 0, taskStalled: 0, recoveryAttempted: 0, totalArchived: 0, lastArchivedAt: "" };
+  const path40 = getArchivedCountsPath(meshId);
+  if (!(0, import_fs6.existsSync)(path40)) return { taskCompleted: 0, taskFailed: 0, taskStalled: 0, recoveryAttempted: 0, totalArchived: 0, lastArchivedAt: "" };
   try {
-    return JSON.parse((0, import_fs6.readFileSync)(path39, "utf-8"));
+    return JSON.parse((0, import_fs6.readFileSync)(path40, "utf-8"));
   } catch {
     return { taskCompleted: 0, taskFailed: 0, taskStalled: 0, recoveryAttempted: 0, totalArchived: 0, lastArchivedAt: "" };
   }
@@ -2691,10 +2691,10 @@ var init_beads_db = __esm({
         this.migratedMeshIds.add(meshId);
         const count = this.db.prepare("SELECT COUNT(*) AS count FROM mesh_queue WHERE mesh_id = ?").get(meshId);
         if (count.count > 0) return;
-        const path39 = legacyQueuePath(meshId);
-        if (!(0, import_fs7.existsSync)(path39)) return;
+        const path40 = legacyQueuePath(meshId);
+        if (!(0, import_fs7.existsSync)(path40)) return;
         try {
-          const entries = JSON.parse((0, import_fs7.readFileSync)(path39, "utf-8"));
+          const entries = JSON.parse((0, import_fs7.readFileSync)(path40, "utf-8"));
           if (!Array.isArray(entries)) return;
           const insert = this.db.prepare(`
                 INSERT OR REPLACE INTO mesh_queue (
@@ -3404,10 +3404,10 @@ function readPendingMeshCoordinatorEventsFromDisk(meshId, coordinatorDaemonId) {
   if (!meshId) return [];
   const paths = coordinatorDaemonId ? [getPendingEventsPath(meshId, coordinatorDaemonId), getPendingEventsPath(meshId)] : [getPendingEventsPath(meshId)];
   const events = [];
-  for (const path39 of paths) {
-    if (!(0, import_fs9.existsSync)(path39)) continue;
+  for (const path40 of paths) {
+    if (!(0, import_fs9.existsSync)(path40)) continue;
     try {
-      const raw = (0, import_fs9.readFileSync)(path39, "utf-8");
+      const raw = (0, import_fs9.readFileSync)(path40, "utf-8");
       const parsed = raw.split("\n").filter(Boolean).flatMap((line) => {
         try {
           return [JSON.parse(line)];
@@ -3415,7 +3415,7 @@ function readPendingMeshCoordinatorEventsFromDisk(meshId, coordinatorDaemonId) {
           return [];
         }
       });
-      const filtered = coordinatorDaemonId && path39 === getPendingEventsPath(meshId) ? parsed.filter((e) => !e.targetCoordinatorDaemonId || e.targetCoordinatorDaemonId === coordinatorDaemonId) : parsed;
+      const filtered = coordinatorDaemonId && path40 === getPendingEventsPath(meshId) ? parsed.filter((e) => !e.targetCoordinatorDaemonId || e.targetCoordinatorDaemonId === coordinatorDaemonId) : parsed;
       events.push(...filtered);
     } catch {
     }
@@ -3484,13 +3484,13 @@ function reconcilePendingMeshCoordinatorEvents(meshId, events) {
     ...backfilled
   ];
 }
-function trimPendingEventsIfNeeded(path39) {
+function trimPendingEventsIfNeeded(path40) {
   try {
-    if (!(0, import_fs9.existsSync)(path39)) return;
-    if ((0, import_fs9.statSync)(path39).size <= MAX_PENDING_EVENTS_BYTES) return;
-    const lines = (0, import_fs9.readFileSync)(path39, "utf-8").split("\n").filter(Boolean);
+    if (!(0, import_fs9.existsSync)(path40)) return;
+    if ((0, import_fs9.statSync)(path40).size <= MAX_PENDING_EVENTS_BYTES) return;
+    const lines = (0, import_fs9.readFileSync)(path40, "utf-8").split("\n").filter(Boolean);
     if (lines.length <= MAX_PENDING_EVENTS_KEEP) return;
-    (0, import_fs9.writeFileSync)(path39, lines.slice(-MAX_PENDING_EVENTS_KEEP).join("\n") + "\n", "utf-8");
+    (0, import_fs9.writeFileSync)(path40, lines.slice(-MAX_PENDING_EVENTS_KEEP).join("\n") + "\n", "utf-8");
   } catch {
   }
 }
@@ -3504,19 +3504,19 @@ function queuePendingMeshCoordinatorEvent(event) {
       LOG.info("MeshEvents", `Suppressed duplicate pending ${event.event} for mesh ${event.meshId}`);
       return true;
     }
-    const path39 = getPendingEventsPath(event.meshId, event.targetCoordinatorDaemonId);
-    trimPendingEventsIfNeeded(path39);
-    (0, import_fs9.appendFileSync)(path39, JSON.stringify(event) + "\n", "utf-8");
+    const path40 = getPendingEventsPath(event.meshId, event.targetCoordinatorDaemonId);
+    trimPendingEventsIfNeeded(path40);
+    (0, import_fs9.appendFileSync)(path40, JSON.stringify(event) + "\n", "utf-8");
     return true;
   } catch (e) {
     LOG.warn("MeshEvents", `Failed to persist pending coordinator event: ${e?.message || e}`);
     return false;
   }
 }
-function atomicDrainFile(path39) {
-  const tmpPath = `${path39}.draining`;
+function atomicDrainFile(path40) {
+  const tmpPath = `${path40}.draining`;
   try {
-    (0, import_fs9.renameSync)(path39, tmpPath);
+    (0, import_fs9.renameSync)(path40, tmpPath);
   } catch {
     return null;
   }
@@ -3539,8 +3539,8 @@ function drainPendingMeshCoordinatorEvents(meshId, coordinatorDaemonId) {
   if (!meshId) return [];
   const paths = coordinatorDaemonId ? [getPendingEventsPath(meshId, coordinatorDaemonId), getPendingEventsPath(meshId)] : [getPendingEventsPath(meshId)];
   const all = [];
-  for (const path39 of paths) {
-    const content = atomicDrainFile(path39);
+  for (const path40 of paths) {
+    const content = atomicDrainFile(path40);
     if (!content) continue;
     const parsed = content.split("\n").filter(Boolean).flatMap((line) => {
       try {
@@ -3549,7 +3549,7 @@ function drainPendingMeshCoordinatorEvents(meshId, coordinatorDaemonId) {
         return [];
       }
     });
-    const filtered = coordinatorDaemonId && path39 === getPendingEventsPath(meshId) ? parsed.filter((e) => !e.targetCoordinatorDaemonId || e.targetCoordinatorDaemonId === coordinatorDaemonId) : parsed;
+    const filtered = coordinatorDaemonId && path40 === getPendingEventsPath(meshId) ? parsed.filter((e) => !e.targetCoordinatorDaemonId || e.targetCoordinatorDaemonId === coordinatorDaemonId) : parsed;
     all.push(...filtered);
   }
   if (all.length === 0) return [];
@@ -3562,9 +3562,9 @@ function getPendingMeshCoordinatorEvents(meshId, coordinatorDaemonId) {
 function clearPendingMeshCoordinatorEvents(meshId, coordinatorDaemonId) {
   if (!meshId) return;
   const paths = coordinatorDaemonId ? [getPendingEventsPath(meshId, coordinatorDaemonId), getPendingEventsPath(meshId)] : [getPendingEventsPath(meshId)];
-  for (const path39 of paths) {
-    if ((0, import_fs9.existsSync)(path39)) try {
-      (0, import_fs9.unlinkSync)(path39);
+  for (const path40 of paths) {
+    if ((0, import_fs9.existsSync)(path40)) try {
+      (0, import_fs9.unlinkSync)(path40);
     } catch {
     }
   }
@@ -4690,6 +4690,56 @@ var init_debug_config = __esm({
   }
 });
 
+// src/providers/provider-trust.ts
+var provider_trust_exports = {};
+__export(provider_trust_exports, {
+  classifyTrust: () => classifyTrust,
+  describeTrust: () => describeTrust,
+  inspectManifestShape: () => inspectManifestShape,
+  requiresConfirmation: () => requiresConfirmation
+});
+function inspectManifestShape(manifest) {
+  const hasTui = !!manifest.tui && typeof manifest.tui === "object" && Object.keys(manifest.tui).length > 0;
+  const hasOverrides = !!manifest.overrides && typeof manifest.overrides === "object" && !Array.isArray(manifest.overrides) && Object.keys(manifest.overrides).length > 0;
+  const compat = Array.isArray(manifest.compatibility) ? manifest.compatibility : [];
+  const compatHasScriptDir = compat.some((entry) => typeof entry?.scriptDir === "string");
+  const hasScriptDir = compatHasScriptDir || typeof manifest.defaultScriptDir === "string";
+  return { hasTui, hasOverrides, hasScriptDir };
+}
+function classifyTrust(layer, shape) {
+  const isSpecOnly = !shape.hasTui && !shape.hasOverrides && !shape.hasScriptDir;
+  switch (layer) {
+    case "user":
+      return "user-custom";
+    case "upstream":
+      return isSpecOnly ? "trusted" : "trusted-with-scripts";
+    case "external":
+      return isSpecOnly ? "external-safe" : "external-untrusted";
+  }
+}
+function requiresConfirmation(trust) {
+  return trust === "external-untrusted";
+}
+function describeTrust(trust) {
+  switch (trust) {
+    case "user-custom":
+      return "Hand-authored in ~/.adhdev/providers/. Runs your own code.";
+    case "trusted":
+      return "Official, declarative-only manifest from the ADHDev registry.";
+    case "trusted-with-scripts":
+      return "Official manifest from the ADHDev registry. Ships JavaScript hooks executed by the daemon.";
+    case "external-safe":
+      return "Manifest from a 3rd-party git source you added. Declarative-only \u2014 the daemon never runs JS from this source.";
+    case "external-untrusted":
+      return "Manifest from a 3rd-party git source you added. Ships JavaScript that the daemon will execute. Treat as untrusted code \u2014 review the source before enabling.";
+  }
+}
+var init_provider_trust = __esm({
+  "src/providers/provider-trust.ts"() {
+    "use strict";
+  }
+});
+
 // src/providers/sdk/v1/schemas/cli/provider.schema.json
 var provider_schema_default;
 var init_provider_schema = __esm({
@@ -5193,7 +5243,7 @@ function getCliValidator() {
   return _cliValidator;
 }
 function formatIssue(err) {
-  const path39 = err.instancePath || "";
+  const path40 = err.instancePath || "";
   const params = err.params;
   let message = err.message || "validation failed";
   let allowed;
@@ -5211,7 +5261,7 @@ function formatIssue(err) {
   } else if (err.keyword === "type") {
     message = `must be ${params.type}`;
   }
-  return { path: path39, keyword: err.keyword, message, ...allowed !== void 0 ? { allowed } : {} };
+  return { path: path40, keyword: err.keyword, message, ...allowed !== void 0 ? { allowed } : {} };
 }
 function validateCliProviderManifest(manifest) {
   const validator = getCliValidator();
@@ -5238,6 +5288,156 @@ var init_manifest = __esm({
   }
 });
 
+// src/providers/external-sources.ts
+var external_sources_exports = {};
+__export(external_sources_exports, {
+  activeFilePath: () => activeFilePath,
+  deriveSourceName: () => deriveSourceName,
+  externalRoot: () => externalRoot,
+  inventoryExternalSources: () => inventoryExternalSources,
+  loadExternalSources: () => loadExternalSources,
+  loadProvidersActive: () => loadProvidersActive,
+  resolveActiveSource: () => resolveActiveSource,
+  saveExternalSources: () => saveExternalSources,
+  saveProvidersActive: () => saveProvidersActive,
+  sourcesFilePath: () => sourcesFilePath,
+  sourcesProviding: () => sourcesProviding
+});
+function adhdevDir() {
+  return path15.join(os10.homedir(), ".adhdev");
+}
+function externalRoot() {
+  return path15.join(adhdevDir(), "external");
+}
+function sourcesFilePath() {
+  return path15.join(adhdevDir(), SOURCES_FILENAME);
+}
+function activeFilePath() {
+  return path15.join(adhdevDir(), ACTIVE_FILENAME);
+}
+function ensureAdhdevDir() {
+  const d = adhdevDir();
+  if (!fs8.existsSync(d)) fs8.mkdirSync(d, { recursive: true });
+}
+function loadExternalSources() {
+  const p = sourcesFilePath();
+  if (!fs8.existsSync(p)) return { schema: 1, sources: [] };
+  try {
+    const raw = JSON.parse(fs8.readFileSync(p, "utf-8"));
+    if (!raw || typeof raw !== "object") return { schema: 1, sources: [] };
+    const sources = Array.isArray(raw.sources) ? raw.sources.filter(isValidSource) : [];
+    return { schema: 1, sources };
+  } catch {
+    return { schema: 1, sources: [] };
+  }
+}
+function saveExternalSources(file) {
+  ensureAdhdevDir();
+  const tmp = sourcesFilePath() + ".tmp";
+  fs8.writeFileSync(tmp, JSON.stringify(file, null, 2) + "\n", "utf-8");
+  fs8.renameSync(tmp, sourcesFilePath());
+}
+function loadProvidersActive() {
+  const p = activeFilePath();
+  if (!fs8.existsSync(p)) return { schema: 1, active: {} };
+  try {
+    const raw = JSON.parse(fs8.readFileSync(p, "utf-8"));
+    if (!raw || typeof raw !== "object") return { schema: 1, active: {} };
+    const active = raw.active && typeof raw.active === "object" ? raw.active : {};
+    return { schema: 1, active };
+  } catch {
+    return { schema: 1, active: {} };
+  }
+}
+function saveProvidersActive(file) {
+  ensureAdhdevDir();
+  const tmp = activeFilePath() + ".tmp";
+  fs8.writeFileSync(tmp, JSON.stringify(file, null, 2) + "\n", "utf-8");
+  fs8.renameSync(tmp, activeFilePath());
+}
+function isValidSource(x) {
+  if (!x || typeof x !== "object") return false;
+  const s = x;
+  return typeof s.name === "string" && s.name.length > 0 && typeof s.url === "string" && s.url.length > 0 && typeof s.ref === "string" && s.ref.length > 0 && typeof s.addedAt === "string";
+}
+function deriveSourceName(url) {
+  const m = url.match(/[/:]([^/:]+)\/([^/]+?)(?:\.git)?$/);
+  if (!m) return "@source";
+  const owner = m[1].toLowerCase().replace(/[^a-z0-9_-]/g, "-");
+  const repo = m[2].toLowerCase().replace(/[^a-z0-9_-]/g, "-");
+  return `@${owner}-${repo}`;
+}
+function inventoryExternalSources() {
+  const root = externalRoot();
+  if (!fs8.existsSync(root)) return [];
+  const out = [];
+  let entries;
+  try {
+    entries = fs8.readdirSync(root, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  for (const sourceEntry of entries) {
+    if (!sourceEntry.isDirectory()) continue;
+    const sourceName = sourceEntry.name;
+    const sourceDir = path15.join(root, sourceName);
+    const providers = {};
+    let categoryEntries;
+    try {
+      categoryEntries = fs8.readdirSync(sourceDir, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const categoryEntry of categoryEntries) {
+      if (!categoryEntry.isDirectory()) continue;
+      const category = categoryEntry.name;
+      const categoryDir = path15.join(sourceDir, category);
+      let typeEntries;
+      try {
+        typeEntries = fs8.readdirSync(categoryDir, { withFileTypes: true });
+      } catch {
+        continue;
+      }
+      const types = [];
+      for (const typeEntry of typeEntries) {
+        if (!typeEntry.isDirectory()) continue;
+        const typeDir = path15.join(categoryDir, typeEntry.name);
+        const hasV1 = fs8.existsSync(path15.join(typeDir, "provider.v1.json"));
+        const hasV0 = fs8.existsSync(path15.join(typeDir, "provider.json"));
+        if (hasV1 || hasV0) types.push(typeEntry.name);
+      }
+      if (types.length > 0) providers[category] = types;
+    }
+    out.push({ sourceName, providers });
+  }
+  return out;
+}
+function sourcesProviding(category, type) {
+  const inventory = inventoryExternalSources();
+  return inventory.filter((s) => (s.providers[category] || []).includes(type)).map((s) => s.sourceName);
+}
+function resolveActiveSource(category, type, activeFile) {
+  const candidates = sourcesProviding(category, type);
+  if (candidates.length === 0) return { source: null, ambiguous: false, candidates };
+  if (candidates.length === 1) return { source: candidates[0], ambiguous: false, candidates };
+  const explicit = (activeFile ?? loadProvidersActive()).active[type];
+  if (explicit && candidates.includes(explicit)) {
+    return { source: explicit, ambiguous: false, candidates };
+  }
+  return { source: candidates[0], ambiguous: true, candidates };
+}
+var fs8, os10, path15, SOURCES_FILENAME, ACTIVE_FILENAME;
+var init_external_sources = __esm({
+  "src/providers/external-sources.ts"() {
+    "use strict";
+    fs8 = __toESM(require("fs"));
+    os10 = __toESM(require("os"));
+    path15 = __toESM(require("path"));
+    SOURCES_FILENAME = "providers-sources.json";
+    ACTIVE_FILENAME = "providers-active.json";
+  }
+});
+
 // src/cli-adapters/terminal-backends/ghostty-vt-backend.ts
 function isModuleNotFoundError(error, ref) {
   if (!(error instanceof Error)) return false;
@@ -5533,11 +5733,11 @@ function loadNodePty() {
   }
   return cachedPty;
 }
-var os10, cachedPty, NodePtyRuntimeTransport, NodePtyTransportFactory;
+var os11, cachedPty, NodePtyRuntimeTransport, NodePtyTransportFactory;
 var init_pty_transport = __esm({
   "src/cli-adapters/pty-transport.ts"() {
     "use strict";
-    os10 = __toESM(require("os"));
+    os11 = __toESM(require("os"));
     init_spawn_env();
     NodePtyRuntimeTransport = class {
       constructor(handle) {
@@ -5574,11 +5774,11 @@ var init_pty_transport = __esm({
         let cwd = options.cwd;
         if (cwd) {
           try {
-            const fs27 = require("fs");
-            const stat2 = fs27.statSync(cwd);
-            if (!stat2.isDirectory()) cwd = os10.homedir();
+            const fs28 = require("fs");
+            const stat2 = fs28.statSync(cwd);
+            if (!stat2.isDirectory()) cwd = os11.homedir();
           } catch {
-            cwd = os10.homedir();
+            cwd = os11.homedir();
           }
         }
         const handle = pty.spawn(command, args, {
@@ -5670,21 +5870,21 @@ function buildCliScreenSnapshot(text) {
 function findBinary(name) {
   const trimmed = String(name || "").trim();
   if (!trimmed) return trimmed;
-  const expanded = trimmed.startsWith("~") ? path15.join(os11.homedir(), trimmed.slice(1)) : trimmed;
-  if (path15.isAbsolute(expanded) || expanded.includes("/") || expanded.includes("\\")) {
-    return path15.isAbsolute(expanded) ? expanded : path15.resolve(expanded);
+  const expanded = trimmed.startsWith("~") ? path16.join(os12.homedir(), trimmed.slice(1)) : trimmed;
+  if (path16.isAbsolute(expanded) || expanded.includes("/") || expanded.includes("\\")) {
+    return path16.isAbsolute(expanded) ? expanded : path16.resolve(expanded);
   }
-  const isWin = os11.platform() === "win32";
-  const paths = (process.env.PATH || "").split(path15.delimiter);
+  const isWin = os12.platform() === "win32";
+  const paths = (process.env.PATH || "").split(path16.delimiter);
   const exes = isWin ? [".exe", ".cmd", ".bat", ""] : [""];
   for (const p of paths) {
     if (!p) continue;
     for (const ext of exes) {
-      const fullPath = path15.join(p, trimmed + ext);
+      const fullPath = path16.join(p, trimmed + ext);
       try {
-        const fs27 = require("fs");
-        if (fs27.existsSync(fullPath)) {
-          const stat2 = fs27.statSync(fullPath);
+        const fs28 = require("fs");
+        if (fs28.existsSync(fullPath)) {
+          const stat2 = fs28.statSync(fullPath);
           if (stat2.isFile() && (isWin || stat2.mode & 73)) {
             return fullPath;
           }
@@ -5696,14 +5896,14 @@ function findBinary(name) {
   return isWin ? `${trimmed}.cmd` : trimmed;
 }
 function isScriptBinary(binaryPath) {
-  if (!path15.isAbsolute(binaryPath)) return false;
+  if (!path16.isAbsolute(binaryPath)) return false;
   try {
-    const fs27 = require("fs");
-    const resolved = fs27.realpathSync(binaryPath);
+    const fs28 = require("fs");
+    const resolved = fs28.realpathSync(binaryPath);
     const head = Buffer.alloc(8);
-    const fd = fs27.openSync(resolved, "r");
-    fs27.readSync(fd, head, 0, 8, 0);
-    fs27.closeSync(fd);
+    const fd = fs28.openSync(resolved, "r");
+    fs28.readSync(fd, head, 0, 8, 0);
+    fs28.closeSync(fd);
     let i = 0;
     if (head[0] === 239 && head[1] === 187 && head[2] === 191) i = 3;
     return head[i] === 35 && head[i + 1] === 33;
@@ -5712,14 +5912,14 @@ function isScriptBinary(binaryPath) {
   }
 }
 function looksLikeMachOOrElf(filePath) {
-  if (!path15.isAbsolute(filePath)) return false;
+  if (!path16.isAbsolute(filePath)) return false;
   try {
-    const fs27 = require("fs");
-    const resolved = fs27.realpathSync(filePath);
+    const fs28 = require("fs");
+    const resolved = fs28.realpathSync(filePath);
     const buf = Buffer.alloc(8);
-    const fd = fs27.openSync(resolved, "r");
-    fs27.readSync(fd, buf, 0, 8, 0);
-    fs27.closeSync(fd);
+    const fd = fs28.openSync(resolved, "r");
+    fs28.readSync(fd, buf, 0, 8, 0);
+    fs28.closeSync(fd);
     let i = 0;
     if (buf[0] === 239 && buf[1] === 187 && buf[2] === 191) i = 3;
     const b = buf.subarray(i);
@@ -5735,7 +5935,7 @@ function looksLikeMachOOrElf(filePath) {
 }
 function shSingleQuote(arg) {
   if (/^[a-zA-Z0-9@%_+=:,./-]+$/.test(arg)) return arg;
-  if (os11.platform() === "win32") {
+  if (os12.platform() === "win32") {
     return `"${arg.replace(/"/g, '""')}"`;
   }
   return `'${arg.replace(/'/g, `'\\''`)}'`;
@@ -5801,12 +6001,12 @@ function normalizeCliProviderForRuntime(raw) {
     }
   };
 }
-var os11, path15, TerminalTranscriptAccumulator, buildCliSpawnEnv;
+var os12, path16, TerminalTranscriptAccumulator, buildCliSpawnEnv;
 var init_provider_cli_shared = __esm({
   "src/cli-adapters/provider-cli-shared.ts"() {
     "use strict";
-    os11 = __toESM(require("os"));
-    path15 = __toESM(require("path"));
+    os12 = __toESM(require("os"));
+    path16 = __toESM(require("path"));
     init_spawn_env();
     TerminalTranscriptAccumulator = class {
       lines = [[]];
@@ -7695,15 +7895,15 @@ function resolveCliSpawnPlan(options) {
   const { spawn: spawnConfig } = provider;
   const configuredCommand = typeof runtimeSettings.executablePath === "string" && runtimeSettings.executablePath.trim() ? runtimeSettings.executablePath.trim() : spawnConfig.command;
   const binaryPath = findBinary(configuredCommand);
-  const isWin = os12.platform() === "win32";
+  const isWin = os13.platform() === "win32";
   const allArgs = [...spawnConfig.args, ...extraArgs].map(
     (arg) => typeof arg === "string" ? arg.replace(/\{\{workingDir\}\}/g, workingDir) : arg
   );
   let shellCmd;
   let shellArgs;
-  const useShellUnix = !isWin && (!!spawnConfig.shell || !path16.isAbsolute(binaryPath) || isScriptBinary(binaryPath) || !looksLikeMachOOrElf(binaryPath));
+  const useShellUnix = !isWin && (!!spawnConfig.shell || !path17.isAbsolute(binaryPath) || isScriptBinary(binaryPath) || !looksLikeMachOOrElf(binaryPath));
   const isCmdShim = isWin && /\.(cmd|bat)$/i.test(binaryPath);
-  const useShellWin = !!spawnConfig.shell || isCmdShim || !path16.isAbsolute(binaryPath) || isScriptBinary(binaryPath);
+  const useShellWin = !!spawnConfig.shell || isCmdShim || !path17.isAbsolute(binaryPath) || isScriptBinary(binaryPath);
   const useShell = isWin ? useShellWin : useShellUnix;
   if (useShell) {
     shellCmd = isWin ? "cmd.exe" : process.env.SHELL || "/bin/zsh";
@@ -7779,12 +7979,12 @@ function respondToCliTerminalQueries(options) {
   }
   return "";
 }
-var os12, path16, import_session_host_core2;
+var os13, path17, import_session_host_core2;
 var init_provider_cli_runtime = __esm({
   "src/cli-adapters/provider-cli-runtime.ts"() {
     "use strict";
-    os12 = __toESM(require("os"));
-    path16 = __toESM(require("path"));
+    os13 = __toESM(require("os"));
+    path17 = __toESM(require("path"));
     import_session_host_core2 = require("@adhdev/session-host-core");
     init_provider_cli_shared();
   }
@@ -7805,11 +8005,11 @@ function appendBoundedText(current, chunk, maxChars) {
   if (current.length <= keepFromCurrent) return current + chunk;
   return current.slice(-keepFromCurrent) + chunk;
 }
-var os13, ProviderCliAdapter;
+var os14, ProviderCliAdapter;
 var init_provider_cli_adapter = __esm({
   "src/cli-adapters/provider-cli-adapter.ts"() {
     "use strict";
-    os13 = __toESM(require("os"));
+    os14 = __toESM(require("os"));
     init_logger();
     init_debug_config();
     init_terminal_screen();
@@ -7830,7 +8030,7 @@ var init_provider_cli_adapter = __esm({
         this.transportFactory = transportFactory;
         this.cliType = provider.type;
         this.cliName = provider.name;
-        this.workingDir = workingDir.startsWith("~") ? workingDir.replace(/^~/, os13.homedir()) : workingDir;
+        this.workingDir = workingDir.startsWith("~") ? workingDir.replace(/^~/, os14.homedir()) : workingDir;
         const resolvedConfig = resolveCliAdapterConfig(provider);
         this.timeouts = resolvedConfig.timeouts;
         this.approvalKeys = resolvedConfig.approvalKeys;
@@ -9977,7 +10177,7 @@ __export(loader_exports, {
 function loadSpec(sourcePath) {
   let raw;
   try {
-    const text = fs8.readFileSync(sourcePath, "utf8");
+    const text = fs9.readFileSync(sourcePath, "utf8");
     raw = JSON.parse(text);
   } catch (err) {
     return { ok: false, errors: [`Failed to read spec: ${err.message}`], sourcePath };
@@ -10053,14 +10253,14 @@ function compileRegex2(source, flags, where, errs) {
   }
 }
 function resolveSpecPath(providerDir) {
-  return path17.join(providerDir, "spec.json");
+  return path18.join(providerDir, "spec.json");
 }
-var fs8, path17, import_ajv, ajv, validate;
+var fs9, path18, import_ajv, ajv, validate;
 var init_loader = __esm({
   "src/providers/spec/loader.ts"() {
     "use strict";
-    fs8 = __toESM(require("fs"));
-    path17 = __toESM(require("path"));
+    fs9 = __toESM(require("fs"));
+    path18 = __toESM(require("path"));
     import_ajv = __toESM(require("ajv"));
     init_schema_gen();
     ajv = new import_ajv.default({ allErrors: true, strict: false });
@@ -10216,7 +10416,7 @@ function _getRegisteredRoots() {
 }
 function canonicalize(p) {
   try {
-    const resolved = path23.resolve(p);
+    const resolved = path24.resolve(p);
     try {
       return nodeFs.realpathSync.native ? nodeFs.realpathSync.native(resolved) : nodeFs.realpathSync(resolved);
     } catch {
@@ -10236,7 +10436,7 @@ function isCallerInsideGatedRoot(callerFilename) {
   }
   for (const root of _gatedRoots) {
     if (normalized === root.rootPath) return root;
-    if (normalized.startsWith(root.rootPath + path23.sep)) return root;
+    if (normalized.startsWith(root.rootPath + path24.sep)) return root;
   }
   return null;
 }
@@ -10255,16 +10455,16 @@ function ensureInstalled() {
   };
 }
 function gatedRequire(request, parent, isMain, gated, originalLoad) {
-  if (request.startsWith("./") || request.startsWith("../") || path23.isAbsolute(request)) {
+  if (request.startsWith("./") || request.startsWith("../") || path24.isAbsolute(request)) {
     let resolved;
     try {
-      const callerRequire = parent?.filename ? (0, import_node_module2.createRequire)(parent.filename) : (0, import_node_module2.createRequire)(path23.join(gated.rootPath, "__entry__.js"));
+      const callerRequire = parent?.filename ? (0, import_node_module2.createRequire)(parent.filename) : (0, import_node_module2.createRequire)(path24.join(gated.rootPath, "__entry__.js"));
       resolved = callerRequire.resolve(request);
     } catch {
       return originalLoad.call(this, request, parent, isMain);
     }
     const resolvedCanon = canonicalize(resolved) || resolved;
-    if (!(resolvedCanon === gated.rootPath || resolvedCanon.startsWith(gated.rootPath + path23.sep))) {
+    if (!(resolvedCanon === gated.rootPath || resolvedCanon.startsWith(gated.rootPath + path24.sep))) {
       denyRequire(request, parent, `relative path escapes provider root (resolved to ${resolvedCanon})`);
     }
     return originalLoad.call(this, request, parent, isMain);
@@ -10288,11 +10488,11 @@ function denyRequire(request, parent, reason) {
   err.callerFilename = caller;
   throw err;
 }
-var path23, import_node_module2, nodeFs, nodeChildProcess, SAFE_STDLIB, SHIMMED_STDLIB, ALL_GATED_STDLIB, FS_READ_ONLY_MEMBERS, FS_PROMISES_READ_ONLY_MEMBERS, FS_SHIM, CHILD_PROCESS_SHIM, DANGEROUS_PROCESS_METHODS, _processGloballyHardened, _originalProcessMethods, PROCESS_SHIM, _gatedRoots, _installed, PROVIDER_REQUIRE_POLICY;
+var path24, import_node_module2, nodeFs, nodeChildProcess, SAFE_STDLIB, SHIMMED_STDLIB, ALL_GATED_STDLIB, FS_READ_ONLY_MEMBERS, FS_PROMISES_READ_ONLY_MEMBERS, FS_SHIM, CHILD_PROCESS_SHIM, DANGEROUS_PROCESS_METHODS, _processGloballyHardened, _originalProcessMethods, PROCESS_SHIM, _gatedRoots, _installed, PROVIDER_REQUIRE_POLICY;
 var init_require_whitelist = __esm({
   "src/providers/sdk/v1/sandbox/require-whitelist.ts"() {
     "use strict";
-    path23 = __toESM(require("path"));
+    path24 = __toESM(require("path"));
     import_node_module2 = require("module");
     nodeFs = __toESM(require("fs"));
     nodeChildProcess = __toESM(require("child_process"));
@@ -10402,7 +10602,7 @@ function executeJsonl(src, input) {
   } else {
     let stat2 = null;
     try {
-      stat2 = fs12.statSync(resolved);
+      stat2 = fs13.statSync(resolved);
     } catch {
       return null;
     }
@@ -10421,7 +10621,7 @@ function executeJsonl(src, input) {
     const v = jsonPathGet(lines[0], src.session_id_path);
     if (typeof v === "string" && v) providerSessionId = v;
   } else if (src.session_id_from === "filename_uuid" || !src.session_id_from) {
-    const m = path24.basename(sourcePath).match(UUID_RE);
+    const m = path25.basename(sourcePath).match(UUID_RE);
     if (m) providerSessionId = m[1];
   }
   const requested = input.providerSessionId || "";
@@ -10446,7 +10646,7 @@ function executeJsonl(src, input) {
 function readJsonlLines(p) {
   let text;
   try {
-    text = fs12.readFileSync(p, "utf8");
+    text = fs13.readFileSync(p, "utf8");
   } catch {
     return [];
   }
@@ -10463,7 +10663,7 @@ function readJsonlLines(p) {
 }
 function executeSqlite(src, input) {
   const resolved = expandPath2(src.path, input);
-  if (!resolved || !fs12.existsSync(resolved)) return null;
+  if (!resolved || !fs13.existsSync(resolved)) return null;
   let Database;
   try {
     Database = require("better-sqlite3");
@@ -10522,19 +10722,19 @@ function expandPath2(template, input) {
   if (!template) return null;
   let out = template;
   if (out.startsWith("~/") || out === "~") {
-    out = path24.join(os17.homedir(), out.slice(2));
+    out = path25.join(os18.homedir(), out.slice(2));
   }
   out = out.replace(/\$\{([A-Z_][A-Z0-9_]*)(?::-(.*?))?\}/g, (_m, name, fallback) => {
     const v = input.envOverrides?.[name] ?? process.env[name];
     return v != null && v !== "" ? v : fallback ?? "";
   });
-  if (out.startsWith("~/")) out = path24.join(os17.homedir(), out.slice(2));
+  if (out.startsWith("~/")) out = path25.join(os18.homedir(), out.slice(2));
   const now = /* @__PURE__ */ new Date();
   const workspaceRaw = input.workspace ?? "";
   let workspaceResolved = workspaceRaw;
   if (workspaceRaw) {
     try {
-      workspaceResolved = fs12.realpathSync(workspaceRaw);
+      workspaceResolved = fs13.realpathSync(workspaceRaw);
     } catch {
     }
   }
@@ -10576,20 +10776,20 @@ function expandDirGlob(template) {
       for (const d of dirs) {
         let entries;
         try {
-          entries = fs12.readdirSync(d, { withFileTypes: true });
+          entries = fs13.readdirSync(d, { withFileTypes: true });
         } catch {
           continue;
         }
         for (const e of entries) {
-          if (e.isDirectory() && re.test(e.name)) next.push(path24.join(d, e.name));
+          if (e.isDirectory() && re.test(e.name)) next.push(path25.join(d, e.name));
         }
       }
     } else {
       for (const d of dirs) {
-        const candidate = path24.join(d, seg);
+        const candidate = path25.join(d, seg);
         let stat2 = null;
         try {
-          stat2 = fs12.statSync(candidate);
+          stat2 = fs13.statSync(candidate);
         } catch {
           continue;
         }
@@ -10603,13 +10803,13 @@ function expandDirGlob(template) {
 function walkAllDirs(root, out) {
   let entries;
   try {
-    entries = fs12.readdirSync(root, { withFileTypes: true });
+    entries = fs13.readdirSync(root, { withFileTypes: true });
   } catch {
     return;
   }
   out.push(root);
   for (const e of entries) {
-    if (e.isDirectory()) walkAllDirs(path24.join(root, e.name), out);
+    if (e.isDirectory()) walkAllDirs(path25.join(root, e.name), out);
   }
 }
 function newestRecentFileAcrossGlob(template, pattern, windowMs, sessionFloorMs = 0) {
@@ -10619,13 +10819,13 @@ function newestRecentFileAcrossGlob(template, pattern, windowMs, sessionFloorMs
   for (const d of dirs) {
     let entries;
     try {
-      entries = fs12.readdirSync(d, { withFileTypes: true });
+      entries = fs13.readdirSync(d, { withFileTypes: true });
     } catch {
       continue;
     }
     for (const e of entries) {
       if (!e.isFile() || !pattern.test(e.name)) continue;
-      const p = path24.join(d, e.name);
+      const p = path25.join(d, e.name);
       const mtime = safeMtimeMs(p);
       if (mtime < cutoff) continue;
       if (!best || mtime > best.mtime) best = { p, mtime };
@@ -10636,7 +10836,7 @@ function newestRecentFileAcrossGlob(template, pattern, windowMs, sessionFloorMs
 function newestRecentFile(dir, pattern, windowMs, sessionFloorMs = 0) {
   let entries;
   try {
-    entries = fs12.readdirSync(dir, { withFileTypes: true });
+    entries = fs13.readdirSync(dir, { withFileTypes: true });
   } catch {
     return null;
   }
@@ -10644,7 +10844,7 @@ function newestRecentFile(dir, pattern, windowMs, sessionFloorMs = 0) {
   let best = null;
   for (const e of entries) {
     if (!e.isFile() || !pattern.test(e.name)) continue;
-    const p = path24.join(dir, e.name);
+    const p = path25.join(dir, e.name);
     const mtime = safeMtimeMs(p);
     if (mtime < cutoff) continue;
     if (!best || mtime > best.mtime) best = { p, mtime };
@@ -10653,7 +10853,7 @@ function newestRecentFile(dir, pattern, windowMs, sessionFloorMs = 0) {
 }
 function safeMtimeMs(p) {
   try {
-    return Math.floor(fs12.statSync(p).mtimeMs);
+    return Math.floor(fs13.statSync(p).mtimeMs);
   } catch {
     return 0;
   }
@@ -10857,13 +11057,13 @@ function evalTerm(t, record) {
   }
   return t.negate ? !result : result;
 }
-var fs12, os17, path24, UUID_RE;
+var fs13, os18, path25, UUID_RE;
 var init_native_history_executor = __esm({
   "src/providers/spec/native-history-executor.ts"() {
     "use strict";
-    fs12 = __toESM(require("fs"));
-    os17 = __toESM(require("os"));
-    path24 = __toESM(require("path"));
+    fs13 = __toESM(require("fs"));
+    os18 = __toESM(require("os"));
+    path25 = __toESM(require("path"));
     UUID_RE = /([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})/i;
   }
 });
@@ -10881,7 +11081,7 @@ function extractTimestampValue(value) {
 }
 function statMtimeMs(filePath) {
   try {
-    return fs13.statSync(filePath).mtimeMs;
+    return fs14.statSync(filePath).mtimeMs;
   } catch {
     return 0;
   }
@@ -10951,7 +11151,7 @@ function extractUserContentParts(content) {
 function parseTranscriptFile(filePath, sessionId, workspaceFallback) {
   let raw;
   try {
-    raw = fs13.readFileSync(filePath, "utf-8");
+    raw = fs14.readFileSync(filePath, "utf-8");
   } catch {
     return [];
   }
@@ -11024,10 +11224,10 @@ function parseTranscriptFile(filePath, sessionId, workspaceFallback) {
   return records;
 }
 function readSession(sessionPath) {
-  if (!sessionPath || !path25.isAbsolute(sessionPath)) return null;
-  const basename12 = path25.basename(sessionPath, ".jsonl");
+  if (!sessionPath || !path26.isAbsolute(sessionPath)) return null;
+  const basename12 = path26.basename(sessionPath, ".jsonl");
   if (!isSafeSessionId(basename12)) return null;
-  if (!fs13.existsSync(sessionPath)) return null;
+  if (!fs14.existsSync(sessionPath)) return null;
   const sourceMtimeMs = statMtimeMs(sessionPath);
   const messages = parseTranscriptFile(sessionPath, basename12);
   if (messages.length === 0) return null;
@@ -11043,12 +11243,12 @@ function readSession(sessionPath) {
     workspace
   };
 }
-var fs13, path25;
+var fs14, path26;
 var init_claude_cli_transcript = __esm({
   "src/providers/native-history/claude-cli-transcript.ts"() {
     "use strict";
-    fs13 = __toESM(require("fs"));
-    path25 = __toESM(require("path"));
+    fs14 = __toESM(require("fs"));
+    path26 = __toESM(require("path"));
   }
 });
 
