@adhdev/daemon-standalone 0.9.82-rc.165 → 0.9.82-rc.166

package/dist/index.js

@@ -34851,8 +34851,8 @@ var require_dist3 = __commonJS({
       return String(value).replace(/\r\n/g, "\n");
     }
     function isPathInside(parent, child) {
-      const relative4 = path5.relative(path5.resolve(parent), path5.resolve(child));
-      return relative4 === "" || !relative4.startsWith("..") && !path5.isAbsolute(relative4);
+      const relative5 = path5.relative(path5.resolve(parent), path5.resolve(child));
+      return relative5 === "" || !relative5.startsWith("..") && !path5.isAbsolute(relative5);
     }
     async function validateWorkspace(workspace) {
       if (typeof workspace !== "string" || workspace.length === 0 || workspace.includes("\0")) {
@@ -35529,10 +35529,10 @@ ${error48.message || ""}`;
       return (0, import_path22.join)(getConfigDir(), "meshes.json");
     }
     function loadMeshConfig() {
-      const path39 = getMeshConfigPath();
-      if (!(0, import_fs2.existsSync)(path39)) return { meshes: [] };
+      const path40 = getMeshConfigPath();
+      if (!(0, import_fs2.existsSync)(path40)) return { meshes: [] };
       try {
-        const raw = JSON.parse((0, import_fs2.readFileSync)(path39, "utf-8"));
+        const raw = JSON.parse((0, import_fs2.readFileSync)(path40, "utf-8"));
         if (!raw || !Array.isArray(raw.meshes)) return { meshes: [] };
         return raw;
       } catch {
@@ -35540,16 +35540,16 @@ ${error48.message || ""}`;
       }
     }
     function saveMeshConfig(config2) {
-      const path39 = getMeshConfigPath();
-      (0, import_fs2.writeFileSync)(path39, JSON.stringify(config2, null, 2), { encoding: "utf-8", mode: 384 });
+      const path40 = getMeshConfigPath();
+      (0, import_fs2.writeFileSync)(path40, JSON.stringify(config2, null, 2), { encoding: "utf-8", mode: 384 });
     }
     function normalizeRepoIdentity(remoteUrl) {
       let identity = remoteUrl.trim();
       if (identity.startsWith("http://") || identity.startsWith("https://")) {
         try {
           const url2 = new URL(identity);
-          const path39 = url2.pathname.replace(/^\//, "").replace(/\.git$/, "");
-          return `${url2.hostname}/${path39}`;
+          const path40 = url2.pathname.replace(/^\//, "").replace(/\.git$/, "");
+          return `${url2.hostname}/${path40}`;
         } catch {
         }
       }
@@ -36498,8 +36498,8 @@ Follow these recovery rules:
       }
       const serverName = mcpConfig.serverName?.trim() || DEFAULT_SERVER_NAME;
       if (mcpConfig.mode === "auto_import") {
-        const path39 = mcpConfig.path?.trim();
-        if (!path39) {
+        const path40 = mcpConfig.path?.trim();
+        if (!path40) {
           return { kind: "unsupported", reason: "Provider auto-import MCP config is missing a config path" };
         }
         const mcpServer = resolveAdhdevMcpServerLaunch({
@@ -36517,7 +36517,7 @@ Follow these recovery rules:
         return {
           kind: "auto_import",
           serverName,
-          configPath: resolveMcpConfigPath(path39, workspace),
+          configPath: resolveMcpConfigPath(path40, workspace),
           configFormat: mcpConfig.format,
           mcpServer
         };
@@ -36674,8 +36674,8 @@ ${rendered}`, "utf-8");
         const remaining = (existing.slice(0, openIdx) + existing.slice(closeIdx + CLOSE.length)).replace(/^\s*\n+/, "").replace(/\n+\s*$/, "");
         if (!remaining.trim()) {
           try {
-            const fs27 = require("fs");
-            fs27.unlinkSync(filePath);
+            const fs28 = require("fs");
+            fs28.unlinkSync(filePath);
           } catch {
           }
         } else {
@@ -36818,10 +36818,10 @@ ${rendered}`, "utf-8");
       }
     }
     function readArchivedCounts(meshId) {
-      const path39 = getArchivedCountsPath(meshId);
-      if (!(0, import_fs6.existsSync)(path39)) return { taskCompleted: 0, taskFailed: 0, taskStalled: 0, recoveryAttempted: 0, totalArchived: 0, lastArchivedAt: "" };
+      const path40 = getArchivedCountsPath(meshId);
+      if (!(0, import_fs6.existsSync)(path40)) return { taskCompleted: 0, taskFailed: 0, taskStalled: 0, recoveryAttempted: 0, totalArchived: 0, lastArchivedAt: "" };
       try {
-        return JSON.parse((0, import_fs6.readFileSync)(path39, "utf-8"));
+        return JSON.parse((0, import_fs6.readFileSync)(path40, "utf-8"));
       } catch {
         return { taskCompleted: 0, taskFailed: 0, taskStalled: 0, recoveryAttempted: 0, totalArchived: 0, lastArchivedAt: "" };
       }
@@ -37493,10 +37493,10 @@ Valid status values: \`completed\` | \`failed\` | \`blocked\` | \`partial\`.`;
             this.migratedMeshIds.add(meshId);
             const count = this.db.prepare("SELECT COUNT(*) AS count FROM mesh_queue WHERE mesh_id = ?").get(meshId);
             if (count.count > 0) return;
-            const path39 = legacyQueuePath(meshId);
-            if (!(0, import_fs7.existsSync)(path39)) return;
+            const path40 = legacyQueuePath(meshId);
+            if (!(0, import_fs7.existsSync)(path40)) return;
             try {
-              const entries = JSON.parse((0, import_fs7.readFileSync)(path39, "utf-8"));
+              const entries = JSON.parse((0, import_fs7.readFileSync)(path40, "utf-8"));
               if (!Array.isArray(entries)) return;
               const insert = this.db.prepare(`
                 INSERT OR REPLACE INTO mesh_queue (
@@ -38207,10 +38207,10 @@ Valid status values: \`completed\` | \`failed\` | \`blocked\` | \`partial\`.`;
       if (!meshId) return [];
       const paths = coordinatorDaemonId ? [getPendingEventsPath(meshId, coordinatorDaemonId), getPendingEventsPath(meshId)] : [getPendingEventsPath(meshId)];
       const events = [];
-      for (const path39 of paths) {
-        if (!(0, import_fs9.existsSync)(path39)) continue;
+      for (const path40 of paths) {
+        if (!(0, import_fs9.existsSync)(path40)) continue;
         try {
-          const raw = (0, import_fs9.readFileSync)(path39, "utf-8");
+          const raw = (0, import_fs9.readFileSync)(path40, "utf-8");
           const parsed = raw.split("\n").filter(Boolean).flatMap((line) => {
             try {
               return [JSON.parse(line)];
@@ -38218,7 +38218,7 @@ Valid status values: \`completed\` | \`failed\` | \`blocked\` | \`partial\`.`;
               return [];
             }
           });
-          const filtered = coordinatorDaemonId && path39 === getPendingEventsPath(meshId) ? parsed.filter((e) => !e.targetCoordinatorDaemonId || e.targetCoordinatorDaemonId === coordinatorDaemonId) : parsed;
+          const filtered = coordinatorDaemonId && path40 === getPendingEventsPath(meshId) ? parsed.filter((e) => !e.targetCoordinatorDaemonId || e.targetCoordinatorDaemonId === coordinatorDaemonId) : parsed;
           events.push(...filtered);
         } catch {
         }
@@ -38287,13 +38287,13 @@ Valid status values: \`completed\` | \`failed\` | \`blocked\` | \`partial\`.`;
         ...backfilled
       ];
     }
-    function trimPendingEventsIfNeeded(path39) {
+    function trimPendingEventsIfNeeded(path40) {
       try {
-        if (!(0, import_fs9.existsSync)(path39)) return;
-        if ((0, import_fs9.statSync)(path39).size <= MAX_PENDING_EVENTS_BYTES) return;
-        const lines = (0, import_fs9.readFileSync)(path39, "utf-8").split("\n").filter(Boolean);
+        if (!(0, import_fs9.existsSync)(path40)) return;
+        if ((0, import_fs9.statSync)(path40).size <= MAX_PENDING_EVENTS_BYTES) return;
+        const lines = (0, import_fs9.readFileSync)(path40, "utf-8").split("\n").filter(Boolean);
         if (lines.length <= MAX_PENDING_EVENTS_KEEP) return;
-        (0, import_fs9.writeFileSync)(path39, lines.slice(-MAX_PENDING_EVENTS_KEEP).join("\n") + "\n", "utf-8");
+        (0, import_fs9.writeFileSync)(path40, lines.slice(-MAX_PENDING_EVENTS_KEEP).join("\n") + "\n", "utf-8");
       } catch {
       }
     }
@@ -38307,19 +38307,19 @@ Valid status values: \`completed\` | \`failed\` | \`blocked\` | \`partial\`.`;
           LOG2.info("MeshEvents", `Suppressed duplicate pending ${event.event} for mesh ${event.meshId}`);
           return true;
         }
-        const path39 = getPendingEventsPath(event.meshId, event.targetCoordinatorDaemonId);
-        trimPendingEventsIfNeeded(path39);
-        (0, import_fs9.appendFileSync)(path39, JSON.stringify(event) + "\n", "utf-8");
+        const path40 = getPendingEventsPath(event.meshId, event.targetCoordinatorDaemonId);
+        trimPendingEventsIfNeeded(path40);
+        (0, import_fs9.appendFileSync)(path40, JSON.stringify(event) + "\n", "utf-8");
         return true;
       } catch (e) {
         LOG2.warn("MeshEvents", `Failed to persist pending coordinator event: ${e?.message || e}`);
         return false;
       }
     }
-    function atomicDrainFile(path39) {
-      const tmpPath = `${path39}.draining`;
+    function atomicDrainFile(path40) {
+      const tmpPath = `${path40}.draining`;
       try {
-        (0, import_fs9.renameSync)(path39, tmpPath);
+        (0, import_fs9.renameSync)(path40, tmpPath);
       } catch {
         return null;
       }
@@ -38342,8 +38342,8 @@ Valid status values: \`completed\` | \`failed\` | \`blocked\` | \`partial\`.`;
       if (!meshId) return [];
       const paths = coordinatorDaemonId ? [getPendingEventsPath(meshId, coordinatorDaemonId), getPendingEventsPath(meshId)] : [getPendingEventsPath(meshId)];
       const all = [];
-      for (const path39 of paths) {
-        const content = atomicDrainFile(path39);
+      for (const path40 of paths) {
+        const content = atomicDrainFile(path40);
         if (!content) continue;
         const parsed = content.split("\n").filter(Boolean).flatMap((line) => {
           try {
@@ -38352,7 +38352,7 @@ Valid status values: \`completed\` | \`failed\` | \`blocked\` | \`partial\`.`;
             return [];
           }
         });
-        const filtered = coordinatorDaemonId && path39 === getPendingEventsPath(meshId) ? parsed.filter((e) => !e.targetCoordinatorDaemonId || e.targetCoordinatorDaemonId === coordinatorDaemonId) : parsed;
+        const filtered = coordinatorDaemonId && path40 === getPendingEventsPath(meshId) ? parsed.filter((e) => !e.targetCoordinatorDaemonId || e.targetCoordinatorDaemonId === coordinatorDaemonId) : parsed;
         all.push(...filtered);
       }
       if (all.length === 0) return [];
@@ -38365,9 +38365,9 @@ Valid status values: \`completed\` | \`failed\` | \`blocked\` | \`partial\`.`;
     function clearPendingMeshCoordinatorEvents(meshId, coordinatorDaemonId) {
       if (!meshId) return;
       const paths = coordinatorDaemonId ? [getPendingEventsPath(meshId, coordinatorDaemonId), getPendingEventsPath(meshId)] : [getPendingEventsPath(meshId)];
-      for (const path39 of paths) {
-        if ((0, import_fs9.existsSync)(path39)) try {
-          (0, import_fs9.unlinkSync)(path39);
+      for (const path40 of paths) {
+        if ((0, import_fs9.existsSync)(path40)) try {
+          (0, import_fs9.unlinkSync)(path40);
         } catch {
         }
       }
@@ -39508,6 +39508,54 @@ Next step: ${nextStep}`;
         currentConfig = { ...DEFAULT_CONFIG2 };
       }
     });
+    var provider_trust_exports = {};
+    __export2(provider_trust_exports, {
+      classifyTrust: () => classifyTrust,
+      describeTrust: () => describeTrust,
+      inspectManifestShape: () => inspectManifestShape,
+      requiresConfirmation: () => requiresConfirmation
+    });
+    function inspectManifestShape(manifest) {
+      const hasTui = !!manifest.tui && typeof manifest.tui === "object" && Object.keys(manifest.tui).length > 0;
+      const hasOverrides = !!manifest.overrides && typeof manifest.overrides === "object" && !Array.isArray(manifest.overrides) && Object.keys(manifest.overrides).length > 0;
+      const compat = Array.isArray(manifest.compatibility) ? manifest.compatibility : [];
+      const compatHasScriptDir = compat.some((entry) => typeof entry?.scriptDir === "string");
+      const hasScriptDir = compatHasScriptDir || typeof manifest.defaultScriptDir === "string";
+      return { hasTui, hasOverrides, hasScriptDir };
+    }
+    function classifyTrust(layer, shape) {
+      const isSpecOnly = !shape.hasTui && !shape.hasOverrides && !shape.hasScriptDir;
+      switch (layer) {
+        case "user":
+          return "user-custom";
+        case "upstream":
+          return isSpecOnly ? "trusted" : "trusted-with-scripts";
+        case "external":
+          return isSpecOnly ? "external-safe" : "external-untrusted";
+      }
+    }
+    function requiresConfirmation(trust) {
+      return trust === "external-untrusted";
+    }
+    function describeTrust(trust) {
+      switch (trust) {
+        case "user-custom":
+          return "Hand-authored in ~/.adhdev/providers/. Runs your own code.";
+        case "trusted":
+          return "Official, declarative-only manifest from the ADHDev registry.";
+        case "trusted-with-scripts":
+          return "Official manifest from the ADHDev registry. Ships JavaScript hooks executed by the daemon.";
+        case "external-safe":
+          return "Manifest from a 3rd-party git source you added. Declarative-only \u2014 the daemon never runs JS from this source.";
+        case "external-untrusted":
+          return "Manifest from a 3rd-party git source you added. Ships JavaScript that the daemon will execute. Treat as untrusted code \u2014 review the source before enabling.";
+      }
+    }
+    var init_provider_trust = __esm2({
+      "src/providers/provider-trust.ts"() {
+        "use strict";
+      }
+    });
     var provider_schema_default;
     var init_provider_schema = __esm2({
       "src/providers/sdk/v1/schemas/cli/provider.schema.json"() {
@@ -40008,7 +40056,7 @@ Next step: ${nextStep}`;
       return _cliValidator;
     }
     function formatIssue(err) {
-      const path39 = err.instancePath || "";
+      const path40 = err.instancePath || "";
       const params = err.params;
       let message = err.message || "validation failed";
       let allowed;
@@ -40026,7 +40074,7 @@ Next step: ${nextStep}`;
       } else if (err.keyword === "type") {
         message = `must be ${params.type}`;
       }
-      return { path: path39, keyword: err.keyword, message, ...allowed !== void 0 ? { allowed } : {} };
+      return { path: path40, keyword: err.keyword, message, ...allowed !== void 0 ? { allowed } : {} };
     }
     function validateCliProviderManifest(manifest) {
       const validator = getCliValidator();
@@ -40055,6 +40103,158 @@ Next step: ${nextStep}`;
         _cliValidator = null;
       }
     });
+    var external_sources_exports = {};
+    __export2(external_sources_exports, {
+      activeFilePath: () => activeFilePath,
+      deriveSourceName: () => deriveSourceName,
+      externalRoot: () => externalRoot,
+      inventoryExternalSources: () => inventoryExternalSources,
+      loadExternalSources: () => loadExternalSources,
+      loadProvidersActive: () => loadProvidersActive,
+      resolveActiveSource: () => resolveActiveSource,
+      saveExternalSources: () => saveExternalSources,
+      saveProvidersActive: () => saveProvidersActive,
+      sourcesFilePath: () => sourcesFilePath,
+      sourcesProviding: () => sourcesProviding
+    });
+    function adhdevDir() {
+      return path15.join(os10.homedir(), ".adhdev");
+    }
+    function externalRoot() {
+      return path15.join(adhdevDir(), "external");
+    }
+    function sourcesFilePath() {
+      return path15.join(adhdevDir(), SOURCES_FILENAME);
+    }
+    function activeFilePath() {
+      return path15.join(adhdevDir(), ACTIVE_FILENAME);
+    }
+    function ensureAdhdevDir() {
+      const d = adhdevDir();
+      if (!fs8.existsSync(d)) fs8.mkdirSync(d, { recursive: true });
+    }
+    function loadExternalSources() {
+      const p = sourcesFilePath();
+      if (!fs8.existsSync(p)) return { schema: 1, sources: [] };
+      try {
+        const raw = JSON.parse(fs8.readFileSync(p, "utf-8"));
+        if (!raw || typeof raw !== "object") return { schema: 1, sources: [] };
+        const sources = Array.isArray(raw.sources) ? raw.sources.filter(isValidSource) : [];
+        return { schema: 1, sources };
+      } catch {
+        return { schema: 1, sources: [] };
+      }
+    }
+    function saveExternalSources(file2) {
+      ensureAdhdevDir();
+      const tmp = sourcesFilePath() + ".tmp";
+      fs8.writeFileSync(tmp, JSON.stringify(file2, null, 2) + "\n", "utf-8");
+      fs8.renameSync(tmp, sourcesFilePath());
+    }
+    function loadProvidersActive() {
+      const p = activeFilePath();
+      if (!fs8.existsSync(p)) return { schema: 1, active: {} };
+      try {
+        const raw = JSON.parse(fs8.readFileSync(p, "utf-8"));
+        if (!raw || typeof raw !== "object") return { schema: 1, active: {} };
+        const active = raw.active && typeof raw.active === "object" ? raw.active : {};
+        return { schema: 1, active };
+      } catch {
+        return { schema: 1, active: {} };
+      }
+    }
+    function saveProvidersActive(file2) {
+      ensureAdhdevDir();
+      const tmp = activeFilePath() + ".tmp";
+      fs8.writeFileSync(tmp, JSON.stringify(file2, null, 2) + "\n", "utf-8");
+      fs8.renameSync(tmp, activeFilePath());
+    }
+    function isValidSource(x) {
+      if (!x || typeof x !== "object") return false;
+      const s = x;
+      return typeof s.name === "string" && s.name.length > 0 && typeof s.url === "string" && s.url.length > 0 && typeof s.ref === "string" && s.ref.length > 0 && typeof s.addedAt === "string";
+    }
+    function deriveSourceName(url2) {
+      const m = url2.match(/[/:]([^/:]+)\/([^/]+?)(?:\.git)?$/);
+      if (!m) return "@source";
+      const owner = m[1].toLowerCase().replace(/[^a-z0-9_-]/g, "-");
+      const repo = m[2].toLowerCase().replace(/[^a-z0-9_-]/g, "-");
+      return `@${owner}-${repo}`;
+    }
+    function inventoryExternalSources() {
+      const root = externalRoot();
+      if (!fs8.existsSync(root)) return [];
+      const out = [];
+      let entries;
+      try {
+        entries = fs8.readdirSync(root, { withFileTypes: true });
+      } catch {
+        return [];
+      }
+      for (const sourceEntry of entries) {
+        if (!sourceEntry.isDirectory()) continue;
+        const sourceName = sourceEntry.name;
+        const sourceDir = path15.join(root, sourceName);
+        const providers = {};
+        let categoryEntries;
+        try {
+          categoryEntries = fs8.readdirSync(sourceDir, { withFileTypes: true });
+        } catch {
+          continue;
+        }
+        for (const categoryEntry of categoryEntries) {
+          if (!categoryEntry.isDirectory()) continue;
+          const category = categoryEntry.name;
+          const categoryDir = path15.join(sourceDir, category);
+          let typeEntries;
+          try {
+            typeEntries = fs8.readdirSync(categoryDir, { withFileTypes: true });
+          } catch {
+            continue;
+          }
+          const types = [];
+          for (const typeEntry of typeEntries) {
+            if (!typeEntry.isDirectory()) continue;
+            const typeDir = path15.join(categoryDir, typeEntry.name);
+            const hasV1 = fs8.existsSync(path15.join(typeDir, "provider.v1.json"));
+            const hasV0 = fs8.existsSync(path15.join(typeDir, "provider.json"));
+            if (hasV1 || hasV0) types.push(typeEntry.name);
+          }
+          if (types.length > 0) providers[category] = types;
+        }
+        out.push({ sourceName, providers });
+      }
+      return out;
+    }
+    function sourcesProviding(category, type) {
+      const inventory = inventoryExternalSources();
+      return inventory.filter((s) => (s.providers[category] || []).includes(type)).map((s) => s.sourceName);
+    }
+    function resolveActiveSource(category, type, activeFile) {
+      const candidates = sourcesProviding(category, type);
+      if (candidates.length === 0) return { source: null, ambiguous: false, candidates };