@@ -11065,7 +11265,7 @@ function extractTimestampValue2(value) {
 }
 function statMtimeMs2(filePath) {
   try {
-    return fs14.statSync(filePath).mtimeMs;
+    return fs15.statSync(filePath).mtimeMs;
   } catch {
     return 0;
   }
@@ -11133,7 +11333,7 @@ function extractToolOutputContent(payload) {
 }
 function readSessionMeta(filePath) {
   try {
-    const firstLine = fs14.readFileSync(filePath, "utf-8").split("\n").find(Boolean);
+    const firstLine = fs15.readFileSync(filePath, "utf-8").split("\n").find(Boolean);
     if (!firstLine) return null;
     const parsed = JSON.parse(firstLine);
     if (String(parsed.type ?? "") !== "session_meta") return null;
@@ -11145,7 +11345,7 @@ function readSessionMeta(filePath) {
 function parseSessionFile(filePath, sessionId, workspaceFallback) {
   let raw;
   try {
-    raw = fs14.readFileSync(filePath, "utf-8");
+    raw = fs15.readFileSync(filePath, "utf-8");
   } catch {
     return [];
   }
@@ -11239,11 +11439,11 @@ function parseSessionFile(filePath, sessionId, workspaceFallback) {
   return records;
 }
 function readSession2(sessionPath) {
-  if (!sessionPath || !path26.isAbsolute(sessionPath)) return null;
-  if (!fs14.existsSync(sessionPath)) return null;
+  if (!sessionPath || !path27.isAbsolute(sessionPath)) return null;
+  if (!fs15.existsSync(sessionPath)) return null;
   const meta = readSessionMeta(sessionPath);
   const metaId = String(meta?.id ?? "").trim();
-  const basename12 = path26.basename(sessionPath, ".jsonl");
+  const basename12 = path27.basename(sessionPath, ".jsonl");
   const uuidMatch = basename12.match(/([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})/i);
   const filenameUuid = uuidMatch ? uuidMatch[1] : "";
   if (metaId && filenameUuid && metaId !== filenameUuid) return null;
@@ -11265,12 +11465,12 @@ function readSession2(sessionPath) {
     workspace
   };
 }
-var fs14, path26;
+var fs15, path27;
 var init_codex_cli_transcript = __esm({
   "src/providers/native-history/codex-cli-transcript.ts"() {
     "use strict";
-    fs14 = __toESM(require("fs"));
-    path26 = __toESM(require("path"));
+    fs15 = __toESM(require("fs"));
+    path27 = __toESM(require("path"));
   }
 });
 
@@ -11287,7 +11487,7 @@ function extractTimestampValue3(value) {
 }
 function statMtimeMs3(filePath) {
   try {
-    return fs15.statSync(filePath).mtimeMs;
+    return fs16.statSync(filePath).mtimeMs;
   } catch {
     return 0;
   }
@@ -11296,13 +11496,13 @@ function isUuidLike(value) {
   return /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(value);
 }
 function antigravityRoot() {
-  return path27.join(os18.homedir(), ".gemini", "antigravity-cli");
+  return path28.join(os19.homedir(), ".gemini", "antigravity-cli");
 }
 function historyJsonlPath() {
-  return path27.join(antigravityRoot(), "history.jsonl");
+  return path28.join(antigravityRoot(), "history.jsonl");
 }
 function brainRoot() {
-  return path27.join(antigravityRoot(), "brain");
+  return path28.join(antigravityRoot(), "brain");
 }
 function extractUserRequestContent(content) {
   const raw = content.trim();
@@ -11318,7 +11518,7 @@ function antigravityRowKind(rowType) {
 function parseBrainTranscript(filePath, sessionId, workspace) {
   let raw;
   try {
-    raw = fs15.readFileSync(filePath, "utf-8");
+    raw = fs16.readFileSync(filePath, "utf-8");
   } catch {
     return null;
   }
@@ -11378,7 +11578,7 @@ function readHistoryRows() {
   const sourcePath = historyJsonlPath();
   let lines = [];
   try {
-    lines = fs15.readFileSync(sourcePath, "utf-8").split("\n").filter(Boolean);
+    lines = fs16.readFileSync(sourcePath, "utf-8").split("\n").filter(Boolean);
   } catch {
     return [];
   }
@@ -11425,7 +11625,7 @@ function extractStringsFromBuffer(buf) {
 function parsePbFile(filePath, sessionId) {
   let buf;
   try {
-    buf = fs15.readFileSync(filePath);
+    buf = fs16.readFileSync(filePath);
   } catch {
     return null;
   }
@@ -11448,13 +11648,13 @@ function parsePbFile(filePath, sessionId) {
   ];
 }
 function readSession3(sessionPath, sessionId, workspace) {
-  if (!sessionPath || !path27.isAbsolute(sessionPath)) return null;
-  if (!fs15.existsSync(sessionPath)) return null;
+  if (!sessionPath || !path28.isAbsolute(sessionPath)) return null;
+  if (!fs16.existsSync(sessionPath)) return null;
   const sourceMtimeMs = statMtimeMs3(sessionPath);
   const brainRootPath = brainRoot();
-  if (sessionPath.startsWith(brainRootPath + path27.sep) && sessionPath.endsWith(".jsonl")) {
-    const relative4 = sessionPath.slice(brainRootPath.length + 1);
-    const uuidFromPath = relative4.split(path27.sep)[0];
+  if (sessionPath.startsWith(brainRootPath + path28.sep) && sessionPath.endsWith(".jsonl")) {
+    const relative5 = sessionPath.slice(brainRootPath.length + 1);
+    const uuidFromPath = relative5.split(path28.sep)[0];
     const resolvedSessionId = sessionId || (isUuidLike(uuidFromPath) ? uuidFromPath : "");
     if (!resolvedSessionId) return null;
     const messages = parseBrainTranscript(sessionPath, resolvedSessionId, workspace);
@@ -11470,7 +11670,7 @@ function readSession3(sessionPath, sessionId, workspace) {
     };
   }
   if (sessionPath.endsWith(".pb")) {
-    const pbSessionId = sessionId || path27.basename(sessionPath, ".pb");
+    const pbSessionId = sessionId || path28.basename(sessionPath, ".pb");
     if (!isUuidLike(pbSessionId)) return null;
     const messages = parsePbFile(sessionPath, pbSessionId);
     if (!messages || messages.length === 0) return null;
@@ -11484,7 +11684,7 @@ function readSession3(sessionPath, sessionId, workspace) {
       partialReason: "antigravity_cli_pb_raw_text_extraction"
     };
   }
-  if (path27.basename(sessionPath) === "history.jsonl") {
+  if (path28.basename(sessionPath) === "history.jsonl") {
     const resolvedSessionId = sessionId || "";
     if (!resolvedSessionId || !isUuidLike(resolvedSessionId)) return null;
     const rows = readHistoryRows().filter((r) => r.conversationId === resolvedSessionId);
@@ -11529,13 +11729,13 @@ function readSession3(sessionPath, sessionId, workspace) {
   }
   return null;
 }
-var fs15, path27, os18, MIN_PRINTABLE_RUN;
+var fs16, path28, os19, MIN_PRINTABLE_RUN;
 var init_antigravity_cli_transcript = __esm({
   "src/providers/native-history/antigravity-cli-transcript.ts"() {
     "use strict";
-    fs15 = __toESM(require("fs"));
-    path27 = __toESM(require("path"));
-    os18 = __toESM(require("os"));
+    fs16 = __toESM(require("fs"));
+    path28 = __toESM(require("path"));
+    os19 = __toESM(require("os"));
     MIN_PRINTABLE_RUN = 8;
   }
 });
@@ -11543,13 +11743,13 @@ var init_antigravity_cli_transcript = __esm({
 // src/providers/native-history/hermes-cli-transcript.ts
 function statMtimeMs4(p) {
   try {
-    return Math.floor(fs16.statSync(p).mtimeMs);
+    return Math.floor(fs17.statSync(p).mtimeMs);
   } catch {
     return 0;
   }
 }
 function openDb() {
-  if (!fs16.existsSync(HERMES_STATE_DB)) return null;
+  if (!fs17.existsSync(HERMES_STATE_DB)) return null;
   try {
     const Database = require("better-sqlite3");
     return new Database(HERMES_STATE_DB, { readonly: true, fileMustExist: true });
@@ -11606,10 +11806,10 @@ function readSession4(sessionPath) {
       }
     }
   }
-  if (!path28.isAbsolute(sessionPath) || !fs16.existsSync(sessionPath)) return null;
+  if (!path29.isAbsolute(sessionPath) || !fs17.existsSync(sessionPath)) return null;
   let raw;
   try {
-    raw = JSON.parse(fs16.readFileSync(sessionPath, "utf8"));
+    raw = JSON.parse(fs17.readFileSync(sessionPath, "utf8"));
   } catch {
     return null;
   }
@@ -11632,7 +11832,7 @@ function readSession4(sessionPath) {
     });
   }
   if (messages.length === 0) return null;
-  const sessionId = typeof raw.session_id === "string" && raw.session_id ? raw.session_id : path28.basename(sessionPath, ".json").replace(/^session_/, "");
+  const sessionId = typeof raw.session_id === "string" && raw.session_id ? raw.session_id : path29.basename(sessionPath, ".json").replace(/^session_/, "");
   return {
     messages,
     providerSessionId: sessionId,
@@ -11649,15 +11849,15 @@ function normalizeHermesRole(r) {
   if (s === "tool" || s === "tool_result" || s === "function") return "assistant";
   return "system";
 }
-var fs16, path28, os19, HERMES_STATE_DB, HERMES_LEGACY_SESSIONS_DIR;
+var fs17, path29, os20, HERMES_STATE_DB, HERMES_LEGACY_SESSIONS_DIR;
 var init_hermes_cli_transcript = __esm({
   "src/providers/native-history/hermes-cli-transcript.ts"() {
     "use strict";
-    fs16 = __toESM(require("fs"));
-    path28 = __toESM(require("path"));
-    os19 = __toESM(require("os"));
-    HERMES_STATE_DB = path28.join(os19.homedir(), ".hermes", "state.db");
-    HERMES_LEGACY_SESSIONS_DIR = path28.join(os19.homedir(), ".hermes", "sessions");
+    fs17 = __toESM(require("fs"));
+    path29 = __toESM(require("path"));
+    os20 = __toESM(require("os"));
+    HERMES_STATE_DB = path29.join(os20.homedir(), ".hermes", "state.db");
+    HERMES_LEGACY_SESSIONS_DIR = path29.join(os20.homedir(), ".hermes", "sessions");
   }
 });
 
@@ -11705,26 +11905,26 @@ function resolveSourcePath(reader, workspace, sessionId) {
   }
 }
 function resolveClaudePath(workspace, sessionId) {
-  const dir = path29.join(os20.homedir(), ".claude", "projects", cwdAsDashes(workspace));
-  if (!fs17.existsSync(dir)) return null;
+  const dir = path30.join(os21.homedir(), ".claude", "projects", cwdAsDashes(workspace));
+  if (!fs18.existsSync(dir)) return null;
   if (sessionId) {
-    const candidate = path29.join(dir, `${sessionId}.jsonl`);
-    if (fs17.existsSync(candidate)) return candidate;
+    const candidate = path30.join(dir, `${sessionId}.jsonl`);
+    if (fs18.existsSync(candidate)) return candidate;
   }
   return null;
 }
 function resolveCodexPath(workspace) {
   void workspace;
   const now = /* @__PURE__ */ new Date();
-  const dir = path29.join(
-    os20.homedir(),
+  const dir = path30.join(
+    os21.homedir(),
     ".codex",
     "sessions",
     String(now.getUTCFullYear()),
     String(now.getUTCMonth() + 1).padStart(2, "0"),
     String(now.getUTCDate()).padStart(2, "0")
   );
-  if (fs17.existsSync(dir)) {
+  if (fs18.existsSync(dir)) {
     const f = newestRecentFile2(dir, /\.jsonl$/);
     if (f) return f;
   }
@@ -11732,23 +11932,23 @@ function resolveCodexPath(workspace) {
 }
 function resolveAntigravityPath(workspace) {
   void workspace;
-  const brainRoot2 = path29.join(os20.homedir(), ".gemini", "antigravity-cli", "brain");
-  if (!fs17.existsSync(brainRoot2)) return null;
+  const brainRoot2 = path30.join(os21.homedir(), ".gemini", "antigravity-cli", "brain");
+  if (!fs18.existsSync(brainRoot2)) return null;
   const cutoff = Date.now() - RECENT_WINDOW_MS;
-  const entries = fs17.readdirSync(brainRoot2, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => ({ p: path29.join(brainRoot2, e.name), mtime: safeMtime(path29.join(brainRoot2, e.name)) })).filter((e) => e.mtime >= cutoff).sort((a, b) => b.mtime - a.mtime);
+  const entries = fs18.readdirSync(brainRoot2, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => ({ p: path30.join(brainRoot2, e.name), mtime: safeMtime(path30.join(brainRoot2, e.name)) })).filter((e) => e.mtime >= cutoff).sort((a, b) => b.mtime - a.mtime);
   for (const e of entries) {
-    const t = path29.join(e.p, ".system_generated", "logs", "transcript.jsonl");
-    if (fs17.existsSync(t)) return t;
+    const t = path30.join(e.p, ".system_generated", "logs", "transcript.jsonl");
+    if (fs18.existsSync(t)) return t;
   }
   return null;
 }
 function resolveHermesPath(workspace, sessionId) {
   void workspace;
   void sessionId;
-  const dbPath = path29.join(os20.homedir(), ".hermes", "state.db");
-  if (fs17.existsSync(dbPath)) return dbPath;
-  const dir = path29.join(os20.homedir(), ".hermes", "sessions");
-  if (!fs17.existsSync(dir)) return null;
+  const dbPath = path30.join(os21.homedir(), ".hermes", "state.db");
+  if (fs18.existsSync(dbPath)) return dbPath;
+  const dir = path30.join(os21.homedir(), ".hermes", "sessions");
+  if (!fs18.existsSync(dir)) return null;
   return newestRecentFile2(dir, /^session_.*\.json$/);
 }
 function readByReader(reader, sourcePath, sessionId, workspace) {
@@ -11770,7 +11970,7 @@ function cwdAsDashes(cwd) {
 function newestRecentFile2(dir, pattern) {
   try {
     const cutoff = Date.now() - RECENT_WINDOW_MS;
-    const entries = fs17.readdirSync(dir, { withFileTypes: true }).filter((e) => e.isFile() && pattern.test(e.name)).map((e) => ({ p: path29.join(dir, e.name), mtime: safeMtime(path29.join(dir, e.name)) })).filter((e) => e.mtime >= cutoff).sort((a, b) => b.mtime - a.mtime);
+    const entries = fs18.readdirSync(dir, { withFileTypes: true }).filter((e) => e.isFile() && pattern.test(e.name)).map((e) => ({ p: path30.join(dir, e.name), mtime: safeMtime(path30.join(dir, e.name)) })).filter((e) => e.mtime >= cutoff).sort((a, b) => b.mtime - a.mtime);
     return entries[0]?.p ?? null;
   } catch {
     return null;
@@ -11778,7 +11978,7 @@ function newestRecentFile2(dir, pattern) {
 }
 function safeMtime(p) {
   try {
-    return Math.floor(fs17.statSync(p).mtimeMs);
+    return Math.floor(fs18.statSync(p).mtimeMs);
   } catch {
     return 0;
   }
@@ -11790,13 +11990,13 @@ function normalizeRole2(r) {
   if (s === "tool" || s === "tool_result" || s === "function") return "assistant";
   return "system";
 }
-var fs17, os20, path29, RECENT_WINDOW_MS;
+var fs18, os21, path30, RECENT_WINDOW_MS;
 var init_dispatcher = __esm({
   "src/providers/native-history/dispatcher.ts"() {
     "use strict";
-    fs17 = __toESM(require("fs"));
-    os20 = __toESM(require("os"));
-    path29 = __toESM(require("path"));
+    fs18 = __toESM(require("fs"));
+    os21 = __toESM(require("os"));
+    path30 = __toESM(require("path"));
     init_claude_cli_transcript();
     init_codex_cli_transcript();
     init_antigravity_cli_transcript();
@@ -12339,12 +12539,12 @@ function parseSubmoduleStatusOutput(output, repoRoot, ignorePaths) {
     if (!match) continue;
     const prefix = match[1];
     const commit = match[2];
-    const path39 = match[3];
-    if (ignoreSet.has(path39)) continue;
+    const path40 = match[3];
+    if (ignoreSet.has(path40)) continue;
     submodules.push({
-      path: path39,
+      path: path40,
       commit,
-      repoPath: repoRoot + "/" + path39,
+      repoPath: repoRoot + "/" + path40,
       dirty: prefix === "+",
       outOfSync: prefix === "-",
       lastCheckedAt: Date.now()
@@ -13848,10 +14048,10 @@ function getRegistryPath() {
   return (0, import_path3.join)(getDaemonDataDir(), "mesh-coordinators.json");
 }
 function loadMeshCoordinatorRegistry() {
-  const path39 = getRegistryPath();
-  if (!(0, import_fs3.existsSync)(path39)) return;
+  const path40 = getRegistryPath();
+  if (!(0, import_fs3.existsSync)(path40)) return;
   try {
-    const raw = JSON.parse((0, import_fs3.readFileSync)(path39, "utf-8"));
+    const raw = JSON.parse((0, import_fs3.readFileSync)(path40, "utf-8"));
     if (!Array.isArray(raw)) return;
     _registry.clear();
     for (const entry of raw) {
@@ -14070,8 +14270,8 @@ function validateMeshRefineConfig(config, source = "inline") {
   if (rejectedCommands.length) errors.push("one or more validation commands are invalid");
   return { valid: errors.length === 0, errors, bootstrapCommands, commands, rejectedCommands };
 }
-function parseConfigText(path39, text) {
-  if (/\.json$/i.test(path39)) return JSON.parse(text);
+function parseConfigText(path40, text) {
+  if (/\.json$/i.test(path40)) return JSON.parse(text);
   return yaml.load(text);
 }
 function loadMeshRefineConfig(mesh, workspace) {
@@ -14082,16 +14282,16 @@ function loadMeshRefineConfig(mesh, workspace) {
     if (!validation.valid) return { source: "mesh.policy.refineConfig", sourceType: "invalid", error: String(validation.rejectedCommands[0]?.reason || validation.errors.join("; ")) };
     return { config: inline, source: "mesh.policy.refineConfig", sourceType: "mesh_policy" };
   }
-  for (const relative4 of MESH_REFINE_CONFIG_LOCATIONS) {
-    const configPath = (0, import_path4.join)(workspace, relative4);
+  for (const relative5 of MESH_REFINE_CONFIG_LOCATIONS) {
+    const configPath = (0, import_path4.join)(workspace, relative5);
     if (!(0, import_fs4.existsSync)(configPath)) continue;
     try {
       const parsed = parseConfigText(configPath, (0, import_fs4.readFileSync)(configPath, "utf-8"));
-      const validation = validateMeshRefineConfig(parsed, relative4);
-      if (!validation.valid) return { source: relative4, sourceType: "invalid", path: configPath, error: String(validation.rejectedCommands[0]?.reason || validation.errors.join("; ")) };
-      return { config: parsed, source: relative4, sourceType: "repo_file", path: configPath };
+      const validation = validateMeshRefineConfig(parsed, relative5);
+      if (!validation.valid) return { source: relative5, sourceType: "invalid", path: configPath, error: String(validation.rejectedCommands[0]?.reason || validation.errors.join("; ")) };
+      return { config: parsed, source: relative5, sourceType: "repo_file", path: configPath };
     } catch (error) {
-      return { source: relative4, sourceType: "invalid", path: configPath, error: error?.message || String(error) };
+      return { source: relative5, sourceType: "invalid", path: configPath, error: error?.message || String(error) };
     }
   }
   return {
@@ -14224,8 +14424,8 @@ var MESH_WORKTREE_BOOTSTRAP_CONFIG_SCHEMA = {
 var DEFAULT_TIMEOUT_MS2 = 12e4;
 var DEFAULT_OUTPUT_LIMIT_BYTES = 128 * 1024;
 var OUTPUT_SUMMARY_CHARS = 2e3;
-function parseConfigText2(path39, text) {
-  if (/\.json$/i.test(path39)) return JSON.parse(text);
+function parseConfigText2(path40, text) {
+  if (/\.json$/i.test(path40)) return JSON.parse(text);
   return yaml2.load(text);
 }
 function truncateOutput(value) {
@@ -14265,16 +14465,16 @@ function loadMeshWorktreeBootstrapConfig(mesh, workspace) {
     if (!validation.valid) return { source: "mesh.policy.worktreeBootstrapConfig", sourceType: "invalid", error: String(validation.rejectedCommands[0]?.reason || validation.errors.join("; ")) };
     return { config: inline, source: "mesh.policy.worktreeBootstrapConfig", sourceType: "mesh_policy" };
   }
-  for (const relative4 of MESH_WORKTREE_BOOTSTRAP_CONFIG_LOCATIONS) {
-    const configPath = (0, import_path5.join)(workspace, relative4);
+  for (const relative5 of MESH_WORKTREE_BOOTSTRAP_CONFIG_LOCATIONS) {
+    const configPath = (0, import_path5.join)(workspace, relative5);
     if (!(0, import_fs5.existsSync)(configPath)) continue;
     try {
       const parsed = parseConfigText2(configPath, (0, import_fs5.readFileSync)(configPath, "utf-8"));
-      const validation = validateMeshWorktreeBootstrapConfig(parsed, relative4);
-      if (!validation.valid) return { source: relative4, sourceType: "invalid", path: configPath, error: String(validation.rejectedCommands[0]?.reason || validation.errors.join("; ")) };
-      return { config: parsed, source: relative4, sourceType: "repo_file", path: configPath };
+      const validation = validateMeshWorktreeBootstrapConfig(parsed, relative5);
+      if (!validation.valid) return { source: relative5, sourceType: "invalid", path: configPath, error: String(validation.rejectedCommands[0]?.reason || validation.errors.join("; ")) };
+      return { config: parsed, source: relative5, sourceType: "repo_file", path: configPath };
     } catch (error) {
-      return { source: relative4, sourceType: "invalid", path: configPath, error: error?.message || String(error) };
+      return { source: relative5, sourceType: "invalid", path: configPath, error: error?.message || String(error) };
     }
   }
   return { source: "unavailable", sourceType: "unavailable", error: `No worktree bootstrap config found. Checked: ${MESH_WORKTREE_BOOTSTRAP_CONFIG_LOCATIONS.join(", ")}` };
@@ -15515,17 +15715,17 @@ function checkPathExists(paths) {
   return null;
 }
 async function detectIDEs(providerLoader) {
-  const os28 = (0, import_os2.platform)();
+  const os29 = (0, import_os2.platform)();
   const results = [];
   for (const def of getMergedDefinitions()) {
     const cliPath = findCliCommand(providerLoader?.getIdeCliCommand(def.id, def.cli) || def.cli);
-    const appPath = checkPathExists(providerLoader?.getIdePathCandidates(def.id, def.paths[os28] || []) || []);
+    const appPath = checkPathExists(providerLoader?.getIdePathCandidates(def.id, def.paths[os29] || []) || []);
     let resolvedCli = cliPath;
-    if (!resolvedCli && appPath && os28 === "darwin") {
+    if (!resolvedCli && appPath && os29 === "darwin") {
       const bundledCli = `${appPath}/Contents/Resources/app/bin/${def.cli}`;
       if ((0, import_fs11.existsSync)(bundledCli)) resolvedCli = bundledCli;
     }
-    if (!resolvedCli && appPath && os28 === "win32") {
+    if (!resolvedCli && appPath && os29 === "win32") {
       const { dirname: dirname11 } = await import("path");
       const appDir = dirname11(appPath);
       const candidates = [
@@ -15542,7 +15742,7 @@ async function detectIDEs(providerLoader) {
         }
       }
     }
-    const installed = os28 === "darwin" ? !!(resolvedCli || appPath) : !!resolvedCli;
+    const installed = os29 === "darwin" ? !!(resolvedCli || appPath) : !!resolvedCli;
     const version = resolvedCli ? await getIdeVersion(resolvedCli) : null;
     results.push({
       id: def.id,
@@ -25924,6 +26124,14 @@ var DaemonCommandHandler = class {
         return this.handleCheckProviderUpdates(args);
       case "list_installed_providers":
         return this.handleListInstalledProviders(args);
+      case "add_provider_source":
+        return this.handleAddProviderSource(args);
+      case "remove_provider_source":
+        return this.handleRemoveProviderSource(args);
+      case "list_provider_sources":
+        return this.handleListProviderSources(args);
+      case "set_active_provider_source":
+        return this.handleSetActiveProviderSource(args);
       // ─── Stream commands (stream-commands.ts) ───────────
       case "select_session":
         return handleSelectSession(this, args);
@@ -25987,49 +26195,62 @@ var DaemonCommandHandler = class {
     return { success: false, error: "ProviderLoader not initialized" };
   }
   /**
-   * Return per-provider availability so a Marketplace UI can show
-   * "Installed" badges. Reuses the existing detection state from
+   * Return per-provider availability so the dashboard's provider catalog
+   * can show "Installed" badges. Reuses the existing detection state from
    * ProviderLoader.getMachineProviderStatus() — no probing is triggered.
    */
   handleListProviderAvailability(_args) {
     if (!this._ctx.providerLoader) {
       return { success: false, error: "ProviderLoader not initialized" };
     }
+    const { describeTrust: describeTrust2, requiresConfirmation: requiresConfirmation2 } = (init_provider_trust(), __toCommonJS(provider_trust_exports));
     const loader = this._ctx.providerLoader;
     const items = loader.getAll().map((provider) => {
       const machineConfig = loader.getMachineProviderConfig(provider.type);
       const lastDetection = machineConfig.lastDetection;
+      const trust = provider._sourceTrust ?? "trusted";
+      const layer = provider._sourceLayer ?? "upstream";
+      const sourceName = provider._sourceName ?? null;
       return {
         type: provider.type,
         category: provider.category,
         status: loader.getMachineProviderStatus(provider.type),
         installed: lastDetection?.ok === true,
         detectedPath: lastDetection?.path ?? null,
-        checkedAt: lastDetection?.checkedAt ?? null
+        checkedAt: lastDetection?.checkedAt ?? null,
+        trust,
+        trustDescription: describeTrust2(trust),
+        requiresConfirmation: requiresConfirmation2(trust),
+        sourceLayer: layer,
+        sourceName
       };
     });
     return { success: true, providers: items };
   }
   /**
-   * Compute the *Marketplace install root*. This is always
-   * `~/.adhdev/marketplace/` regardless of how ProviderLoader resolved its
-   * userDir (which can point to a sibling adhdev-providers git checkout in
-   * dev). Marketplace-installed manifests must never overwrite files in a
-   * developer checkout, and they should be isolated from upstream/registry
-   * sync so they survive `refresh_scripts`.
+   * Compute the *upstream cache root*. install_provider_manifest writes
+   * official-registry manifests here so the daemon's standard upstream
+   * layer picks them up — no special handling needed at load time, and
+   * the manifests inherit the official-trust badge instead of the
+   * untrusted-external one.
+   *
+   * Path matches ProviderLoader.upstreamDir but we recompute it from
+   * homedir() so this method stays usable in dev where userDir can
+   * point at a sibling git checkout.
    */
-  getMarketplaceInstallRoot() {
-    const os28 = require("os");
-    const path39 = require("path");
-    return path39.join(os28.homedir(), ".adhdev", "marketplace");
+  getUpstreamInstallRoot() {
+    const os29 = require("os");
+    const path40 = require("path");
+    return path40.join(os29.homedir(), ".adhdev", "providers", ".upstream");
   }
   /**
    * Download a single provider manifest from the registry and write it to
-   * ~/.adhdev/marketplace/{category}/{type}/provider.json.
+   * ~/.adhdev/providers/.upstream/{category}/{type}/provider.json.
    *
-   * Used by the Marketplace UI's Install button. Verifies SHA-256 checksum
-   * against the registry meta before persisting. Refuses to write outside
-   * the marketplace root.
+   * Used by standalone onboarding to seed the upstream cache with the
+   * default provider set on first launch. Verifies SHA-256 checksum
+   * against the registry meta before persisting. Refuses to write
+   * outside the upstream root.
    *
    * Args: { type: string, category?: string, version?: string }
    * If category/version are omitted, looks up the latest from the registry.
@@ -26044,8 +26265,8 @@ var DaemonCommandHandler = class {
       return { success: false, error: "invalid type" };
     }
     const https = require("https");
-    const fs27 = require("fs");
-    const path39 = require("path");
+    const fs28 = require("fs");
+    const path40 = require("path");
     const crypto6 = require("crypto");
     const REGISTRY = "https://api.adhf.dev/api/v1/registry";
     function fetchText(url, timeoutMs) {
@@ -26082,13 +26303,13 @@ var DaemonCommandHandler = class {
       if (actualChecksum !== meta.checksum) {
         return { success: false, error: `checksum mismatch: expected ${meta.checksum}, got ${actualChecksum}` };
       }
-      const installRoot = this.getMarketplaceInstallRoot();
-      const installRootResolved = path39.resolve(installRoot);
-      const targetDir = path39.resolve(path39.join(installRoot, category, type));
-      if (!targetDir.startsWith(installRootResolved + path39.sep)) {
-        return { success: false, error: "install path escaped marketplace root" };
+      const installRoot = this.getUpstreamInstallRoot();
+      const installRootResolved = path40.resolve(installRoot);
+      const targetDir = path40.resolve(path40.join(installRoot, category, type));
+      if (!targetDir.startsWith(installRootResolved + path40.sep)) {
+        return { success: false, error: "install path escaped upstream root" };
       }
-      fs27.mkdirSync(targetDir, { recursive: true });
+      fs28.mkdirSync(targetDir, { recursive: true });
       let manifestProbe = {};
       try {
         manifestProbe = JSON.parse(manifestBody);
@@ -26112,8 +26333,8 @@ ${formatManifestValidationIssues2(validation.issues)}`,
         }
       }
       const targetFile = isV1 ? "provider.v1.json" : "provider.json";
-      const targetPath = path39.join(targetDir, targetFile);
-      fs27.writeFileSync(targetPath, manifestBody, "utf-8");
+      const targetPath = path40.join(targetDir, targetFile);
+      fs28.writeFileSync(targetPath, manifestBody, "utf-8");
       const manifestJson = JSON.parse(manifestBody);
       const scriptFetch = await this.fetchProviderSources(
         manifestJson,
@@ -26161,6 +26382,10 @@ ${formatManifestValidationIssues2(validation.issues)}`,
     if (Array.isArray(manifest.compatibility)) {
       for (const c of manifest.compatibility) {
         if (typeof c?.scriptDir === "string") scriptDirs.add(c.scriptDir);
+        if (typeof c?.spec === "string" && c.spec.includes("/")) {
+          const dir = c.spec.substring(0, c.spec.lastIndexOf("/"));
+          if (dir) scriptDirs.add(dir);
+        }
       }
     }
     if (manifest.overrides && typeof manifest.overrides === "object" && !Array.isArray(manifest.overrides)) {
@@ -26179,8 +26404,8 @@ ${formatManifestValidationIssues2(validation.issues)}`,
     const repo = source.repo;
     const ref = source.ref;
     const https = require("https");
-    const fs27 = require("fs");
-    const path39 = require("path");
+    const fs28 = require("fs");
+    const path40 = require("path");
     function fetchJson(url, timeoutMs) {
       return new Promise((resolve23, reject) => {
         const req = https.get(url, {
@@ -26236,9 +26461,9 @@ ${formatManifestValidationIssues2(validation.issues)}`,
     }
     let fetchedCount = 0;
     const sharedDirRel = `${category}/_shared`;
-    const sharedTargetDir = path39.resolve(path39.join(targetDir, "../_shared"));
-    const installRootResolved = path39.resolve(path39.join(targetDir, "../.."));
-    if (sharedTargetDir.startsWith(installRootResolved + path39.sep)) {
+    const sharedTargetDir = path40.resolve(path40.join(targetDir, "../_shared"));
+    const installRootResolved = path40.resolve(path40.join(targetDir, "../.."));
+    if (sharedTargetDir.startsWith(installRootResolved + path40.sep)) {
       const sharedStack = [sharedDirRel];
       while (sharedStack.length) {
         const relDir = sharedStack.pop();
@@ -26261,10 +26486,10 @@ ${formatManifestValidationIssues2(validation.issues)}`,
           try {
             const body = await fetchBinary(entry.download_url, 3e4);
             const relInside = entry.path.startsWith(sharedDirRel + "/") ? entry.path.slice(sharedDirRel.length + 1) : entry.path;
-            const outPath = path39.resolve(path39.join(sharedTargetDir, relInside));
-            if (!outPath.startsWith(path39.resolve(sharedTargetDir) + path39.sep)) continue;
-            fs27.mkdirSync(path39.dirname(outPath), { recursive: true });
-            fs27.writeFileSync(outPath, body);
+            const outPath = path40.resolve(path40.join(sharedTargetDir, relInside));
+            if (!outPath.startsWith(path40.resolve(sharedTargetDir) + path40.sep)) continue;
+            fs28.mkdirSync(path40.dirname(outPath), { recursive: true });
+            fs28.writeFileSync(outPath, body);
             fetchedCount++;
           } catch (e) {
             errors.push(`fetch shared ${entry.path}: ${e?.message ?? e}`);
@@ -26297,13 +26522,13 @@ ${formatManifestValidationIssues2(validation.issues)}`,
           try {
             const body = await fetchBinary(entry.download_url, 3e4);
             const relInsideProvider = entry.path.startsWith(subdir + "/") ? entry.path.slice(subdir.length + 1) : entry.path;
-            const outPath = path39.resolve(path39.join(targetDir, relInsideProvider));
-            if (!outPath.startsWith(path39.resolve(targetDir) + path39.sep)) {
+            const outPath = path40.resolve(path40.join(targetDir, relInsideProvider));
+            if (!outPath.startsWith(path40.resolve(targetDir) + path40.sep)) {
               errors.push(`refusing to write outside targetDir: ${entry.path}`);
               continue;
             }
-            fs27.mkdirSync(path39.dirname(outPath), { recursive: true });
-            fs27.writeFileSync(outPath, body);
+            fs28.mkdirSync(path40.dirname(outPath), { recursive: true });
+            fs28.writeFileSync(outPath, body);
             fetchedCount++;
           } catch (e) {
             errors.push(`fetch ${entry.path}: ${e?.message ?? e}`);
@@ -26314,9 +26539,12 @@ ${formatManifestValidationIssues2(validation.issues)}`,
     return { fetchedCount, source: `${repo}@${ref}`, errors };
   }
   /**
-   * Remove a provider manifest from the marketplace install root
-   * (~/.adhdev/marketplace/{category}/{type}/). Refuses to touch anything
-   * outside that root.
+   * Remove a provider manifest from the upstream cache root
+   * (~/.adhdev/providers/.upstream/{category}/{type}/). Refuses to touch
+   * anything outside that root. Used by onboarding to opt out of a
+   * provider the user doesn't want; the dashboard no longer exposes a
+   * per-provider uninstall button (external sources are removed as a
+   * whole via remove_provider_source).
    */
   async handleUninstallProviderManifest(args) {
     const type = typeof args?.type === "string" ? args.type : "";
@@ -26328,19 +26556,19 @@ ${formatManifestValidationIssues2(validation.issues)}`,
     if (!["cli", "ide", "extension", "acp"].includes(category)) {
       return { success: false, error: `unknown category: ${category}` };
     }
-    const fs27 = require("fs");
-    const path39 = require("path");
+    const fs28 = require("fs");
+    const path40 = require("path");
     try {
-      const installRoot = this.getMarketplaceInstallRoot();
-      const installRootResolved = path39.resolve(installRoot);
-      const targetDir = path39.resolve(path39.join(installRoot, category, type));
-      if (!targetDir.startsWith(installRootResolved + path39.sep)) {
-        return { success: false, error: "refusing to delete outside marketplace root" };
+      const installRoot = this.getUpstreamInstallRoot();
+      const installRootResolved = path40.resolve(installRoot);
+      const targetDir = path40.resolve(path40.join(installRoot, category, type));
+      if (!targetDir.startsWith(installRootResolved + path40.sep)) {
+        return { success: false, error: "refusing to delete outside upstream root" };
       }
-      if (!fs27.existsSync(targetDir)) {
+      if (!fs28.existsSync(targetDir)) {
         return { success: false, error: "not installed" };
       }
-      fs27.rmSync(targetDir, { recursive: true, force: true });
+      fs28.rmSync(targetDir, { recursive: true, force: true });
       if (this._ctx.providerLoader) {
         this._ctx.providerLoader.reload();
         this._ctx.providerLoader.registerToDetector();
@@ -26351,33 +26579,33 @@ ${formatManifestValidationIssues2(validation.issues)}`,
     }
   }
   /**
-   * Return everything currently installed in ~/.adhdev/marketplace/ with its
+   * Return everything currently installed in the upstream cache with its
    * version. This is the "what does this daemon have" answer used both by
    * the UI and by the update checker.
    */
   handleListInstalledProviders(_args) {
-    const fs27 = require("fs");
-    const path39 = require("path");
-    const installRoot = this.getMarketplaceInstallRoot();
-    if (!fs27.existsSync(installRoot)) return { success: true, providers: [] };
+    const fs28 = require("fs");
+    const path40 = require("path");
+    const installRoot = this.getUpstreamInstallRoot();
+    if (!fs28.existsSync(installRoot)) return { success: true, providers: [] };
     const CATEGORIES = ["cli", "ide", "extension", "acp"];
     const items = [];
     for (const category of CATEGORIES) {
-      const categoryDir = path39.join(installRoot, category);
-      if (!fs27.existsSync(categoryDir)) continue;
+      const categoryDir = path40.join(installRoot, category);
+      if (!fs28.existsSync(categoryDir)) continue;
       let entries;
       try {
-        entries = fs27.readdirSync(categoryDir);
+        entries = fs28.readdirSync(categoryDir);
       } catch {
         continue;
       }
       for (const type of entries) {
-        const v1Path = path39.join(categoryDir, type, "provider.v1.json");
-        const v0Path = path39.join(categoryDir, type, "provider.json");
-        const manifestPath = fs27.existsSync(v1Path) ? v1Path : fs27.existsSync(v0Path) ? v0Path : null;
+        const v1Path = path40.join(categoryDir, type, "provider.v1.json");
+        const v0Path = path40.join(categoryDir, type, "provider.json");
+        const manifestPath = fs28.existsSync(v1Path) ? v1Path : fs28.existsSync(v0Path) ? v0Path : null;
         if (!manifestPath) continue;
         try {
-          const m = JSON.parse(fs27.readFileSync(manifestPath, "utf-8"));
+          const m = JSON.parse(fs28.readFileSync(manifestPath, "utf-8"));
           items.push({
             type,
             category,
@@ -26454,6 +26682,196 @@ ${formatManifestValidationIssues2(validation.issues)}`,
     );
     return { success: true, providers: checks };
   }
+  // ─── External provider sources (3rd-party git URLs) ──────────────
+  /**
+   * Register a new external provider source. The daemon clones the repo
+   * to ~/.adhdev/external/<name>/, walks it once to detect provided
+   * types, and surfaces any conflicts with already-installed types so
+   * the dashboard can ask the user how to resolve them.
+   *
+   * Args: { url: string, ref?: string, name?: string }
+   *   - url: https://, git@, or any git-cloneable URL
+   *   - ref: branch/tag/commit (default "main")
+   *   - name: short identifier (default derived from URL)
+   *
+   * Returns: { source, providers, conflicts }
+   *   - conflicts: list of types this new source provides that another
+   *     source already exposes. UI uses this to prompt for active-source
+   *     selection before the load takes effect.
+   */
+  async handleAddProviderSource(args) {
+    const url = typeof args?.url === "string" ? args.url.trim() : "";
+    if (!url) return { success: false, error: "url is required" };
+    const ref = typeof args?.ref === "string" && args.ref.trim() ? args.ref.trim() : "main";
+    if (url.startsWith("-")) return { success: false, error: 'url must not start with "-"' };
+    if (ref.startsWith("-")) return { success: false, error: 'ref must not start with "-"' };
+    if (!/^(https?:\/\/|git@[a-z0-9._-]+:)[a-z0-9._@:/~\-]+$/i.test(url)) {
+      return { success: false, error: "url must be https://\u2026 or git@host:\u2026 and contain only URL-safe characters" };
+    }
+    if (!/^[A-Za-z0-9._/-]+$/.test(ref)) {
+      return { success: false, error: "ref must contain only [A-Za-z0-9._/-]" };
+    }
+    const ext = (init_external_sources(), __toCommonJS(external_sources_exports));
+    const requestedName = typeof args?.name === "string" && args.name.trim() ? args.name.trim() : ext.deriveSourceName(url);
+    if (!/^@[a-z0-9_-]+$/i.test(requestedName)) {
+      return { success: false, error: "name must match @[a-z0-9_-]+" };
+    }
+    const fs28 = require("fs");
+    const path40 = require("path");
+    const { spawnSync: spawnSync2 } = require("child_process");
+    const file = ext.loadExternalSources();
+    if (file.sources.some((s) => s.name === requestedName)) {
+      return { success: false, error: `source name "${requestedName}" is already registered` };
+    }
+    if (file.sources.some((s) => s.url === url && s.ref === ref)) {
+      return { success: false, error: `source url+ref already registered (use a different name to track another ref)` };
+    }
+    const sourceDir = path40.join(ext.externalRoot(), requestedName);
+    if (!fs28.existsSync(ext.externalRoot())) fs28.mkdirSync(ext.externalRoot(), { recursive: true });
+    if (fs28.existsSync(sourceDir)) {
+      return { success: false, error: `directory already exists: ${sourceDir} (rename or remove first)` };
+    }
+    const clone = spawnSync2("git", ["clone", "--depth=1", "--branch", ref, "--", url, sourceDir], {
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "pipe"],
+      timeout: 6e4
+    });
+    if (clone.status !== 0) {
+      try {
+        fs28.rmSync(sourceDir, { recursive: true, force: true });
+      } catch {
+      }
+      return { success: false, error: `git clone failed: ${(clone.stderr || clone.stdout || "").trim() || "unknown error"}` };
+    }
+    const source = {
+      name: requestedName,
+      url,
+      ref,
+      addedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    ext.saveExternalSources({ schema: 1, sources: [...file.sources, source] });
+    const inventory = ext.inventoryExternalSources();
+    const conflicts = [];
+    const newEntry = inventory.find((e) => e.sourceName === requestedName);
+    if (newEntry) {
+      for (const [category, types] of Object.entries(newEntry.providers)) {
+        for (const type of types) {
+          const sources = ext.sourcesProviding(category, type);
+          if (sources.length > 1) conflicts.push({ category, type, sources });
+        }
+      }
+    }
+    if (this._ctx.providerLoader) {
+      this._ctx.providerLoader.reload();
+      this._ctx.providerLoader.registerToDetector();
+    }
+    return {
+      success: true,
+      source,
+      providers: newEntry?.providers ?? {},
+      conflicts
+    };
+  }
+  /**
+   * Remove a registered external source. Deletes the clone directory and
+   * any active-source entry pointing to it.
+   *
+   * Args: { name: string }
+   */
+  async handleRemoveProviderSource(args) {
+    const name = typeof args?.name === "string" ? args.name.trim() : "";
+    if (!name) return { success: false, error: "name is required" };
+    const ext = (init_external_sources(), __toCommonJS(external_sources_exports));
+    const fs28 = require("fs");
+    const path40 = require("path");
+    const file = ext.loadExternalSources();
+    const match = file.sources.find((s) => s.name === name);
+    if (!match) return { success: false, error: `source "${name}" not registered` };
+    const sourceDir = path40.join(ext.externalRoot(), name);
+    if (fs28.existsSync(sourceDir)) {
+      try {
+        fs28.rmSync(sourceDir, { recursive: true, force: true });
+      } catch (e) {
+        return { success: false, error: `failed to delete ${sourceDir}: ${e?.message || e}` };
+      }
+    }
+    ext.saveExternalSources({
+      schema: 1,
+      sources: file.sources.filter((s) => s.name !== name)
+    });
+    const active = ext.loadProvidersActive();
+    const filteredActive = {};
+    for (const [type, src] of Object.entries(active.active)) {
+      if (src !== name) filteredActive[type] = src;
+    }
+    ext.saveProvidersActive({ schema: 1, active: filteredActive });
+    if (this._ctx.providerLoader) {
+      this._ctx.providerLoader.reload();
+      this._ctx.providerLoader.registerToDetector();
+    }
+    return { success: true, removed: { name } };
+  }
+  /**
+   * List registered external sources + each source's currently installed
+   * providers + the active selection for any conflicting types. Used by
+   * the dashboard's "Sources" tab.
+   */
+  handleListProviderSources(_args) {
+    const ext = (init_external_sources(), __toCommonJS(external_sources_exports));
+    const file = ext.loadExternalSources();
+    const inventory = ext.inventoryExternalSources();
+    const active = ext.loadProvidersActive();
+    const sources = file.sources.map((s) => {
+      const inv = inventory.find((e) => e.sourceName === s.name);
+      return {
+        ...s,
+        providers: inv?.providers ?? {}
+      };
+    });
+    const conflictMap = /* @__PURE__ */ new Map();
+    for (const inv of inventory) {
+      for (const [category, types] of Object.entries(inv.providers)) {
+        for (const type of types) {
+          const candidates = ext.sourcesProviding(category, type);
+          if (candidates.length > 1 && !conflictMap.has(type)) {
+            conflictMap.set(type, { category, sources: candidates });
+          }
+        }
+      }
+    }
+    const conflicts = [...conflictMap.entries()].map(([type, info]) => ({
+      type,
+      category: info.category,
+      candidates: info.sources,
+      active: active.active[type] ?? null
+    }));
+    return { success: true, sources, conflicts };
+  }
+  /**
+   * Pick which source's copy of a conflicting provider type is active.
+   * Other sources' copies stay on disk but the loader ignores them.
+   *
+   * Args: { type: string, sourceName: string }
+   */
+  handleSetActiveProviderSource(args) {
+    const type = typeof args?.type === "string" ? args.type.trim() : "";
+    const sourceName = typeof args?.sourceName === "string" ? args.sourceName.trim() : "";
+    if (!type || !sourceName) return { success: false, error: "type and sourceName are required" };
+    const ext = (init_external_sources(), __toCommonJS(external_sources_exports));
+    const inventory = ext.inventoryExternalSources();
+    const entry = inventory.find((e) => e.sourceName === sourceName);
+    if (!entry) return { success: false, error: `source "${sourceName}" not found` };
+    const provided = Object.values(entry.providers).some((types) => types.includes(type));
+    if (!provided) return { success: false, error: `source "${sourceName}" does not provide type "${type}"` };
+    const active = ext.loadProvidersActive();
+    active.active[type] = sourceName;
+    ext.saveProvidersActive(active);
+    if (this._ctx.providerLoader) {
+      this._ctx.providerLoader.reload();
+      this._ctx.providerLoader.registerToDetector();
+    }
+    return { success: true, type, sourceName };
+  }
   // ─── DevServer HTTP proxy helpers ─────────────────
   // These bridge WS commands to the DevServer REST API (localhost:19280)
   async proxyDevServerPost(args, endpoint) {
@@ -26546,8 +26964,8 @@ ${formatManifestValidationIssues2(validation.issues)}`,
 };
 