+      if (candidates.length === 1) return { source: candidates[0], ambiguous: false, candidates };
+      const explicit = (activeFile ?? loadProvidersActive()).active[type];
+      if (explicit && candidates.includes(explicit)) {
+        return { source: explicit, ambiguous: false, candidates };
+      }
+      return { source: candidates[0], ambiguous: true, candidates };
+    }
+    var fs8;
+    var os10;
+    var path15;
+    var SOURCES_FILENAME;
+    var ACTIVE_FILENAME;
+    var init_external_sources = __esm2({
+      "src/providers/external-sources.ts"() {
+        "use strict";
+        fs8 = __toESM2(require("fs"));
+        os10 = __toESM2(require("os"));
+        path15 = __toESM2(require("path"));
+        SOURCES_FILENAME = "providers-sources.json";
+        ACTIVE_FILENAME = "providers-active.json";
+      }
+    });
     function isModuleNotFoundError(error48, ref) {
       if (!(error48 instanceof Error)) return false;
       const message = error48.message || "";
@@ -40347,14 +40547,14 @@ Next step: ${nextStep}`;
       }
       return cachedPty;
     }
-    var os10;
+    var os11;
     var cachedPty;
     var NodePtyRuntimeTransport;
     var NodePtyTransportFactory;
     var init_pty_transport = __esm2({
       "src/cli-adapters/pty-transport.ts"() {
         "use strict";
-        os10 = __toESM2(require("os"));
+        os11 = __toESM2(require("os"));
         init_spawn_env();
         NodePtyRuntimeTransport = class {
           constructor(handle) {
@@ -40391,11 +40591,11 @@ Next step: ${nextStep}`;
             let cwd = options.cwd;
             if (cwd) {
               try {
-                const fs27 = require("fs");
-                const stat2 = fs27.statSync(cwd);
-                if (!stat2.isDirectory()) cwd = os10.homedir();
+                const fs28 = require("fs");
+                const stat2 = fs28.statSync(cwd);
+                if (!stat2.isDirectory()) cwd = os11.homedir();
               } catch {
-                cwd = os10.homedir();
+                cwd = os11.homedir();
               }
             }
             const handle = pty.spawn(command, args, {
@@ -40485,21 +40685,21 @@ Next step: ${nextStep}`;
     function findBinary(name) {
       const trimmed = String(name || "").trim();
       if (!trimmed) return trimmed;
-      const expanded = trimmed.startsWith("~") ? path15.join(os11.homedir(), trimmed.slice(1)) : trimmed;
-      if (path15.isAbsolute(expanded) || expanded.includes("/") || expanded.includes("\\")) {
-        return path15.isAbsolute(expanded) ? expanded : path15.resolve(expanded);
+      const expanded = trimmed.startsWith("~") ? path16.join(os12.homedir(), trimmed.slice(1)) : trimmed;
+      if (path16.isAbsolute(expanded) || expanded.includes("/") || expanded.includes("\\")) {
+        return path16.isAbsolute(expanded) ? expanded : path16.resolve(expanded);
       }
-      const isWin = os11.platform() === "win32";
-      const paths = (process.env.PATH || "").split(path15.delimiter);
+      const isWin = os12.platform() === "win32";
+      const paths = (process.env.PATH || "").split(path16.delimiter);
       const exes = isWin ? [".exe", ".cmd", ".bat", ""] : [""];
       for (const p of paths) {
         if (!p) continue;
         for (const ext of exes) {
-          const fullPath = path15.join(p, trimmed + ext);
+          const fullPath = path16.join(p, trimmed + ext);
           try {
-            const fs27 = require("fs");
-            if (fs27.existsSync(fullPath)) {
-              const stat2 = fs27.statSync(fullPath);
+            const fs28 = require("fs");
+            if (fs28.existsSync(fullPath)) {
+              const stat2 = fs28.statSync(fullPath);
               if (stat2.isFile() && (isWin || stat2.mode & 73)) {
                 return fullPath;
               }
@@ -40511,14 +40711,14 @@ Next step: ${nextStep}`;
       return isWin ? `${trimmed}.cmd` : trimmed;
     }
     function isScriptBinary(binaryPath) {
-      if (!path15.isAbsolute(binaryPath)) return false;
+      if (!path16.isAbsolute(binaryPath)) return false;
       try {
-        const fs27 = require("fs");
-        const resolved = fs27.realpathSync(binaryPath);
+        const fs28 = require("fs");
+        const resolved = fs28.realpathSync(binaryPath);
         const head = Buffer.alloc(8);
-        const fd = fs27.openSync(resolved, "r");
-        fs27.readSync(fd, head, 0, 8, 0);
-        fs27.closeSync(fd);
+        const fd = fs28.openSync(resolved, "r");
+        fs28.readSync(fd, head, 0, 8, 0);
+        fs28.closeSync(fd);
         let i = 0;
         if (head[0] === 239 && head[1] === 187 && head[2] === 191) i = 3;
         return head[i] === 35 && head[i + 1] === 33;
@@ -40527,14 +40727,14 @@ Next step: ${nextStep}`;
       }
     }
     function looksLikeMachOOrElf(filePath) {
-      if (!path15.isAbsolute(filePath)) return false;
+      if (!path16.isAbsolute(filePath)) return false;
       try {
-        const fs27 = require("fs");
-        const resolved = fs27.realpathSync(filePath);
+        const fs28 = require("fs");
+        const resolved = fs28.realpathSync(filePath);
         const buf = Buffer.alloc(8);
-        const fd = fs27.openSync(resolved, "r");
-        fs27.readSync(fd, buf, 0, 8, 0);
-        fs27.closeSync(fd);
+        const fd = fs28.openSync(resolved, "r");
+        fs28.readSync(fd, buf, 0, 8, 0);
+        fs28.closeSync(fd);
         let i = 0;
         if (buf[0] === 239 && buf[1] === 187 && buf[2] === 191) i = 3;
         const b = buf.subarray(i);
@@ -40550,7 +40750,7 @@ Next step: ${nextStep}`;
     }
     function shSingleQuote(arg) {
       if (/^[a-zA-Z0-9@%_+=:,./-]+$/.test(arg)) return arg;
-      if (os11.platform() === "win32") {
+      if (os12.platform() === "win32") {
         return `"${arg.replace(/"/g, '""')}"`;
       }
       return `'${arg.replace(/'/g, `'\\''`)}'`;
@@ -40616,15 +40816,15 @@ Next step: ${nextStep}`;
         }
       };
     }
-    var os11;
-    var path15;
+    var os12;
+    var path16;
     var TerminalTranscriptAccumulator;
     var buildCliSpawnEnv;
     var init_provider_cli_shared = __esm2({
       "src/cli-adapters/provider-cli-shared.ts"() {
         "use strict";
-        os11 = __toESM2(require("os"));
-        path15 = __toESM2(require("path"));
+        os12 = __toESM2(require("os"));
+        path16 = __toESM2(require("path"));
         init_spawn_env();
         TerminalTranscriptAccumulator = class {
           lines = [[]];
@@ -42506,15 +42706,15 @@ ${cont}` : cont;
       const { spawn: spawnConfig } = provider;
       const configuredCommand = typeof runtimeSettings.executablePath === "string" && runtimeSettings.executablePath.trim() ? runtimeSettings.executablePath.trim() : spawnConfig.command;
       const binaryPath = findBinary(configuredCommand);
-      const isWin = os12.platform() === "win32";
+      const isWin = os13.platform() === "win32";
       const allArgs = [...spawnConfig.args, ...extraArgs].map(
         (arg) => typeof arg === "string" ? arg.replace(/\{\{workingDir\}\}/g, workingDir) : arg
       );
       let shellCmd;
       let shellArgs;
-      const useShellUnix = !isWin && (!!spawnConfig.shell || !path16.isAbsolute(binaryPath) || isScriptBinary(binaryPath) || !looksLikeMachOOrElf(binaryPath));
+      const useShellUnix = !isWin && (!!spawnConfig.shell || !path17.isAbsolute(binaryPath) || isScriptBinary(binaryPath) || !looksLikeMachOOrElf(binaryPath));
       const isCmdShim = isWin && /\.(cmd|bat)$/i.test(binaryPath);
-      const useShellWin = !!spawnConfig.shell || isCmdShim || !path16.isAbsolute(binaryPath) || isScriptBinary(binaryPath);
+      const useShellWin = !!spawnConfig.shell || isCmdShim || !path17.isAbsolute(binaryPath) || isScriptBinary(binaryPath);
       const useShell = isWin ? useShellWin : useShellUnix;
       if (useShell) {
         shellCmd = isWin ? "cmd.exe" : process.env.SHELL || "/bin/zsh";
@@ -42590,14 +42790,14 @@ ${cont}` : cont;
       }
       return "";
     }
-    var os12;
-    var path16;
+    var os13;
+    var path17;
     var import_session_host_core22;
     var init_provider_cli_runtime = __esm2({
       "src/cli-adapters/provider-cli-runtime.ts"() {
         "use strict";
-        os12 = __toESM2(require("os"));
-        path16 = __toESM2(require("path"));
+        os13 = __toESM2(require("os"));
+        path17 = __toESM2(require("path"));
         import_session_host_core22 = require_dist2();
         init_provider_cli_shared();
       }
@@ -42616,12 +42816,12 @@ ${cont}` : cont;
       if (current.length <= keepFromCurrent) return current + chunk;
       return current.slice(-keepFromCurrent) + chunk;
     }
-    var os13;
+    var os14;
     var ProviderCliAdapter;
     var init_provider_cli_adapter = __esm2({
       "src/cli-adapters/provider-cli-adapter.ts"() {
         "use strict";
-        os13 = __toESM2(require("os"));
+        os14 = __toESM2(require("os"));
         init_logger();
         init_debug_config();
         init_terminal_screen();
@@ -42642,7 +42842,7 @@ ${cont}` : cont;
             this.transportFactory = transportFactory;
             this.cliType = provider.type;
             this.cliName = provider.name;
-            this.workingDir = workingDir.startsWith("~") ? workingDir.replace(/^~/, os13.homedir()) : workingDir;
+            this.workingDir = workingDir.startsWith("~") ? workingDir.replace(/^~/, os14.homedir()) : workingDir;
             const resolvedConfig = resolveCliAdapterConfig(provider);
             this.timeouts = resolvedConfig.timeouts;
             this.approvalKeys = resolvedConfig.approvalKeys;
@@ -44785,7 +44985,7 @@ ${lastSnapshot}`;
     function loadSpec(sourcePath) {
       let raw;
       try {
-        const text = fs8.readFileSync(sourcePath, "utf8");
+        const text = fs9.readFileSync(sourcePath, "utf8");
         raw = JSON.parse(text);
       } catch (err) {
         return { ok: false, errors: [`Failed to read spec: ${err.message}`], sourcePath };
@@ -44861,18 +45061,18 @@ ${lastSnapshot}`;
       }
     }
     function resolveSpecPath(providerDir) {
-      return path17.join(providerDir, "spec.json");
+      return path18.join(providerDir, "spec.json");
     }
-    var fs8;
-    var path17;
+    var fs9;
+    var path18;
     var import_ajv;
     var ajv;
     var validate;
     var init_loader = __esm2({
       "src/providers/spec/loader.ts"() {
         "use strict";
-        fs8 = __toESM2(require("fs"));
-        path17 = __toESM2(require("path"));
+        fs9 = __toESM2(require("fs"));
+        path18 = __toESM2(require("path"));
         import_ajv = __toESM2(require_ajv());
         init_schema_gen();
         ajv = new import_ajv.default({ allErrors: true, strict: false });
@@ -45026,7 +45226,7 @@ ${lastSnapshot}`;
     }
     function canonicalize(p) {
       try {
-        const resolved = path23.resolve(p);
+        const resolved = path24.resolve(p);
         try {
           return nodeFs.realpathSync.native ? nodeFs.realpathSync.native(resolved) : nodeFs.realpathSync(resolved);
         } catch {
@@ -45046,7 +45246,7 @@ ${lastSnapshot}`;
       }
       for (const root of _gatedRoots) {
         if (normalized === root.rootPath) return root;
-        if (normalized.startsWith(root.rootPath + path23.sep)) return root;
+        if (normalized.startsWith(root.rootPath + path24.sep)) return root;
       }
       return null;
     }
@@ -45065,16 +45265,16 @@ ${lastSnapshot}`;
       };
     }
     function gatedRequire(request, parent, isMain, gated, originalLoad) {
-      if (request.startsWith("./") || request.startsWith("../") || path23.isAbsolute(request)) {
+      if (request.startsWith("./") || request.startsWith("../") || path24.isAbsolute(request)) {
         let resolved;
         try {
-          const callerRequire = parent?.filename ? (0, import_node_module2.createRequire)(parent.filename) : (0, import_node_module2.createRequire)(path23.join(gated.rootPath, "__entry__.js"));
+          const callerRequire = parent?.filename ? (0, import_node_module2.createRequire)(parent.filename) : (0, import_node_module2.createRequire)(path24.join(gated.rootPath, "__entry__.js"));
           resolved = callerRequire.resolve(request);
         } catch {
           return originalLoad.call(this, request, parent, isMain);
         }
         const resolvedCanon = canonicalize(resolved) || resolved;
-        if (!(resolvedCanon === gated.rootPath || resolvedCanon.startsWith(gated.rootPath + path23.sep))) {
+        if (!(resolvedCanon === gated.rootPath || resolvedCanon.startsWith(gated.rootPath + path24.sep))) {
           denyRequire(request, parent, `relative path escapes provider root (resolved to ${resolvedCanon})`);
         }
         return originalLoad.call(this, request, parent, isMain);
@@ -45098,7 +45298,7 @@ ${lastSnapshot}`;
       err.callerFilename = caller;
       throw err;
     }
-    var path23;
+    var path24;
     var import_node_module2;
     var nodeFs;
     var nodeChildProcess;
@@ -45119,7 +45319,7 @@ ${lastSnapshot}`;
     var init_require_whitelist = __esm2({
       "src/providers/sdk/v1/sandbox/require-whitelist.ts"() {
         "use strict";
-        path23 = __toESM2(require("path"));
+        path24 = __toESM2(require("path"));
         import_node_module2 = require("module");
         nodeFs = __toESM2(require("fs"));
         nodeChildProcess = __toESM2(require("child_process"));
@@ -45227,7 +45427,7 @@ ${lastSnapshot}`;
       } else {
         let stat2 = null;
         try {
-          stat2 = fs12.statSync(resolved);
+          stat2 = fs13.statSync(resolved);
         } catch {
           return null;
         }
@@ -45246,7 +45446,7 @@ ${lastSnapshot}`;
         const v = jsonPathGet(lines[0], src.session_id_path);
         if (typeof v === "string" && v) providerSessionId = v;
       } else if (src.session_id_from === "filename_uuid" || !src.session_id_from) {
-        const m = path24.basename(sourcePath).match(UUID_RE);
+        const m = path25.basename(sourcePath).match(UUID_RE);
         if (m) providerSessionId = m[1];
       }
       const requested = input.providerSessionId || "";
@@ -45271,7 +45471,7 @@ ${lastSnapshot}`;
     function readJsonlLines(p) {
       let text;
       try {
-        text = fs12.readFileSync(p, "utf8");
+        text = fs13.readFileSync(p, "utf8");
       } catch {
         return [];
       }
@@ -45288,7 +45488,7 @@ ${lastSnapshot}`;
     }
     function executeSqlite(src, input) {
       const resolved = expandPath2(src.path, input);
-      if (!resolved || !fs12.existsSync(resolved)) return null;
+      if (!resolved || !fs13.existsSync(resolved)) return null;
       let Database;
       try {
         Database = require("better-sqlite3");
@@ -45347,19 +45547,19 @@ ${lastSnapshot}`;
       if (!template) return null;
       let out = template;
       if (out.startsWith("~/") || out === "~") {
-        out = path24.join(os17.homedir(), out.slice(2));
+        out = path25.join(os18.homedir(), out.slice(2));
       }
       out = out.replace(/\$\{([A-Z_][A-Z0-9_]*)(?::-(.*?))?\}/g, (_m, name, fallback) => {
         const v = input.envOverrides?.[name] ?? process.env[name];
         return v != null && v !== "" ? v : fallback ?? "";
       });
-      if (out.startsWith("~/")) out = path24.join(os17.homedir(), out.slice(2));
+      if (out.startsWith("~/")) out = path25.join(os18.homedir(), out.slice(2));
       const now = /* @__PURE__ */ new Date();
       const workspaceRaw = input.workspace ?? "";
       let workspaceResolved = workspaceRaw;
       if (workspaceRaw) {
         try {
-          workspaceResolved = fs12.realpathSync(workspaceRaw);
+          workspaceResolved = fs13.realpathSync(workspaceRaw);
         } catch {
         }
       }
@@ -45401,20 +45601,20 @@ ${lastSnapshot}`;
           for (const d of dirs) {
             let entries;
             try {
-              entries = fs12.readdirSync(d, { withFileTypes: true });
+              entries = fs13.readdirSync(d, { withFileTypes: true });
             } catch {
               continue;
             }
             for (const e of entries) {
-              if (e.isDirectory() && re.test(e.name)) next.push(path24.join(d, e.name));
+              if (e.isDirectory() && re.test(e.name)) next.push(path25.join(d, e.name));
             }
           }
         } else {
           for (const d of dirs) {
-            const candidate = path24.join(d, seg);
+            const candidate = path25.join(d, seg);
             let stat2 = null;
             try {
-              stat2 = fs12.statSync(candidate);
+              stat2 = fs13.statSync(candidate);
             } catch {
               continue;
             }
@@ -45428,13 +45628,13 @@ ${lastSnapshot}`;
     function walkAllDirs(root, out) {
       let entries;
       try {
-        entries = fs12.readdirSync(root, { withFileTypes: true });
+        entries = fs13.readdirSync(root, { withFileTypes: true });
       } catch {
         return;
       }
       out.push(root);
       for (const e of entries) {
-        if (e.isDirectory()) walkAllDirs(path24.join(root, e.name), out);
+        if (e.isDirectory()) walkAllDirs(path25.join(root, e.name), out);
       }
     }
     function newestRecentFileAcrossGlob(template, pattern, windowMs, sessionFloorMs = 0) {
@@ -45444,13 +45644,13 @@ ${lastSnapshot}`;
       for (const d of dirs) {
         let entries;
         try {
-          entries = fs12.readdirSync(d, { withFileTypes: true });
+          entries = fs13.readdirSync(d, { withFileTypes: true });
         } catch {
           continue;
         }
         for (const e of entries) {
           if (!e.isFile() || !pattern.test(e.name)) continue;
-          const p = path24.join(d, e.name);
+          const p = path25.join(d, e.name);
           const mtime = safeMtimeMs(p);
           if (mtime < cutoff) continue;
           if (!best || mtime > best.mtime) best = { p, mtime };
@@ -45461,7 +45661,7 @@ ${lastSnapshot}`;
     function newestRecentFile(dir, pattern, windowMs, sessionFloorMs = 0) {
       let entries;
       try {
-        entries = fs12.readdirSync(dir, { withFileTypes: true });
+        entries = fs13.readdirSync(dir, { withFileTypes: true });
       } catch {
         return null;
       }
@@ -45469,7 +45669,7 @@ ${lastSnapshot}`;
       let best = null;
       for (const e of entries) {
         if (!e.isFile() || !pattern.test(e.name)) continue;
-        const p = path24.join(dir, e.name);
+        const p = path25.join(dir, e.name);
         const mtime = safeMtimeMs(p);
         if (mtime < cutoff) continue;
         if (!best || mtime > best.mtime) best = { p, mtime };
@@ -45478,7 +45678,7 @@ ${lastSnapshot}`;
     }
     function safeMtimeMs(p) {
       try {
-        return Math.floor(fs12.statSync(p).mtimeMs);
+        return Math.floor(fs13.statSync(p).mtimeMs);
       } catch {
         return 0;
       }
@@ -45682,16 +45882,16 @@ ${lastSnapshot}`;
       }
       return t.negate ? !result : result;
     }
-    var fs12;
-    var os17;
-    var path24;
+    var fs13;
+    var os18;
+    var path25;
     var UUID_RE;
     var init_native_history_executor = __esm2({
       "src/providers/spec/native-history-executor.ts"() {
         "use strict";
-        fs12 = __toESM2(require("fs"));
-        os17 = __toESM2(require("os"));
-        path24 = __toESM2(require("path"));
+        fs13 = __toESM2(require("fs"));
+        os18 = __toESM2(require("os"));
+        path25 = __toESM2(require("path"));
         UUID_RE = /([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})/i;
       }
     });
@@ -45707,7 +45907,7 @@ ${lastSnapshot}`;
     }
     function statMtimeMs(filePath) {
       try {
-        return fs13.statSync(filePath).mtimeMs;
+        return fs14.statSync(filePath).mtimeMs;
       } catch {
         return 0;
       }
@@ -45777,7 +45977,7 @@ ${lastSnapshot}`;
     function parseTranscriptFile(filePath, sessionId, workspaceFallback) {
       let raw;
       try {
-        raw = fs13.readFileSync(filePath, "utf-8");
+        raw = fs14.readFileSync(filePath, "utf-8");
       } catch {
         return [];
       }
@@ -45850,10 +46050,10 @@ ${lastSnapshot}`;
       return records;
     }
     function readSession(sessionPath) {
-      if (!sessionPath || !path25.isAbsolute(sessionPath)) return null;
-      const basename12 = path25.basename(sessionPath, ".jsonl");
+      if (!sessionPath || !path26.isAbsolute(sessionPath)) return null;
+      const basename12 = path26.basename(sessionPath, ".jsonl");
       if (!isSafeSessionId(basename12)) return null;
-      if (!fs13.existsSync(sessionPath)) return null;
+      if (!fs14.existsSync(sessionPath)) return null;
       const sourceMtimeMs = statMtimeMs(sessionPath);
       const messages = parseTranscriptFile(sessionPath, basename12);
       if (messages.length === 0) return null;
@@ -45869,13 +46069,13 @@ ${lastSnapshot}`;
         workspace
       };
     }
-    var fs13;
-    var path25;
+    var fs14;
+    var path26;
     var init_claude_cli_transcript = __esm2({
       "src/providers/native-history/claude-cli-transcript.ts"() {
         "use strict";
-        fs13 = __toESM2(require("fs"));
-        path25 = __toESM2(require("path"));
+        fs14 = __toESM2(require("fs"));
+        path26 = __toESM2(require("path"));
       }
     });
     function extractTimestampValue2(value) {
@@ -45890,7 +46090,7 @@ ${lastSnapshot}`;
     }
     function statMtimeMs2(filePath) {
       try {
-        return fs14.statSync(filePath).mtimeMs;
+        return fs15.statSync(filePath).mtimeMs;
       } catch {
         return 0;
       }
@@ -45958,7 +46158,7 @@ ${lastSnapshot}`;
     }
     function readSessionMeta(filePath) {
       try {
-        const firstLine = fs14.readFileSync(filePath, "utf-8").split("\n").find(Boolean);
+        const firstLine = fs15.readFileSync(filePath, "utf-8").split("\n").find(Boolean);
         if (!firstLine) return null;
         const parsed = JSON.parse(firstLine);
         if (String(parsed.type ?? "") !== "session_meta") return null;
@@ -45970,7 +46170,7 @@ ${lastSnapshot}`;
     function parseSessionFile(filePath, sessionId, workspaceFallback) {
       let raw;
       try {
-        raw = fs14.readFileSync(filePath, "utf-8");
+        raw = fs15.readFileSync(filePath, "utf-8");
       } catch {
         return [];
       }
@@ -46064,11 +46264,11 @@ ${lastSnapshot}`;
       return records;
     }
     function readSession2(sessionPath) {
-      if (!sessionPath || !path26.isAbsolute(sessionPath)) return null;
-      if (!fs14.existsSync(sessionPath)) return null;
+      if (!sessionPath || !path27.isAbsolute(sessionPath)) return null;
+      if (!fs15.existsSync(sessionPath)) return null;
       const meta3 = readSessionMeta(sessionPath);
       const metaId = String(meta3?.id ?? "").trim();
-      const basename12 = path26.basename(sessionPath, ".jsonl");
+      const basename12 = path27.basename(sessionPath, ".jsonl");
       const uuidMatch = basename12.match(/([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})/i);
       const filenameUuid = uuidMatch ? uuidMatch[1] : "";
       if (metaId && filenameUuid && metaId !== filenameUuid) return null;
@@ -46090,13 +46290,13 @@ ${lastSnapshot}`;
         workspace
       };
     }
-    var fs14;
-    var path26;
+    var fs15;
+    var path27;
     var init_codex_cli_transcript = __esm2({
       "src/providers/native-history/codex-cli-transcript.ts"() {
         "use strict";
-        fs14 = __toESM2(require("fs"));
-        path26 = __toESM2(require("path"));
+        fs15 = __toESM2(require("fs"));
+        path27 = __toESM2(require("path"));
       }
     });
     function extractTimestampValue3(value) {
@@ -46111,7 +46311,7 @@ ${lastSnapshot}`;
     }
     function statMtimeMs3(filePath) {
       try {
-        return fs15.statSync(filePath).mtimeMs;
+        return fs16.statSync(filePath).mtimeMs;
       } catch {
         return 0;
       }
@@ -46120,13 +46320,13 @@ ${lastSnapshot}`;
       return /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(value);
     }
     function antigravityRoot() {
-      return path27.join(os18.homedir(), ".gemini", "antigravity-cli");
+      return path28.join(os19.homedir(), ".gemini", "antigravity-cli");
     }
     function historyJsonlPath() {
-      return path27.join(antigravityRoot(), "history.jsonl");
+      return path28.join(antigravityRoot(), "history.jsonl");
     }
     function brainRoot() {
-      return path27.join(antigravityRoot(), "brain");
+      return path28.join(antigravityRoot(), "brain");
     }
     function extractUserRequestContent(content) {
       const raw = content.trim();
@@ -46142,7 +46342,7 @@ ${lastSnapshot}`;
     function parseBrainTranscript(filePath, sessionId, workspace) {
       let raw;
       try {
-        raw = fs15.readFileSync(filePath, "utf-8");
+        raw = fs16.readFileSync(filePath, "utf-8");
       } catch {
         return null;
       }
@@ -46202,7 +46402,7 @@ ${lastSnapshot}`;
       const sourcePath = historyJsonlPath();
       let lines = [];
       try {
-        lines = fs15.readFileSync(sourcePath, "utf-8").split("\n").filter(Boolean);
+        lines = fs16.readFileSync(sourcePath, "utf-8").split("\n").filter(Boolean);
       } catch {
         return [];
       }
@@ -46249,7 +46449,7 @@ ${lastSnapshot}`;
     function parsePbFile(filePath, sessionId) {
       let buf;
       try {
-        buf = fs15.readFileSync(filePath);
+        buf = fs16.readFileSync(filePath);
       } catch {
         return null;
       }
@@ -46272,13 +46472,13 @@ ${lastSnapshot}`;
       ];
     }
     function readSession3(sessionPath, sessionId, workspace) {
-      if (!sessionPath || !path27.isAbsolute(sessionPath)) return null;
-      if (!fs15.existsSync(sessionPath)) return null;
+      if (!sessionPath || !path28.isAbsolute(sessionPath)) return null;
+      if (!fs16.existsSync(sessionPath)) return null;
       const sourceMtimeMs = statMtimeMs3(sessionPath);
       const brainRootPath = brainRoot();
-      if (sessionPath.startsWith(brainRootPath + path27.sep) && sessionPath.endsWith(".jsonl")) {
-        const relative4 = sessionPath.slice(brainRootPath.length + 1);
-        const uuidFromPath = relative4.split(path27.sep)[0];
+      if (sessionPath.startsWith(brainRootPath + path28.sep) && sessionPath.endsWith(".jsonl")) {
+        const relative5 = sessionPath.slice(brainRootPath.length + 1);
+        const uuidFromPath = relative5.split(path28.sep)[0];
         const resolvedSessionId = sessionId || (isUuidLike(uuidFromPath) ? uuidFromPath : "");
         if (!resolvedSessionId) return null;
         const messages = parseBrainTranscript(sessionPath, resolvedSessionId, workspace);
@@ -46294,7 +46494,7 @@ ${lastSnapshot}`;
         };
       }
       if (sessionPath.endsWith(".pb")) {
-        const pbSessionId = sessionId || path27.basename(sessionPath, ".pb");
+        const pbSessionId = sessionId || path28.basename(sessionPath, ".pb");
         if (!isUuidLike(pbSessionId)) return null;
         const messages = parsePbFile(sessionPath, pbSessionId);
         if (!messages || messages.length === 0) return null;
@@ -46308,7 +46508,7 @@ ${lastSnapshot}`;
           partialReason: "antigravity_cli_pb_raw_text_extraction"
         };
       }
-      if (path27.basename(sessionPath) === "history.jsonl") {
+      if (path28.basename(sessionPath) === "history.jsonl") {
         const resolvedSessionId = sessionId || "";
         if (!resolvedSessionId || !isUuidLike(resolvedSessionId)) return null;
         const rows = readHistoryRows().filter((r) => r.conversationId === resolvedSessionId);
@@ -46353,28 +46553,28 @@ ${lastSnapshot}`;
       }
       return null;
     }
-    var fs15;
-    var path27;
-    var os18;
+    var fs16;
+    var path28;
+    var os19;
     var MIN_PRINTABLE_RUN;
     var init_antigravity_cli_transcript = __esm2({
       "src/providers/native-history/antigravity-cli-transcript.ts"() {
         "use strict";
-        fs15 = __toESM2(require("fs"));
-        path27 = __toESM2(require("path"));
-        os18 = __toESM2(require("os"));
+        fs16 = __toESM2(require("fs"));
+        path28 = __toESM2(require("path"));
+        os19 = __toESM2(require("os"));
         MIN_PRINTABLE_RUN = 8;
       }
     });
     function statMtimeMs4(p) {
       try {
-        return Math.floor(fs16.statSync(p).mtimeMs);
+        return Math.floor(fs17.statSync(p).mtimeMs);
       } catch {
         return 0;
       }
     }
     function openDb() {
-      if (!fs16.existsSync(HERMES_STATE_DB)) return null;
+      if (!fs17.existsSync(HERMES_STATE_DB)) return null;
       try {
         const Database = require("better-sqlite3");
         return new Database(HERMES_STATE_DB, { readonly: true, fileMustExist: true });
@@ -46431,10 +46631,10 @@ ${lastSnapshot}`;
           }
         }
       }
-      if (!path28.isAbsolute(sessionPath) || !fs16.existsSync(sessionPath)) return null;
+      if (!path29.isAbsolute(sessionPath) || !fs17.existsSync(sessionPath)) return null;
       let raw;
       try {
-        raw = JSON.parse(fs16.readFileSync(sessionPath, "utf8"));
+        raw = JSON.parse(fs17.readFileSync(sessionPath, "utf8"));
       } catch {
         return null;
       }
@@ -46457,7 +46657,7 @@ ${lastSnapshot}`;
         });
       }
       if (messages.length === 0) return null;
-      const sessionId = typeof raw.session_id === "string" && raw.session_id ? raw.session_id : path28.basename(sessionPath, ".json").replace(/^session_/, "");
+      const sessionId = typeof raw.session_id === "string" && raw.session_id ? raw.session_id : path29.basename(sessionPath, ".json").replace(/^session_/, "");
       return {
         messages,
         providerSessionId: sessionId,
@@ -46474,19 +46674,19 @@ ${lastSnapshot}`;
       if (s === "tool" || s === "tool_result" || s === "function") return "assistant";
       return "system";
     }
-    var fs16;
-    var path28;
-    var os19;
+    var fs17;
+    var path29;
+    var os20;
     var HERMES_STATE_DB;
     var HERMES_LEGACY_SESSIONS_DIR;
     var init_hermes_cli_transcript = __esm2({
       "src/providers/native-history/hermes-cli-transcript.ts"() {
         "use strict";
-        fs16 = __toESM2(require("fs"));
-        path28 = __toESM2(require("path"));
-        os19 = __toESM2(require("os"));
-        HERMES_STATE_DB = path28.join(os19.homedir(), ".hermes", "state.db");
-        HERMES_LEGACY_SESSIONS_DIR = path28.join(os19.homedir(), ".hermes", "sessions");
+        fs17 = __toESM2(require("fs"));
+        path29 = __toESM2(require("path"));
+        os20 = __toESM2(require("os"));
+        HERMES_STATE_DB = path29.join(os20.homedir(), ".hermes", "state.db");
+        HERMES_LEGACY_SESSIONS_DIR = path29.join(os20.homedir(), ".hermes", "sessions");
       }
     });
     var dispatcher_exports = {};
@@ -46532,26 +46732,26 @@ ${lastSnapshot}`;
       }
     }
     function resolveClaudePath(workspace, sessionId) {
-      const dir = path29.join(os20.homedir(), ".claude", "projects", cwdAsDashes(workspace));
-      if (!fs17.existsSync(dir)) return null;
+      const dir = path30.join(os21.homedir(), ".claude", "projects", cwdAsDashes(workspace));
+      if (!fs18.existsSync(dir)) return null;
       if (sessionId) {
-        const candidate = path29.join(dir, `${sessionId}.jsonl`);
-        if (fs17.existsSync(candidate)) return candidate;
+        const candidate = path30.join(dir, `${sessionId}.jsonl`);
+        if (fs18.existsSync(candidate)) return candidate;
       }
       return null;
     }
     function resolveCodexPath(workspace) {
       void workspace;
       const now = /* @__PURE__ */ new Date();
-      const dir = path29.join(
-        os20.homedir(),
+      const dir = path30.join(
+        os21.homedir(),
         ".codex",
         "sessions",
         String(now.getUTCFullYear()),
         String(now.getUTCMonth() + 1).padStart(2, "0"),
         String(now.getUTCDate()).padStart(2, "0")
       );
-      if (fs17.existsSync(dir)) {
+      if (fs18.existsSync(dir)) {
         const f = newestRecentFile2(dir, /\.jsonl$/);
         if (f) return f;
       }
@@ -46559,23 +46759,23 @@ ${lastSnapshot}`;
     }
     function resolveAntigravityPath(workspace) {
       void workspace;
-      const brainRoot2 = path29.join(os20.homedir(), ".gemini", "antigravity-cli", "brain");
-      if (!fs17.existsSync(brainRoot2)) return null;
+      const brainRoot2 = path30.join(os21.homedir(), ".gemini", "antigravity-cli", "brain");
+      if (!fs18.existsSync(brainRoot2)) return null;
       const cutoff = Date.now() - RECENT_WINDOW_MS;
-      const entries = fs17.readdirSync(brainRoot2, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => ({ p: path29.join(brainRoot2, e.name), mtime: safeMtime(path29.join(brainRoot2, e.name)) })).filter((e) => e.mtime >= cutoff).sort((a, b) => b.mtime - a.mtime);
+      const entries = fs18.readdirSync(brainRoot2, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => ({ p: path30.join(brainRoot2, e.name), mtime: safeMtime(path30.join(brainRoot2, e.name)) })).filter((e) => e.mtime >= cutoff).sort((a, b) => b.mtime - a.mtime);
       for (const e of entries) {
-        const t = path29.join(e.p, ".system_generated", "logs", "transcript.jsonl");
-        if (fs17.existsSync(t)) return t;
+        const t = path30.join(e.p, ".system_generated", "logs", "transcript.jsonl");
+        if (fs18.existsSync(t)) return t;
       }
       return null;
     }
     function resolveHermesPath(workspace, sessionId) {
       void workspace;
       void sessionId;
-      const dbPath = path29.join(os20.homedir(), ".hermes", "state.db");
-      if (fs17.existsSync(dbPath)) return dbPath;
-      const dir = path29.join(os20.homedir(), ".hermes", "sessions");
-      if (!fs17.existsSync(dir)) return null;
+      const dbPath = path30.join(os21.homedir(), ".hermes", "state.db");
+      if (fs18.existsSync(dbPath)) return dbPath;
+      const dir = path30.join(os21.homedir(), ".hermes", "sessions");
+      if (!fs18.existsSync(dir)) return null;
       return newestRecentFile2(dir, /^session_.*\.json$/);
     }
     function readByReader(reader, sourcePath, sessionId, workspace) {
@@ -46597,7 +46797,7 @@ ${lastSnapshot}`;
     function newestRecentFile2(dir, pattern) {
       try {
         const cutoff = Date.now() - RECENT_WINDOW_MS;
-        const entries = fs17.readdirSync(dir, { withFileTypes: true }).filter((e) => e.isFile() && pattern.test(e.name)).map((e) => ({ p: path29.join(dir, e.name), mtime: safeMtime(path29.join(dir, e.name)) })).filter((e) => e.mtime >= cutoff).sort((a, b) => b.mtime - a.mtime);
+        const entries = fs18.readdirSync(dir, { withFileTypes: true }).filter((e) => e.isFile() && pattern.test(e.name)).map((e) => ({ p: path30.join(dir, e.name), mtime: safeMtime(path30.join(dir, e.name)) })).filter((e) => e.mtime >= cutoff).sort((a, b) => b.mtime - a.mtime);
         return entries[0]?.p ?? null;
       } catch {
         return null;
@@ -46605,7 +46805,7 @@ ${lastSnapshot}`;
     }
     function safeMtime(p) {
       try {
-        return Math.floor(fs17.statSync(p).mtimeMs);
+        return Math.floor(fs18.statSync(p).mtimeMs);
       } catch {
         return 0;
       }
@@ -46617,16 +46817,16 @@ ${lastSnapshot}`;
       if (s === "tool" || s === "tool_result" || s === "function") return "assistant";
       return "system";
     }
-    var fs17;
-    var os20;
-    var path29;
+    var fs18;
+    var os21;
+    var path30;
     var RECENT_WINDOW_MS;
     var init_dispatcher = __esm2({
       "src/providers/native-history/dispatcher.ts"() {
         "use strict";
-        fs17 = __toESM2(require("fs"));
-        os20 = __toESM2(require("os"));
-        path29 = __toESM2(require("path"));
+        fs18 = __toESM2(require("fs"));
+        os21 = __toESM2(require("os"));
+        path30 = __toESM2(require("path"));
         init_claude_cli_transcript();
         init_codex_cli_transcript();
         init_antigravity_cli_transcript();
@@ -47163,12 +47363,12 @@ ${lastSnapshot}`;
         if (!match) continue;
         const prefix = match[1];
         const commit = match[2];
-        const path39 = match[3];
-        if (ignoreSet.has(path39)) continue;
+        const path40 = match[3];
+        if (ignoreSet.has(path40)) continue;
         submodules.push({
-          path: path39,
+          path: path40,
           commit,
-          repoPath: repoRoot + "/" + path39,
+          repoPath: repoRoot + "/" + path40,
           dirty: prefix === "+",
           outOfSync: prefix === "-",
           lastCheckedAt: Date.now()
@@ -47177,7 +47377,7 @@ ${lastSnapshot}`;
       return submodules;
     }
     var import_promises2 = require("fs/promises");
-    var path210 = __toESM2(require("path"));
+    var path23 = __toESM2(require("path"));
     init_git_executor();
     var DEFAULT_MAX_FILES = 200;
     var DEFAULT_MAX_BYTES = 2e5;
@@ -47349,17 +47549,17 @@ ${lastSnapshot}`;
       if (typeof filePath !== "string" || filePath.length === 0 || filePath.includes("\0")) {
         throw new GitCommandError("invalid_args", "File path must be a non-empty path");
       }
-      const canonicalRepoRoot = await (0, import_promises2.realpath)(repoRoot).catch(() => path210.resolve(repoRoot));
-      const absolutePath = path210.isAbsolute(filePath) ? path210.resolve(filePath) : path210.resolve(repoRoot, filePath);
+      const canonicalRepoRoot = await (0, import_promises2.realpath)(repoRoot).catch(() => path23.resolve(repoRoot));
+      const absolutePath = path23.isAbsolute(filePath) ? path23.resolve(filePath) : path23.resolve(repoRoot, filePath);
       const checkPath = await (0, import_promises2.realpath)(absolutePath).catch(() => absolutePath);
-      const relativeBase = isPathInside(canonicalRepoRoot, checkPath) ? canonicalRepoRoot : path210.resolve(repoRoot);
+      const relativeBase = isPathInside(canonicalRepoRoot, checkPath) ? canonicalRepoRoot : path23.resolve(repoRoot);
       if (!isPathInside(canonicalRepoRoot, checkPath) && !isPathInside(repoRoot, absolutePath)) {
         throw new GitCommandError("path_outside_repo", "Selected file path is outside the repository root", {
           cwd: repoRoot
         });
       }
-      const relativePath = path210.relative(relativeBase, checkPath).split(path210.sep).join("/");
-      if (!relativePath || relativePath.startsWith("..") || path210.isAbsolute(relativePath)) {
+      const relativePath = path23.relative(relativeBase, checkPath).split(path23.sep).join("/");
+      if (!relativePath || relativePath.startsWith("..") || path23.isAbsolute(relativePath)) {
         throw new GitCommandError("path_outside_repo", "Selected file path is outside the repository root", {
           cwd: repoRoot
         });
@@ -48642,10 +48842,10 @@ ${lastSnapshot}`;
       return (0, import_path3.join)(getDaemonDataDir(), "mesh-coordinators.json");
     }
     function loadMeshCoordinatorRegistry() {
-      const path39 = getRegistryPath();
-      if (!(0, import_fs3.existsSync)(path39)) return;
+      const path40 = getRegistryPath();
+      if (!(0, import_fs3.existsSync)(path40)) return;
       try {
-        const raw = JSON.parse((0, import_fs3.readFileSync)(path39, "utf-8"));
+        const raw = JSON.parse((0, import_fs3.readFileSync)(path40, "utf-8"));
         if (!Array.isArray(raw)) return;
         _registry.clear();
         for (const entry of raw) {
@@ -48862,8 +49062,8 @@ ${lastSnapshot}`;
       if (rejectedCommands.length) errors.push("one or more validation commands are invalid");
       return { valid: errors.length === 0, errors, bootstrapCommands, commands, rejectedCommands };
     }
-    function parseConfigText(path39, text) {
-      if (/\.json$/i.test(path39)) return JSON.parse(text);
+    function parseConfigText(path40, text) {
+      if (/\.json$/i.test(path40)) return JSON.parse(text);
       return yaml.load(text);
     }
     function loadMeshRefineConfig(mesh, workspace) {
@@ -48874,16 +49074,16 @@ ${lastSnapshot}`;
         if (!validation.valid) return { source: "mesh.policy.refineConfig", sourceType: "invalid", error: String(validation.rejectedCommands[0]?.reason || validation.errors.join("; ")) };
         return { config: inline, source: "mesh.policy.refineConfig", sourceType: "mesh_policy" };