 // src/commands/cli-manager.ts
-var os16 = __toESM(require("os"));
-var path22 = __toESM(require("path"));
+var os17 = __toESM(require("os"));
+var path23 = __toESM(require("path"));
 var crypto5 = __toESM(require("crypto"));
 var import_fs12 = require("fs");
 var import_child_process5 = require("child_process");
@@ -26557,21 +26975,21 @@ init_cli_detector();
 init_config();
 
 // src/providers/cli-provider-instance.ts
-var os15 = __toESM(require("os"));
-var path20 = __toESM(require("path"));
+var os16 = __toESM(require("os"));
+var path21 = __toESM(require("path"));
 var crypto4 = __toESM(require("crypto"));
-var fs11 = __toESM(require("fs"));
+var fs12 = __toESM(require("fs"));
 var import_node_module = require("module");
 
 // src/providers/spec/route.ts
-var fs10 = __toESM(require("fs"));
-var path19 = __toESM(require("path"));
+var fs11 = __toESM(require("fs"));
+var path20 = __toESM(require("path"));
 init_provider_cli_adapter();
 
 // src/providers/spec/driver.ts
-var fs9 = __toESM(require("fs"));
-var os14 = __toESM(require("os"));
-var path18 = __toESM(require("path"));
+var fs10 = __toESM(require("fs"));
+var os15 = __toESM(require("os"));
+var path19 = __toESM(require("path"));
 
 // src/providers/spec/adapter.ts
 var xtermHeadlessNs = __toESM(require("@xterm/headless"));
@@ -26948,7 +27366,7 @@ var SpecDriver = class {
   }
   armSpecWatcher() {
     try {
-      this.specWatcher = fs9.watch(this.opts.specPath, { persistent: false }, () => {
+      this.specWatcher = fs10.watch(this.opts.specPath, { persistent: false }, () => {
         const res = loadSpec(this.opts.specPath);
         if (!res.ok) {
           this.emit({ kind: "spec_error", errors: res.errors });
@@ -27041,7 +27459,7 @@ var SpecDriver = class {
   }
   fireDelegate(d) {
     const ev = this.currentEval;
-    const task = d.task_template.replace(/\{node\}/g, os14.hostname()).replace(/\{state\.label\}/g, ev?.state.label ?? "").replace(/\{state\.title\}/g, ev?.state.title ?? "").replace(/\{duration_ms\}/g, String(d.after_duration_ms ?? 0));
+    const task = d.task_template.replace(/\{node\}/g, os15.hostname()).replace(/\{state\.label\}/g, ev?.state.label ?? "").replace(/\{state\.title\}/g, ev?.state.title ?? "").replace(/\{duration_ms\}/g, String(d.after_duration_ms ?? 0));
     this.emit({ kind: "delegate", id: d.id, task });
   }
   // ────────────────────────────────────────────────────────────────────
@@ -27110,9 +27528,9 @@ var SpecDriver = class {
     const ctl = (this.spec.control_bar ?? []).find((c) => c.action.type === "attach_image");
     if (!ctl || ctl.action.type !== "attach_image") return;
     const ext = guessExt(mime);
-    const tmp = path18.join(os14.tmpdir(), `adhdev-attach-${Date.now()}${ext}`);
+    const tmp = path19.join(os15.tmpdir(), `adhdev-attach-${Date.now()}${ext}`);
     try {
-      fs9.writeFileSync(tmp, Buffer.from(blob, "base64"));
+      fs10.writeFileSync(tmp, Buffer.from(blob, "base64"));
     } catch {
       return;
     }
@@ -27440,14 +27858,14 @@ init_logger();
 function createCliAdapter(provider, workingDir, cliArgs, extraEnv, transportFactory) {
   const resolvedSpecPath = provider._resolvedSpecPath;
   const dir = provider._resolvedProviderDir;
-  let specPath = resolvedSpecPath && fs10.existsSync(resolvedSpecPath) ? resolvedSpecPath : void 0;
+  let specPath = resolvedSpecPath && fs11.existsSync(resolvedSpecPath) ? resolvedSpecPath : void 0;
   if (!specPath && dir) {
-    const legacy = path19.join(dir, "spec.json");
-    if (fs10.existsSync(legacy)) specPath = legacy;
+    const legacy = path20.join(dir, "spec.json");
+    if (fs11.existsSync(legacy)) specPath = legacy;
   }
   if (specPath) {
     try {
-      LOG.info("spec-route", `[${provider.type}] routing through SpecCliAdapter (${path19.relative(dir || "", specPath) || specPath})`);
+      LOG.info("spec-route", `[${provider.type}] routing through SpecCliAdapter (${path20.relative(dir || "", specPath) || specPath})`);
       return new SpecCliAdapter(specPath, workingDir, cliArgs, extraEnv, transportFactory);
     } catch (err) {
       LOG.warn("spec-route", `[${provider.type}] spec invalid, falling back to ProviderCliAdapter: ${err.message}`);
@@ -27508,7 +27926,7 @@ function filePathFromUri(uri) {
       return uri.slice("file://".length);
     }
   }
-  if (path20.isAbsolute(uri)) return uri;
+  if (path21.isAbsolute(uri)) return uri;
   return null;
 }
 function extensionForImageMime(mimeType) {
@@ -27523,9 +27941,9 @@ function materializeImageDataPart(part, index, dir) {
   if (!part.data) return null;
   const rawData = part.data.includes(",") ? part.data.split(",").pop() || "" : part.data;
   if (!rawData) return null;
-  fs11.mkdirSync(dir, { recursive: true });
-  const filePath = path20.join(dir, safeInputImageBasename(index, part.mimeType));
-  fs11.writeFileSync(filePath, Buffer.from(rawData, "base64"));
+  fs12.mkdirSync(dir, { recursive: true });
+  const filePath = path21.join(dir, safeInputImageBasename(index, part.mimeType));
+  fs12.writeFileSync(filePath, Buffer.from(rawData, "base64"));
   cleanupStaleMaterializedImages(dir);
   return filePath;
 }
@@ -27537,14 +27955,14 @@ function cleanupStaleMaterializedImages(dir) {
   if (now - lastMaterializedImageCleanupAt < MATERIALIZED_IMAGE_CLEANUP_INTERVAL_MS) return;
   lastMaterializedImageCleanupAt = now;
   try {
-    const entries = fs11.readdirSync(dir);
+    const entries = fs12.readdirSync(dir);
     for (const entry of entries) {
       if (!entry.startsWith("adhdev-input-image-")) continue;
-      const fullPath = path20.join(dir, entry);
+      const fullPath = path21.join(dir, entry);
       try {
-        const stat2 = fs11.statSync(fullPath);
+        const stat2 = fs12.statSync(fullPath);
         if (now - stat2.mtimeMs > MATERIALIZED_IMAGE_MAX_AGE_MS) {
-          fs11.unlinkSync(fullPath);
+          fs12.unlinkSync(fullPath);
         }
       } catch {
       }
@@ -27563,7 +27981,7 @@ function buildCliStructuredInputPrompt(input, options = {}) {
   const promptParts = [];
   const imageRefs = [];
   const resourceRefs = [];
-  const materializeDir = options.materializeDir || path20.join(os15.tmpdir(), "adhdev-input-media");
+  const materializeDir = options.materializeDir || path21.join(os16.tmpdir(), "adhdev-input-media");
   input.parts.forEach((part, index) => {
     if (part.type === "text" && part.text.trim()) {
       promptParts.push(part.text.trim());
@@ -27630,7 +28048,7 @@ function buildIncrementalHistoryAppendMessages(previousMessages, currentMessages
 var CachedDatabaseSync = null;
 function getDatabaseSync() {
   if (CachedDatabaseSync) return CachedDatabaseSync;
-  const requireFn = typeof require === "function" ? require : (0, import_node_module.createRequire)(path20.join(process.cwd(), "__adhdev_sqlite_loader__.js"));
+  const requireFn = typeof require === "function" ? require : (0, import_node_module.createRequire)(path21.join(process.cwd(), "__adhdev_sqlite_loader__.js"));
   const sqliteModule = requireFn(`node:${"sqlite"}`);
   CachedDatabaseSync = sqliteModule.DatabaseSync;
   if (!CachedDatabaseSync) {
@@ -27784,10 +28202,10 @@ var CliProviderInstance = class {
    * Replaces the previously duplicated probeOpenCode/Codex/Goose functions.
    */
   probeSessionIdFromConfig(probe) {
-    const resolvedDbPath = probe.dbPath.replace(/^~/, os15.homedir());
+    const resolvedDbPath = probe.dbPath.replace(/^~/, os16.homedir());
     const now = Date.now();
     if (this.cachedSqliteDbMissingUntil > now) return null;
-    if (!fs11.existsSync(resolvedDbPath)) {
+    if (!fs12.existsSync(resolvedDbPath)) {
       this.cachedSqliteDbMissingUntil = now + 1e4;
       return null;
     }
@@ -28889,7 +29307,7 @@ ${effect.notification.body || ""}`.trim();
     };
     addDir(this.workingDir);
     try {
-      addDir(fs11.realpathSync.native(this.workingDir));
+      addDir(fs12.realpathSync.native(this.workingDir));
     } catch {
     }
     return Array.from(dirs);
@@ -28926,7 +29344,7 @@ ${effect.notification.body || ""}`.trim();
 };
 
 // src/providers/acp-provider-instance.ts
-var path21 = __toESM(require("path"));
+var path22 = __toESM(require("path"));
 var import_stream = require("stream");
 var import_child_process4 = require("child_process");
 var import_sdk = require("@agentclientprotocol/sdk");
@@ -29701,7 +30119,7 @@ var AcpProviderInstance = class {
         return b.uri ? {
           type: "resource_link",
           uri: b.uri,
-          name: path21.basename(b.uri),
+          name: path22.basename(b.uri),
           mimeType: b.mimeType,
           ...b.transcript ? { description: b.transcript } : {}
         } : { type: "text", text: b.transcript || `[Video attachment: ${b.mimeType}]` };
@@ -30159,11 +30577,11 @@ function shouldRestoreHostedRuntime(record, managerTag) {
 // src/commands/cli-manager.ts
 function isExplicitCommand(command) {
   const trimmed = command.trim();
-  return path22.isAbsolute(trimmed) || trimmed.includes("/") || trimmed.includes("\\") || trimmed.startsWith("~");
+  return path23.isAbsolute(trimmed) || trimmed.includes("/") || trimmed.includes("\\") || trimmed.startsWith("~");
 }
 function expandExecutable(command) {
   const trimmed = command.trim();
-  return trimmed.startsWith("~") ? path22.join(os16.homedir(), trimmed.slice(1)) : trimmed;
+  return trimmed.startsWith("~") ? path23.join(os17.homedir(), trimmed.slice(1)) : trimmed;
 }
 function commandExists(command) {
   const trimmed = command.trim();
@@ -30290,10 +30708,10 @@ function hasCliArg(args, flag) {
   return args.some((arg) => arg === flag || arg.startsWith(`${flag}=`));
 }
 function ensureEmptyDelegatedMcpConfig(workspace) {
-  const baseDir = path22.join(os16.tmpdir(), "adhdev-delegated-agent-empty-mcp");
+  const baseDir = path23.join(os17.tmpdir(), "adhdev-delegated-agent-empty-mcp");
   (0, import_fs12.mkdirSync)(baseDir, { recursive: true });
-  const workspaceHash = crypto5.createHash("sha256").update(path22.resolve(workspace || os16.tmpdir())).digest("hex").slice(0, 16);
-  const filePath = path22.join(baseDir, `${workspaceHash}.json`);
+  const workspaceHash = crypto5.createHash("sha256").update(path23.resolve(workspace || os17.tmpdir())).digest("hex").slice(0, 16);
+  const filePath = path23.join(baseDir, `${workspaceHash}.json`);
   (0, import_fs12.writeFileSync)(filePath, JSON.stringify({ mcpServers: {} }, null, 2), "utf-8");
   return filePath;
 }
@@ -30587,7 +31005,7 @@ var DaemonCliManager = class {
   async startSession(cliType, workingDir, cliArgs, initialModel, options) {
     const trimmed = (workingDir || "").trim();
     if (!trimmed) throw new Error("working directory required");
-    const resolvedDir = trimmed.startsWith("~") ? trimmed.replace(/^~/, os16.homedir()) : path22.resolve(trimmed);
+    const resolvedDir = trimmed.startsWith("~") ? trimmed.replace(/^~/, os17.homedir()) : path23.resolve(trimmed);
     const normalizedType = this.providerLoader.resolveAlias(cliType);
     const rawProvider = this.providerLoader.getByAlias(cliType);
     const provider = rawProvider ? this.providerLoader.resolve(normalizedType) || rawProvider : void 0;
@@ -30972,6 +31390,20 @@ Run 'adhdev doctor' for detailed diagnostics.`
           cliArgs: args?.cliArgs,
           env: args?.env
         }) : null;
+        const provLookup = this.providerLoader.getMeta(this.providerLoader.resolveAlias(cliType));
+        const provTrust = provLookup?._sourceTrust;
+        if (provTrust === "external-untrusted" && args?.confirmExternalUntrusted !== true) {
+          return {
+            success: false,
+            error: "untrusted_external_provider",
+            provider: {
+              type: provLookup?.type ?? cliType,
+              sourceName: provLookup?._sourceName ?? null,
+              trust: provTrust
+            },
+            hint: "Resend launch_cli with confirmExternalUntrusted=true after the user explicitly approves running JavaScript from this 3rd-party source."
+          };
+        }
         const started = await this.startSession(
           cliType,
           dir,
@@ -31158,13 +31590,13 @@ Run 'adhdev doctor' for detailed diagnostics.`
 // src/launch.ts
 var import_child_process6 = require("child_process");
 var net = __toESM(require("net"));
-var os22 = __toESM(require("os"));
-var path31 = __toESM(require("path"));
+var os23 = __toESM(require("os"));
+var path32 = __toESM(require("path"));
 
 // src/providers/provider-loader.ts
-var fs18 = __toESM(require("fs"));
-var path30 = __toESM(require("path"));
-var os21 = __toESM(require("os"));
+var fs19 = __toESM(require("fs"));
+var path31 = __toESM(require("path"));
+var os22 = __toESM(require("os"));
 var chokidar = __toESM(require("chokidar"));
 init_logger();
 