       }
-      for (const relative4 of MESH_REFINE_CONFIG_LOCATIONS) {
-        const configPath = (0, import_path4.join)(workspace, relative4);
+      for (const relative5 of MESH_REFINE_CONFIG_LOCATIONS) {
+        const configPath = (0, import_path4.join)(workspace, relative5);
         if (!(0, import_fs4.existsSync)(configPath)) continue;
         try {
           const parsed = parseConfigText(configPath, (0, import_fs4.readFileSync)(configPath, "utf-8"));
-          const validation = validateMeshRefineConfig(parsed, relative4);
-          if (!validation.valid) return { source: relative4, sourceType: "invalid", path: configPath, error: String(validation.rejectedCommands[0]?.reason || validation.errors.join("; ")) };
-          return { config: parsed, source: relative4, sourceType: "repo_file", path: configPath };
+          const validation = validateMeshRefineConfig(parsed, relative5);
+          if (!validation.valid) return { source: relative5, sourceType: "invalid", path: configPath, error: String(validation.rejectedCommands[0]?.reason || validation.errors.join("; ")) };
+          return { config: parsed, source: relative5, sourceType: "repo_file", path: configPath };
         } catch (error48) {
-          return { source: relative4, sourceType: "invalid", path: configPath, error: error48?.message || String(error48) };
+          return { source: relative5, sourceType: "invalid", path: configPath, error: error48?.message || String(error48) };
         }
       }
       return {
@@ -49014,8 +49214,8 @@ ${lastSnapshot}`;
     var DEFAULT_TIMEOUT_MS2 = 12e4;
     var DEFAULT_OUTPUT_LIMIT_BYTES = 128 * 1024;
     var OUTPUT_SUMMARY_CHARS = 2e3;
-    function parseConfigText2(path39, text) {
-      if (/\.json$/i.test(path39)) return JSON.parse(text);
+    function parseConfigText2(path40, text) {
+      if (/\.json$/i.test(path40)) return JSON.parse(text);
       return yaml2.load(text);
     }
     function truncateOutput(value) {
@@ -49055,16 +49255,16 @@ ${lastSnapshot}`;
         if (!validation.valid) return { source: "mesh.policy.worktreeBootstrapConfig", sourceType: "invalid", error: String(validation.rejectedCommands[0]?.reason || validation.errors.join("; ")) };
         return { config: inline, source: "mesh.policy.worktreeBootstrapConfig", sourceType: "mesh_policy" };
       }
-      for (const relative4 of MESH_WORKTREE_BOOTSTRAP_CONFIG_LOCATIONS) {
-        const configPath = (0, import_path5.join)(workspace, relative4);
+      for (const relative5 of MESH_WORKTREE_BOOTSTRAP_CONFIG_LOCATIONS) {
+        const configPath = (0, import_path5.join)(workspace, relative5);
         if (!(0, import_fs5.existsSync)(configPath)) continue;
         try {
           const parsed = parseConfigText2(configPath, (0, import_fs5.readFileSync)(configPath, "utf-8"));
-          const validation = validateMeshWorktreeBootstrapConfig(parsed, relative4);
-          if (!validation.valid) return { source: relative4, sourceType: "invalid", path: configPath, error: String(validation.rejectedCommands[0]?.reason || validation.errors.join("; ")) };
-          return { config: parsed, source: relative4, sourceType: "repo_file", path: configPath };
+          const validation = validateMeshWorktreeBootstrapConfig(parsed, relative5);
+          if (!validation.valid) return { source: relative5, sourceType: "invalid", path: configPath, error: String(validation.rejectedCommands[0]?.reason || validation.errors.join("; ")) };
+          return { config: parsed, source: relative5, sourceType: "repo_file", path: configPath };
         } catch (error48) {
-          return { source: relative4, sourceType: "invalid", path: configPath, error: error48?.message || String(error48) };
+          return { source: relative5, sourceType: "invalid", path: configPath, error: error48?.message || String(error48) };
         }
       }
       return { source: "unavailable", sourceType: "unavailable", error: `No worktree bootstrap config found. Checked: ${MESH_WORKTREE_BOOTSTRAP_CONFIG_LOCATIONS.join(", ")}` };
@@ -50283,17 +50483,17 @@ ${lastSnapshot}`;
       return null;
     }
     async function detectIDEs(providerLoader) {
-      const os28 = (0, import_os22.platform)();
+      const os29 = (0, import_os22.platform)();
       const results = [];
       for (const def of getMergedDefinitions()) {
         const cliPath = findCliCommand(providerLoader?.getIdeCliCommand(def.id, def.cli) || def.cli);
-        const appPath = checkPathExists(providerLoader?.getIdePathCandidates(def.id, def.paths[os28] || []) || []);
+        const appPath = checkPathExists(providerLoader?.getIdePathCandidates(def.id, def.paths[os29] || []) || []);
         let resolvedCli = cliPath;
-        if (!resolvedCli && appPath && os28 === "darwin") {
+        if (!resolvedCli && appPath && os29 === "darwin") {
           const bundledCli = `${appPath}/Contents/Resources/app/bin/${def.cli}`;
           if ((0, import_fs11.existsSync)(bundledCli)) resolvedCli = bundledCli;
         }
-        if (!resolvedCli && appPath && os28 === "win32") {
+        if (!resolvedCli && appPath && os29 === "win32") {
           const { dirname: dirname11 } = await import("path");
           const appDir = dirname11(appPath);
           const candidates = [
@@ -50310,7 +50510,7 @@ ${lastSnapshot}`;
             }
           }
         }
-        const installed = os28 === "darwin" ? !!(resolvedCli || appPath) : !!resolvedCli;
+        const installed = os29 === "darwin" ? !!(resolvedCli || appPath) : !!resolvedCli;
         const version2 = resolvedCli ? await getIdeVersion(resolvedCli) : null;
         results.push({
           id: def.id,
@@ -60600,6 +60800,14 @@ ${effect.notification.body || ""}`.trim();
             return this.handleCheckProviderUpdates(args);
           case "list_installed_providers":
             return this.handleListInstalledProviders(args);
+          case "add_provider_source":
+            return this.handleAddProviderSource(args);
+          case "remove_provider_source":
+            return this.handleRemoveProviderSource(args);
+          case "list_provider_sources":
+            return this.handleListProviderSources(args);
+          case "set_active_provider_source":
+            return this.handleSetActiveProviderSource(args);
           // ─── Stream commands (stream-commands.ts) ───────────
           case "select_session":
             return handleSelectSession(this, args);
@@ -60663,49 +60871,62 @@ ${effect.notification.body || ""}`.trim();
         return { success: false, error: "ProviderLoader not initialized" };
       }
       /**
-       * Return per-provider availability so a Marketplace UI can show
-       * "Installed" badges. Reuses the existing detection state from
+       * Return per-provider availability so the dashboard's provider catalog
+       * can show "Installed" badges. Reuses the existing detection state from
        * ProviderLoader.getMachineProviderStatus() — no probing is triggered.
        */
       handleListProviderAvailability(_args) {
         if (!this._ctx.providerLoader) {
           return { success: false, error: "ProviderLoader not initialized" };
         }
+        const { describeTrust: describeTrust2, requiresConfirmation: requiresConfirmation2 } = (init_provider_trust(), __toCommonJS2(provider_trust_exports));
         const loader = this._ctx.providerLoader;
         const items = loader.getAll().map((provider) => {
           const machineConfig = loader.getMachineProviderConfig(provider.type);
           const lastDetection = machineConfig.lastDetection;
+          const trust = provider._sourceTrust ?? "trusted";
+          const layer = provider._sourceLayer ?? "upstream";
+          const sourceName = provider._sourceName ?? null;
           return {
             type: provider.type,
             category: provider.category,
             status: loader.getMachineProviderStatus(provider.type),
             installed: lastDetection?.ok === true,
             detectedPath: lastDetection?.path ?? null,
-            checkedAt: lastDetection?.checkedAt ?? null
+            checkedAt: lastDetection?.checkedAt ?? null,
+            trust,
+            trustDescription: describeTrust2(trust),
+            requiresConfirmation: requiresConfirmation2(trust),
+            sourceLayer: layer,
+            sourceName
           };
         });
         return { success: true, providers: items };
       }
       /**
-       * Compute the *Marketplace install root*. This is always
-       * `~/.adhdev/marketplace/` regardless of how ProviderLoader resolved its
-       * userDir (which can point to a sibling adhdev-providers git checkout in
-       * dev). Marketplace-installed manifests must never overwrite files in a
-       * developer checkout, and they should be isolated from upstream/registry
-       * sync so they survive `refresh_scripts`.
+       * Compute the *upstream cache root*. install_provider_manifest writes
+       * official-registry manifests here so the daemon's standard upstream
+       * layer picks them up — no special handling needed at load time, and
+       * the manifests inherit the official-trust badge instead of the
+       * untrusted-external one.
+       *
+       * Path matches ProviderLoader.upstreamDir but we recompute it from
+       * homedir() so this method stays usable in dev where userDir can
+       * point at a sibling git checkout.
        */
-      getMarketplaceInstallRoot() {
-        const os28 = require("os");
-        const path39 = require("path");
-        return path39.join(os28.homedir(), ".adhdev", "marketplace");
+      getUpstreamInstallRoot() {
+        const os29 = require("os");
+        const path40 = require("path");
+        return path40.join(os29.homedir(), ".adhdev", "providers", ".upstream");
       }
       /**
        * Download a single provider manifest from the registry and write it to
-       * ~/.adhdev/marketplace/{category}/{type}/provider.json.
+       * ~/.adhdev/providers/.upstream/{category}/{type}/provider.json.
        *
-       * Used by the Marketplace UI's Install button. Verifies SHA-256 checksum
-       * against the registry meta before persisting. Refuses to write outside
-       * the marketplace root.
+       * Used by standalone onboarding to seed the upstream cache with the
+       * default provider set on first launch. Verifies SHA-256 checksum
+       * against the registry meta before persisting. Refuses to write
+       * outside the upstream root.
        *
        * Args: { type: string, category?: string, version?: string }
        * If category/version are omitted, looks up the latest from the registry.
@@ -60720,8 +60941,8 @@ ${effect.notification.body || ""}`.trim();
           return { success: false, error: "invalid type" };
         }
         const https = require("https");
-        const fs27 = require("fs");
-        const path39 = require("path");
+        const fs28 = require("fs");
+        const path40 = require("path");
         const crypto6 = require("crypto");
         const REGISTRY = "https://api.adhf.dev/api/v1/registry";
         function fetchText(url2, timeoutMs) {
@@ -60758,13 +60979,13 @@ ${effect.notification.body || ""}`.trim();
           if (actualChecksum !== meta3.checksum) {
             return { success: false, error: `checksum mismatch: expected ${meta3.checksum}, got ${actualChecksum}` };
           }
-          const installRoot = this.getMarketplaceInstallRoot();
-          const installRootResolved = path39.resolve(installRoot);
-          const targetDir = path39.resolve(path39.join(installRoot, category, type));
-          if (!targetDir.startsWith(installRootResolved + path39.sep)) {
-            return { success: false, error: "install path escaped marketplace root" };
+          const installRoot = this.getUpstreamInstallRoot();
+          const installRootResolved = path40.resolve(installRoot);
+          const targetDir = path40.resolve(path40.join(installRoot, category, type));
+          if (!targetDir.startsWith(installRootResolved + path40.sep)) {
+            return { success: false, error: "install path escaped upstream root" };
           }
-          fs27.mkdirSync(targetDir, { recursive: true });
+          fs28.mkdirSync(targetDir, { recursive: true });
           let manifestProbe = {};
           try {
             manifestProbe = JSON.parse(manifestBody);
@@ -60788,8 +61009,8 @@ ${formatManifestValidationIssues2(validation.issues)}`,
             }
           }
           const targetFile = isV1 ? "provider.v1.json" : "provider.json";
-          const targetPath = path39.join(targetDir, targetFile);
-          fs27.writeFileSync(targetPath, manifestBody, "utf-8");
+          const targetPath = path40.join(targetDir, targetFile);
+          fs28.writeFileSync(targetPath, manifestBody, "utf-8");
           const manifestJson = JSON.parse(manifestBody);
           const scriptFetch = await this.fetchProviderSources(
             manifestJson,
@@ -60837,6 +61058,10 @@ ${formatManifestValidationIssues2(validation.issues)}`,
         if (Array.isArray(manifest.compatibility)) {
           for (const c of manifest.compatibility) {
             if (typeof c?.scriptDir === "string") scriptDirs.add(c.scriptDir);
+            if (typeof c?.spec === "string" && c.spec.includes("/")) {
+              const dir = c.spec.substring(0, c.spec.lastIndexOf("/"));
+              if (dir) scriptDirs.add(dir);
+            }
           }
         }
         if (manifest.overrides && typeof manifest.overrides === "object" && !Array.isArray(manifest.overrides)) {
@@ -60855,8 +61080,8 @@ ${formatManifestValidationIssues2(validation.issues)}`,
         const repo = source.repo;
         const ref = source.ref;
         const https = require("https");
-        const fs27 = require("fs");
-        const path39 = require("path");
+        const fs28 = require("fs");
+        const path40 = require("path");
         function fetchJson(url2, timeoutMs) {
           return new Promise((resolve23, reject) => {
             const req = https.get(url2, {
@@ -60912,9 +61137,9 @@ ${formatManifestValidationIssues2(validation.issues)}`,
         }
         let fetchedCount = 0;
         const sharedDirRel = `${category}/_shared`;
-        const sharedTargetDir = path39.resolve(path39.join(targetDir, "../_shared"));
-        const installRootResolved = path39.resolve(path39.join(targetDir, "../.."));
-        if (sharedTargetDir.startsWith(installRootResolved + path39.sep)) {
+        const sharedTargetDir = path40.resolve(path40.join(targetDir, "../_shared"));
+        const installRootResolved = path40.resolve(path40.join(targetDir, "../.."));
+        if (sharedTargetDir.startsWith(installRootResolved + path40.sep)) {
           const sharedStack = [sharedDirRel];
           while (sharedStack.length) {
             const relDir = sharedStack.pop();
@@ -60937,10 +61162,10 @@ ${formatManifestValidationIssues2(validation.issues)}`,
               try {
                 const body = await fetchBinary(entry.download_url, 3e4);
                 const relInside = entry.path.startsWith(sharedDirRel + "/") ? entry.path.slice(sharedDirRel.length + 1) : entry.path;
-                const outPath = path39.resolve(path39.join(sharedTargetDir, relInside));
-                if (!outPath.startsWith(path39.resolve(sharedTargetDir) + path39.sep)) continue;
-                fs27.mkdirSync(path39.dirname(outPath), { recursive: true });
-                fs27.writeFileSync(outPath, body);
+                const outPath = path40.resolve(path40.join(sharedTargetDir, relInside));
+                if (!outPath.startsWith(path40.resolve(sharedTargetDir) + path40.sep)) continue;
+                fs28.mkdirSync(path40.dirname(outPath), { recursive: true });
+                fs28.writeFileSync(outPath, body);
                 fetchedCount++;
               } catch (e) {
                 errors.push(`fetch shared ${entry.path}: ${e?.message ?? e}`);
@@ -60973,13 +61198,13 @@ ${formatManifestValidationIssues2(validation.issues)}`,
               try {
                 const body = await fetchBinary(entry.download_url, 3e4);
                 const relInsideProvider = entry.path.startsWith(subdir + "/") ? entry.path.slice(subdir.length + 1) : entry.path;
-                const outPath = path39.resolve(path39.join(targetDir, relInsideProvider));
-                if (!outPath.startsWith(path39.resolve(targetDir) + path39.sep)) {
+                const outPath = path40.resolve(path40.join(targetDir, relInsideProvider));
+                if (!outPath.startsWith(path40.resolve(targetDir) + path40.sep)) {
                   errors.push(`refusing to write outside targetDir: ${entry.path}`);
                   continue;
                 }
-                fs27.mkdirSync(path39.dirname(outPath), { recursive: true });
-                fs27.writeFileSync(outPath, body);
+                fs28.mkdirSync(path40.dirname(outPath), { recursive: true });
+                fs28.writeFileSync(outPath, body);
                 fetchedCount++;
               } catch (e) {
                 errors.push(`fetch ${entry.path}: ${e?.message ?? e}`);
@@ -60990,9 +61215,12 @@ ${formatManifestValidationIssues2(validation.issues)}`,
         return { fetchedCount, source: `${repo}@${ref}`, errors };
       }
       /**
-       * Remove a provider manifest from the marketplace install root
-       * (~/.adhdev/marketplace/{category}/{type}/). Refuses to touch anything
-       * outside that root.
+       * Remove a provider manifest from the upstream cache root
+       * (~/.adhdev/providers/.upstream/{category}/{type}/). Refuses to touch
+       * anything outside that root. Used by onboarding to opt out of a
+       * provider the user doesn't want; the dashboard no longer exposes a
+       * per-provider uninstall button (external sources are removed as a
+       * whole via remove_provider_source).
        */
       async handleUninstallProviderManifest(args) {
         const type = typeof args?.type === "string" ? args.type : "";
@@ -61004,19 +61232,19 @@ ${formatManifestValidationIssues2(validation.issues)}`,
         if (!["cli", "ide", "extension", "acp"].includes(category)) {
           return { success: false, error: `unknown category: ${category}` };
         }
-        const fs27 = require("fs");
-        const path39 = require("path");
+        const fs28 = require("fs");
+        const path40 = require("path");
         try {
-          const installRoot = this.getMarketplaceInstallRoot();
-          const installRootResolved = path39.resolve(installRoot);
-          const targetDir = path39.resolve(path39.join(installRoot, category, type));
-          if (!targetDir.startsWith(installRootResolved + path39.sep)) {
-            return { success: false, error: "refusing to delete outside marketplace root" };
+          const installRoot = this.getUpstreamInstallRoot();
+          const installRootResolved = path40.resolve(installRoot);
+          const targetDir = path40.resolve(path40.join(installRoot, category, type));
+          if (!targetDir.startsWith(installRootResolved + path40.sep)) {
+            return { success: false, error: "refusing to delete outside upstream root" };
           }
-          if (!fs27.existsSync(targetDir)) {
+          if (!fs28.existsSync(targetDir)) {
             return { success: false, error: "not installed" };
           }
-          fs27.rmSync(targetDir, { recursive: true, force: true });
+          fs28.rmSync(targetDir, { recursive: true, force: true });
           if (this._ctx.providerLoader) {
             this._ctx.providerLoader.reload();
             this._ctx.providerLoader.registerToDetector();
@@ -61027,33 +61255,33 @@ ${formatManifestValidationIssues2(validation.issues)}`,
         }
       }
       /**
-       * Return everything currently installed in ~/.adhdev/marketplace/ with its
+       * Return everything currently installed in the upstream cache with its
        * version. This is the "what does this daemon have" answer used both by
        * the UI and by the update checker.
        */
       handleListInstalledProviders(_args) {
-        const fs27 = require("fs");
-        const path39 = require("path");
-        const installRoot = this.getMarketplaceInstallRoot();
-        if (!fs27.existsSync(installRoot)) return { success: true, providers: [] };
+        const fs28 = require("fs");
+        const path40 = require("path");
+        const installRoot = this.getUpstreamInstallRoot();
+        if (!fs28.existsSync(installRoot)) return { success: true, providers: [] };
         const CATEGORIES = ["cli", "ide", "extension", "acp"];
         const items = [];
         for (const category of CATEGORIES) {
-          const categoryDir = path39.join(installRoot, category);
-          if (!fs27.existsSync(categoryDir)) continue;
+          const categoryDir = path40.join(installRoot, category);
+          if (!fs28.existsSync(categoryDir)) continue;
           let entries;
           try {
-            entries = fs27.readdirSync(categoryDir);
+            entries = fs28.readdirSync(categoryDir);
           } catch {
             continue;
           }
           for (const type of entries) {
-            const v1Path = path39.join(categoryDir, type, "provider.v1.json");
-            const v0Path = path39.join(categoryDir, type, "provider.json");
-            const manifestPath = fs27.existsSync(v1Path) ? v1Path : fs27.existsSync(v0Path) ? v0Path : null;
+            const v1Path = path40.join(categoryDir, type, "provider.v1.json");
+            const v0Path = path40.join(categoryDir, type, "provider.json");
+            const manifestPath = fs28.existsSync(v1Path) ? v1Path : fs28.existsSync(v0Path) ? v0Path : null;
             if (!manifestPath) continue;
             try {
-              const m = JSON.parse(fs27.readFileSync(manifestPath, "utf-8"));
+              const m = JSON.parse(fs28.readFileSync(manifestPath, "utf-8"));
               items.push({
                 type,
                 category,
@@ -61130,6 +61358,196 @@ ${formatManifestValidationIssues2(validation.issues)}`,
         );
         return { success: true, providers: checks };
       }
+      // ─── External provider sources (3rd-party git URLs) ──────────────
+      /**
+       * Register a new external provider source. The daemon clones the repo
+       * to ~/.adhdev/external/<name>/, walks it once to detect provided
+       * types, and surfaces any conflicts with already-installed types so
+       * the dashboard can ask the user how to resolve them.
+       *
+       * Args: { url: string, ref?: string, name?: string }
+       *   - url: https://, git@, or any git-cloneable URL
+       *   - ref: branch/tag/commit (default "main")
+       *   - name: short identifier (default derived from URL)
+       *
+       * Returns: { source, providers, conflicts }
+       *   - conflicts: list of types this new source provides that another
+       *     source already exposes. UI uses this to prompt for active-source
+       *     selection before the load takes effect.
+       */
+      async handleAddProviderSource(args) {
+        const url2 = typeof args?.url === "string" ? args.url.trim() : "";
+        if (!url2) return { success: false, error: "url is required" };
+        const ref = typeof args?.ref === "string" && args.ref.trim() ? args.ref.trim() : "main";
+        if (url2.startsWith("-")) return { success: false, error: 'url must not start with "-"' };
+        if (ref.startsWith("-")) return { success: false, error: 'ref must not start with "-"' };
+        if (!/^(https?:\/\/|git@[a-z0-9._-]+:)[a-z0-9._@:/~\-]+$/i.test(url2)) {
+          return { success: false, error: "url must be https://\u2026 or git@host:\u2026 and contain only URL-safe characters" };
+        }
+        if (!/^[A-Za-z0-9._/-]+$/.test(ref)) {
+          return { success: false, error: "ref must contain only [A-Za-z0-9._/-]" };
+        }
+        const ext = (init_external_sources(), __toCommonJS2(external_sources_exports));
+        const requestedName = typeof args?.name === "string" && args.name.trim() ? args.name.trim() : ext.deriveSourceName(url2);
+        if (!/^@[a-z0-9_-]+$/i.test(requestedName)) {
+          return { success: false, error: "name must match @[a-z0-9_-]+" };
+        }
+        const fs28 = require("fs");
+        const path40 = require("path");
+        const { spawnSync: spawnSync2 } = require("child_process");
+        const file2 = ext.loadExternalSources();
+        if (file2.sources.some((s) => s.name === requestedName)) {
+          return { success: false, error: `source name "${requestedName}" is already registered` };
+        }
+        if (file2.sources.some((s) => s.url === url2 && s.ref === ref)) {
+          return { success: false, error: `source url+ref already registered (use a different name to track another ref)` };
+        }
+        const sourceDir = path40.join(ext.externalRoot(), requestedName);
+        if (!fs28.existsSync(ext.externalRoot())) fs28.mkdirSync(ext.externalRoot(), { recursive: true });
+        if (fs28.existsSync(sourceDir)) {
+          return { success: false, error: `directory already exists: ${sourceDir} (rename or remove first)` };
+        }
+        const clone2 = spawnSync2("git", ["clone", "--depth=1", "--branch", ref, "--", url2, sourceDir], {
+          encoding: "utf-8",
+          stdio: ["ignore", "pipe", "pipe"],
+          timeout: 6e4
+        });
+        if (clone2.status !== 0) {
+          try {
+            fs28.rmSync(sourceDir, { recursive: true, force: true });
+          } catch {
+          }
+          return { success: false, error: `git clone failed: ${(clone2.stderr || clone2.stdout || "").trim() || "unknown error"}` };
+        }
+        const source = {
+          name: requestedName,
+          url: url2,
+          ref,
+          addedAt: (/* @__PURE__ */ new Date()).toISOString()
+        };
+        ext.saveExternalSources({ schema: 1, sources: [...file2.sources, source] });
+        const inventory = ext.inventoryExternalSources();
+        const conflicts = [];
+        const newEntry = inventory.find((e) => e.sourceName === requestedName);
+        if (newEntry) {
+          for (const [category, types] of Object.entries(newEntry.providers)) {
+            for (const type of types) {
+              const sources = ext.sourcesProviding(category, type);
+              if (sources.length > 1) conflicts.push({ category, type, sources });
+            }
+          }
+        }
+        if (this._ctx.providerLoader) {
+          this._ctx.providerLoader.reload();
+          this._ctx.providerLoader.registerToDetector();
+        }
+        return {
+          success: true,
+          source,
+          providers: newEntry?.providers ?? {},
+          conflicts
+        };
+      }
+      /**
+       * Remove a registered external source. Deletes the clone directory and
+       * any active-source entry pointing to it.
+       *
+       * Args: { name: string }
+       */
+      async handleRemoveProviderSource(args) {
+        const name = typeof args?.name === "string" ? args.name.trim() : "";
+        if (!name) return { success: false, error: "name is required" };
+        const ext = (init_external_sources(), __toCommonJS2(external_sources_exports));
+        const fs28 = require("fs");
+        const path40 = require("path");
+        const file2 = ext.loadExternalSources();
+        const match = file2.sources.find((s) => s.name === name);
+        if (!match) return { success: false, error: `source "${name}" not registered` };
+        const sourceDir = path40.join(ext.externalRoot(), name);
+        if (fs28.existsSync(sourceDir)) {
+          try {
+            fs28.rmSync(sourceDir, { recursive: true, force: true });
+          } catch (e) {
+            return { success: false, error: `failed to delete ${sourceDir}: ${e?.message || e}` };
+          }
+        }
+        ext.saveExternalSources({
+          schema: 1,
+          sources: file2.sources.filter((s) => s.name !== name)
+        });
+        const active = ext.loadProvidersActive();
+        const filteredActive = {};
+        for (const [type, src] of Object.entries(active.active)) {
+          if (src !== name) filteredActive[type] = src;
+        }
+        ext.saveProvidersActive({ schema: 1, active: filteredActive });
+        if (this._ctx.providerLoader) {
+          this._ctx.providerLoader.reload();
+          this._ctx.providerLoader.registerToDetector();
+        }
+        return { success: true, removed: { name } };
+      }
+      /**
+       * List registered external sources + each source's currently installed
+       * providers + the active selection for any conflicting types. Used by
+       * the dashboard's "Sources" tab.
+       */
+      handleListProviderSources(_args) {
+        const ext = (init_external_sources(), __toCommonJS2(external_sources_exports));
+        const file2 = ext.loadExternalSources();
+        const inventory = ext.inventoryExternalSources();
+        const active = ext.loadProvidersActive();
+        const sources = file2.sources.map((s) => {
+          const inv = inventory.find((e) => e.sourceName === s.name);
+          return {
+            ...s,
+            providers: inv?.providers ?? {}
+          };
+        });
+        const conflictMap = /* @__PURE__ */ new Map();
+        for (const inv of inventory) {
+          for (const [category, types] of Object.entries(inv.providers)) {
+            for (const type of types) {
+              const candidates = ext.sourcesProviding(category, type);
+              if (candidates.length > 1 && !conflictMap.has(type)) {
+                conflictMap.set(type, { category, sources: candidates });
+              }
+            }
+          }
+        }
+        const conflicts = [...conflictMap.entries()].map(([type, info]) => ({
+          type,
+          category: info.category,
+          candidates: info.sources,
+          active: active.active[type] ?? null
+        }));
+        return { success: true, sources, conflicts };
+      }
+      /**
+       * Pick which source's copy of a conflicting provider type is active.
+       * Other sources' copies stay on disk but the loader ignores them.
+       *
+       * Args: { type: string, sourceName: string }
+       */
+      handleSetActiveProviderSource(args) {
+        const type = typeof args?.type === "string" ? args.type.trim() : "";
+        const sourceName = typeof args?.sourceName === "string" ? args.sourceName.trim() : "";
+        if (!type || !sourceName) return { success: false, error: "type and sourceName are required" };
+        const ext = (init_external_sources(), __toCommonJS2(external_sources_exports));
+        const inventory = ext.inventoryExternalSources();
+        const entry = inventory.find((e) => e.sourceName === sourceName);
+        if (!entry) return { success: false, error: `source "${sourceName}" not found` };
+        const provided = Object.values(entry.providers).some((types) => types.includes(type));
+        if (!provided) return { success: false, error: `source "${sourceName}" does not provide type "${type}"` };
+        const active = ext.loadProvidersActive();
+        active.active[type] = sourceName;
+        ext.saveProvidersActive(active);
+        if (this._ctx.providerLoader) {
+          this._ctx.providerLoader.reload();
+          this._ctx.providerLoader.registerToDetector();
+        }
+        return { success: true, type, sourceName };
+      }
       // ─── DevServer HTTP proxy helpers ─────────────────
       // These bridge WS commands to the DevServer REST API (localhost:19280)
       async proxyDevServerPost(args, endpoint) {
@@ -61220,8 +61638,8 @@ ${formatManifestValidationIssues2(validation.issues)}`,
         }
       }
     };
-    var os16 = __toESM2(require("os"));
-    var path222 = __toESM2(require("path"));
+    var os17 = __toESM2(require("os"));
+    var path232 = __toESM2(require("path"));
     var crypto5 = __toESM2(require("crypto"));
     var import_fs12 = require("fs");
     var import_child_process5 = require("child_process");
@@ -61229,17 +61647,17 @@ ${formatManifestValidationIssues2(validation.issues)}`,
     init_provider_cli_adapter();
     init_cli_detector();
     init_config();
-    var os15 = __toESM2(require("os"));
-    var path20 = __toESM2(require("path"));
+    var os16 = __toESM2(require("os"));
+    var path21 = __toESM2(require("path"));
     var crypto4 = __toESM2(require("crypto"));
-    var fs11 = __toESM2(require("fs"));
+    var fs12 = __toESM2(require("fs"));
     var import_node_module = require("module");
+    var fs11 = __toESM2(require("fs"));
+    var path20 = __toESM2(require("path"));
+    init_provider_cli_adapter();
     var fs10 = __toESM2(require("fs"));
+    var os15 = __toESM2(require("os"));
     var path19 = __toESM2(require("path"));
-    init_provider_cli_adapter();
-    var fs9 = __toESM2(require("fs"));
-    var os14 = __toESM2(require("os"));
-    var path18 = __toESM2(require("path"));
     var xtermHeadlessNs = __toESM2(require_xterm_headless());
     init_pty_transport();
     var TerminalCtor2 = xtermHeadlessNs.Terminal ?? xtermHeadlessNs.default?.Terminal;
@@ -61610,7 +62028,7 @@ ${formatManifestValidationIssues2(validation.issues)}`,
       }
       armSpecWatcher() {
         try {
-          this.specWatcher = fs9.watch(this.opts.specPath, { persistent: false }, () => {
+          this.specWatcher = fs10.watch(this.opts.specPath, { persistent: false }, () => {
             const res = loadSpec(this.opts.specPath);
             if (!res.ok) {
               this.emit({ kind: "spec_error", errors: res.errors });
@@ -61703,7 +62121,7 @@ ${formatManifestValidationIssues2(validation.issues)}`,
       }
       fireDelegate(d) {
         const ev = this.currentEval;
-        const task = d.task_template.replace(/\{node\}/g, os14.hostname()).replace(/\{state\.label\}/g, ev?.state.label ?? "").replace(/\{state\.title\}/g, ev?.state.title ?? "").replace(/\{duration_ms\}/g, String(d.after_duration_ms ?? 0));
+        const task = d.task_template.replace(/\{node\}/g, os15.hostname()).replace(/\{state\.label\}/g, ev?.state.label ?? "").replace(/\{state\.title\}/g, ev?.state.title ?? "").replace(/\{duration_ms\}/g, String(d.after_duration_ms ?? 0));
         this.emit({ kind: "delegate", id: d.id, task });
       }
       // ────────────────────────────────────────────────────────────────────
@@ -61772,9 +62190,9 @@ ${formatManifestValidationIssues2(validation.issues)}`,
         const ctl = (this.spec.control_bar ?? []).find((c) => c.action.type === "attach_image");
         if (!ctl || ctl.action.type !== "attach_image") return;
         const ext = guessExt(mime);
-        const tmp = path18.join(os14.tmpdir(), `adhdev-attach-${Date.now()}${ext}`);
+        const tmp = path19.join(os15.tmpdir(), `adhdev-attach-${Date.now()}${ext}`);
         try {
-          fs9.writeFileSync(tmp, Buffer.from(blob, "base64"));
+          fs10.writeFileSync(tmp, Buffer.from(blob, "base64"));
         } catch {
           return;
         }
@@ -62098,14 +62516,14 @@ ${formatManifestValidationIssues2(validation.issues)}`,
     function createCliAdapter(provider, workingDir, cliArgs, extraEnv, transportFactory) {
       const resolvedSpecPath = provider._resolvedSpecPath;
       const dir = provider._resolvedProviderDir;
-      let specPath = resolvedSpecPath && fs10.existsSync(resolvedSpecPath) ? resolvedSpecPath : void 0;
+      let specPath = resolvedSpecPath && fs11.existsSync(resolvedSpecPath) ? resolvedSpecPath : void 0;
       if (!specPath && dir) {
-        const legacy = path19.join(dir, "spec.json");
-        if (fs10.existsSync(legacy)) specPath = legacy;
+        const legacy = path20.join(dir, "spec.json");
+        if (fs11.existsSync(legacy)) specPath = legacy;
       }
       if (specPath) {
         try {
-          LOG2.info("spec-route", `[${provider.type}] routing through SpecCliAdapter (${path19.relative(dir || "", specPath) || specPath})`);
+          LOG2.info("spec-route", `[${provider.type}] routing through SpecCliAdapter (${path20.relative(dir || "", specPath) || specPath})`);
           return new SpecCliAdapter(specPath, workingDir, cliArgs, extraEnv, transportFactory);
         } catch (err) {
           LOG2.warn("spec-route", `[${provider.type}] spec invalid, falling back to ProviderCliAdapter: ${err.message}`);
@@ -62160,7 +62578,7 @@ ${formatManifestValidationIssues2(validation.issues)}`,
           return uri.slice("file://".length);
         }
       }
-      if (path20.isAbsolute(uri)) return uri;
+      if (path21.isAbsolute(uri)) return uri;
       return null;
     }
     function extensionForImageMime(mimeType) {
@@ -62175,9 +62593,9 @@ ${formatManifestValidationIssues2(validation.issues)}`,
       if (!part.data) return null;
       const rawData = part.data.includes(",") ? part.data.split(",").pop() || "" : part.data;
       if (!rawData) return null;
-      fs11.mkdirSync(dir, { recursive: true });
-      const filePath = path20.join(dir, safeInputImageBasename(index, part.mimeType));
-      fs11.writeFileSync(filePath, Buffer.from(rawData, "base64"));
+      fs12.mkdirSync(dir, { recursive: true });
+      const filePath = path21.join(dir, safeInputImageBasename(index, part.mimeType));
+      fs12.writeFileSync(filePath, Buffer.from(rawData, "base64"));
       cleanupStaleMaterializedImages(dir);
       return filePath;
     }
@@ -62189,14 +62607,14 @@ ${formatManifestValidationIssues2(validation.issues)}`,
       if (now - lastMaterializedImageCleanupAt < MATERIALIZED_IMAGE_CLEANUP_INTERVAL_MS) return;
       lastMaterializedImageCleanupAt = now;
       try {
-        const entries = fs11.readdirSync(dir);
+        const entries = fs12.readdirSync(dir);
         for (const entry of entries) {
           if (!entry.startsWith("adhdev-input-image-")) continue;
-          const fullPath = path20.join(dir, entry);
+          const fullPath = path21.join(dir, entry);
           try {
-            const stat2 = fs11.statSync(fullPath);
+            const stat2 = fs12.statSync(fullPath);
             if (now - stat2.mtimeMs > MATERIALIZED_IMAGE_MAX_AGE_MS) {
-              fs11.unlinkSync(fullPath);
+              fs12.unlinkSync(fullPath);
             }
           } catch {
           }
@@ -62215,7 +62633,7 @@ ${formatManifestValidationIssues2(validation.issues)}`,
       const promptParts = [];
       const imageRefs = [];
       const resourceRefs = [];
-      const materializeDir = options.materializeDir || path20.join(os15.tmpdir(), "adhdev-input-media");
+      const materializeDir = options.materializeDir || path21.join(os16.tmpdir(), "adhdev-input-media");
       input.parts.forEach((part, index) => {
         if (part.type === "text" && part.text.trim()) {
           promptParts.push(part.text.trim());
@@ -62282,7 +62700,7 @@ ${formatManifestValidationIssues2(validation.issues)}`,
     var CachedDatabaseSync = null;
     function getDatabaseSync() {
       if (CachedDatabaseSync) return CachedDatabaseSync;
-      const requireFn = typeof require === "function" ? require : (0, import_node_module.createRequire)(path20.join(process.cwd(), "__adhdev_sqlite_loader__.js"));
+      const requireFn = typeof require === "function" ? require : (0, import_node_module.createRequire)(path21.join(process.cwd(), "__adhdev_sqlite_loader__.js"));
       const sqliteModule = requireFn(`node:${"sqlite"}`);
       CachedDatabaseSync = sqliteModule.DatabaseSync;
       if (!CachedDatabaseSync) {
@@ -62436,10 +62854,10 @@ ${formatManifestValidationIssues2(validation.issues)}`,
        * Replaces the previously duplicated probeOpenCode/Codex/Goose functions.