@@ -31537,9 +31969,9 @@ var ProviderLoader = class _ProviderLoader {
   static siblingStderrLogged = /* @__PURE__ */ new Set();
   static looksLikeProviderRoot(candidate) {
     try {
-      if (!fs18.existsSync(candidate) || !fs18.statSync(candidate).isDirectory()) return false;
+      if (!fs19.existsSync(candidate) || !fs19.statSync(candidate).isDirectory()) return false;
       return ["ide", "extension", "cli", "acp"].some(
-        (category) => fs18.existsSync(path30.join(candidate, category))
+        (category) => fs19.existsSync(path31.join(candidate, category))
       );
     } catch {
       return false;
@@ -31547,20 +31979,20 @@ var ProviderLoader = class _ProviderLoader {
   }
   static hasProviderRootMarker(candidate) {
     try {
-      return fs18.existsSync(path30.join(candidate, _ProviderLoader.SIBLING_MARKER_FILE));
+      return fs19.existsSync(path31.join(candidate, _ProviderLoader.SIBLING_MARKER_FILE));
     } catch {
       return false;
     }
   }
   detectDefaultUserDir() {
-    const fallback = path30.join(os21.homedir(), ".adhdev", "providers");
+    const fallback = path31.join(os22.homedir(), ".adhdev", "providers");
     const envOptIn = process.env[_ProviderLoader.SIBLING_ENV_VAR] === "1";
     const visited = /* @__PURE__ */ new Set();
     for (const start of this.probeStarts) {
-      let current = path30.resolve(start);
+      let current = path31.resolve(start);
       while (!visited.has(current)) {
         visited.add(current);
-        const siblingCandidate = path30.join(path30.dirname(current), _ProviderLoader.REPO_PROVIDER_DIRNAME);
+        const siblingCandidate = path31.join(path31.dirname(current), _ProviderLoader.REPO_PROVIDER_DIRNAME);
         if (_ProviderLoader.looksLikeProviderRoot(siblingCandidate)) {
           const hasMarker = _ProviderLoader.hasProviderRootMarker(siblingCandidate);
           if (envOptIn || hasMarker) {
@@ -31582,7 +32014,7 @@ var ProviderLoader = class _ProviderLoader {
             return { path: siblingCandidate, source };
           }
         }
-        const parent = path30.dirname(current);
+        const parent = path31.dirname(current);
         if (parent === current) break;
         current = parent;
       }
@@ -31592,17 +32024,34 @@ var ProviderLoader = class _ProviderLoader {
   constructor(options) {
     this.logFn = options?.logFn || LOG.forComponent("Provider").asLogFn();
     this.probeStarts = options?.probeStarts ?? [process.cwd(), __dirname];
-    this.defaultProvidersDir = path30.join(os21.homedir(), ".adhdev", "providers");
+    this.defaultProvidersDir = path31.join(os22.homedir(), ".adhdev", "providers");
     const detected = this.detectDefaultUserDir();
     this.userDir = detected.path;
     this.userDirSource = detected.source;
-    this.upstreamDir = path30.join(this.defaultProvidersDir, ".upstream");
+    this.upstreamDir = path31.join(this.defaultProvidersDir, ".upstream");
     this.disableUpstream = false;
     this.applySourceConfig({
       userDir: options?.userDir,
       sourceMode: options?.sourceMode,
       disableUpstream: options?.disableUpstream
     });
+    this.migrateMarketplaceDirToExternal();
+  }
+  migrateMarketplaceDirToExternal() {
+    try {
+      const home = os22.homedir();
+      const oldDir = path31.join(home, ".adhdev", "marketplace");
+      const newDir = path31.join(home, ".adhdev", "external");
+      if (!fs19.existsSync(oldDir)) return;
+      if (fs19.existsSync(newDir)) {
+        this.log(`Migration skipped: both ~/.adhdev/marketplace and ~/.adhdev/external exist (marketplace dir is now inert and can be removed manually).`);
+        return;
+      }
+      fs19.renameSync(oldDir, newDir);
+      this.log(`Migrated ~/.adhdev/marketplace \u2192 ~/.adhdev/external (one-time rename after provider source-layer cleanup).`);
+    } catch (e) {
+      this.log(`Marketplace\u2192external migration failed: ${e?.message || e}`);
+    }
   }
   log(msg) {
     this.logFn(`[ProviderLoader] ${msg}`);
@@ -31628,8 +32077,8 @@ var ProviderLoader = class _ProviderLoader {
    * Highest-priority editable overrides come first.
    */
   getProviderRoots() {
-    const marketplaceDir = path30.join(os21.homedir(), ".adhdev", "marketplace");
-    return [this.userDir, marketplaceDir, this.upstreamDir];
+    const externalDir = path31.join(os22.homedir(), ".adhdev", "external");
+    return [this.userDir, externalDir, this.upstreamDir];
   }
   getSourceConfig() {
     return {
@@ -31656,7 +32105,7 @@ var ProviderLoader = class _ProviderLoader {
       this.userDir = detected.path;
       this.userDirSource = detected.source;
     }
-    this.upstreamDir = path30.join(this.defaultProvidersDir, ".upstream");
+    this.upstreamDir = path31.join(this.defaultProvidersDir, ".upstream");
     this.disableUpstream = this.sourceMode === "no-upstream";
     if (this.explicitProviderDir) {
       this.log(`Config 'providerDir' applied: ${this.userDir}`);
@@ -31670,7 +32119,7 @@ var ProviderLoader = class _ProviderLoader {
   * Canonical provider directory shape for a given root.
   */
   getProviderDir(root, category, type) {
-    return path30.join(root, category, type);
+    return path31.join(root, category, type);
   }
   /**
   * Canonical user override directory for a provider.
@@ -31697,20 +32146,23 @@ var ProviderLoader = class _ProviderLoader {
   resolveProviderFile(type, ...segments) {
     const dir = this.findProviderDirInternal(type);
     if (!dir) return null;
-    return path30.join(dir, ...segments);
+    return path31.join(dir, ...segments);
   }
   /**
   * Load all providers (3-tier priority)
-  * 1. .upstream/ (GitHub auto-download — primary source)
-  * 2. User custom (~/.adhdev/providers/ excluding .upstream)
-  * User custom always wins (highest priority).
+  * 1. ~/.adhdev/providers/.upstream/ — official git, auto-synced
+  * 2. ~/.adhdev/external/ — 3rd-party git sources, user-added,
+  *    bundled providers may include arbitrary JS (untrusted by default)
+  * 3. ~/.adhdev/providers/ (excluding .upstream) — user-authored customs,
+  *    always wins
+  * Highest priority listed last (overwrites earlier loads).
   * If .upstream/ is empty, call fetchLatest() before loadAll().
   */
   loadAll() {
     this.providers.clear();
     this.providerAvailability.clear();
     let upstreamCount = 0;
-    if (!this.disableUpstream && fs18.existsSync(this.upstreamDir)) {
+    if (!this.disableUpstream && fs19.existsSync(this.upstreamDir)) {
       upstreamCount = this.loadDir(this.upstreamDir);
       if (upstreamCount > 0) {
         this.log(`Loaded ${upstreamCount} upstream providers (auto-updated)`);
@@ -31718,14 +32170,64 @@ var ProviderLoader = class _ProviderLoader {
     } else if (this.disableUpstream) {
       this.log("Upstream loading disabled (sourceMode=no-upstream)");
     }
-    const marketplaceDir = path30.join(os21.homedir(), ".adhdev", "marketplace");
-    if (fs18.existsSync(marketplaceDir)) {
-      const marketplaceCount = this.loadDir(marketplaceDir);
-      if (marketplaceCount > 0) {
-        this.log(`Loaded ${marketplaceCount} marketplace-installed providers`);
+    const externalDir = path31.join(os22.homedir(), ".adhdev", "external");
+    if (fs19.existsSync(externalDir)) {
+      const rootEntries = (() => {
+        try {
+          return fs19.readdirSync(externalDir, { withFileTypes: true });
+        } catch {
+          return [];
+        }
+      })();
+      const KNOWN_CATEGORIES = /* @__PURE__ */ new Set(["cli", "ide", "extension", "acp"]);
+      const looksLegacy = rootEntries.some((e) => e.isDirectory() && KNOWN_CATEGORIES.has(e.name));
+      if (looksLegacy) {
+        const externalCount = this.loadDir(externalDir);
+        if (externalCount > 0) {
+          this.log(`Loaded ${externalCount} external providers (legacy unnamed source)`);
+        }
+      } else {
+        const {
+          loadProvidersActive: loadProvidersActive2,
+          resolveActiveSource: resolveActiveSource2
+        } = (init_external_sources(), __toCommonJS(external_sources_exports));
+        const activeFile = loadProvidersActive2();
+        let totalLoaded = 0;
+        const ambiguousTypes = [];
+        for (const sourceEntry of rootEntries) {
+          if (!sourceEntry.isDirectory()) continue;
+          const sourceDir = path31.join(externalDir, sourceEntry.name);
+          const sourceLoaded = this.loadDir(sourceDir);
+          if (sourceLoaded > 0) {
+            totalLoaded += sourceLoaded;
+            this.log(`Loaded ${sourceLoaded} providers from external source "${sourceEntry.name}"`);
+          }
+        }
+        for (const [type] of this.providers) {
+          const prov = this.providers.get(type);
+          if (!prov) continue;
+          const resolved = resolveActiveSource2(prov.category, type, activeFile);
+          if (resolved.candidates.length <= 1) continue;
+          if (resolved.ambiguous) {
+            ambiguousTypes.push({ type, chosen: resolved.source ?? "?", candidates: resolved.candidates });
+          }
+          if (resolved.source && resolved.source !== "?") {
+            const sourceDir = path31.join(externalDir, resolved.source);
+            const reloadCount = this.loadDir(sourceDir);
+            if (reloadCount === 0) {
+              this.log(`Active source "${resolved.source}" no longer provides ${type}`);
+            }
+          }
+        }
+        if (totalLoaded > 0) {
+          this.log(`Loaded ${totalLoaded} external providers (3rd-party sources)`);
+        }
+        for (const a of ambiguousTypes) {
+          this.log(`Ambiguous provider "${a.type}" \u2014 provided by [${a.candidates.join(", ")}], defaulted to "${a.chosen}". Set the active source from the dashboard to silence this warning.`);
+        }
       }
     }
-    if (fs18.existsSync(this.userDir)) {
+    if (fs19.existsSync(this.userDir)) {
       const userCount = this.loadDir(this.userDir, [".upstream"]);
       if (userCount > 0) {
         this.log(`Loaded ${userCount} user custom providers (never auto-updated)`);
@@ -31740,10 +32242,10 @@ var ProviderLoader = class _ProviderLoader {
    * Check if upstream directory exists and has providers.
    */
   hasUpstream() {
-    if (!fs18.existsSync(this.upstreamDir)) return false;
+    if (!fs19.existsSync(this.upstreamDir)) return false;
     try {
-      return fs18.readdirSync(this.upstreamDir).some(
-        (d) => fs18.statSync(path30.join(this.upstreamDir, d)).isDirectory()
+      return fs19.readdirSync(this.upstreamDir).some(
+        (d) => fs19.statSync(path31.join(this.upstreamDir, d)).isDirectory()
       );
     } catch {
       return false;
@@ -32241,8 +32743,8 @@ var ProviderLoader = class _ProviderLoader {
                 resolved._resolvedScriptDir = entry.scriptDir;
                 resolved._resolvedScriptsSource = `compatibility:${entry.ideVersion}`;
                 if (providerDir) {
-                  const fullDir = path30.join(providerDir, entry.scriptDir);
-                  resolved._resolvedScriptsPath = fs18.existsSync(path30.join(fullDir, "scripts.js")) ? path30.join(fullDir, "scripts.js") : fullDir;
+                  const fullDir = path31.join(providerDir, entry.scriptDir);
+                  resolved._resolvedScriptsPath = fs19.existsSync(path31.join(fullDir, "scripts.js")) ? path31.join(fullDir, "scripts.js") : fullDir;
                 }
                 matched = true;
               }
@@ -32260,8 +32762,8 @@ var ProviderLoader = class _ProviderLoader {
             resolved._resolvedScriptDir = base.defaultScriptDir;
             resolved._resolvedScriptsSource = "defaultScriptDir:version_miss";
             if (providerDir) {
-              const fullDir = path30.join(providerDir, base.defaultScriptDir);
-              resolved._resolvedScriptsPath = fs18.existsSync(path30.join(fullDir, "scripts.js")) ? path30.join(fullDir, "scripts.js") : fullDir;
+              const fullDir = path31.join(providerDir, base.defaultScriptDir);
+              resolved._resolvedScriptsPath = fs19.existsSync(path31.join(fullDir, "scripts.js")) ? path31.join(fullDir, "scripts.js") : fullDir;
             }
           }
           resolved._versionWarning = `Version ${currentVersion} not in compatibility matrix. Using default scripts.`;
@@ -32278,8 +32780,8 @@ var ProviderLoader = class _ProviderLoader {
               resolved._resolvedScriptDir = dirOverride;
               resolved._resolvedScriptsSource = `versions:${range}`;
               if (providerDir) {
-                const fullDir = path30.join(providerDir, dirOverride);
-                resolved._resolvedScriptsPath = fs18.existsSync(path30.join(fullDir, "scripts.js")) ? path30.join(fullDir, "scripts.js") : fullDir;
+                const fullDir = path31.join(providerDir, dirOverride);
+                resolved._resolvedScriptsPath = fs19.existsSync(path31.join(fullDir, "scripts.js")) ? path31.join(fullDir, "scripts.js") : fullDir;
               }
             }
           } else if (override.scripts) {
@@ -32295,8 +32797,8 @@ var ProviderLoader = class _ProviderLoader {
         resolved._resolvedScriptDir = base.defaultScriptDir;
         resolved._resolvedScriptsSource = "defaultScriptDir:no_version";
         if (providerDir) {
-          const fullDir = path30.join(providerDir, base.defaultScriptDir);
-          resolved._resolvedScriptsPath = fs18.existsSync(path30.join(fullDir, "scripts.js")) ? path30.join(fullDir, "scripts.js") : fullDir;
+          const fullDir = path31.join(providerDir, base.defaultScriptDir);
+          resolved._resolvedScriptsPath = fs19.existsSync(path31.join(fullDir, "scripts.js")) ? path31.join(fullDir, "scripts.js") : fullDir;
         }
       }
     }
@@ -32313,13 +32815,13 @@ var ProviderLoader = class _ProviderLoader {
       if (providerDir2) {
         for (const [scriptName, override] of Object.entries(base.overrides)) {
           if (!override || typeof override.path !== "string") continue;
-          const fullPath = path30.join(providerDir2, override.path);
-          if (!fs18.existsSync(fullPath)) {
+          const fullPath = path31.join(providerDir2, override.path);
+          if (!fs19.existsSync(fullPath)) {
             this.log(`  [overrides] ${base.type}: ${scriptName} path not found: ${fullPath}`);
             continue;
           }
           try {
-            registerProviderScriptRootSafely(path30.dirname(path30.dirname(providerDir2)));
+            registerProviderScriptRootSafely(path31.dirname(path31.dirname(providerDir2)));
             delete require.cache[require.resolve(fullPath)];
             const fn = require(fullPath);
             const target = typeof fn === "function" ? fn : fn && fn[scriptName];
@@ -32344,19 +32846,19 @@ var ProviderLoader = class _ProviderLoader {
     }
     if (providerDir) {
       try {
-        const fs27 = require("fs");
-        const path39 = require("path");
+        const fs28 = require("fs");
+        const path40 = require("path");
         const candidates = [];
         if (Array.isArray(base.compatibility)) {
           for (const entry of base.compatibility) {
             if (typeof entry?.spec !== "string") continue;
             const matches = !entry.ideVersion || currentVersion && this.matchesVersion(currentVersion, entry.ideVersion) || !currentVersion;
-            if (matches) candidates.push(path39.join(providerDir, entry.spec));
+            if (matches) candidates.push(path40.join(providerDir, entry.spec));
           }
         }
-        candidates.push(path39.join(providerDir, "specs", "default.json"));
-        candidates.push(path39.join(providerDir, "spec.json"));
-        const specPath = candidates.find((p) => fs27.existsSync(p));
+        candidates.push(path40.join(providerDir, "specs", "default.json"));
+        candidates.push(path40.join(providerDir, "spec.json"));
+        const specPath = candidates.find((p) => fs28.existsSync(p));
         if (specPath) {
           resolved._resolvedSpecPath = specPath;
           const { loadSpec: loadSpec2 } = (init_loader(), __toCommonJS(loader_exports));
@@ -32385,10 +32887,10 @@ var ProviderLoader = class _ProviderLoader {
               format = `spec-${nh.source.kind}`;
               reader = (input) => executeNativeHistory2(nh, input);
             } else if (nh.override_path) {
-              const overrideFile = path39.resolve(providerDir, nh.override_path);
-              if (fs27.existsSync(overrideFile)) {
+              const overrideFile = path40.resolve(providerDir, nh.override_path);
+              if (fs28.existsSync(overrideFile)) {
                 try {
-                  registerProviderScriptRootSafely(path39.dirname(path39.dirname(providerDir)));
+                  registerProviderScriptRootSafely(path40.dirname(path40.dirname(providerDir)));
                   delete require.cache[require.resolve(overrideFile)];
                   const mod = require(overrideFile);
                   const fn = typeof mod === "function" ? mod : mod && typeof mod.default === "function" ? mod.default : null;
@@ -32432,16 +32934,16 @@ var ProviderLoader = class _ProviderLoader {
       this.debugLog(`[loadScriptsFromDir] ${type}: providerDir not found`);
       return null;
     }
-    const dir = path30.join(providerDir, scriptDir);
-    if (!fs18.existsSync(dir)) {
+    const dir = path31.join(providerDir, scriptDir);
+    if (!fs19.existsSync(dir)) {
       this.debugLog(`[loadScriptsFromDir] ${type}: dir not found: ${dir}`);
       return null;
     }
-    registerProviderScriptRootSafely(path30.dirname(path30.dirname(providerDir)));
+    registerProviderScriptRootSafely(path31.dirname(path31.dirname(providerDir)));
     const cached = this.scriptsCache.get(dir);
     if (cached) return cached;
-    const scriptsJs = path30.join(dir, "scripts.js");
-    if (fs18.existsSync(scriptsJs)) {
+    const scriptsJs = path31.join(dir, "scripts.js");
+    if (fs19.existsSync(scriptsJs)) {
       try {
         delete require.cache[require.resolve(scriptsJs)];
         const loaded = require(scriptsJs);
@@ -32462,9 +32964,9 @@ var ProviderLoader = class _ProviderLoader {
   watch() {
     this.stopWatch();
     const watchDir = (dir) => {
-      if (!fs18.existsSync(dir)) {
+      if (!fs19.existsSync(dir)) {
         try {
-          fs18.mkdirSync(dir, { recursive: true });
+          fs19.mkdirSync(dir, { recursive: true });
         } catch {
           return;
         }
@@ -32485,7 +32987,7 @@ var ProviderLoader = class _ProviderLoader {
           if (filePath.endsWith(".js") || filePath.endsWith(".json")) {
             if (reloadTimer) clearTimeout(reloadTimer);
             reloadTimer = setTimeout(() => {
-              this.log(`File changed: ${path30.basename(filePath)}, reloading...`);
+              this.log(`File changed: ${path31.basename(filePath)}, reloading...`);
               this.reload();
             }, 300);
           }
@@ -32553,11 +33055,11 @@ var ProviderLoader = class _ProviderLoader {
     }
     this.log(`Registry sync starting (${_ProviderLoader.REGISTRY_BASE_URL})...`);
     const https = require("https");
-    const regMetaPath = path30.join(this.upstreamDir, _ProviderLoader.REGISTRY_META_FILE);
+    const regMetaPath = path31.join(this.upstreamDir, _ProviderLoader.REGISTRY_META_FILE);
     let cachedChecksums = {};
     try {
-      if (fs18.existsSync(regMetaPath)) {
-        cachedChecksums = JSON.parse(fs18.readFileSync(regMetaPath, "utf-8")).checksums ?? {};
+      if (fs19.existsSync(regMetaPath)) {
+        cachedChecksums = JSON.parse(fs19.readFileSync(regMetaPath, "utf-8")).checksums ?? {};
       }
     } catch {
     }
@@ -32611,15 +33113,15 @@ var ProviderLoader = class _ProviderLoader {
           this.log(`\u26A0 Registry checksum mismatch for ${type}@${version} \u2014 skipping`);
           continue;
         }
-        const providerDir = path30.join(this.upstreamDir, category, type);
-        fs18.mkdirSync(providerDir, { recursive: true });
-        fs18.writeFileSync(path30.join(providerDir, "provider.json"), manifestBody, "utf-8");
+        const providerDir = path31.join(this.upstreamDir, category, type);
+        fs19.mkdirSync(providerDir, { recursive: true });
+        fs19.writeFileSync(path31.join(providerDir, "provider.json"), manifestBody, "utf-8");
         cachedChecksums[cacheKey] = checksum;
         updatedCount++;
         this.log(`\u2713 Registry updated: ${category}/${type}@${version}`);
       }
-      fs18.mkdirSync(this.upstreamDir, { recursive: true });
-      fs18.writeFileSync(regMetaPath, JSON.stringify({
+      fs19.mkdirSync(this.upstreamDir, { recursive: true });
+      fs19.writeFileSync(regMetaPath, JSON.stringify({
         checksums: cachedChecksums,
         syncedAt: (/* @__PURE__ */ new Date()).toISOString(),
         providerCount: list.providers.length
@@ -32640,12 +33142,12 @@ var ProviderLoader = class _ProviderLoader {
     const { exec: exec7 } = require("child_process");
     const { promisify: promisify7 } = require("util");
     const execAsync5 = promisify7(exec7);
-    const metaPath = path30.join(this.upstreamDir, _ProviderLoader.META_FILE);
+    const metaPath = path31.join(this.upstreamDir, _ProviderLoader.META_FILE);
     let prevEtag = "";
     let prevTimestamp = 0;
     try {
-      if (fs18.existsSync(metaPath)) {
-        const meta = JSON.parse(fs18.readFileSync(metaPath, "utf-8"));
+      if (fs19.existsSync(metaPath)) {
+        const meta = JSON.parse(fs19.readFileSync(metaPath, "utf-8"));
         prevEtag = meta.etag || "";
         prevTimestamp = meta.timestamp || 0;
       }
@@ -32700,39 +33202,39 @@ var ProviderLoader = class _ProviderLoader {
         return { updated: false };
       }
       this.log("Downloading latest providers from GitHub...");
-      const tmpTar = path30.join(os21.tmpdir(), `adhdev-providers-${Date.now()}.tar.gz`);
-      const tmpExtract = path30.join(os21.tmpdir(), `adhdev-providers-extract-${Date.now()}`);
+      const tmpTar = path31.join(os22.tmpdir(), `adhdev-providers-${Date.now()}.tar.gz`);
+      const tmpExtract = path31.join(os22.tmpdir(), `adhdev-providers-extract-${Date.now()}`);
       await this.downloadFile(_ProviderLoader.GITHUB_TARBALL_URL, tmpTar);
-      fs18.mkdirSync(tmpExtract, { recursive: true });
+      fs19.mkdirSync(tmpExtract, { recursive: true });
       await execAsync5(`tar -xzf "${tmpTar}" -C "${tmpExtract}"`, { timeout: 3e4 });
-      const extracted = fs18.readdirSync(tmpExtract);
+      const extracted = fs19.readdirSync(tmpExtract);
       const rootDir = extracted.find(
-        (d) => fs18.statSync(path30.join(tmpExtract, d)).isDirectory() && d.startsWith("adhdev-providers")
+        (d) => fs19.statSync(path31.join(tmpExtract, d)).isDirectory() && d.startsWith("adhdev-providers")
       );
       if (!rootDir) throw new Error("Unexpected tarball structure");
-      const sourceDir = path30.join(tmpExtract, rootDir);
+      const sourceDir = path31.join(tmpExtract, rootDir);
       const backupDir = this.upstreamDir + ".bak";
-      if (fs18.existsSync(this.upstreamDir)) {
-        if (fs18.existsSync(backupDir)) fs18.rmSync(backupDir, { recursive: true, force: true });
-        fs18.renameSync(this.upstreamDir, backupDir);
+      if (fs19.existsSync(this.upstreamDir)) {
+        if (fs19.existsSync(backupDir)) fs19.rmSync(backupDir, { recursive: true, force: true });
+        fs19.renameSync(this.upstreamDir, backupDir);
       }
       try {
         this.copyDirRecursive(sourceDir, this.upstreamDir);
         this.writeMeta(metaPath, etag || `ts-${Date.now()}`, Date.now());
-        if (fs18.existsSync(backupDir)) fs18.rmSync(backupDir, { recursive: true, force: true });
+        if (fs19.existsSync(backupDir)) fs19.rmSync(backupDir, { recursive: true, force: true });
       } catch (e) {
-        if (fs18.existsSync(backupDir)) {
-          if (fs18.existsSync(this.upstreamDir)) fs18.rmSync(this.upstreamDir, { recursive: true, force: true });
-          fs18.renameSync(backupDir, this.upstreamDir);
+        if (fs19.existsSync(backupDir)) {
+          if (fs19.existsSync(this.upstreamDir)) fs19.rmSync(this.upstreamDir, { recursive: true, force: true });
+          fs19.renameSync(backupDir, this.upstreamDir);
         }
         throw e;
       }
       try {
-        fs18.rmSync(tmpTar, { force: true });
+        fs19.rmSync(tmpTar, { force: true });
       } catch {
       }
       try {
-        fs18.rmSync(tmpExtract, { recursive: true, force: true });
+        fs19.rmSync(tmpExtract, { recursive: true, force: true });
       } catch {
       }
       const upstreamCount = this.countProviders(this.upstreamDir);
@@ -32764,7 +33266,7 @@ var ProviderLoader = class _ProviderLoader {
             reject(new Error(`HTTP ${res.statusCode}`));
             return;
           }
-          const ws = fs18.createWriteStream(destPath);
+          const ws = fs19.createWriteStream(destPath);
           res.pipe(ws);
           ws.on("finish", () => {
             ws.close();
@@ -32783,22 +33285,22 @@ var ProviderLoader = class _ProviderLoader {
   }
   /** Recursive directory copy */
   copyDirRecursive(src, dest) {
-    fs18.mkdirSync(dest, { recursive: true });
-    for (const entry of fs18.readdirSync(src, { withFileTypes: true })) {
-      const srcPath = path30.join(src, entry.name);
-      const destPath = path30.join(dest, entry.name);
+    fs19.mkdirSync(dest, { recursive: true });
+    for (const entry of fs19.readdirSync(src, { withFileTypes: true })) {
+      const srcPath = path31.join(src, entry.name);
+      const destPath = path31.join(dest, entry.name);
       if (entry.isDirectory()) {
         this.copyDirRecursive(srcPath, destPath);
       } else {
-        fs18.copyFileSync(srcPath, destPath);
+        fs19.copyFileSync(srcPath, destPath);
       }
     }
   }
   /** .meta.json save */
   writeMeta(metaPath, etag, timestamp) {
     try {
-      fs18.mkdirSync(path30.dirname(metaPath), { recursive: true });
-      fs18.writeFileSync(metaPath, JSON.stringify({
+      fs19.mkdirSync(path31.dirname(metaPath), { recursive: true });
+      fs19.writeFileSync(metaPath, JSON.stringify({
         etag,
         timestamp,
         lastCheck: new Date(timestamp).toISOString(),
@@ -32809,15 +33311,15 @@ var ProviderLoader = class _ProviderLoader {
   }
   /** Count provider files (provider.v1.json or provider.json — at most one per dir). */
   countProviders(dir) {
-    if (!fs18.existsSync(dir)) return 0;
+    if (!fs19.existsSync(dir)) return 0;
     let count = 0;
     const scan = (d) => {
       try {
-        const entries = fs18.readdirSync(d, { withFileTypes: true });
+        const entries = fs19.readdirSync(d, { withFileTypes: true });
         const hasManifest = entries.some((e) => e.name === "provider.v1.json" || e.name === "provider.json");
         if (hasManifest) count++;
         for (const entry of entries) {
-          if (entry.isDirectory()) scan(path30.join(d, entry.name));
+          if (entry.isDirectory()) scan(path31.join(d, entry.name));
         }
       } catch {
       }
@@ -33043,13 +33545,13 @@ var ProviderLoader = class _ProviderLoader {
     if (!provider) return null;
     const cat = provider.category;
     const searchRoots = this.getProviderRoots();
-    const hasManifest = (dir) => fs18.existsSync(path30.join(dir, "provider.v1.json")) || fs18.existsSync(path30.join(dir, "provider.json"));
+    const hasManifest = (dir) => fs19.existsSync(path31.join(dir, "provider.v1.json")) || fs19.existsSync(path31.join(dir, "provider.json"));
     const readManifestType = (dir) => {
       for (const file of ["provider.v1.json", "provider.json"]) {
-        const p = path30.join(dir, file);
-        if (!fs18.existsSync(p)) continue;
+        const p = path31.join(dir, file);
+        if (!fs19.existsSync(p)) continue;
         try {
-          const data = JSON.parse(fs18.readFileSync(p, "utf-8"));
+          const data = JSON.parse(fs19.readFileSync(p, "utf-8"));
           if (typeof data?.type === "string") return data.type;
         } catch {
         }
@@ -33057,15 +33559,15 @@ var ProviderLoader = class _ProviderLoader {
       return null;
     };
     for (const root of searchRoots) {
-      if (!fs18.existsSync(root)) continue;
+      if (!fs19.existsSync(root)) continue;
       const candidate = this.getProviderDir(root, cat, type);
       if (hasManifest(candidate)) return candidate;
-      const catDir = path30.join(root, cat);
-      if (fs18.existsSync(catDir)) {
+      const catDir = path31.join(root, cat);
+      if (fs19.existsSync(catDir)) {
         try {
-          for (const entry of fs18.readdirSync(catDir, { withFileTypes: true })) {
+          for (const entry of fs19.readdirSync(catDir, { withFileTypes: true })) {
             if (!entry.isDirectory()) continue;
-            const entryDir = path30.join(catDir, entry.name);
+            const entryDir = path31.join(catDir, entry.name);
             const manifestType = readManifestType(entryDir);
             if (manifestType === type) return entryDir;
           }
@@ -33081,8 +33583,8 @@ var ProviderLoader = class _ProviderLoader {
    * (template substitution is NOT applied here — scripts.js handles that)
    */
   buildScriptWrappersFromDir(dir) {
-    const scriptsJs = path30.join(dir, "scripts.js");
-    if (fs18.existsSync(scriptsJs)) {
+    const scriptsJs = path31.join(dir, "scripts.js");
+    if (fs19.existsSync(scriptsJs)) {
       try {
         delete require.cache[require.resolve(scriptsJs)];
         return require(scriptsJs);
@@ -33092,13 +33594,13 @@ var ProviderLoader = class _ProviderLoader {
     const toCamel = (name) => name.replace(/_([a-z])/g, (_, c) => c.toUpperCase());
     const result = {};
     try {
-      for (const file of fs18.readdirSync(dir)) {
+      for (const file of fs19.readdirSync(dir)) {
         if (!file.endsWith(".js")) continue;
         const scriptName = toCamel(file.replace(".js", ""));
-        const filePath = path30.join(dir, file);
+        const filePath = path31.join(dir, file);
         result[scriptName] = (...args) => {
           try {
-            let content = fs18.readFileSync(filePath, "utf-8");
+            let content = fs19.readFileSync(filePath, "utf-8");
             if (args[0] && typeof args[0] === "object") {
               for (const [key, val] of Object.entries(args[0])) {
                 let v = val;
@@ -33144,12 +33646,12 @@ var ProviderLoader = class _ProviderLoader {
    * Structure: dir/category/agent-name/provider.{json,js}
    */
   loadDir(dir, excludeDirs) {
-    if (!fs18.existsSync(dir)) return 0;
+    if (!fs19.existsSync(dir)) return 0;
     let count = 0;
     const scan = (d) => {
       let entries;
       try {
-        entries = fs18.readdirSync(d, { withFileTypes: true });
+        entries = fs19.readdirSync(d, { withFileTypes: true });
       } catch {
         return;
       }
@@ -33157,9 +33659,9 @@ var ProviderLoader = class _ProviderLoader {
       const hasJson = entries.some((e) => e.name === "provider.json");
       if (hasV1 || hasJson) {
         const manifestFile = hasV1 ? "provider.v1.json" : "provider.json";
-        const jsonPath = path30.join(d, manifestFile);
+        const jsonPath = path31.join(d, manifestFile);
         try {
-          const raw = fs18.readFileSync(jsonPath, "utf-8");
+          const raw = fs19.readFileSync(jsonPath, "utf-8");
           const mod = JSON.parse(raw);
           if (hasV1 && mod?.category === "cli") {
             try {
@@ -33197,10 +33699,10 @@ ${formatManifestValidationIssues2(validation2.issues)}`);
             this.log(`\u26A0 Invalid provider at ${jsonPath}: ${validation.errors.join("; ")}`);
           } else {
             const hasCompatibility = Array.isArray(normalizedProvider.compatibility);
-            const scriptsPath = path30.join(d, "scripts.js");
-            if (!hasCompatibility && fs18.existsSync(scriptsPath)) {
+            const scriptsPath = path31.join(d, "scripts.js");
+            if (!hasCompatibility && fs19.existsSync(scriptsPath)) {
               try {
-                registerProviderScriptRootSafely(path30.dirname(path30.dirname(d)));
+                registerProviderScriptRootSafely(path31.dirname(path31.dirname(d)));
                 delete require.cache[require.resolve(scriptsPath)];
                 const scripts = require(scriptsPath);
                 normalizedProvider.scripts = scripts;
@@ -33208,12 +33710,30 @@ ${formatManifestValidationIssues2(validation2.issues)}`);
                 this.log(`\u26A0 Failed to load scripts: ${scriptsPath}: ${e.message}`);
               }
             }
+            const externalDirAbs = path31.join(os22.homedir(), ".adhdev", "external");
+            const layer = d.startsWith(externalDirAbs) ? "external" : d.startsWith(this.userDir) && !d.includes(".upstream") ? "user" : "upstream";
+            try {
+              const { inspectManifestShape: inspectManifestShape2, classifyTrust: classifyTrust2 } = (init_provider_trust(), __toCommonJS(provider_trust_exports));
+              const shape = inspectManifestShape2(mod);
+              const trust = classifyTrust2(layer, shape);
+              normalizedProvider._sourceLayer = layer;
+              normalizedProvider._sourceTrust = trust;
+              normalizedProvider._manifestShape = shape;
+              if (layer === "external") {
+                const rel = path31.relative(externalDirAbs, d);
+                const firstSeg = rel.split(path31.sep)[0];
+                if (firstSeg && firstSeg !== "..") normalizedProvider._sourceName = firstSeg;
+              }
+            } catch {
+            }
             const existed = this.providers.has(normalizedProvider.type);
             this.providers.set(normalizedProvider.type, normalizedProvider);
             count++;
-            const source = d.startsWith(this.userDir) && !d.includes(".upstream") ? "user" : "upstream";
+            const source = normalizedProvider._sourceLayer ?? "upstream";
             const overrideWarning = existed && source === "user" ? " \u26A0 OVERRIDES upstream" : "";
-            this.log(`  ${existed ? "\u{1F504}" : "\u2705"} ${normalizedProvider.type} (${normalizedProvider.category}) \u2014 ${normalizedProvider.name} [${source}]${overrideWarning}`);
+            const sourceName = normalizedProvider._sourceName;
+            const sourceLabel = sourceName ? `${source}/${sourceName}` : source;
+            this.log(`  ${existed ? "\u{1F504}" : "\u2705"} ${normalizedProvider.type} (${normalizedProvider.category}) \u2014 ${normalizedProvider.name} [${sourceLabel}]${overrideWarning}`);
           }
         } catch (e) {
           this.log(`\u26A0 Failed to load ${jsonPath}: ${e.message}`);
@@ -33223,8 +33743,9 @@ ${formatManifestValidationIssues2(validation2.issues)}`);
         for (const entry of entries) {
           if (!entry.isDirectory()) continue;
           if (entry.name.startsWith("_") || entry.name.startsWith(".")) continue;
+          if (d === dir && entry.name === "examples") continue;
           if (excludeDirs && d === dir && excludeDirs.includes(entry.name)) continue;
-          scan(path30.join(d, entry.name));
+          scan(path31.join(d, entry.name));
         }
       }
     };
@@ -33422,7 +33943,7 @@ async function isCdpActive(port) {
   });
 }
 async function killIdeProcess(ideId) {
-  const plat = os22.platform();
+  const plat = os23.platform();
   const appName = getMacAppIdentifiers()[ideId];
   const winProcesses = getWinProcessNames()[ideId];
   try {
@@ -33483,7 +34004,7 @@ async function killIdeProcess(ideId) {
   }
 }
 async function isIdeRunning(ideId) {
-  const plat = os22.platform();
+  const plat = os23.platform();
   try {
     if (plat === "darwin") {
       const appName = getMacAppIdentifiers()[ideId];
@@ -33538,7 +34059,7 @@ async function isIdeRunning(ideId) {
   }
 }
 async function detectCurrentWorkspace(ideId) {
-  const plat = os22.platform();
+  const plat = os23.platform();
   if (plat === "darwin") {
     try {
       const appName = getMacAppIdentifiers()[ideId];
@@ -33553,17 +34074,17 @@ async function detectCurrentWorkspace(ideId) {
     }
   } else if (plat === "win32") {
     try {
-      const fs27 = require("fs");
+      const fs28 = require("fs");
       const appNameMap = getMacAppIdentifiers();
       const appName = appNameMap[ideId];
       if (appName) {
-        const storagePath = path31.join(
-          process.env.APPDATA || path31.join(os22.homedir(), "AppData", "Roaming"),
+        const storagePath = path32.join(
+          process.env.APPDATA || path32.join(os23.homedir(), "AppData", "Roaming"),
           appName,
           "storage.json"
         );
-        if (fs27.existsSync(storagePath)) {
-          const data = JSON.parse(fs27.readFileSync(storagePath, "utf-8"));
+        if (fs28.existsSync(storagePath)) {
+          const data = JSON.parse(fs28.readFileSync(storagePath, "utf-8"));
           const workspaces = data?.openedPathsList?.workspaces3 || data?.openedPathsList?.entries || [];
           if (workspaces.length > 0) {
             const recent = workspaces[0];
@@ -33580,7 +34101,7 @@ async function detectCurrentWorkspace(ideId) {
   return void 0;
 }
 async function launchWithCdp(options = {}) {
-  const platform10 = os22.platform();
+  const platform10 = os23.platform();
   let targetIde;
   const ides = await detectIDEs(getProviderLoader());
   if (options.ideId) {
@@ -33747,14 +34268,14 @@ init_cli_detector();
 init_logger();
 