        */
       probeSessionIdFromConfig(probe) {
-        const resolvedDbPath = probe.dbPath.replace(/^~/, os15.homedir());
+        const resolvedDbPath = probe.dbPath.replace(/^~/, os16.homedir());
         const now = Date.now();
         if (this.cachedSqliteDbMissingUntil > now) return null;
-        if (!fs11.existsSync(resolvedDbPath)) {
+        if (!fs12.existsSync(resolvedDbPath)) {
           this.cachedSqliteDbMissingUntil = now + 1e4;
           return null;
         }
@@ -63541,7 +63959,7 @@ ${effect.notification.body || ""}`.trim();
         };
         addDir(this.workingDir);
         try {
-          addDir(fs11.realpathSync.native(this.workingDir));
+          addDir(fs12.realpathSync.native(this.workingDir));
         } catch {
         }
         return Array.from(dirs);
@@ -63576,7 +63994,7 @@ ${effect.notification.body || ""}`.trim();
         }
       }
     };
-    var path21 = __toESM2(require("path"));
+    var path222 = __toESM2(require("path"));
     var import_stream = require("stream");
     var import_child_process4 = require("child_process");
     var import_sdk = (init_acp(), __toCommonJS(acp_exports));
@@ -64351,7 +64769,7 @@ ${effect.notification.body || ""}`.trim();
             return b.uri ? {
               type: "resource_link",
               uri: b.uri,
-              name: path21.basename(b.uri),
+              name: path222.basename(b.uri),
               mimeType: b.mimeType,
               ...b.transcript ? { description: b.transcript } : {}
             } : { type: "text", text: b.transcript || `[Video attachment: ${b.mimeType}]` };
@@ -64803,11 +65221,11 @@ ${rawInput}` : rawInput;
     }
     function isExplicitCommand(command) {
       const trimmed = command.trim();
-      return path222.isAbsolute(trimmed) || trimmed.includes("/") || trimmed.includes("\\") || trimmed.startsWith("~");
+      return path232.isAbsolute(trimmed) || trimmed.includes("/") || trimmed.includes("\\") || trimmed.startsWith("~");
     }
     function expandExecutable(command) {
       const trimmed = command.trim();
-      return trimmed.startsWith("~") ? path222.join(os16.homedir(), trimmed.slice(1)) : trimmed;
+      return trimmed.startsWith("~") ? path232.join(os17.homedir(), trimmed.slice(1)) : trimmed;
     }
     function commandExists(command) {
       const trimmed = command.trim();
@@ -64934,10 +65352,10 @@ ${rawInput}` : rawInput;
       return args.some((arg) => arg === flag || arg.startsWith(`${flag}=`));
     }
     function ensureEmptyDelegatedMcpConfig(workspace) {
-      const baseDir = path222.join(os16.tmpdir(), "adhdev-delegated-agent-empty-mcp");
+      const baseDir = path232.join(os17.tmpdir(), "adhdev-delegated-agent-empty-mcp");
       (0, import_fs12.mkdirSync)(baseDir, { recursive: true });
-      const workspaceHash = crypto5.createHash("sha256").update(path222.resolve(workspace || os16.tmpdir())).digest("hex").slice(0, 16);
-      const filePath = path222.join(baseDir, `${workspaceHash}.json`);
+      const workspaceHash = crypto5.createHash("sha256").update(path232.resolve(workspace || os17.tmpdir())).digest("hex").slice(0, 16);
+      const filePath = path232.join(baseDir, `${workspaceHash}.json`);
       (0, import_fs12.writeFileSync)(filePath, JSON.stringify({ mcpServers: {} }, null, 2), "utf-8");
       return filePath;
     }
@@ -65231,7 +65649,7 @@ ${rawInput}` : rawInput;
       async startSession(cliType, workingDir, cliArgs, initialModel, options) {
         const trimmed = (workingDir || "").trim();
         if (!trimmed) throw new Error("working directory required");
-        const resolvedDir = trimmed.startsWith("~") ? trimmed.replace(/^~/, os16.homedir()) : path222.resolve(trimmed);
+        const resolvedDir = trimmed.startsWith("~") ? trimmed.replace(/^~/, os17.homedir()) : path232.resolve(trimmed);
         const normalizedType = this.providerLoader.resolveAlias(cliType);
         const rawProvider = this.providerLoader.getByAlias(cliType);
         const provider = rawProvider ? this.providerLoader.resolve(normalizedType) || rawProvider : void 0;
@@ -65616,6 +66034,20 @@ Run 'adhdev doctor' for detailed diagnostics.`
               cliArgs: args?.cliArgs,
               env: args?.env
             }) : null;
+            const provLookup = this.providerLoader.getMeta(this.providerLoader.resolveAlias(cliType));
+            const provTrust = provLookup?._sourceTrust;
+            if (provTrust === "external-untrusted" && args?.confirmExternalUntrusted !== true) {
+              return {
+                success: false,
+                error: "untrusted_external_provider",
+                provider: {
+                  type: provLookup?.type ?? cliType,
+                  sourceName: provLookup?._sourceName ?? null,
+                  trust: provTrust
+                },
+                hint: "Resend launch_cli with confirmExternalUntrusted=true after the user explicitly approves running JavaScript from this 3rd-party source."
+              };
+            }
             const started = await this.startSession(
               cliType,
               dir,
@@ -65800,11 +66232,11 @@ Run 'adhdev doctor' for detailed diagnostics.`
     };
     var import_child_process6 = require("child_process");
     var net3 = __toESM2(require("net"));
-    var os222 = __toESM2(require("os"));
+    var os23 = __toESM2(require("os"));
+    var path322 = __toESM2(require("path"));
+    var fs19 = __toESM2(require("fs"));
     var path31 = __toESM2(require("path"));
-    var fs18 = __toESM2(require("fs"));
-    var path30 = __toESM2(require("path"));
-    var os21 = __toESM2(require("os"));
+    var os222 = __toESM2(require("os"));
     var chokidar = __toESM2(require_chokidar());
     init_logger();
     var VALID_CAPABILITY_MEDIA_TYPES = /* @__PURE__ */ new Set(["text", "image", "audio", "video", "resource"]);
@@ -66173,9 +66605,9 @@ Run 'adhdev doctor' for detailed diagnostics.`
       static siblingStderrLogged = /* @__PURE__ */ new Set();
       static looksLikeProviderRoot(candidate) {
         try {
-          if (!fs18.existsSync(candidate) || !fs18.statSync(candidate).isDirectory()) return false;
+          if (!fs19.existsSync(candidate) || !fs19.statSync(candidate).isDirectory()) return false;
           return ["ide", "extension", "cli", "acp"].some(
-            (category) => fs18.existsSync(path30.join(candidate, category))
+            (category) => fs19.existsSync(path31.join(candidate, category))
           );
         } catch {
           return false;
@@ -66183,20 +66615,20 @@ Run 'adhdev doctor' for detailed diagnostics.`
       }
       static hasProviderRootMarker(candidate) {
         try {
-          return fs18.existsSync(path30.join(candidate, _ProviderLoader.SIBLING_MARKER_FILE));
+          return fs19.existsSync(path31.join(candidate, _ProviderLoader.SIBLING_MARKER_FILE));
         } catch {
           return false;
         }
       }
       detectDefaultUserDir() {
-        const fallback = path30.join(os21.homedir(), ".adhdev", "providers");
+        const fallback = path31.join(os222.homedir(), ".adhdev", "providers");
         const envOptIn = process.env[_ProviderLoader.SIBLING_ENV_VAR] === "1";
         const visited = /* @__PURE__ */ new Set();
         for (const start of this.probeStarts) {
-          let current = path30.resolve(start);
+          let current = path31.resolve(start);
           while (!visited.has(current)) {
             visited.add(current);
-            const siblingCandidate = path30.join(path30.dirname(current), _ProviderLoader.REPO_PROVIDER_DIRNAME);
+            const siblingCandidate = path31.join(path31.dirname(current), _ProviderLoader.REPO_PROVIDER_DIRNAME);
             if (_ProviderLoader.looksLikeProviderRoot(siblingCandidate)) {
               const hasMarker = _ProviderLoader.hasProviderRootMarker(siblingCandidate);
               if (envOptIn || hasMarker) {
@@ -66218,7 +66650,7 @@ Run 'adhdev doctor' for detailed diagnostics.`
                 return { path: siblingCandidate, source };
               }
             }
-            const parent = path30.dirname(current);
+            const parent = path31.dirname(current);
             if (parent === current) break;
             current = parent;
           }
@@ -66228,17 +66660,34 @@ Run 'adhdev doctor' for detailed diagnostics.`
       constructor(options) {
         this.logFn = options?.logFn || LOG2.forComponent("Provider").asLogFn();
         this.probeStarts = options?.probeStarts ?? [process.cwd(), __dirname];
-        this.defaultProvidersDir = path30.join(os21.homedir(), ".adhdev", "providers");
+        this.defaultProvidersDir = path31.join(os222.homedir(), ".adhdev", "providers");
         const detected = this.detectDefaultUserDir();
         this.userDir = detected.path;
         this.userDirSource = detected.source;
-        this.upstreamDir = path30.join(this.defaultProvidersDir, ".upstream");
+        this.upstreamDir = path31.join(this.defaultProvidersDir, ".upstream");
         this.disableUpstream = false;
         this.applySourceConfig({
           userDir: options?.userDir,
           sourceMode: options?.sourceMode,
           disableUpstream: options?.disableUpstream
         });
+        this.migrateMarketplaceDirToExternal();
+      }
+      migrateMarketplaceDirToExternal() {
+        try {
+          const home = os222.homedir();
+          const oldDir = path31.join(home, ".adhdev", "marketplace");
+          const newDir = path31.join(home, ".adhdev", "external");
+          if (!fs19.existsSync(oldDir)) return;
+          if (fs19.existsSync(newDir)) {
+            this.log(`Migration skipped: both ~/.adhdev/marketplace and ~/.adhdev/external exist (marketplace dir is now inert and can be removed manually).`);
+            return;
+          }
+          fs19.renameSync(oldDir, newDir);
+          this.log(`Migrated ~/.adhdev/marketplace \u2192 ~/.adhdev/external (one-time rename after provider source-layer cleanup).`);
+        } catch (e) {
+          this.log(`Marketplace\u2192external migration failed: ${e?.message || e}`);
+        }
       }
       log(msg) {
         this.logFn(`[ProviderLoader] ${msg}`);
@@ -66264,8 +66713,8 @@ Run 'adhdev doctor' for detailed diagnostics.`
        * Highest-priority editable overrides come first.
        */
       getProviderRoots() {
-        const marketplaceDir = path30.join(os21.homedir(), ".adhdev", "marketplace");
-        return [this.userDir, marketplaceDir, this.upstreamDir];
+        const externalDir = path31.join(os222.homedir(), ".adhdev", "external");
+        return [this.userDir, externalDir, this.upstreamDir];
       }
       getSourceConfig() {
         return {
@@ -66292,7 +66741,7 @@ Run 'adhdev doctor' for detailed diagnostics.`
           this.userDir = detected.path;
           this.userDirSource = detected.source;
         }
-        this.upstreamDir = path30.join(this.defaultProvidersDir, ".upstream");
+        this.upstreamDir = path31.join(this.defaultProvidersDir, ".upstream");
         this.disableUpstream = this.sourceMode === "no-upstream";
         if (this.explicitProviderDir) {
           this.log(`Config 'providerDir' applied: ${this.userDir}`);
@@ -66306,7 +66755,7 @@ Run 'adhdev doctor' for detailed diagnostics.`
       * Canonical provider directory shape for a given root.
       */
       getProviderDir(root, category, type) {
-        return path30.join(root, category, type);
+        return path31.join(root, category, type);
       }
       /**
       * Canonical user override directory for a provider.
@@ -66333,20 +66782,23 @@ Run 'adhdev doctor' for detailed diagnostics.`
       resolveProviderFile(type, ...segments) {
         const dir = this.findProviderDirInternal(type);
         if (!dir) return null;
-        return path30.join(dir, ...segments);
+        return path31.join(dir, ...segments);
       }
       /**
       * Load all providers (3-tier priority)
-      * 1. .upstream/ (GitHub auto-download — primary source)
-      * 2. User custom (~/.adhdev/providers/ excluding .upstream)
-      * User custom always wins (highest priority).
+      * 1. ~/.adhdev/providers/.upstream/ — official git, auto-synced
+      * 2. ~/.adhdev/external/ — 3rd-party git sources, user-added,
+      *    bundled providers may include arbitrary JS (untrusted by default)
+      * 3. ~/.adhdev/providers/ (excluding .upstream) — user-authored customs,
+      *    always wins
+      * Highest priority listed last (overwrites earlier loads).
       * If .upstream/ is empty, call fetchLatest() before loadAll().
       */
       loadAll() {
         this.providers.clear();
         this.providerAvailability.clear();
         let upstreamCount = 0;
-        if (!this.disableUpstream && fs18.existsSync(this.upstreamDir)) {
+        if (!this.disableUpstream && fs19.existsSync(this.upstreamDir)) {
           upstreamCount = this.loadDir(this.upstreamDir);
           if (upstreamCount > 0) {
             this.log(`Loaded ${upstreamCount} upstream providers (auto-updated)`);
@@ -66354,14 +66806,64 @@ Run 'adhdev doctor' for detailed diagnostics.`
         } else if (this.disableUpstream) {
           this.log("Upstream loading disabled (sourceMode=no-upstream)");
         }
-        const marketplaceDir = path30.join(os21.homedir(), ".adhdev", "marketplace");
-        if (fs18.existsSync(marketplaceDir)) {
-          const marketplaceCount = this.loadDir(marketplaceDir);
-          if (marketplaceCount > 0) {
-            this.log(`Loaded ${marketplaceCount} marketplace-installed providers`);
+        const externalDir = path31.join(os222.homedir(), ".adhdev", "external");
+        if (fs19.existsSync(externalDir)) {
+          const rootEntries = (() => {
+            try {
+              return fs19.readdirSync(externalDir, { withFileTypes: true });
+            } catch {
+              return [];
+            }
+          })();
+          const KNOWN_CATEGORIES = /* @__PURE__ */ new Set(["cli", "ide", "extension", "acp"]);
+          const looksLegacy = rootEntries.some((e) => e.isDirectory() && KNOWN_CATEGORIES.has(e.name));
+          if (looksLegacy) {
+            const externalCount = this.loadDir(externalDir);
+            if (externalCount > 0) {
+              this.log(`Loaded ${externalCount} external providers (legacy unnamed source)`);
+            }
+          } else {
+            const {
+              loadProvidersActive: loadProvidersActive2,
+              resolveActiveSource: resolveActiveSource2
+            } = (init_external_sources(), __toCommonJS2(external_sources_exports));
+            const activeFile = loadProvidersActive2();
+            let totalLoaded = 0;
+            const ambiguousTypes = [];
+            for (const sourceEntry of rootEntries) {
+              if (!sourceEntry.isDirectory()) continue;
+              const sourceDir = path31.join(externalDir, sourceEntry.name);
+              const sourceLoaded = this.loadDir(sourceDir);
+              if (sourceLoaded > 0) {
+                totalLoaded += sourceLoaded;
+                this.log(`Loaded ${sourceLoaded} providers from external source "${sourceEntry.name}"`);
+              }
+            }
+            for (const [type] of this.providers) {
+              const prov = this.providers.get(type);
+              if (!prov) continue;
+              const resolved = resolveActiveSource2(prov.category, type, activeFile);
+              if (resolved.candidates.length <= 1) continue;
+              if (resolved.ambiguous) {
+                ambiguousTypes.push({ type, chosen: resolved.source ?? "?", candidates: resolved.candidates });
+              }
+              if (resolved.source && resolved.source !== "?") {
+                const sourceDir = path31.join(externalDir, resolved.source);
+                const reloadCount = this.loadDir(sourceDir);
+                if (reloadCount === 0) {
+                  this.log(`Active source "${resolved.source}" no longer provides ${type}`);
+                }
+              }
+            }
+            if (totalLoaded > 0) {
+              this.log(`Loaded ${totalLoaded} external providers (3rd-party sources)`);
+            }
+            for (const a of ambiguousTypes) {
+              this.log(`Ambiguous provider "${a.type}" \u2014 provided by [${a.candidates.join(", ")}], defaulted to "${a.chosen}". Set the active source from the dashboard to silence this warning.`);
+            }
           }
         }
-        if (fs18.existsSync(this.userDir)) {
+        if (fs19.existsSync(this.userDir)) {
           const userCount = this.loadDir(this.userDir, [".upstream"]);
           if (userCount > 0) {
             this.log(`Loaded ${userCount} user custom providers (never auto-updated)`);
@@ -66376,10 +66878,10 @@ Run 'adhdev doctor' for detailed diagnostics.`
        * Check if upstream directory exists and has providers.
        */
       hasUpstream() {
-        if (!fs18.existsSync(this.upstreamDir)) return false;
+        if (!fs19.existsSync(this.upstreamDir)) return false;
         try {
-          return fs18.readdirSync(this.upstreamDir).some(
-            (d) => fs18.statSync(path30.join(this.upstreamDir, d)).isDirectory()
+          return fs19.readdirSync(this.upstreamDir).some(
+            (d) => fs19.statSync(path31.join(this.upstreamDir, d)).isDirectory()
           );
         } catch {
           return false;
@@ -66877,8 +67379,8 @@ Run 'adhdev doctor' for detailed diagnostics.`
                     resolved._resolvedScriptDir = entry.scriptDir;
                     resolved._resolvedScriptsSource = `compatibility:${entry.ideVersion}`;
                     if (providerDir) {
-                      const fullDir = path30.join(providerDir, entry.scriptDir);
-                      resolved._resolvedScriptsPath = fs18.existsSync(path30.join(fullDir, "scripts.js")) ? path30.join(fullDir, "scripts.js") : fullDir;
+                      const fullDir = path31.join(providerDir, entry.scriptDir);
+                      resolved._resolvedScriptsPath = fs19.existsSync(path31.join(fullDir, "scripts.js")) ? path31.join(fullDir, "scripts.js") : fullDir;
                     }
                     matched = true;
                   }
@@ -66896,8 +67398,8 @@ Run 'adhdev doctor' for detailed diagnostics.`
                 resolved._resolvedScriptDir = base.defaultScriptDir;
                 resolved._resolvedScriptsSource = "defaultScriptDir:version_miss";
                 if (providerDir) {
-                  const fullDir = path30.join(providerDir, base.defaultScriptDir);
-                  resolved._resolvedScriptsPath = fs18.existsSync(path30.join(fullDir, "scripts.js")) ? path30.join(fullDir, "scripts.js") : fullDir;
+                  const fullDir = path31.join(providerDir, base.defaultScriptDir);
+                  resolved._resolvedScriptsPath = fs19.existsSync(path31.join(fullDir, "scripts.js")) ? path31.join(fullDir, "scripts.js") : fullDir;
                 }
               }
               resolved._versionWarning = `Version ${currentVersion} not in compatibility matrix. Using default scripts.`;
@@ -66914,8 +67416,8 @@ Run 'adhdev doctor' for detailed diagnostics.`
                   resolved._resolvedScriptDir = dirOverride;
                   resolved._resolvedScriptsSource = `versions:${range}`;
                   if (providerDir) {
-                    const fullDir = path30.join(providerDir, dirOverride);
-                    resolved._resolvedScriptsPath = fs18.existsSync(path30.join(fullDir, "scripts.js")) ? path30.join(fullDir, "scripts.js") : fullDir;
+                    const fullDir = path31.join(providerDir, dirOverride);
+                    resolved._resolvedScriptsPath = fs19.existsSync(path31.join(fullDir, "scripts.js")) ? path31.join(fullDir, "scripts.js") : fullDir;
                   }
                 }
               } else if (override.scripts) {
@@ -66931,8 +67433,8 @@ Run 'adhdev doctor' for detailed diagnostics.`
             resolved._resolvedScriptDir = base.defaultScriptDir;
             resolved._resolvedScriptsSource = "defaultScriptDir:no_version";
             if (providerDir) {
-              const fullDir = path30.join(providerDir, base.defaultScriptDir);
-              resolved._resolvedScriptsPath = fs18.existsSync(path30.join(fullDir, "scripts.js")) ? path30.join(fullDir, "scripts.js") : fullDir;
+              const fullDir = path31.join(providerDir, base.defaultScriptDir);
+              resolved._resolvedScriptsPath = fs19.existsSync(path31.join(fullDir, "scripts.js")) ? path31.join(fullDir, "scripts.js") : fullDir;
             }
           }
         }
@@ -66949,13 +67451,13 @@ Run 'adhdev doctor' for detailed diagnostics.`
           if (providerDir2) {
             for (const [scriptName, override] of Object.entries(base.overrides)) {
               if (!override || typeof override.path !== "string") continue;
-              const fullPath = path30.join(providerDir2, override.path);
-              if (!fs18.existsSync(fullPath)) {
+              const fullPath = path31.join(providerDir2, override.path);
+              if (!fs19.existsSync(fullPath)) {
                 this.log(`  [overrides] ${base.type}: ${scriptName} path not found: ${fullPath}`);
                 continue;
               }
               try {
-                registerProviderScriptRootSafely(path30.dirname(path30.dirname(providerDir2)));
+                registerProviderScriptRootSafely(path31.dirname(path31.dirname(providerDir2)));
                 delete require.cache[require.resolve(fullPath)];
                 const fn = require(fullPath);
                 const target = typeof fn === "function" ? fn : fn && fn[scriptName];
@@ -66980,19 +67482,19 @@ Run 'adhdev doctor' for detailed diagnostics.`
         }
         if (providerDir) {
           try {
-            const fs27 = require("fs");
-            const path39 = require("path");
+            const fs28 = require("fs");
+            const path40 = require("path");
             const candidates = [];
             if (Array.isArray(base.compatibility)) {
               for (const entry of base.compatibility) {
                 if (typeof entry?.spec !== "string") continue;
                 const matches = !entry.ideVersion || currentVersion && this.matchesVersion(currentVersion, entry.ideVersion) || !currentVersion;
-                if (matches) candidates.push(path39.join(providerDir, entry.spec));
+                if (matches) candidates.push(path40.join(providerDir, entry.spec));
               }
             }
-            candidates.push(path39.join(providerDir, "specs", "default.json"));
-            candidates.push(path39.join(providerDir, "spec.json"));
-            const specPath = candidates.find((p) => fs27.existsSync(p));
+            candidates.push(path40.join(providerDir, "specs", "default.json"));
+            candidates.push(path40.join(providerDir, "spec.json"));
+            const specPath = candidates.find((p) => fs28.existsSync(p));
             if (specPath) {
               resolved._resolvedSpecPath = specPath;
               const { loadSpec: loadSpec2 } = (init_loader(), __toCommonJS2(loader_exports));
@@ -67021,10 +67523,10 @@ Run 'adhdev doctor' for detailed diagnostics.`
                   format = `spec-${nh.source.kind}`;
                   reader = (input) => executeNativeHistory2(nh, input);
                 } else if (nh.override_path) {
-                  const overrideFile = path39.resolve(providerDir, nh.override_path);
-                  if (fs27.existsSync(overrideFile)) {
+                  const overrideFile = path40.resolve(providerDir, nh.override_path);
+                  if (fs28.existsSync(overrideFile)) {
                     try {
-                      registerProviderScriptRootSafely(path39.dirname(path39.dirname(providerDir)));
+                      registerProviderScriptRootSafely(path40.dirname(path40.dirname(providerDir)));
                       delete require.cache[require.resolve(overrideFile)];
                       const mod = require(overrideFile);
                       const fn = typeof mod === "function" ? mod : mod && typeof mod.default === "function" ? mod.default : null;
@@ -67068,16 +67570,16 @@ Run 'adhdev doctor' for detailed diagnostics.`
           this.debugLog(`[loadScriptsFromDir] ${type}: providerDir not found`);
           return null;
         }
-        const dir = path30.join(providerDir, scriptDir);
-        if (!fs18.existsSync(dir)) {
+        const dir = path31.join(providerDir, scriptDir);
+        if (!fs19.existsSync(dir)) {
           this.debugLog(`[loadScriptsFromDir] ${type}: dir not found: ${dir}`);
           return null;
         }
-        registerProviderScriptRootSafely(path30.dirname(path30.dirname(providerDir)));
+        registerProviderScriptRootSafely(path31.dirname(path31.dirname(providerDir)));
         const cached2 = this.scriptsCache.get(dir);
         if (cached2) return cached2;
-        const scriptsJs = path30.join(dir, "scripts.js");
-        if (fs18.existsSync(scriptsJs)) {
+        const scriptsJs = path31.join(dir, "scripts.js");
+        if (fs19.existsSync(scriptsJs)) {
           try {
             delete require.cache[require.resolve(scriptsJs)];
             const loaded = require(scriptsJs);
@@ -67098,9 +67600,9 @@ Run 'adhdev doctor' for detailed diagnostics.`
       watch() {
         this.stopWatch();
         const watchDir = (dir) => {
-          if (!fs18.existsSync(dir)) {
+          if (!fs19.existsSync(dir)) {
             try {
-              fs18.mkdirSync(dir, { recursive: true });
+              fs19.mkdirSync(dir, { recursive: true });
             } catch {
               return;
             }
@@ -67121,7 +67623,7 @@ Run 'adhdev doctor' for detailed diagnostics.`
               if (filePath.endsWith(".js") || filePath.endsWith(".json")) {
                 if (reloadTimer) clearTimeout(reloadTimer);
                 reloadTimer = setTimeout(() => {
-                  this.log(`File changed: ${path30.basename(filePath)}, reloading...`);
+                  this.log(`File changed: ${path31.basename(filePath)}, reloading...`);
                   this.reload();
                 }, 300);
               }
@@ -67189,11 +67691,11 @@ Run 'adhdev doctor' for detailed diagnostics.`
         }
         this.log(`Registry sync starting (${_ProviderLoader.REGISTRY_BASE_URL})...`);
         const https = require("https");
-        const regMetaPath = path30.join(this.upstreamDir, _ProviderLoader.REGISTRY_META_FILE);
+        const regMetaPath = path31.join(this.upstreamDir, _ProviderLoader.REGISTRY_META_FILE);
         let cachedChecksums = {};
         try {
-          if (fs18.existsSync(regMetaPath)) {
-            cachedChecksums = JSON.parse(fs18.readFileSync(regMetaPath, "utf-8")).checksums ?? {};
+          if (fs19.existsSync(regMetaPath)) {
+            cachedChecksums = JSON.parse(fs19.readFileSync(regMetaPath, "utf-8")).checksums ?? {};
           }
         } catch {
         }
@@ -67247,15 +67749,15 @@ Run 'adhdev doctor' for detailed diagnostics.`
               this.log(`\u26A0 Registry checksum mismatch for ${type}@${version2} \u2014 skipping`);
               continue;
             }
-            const providerDir = path30.join(this.upstreamDir, category, type);
-            fs18.mkdirSync(providerDir, { recursive: true });
-            fs18.writeFileSync(path30.join(providerDir, "provider.json"), manifestBody, "utf-8");
+            const providerDir = path31.join(this.upstreamDir, category, type);
+            fs19.mkdirSync(providerDir, { recursive: true });
+            fs19.writeFileSync(path31.join(providerDir, "provider.json"), manifestBody, "utf-8");
             cachedChecksums[cacheKey] = checksum;
             updatedCount++;
             this.log(`\u2713 Registry updated: ${category}/${type}@${version2}`);
           }
-          fs18.mkdirSync(this.upstreamDir, { recursive: true });
-          fs18.writeFileSync(regMetaPath, JSON.stringify({
+          fs19.mkdirSync(this.upstreamDir, { recursive: true });
+          fs19.writeFileSync(regMetaPath, JSON.stringify({
             checksums: cachedChecksums,
             syncedAt: (/* @__PURE__ */ new Date()).toISOString(),
             providerCount: list.providers.length
@@ -67276,12 +67778,12 @@ Run 'adhdev doctor' for detailed diagnostics.`
         const { exec: exec7 } = require("child_process");
         const { promisify: promisify7 } = require("util");
         const execAsync5 = promisify7(exec7);
-        const metaPath = path30.join(this.upstreamDir, _ProviderLoader.META_FILE);
+        const metaPath = path31.join(this.upstreamDir, _ProviderLoader.META_FILE);
         let prevEtag = "";
         let prevTimestamp = 0;
         try {
-          if (fs18.existsSync(metaPath)) {
-            const meta3 = JSON.parse(fs18.readFileSync(metaPath, "utf-8"));
+          if (fs19.existsSync(metaPath)) {
+            const meta3 = JSON.parse(fs19.readFileSync(metaPath, "utf-8"));
             prevEtag = meta3.etag || "";
             prevTimestamp = meta3.timestamp || 0;
           }
@@ -67336,39 +67838,39 @@ Run 'adhdev doctor' for detailed diagnostics.`
             return { updated: false };
           }
           this.log("Downloading latest providers from GitHub...");
-          const tmpTar = path30.join(os21.tmpdir(), `adhdev-providers-${Date.now()}.tar.gz`);
-          const tmpExtract = path30.join(os21.tmpdir(), `adhdev-providers-extract-${Date.now()}`);
+          const tmpTar = path31.join(os222.tmpdir(), `adhdev-providers-${Date.now()}.tar.gz`);
+          const tmpExtract = path31.join(os222.tmpdir(), `adhdev-providers-extract-${Date.now()}`);
           await this.downloadFile(_ProviderLoader.GITHUB_TARBALL_URL, tmpTar);
-          fs18.mkdirSync(tmpExtract, { recursive: true });
+          fs19.mkdirSync(tmpExtract, { recursive: true });
           await execAsync5(`tar -xzf "${tmpTar}" -C "${tmpExtract}"`, { timeout: 3e4 });
-          const extracted = fs18.readdirSync(tmpExtract);
+          const extracted = fs19.readdirSync(tmpExtract);
           const rootDir = extracted.find(
-            (d) => fs18.statSync(path30.join(tmpExtract, d)).isDirectory() && d.startsWith("adhdev-providers")
+            (d) => fs19.statSync(path31.join(tmpExtract, d)).isDirectory() && d.startsWith("adhdev-providers")
           );
           if (!rootDir) throw new Error("Unexpected tarball structure");
-          const sourceDir = path30.join(tmpExtract, rootDir);
+          const sourceDir = path31.join(tmpExtract, rootDir);
           const backupDir = this.upstreamDir + ".bak";
-          if (fs18.existsSync(this.upstreamDir)) {
-            if (fs18.existsSync(backupDir)) fs18.rmSync(backupDir, { recursive: true, force: true });
-            fs18.renameSync(this.upstreamDir, backupDir);
+          if (fs19.existsSync(this.upstreamDir)) {
+            if (fs19.existsSync(backupDir)) fs19.rmSync(backupDir, { recursive: true, force: true });
+            fs19.renameSync(this.upstreamDir, backupDir);
           }
           try {
             this.copyDirRecursive(sourceDir, this.upstreamDir);
             this.writeMeta(metaPath, etag || `ts-${Date.now()}`, Date.now());
-            if (fs18.existsSync(backupDir)) fs18.rmSync(backupDir, { recursive: true, force: true });
+            if (fs19.existsSync(backupDir)) fs19.rmSync(backupDir, { recursive: true, force: true });
           } catch (e) {
-            if (fs18.existsSync(backupDir)) {
-              if (fs18.existsSync(this.upstreamDir)) fs18.rmSync(this.upstreamDir, { recursive: true, force: true });
-              fs18.renameSync(backupDir, this.upstreamDir);
+            if (fs19.existsSync(backupDir)) {
+              if (fs19.existsSync(this.upstreamDir)) fs19.rmSync(this.upstreamDir, { recursive: true, force: true });
+              fs19.renameSync(backupDir, this.upstreamDir);
             }
             throw e;
           }
           try {
-            fs18.rmSync(tmpTar, { force: true });
+            fs19.rmSync(tmpTar, { force: true });
           } catch {
           }
           try {
-            fs18.rmSync(tmpExtract, { recursive: true, force: true });
+            fs19.rmSync(tmpExtract, { recursive: true, force: true });
           } catch {
           }
           const upstreamCount = this.countProviders(this.upstreamDir);
@@ -67400,7 +67902,7 @@ Run 'adhdev doctor' for detailed diagnostics.`
                 reject(new Error(`HTTP ${res.statusCode}`));
                 return;
               }
-              const ws = fs18.createWriteStream(destPath);
+              const ws = fs19.createWriteStream(destPath);
               res.pipe(ws);
               ws.on("finish", () => {
                 ws.close();
@@ -67419,22 +67921,22 @@ Run 'adhdev doctor' for detailed diagnostics.`
       }
       /** Recursive directory copy */
       copyDirRecursive(src, dest) {
-        fs18.mkdirSync(dest, { recursive: true });
-        for (const entry of fs18.readdirSync(src, { withFileTypes: true })) {
-          const srcPath = path30.join(src, entry.name);
-          const destPath = path30.join(dest, entry.name);
+        fs19.mkdirSync(dest, { recursive: true });
+        for (const entry of fs19.readdirSync(src, { withFileTypes: true })) {
+          const srcPath = path31.join(src, entry.name);
+          const destPath = path31.join(dest, entry.name);
           if (entry.isDirectory()) {
             this.copyDirRecursive(srcPath, destPath);
           } else {
-            fs18.copyFileSync(srcPath, destPath);
+            fs19.copyFileSync(srcPath, destPath);
           }
         }
       }
       /** .meta.json save */
       writeMeta(metaPath, etag, timestamp) {
         try {
-          fs18.mkdirSync(path30.dirname(metaPath), { recursive: true });
-          fs18.writeFileSync(metaPath, JSON.stringify({
+          fs19.mkdirSync(path31.dirname(metaPath), { recursive: true });
+          fs19.writeFileSync(metaPath, JSON.stringify({
             etag,
             timestamp,
             lastCheck: new Date(timestamp).toISOString(),
@@ -67445,15 +67947,15 @@ Run 'adhdev doctor' for detailed diagnostics.`
       }
       /** Count provider files (provider.v1.json or provider.json — at most one per dir). */
       countProviders(dir) {
-        if (!fs18.existsSync(dir)) return 0;
+        if (!fs19.existsSync(dir)) return 0;
         let count = 0;
         const scan = (d) => {
           try {
-            const entries = fs18.readdirSync(d, { withFileTypes: true });
+            const entries = fs19.readdirSync(d, { withFileTypes: true });
             const hasManifest = entries.some((e) => e.name === "provider.v1.json" || e.name === "provider.json");
             if (hasManifest) count++;
             for (const entry of entries) {
-              if (entry.isDirectory()) scan(path30.join(d, entry.name));
+              if (entry.isDirectory()) scan(path31.join(d, entry.name));
             }
           } catch {
           }
@@ -67679,13 +68181,13 @@ Run 'adhdev doctor' for detailed diagnostics.`
         if (!provider) return null;
         const cat = provider.category;
         const searchRoots = this.getProviderRoots();
-        const hasManifest = (dir) => fs18.existsSync(path30.join(dir, "provider.v1.json")) || fs18.existsSync(path30.join(dir, "provider.json"));
+        const hasManifest = (dir) => fs19.existsSync(path31.join(dir, "provider.v1.json")) || fs19.existsSync(path31.join(dir, "provider.json"));
         const readManifestType = (dir) => {
           for (const file2 of ["provider.v1.json", "provider.json"]) {
-            const p = path30.join(dir, file2);
-            if (!fs18.existsSync(p)) continue;
+            const p = path31.join(dir, file2);
+            if (!fs19.existsSync(p)) continue;
             try {
-              const data = JSON.parse(fs18.readFileSync(p, "utf-8"));
+              const data = JSON.parse(fs19.readFileSync(p, "utf-8"));
               if (typeof data?.type === "string") return data.type;
             } catch {
             }
@@ -67693,15 +68195,15 @@ Run 'adhdev doctor' for detailed diagnostics.`
           return null;
         };
         for (const root of searchRoots) {
-          if (!fs18.existsSync(root)) continue;
+          if (!fs19.existsSync(root)) continue;
           const candidate = this.getProviderDir(root, cat, type);
           if (hasManifest(candidate)) return candidate;
-          const catDir = path30.join(root, cat);
-          if (fs18.existsSync(catDir)) {
+          const catDir = path31.join(root, cat);
+          if (fs19.existsSync(catDir)) {
             try {
-              for (const entry of fs18.readdirSync(catDir, { withFileTypes: true })) {
+              for (const entry of fs19.readdirSync(catDir, { withFileTypes: true })) {
                 if (!entry.isDirectory()) continue;
-                const entryDir = path30.join(catDir, entry.name);
+                const entryDir = path31.join(catDir, entry.name);
                 const manifestType = readManifestType(entryDir);
                 if (manifestType === type) return entryDir;
               }
@@ -67717,8 +68219,8 @@ Run 'adhdev doctor' for detailed diagnostics.`
        * (template substitution is NOT applied here — scripts.js handles that)
        */
       buildScriptWrappersFromDir(dir) {
-        const scriptsJs = path30.join(dir, "scripts.js");
-        if (fs18.existsSync(scriptsJs)) {
+        const scriptsJs = path31.join(dir, "scripts.js");
+        if (fs19.existsSync(scriptsJs)) {
           try {
             delete require.cache[require.resolve(scriptsJs)];
             return require(scriptsJs);
@@ -67728,13 +68230,13 @@ Run 'adhdev doctor' for detailed diagnostics.`
         const toCamel = (name) => name.replace(/_([a-z])/g, (_, c) => c.toUpperCase());
         const result = {};
         try {
-          for (const file2 of fs18.readdirSync(dir)) {
+          for (const file2 of fs19.readdirSync(dir)) {
             if (!file2.endsWith(".js")) continue;
             const scriptName = toCamel(file2.replace(".js", ""));
-            const filePath = path30.join(dir, file2);
+            const filePath = path31.join(dir, file2);
             result[scriptName] = (...args) => {
               try {
-                let content = fs18.readFileSync(filePath, "utf-8");
+                let content = fs19.readFileSync(filePath, "utf-8");
                 if (args[0] && typeof args[0] === "object") {
                   for (const [key, val] of Object.entries(args[0])) {
                     let v = val;
@@ -67780,12 +68282,12 @@ Run 'adhdev doctor' for detailed diagnostics.`
        * Structure: dir/category/agent-name/provider.{json,js}
        */
       loadDir(dir, excludeDirs) {
-        if (!fs18.existsSync(dir)) return 0;
+        if (!fs19.existsSync(dir)) return 0;
         let count = 0;
         const scan = (d) => {
           let entries;
           try {
-            entries = fs18.readdirSync(d, { withFileTypes: true });
+            entries = fs19.readdirSync(d, { withFileTypes: true });
           } catch {
             return;
           }
@@ -67793,9 +68295,9 @@ Run 'adhdev doctor' for detailed diagnostics.`
           const hasJson = entries.some((e) => e.name === "provider.json");
           if (hasV1 || hasJson) {
             const manifestFile = hasV1 ? "provider.v1.json" : "provider.json";
-            const jsonPath = path30.join(d, manifestFile);
+            const jsonPath = path31.join(d, manifestFile);
             try {
-              const raw = fs18.readFileSync(jsonPath, "utf-8");
+              const raw = fs19.readFileSync(jsonPath, "utf-8");
               const mod = JSON.parse(raw);
               if (hasV1 && mod?.category === "cli") {
                 try {
@@ -67833,10 +68335,10 @@ ${formatManifestValidationIssues2(validation2.issues)}`);
                 this.log(`\u26A0 Invalid provider at ${jsonPath}: ${validation.errors.join("; ")}`);
               } else {
                 const hasCompatibility = Array.isArray(normalizedProvider.compatibility);
-                const scriptsPath = path30.join(d, "scripts.js");
-                if (!hasCompatibility && fs18.existsSync(scriptsPath)) {
+                const scriptsPath = path31.join(d, "scripts.js");
+                if (!hasCompatibility && fs19.existsSync(scriptsPath)) {