 // src/logging/command-log.ts
-var fs19 = __toESM(require("fs"));
-var path32 = __toESM(require("path"));
-var os23 = __toESM(require("os"));
-var LOG_DIR2 = process.platform === "win32" ? path32.join(process.env.LOCALAPPDATA || process.env.APPDATA || path32.join(os23.homedir(), "AppData", "Local"), "adhdev", "logs") : process.platform === "darwin" ? path32.join(os23.homedir(), "Library", "Logs", "adhdev") : path32.join(os23.homedir(), ".local", "share", "adhdev", "logs");
+var fs20 = __toESM(require("fs"));
+var path33 = __toESM(require("path"));
+var os24 = __toESM(require("os"));
+var LOG_DIR2 = process.platform === "win32" ? path33.join(process.env.LOCALAPPDATA || process.env.APPDATA || path33.join(os24.homedir(), "AppData", "Local"), "adhdev", "logs") : process.platform === "darwin" ? path33.join(os24.homedir(), "Library", "Logs", "adhdev") : path33.join(os24.homedir(), ".local", "share", "adhdev", "logs");
 var MAX_FILE_SIZE = 5 * 1024 * 1024;
 var MAX_DAYS = 7;
 try {
-  fs19.mkdirSync(LOG_DIR2, { recursive: true });
+  fs20.mkdirSync(LOG_DIR2, { recursive: true });
 } catch {
 }
 var SENSITIVE_KEYS = /* @__PURE__ */ new Set([
@@ -33788,19 +34309,19 @@ function getDateStr2() {
   return (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
 }
 var currentDate2 = getDateStr2();
-var currentFile = path32.join(LOG_DIR2, `commands-${currentDate2}.jsonl`);
+var currentFile = path33.join(LOG_DIR2, `commands-${currentDate2}.jsonl`);
 var writeCount2 = 0;
 function checkRotation() {
   const today = getDateStr2();
   if (today !== currentDate2) {
     currentDate2 = today;
-    currentFile = path32.join(LOG_DIR2, `commands-${currentDate2}.jsonl`);
+    currentFile = path33.join(LOG_DIR2, `commands-${currentDate2}.jsonl`);
     cleanOldFiles();
   }
 }
 function cleanOldFiles() {
   try {
-    const files = fs19.readdirSync(LOG_DIR2).filter((f) => f.startsWith("commands-") && f.endsWith(".jsonl"));
+    const files = fs20.readdirSync(LOG_DIR2).filter((f) => f.startsWith("commands-") && f.endsWith(".jsonl"));
     const cutoff = /* @__PURE__ */ new Date();
     cutoff.setDate(cutoff.getDate() - MAX_DAYS);
     const cutoffStr = cutoff.toISOString().slice(0, 10);
@@ -33808,7 +34329,7 @@ function cleanOldFiles() {
       const dateMatch = file.match(/commands-(\d{4}-\d{2}-\d{2})/);
       if (dateMatch && dateMatch[1] < cutoffStr) {
         try {
-          fs19.unlinkSync(path32.join(LOG_DIR2, file));
+          fs20.unlinkSync(path33.join(LOG_DIR2, file));
         } catch {
         }
       }
@@ -33818,14 +34339,14 @@ function cleanOldFiles() {
 }
 function checkSize() {
   try {
-    const stat2 = fs19.statSync(currentFile);
+    const stat2 = fs20.statSync(currentFile);
     if (stat2.size > MAX_FILE_SIZE) {
       const backup = currentFile.replace(".jsonl", ".1.jsonl");
       try {
-        fs19.unlinkSync(backup);
+        fs20.unlinkSync(backup);
       } catch {
       }
-      fs19.renameSync(currentFile, backup);
+      fs20.renameSync(currentFile, backup);
     }
   } catch {
   }
@@ -33858,14 +34379,14 @@ function logCommand(entry) {
       ...entry.error ? { err: entry.error } : {},
       ...entry.durationMs !== void 0 ? { ms: entry.durationMs } : {}
     });
-    fs19.appendFileSync(currentFile, line + "\n");
+    fs20.appendFileSync(currentFile, line + "\n");
   } catch {
   }
 }
 function getRecentCommands(count = 50) {
   try {
-    if (!fs19.existsSync(currentFile)) return [];
-    const content = fs19.readFileSync(currentFile, "utf-8");
+    if (!fs20.existsSync(currentFile)) return [];
+    const content = fs20.readFileSync(currentFile, "utf-8");
     const lines = content.trim().split("\n").filter(Boolean);
     return lines.slice(-count).map((line) => {
       try {
@@ -33915,10 +34436,10 @@ function runGit2(repoRoot, args) {
   }
 }
 function readRecord3(repoRoot) {
-  const path39 = (0, import_node_path2.resolve)(repoRoot, PREVIEW_DEPLOY_RECORD);
-  if (!(0, import_node_fs4.existsSync)(path39)) return null;
+  const path40 = (0, import_node_path2.resolve)(repoRoot, PREVIEW_DEPLOY_RECORD);
+  if (!(0, import_node_fs4.existsSync)(path40)) return null;
   try {
-    const parsed = JSON.parse((0, import_node_fs4.readFileSync)(path39, "utf8"));
+    const parsed = JSON.parse((0, import_node_fs4.readFileSync)(path40, "utf8"));
     return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
   } catch {
     return null;
@@ -33980,7 +34501,7 @@ function buildPreviewFreshness(repoRoot) {
 }
 
 // src/status/snapshot.ts
-var os24 = __toESM(require("os"));
+var os25 = __toESM(require("os"));
 init_config();
 init_terminal_screen();
 init_logger();
@@ -34019,25 +34540,50 @@ function buildDetectedIdeInfos(detectedIdes, cdpManagers) {
 }
 function buildAvailableProviders(providerLoader) {
   const providers = providerLoader.getAvailableProviderInfos?.() || providerLoader.getAll();
-  return providers.map((provider) => ({
-    type: provider.type,
-    name: provider.displayName || provider.type,
-    displayName: provider.displayName || provider.type,
-    icon: provider.icon || "\u{1F4BB}",
-    category: provider.category,
-    ...provider.installed !== void 0 ? { installed: provider.installed } : {},
-    ...provider.detectedPath !== void 0 ? { detectedPath: provider.detectedPath } : {},
-    ...provider.enabled !== void 0 ? { enabled: provider.enabled } : {},
-    ...provider.machineStatus !== void 0 ? { machineStatus: provider.machineStatus } : {},
-    ...provider.lastDetection !== void 0 ? { lastDetection: provider.lastDetection } : {},
-    ...provider.lastVerification !== void 0 ? { lastVerification: provider.lastVerification } : {},
-    ...provider.meshCoordinator !== void 0 ? { meshCoordinator: provider.meshCoordinator } : {}
-  }));
+  let describeTrust2 = () => "";
+  let requiresConfirmation2 = () => false;
+  try {
+    const mod = (init_provider_trust(), __toCommonJS(provider_trust_exports));
+    describeTrust2 = mod.describeTrust;
+    requiresConfirmation2 = mod.requiresConfirmation;
+  } catch {
+  }
+  return providers.map((provider) => {
+    const trust = provider._sourceTrust;
+    const sourceLayer = provider._sourceLayer;
+    const sourceName = provider._sourceName;
+    return {
+      type: provider.type,
+      name: provider.displayName || provider.type,
+      displayName: provider.displayName || provider.type,
+      icon: provider.icon || "\u{1F4BB}",
+      category: provider.category,
+      ...provider.installed !== void 0 ? { installed: provider.installed } : {},
+      ...provider.detectedPath !== void 0 ? { detectedPath: provider.detectedPath } : {},
+      ...provider.enabled !== void 0 ? { enabled: provider.enabled } : {},
+      ...provider.machineStatus !== void 0 ? { machineStatus: provider.machineStatus } : {},
+      ...provider.lastDetection !== void 0 ? { lastDetection: provider.lastDetection } : {},
+      ...provider.lastVerification !== void 0 ? { lastVerification: provider.lastVerification } : {},
+      ...provider.meshCoordinator !== void 0 ? { meshCoordinator: provider.meshCoordinator } : {},
+      ...trust ? {
+        trust,
+        trustDescription: describeTrust2(trust),
+        requiresConfirmation: requiresConfirmation2(trust)
+      } : {},
+      ...sourceLayer ? { sourceLayer } : {},
+      ...sourceName ? { sourceName } : {},
+      ...provider.providerVersion ? { providerVersion: provider.providerVersion } : {},
+      ...provider.binary ? { binary: provider.binary } : {},
+      ...provider.status ? { status: provider.status } : {},
+      ...provider.details ? { details: provider.details } : {},
+      ...provider.links ? { links: provider.links } : {}
+    };
+  });
 }
 function buildMachineInfo(profile = "full") {
   const base = {
-    hostname: os24.hostname(),
-    platform: os24.platform()
+    hostname: os25.hostname(),
+    platform: os25.platform()
   };
   if (profile === "live") {
     return base;
@@ -34046,23 +34592,23 @@ function buildMachineInfo(profile = "full") {
     const memSnap2 = getHostMemorySnapshot();
     return {
       ...base,
-      arch: os24.arch(),
-      cpus: os24.cpus().length,
+      arch: os25.arch(),
+      cpus: os25.cpus().length,
       totalMem: memSnap2.totalMem,
-      release: os24.release()
+      release: os25.release()
     };
   }
   const memSnap = getHostMemorySnapshot();
   return {
     ...base,
-    arch: os24.arch(),
-    cpus: os24.cpus().length,
+    arch: os25.arch(),
+    cpus: os25.cpus().length,
     totalMem: memSnap.totalMem,
     freeMem: memSnap.freeMem,
     availableMem: memSnap.availableMem,
-    loadavg: os24.loadavg(),
-    uptime: os24.uptime(),
-    release: os24.release()
+    loadavg: os25.loadavg(),
+    uptime: os25.uptime(),
+    release: os25.release()
   };
 }
 function parseMessageTime(value) {
@@ -34303,42 +34849,42 @@ function buildStatusSnapshot(options) {
 // src/commands/upgrade-helper.ts
 var import_child_process7 = require("child_process");
 var import_child_process8 = require("child_process");
-var fs20 = __toESM(require("fs"));
-var os25 = __toESM(require("os"));
-var path33 = __toESM(require("path"));
+var fs21 = __toESM(require("fs"));
+var os26 = __toESM(require("os"));
+var path34 = __toESM(require("path"));
 var UPGRADE_HELPER_ENV = "ADHDEV_DAEMON_UPGRADE_HELPER";
 function getUpgradeLogPath() {
-  const home = os25.homedir();
-  const dir = path33.join(home, ".adhdev");
-  fs20.mkdirSync(dir, { recursive: true });
-  return path33.join(dir, "daemon-upgrade.log");
+  const home = os26.homedir();
+  const dir = path34.join(home, ".adhdev");
+  fs21.mkdirSync(dir, { recursive: true });
+  return path34.join(dir, "daemon-upgrade.log");
 }
 function appendUpgradeLog(message) {
   const line = `[${(/* @__PURE__ */ new Date()).toISOString()}] ${message}
 `;
   try {
-    fs20.appendFileSync(getUpgradeLogPath(), line, "utf8");
+    fs21.appendFileSync(getUpgradeLogPath(), line, "utf8");
   } catch {
   }
 }
 function resolveSiblingNpmInvocation(nodeExecutable, platform10 = process.platform) {
-  const binDir = path33.dirname(nodeExecutable);
+  const binDir = path34.dirname(nodeExecutable);
   if (platform10 === "win32") {
-    const npmCliPath = path33.join(binDir, "node_modules", "npm", "bin", "npm-cli.js");
-    if (fs20.existsSync(npmCliPath)) {
+    const npmCliPath = path34.join(binDir, "node_modules", "npm", "bin", "npm-cli.js");
+    if (fs21.existsSync(npmCliPath)) {
       return { executable: nodeExecutable, argsPrefix: [npmCliPath], execOptions: getNpmExecOptions(platform10) };
     }
     for (const candidate of ["npm.exe", "npm"]) {
-      const candidatePath = path33.join(binDir, candidate);
-      if (fs20.existsSync(candidatePath)) {
+      const candidatePath = path34.join(binDir, candidate);
+      if (fs21.existsSync(candidatePath)) {
         return { executable: candidatePath, argsPrefix: [], execOptions: getNpmExecOptions(platform10) };
       }
     }
     return { executable: nodeExecutable, argsPrefix: [npmCliPath], execOptions: getNpmExecOptions(platform10) };
   }
   for (const candidate of ["npm"]) {
-    const candidatePath = path33.join(binDir, candidate);
-    if (fs20.existsSync(candidatePath)) {
+    const candidatePath = path34.join(binDir, candidate);
+    if (fs21.existsSync(candidatePath)) {
       return { executable: candidatePath, argsPrefix: [], execOptions: getNpmExecOptions(platform10) };
     }
   }
@@ -34348,22 +34894,22 @@ function findCurrentPackageRoot(currentCliPath, packageName) {
   if (!currentCliPath) return null;
   let resolvedPath = currentCliPath;
   try {
-    resolvedPath = fs20.realpathSync.native(currentCliPath);
+    resolvedPath = fs21.realpathSync.native(currentCliPath);
   } catch {
   }
   let currentDir = resolvedPath;
   try {
-    if (fs20.statSync(resolvedPath).isFile()) {
-      currentDir = path33.dirname(resolvedPath);
+    if (fs21.statSync(resolvedPath).isFile()) {
+      currentDir = path34.dirname(resolvedPath);
     }
   } catch {
-    currentDir = path33.dirname(resolvedPath);
+    currentDir = path34.dirname(resolvedPath);
   }
   while (true) {
-    const packageJsonPath = path33.join(currentDir, "package.json");
+    const packageJsonPath = path34.join(currentDir, "package.json");
     try {
-      if (fs20.existsSync(packageJsonPath)) {
-        const parsed = JSON.parse(fs20.readFileSync(packageJsonPath, "utf8"));
+      if (fs21.existsSync(packageJsonPath)) {
+        const parsed = JSON.parse(fs21.readFileSync(packageJsonPath, "utf8"));
         if (parsed?.name === packageName) {
           const normalized = currentDir.replace(/\\/g, "/");
           return normalized.includes("/node_modules/") ? currentDir : null;
@@ -34371,7 +34917,7 @@ function findCurrentPackageRoot(currentCliPath, packageName) {
       }
     } catch {
     }
-    const parentDir = path33.dirname(currentDir);
+    const parentDir = path34.dirname(currentDir);
     if (parentDir === currentDir) {
       return null;
     }
@@ -34379,13 +34925,13 @@ function findCurrentPackageRoot(currentCliPath, packageName) {
   }
 }
 function resolveInstallPrefixFromPackageRoot(packageRoot, packageName) {
-  const nodeModulesDir = packageName.startsWith("@") ? path33.dirname(path33.dirname(packageRoot)) : path33.dirname(packageRoot);
-  if (path33.basename(nodeModulesDir) !== "node_modules") {
+  const nodeModulesDir = packageName.startsWith("@") ? path34.dirname(path34.dirname(packageRoot)) : path34.dirname(packageRoot);
+  if (path34.basename(nodeModulesDir) !== "node_modules") {
     return null;
   }
-  const maybeLibDir = path33.dirname(nodeModulesDir);
-  if (path33.basename(maybeLibDir) === "lib") {
-    return path33.dirname(maybeLibDir);
+  const maybeLibDir = path34.dirname(nodeModulesDir);
+  if (path34.basename(maybeLibDir) === "lib") {
+    return path34.dirname(maybeLibDir);
   }
   return maybeLibDir;
 }
@@ -34500,10 +35046,10 @@ async function waitForPidExit(pid, timeoutMs) {
   }
 }
 function stopSessionHostProcesses(appName) {
-  const pidFile = path33.join(os25.homedir(), ".adhdev", `${appName}-session-host.pid`);
+  const pidFile = path34.join(os26.homedir(), ".adhdev", `${appName}-session-host.pid`);
   try {
-    if (fs20.existsSync(pidFile)) {
-      const pid = Number.parseInt(fs20.readFileSync(pidFile, "utf8").trim(), 10);
+    if (fs21.existsSync(pidFile)) {
+      const pid = Number.parseInt(fs21.readFileSync(pidFile, "utf8").trim(), 10);
       if (Number.isFinite(pid) && pid !== process.pid && isManagedSessionHostPid(pid)) {
         killPid(pid);
       }
@@ -34511,15 +35057,15 @@ function stopSessionHostProcesses(appName) {
   } catch {
   } finally {
     try {
-      fs20.unlinkSync(pidFile);
+      fs21.unlinkSync(pidFile);
     } catch {
     }
   }
 }
 function removeDaemonPidFile() {
-  const pidFile = path33.join(os25.homedir(), ".adhdev", "daemon.pid");
+  const pidFile = path34.join(os26.homedir(), ".adhdev", "daemon.pid");
   try {
-    fs20.unlinkSync(pidFile);
+    fs21.unlinkSync(pidFile);
   } catch {
   }
 }
@@ -34528,7 +35074,7 @@ function cleanupStaleGlobalInstallDirs(pkgName, surface) {
   const npmRoot = String(execNpmCommandSync(["root", "-g", ...prefixArgs], { encoding: "utf8" }, surface)).trim();
   if (!npmRoot) return;
   const npmPrefix = surface.installPrefix || String(execNpmCommandSync(["prefix", "-g", ...prefixArgs], { encoding: "utf8" }, surface)).trim();
-  const binDir = process.platform === "win32" ? npmPrefix : path33.join(npmPrefix, "bin");
+  const binDir = process.platform === "win32" ? npmPrefix : path34.join(npmPrefix, "bin");
   const packageBaseName = pkgName.startsWith("@") ? pkgName.split("/")[1] : pkgName;
   const binNames = /* @__PURE__ */ new Set([packageBaseName]);
   if (pkgName === "@adhdev/daemon-standalone") {
@@ -34536,25 +35082,25 @@ function cleanupStaleGlobalInstallDirs(pkgName, surface) {
   }
   if (pkgName.startsWith("@")) {
     const [scope, name] = pkgName.split("/");
-    const scopeDir = path33.join(npmRoot, scope);
-    if (!fs20.existsSync(scopeDir)) return;
-    for (const entry of fs20.readdirSync(scopeDir)) {
+    const scopeDir = path34.join(npmRoot, scope);
+    if (!fs21.existsSync(scopeDir)) return;
+    for (const entry of fs21.readdirSync(scopeDir)) {
       if (!entry.startsWith(`.${name}-`)) continue;
-      fs20.rmSync(path33.join(scopeDir, entry), { recursive: true, force: true });
-      appendUpgradeLog(`Removed stale scoped staging dir: ${path33.join(scopeDir, entry)}`);
+      fs21.rmSync(path34.join(scopeDir, entry), { recursive: true, force: true });
+      appendUpgradeLog(`Removed stale scoped staging dir: ${path34.join(scopeDir, entry)}`);
     }
   } else {
-    for (const entry of fs20.readdirSync(npmRoot)) {
+    for (const entry of fs21.readdirSync(npmRoot)) {
       if (!entry.startsWith(`.${pkgName}-`)) continue;
-      fs20.rmSync(path33.join(npmRoot, entry), { recursive: true, force: true });
-      appendUpgradeLog(`Removed stale staging dir: ${path33.join(npmRoot, entry)}`);
+      fs21.rmSync(path34.join(npmRoot, entry), { recursive: true, force: true });
+      appendUpgradeLog(`Removed stale staging dir: ${path34.join(npmRoot, entry)}`);
     }
   }
-  if (fs20.existsSync(binDir)) {
-    for (const entry of fs20.readdirSync(binDir)) {
+  if (fs21.existsSync(binDir)) {
+    for (const entry of fs21.readdirSync(binDir)) {
       if (!Array.from(binNames).some((name) => entry.startsWith(`.${name}-`))) continue;
-      fs20.rmSync(path33.join(binDir, entry), { recursive: true, force: true });
-      appendUpgradeLog(`Removed stale bin staging entry: ${path33.join(binDir, entry)}`);
+      fs21.rmSync(path34.join(binDir, entry), { recursive: true, force: true });
+      appendUpgradeLog(`Removed stale bin staging entry: ${path34.join(binDir, entry)}`);
     }
   }
 }
@@ -34642,7 +35188,7 @@ async function maybeRunDaemonUpgradeHelperFromEnv() {
 init_mesh_work_queue();
 var import_os3 = require("os");
 var import_path10 = require("path");
-var fs21 = __toESM(require("fs"));
+var fs22 = __toESM(require("fs"));
 var import_node_child_process5 = require("child_process");
 var CHANNEL_NPM_TAG = { stable: "latest", preview: "next" };
 var CHANNEL_SERVER_URL = {
@@ -34769,12 +35315,12 @@ function readGitSubmodules(value, parentRepoRoot) {
   if (!Array.isArray(value)) return void 0;
   const submodules = value.map((entry) => {
     const submodule = readObjectRecord(entry);
-    const path39 = readStringValue(submodule.path);
+    const path40 = readStringValue(submodule.path);
     const commit = readStringValue(submodule.commit);
-    const repoPath = readStringValue(submodule.repoPath, submodule.repo_root) ?? joinRepoPath(parentRepoRoot, path39);
-    if (!path39 || !commit || !repoPath) return null;
+    const repoPath = readStringValue(submodule.repoPath, submodule.repo_root) ?? joinRepoPath(parentRepoRoot, path40);
+    if (!path40 || !commit || !repoPath) return null;
     return {
-      path: path39,
+      path: path40,
       commit,
       repoPath,
       dirty: readBooleanValue(submodule.dirty) ?? false,
@@ -35416,7 +35962,7 @@ async function hydrateInlineMeshDirectTruth(args) {
       if (!isSelfNode && daemonId) unavailableNodeIds.push(nodeId);
       continue;
     }
-    if (fs21.existsSync(workspace)) {
+    if (fs22.existsSync(workspace)) {
       try {
         const localGit = await getGitRepoStatus(workspace, { timeoutMs: 1e4, refreshUpstream: true });
         if (localGit?.isGitRepo) {
@@ -35501,7 +36047,7 @@ function readLiveMeshNodeWorkspace(args) {
 }
 function collectLiveMeshSessionRecords(args) {
   const nodeWorkspace = readStringValue(args.node?.workspace);
-  const nodeIsMissingLocalWorktree = args.node?.isLocalWorktree === true && !!nodeWorkspace && !fs21.existsSync(nodeWorkspace);
+  const nodeIsMissingLocalWorktree = args.node?.isLocalWorktree === true && !!nodeWorkspace && !fs22.existsSync(nodeWorkspace);
   const matches = args.liveSessionRecords.filter((record) => {
     const recordNodeId = readStringValue(record?.meta?.meshNodeId);
     if (recordNodeId && recordNodeId !== args.nodeId) return false;
@@ -35528,7 +36074,7 @@ function buildHistoricalMeshSessions(args) {
     const workspace = readStringValue(node?.workspace);
     if (nodeId) liveNodeIds.add(nodeId);
     if (workspace) liveWorkspaces.add(workspace);
-    if (nodeId && node?.isLocalWorktree === true && workspace && !fs21.existsSync(workspace)) {
+    if (nodeId && node?.isLocalWorktree === true && workspace && !fs22.existsSync(workspace)) {
       missingLocalWorktreeNodeIds.add(nodeId);
     }
   }
@@ -35727,10 +36273,10 @@ ${e?.stderr || ""}`
 }
 function buildPatchEquivalenceSubmoduleConflictHint(repoRoot, baseHead, branchHead, output) {
   if (!/(submodule|160000)/i.test(output) || !/(conflict|failed to merge)/i.test(output)) return void 0;
-  const conflicts = readChangedGitlinkPaths(repoRoot, baseHead, branchHead).map((path39) => ({
-    path: path39,
-    baseCommit: readTreeObject(repoRoot, baseHead, path39),
-    branchCommit: readTreeObject(repoRoot, branchHead, path39)
+  const conflicts = readChangedGitlinkPaths(repoRoot, baseHead, branchHead).map((path40) => ({
+    path: path40,
+    baseCommit: readTreeObject(repoRoot, baseHead, path40),
+    branchCommit: readTreeObject(repoRoot, branchHead, path40)
   }));
   if (conflicts.length === 0) return void 0;
   return {
@@ -35756,11 +36302,11 @@ function readChangedGitlinkPaths(repoRoot, fromRef, toRef) {
       if (!line.trim()) continue;
       const metaAndPath = line.split("	");
       const meta = metaAndPath[0] || "";
-      const path39 = metaAndPath[metaAndPath.length - 1]?.trim();
-      if (!path39) continue;
+      const path40 = metaAndPath[metaAndPath.length - 1]?.trim();
+      if (!path40) continue;
       const parts = meta.split(/\s+/);
       if (parts[0]?.includes("160000") || parts[1]?.includes("160000")) {
-        paths.add(path39);
+        paths.add(path40);
       }
     }
     return [...paths].sort();
@@ -35768,9 +36314,9 @@ function readChangedGitlinkPaths(repoRoot, fromRef, toRef) {
     return [];
   }
 }
-function readTreeObject(repoRoot, ref, path39) {
+function readTreeObject(repoRoot, ref, path40) {
   try {
-    const output = (0, import_node_child_process5.execFileSync)("git", ["ls-tree", ref, "--", path39], {
+    const output = (0, import_node_child_process5.execFileSync)("git", ["ls-tree", ref, "--", path40], {
       cwd: repoRoot,
       encoding: "utf8",
       maxBuffer: 1024 * 1024
@@ -35783,7 +36329,7 @@ function readTreeObject(repoRoot, ref, path39) {
 }
 async function alignRefinerySubmodulesAfterMerge(repoRoot, previousBaseHead, currentHead, options = {}) {
   const startedAt = Date.now();
-  const changedGitlinkPaths = readChangedGitlinkPaths(repoRoot, previousBaseHead, currentHead).filter((path39) => !(options.submoduleIgnorePaths || []).includes(path39));
+  const changedGitlinkPaths = readChangedGitlinkPaths(repoRoot, previousBaseHead, currentHead).filter((path40) => !(options.submoduleIgnorePaths || []).includes(path40));
   const preStatus = await getGitRepoStatus(repoRoot, {
     includeSubmodules: true,
     submoduleIgnorePaths: options.submoduleIgnorePaths,
@@ -35824,7 +36370,7 @@ async function alignRefinerySubmodulesAfterMerge(repoRoot, previousBaseHead, cur
       changedGitlinkPaths,
       outOfSyncPaths,
       updatedPaths: updatePaths,
-      verifiedPaths: updatePaths.filter((path39) => !remaining.some((submodule) => submodule.path === path39)),
+      verifiedPaths: updatePaths.filter((path40) => !remaining.some((submodule) => submodule.path === path40)),
       durationMs: Date.now() - startedAt,
       command: `git ${commandArgs.join(" ")}`,
       stdout: truncateValidationOutput(result.stdout),
@@ -35879,7 +36425,7 @@ async function runMeshRefineSubmoduleReachabilityGate(repoRoot, mergedTree, opti
       return { stdout: String(stdout || ""), stderr: String(stderr || ""), refspec };
     };
     const importCommitFromWorktreeSubmodule = async (submodulePath, worktreeSubmodulePath, commit) => {
-      if (!fs21.existsSync(worktreeSubmodulePath)) return false;
+      if (!fs22.existsSync(worktreeSubmodulePath)) return false;
       try {
         await runGit3(worktreeSubmodulePath, ["cat-file", "-e", `${commit}^{commit}`]);
       } catch {
@@ -35902,7 +36448,7 @@ async function runMeshRefineSubmoduleReachabilityGate(repoRoot, mergedTree, opti
         reachable: false
       };
       try {
-        if (!fs21.existsSync(submodulePath)) {
+        if (!fs22.existsSync(submodulePath)) {
           entry.error = `Submodule checkout missing at ${gitlink.path}`;
           entry.publishRequired = true;
           if (options.allowAutoPublishSubmoduleMainCommits === true) {
@@ -36094,9 +36640,9 @@ async function runMeshRefineValidationGate(mesh, workspace) {
     return ["npm", "pnpm", "yarn", "bun"].includes(command) && candidate.args.some((arg) => arg === "run" || arg === "test" || arg === "exec");
   };
   const dependenciesLikelyMissing = (cwd) => {
-    if (!fs21.existsSync((0, import_path10.join)(cwd, "package.json"))) return false;
-    if (fs21.existsSync((0, import_path10.join)(cwd, "node_modules"))) return false;
-    return ["package-lock.json", "npm-shrinkwrap.json", "pnpm-lock.yaml", "yarn.lock", "bun.lockb", "bun.lock"].some((lock) => fs21.existsSync((0, import_path10.join)(cwd, lock)));
+    if (!fs22.existsSync((0, import_path10.join)(cwd, "package.json"))) return false;
+    if (fs22.existsSync((0, import_path10.join)(cwd, "node_modules"))) return false;
+    return ["package-lock.json", "npm-shrinkwrap.json", "pnpm-lock.yaml", "yarn.lock", "bun.lockb", "bun.lock"].some((lock) => fs22.existsSync((0, import_path10.join)(cwd, lock)));
   };
   for (const candidate of selection.bootstrapCommands) {
     const startedAt = Date.now();
@@ -36193,9 +36739,9 @@ function resolveHermesUserHome() {
 function loadHermesCoordinatorBaseConfig(targetConfigPath) {
   const sourceHome = resolveHermesUserHome();
   const sourceConfigPath = (0, import_path10.join)(sourceHome, "config.yaml");
-  if (!fs21.existsSync(sourceConfigPath)) return { config: {}, sourceHome, sourceConfigPath };
+  if (!fs22.existsSync(sourceConfigPath)) return { config: {}, sourceHome, sourceConfigPath };
   if ((0, import_path10.resolve)(sourceConfigPath) === (0, import_path10.resolve)(targetConfigPath)) return { config: {}, sourceHome, sourceConfigPath };
-  const parsed = parseMeshCoordinatorMcpConfig(fs21.readFileSync(sourceConfigPath, "utf-8"), "hermes_config_yaml");
+  const parsed = parseMeshCoordinatorMcpConfig(fs22.readFileSync(sourceConfigPath, "utf-8"), "hermes_config_yaml");
   const { mcp_servers: _mcpServers, ...baseConfig } = parsed;
   return { config: baseConfig, sourceHome, sourceConfigPath };
 }
@@ -36232,9 +36778,9 @@ function copyHermesCoordinatorCredentialFiles(sourceHome, targetHome) {
   for (const fileName of [".env", "auth.json"]) {
     const sourcePath = (0, import_path10.join)(sourceHome, fileName);
     const targetPath = (0, import_path10.join)(targetHome, fileName);
-    if (!fs21.existsSync(sourcePath)) continue;
+    if (!fs22.existsSync(sourcePath)) continue;
     try {
-      fs21.copyFileSync(sourcePath, targetPath);
+      fs22.copyFileSync(sourcePath, targetPath);
     } catch (error) {
       LOG.warn("MeshCoordinator", `Could not copy Hermes ${fileName} into isolated coordinator home: ${error?.message || error}`);
     }
@@ -36589,13 +37135,13 @@ var DaemonCommandRouter = class {
         recoveryHint: "Inspect the mesh node record before removing it, or remove stale metadata manually only after confirming no managed worktree remains."
       };
     }
-    const worktreeExists = fs21.existsSync(workspace);
+    const worktreeExists = fs22.existsSync(workspace);
     const sourceNode = args.node?.clonedFromNodeId ? args.mesh?.nodes?.find((n) => n.id === args.node.clonedFromNodeId || n.nodeId === args.node.clonedFromNodeId) : args.mesh?.nodes?.find((n) => !n.isLocalWorktree);
     const repoRoot = typeof sourceNode?.repoRoot === "string" && sourceNode.repoRoot.trim() ? sourceNode.repoRoot.trim() : typeof sourceNode?.workspace === "string" && sourceNode.workspace.trim() ? sourceNode.workspace.trim() : "";
     if (!worktreeExists) {
       return { success: true, skipped: true, removedPath: workspace, repoRoot: repoRoot || void 0, reason: "worktree_path_missing" };
     }
-    if (!repoRoot || !fs21.existsSync(repoRoot)) {
+    if (!repoRoot || !fs22.existsSync(repoRoot)) {
       return {
         success: false,
         code: "mesh_worktree_cleanup_missing_source_repo",
@@ -36615,7 +37161,7 @@ var DaemonCommandRouter = class {
     const normalizePath = (value) => {
       const resolved = (0, import_path10.resolve)(value);
       try {
-        return fs21.realpathSync(resolved);
+        return fs22.realpathSync(resolved);
       } catch {
         return resolved;
       }
@@ -37554,8 +38100,8 @@ var DaemonCommandRouter = class {
           if (sinceTs > 0) {
             return { success: true, logs: [], totalBuffered: 0 };
           }
-          if (fs21.existsSync(LOG_PATH)) {
-            const content = fs21.readFileSync(LOG_PATH, "utf-8");
+          if (fs22.existsSync(LOG_PATH)) {
+            const content = fs22.readFileSync(LOG_PATH, "utf-8");
             const allLines = content.split("\n");
             const recent = allLines.slice(-count).join("\n");
             return { success: true, logs: recent, totalLines: allLines.length };
@@ -37945,24 +38491,24 @@ var DaemonCommandRouter = class {
       //    Settings page in the dashboard reads/writes via these two
       //    commands instead of going through fs from the browser.
       case "list_coordinator_prompts": {
-        const fs27 = await import("fs");
-        const path39 = await import("path");
-        const os28 = await import("os");
-        const dir = path39.join(os28.homedir(), ".adhdev", "coordinator-prompts");
+        const fs28 = await import("fs");
+        const path40 = await import("path");
+        const os29 = await import("os");
+        const dir = path40.join(os29.homedir(), ".adhdev", "coordinator-prompts");
         const entries = {};
         try {
-          if (fs27.existsSync(dir)) {
-            for (const name of fs27.readdirSync(dir)) {
+          if (fs28.existsSync(dir)) {
+            for (const name of fs28.readdirSync(dir)) {
               const matchOverride = name.match(/^([a-zA-Z0-9_.-]+)\.md$/);
               const matchAppend = name.match(/^([a-zA-Z0-9_.-]+)\.append\.md$/);
               const m = matchAppend || matchOverride;
               if (!m) continue;
               const isAppend = !!matchAppend;
               const key = m[1];
-              const full = path39.join(dir, name);
+              const full = path40.join(dir, name);
               let content = "";
               try {
-                content = fs27.readFileSync(full, "utf8");
+                content = fs28.readFileSync(full, "utf8");
               } catch {
               }
               if (!entries[key]) entries[key] = { override: "", append: "" };
@@ -37976,24 +38522,24 @@ var DaemonCommandRouter = class {
         return { success: true, dir, entries };
       }
       case "write_coordinator_prompt": {
-        const fs27 = await import("fs");
-        const path39 = await import("path");
-        const os28 = await import("os");
+        const fs28 = await import("fs");
+        const path40 = await import("path");
+        const os29 = await import("os");
         const key = typeof args?.key === "string" ? args.key.trim() : "";
         const kind = args?.kind === "append" ? "append" : "override";
         const content = typeof args?.content === "string" ? args.content : "";
         if (!key || !/^[a-zA-Z0-9_.-]+$/.test(key)) {
           return { success: false, error: "key must match [a-zA-Z0-9_.-]+" };
         }
-        const dir = path39.join(os28.homedir(), ".adhdev", "coordinator-prompts");
+        const dir = path40.join(os29.homedir(), ".adhdev", "coordinator-prompts");
         const filename = kind === "append" ? `${key}.append.md` : `${key}.md`;
-        const full = path39.join(dir, filename);
+        const full = path40.join(dir, filename);
         try {
-          fs27.mkdirSync(dir, { recursive: true });
+          fs28.mkdirSync(dir, { recursive: true });
           if (content.trim()) {
-            fs27.writeFileSync(full, content, { encoding: "utf8", mode: 384 });
-          } else if (fs27.existsSync(full)) {
-            fs27.unlinkSync(full);
+            fs28.writeFileSync(full, content, { encoding: "utf8", mode: 384 });
+          } else if (fs28.existsSync(full)) {
+            fs28.unlinkSync(full);
           }
           return { success: true, path: full, kind, key };
         } catch (error) {
@@ -39202,7 +39748,7 @@ ${ptyResult.output.slice(-2e3)}`);
               workspace
             };
           }
-          const { existsSync: existsSync38, readFileSync: readFileSync32, writeFileSync: writeFileSync19, copyFileSync: copyFileSync4, mkdirSync: mkdirSync18 } = await import("fs");
+          const { existsSync: existsSync39, readFileSync: readFileSync33, writeFileSync: writeFileSync20, copyFileSync: copyFileSync4, mkdirSync: mkdirSync19 } = await import("fs");
           const { dirname: dirname11 } = await import("path");
           const mcpConfigPath = coordinatorSetup.configPath;
           const hermesManualFallback = cliType === "hermes-cli" && configFormat === "hermes_config_yaml" ? createHermesManualMeshCoordinatorSetup(meshId, workspace) : null;
@@ -39238,21 +39784,21 @@ ${ptyResult.output.slice(-2e3)}`);
             };
           }
           try {
-            mkdirSync18(dirname11(mcpConfigPath), { recursive: true });
+            mkdirSync19(dirname11(mcpConfigPath), { recursive: true });
           } catch (error) {
             const message = `Could not prepare MCP config path for automatic setup: ${error?.message || error}`;
             LOG.error("MeshCoordinator", message);
             if (hermesManualFallback) return returnManualFallback(message);
             return { success: false, code: "mesh_coordinator_config_write_failed", error: message, meshId, cliType, workspace };
           }
-          const hadExistingMcpConfig = existsSync38(mcpConfigPath);
+          const hadExistingMcpConfig = existsSync39(mcpConfigPath);
           let existingMcpConfig = hermesBaseConfig?.config || {};
           if (hermesBaseConfig) {
             copyHermesCoordinatorCredentialFiles(hermesBaseConfig.sourceHome, dirname11(mcpConfigPath));
           }
           if (hadExistingMcpConfig) {
             try {
-              const parsedExistingMcpConfig = parseMeshCoordinatorMcpConfig(readFileSync32(mcpConfigPath, "utf-8"), configFormat);
+              const parsedExistingMcpConfig = parseMeshCoordinatorMcpConfig(readFileSync33(mcpConfigPath, "utf-8"), configFormat);
               const existingCoordinatorConfig = hermesManualFallback ? stripHermesCoordinatorTempModelProviderOverrides(parsedExistingMcpConfig) : parsedExistingMcpConfig;
               existingMcpConfig = { ...existingMcpConfig, ...existingCoordinatorConfig };
               copyFileSync4(mcpConfigPath, mcpConfigPath + ".backup");
@@ -39275,7 +39821,7 @@ ${ptyResult.output.slice(-2e3)}`);
             }
           };
           try {
-            writeFileSync19(mcpConfigPath, serializeMeshCoordinatorMcpConfig(mcpConfig, configFormat), "utf-8");
+            writeFileSync20(mcpConfigPath, serializeMeshCoordinatorMcpConfig(mcpConfig, configFormat), "utf-8");
           } catch (error) {
             const message = `Could not write MCP config for automatic setup: ${error?.message || error}`;
             LOG.error("MeshCoordinator", message);
@@ -39554,7 +40100,7 @@ ${ptyResult.output.slice(-2e3)}`);
               }
             }
             if (workspace) {
-              if (!fs21.existsSync(workspace)) {
+              if (!fs22.existsSync(workspace)) {
                 const inlineTransitGit = buildInlineMeshTransitGitStatus(node);
                 let remoteProbeApplied = false;
                 if (inlineTransitGit) {
@@ -39667,7 +40213,7 @@ ${ptyResult.output.slice(-2e3)}`);
           const callerCoordinatorDaemonId = typeof args?.coordinatorDaemonId === "string" && args.coordinatorDaemonId.trim() ? args.coordinatorDaemonId.trim() : this.deps.statusInstanceId || void 0;
           const pendingCoordinatorEvents = drainPendingMeshCoordinatorEvents(meshId, callerCoordinatorDaemonId);
           const previewFreshness = (() => {
-            const localRepoRoot = nodeStatuses.map((node) => readStringValue(node?.git?.repoRoot, node?.repoRoot, node?.workspace)).find((candidate) => !!candidate && fs21.existsSync(candidate));
+            const localRepoRoot = nodeStatuses.map((node) => readStringValue(node?.git?.repoRoot, node?.repoRoot, node?.workspace)).find((candidate) => !!candidate && fs22.existsSync(candidate));
             return localRepoRoot ? buildPreviewFreshness(localRepoRoot) : void 0;
           })();
           const asyncRefineJobs = buildMeshAsyncRefineJobs({
@@ -41414,12 +41960,12 @@ var ProviderInstanceManager = class {
 };
 
 // src/providers/version-archive.ts
-var fs22 = __toESM(require("fs"));
-var path34 = __toESM(require("path"));
-var os26 = __toESM(require("os"));
+var fs23 = __toESM(require("fs"));
+var path35 = __toESM(require("path"));
+var os27 = __toESM(require("os"));
 var import_os4 = require("os");
 var import_child_process9 = require("child_process");
-var ARCHIVE_PATH = path34.join(os26.homedir(), ".adhdev", "version-history.json");
+var ARCHIVE_PATH = path35.join(os27.homedir(), ".adhdev", "version-history.json");
 var MAX_ENTRIES_PER_PROVIDER = 20;
 var VersionArchive = class {
   history = {};
@@ -41428,8 +41974,8 @@ var VersionArchive = class {
   }
   load() {
     try {
-      if (fs22.existsSync(ARCHIVE_PATH)) {
-        this.history = JSON.parse(fs22.readFileSync(ARCHIVE_PATH, "utf-8"));
+      if (fs23.existsSync(ARCHIVE_PATH)) {
+        this.history = JSON.parse(fs23.readFileSync(ARCHIVE_PATH, "utf-8"));
       }
     } catch {
       this.history = {};
@@ -41466,8 +42012,8 @@ var VersionArchive = class {
   }
   save() {
     try {
-      fs22.mkdirSync(path34.dirname(ARCHIVE_PATH), { recursive: true });
-      fs22.writeFileSync(ARCHIVE_PATH, JSON.stringify(this.history, null, 2));
+      fs23.mkdirSync(path35.dirname(ARCHIVE_PATH), { recursive: true });
+      fs23.writeFileSync(ARCHIVE_PATH, JSON.stringify(this.history, null, 2));
     } catch {
     }
   }
@@ -41490,10 +42036,10 @@ function findBinary2(name) {
   for (const p of paths) {
     if (!p) continue;
     for (const ext of exes) {
-      const fullPath = path34.join(p, name + ext);
+      const fullPath = path35.join(p, name + ext);
       try {
-        if (fs22.existsSync(fullPath)) {
-          const stat2 = fs22.statSync(fullPath);
+        if (fs23.existsSync(fullPath)) {
+          const stat2 = fs23.statSync(fullPath);
           if (stat2.isFile() && (isWin || stat2.mode & 73)) {
             return fullPath;
           }
@@ -41538,19 +42084,19 @@ async function getVersion(binary, versionCommand) {
 function checkPathExists2(paths) {
   for (const p of paths) {
     if (p.includes("*")) {
-      const home = os26.homedir();
-      const resolved = p.replace(/\*/g, home.split(path34.sep).pop() || "");
-      if (fs22.existsSync(resolved)) return resolved;
+      const home = os27.homedir();
+      const resolved = p.replace(/\*/g, home.split(path35.sep).pop() || "");
+      if (fs23.existsSync(resolved)) return resolved;
     } else {
-      if (fs22.existsSync(p)) return p;
+      if (fs23.existsSync(p)) return p;
     }
   }
   return null;
 }
 async function getMacAppVersion(appPath) {
   if ((0, import_os4.platform)() !== "darwin" || !appPath.endsWith(".app")) return null;
-  const plistPath = path34.join(appPath, "Contents", "Info.plist");
-  if (!fs22.existsSync(plistPath)) return null;
+  const plistPath = path35.join(appPath, "Contents", "Info.plist");
+  if (!fs23.existsSync(plistPath)) return null;
   const raw = await runCommand(`/usr/libexec/PlistBuddy -c "Print CFBundleShortVersionString" "${plistPath}"`);
   return raw || null;
 }
@@ -41575,8 +42121,8 @@ async function detectAllVersions(loader, archive) {
       const cliBin = provider.cli ? findBinary2(provider.cli) : null;
       let resolvedBin = cliBin;
       if (!resolvedBin && appPath && currentOs === "darwin") {
-        const bundled = path34.join(appPath, "Contents", "Resources", "app", "bin", provider.cli || "");
-        if (provider.cli && fs22.existsSync(bundled)) resolvedBin = bundled;
+        const bundled = path35.join(appPath, "Contents", "Resources", "app", "bin", provider.cli || "");
+        if (provider.cli && fs23.existsSync(bundled)) resolvedBin = bundled;
       }
       info.installed = !!(appPath || resolvedBin);
       info.path = appPath || null;
@@ -41615,8 +42161,8 @@ async function detectAllVersions(loader, archive) {
 
 // src/daemon/dev-server.ts
 var http2 = __toESM(require("http"));
-var fs26 = __toESM(require("fs"));
-var path38 = __toESM(require("path"));
+var fs27 = __toESM(require("fs"));
+var path39 = __toESM(require("path"));
 init_config();
 
 // src/daemon/scaffold-template.ts
@@ -41966,8 +42512,8 @@ async (params) => {
 init_logger();
 
 // src/daemon/dev-cdp-handlers.ts
-var fs23 = __toESM(require("fs"));
-var path35 = __toESM(require("path"));
+var fs24 = __toESM(require("fs"));
+var path36 = __toESM(require("path"));
 init_logger();
 async function handleCdpEvaluate(ctx, req, res) {
   const body = await ctx.readBody(req);
@@ -42146,18 +42692,18 @@ async function handleScriptHints(ctx, type, _req, res) {
     return;
   }
   let scriptsPath = "";
-  const directScripts = path35.join(dir, "scripts.js");
-  if (fs23.existsSync(directScripts)) {
+  const directScripts = path36.join(dir, "scripts.js");
+  if (fs24.existsSync(directScripts)) {
     scriptsPath = directScripts;
   } else {
-    const scriptsDir = path35.join(dir, "scripts");
-    if (fs23.existsSync(scriptsDir)) {
-      const versions = fs23.readdirSync(scriptsDir).filter((d) => {
-        return fs23.statSync(path35.join(scriptsDir, d)).isDirectory();
+    const scriptsDir = path36.join(dir, "scripts");
+    if (fs24.existsSync(scriptsDir)) {
+      const versions = fs24.readdirSync(scriptsDir).filter((d) => {
+        return fs24.statSync(path36.join(scriptsDir, d)).isDirectory();
       }).sort().reverse();
       for (const ver of versions) {
-        const p = path35.join(scriptsDir, ver, "scripts.js");
-        if (fs23.existsSync(p)) {
+        const p = path36.join(scriptsDir, ver, "scripts.js");
+        if (fs24.existsSync(p)) {
           scriptsPath = p;
           break;
         }
@@ -42169,7 +42715,7 @@ async function handleScriptHints(ctx, type, _req, res) {
     return;
   }
   try {
-    const source = fs23.readFileSync(scriptsPath, "utf-8");
+    const source = fs24.readFileSync(scriptsPath, "utf-8");
     const hints = {};
     const funcRegex = /module\.exports\.(\w+)\s*=\s*function\s+\w+\s*\(params\)/g;
     let match;
@@ -42984,8 +43530,8 @@ async function handleDomContext(ctx, type, req, res) {
 }
 
 // src/daemon/dev-cli-debug.ts
-var fs24 = __toESM(require("fs"));
-var path36 = __toESM(require("path"));
+var fs25 = __toESM(require("fs"));
+var path37 = __toESM(require("path"));
 function slugifyFixtureName(value) {
   const normalized = String(value || "").trim().toLowerCase().replace(/[^a-z0-9._-]+/g, "-").replace(/^-+|-+$/g, "");
   return normalized || `fixture-${Date.now()}`;
@@ -42995,15 +43541,15 @@ function getCliFixtureDir(ctx, type) {
   if (!providerDir) {
     throw new Error(`Provider directory not found for '${type}'`);
   }
-  return path36.join(providerDir, "fixtures");
+  return path37.join(providerDir, "fixtures");
 }
 function readCliFixture(ctx, type, name) {
   const fixtureDir = getCliFixtureDir(ctx, type);
-  const filePath = path36.join(fixtureDir, `${name}.json`);
-  if (!fs24.existsSync(filePath)) {
+  const filePath = path37.join(fixtureDir, `${name}.json`);
+  if (!fs25.existsSync(filePath)) {
     throw new Error(`Fixture not found: ${filePath}`);
   }
-  return JSON.parse(fs24.readFileSync(filePath, "utf-8"));
+  return JSON.parse(fs25.readFileSync(filePath, "utf-8"));
 }
 function getExerciseTranscriptText(result) {
   const parts = [];
@@ -43748,7 +44294,7 @@ async function handleCliFixtureCapture(ctx, req, res) {
       return;
     }
     const fixtureDir = getCliFixtureDir(ctx, type);
-    fs24.mkdirSync(fixtureDir, { recursive: true });
+    fs25.mkdirSync(fixtureDir, { recursive: true });
     const name = slugifyFixtureName(String(body?.name || `${type}-${Date.now()}`));
     const result = await runCliExerciseInternal(ctx, { ...request, type });
     const fixture = {
@@ -43775,8 +44321,8 @@ async function handleCliFixtureCapture(ctx, req, res) {
       },
       notes: typeof body?.notes === "string" ? body.notes : void 0
     };
-    const filePath = path36.join(fixtureDir, `${name}.json`);
-    fs24.writeFileSync(filePath, JSON.stringify(fixture, null, 2));
+    const filePath = path37.join(fixtureDir, `${name}.json`);
+    fs25.writeFileSync(filePath, JSON.stringify(fixture, null, 2));
     ctx.json(res, 200, {
       saved: true,
       name,
@@ -43794,14 +44340,14 @@ async function handleCliFixtureCapture(ctx, req, res) {
 async function handleCliFixtureList(ctx, type, _req, res) {
   try {
     const fixtureDir = getCliFixtureDir(ctx, type);
-    if (!fs24.existsSync(fixtureDir)) {
+    if (!fs25.existsSync(fixtureDir)) {
       ctx.json(res, 200, { fixtures: [], count: 0 });
       return;
     }
-    const fixtures = fs24.readdirSync(fixtureDir).filter((file) => file.endsWith(".json")).sort((a, b) => b.localeCompare(a, void 0, { numeric: true, sensitivity: "base" })).map((file) => {
-      const fullPath = path36.join(fixtureDir, file);
+    const fixtures = fs25.readdirSync(fixtureDir).filter((file) => file.endsWith(".json")).sort((a, b) => b.localeCompare(a, void 0, { numeric: true, sensitivity: "base" })).map((file) => {
+      const fullPath = path37.join(fixtureDir, file);
       try {
-        const raw = JSON.parse(fs24.readFileSync(fullPath, "utf-8"));
+        const raw = JSON.parse(fs25.readFileSync(fullPath, "utf-8"));
         return {
           name: raw.name || file.replace(/\.json$/i, ""),
           path: fullPath,
@@ -43934,9 +44480,9 @@ async function handleCliRaw(ctx, req, res) {
 }
 
 // src/daemon/dev-auto-implement.ts
-var fs25 = __toESM(require("fs"));
-var path37 = __toESM(require("path"));
-var os27 = __toESM(require("os"));
+var fs26 = __toESM(require("fs"));
+var path38 = __toESM(require("path"));
+var os28 = __toESM(require("os"));
 function getAutoImplPid(ctx) {
   const pid = ctx.autoImplProcess?.pid;
   return typeof pid === "number" && pid > 0 ? pid : null;
@@ -43982,38 +44528,38 @@ function resolveAutoImplReference(ctx, category, requestedReference, targetType)
   return fallback?.type || null;
 }
 function getLatestScriptVersionDir(scriptsDir) {
-  if (!fs25.existsSync(scriptsDir)) return null;
-  const versions = fs25.readdirSync(scriptsDir).filter((d) => {
+  if (!fs26.existsSync(scriptsDir)) return null;
+  const versions = fs26.readdirSync(scriptsDir).filter((d) => {
     try {
-      return fs25.statSync(path37.join(scriptsDir, d)).isDirectory();
+      return fs26.statSync(path38.join(scriptsDir, d)).isDirectory();
     } catch {
       return false;
     }
   }).sort((a, b) => b.localeCompare(a, void 0, { numeric: true, sensitivity: "base" }));
   if (versions.length === 0) return null;
-  return path37.join(scriptsDir, versions[0]);
+  return path38.join(scriptsDir, versions[0]);
 }
 function resolveAutoImplWritableProviderDir(ctx, category, type, requestedDir) {
-  const canonicalUserDir = path37.resolve(ctx.providerLoader.getUserProviderDir(category, type));
-  const desiredDir = requestedDir ? path37.resolve(requestedDir) : canonicalUserDir;
-  const upstreamRoot = path37.resolve(ctx.providerLoader.getUpstreamDir());
-  if (desiredDir === upstreamRoot || desiredDir.startsWith(`${upstreamRoot}${path37.sep}`)) {
+  const canonicalUserDir = path38.resolve(ctx.providerLoader.getUserProviderDir(category, type));
+  const desiredDir = requestedDir ? path38.resolve(requestedDir) : canonicalUserDir;
+  const upstreamRoot = path38.resolve(ctx.providerLoader.getUpstreamDir());
+  if (desiredDir === upstreamRoot || desiredDir.startsWith(`${upstreamRoot}${path38.sep}`)) {
     return { dir: null, reason: `Refusing to write into upstream provider directory: ${desiredDir}` };
   }
-  if (path37.basename(desiredDir) !== type) {
+  if (path38.basename(desiredDir) !== type) {
     return { dir: null, reason: `Requested writable provider directory must end with '${type}': ${desiredDir}` };
   }
   const sourceDir = ctx.findProviderDir(type);
   if (!sourceDir) {
     return { dir: null, reason: `Provider source directory not found for '${type}'` };
   }
-  if (!fs25.existsSync(desiredDir)) {
-    fs25.mkdirSync(path37.dirname(desiredDir), { recursive: true });
-    fs25.cpSync(sourceDir, desiredDir, { recursive: true });
+  if (!fs26.existsSync(desiredDir)) {
+    fs26.mkdirSync(path38.dirname(desiredDir), { recursive: true });
+    fs26.cpSync(sourceDir, desiredDir, { recursive: true });
     ctx.log(`Auto-implement writable copy created: ${desiredDir}`);
   }
-  const providerJson = path37.join(desiredDir, "provider.json");
-  if (!fs25.existsSync(providerJson)) {
+  const providerJson = path38.join(desiredDir, "provider.json");
+  if (!fs26.existsSync(providerJson)) {
     return { dir: null, reason: `provider.json not found in writable provider directory: ${desiredDir}` };
   }
   return { dir: desiredDir };
@@ -44021,15 +44567,15 @@ function resolveAutoImplWritableProviderDir(ctx, category, type, requestedDir) {
 function loadAutoImplReferenceScripts(ctx, referenceType) {
   if (!referenceType) return {};
   const refDir = ctx.findProviderDir(referenceType);
-  if (!refDir || !fs25.existsSync(refDir)) return {};
+  if (!refDir || !fs26.existsSync(refDir)) return {};
   const referenceScripts = {};
-  const scriptsDir = path37.join(refDir, "scripts");
+  const scriptsDir = path38.join(refDir, "scripts");
   const latestDir = getLatestScriptVersionDir(scriptsDir);
   if (!latestDir) return referenceScripts;
-  for (const file of fs25.readdirSync(latestDir)) {
+  for (const file of fs26.readdirSync(latestDir)) {
     if (!file.endsWith(".js")) continue;
     try {
-      referenceScripts[file] = fs25.readFileSync(path37.join(latestDir, file), "utf-8");
+      referenceScripts[file] = fs26.readFileSync(path38.join(latestDir, file), "utf-8");
     } catch {
     }
   }
@@ -44137,16 +44683,16 @@ async function handleAutoImplement(ctx, type, req, res) {
     });
     const referenceScripts = loadAutoImplReferenceScripts(ctx, resolvedReference);
     const prompt = buildAutoImplPrompt(ctx, type, provider, providerDir, functions, domContext, referenceScripts, comment, resolvedReference, verification);
-    const tmpDir = path37.join(os27.tmpdir(), "adhdev-autoimpl");
-    if (!fs25.existsSync(tmpDir)) fs25.mkdirSync(tmpDir, { recursive: true });
-    const promptFile = path37.join(tmpDir, `prompt-${type}-${Date.now()}.md`);
-    fs25.writeFileSync(promptFile, prompt, "utf-8");
+    const tmpDir = path38.join(os28.tmpdir(), "adhdev-autoimpl");
+    if (!fs26.existsSync(tmpDir)) fs26.mkdirSync(tmpDir, { recursive: true });
+    const promptFile = path38.join(tmpDir, `prompt-${type}-${Date.now()}.md`);
+    fs26.writeFileSync(promptFile, prompt, "utf-8");
     ctx.log(`Auto-implement prompt written to ${promptFile} (${prompt.length} chars)`);
     const agentProvider = ctx.providerLoader.resolve(agent) || ctx.providerLoader.getMeta(agent);
     const spawn4 = agentProvider?.spawn;
     if (!spawn4?.command) {
       try {
-        fs25.unlinkSync(promptFile);
+        fs26.unlinkSync(promptFile);
       } catch {
       }
       ctx.json(res, 400, { error: `Agent '${agent}' has no spawn config. Select a CLI provider with a spawn configuration.` });
@@ -44248,7 +44794,7 @@ async function handleAutoImplement(ctx, type, req, res) {
         } catch {
         }
         try {
-          fs25.unlinkSync(promptFile);
+          fs26.unlinkSync(promptFile);
         } catch {
         }
         ctx.log(`Auto-implement (ACP) ${success ? "completed" : "failed"}: ${type} (exit: ${code})`);
@@ -44292,7 +44838,7 @@ async function handleAutoImplement(ctx, type, req, res) {
     const interactiveFlags = ["--yolo", "--interactive", "-i"];
     const baseArgs = [...spawn4.args || []].filter((a) => !interactiveFlags.includes(a));
     let shellCmd;
-    const isWin = os27.platform() === "win32";
+    const isWin = os28.platform() === "win32";
     const escapeArg = (a) => isWin ? `"${a.replace(/"/g, '""')}"` : `'${a.replace(/'/g, "'\\''")}'`;
     const promptMode = autoImpl?.promptMode ?? "stdin";
     const extraArgs = autoImpl?.extraArgs ?? [];
@@ -44331,7 +44877,7 @@ async function handleAutoImplement(ctx, type, req, res) {
     try {
       const pty = require("node-pty");
       ctx.log(`Auto-implement spawn (PTY): ${shellCmd}`);
-      const isWin2 = os27.platform() === "win32";
+      const isWin2 = os28.platform() === "win32";
       child = pty.spawn(isWin2 ? "cmd.exe" : process.env.SHELL || "/bin/zsh", [isWin2 ? "/c" : "-c", shellCmd], {
         name: "xterm-256color",
         cols: 120,
@@ -44474,7 +45020,7 @@ async function handleAutoImplement(ctx, type, req, res) {
         }
       });
       try {
-        fs25.unlinkSync(promptFile);
+        fs26.unlinkSync(promptFile);
       } catch {
       }
       ctx.log(`Auto-implement ${success ? "completed" : "failed"}: ${type} (exit: ${code})${verificationSummary ? ` verify=${verificationSummary.pass ? "pass" : "fail"}` : ""}`);
@@ -44571,7 +45117,7 @@ function buildAutoImplPrompt(ctx, type, provider, providerDir, functions, domCon
     setMode: "set_mode.js"
   };
   const targetFileNames = new Set(functions.map((fn) => funcToFile[fn]).filter(Boolean));
-  const scriptsDir = path37.join(providerDir, "scripts");
+  const scriptsDir = path38.join(providerDir, "scripts");
   const latestScriptsDir = getLatestScriptVersionDir(scriptsDir);
   if (latestScriptsDir) {
     lines.push(`Scripts version directory: \`${latestScriptsDir}\``);
@@ -44579,10 +45125,10 @@ function buildAutoImplPrompt(ctx, type, provider, providerDir, functions, domCon
     lines.push("## \u270F\uFE0F Target Files (EDIT THESE)");
     lines.push("These are the ONLY files you are allowed to modify. Replace the TODO stubs with working implementations.");
     lines.push("");
-    for (const file of fs25.readdirSync(latestScriptsDir)) {
+    for (const file of fs26.readdirSync(latestScriptsDir)) {
       if (file.endsWith(".js") && targetFileNames.has(file)) {
         try {
-          const content = fs25.readFileSync(path37.join(latestScriptsDir, file), "utf-8");
+          const content = fs26.readFileSync(path38.join(latestScriptsDir, file), "utf-8");
           lines.push(`### \`${file}\` \u270F\uFE0F EDIT`);
           lines.push("```javascript");
           lines.push(content);
@@ -44592,14 +45138,14 @@ function buildAutoImplPrompt(ctx, type, provider, providerDir, functions, domCon
         }
       }
     }
-    const refFiles = fs25.readdirSync(latestScriptsDir).filter((f) => f.endsWith(".js") && !targetFileNames.has(f));
+    const refFiles = fs26.readdirSync(latestScriptsDir).filter((f) => f.endsWith(".js") && !targetFileNames.has(f));
     if (refFiles.length > 0) {
       lines.push("## \u{1F512} Other Scripts (REFERENCE ONLY \u2014 DO NOT EDIT)");
       lines.push("These files are shown for context only. Do NOT modify them under any circumstances.");
       lines.push("");
       for (const file of refFiles) {
         try {
-          const content = fs25.readFileSync(path37.join(latestScriptsDir, file), "utf-8");
+          const content = fs26.readFileSync(path38.join(latestScriptsDir, file), "utf-8");
           lines.push(`### \`${file}\` \u{1F512}`);
           lines.push("```javascript");
           lines.push(content);
@@ -44640,11 +45186,11 @@ function buildAutoImplPrompt(ctx, type, provider, providerDir, functions, domCon
       lines.push("");
     }
   }
-  const docsDir = path37.join(providerDir, "../../docs");
+  const docsDir = path38.join(providerDir, "../../docs");
   const loadGuide = (name) => {
     try {
-      const p = path37.join(docsDir, name);
-      if (fs25.existsSync(p)) return fs25.readFileSync(p, "utf-8");
+      const p = path38.join(docsDir, name);
+      if (fs26.existsSync(p)) return fs26.readFileSync(p, "utf-8");
     } catch {
     }
     return null;
@@ -44880,7 +45426,7 @@ function buildCliAutoImplPrompt(ctx, type, provider, providerDir, functions, ref
     parseApproval: "parse_approval.js"
   };
   const targetFileNames = new Set(functions.map((fn) => funcToFile[fn]).filter(Boolean));
-  const scriptsDir = path37.join(providerDir, "scripts");
+  const scriptsDir = path38.join(providerDir, "scripts");
   const latestScriptsDir = getLatestScriptVersionDir(scriptsDir);
   if (latestScriptsDir) {
     lines.push(`Scripts version directory: \`${latestScriptsDir}\``);
@@ -44888,11 +45434,11 @@ function buildCliAutoImplPrompt(ctx, type, provider, providerDir, functions, ref
     lines.push("## \u270F\uFE0F Target Files (EDIT THESE)");
     lines.push("These are the ONLY files you are allowed to modify. Replace TODO or heuristic-only logic with working PTY-aware implementations.");
     lines.push("");
-    for (const file of fs25.readdirSync(latestScriptsDir)) {
+    for (const file of fs26.readdirSync(latestScriptsDir)) {
       if (!file.endsWith(".js")) continue;
       if (!targetFileNames.has(file)) continue;
       try {
-        const content = fs25.readFileSync(path37.join(latestScriptsDir, file), "utf-8");
+        const content = fs26.readFileSync(path38.join(latestScriptsDir, file), "utf-8");
         lines.push(`### \`${file}\` \u270F\uFE0F EDIT`);
         lines.push("```javascript");
         lines.push(content);
@@ -44901,14 +45447,14 @@ function buildCliAutoImplPrompt(ctx, type, provider, providerDir, functions, ref
       } catch {
       }
     }
-    const refFiles = fs25.readdirSync(latestScriptsDir).filter((f) => f.endsWith(".js") && !targetFileNames.has(f));
+    const refFiles = fs26.readdirSync(latestScriptsDir).filter((f) => f.endsWith(".js") && !targetFileNames.has(f));
     if (refFiles.length > 0) {
       lines.push("## \u{1F512} Other Scripts (REFERENCE ONLY \u2014 DO NOT EDIT)");
       lines.push("These files are shown for context only. Do NOT modify them under any circumstances.");
       lines.push("");
       for (const file of refFiles) {
         try {
-          const content = fs25.readFileSync(path37.join(latestScriptsDir, file), "utf-8");
+          const content = fs26.readFileSync(path38.join(latestScriptsDir, file), "utf-8");
           lines.push(`### \`${file}\` \u{1F512}`);
           lines.push("```javascript");
           lines.push(content);
@@ -44941,11 +45487,11 @@ function buildCliAutoImplPrompt(ctx, type, provider, providerDir, functions, ref
       lines.push("");
     }
   }
-  const docsDir = path37.join(providerDir, "../../docs");
+  const docsDir = path38.join(providerDir, "../../docs");
   const loadGuide = (name) => {
     try {
-      const p = path37.join(docsDir, name);
-      if (fs25.existsSync(p)) return fs25.readFileSync(p, "utf-8");
+      const p = path38.join(docsDir, name);
+      if (fs26.existsSync(p)) return fs26.readFileSync(p, "utf-8");
     } catch {
     }
     return null;
@@ -45391,8 +45937,8 @@ var DevServer = class _DevServer {
   }
   getEndpointList() {
     return this.routes.map((r) => {
-      const path39 = typeof r.pattern === "string" ? r.pattern : r.pattern.source.replace(/\\\//g, "/").replace(/\(\[.*?\]\+\)/g, ":type").replace(/[\^$]/g, "");
-      return `${r.method.padEnd(5)} ${path39}`;
+      const path40 = typeof r.pattern === "string" ? r.pattern : r.pattern.source.replace(/\\\//g, "/").replace(/\(\[.*?\]\+\)/g, ":type").replace(/[\^$]/g, "");
+      return `${r.method.padEnd(5)} ${path40}`;
     });
   }
   async start(port = DEV_SERVER_PORT) {
@@ -45680,12 +46226,12 @@ var DevServer = class _DevServer {
   // ─── DevConsole SPA ───
   getConsoleDistDir() {
     const candidates = [
-      path38.resolve(__dirname, "../../web-devconsole/dist"),
-      path38.resolve(__dirname, "../../../web-devconsole/dist"),
-      path38.join(process.cwd(), "packages/web-devconsole/dist")
+      path39.resolve(__dirname, "../../web-devconsole/dist"),
+      path39.resolve(__dirname, "../../../web-devconsole/dist"),
+      path39.join(process.cwd(), "packages/web-devconsole/dist")
     ];
     for (const dir of candidates) {
-      if (fs26.existsSync(path38.join(dir, "index.html"))) return dir;
+      if (fs27.existsSync(path39.join(dir, "index.html"))) return dir;
     }
     return null;
   }
@@ -45695,9 +46241,9 @@ var DevServer = class _DevServer {
       this.json(res, 500, { error: "DevConsole not found. Run: npm run build -w packages/web-devconsole" });
       return;
     }
-    const htmlPath = path38.join(distDir, "index.html");
+    const htmlPath = path39.join(distDir, "index.html");
     try {
-      const html = fs26.readFileSync(htmlPath, "utf-8");
+      const html = fs27.readFileSync(htmlPath, "utf-8");
       res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
       res.end(html);
     } catch (e) {
@@ -45720,15 +46266,15 @@ var DevServer = class _DevServer {
       this.json(res, 404, { error: "Not found" });
       return;
     }
-    const safePath = path38.normalize(pathname).replace(/^\.\.\//, "");
-    const filePath = path38.join(distDir, safePath);
+    const safePath = path39.normalize(pathname).replace(/^\.\.\//, "");
+    const filePath = path39.join(distDir, safePath);
     if (!filePath.startsWith(distDir)) {
       this.json(res, 403, { error: "Forbidden" });
       return;
     }
     try {
-      const content = fs26.readFileSync(filePath);
-      const ext = path38.extname(filePath);
+      const content = fs27.readFileSync(filePath);
+      const ext = path39.extname(filePath);
       const contentType = _DevServer.MIME_MAP[ext] || "application/octet-stream";
       res.writeHead(200, { "Content-Type": contentType, "Cache-Control": "public, max-age=31536000, immutable" });
       res.end(content);
@@ -45836,14 +46382,14 @@ var DevServer = class _DevServer {
     const files = [];
     const scan = (d, prefix) => {
       try {
-        for (const entry of fs26.readdirSync(d, { withFileTypes: true })) {
+        for (const entry of fs27.readdirSync(d, { withFileTypes: true })) {
           if (entry.name.startsWith(".") || entry.name.endsWith(".bak")) continue;
           const rel = prefix ? `${prefix}/${entry.name}` : entry.name;
           if (entry.isDirectory()) {
             files.push({ path: rel, size: 0, type: "dir" });
-            scan(path38.join(d, entry.name), rel);
+            scan(path39.join(d, entry.name), rel);
           } else {
-            const stat2 = fs26.statSync(path38.join(d, entry.name));
+            const stat2 = fs27.statSync(path39.join(d, entry.name));
             files.push({ path: rel, size: stat2.size, type: "file" });
           }
         }
@@ -45866,16 +46412,16 @@ var DevServer = class _DevServer {
       this.json(res, 404, { error: `Provider directory not found: ${type}` });
       return;
     }
-    const fullPath = path38.resolve(dir, path38.normalize(filePath));
+    const fullPath = path39.resolve(dir, path39.normalize(filePath));
     if (!fullPath.startsWith(dir)) {
       this.json(res, 403, { error: "Forbidden" });
       return;
     }
-    if (!fs26.existsSync(fullPath) || fs26.statSync(fullPath).isDirectory()) {
+    if (!fs27.existsSync(fullPath) || fs27.statSync(fullPath).isDirectory()) {
       this.json(res, 404, { error: `File not found: ${filePath}` });
       return;
     }
-    const content = fs26.readFileSync(fullPath, "utf-8");
+    const content = fs27.readFileSync(fullPath, "utf-8");
     this.json(res, 200, { type, path: filePath, content, lines: content.split("\n").length });
   }
   /** POST /api/providers/:type/file — write a file { path, content } */
@@ -45891,15 +46437,15 @@ var DevServer = class _DevServer {
       this.json(res, 404, { error: `Provider directory not found: ${type}` });
       return;
     }
-    const fullPath = path38.resolve(dir, path38.normalize(filePath));
+    const fullPath = path39.resolve(dir, path39.normalize(filePath));
     if (!fullPath.startsWith(dir)) {
       this.json(res, 403, { error: "Forbidden" });
       return;
     }
     try {
-      if (fs26.existsSync(fullPath)) fs26.copyFileSync(fullPath, fullPath + ".bak");
-      fs26.mkdirSync(path38.dirname(fullPath), { recursive: true });
-      fs26.writeFileSync(fullPath, content, "utf-8");
+      if (fs27.existsSync(fullPath)) fs27.copyFileSync(fullPath, fullPath + ".bak");
+      fs27.mkdirSync(path39.dirname(fullPath), { recursive: true });
+      fs27.writeFileSync(fullPath, content, "utf-8");
       this.log(`File saved: ${fullPath} (${content.length} chars)`);
       this.providerLoader.reload();
       this.json(res, 200, { saved: true, path: filePath, chars: content.length });
@@ -45915,9 +46461,9 @@ var DevServer = class _DevServer {
       return;
     }
     for (const name of ["scripts.js", "provider.json"]) {
-      const p = path38.join(dir, name);
-      if (fs26.existsSync(p)) {
-        const source = fs26.readFileSync(p, "utf-8");
+      const p = path39.join(dir, name);
+      if (fs27.existsSync(p)) {
+        const source = fs27.readFileSync(p, "utf-8");
         this.json(res, 200, { type, path: p, source, lines: source.split("\n").length });
         return;
       }
@@ -45936,11 +46482,11 @@ var DevServer = class _DevServer {
       this.json(res, 404, { error: `Provider not found: ${type}` });
       return;
     }
-    const target = fs26.existsSync(path38.join(dir, "scripts.js")) ? "scripts.js" : "provider.json";
-    const targetPath = path38.join(dir, target);
+    const target = fs27.existsSync(path39.join(dir, "scripts.js")) ? "scripts.js" : "provider.json";
+    const targetPath = path39.join(dir, target);
     try {
-      if (fs26.existsSync(targetPath)) fs26.copyFileSync(targetPath, targetPath + ".bak");
-      fs26.writeFileSync(targetPath, source, "utf-8");
+      if (fs27.existsSync(targetPath)) fs27.copyFileSync(targetPath, targetPath + ".bak");
+      fs27.writeFileSync(targetPath, source, "utf-8");
       this.log(`Saved provider: ${targetPath} (${source.length} chars)`);
       this.providerLoader.reload();
       this.json(res, 200, { saved: true, path: targetPath, chars: source.length });
@@ -46084,21 +46630,21 @@ var DevServer = class _DevServer {
     }
     let targetDir;
     targetDir = this.providerLoader.getUserProviderDir(category, type);
-    const jsonPath = path38.join(targetDir, "provider.json");
-    if (fs26.existsSync(jsonPath)) {
+    const jsonPath = path39.join(targetDir, "provider.json");
+    if (fs27.existsSync(jsonPath)) {
       this.json(res, 409, { error: `Provider already exists at ${targetDir}`, path: targetDir });
       return;
     }
     try {
       const result = generateFiles(type, name, category, { cdpPorts, cli, processName, installPath, binary, extensionId, version, osPaths, processNames });
-      fs26.mkdirSync(targetDir, { recursive: true });
-      fs26.writeFileSync(jsonPath, result["provider.json"], "utf-8");
+      fs27.mkdirSync(targetDir, { recursive: true });
+      fs27.writeFileSync(jsonPath, result["provider.json"], "utf-8");
       const createdFiles = ["provider.json"];
       if (result.files) {
         for (const [relPath, content] of Object.entries(result.files)) {
-          const fullPath = path38.join(targetDir, relPath);
-          fs26.mkdirSync(path38.dirname(fullPath), { recursive: true });
-          fs26.writeFileSync(fullPath, content, "utf-8");
+          const fullPath = path39.join(targetDir, relPath);
+          fs27.mkdirSync(path39.dirname(fullPath), { recursive: true });
+          fs27.writeFileSync(fullPath, content, "utf-8");
           createdFiles.push(relPath);
         }
       }
@@ -46147,38 +46693,38 @@ var DevServer = class _DevServer {
   }
   // ─── Phase 2: Auto-Implement Backend ───
   getLatestScriptVersionDir(scriptsDir) {
-    if (!fs26.existsSync(scriptsDir)) return null;
-    const versions = fs26.readdirSync(scriptsDir).filter((d) => {
+    if (!fs27.existsSync(scriptsDir)) return null;
+    const versions = fs27.readdirSync(scriptsDir).filter((d) => {
       try {
-        return fs26.statSync(path38.join(scriptsDir, d)).isDirectory();
+        return fs27.statSync(path39.join(scriptsDir, d)).isDirectory();
       } catch {
         return false;
       }
     }).sort((a, b) => b.localeCompare(a, void 0, { numeric: true, sensitivity: "base" }));
     if (versions.length === 0) return null;
-    return path38.join(scriptsDir, versions[0]);
+    return path39.join(scriptsDir, versions[0]);
   }
   resolveAutoImplWritableProviderDir(category, type, requestedDir) {
-    const canonicalUserDir = path38.resolve(this.providerLoader.getUserProviderDir(category, type));
-    const desiredDir = requestedDir ? path38.resolve(requestedDir) : canonicalUserDir;
-    const upstreamRoot = path38.resolve(this.providerLoader.getUpstreamDir());
-    if (desiredDir === upstreamRoot || desiredDir.startsWith(`${upstreamRoot}${path38.sep}`)) {
+    const canonicalUserDir = path39.resolve(this.providerLoader.getUserProviderDir(category, type));
+    const desiredDir = requestedDir ? path39.resolve(requestedDir) : canonicalUserDir;
+    const upstreamRoot = path39.resolve(this.providerLoader.getUpstreamDir());
+    if (desiredDir === upstreamRoot || desiredDir.startsWith(`${upstreamRoot}${path39.sep}`)) {
       return { dir: null, reason: `Refusing to write into upstream provider directory: ${desiredDir}` };
     }
-    if (path38.basename(desiredDir) !== type) {
+    if (path39.basename(desiredDir) !== type) {
       return { dir: null, reason: `Requested writable provider directory must end with '${type}': ${desiredDir}` };
     }
     const sourceDir = this.findProviderDir(type);
     if (!sourceDir) {
       return { dir: null, reason: `Provider source directory not found for '${type}'` };
     }
-    if (!fs26.existsSync(desiredDir)) {
-      fs26.mkdirSync(path38.dirname(desiredDir), { recursive: true });
-      fs26.cpSync(sourceDir, desiredDir, { recursive: true });
+    if (!fs27.existsSync(desiredDir)) {
+      fs27.mkdirSync(path39.dirname(desiredDir), { recursive: true });
+      fs27.cpSync(sourceDir, desiredDir, { recursive: true });
       this.log(`Auto-implement writable copy created: ${desiredDir}`);
     }
-    const providerJson = path38.join(desiredDir, "provider.json");
-    if (!fs26.existsSync(providerJson)) {
+    const providerJson = path39.join(desiredDir, "provider.json");
+    if (!fs27.existsSync(providerJson)) {
       return { dir: null, reason: `provider.json not found in writable provider directory: ${desiredDir}` };
     }
     return { dir: desiredDir };
@@ -46213,7 +46759,7 @@ var DevServer = class _DevServer {
       setMode: "set_mode.js"
     };
     const targetFileNames = new Set(functions.map((fn) => funcToFile[fn]).filter(Boolean));
-    const scriptsDir = path38.join(providerDir, "scripts");
+    const scriptsDir = path39.join(providerDir, "scripts");
     const latestScriptsDir = this.getLatestScriptVersionDir(scriptsDir);
     if (latestScriptsDir) {
       lines.push(`Scripts version directory: \`${latestScriptsDir}\``);
@@ -46221,10 +46767,10 @@ var DevServer = class _DevServer {
       lines.push("## \u270F\uFE0F Target Files (EDIT THESE)");
       lines.push("These are the ONLY files you are allowed to modify. Replace the TODO stubs with working implementations.");
       lines.push("");
-      for (const file of fs26.readdirSync(latestScriptsDir)) {
+      for (const file of fs27.readdirSync(latestScriptsDir)) {
         if (file.endsWith(".js") && targetFileNames.has(file)) {
           try {
-            const content = fs26.readFileSync(path38.join(latestScriptsDir, file), "utf-8");
+            const content = fs27.readFileSync(path39.join(latestScriptsDir, file), "utf-8");
             lines.push(`### \`${file}\` \u270F\uFE0F EDIT`);
             lines.push("```javascript");
             lines.push(content);
@@ -46234,14 +46780,14 @@ var DevServer = class _DevServer {
           }
         }
       }
-      const refFiles = fs26.readdirSync(latestScriptsDir).filter((f) => f.endsWith(".js") && !targetFileNames.has(f));
+      const refFiles = fs27.readdirSync(latestScriptsDir).filter((f) => f.endsWith(".js") && !targetFileNames.has(f));
       if (refFiles.length > 0) {
         lines.push("## \u{1F512} Other Scripts (REFERENCE ONLY \u2014 DO NOT EDIT)");
         lines.push("These files are shown for context only. Do NOT modify them under any circumstances.");
         lines.push("");
         for (const file of refFiles) {
           try {
-            const content = fs26.readFileSync(path38.join(latestScriptsDir, file), "utf-8");
+            const content = fs27.readFileSync(path39.join(latestScriptsDir, file), "utf-8");
             lines.push(`### \`${file}\` \u{1F512}`);
             lines.push("```javascript");
             lines.push(content);
@@ -46282,11 +46828,11 @@ var DevServer = class _DevServer {
         lines.push("");
       }
     }
-    const docsDir = path38.join(providerDir, "../../docs");
+    const docsDir = path39.join(providerDir, "../../docs");
     const loadGuide = (name) => {
       try {
-        const p = path38.join(docsDir, name);
-        if (fs26.existsSync(p)) return fs26.readFileSync(p, "utf-8");
+        const p = path39.join(docsDir, name);
+        if (fs27.existsSync(p)) return fs27.readFileSync(p, "utf-8");
       } catch {
       }
       return null;
@@ -46459,7 +47005,7 @@ var DevServer = class _DevServer {
       parseApproval: "parse_approval.js"
     };
     const targetFileNames = new Set(functions.map((fn) => funcToFile[fn]).filter(Boolean));
-    const scriptsDir = path38.join(providerDir, "scripts");
+    const scriptsDir = path39.join(providerDir, "scripts");
     const latestScriptsDir = this.getLatestScriptVersionDir(scriptsDir);
     if (latestScriptsDir) {
       lines.push(`Scripts version directory: \`${latestScriptsDir}\``);
@@ -46467,11 +47013,11 @@ var DevServer = class _DevServer {
       lines.push("## \u270F\uFE0F Target Files (EDIT THESE)");
       lines.push("These are the ONLY files you are allowed to modify. Replace TODO or heuristic-only logic with working PTY-aware implementations.");
       lines.push("");
-      for (const file of fs26.readdirSync(latestScriptsDir)) {
+      for (const file of fs27.readdirSync(latestScriptsDir)) {
         if (!file.endsWith(".js")) continue;
         if (!targetFileNames.has(file)) continue;
         try {
-          const content = fs26.readFileSync(path38.join(latestScriptsDir, file), "utf-8");
+          const content = fs27.readFileSync(path39.join(latestScriptsDir, file), "utf-8");
           lines.push(`### \`${file}\` \u270F\uFE0F EDIT`);
           lines.push("```javascript");
           lines.push(content);
@@ -46480,14 +47026,14 @@ var DevServer = class _DevServer {
         } catch {
         }
       }
-      const refFiles = fs26.readdirSync(latestScriptsDir).filter((f) => f.endsWith(".js") && !targetFileNames.has(f));
+      const refFiles = fs27.readdirSync(latestScriptsDir).filter((f) => f.endsWith(".js") && !targetFileNames.has(f));
       if (refFiles.length > 0) {
         lines.push("## \u{1F512} Other Scripts (REFERENCE ONLY \u2014 DO NOT EDIT)");
         lines.push("These files are shown for context only. Do NOT modify them under any circumstances.");
         lines.push("");
         for (const file of refFiles) {
           try {
-            const content = fs26.readFileSync(path38.join(latestScriptsDir, file), "utf-8");
+            const content = fs27.readFileSync(path39.join(latestScriptsDir, file), "utf-8");
             lines.push(`### \`${file}\` \u{1F512}`);
             lines.push("```javascript");
             lines.push(content);
@@ -46520,11 +47066,11 @@ var DevServer = class _DevServer {
         lines.push("");
       }
     }
-    const docsDir = path38.join(providerDir, "../../docs");
+    const docsDir = path39.join(providerDir, "../../docs");
     const loadGuide = (name) => {
       try {
-        const p = path38.join(docsDir, name);
-        if (fs26.existsSync(p)) return fs26.readFileSync(p, "utf-8");
+        const p = path39.join(docsDir, name);
+        if (fs27.existsSync(p)) return fs27.readFileSync(p, "utf-8");
       } catch {
       }
       return null;
@@ -47429,8 +47975,8 @@ async function installExtension(ide, extension) {
       const res = await fetch(extension.vsixUrl);
       if (res.ok) {
         const buffer = Buffer.from(await res.arrayBuffer());
-        const fs27 = await import("fs");
-        fs27.writeFileSync(vsixPath, buffer);
+        const fs28 = await import("fs");
+        fs28.writeFileSync(vsixPath, buffer);
         return new Promise((resolve23) => {
           const cmd = `"${ide.cliCommand}" --install-extension "${vsixPath}" --force`;
           (0, import_child_process10.exec)(cmd, { timeout: 6e4 }, (error, _stdout, stderr) => {