                   try {
-                    registerProviderScriptRootSafely(path30.dirname(path30.dirname(d)));
+                    registerProviderScriptRootSafely(path31.dirname(path31.dirname(d)));
                     delete require.cache[require.resolve(scriptsPath)];
                     const scripts = require(scriptsPath);
                     normalizedProvider.scripts = scripts;
@@ -67844,12 +68346,30 @@ ${formatManifestValidationIssues2(validation2.issues)}`);
                     this.log(`\u26A0 Failed to load scripts: ${scriptsPath}: ${e.message}`);
                   }
                 }
+                const externalDirAbs = path31.join(os222.homedir(), ".adhdev", "external");
+                const layer = d.startsWith(externalDirAbs) ? "external" : d.startsWith(this.userDir) && !d.includes(".upstream") ? "user" : "upstream";
+                try {
+                  const { inspectManifestShape: inspectManifestShape2, classifyTrust: classifyTrust2 } = (init_provider_trust(), __toCommonJS2(provider_trust_exports));
+                  const shape = inspectManifestShape2(mod);
+                  const trust = classifyTrust2(layer, shape);
+                  normalizedProvider._sourceLayer = layer;
+                  normalizedProvider._sourceTrust = trust;
+                  normalizedProvider._manifestShape = shape;
+                  if (layer === "external") {
+                    const rel = path31.relative(externalDirAbs, d);
+                    const firstSeg = rel.split(path31.sep)[0];
+                    if (firstSeg && firstSeg !== "..") normalizedProvider._sourceName = firstSeg;
+                  }
+                } catch {
+                }
                 const existed = this.providers.has(normalizedProvider.type);
                 this.providers.set(normalizedProvider.type, normalizedProvider);
                 count++;
-                const source = d.startsWith(this.userDir) && !d.includes(".upstream") ? "user" : "upstream";
+                const source = normalizedProvider._sourceLayer ?? "upstream";
                 const overrideWarning = existed && source === "user" ? " \u26A0 OVERRIDES upstream" : "";
-                this.log(`  ${existed ? "\u{1F504}" : "\u2705"} ${normalizedProvider.type} (${normalizedProvider.category}) \u2014 ${normalizedProvider.name} [${source}]${overrideWarning}`);
+                const sourceName = normalizedProvider._sourceName;
+                const sourceLabel = sourceName ? `${source}/${sourceName}` : source;
+                this.log(`  ${existed ? "\u{1F504}" : "\u2705"} ${normalizedProvider.type} (${normalizedProvider.category}) \u2014 ${normalizedProvider.name} [${sourceLabel}]${overrideWarning}`);
               }
             } catch (e) {
               this.log(`\u26A0 Failed to load ${jsonPath}: ${e.message}`);
@@ -67859,8 +68379,9 @@ ${formatManifestValidationIssues2(validation2.issues)}`);
             for (const entry of entries) {
               if (!entry.isDirectory()) continue;
               if (entry.name.startsWith("_") || entry.name.startsWith(".")) continue;
+              if (d === dir && entry.name === "examples") continue;
               if (excludeDirs && d === dir && excludeDirs.includes(entry.name)) continue;
-              scan(path30.join(d, entry.name));
+              scan(path31.join(d, entry.name));
             }
           }
         };
@@ -68054,7 +68575,7 @@ ${formatManifestValidationIssues2(validation2.issues)}`);
       });
     }
     async function killIdeProcess(ideId) {
-      const plat = os222.platform();
+      const plat = os23.platform();
       const appName = getMacAppIdentifiers()[ideId];
       const winProcesses = getWinProcessNames()[ideId];
       try {
@@ -68115,7 +68636,7 @@ ${formatManifestValidationIssues2(validation2.issues)}`);
       }
     }
     async function isIdeRunning(ideId) {
-      const plat = os222.platform();
+      const plat = os23.platform();
       try {
         if (plat === "darwin") {
           const appName = getMacAppIdentifiers()[ideId];
@@ -68170,7 +68691,7 @@ ${formatManifestValidationIssues2(validation2.issues)}`);
       }
     }
     async function detectCurrentWorkspace(ideId) {
-      const plat = os222.platform();
+      const plat = os23.platform();
       if (plat === "darwin") {
         try {
           const appName = getMacAppIdentifiers()[ideId];
@@ -68185,17 +68706,17 @@ ${formatManifestValidationIssues2(validation2.issues)}`);
         }
       } else if (plat === "win32") {
         try {
-          const fs27 = require("fs");
+          const fs28 = require("fs");
           const appNameMap = getMacAppIdentifiers();
           const appName = appNameMap[ideId];
           if (appName) {
-            const storagePath = path31.join(
-              process.env.APPDATA || path31.join(os222.homedir(), "AppData", "Roaming"),
+            const storagePath = path322.join(
+              process.env.APPDATA || path322.join(os23.homedir(), "AppData", "Roaming"),
               appName,
               "storage.json"
             );
-            if (fs27.existsSync(storagePath)) {
-              const data = JSON.parse(fs27.readFileSync(storagePath, "utf-8"));
+            if (fs28.existsSync(storagePath)) {
+              const data = JSON.parse(fs28.readFileSync(storagePath, "utf-8"));
               const workspaces = data?.openedPathsList?.workspaces3 || data?.openedPathsList?.entries || [];
               if (workspaces.length > 0) {
                 const recent = workspaces[0];
@@ -68212,7 +68733,7 @@ ${formatManifestValidationIssues2(validation2.issues)}`);
       return void 0;
     }
     async function launchWithCdp(options = {}) {
-      const platform10 = os222.platform();
+      const platform10 = os23.platform();
       let targetIde;
       const ides = await detectIDEs(getProviderLoader());
       if (options.ideId) {
@@ -68375,14 +68896,14 @@ ${formatManifestValidationIssues2(validation2.issues)}`);
     init_config();
     init_cli_detector();
     init_logger();
-    var fs19 = __toESM2(require("fs"));
-    var path322 = __toESM2(require("path"));
-    var os23 = __toESM2(require("os"));
-    var LOG_DIR2 = process.platform === "win32" ? path322.join(process.env.LOCALAPPDATA || process.env.APPDATA || path322.join(os23.homedir(), "AppData", "Local"), "adhdev", "logs") : process.platform === "darwin" ? path322.join(os23.homedir(), "Library", "Logs", "adhdev") : path322.join(os23.homedir(), ".local", "share", "adhdev", "logs");
+    var fs20 = __toESM2(require("fs"));
+    var path33 = __toESM2(require("path"));
+    var os24 = __toESM2(require("os"));
+    var LOG_DIR2 = process.platform === "win32" ? path33.join(process.env.LOCALAPPDATA || process.env.APPDATA || path33.join(os24.homedir(), "AppData", "Local"), "adhdev", "logs") : process.platform === "darwin" ? path33.join(os24.homedir(), "Library", "Logs", "adhdev") : path33.join(os24.homedir(), ".local", "share", "adhdev", "logs");
     var MAX_FILE_SIZE = 5 * 1024 * 1024;
     var MAX_DAYS = 7;
     try {
-      fs19.mkdirSync(LOG_DIR2, { recursive: true });
+      fs20.mkdirSync(LOG_DIR2, { recursive: true });
     } catch {
     }
     var SENSITIVE_KEYS = /* @__PURE__ */ new Set([
@@ -68416,19 +68937,19 @@ ${formatManifestValidationIssues2(validation2.issues)}`);
       return (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
     }
     var currentDate2 = getDateStr2();
-    var currentFile = path322.join(LOG_DIR2, `commands-${currentDate2}.jsonl`);
+    var currentFile = path33.join(LOG_DIR2, `commands-${currentDate2}.jsonl`);
     var writeCount2 = 0;
     function checkRotation() {
       const today = getDateStr2();
       if (today !== currentDate2) {
         currentDate2 = today;
-        currentFile = path322.join(LOG_DIR2, `commands-${currentDate2}.jsonl`);
+        currentFile = path33.join(LOG_DIR2, `commands-${currentDate2}.jsonl`);
         cleanOldFiles();
       }
     }
     function cleanOldFiles() {
       try {
-        const files = fs19.readdirSync(LOG_DIR2).filter((f) => f.startsWith("commands-") && f.endsWith(".jsonl"));
+        const files = fs20.readdirSync(LOG_DIR2).filter((f) => f.startsWith("commands-") && f.endsWith(".jsonl"));
         const cutoff = /* @__PURE__ */ new Date();
         cutoff.setDate(cutoff.getDate() - MAX_DAYS);
         const cutoffStr = cutoff.toISOString().slice(0, 10);
@@ -68436,7 +68957,7 @@ ${formatManifestValidationIssues2(validation2.issues)}`);
           const dateMatch = file2.match(/commands-(\d{4}-\d{2}-\d{2})/);
           if (dateMatch && dateMatch[1] < cutoffStr) {
             try {
-              fs19.unlinkSync(path322.join(LOG_DIR2, file2));
+              fs20.unlinkSync(path33.join(LOG_DIR2, file2));
             } catch {
             }
           }
@@ -68446,14 +68967,14 @@ ${formatManifestValidationIssues2(validation2.issues)}`);
     }
     function checkSize() {
       try {
-        const stat2 = fs19.statSync(currentFile);
+        const stat2 = fs20.statSync(currentFile);
         if (stat2.size > MAX_FILE_SIZE) {
           const backup = currentFile.replace(".jsonl", ".1.jsonl");
           try {
-            fs19.unlinkSync(backup);
+            fs20.unlinkSync(backup);
           } catch {
           }
-          fs19.renameSync(currentFile, backup);
+          fs20.renameSync(currentFile, backup);
         }
       } catch {
       }
@@ -68486,14 +69007,14 @@ ${formatManifestValidationIssues2(validation2.issues)}`);
           ...entry.error ? { err: entry.error } : {},
           ...entry.durationMs !== void 0 ? { ms: entry.durationMs } : {}
         });
-        fs19.appendFileSync(currentFile, line + "\n");
+        fs20.appendFileSync(currentFile, line + "\n");
       } catch {
       }
     }
     function getRecentCommands(count = 50) {
       try {
-        if (!fs19.existsSync(currentFile)) return [];
-        const content = fs19.readFileSync(currentFile, "utf-8");
+        if (!fs20.existsSync(currentFile)) return [];
+        const content = fs20.readFileSync(currentFile, "utf-8");
         const lines = content.trim().split("\n").filter(Boolean);
         return lines.slice(-count).map((line) => {
           try {
@@ -68539,10 +69060,10 @@ ${formatManifestValidationIssues2(validation2.issues)}`);
       }
     }
     function readRecord3(repoRoot) {
-      const path39 = (0, import_node_path2.resolve)(repoRoot, PREVIEW_DEPLOY_RECORD);
-      if (!(0, import_node_fs4.existsSync)(path39)) return null;
+      const path40 = (0, import_node_path2.resolve)(repoRoot, PREVIEW_DEPLOY_RECORD);
+      if (!(0, import_node_fs4.existsSync)(path40)) return null;
       try {
-        const parsed = JSON.parse((0, import_node_fs4.readFileSync)(path39, "utf8"));
+        const parsed = JSON.parse((0, import_node_fs4.readFileSync)(path40, "utf8"));
         return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
       } catch {
         return null;
@@ -68602,7 +69123,7 @@ ${formatManifestValidationIssues2(validation2.issues)}`);
         nextAction
       };
     }
-    var os24 = __toESM2(require("os"));
+    var os25 = __toESM2(require("os"));
     init_config();
     init_terminal_screen();
     init_logger();
@@ -68641,25 +69162,50 @@ ${formatManifestValidationIssues2(validation2.issues)}`);
     }
     function buildAvailableProviders(providerLoader) {
       const providers = providerLoader.getAvailableProviderInfos?.() || providerLoader.getAll();
-      return providers.map((provider) => ({
-        type: provider.type,
-        name: provider.displayName || provider.type,
-        displayName: provider.displayName || provider.type,
-        icon: provider.icon || "\u{1F4BB}",
-        category: provider.category,
-        ...provider.installed !== void 0 ? { installed: provider.installed } : {},
-        ...provider.detectedPath !== void 0 ? { detectedPath: provider.detectedPath } : {},
-        ...provider.enabled !== void 0 ? { enabled: provider.enabled } : {},
-        ...provider.machineStatus !== void 0 ? { machineStatus: provider.machineStatus } : {},
-        ...provider.lastDetection !== void 0 ? { lastDetection: provider.lastDetection } : {},
-        ...provider.lastVerification !== void 0 ? { lastVerification: provider.lastVerification } : {},
-        ...provider.meshCoordinator !== void 0 ? { meshCoordinator: provider.meshCoordinator } : {}
-      }));
+      let describeTrust2 = () => "";
+      let requiresConfirmation2 = () => false;
+      try {
+        const mod = (init_provider_trust(), __toCommonJS2(provider_trust_exports));
+        describeTrust2 = mod.describeTrust;
+        requiresConfirmation2 = mod.requiresConfirmation;
+      } catch {
+      }
+      return providers.map((provider) => {
+        const trust = provider._sourceTrust;
+        const sourceLayer = provider._sourceLayer;
+        const sourceName = provider._sourceName;
+        return {
+          type: provider.type,
+          name: provider.displayName || provider.type,
+          displayName: provider.displayName || provider.type,
+          icon: provider.icon || "\u{1F4BB}",
+          category: provider.category,
+          ...provider.installed !== void 0 ? { installed: provider.installed } : {},
+          ...provider.detectedPath !== void 0 ? { detectedPath: provider.detectedPath } : {},
+          ...provider.enabled !== void 0 ? { enabled: provider.enabled } : {},
+          ...provider.machineStatus !== void 0 ? { machineStatus: provider.machineStatus } : {},
+          ...provider.lastDetection !== void 0 ? { lastDetection: provider.lastDetection } : {},
+          ...provider.lastVerification !== void 0 ? { lastVerification: provider.lastVerification } : {},
+          ...provider.meshCoordinator !== void 0 ? { meshCoordinator: provider.meshCoordinator } : {},
+          ...trust ? {
+            trust,
+            trustDescription: describeTrust2(trust),
+            requiresConfirmation: requiresConfirmation2(trust)
+          } : {},
+          ...sourceLayer ? { sourceLayer } : {},
+          ...sourceName ? { sourceName } : {},
+          ...provider.providerVersion ? { providerVersion: provider.providerVersion } : {},
+          ...provider.binary ? { binary: provider.binary } : {},
+          ...provider.status ? { status: provider.status } : {},
+          ...provider.details ? { details: provider.details } : {},
+          ...provider.links ? { links: provider.links } : {}
+        };
+      });
     }
     function buildMachineInfo2(profile = "full") {
       const base = {
-        hostname: os24.hostname(),
-        platform: os24.platform()
+        hostname: os25.hostname(),
+        platform: os25.platform()
       };
       if (profile === "live") {
         return base;
@@ -68668,23 +69214,23 @@ ${formatManifestValidationIssues2(validation2.issues)}`);
         const memSnap2 = getHostMemorySnapshot();
         return {
           ...base,
-          arch: os24.arch(),
-          cpus: os24.cpus().length,
+          arch: os25.arch(),
+          cpus: os25.cpus().length,
           totalMem: memSnap2.totalMem,
-          release: os24.release()
+          release: os25.release()
         };
       }
       const memSnap = getHostMemorySnapshot();
       return {
         ...base,
-        arch: os24.arch(),
-        cpus: os24.cpus().length,
+        arch: os25.arch(),
+        cpus: os25.cpus().length,
         totalMem: memSnap.totalMem,
         freeMem: memSnap.freeMem,
         availableMem: memSnap.availableMem,
-        loadavg: os24.loadavg(),
-        uptime: os24.uptime(),
-        release: os24.release()
+        loadavg: os25.loadavg(),
+        uptime: os25.uptime(),
+        release: os25.release()
       };
     }
     function parseMessageTime(value) {
@@ -68923,42 +69469,42 @@ ${formatManifestValidationIssues2(validation2.issues)}`);
     }
     var import_child_process7 = require("child_process");
     var import_child_process8 = require("child_process");
-    var fs20 = __toESM2(require("fs"));
-    var os25 = __toESM2(require("os"));
-    var path33 = __toESM2(require("path"));
+    var fs21 = __toESM2(require("fs"));
+    var os26 = __toESM2(require("os"));
+    var path34 = __toESM2(require("path"));
     var UPGRADE_HELPER_ENV = "ADHDEV_DAEMON_UPGRADE_HELPER";
     function getUpgradeLogPath() {
-      const home = os25.homedir();
-      const dir = path33.join(home, ".adhdev");
-      fs20.mkdirSync(dir, { recursive: true });
-      return path33.join(dir, "daemon-upgrade.log");
+      const home = os26.homedir();
+      const dir = path34.join(home, ".adhdev");
+      fs21.mkdirSync(dir, { recursive: true });
+      return path34.join(dir, "daemon-upgrade.log");
     }
     function appendUpgradeLog(message) {
       const line = `[${(/* @__PURE__ */ new Date()).toISOString()}] ${message}
 `;
       try {
-        fs20.appendFileSync(getUpgradeLogPath(), line, "utf8");
+        fs21.appendFileSync(getUpgradeLogPath(), line, "utf8");
       } catch {
       }
     }
     function resolveSiblingNpmInvocation(nodeExecutable, platform10 = process.platform) {
-      const binDir = path33.dirname(nodeExecutable);
+      const binDir = path34.dirname(nodeExecutable);
       if (platform10 === "win32") {
-        const npmCliPath = path33.join(binDir, "node_modules", "npm", "bin", "npm-cli.js");
-        if (fs20.existsSync(npmCliPath)) {
+        const npmCliPath = path34.join(binDir, "node_modules", "npm", "bin", "npm-cli.js");
+        if (fs21.existsSync(npmCliPath)) {
           return { executable: nodeExecutable, argsPrefix: [npmCliPath], execOptions: getNpmExecOptions(platform10) };
         }
         for (const candidate of ["npm.exe", "npm"]) {
-          const candidatePath = path33.join(binDir, candidate);
-          if (fs20.existsSync(candidatePath)) {
+          const candidatePath = path34.join(binDir, candidate);
+          if (fs21.existsSync(candidatePath)) {
             return { executable: candidatePath, argsPrefix: [], execOptions: getNpmExecOptions(platform10) };
           }
         }
         return { executable: nodeExecutable, argsPrefix: [npmCliPath], execOptions: getNpmExecOptions(platform10) };
       }
       for (const candidate of ["npm"]) {
-        const candidatePath = path33.join(binDir, candidate);
-        if (fs20.existsSync(candidatePath)) {
+        const candidatePath = path34.join(binDir, candidate);
+        if (fs21.existsSync(candidatePath)) {
           return { executable: candidatePath, argsPrefix: [], execOptions: getNpmExecOptions(platform10) };
         }
       }
@@ -68968,22 +69514,22 @@ ${formatManifestValidationIssues2(validation2.issues)}`);
       if (!currentCliPath) return null;
       let resolvedPath = currentCliPath;
       try {
-        resolvedPath = fs20.realpathSync.native(currentCliPath);
+        resolvedPath = fs21.realpathSync.native(currentCliPath);
       } catch {
       }
       let currentDir = resolvedPath;
       try {
-        if (fs20.statSync(resolvedPath).isFile()) {
-          currentDir = path33.dirname(resolvedPath);
+        if (fs21.statSync(resolvedPath).isFile()) {
+          currentDir = path34.dirname(resolvedPath);
         }
       } catch {
-        currentDir = path33.dirname(resolvedPath);
+        currentDir = path34.dirname(resolvedPath);
       }
       while (true) {
-        const packageJsonPath = path33.join(currentDir, "package.json");
+        const packageJsonPath = path34.join(currentDir, "package.json");
         try {
-          if (fs20.existsSync(packageJsonPath)) {
-            const parsed = JSON.parse(fs20.readFileSync(packageJsonPath, "utf8"));
+          if (fs21.existsSync(packageJsonPath)) {
+            const parsed = JSON.parse(fs21.readFileSync(packageJsonPath, "utf8"));
             if (parsed?.name === packageName) {
               const normalized = currentDir.replace(/\\/g, "/");
               return normalized.includes("/node_modules/") ? currentDir : null;
@@ -68991,7 +69537,7 @@ ${formatManifestValidationIssues2(validation2.issues)}`);
           }
         } catch {
         }
-        const parentDir = path33.dirname(currentDir);
+        const parentDir = path34.dirname(currentDir);
         if (parentDir === currentDir) {
           return null;
         }
@@ -68999,13 +69545,13 @@ ${formatManifestValidationIssues2(validation2.issues)}`);
       }
     }
     function resolveInstallPrefixFromPackageRoot(packageRoot, packageName) {
-      const nodeModulesDir = packageName.startsWith("@") ? path33.dirname(path33.dirname(packageRoot)) : path33.dirname(packageRoot);
-      if (path33.basename(nodeModulesDir) !== "node_modules") {
+      const nodeModulesDir = packageName.startsWith("@") ? path34.dirname(path34.dirname(packageRoot)) : path34.dirname(packageRoot);
+      if (path34.basename(nodeModulesDir) !== "node_modules") {
         return null;
       }
-      const maybeLibDir = path33.dirname(nodeModulesDir);
-      if (path33.basename(maybeLibDir) === "lib") {
-        return path33.dirname(maybeLibDir);
+      const maybeLibDir = path34.dirname(nodeModulesDir);
+      if (path34.basename(maybeLibDir) === "lib") {
+        return path34.dirname(maybeLibDir);
       }
       return maybeLibDir;
     }
@@ -69120,10 +69666,10 @@ ${formatManifestValidationIssues2(validation2.issues)}`);
       }
     }
     function stopSessionHostProcesses(appName) {
-      const pidFile = path33.join(os25.homedir(), ".adhdev", `${appName}-session-host.pid`);
+      const pidFile = path34.join(os26.homedir(), ".adhdev", `${appName}-session-host.pid`);
       try {
-        if (fs20.existsSync(pidFile)) {
-          const pid = Number.parseInt(fs20.readFileSync(pidFile, "utf8").trim(), 10);
+        if (fs21.existsSync(pidFile)) {
+          const pid = Number.parseInt(fs21.readFileSync(pidFile, "utf8").trim(), 10);
           if (Number.isFinite(pid) && pid !== process.pid && isManagedSessionHostPid(pid)) {
             killPid2(pid);
           }
@@ -69131,15 +69677,15 @@ ${formatManifestValidationIssues2(validation2.issues)}`);
       } catch {
       } finally {
         try {
-          fs20.unlinkSync(pidFile);
+          fs21.unlinkSync(pidFile);
         } catch {
         }
       }
     }
     function removeDaemonPidFile() {
-      const pidFile = path33.join(os25.homedir(), ".adhdev", "daemon.pid");
+      const pidFile = path34.join(os26.homedir(), ".adhdev", "daemon.pid");
       try {
-        fs20.unlinkSync(pidFile);
+        fs21.unlinkSync(pidFile);
       } catch {
       }
     }
@@ -69148,7 +69694,7 @@ ${formatManifestValidationIssues2(validation2.issues)}`);
       const npmRoot = String(execNpmCommandSync(["root", "-g", ...prefixArgs], { encoding: "utf8" }, surface)).trim();
       if (!npmRoot) return;
       const npmPrefix = surface.installPrefix || String(execNpmCommandSync(["prefix", "-g", ...prefixArgs], { encoding: "utf8" }, surface)).trim();
-      const binDir = process.platform === "win32" ? npmPrefix : path33.join(npmPrefix, "bin");
+      const binDir = process.platform === "win32" ? npmPrefix : path34.join(npmPrefix, "bin");
       const packageBaseName = pkgName.startsWith("@") ? pkgName.split("/")[1] : pkgName;
       const binNames = /* @__PURE__ */ new Set([packageBaseName]);
       if (pkgName === "@adhdev/daemon-standalone") {
@@ -69156,25 +69702,25 @@ ${formatManifestValidationIssues2(validation2.issues)}`);
       }
       if (pkgName.startsWith("@")) {
         const [scope, name] = pkgName.split("/");
-        const scopeDir = path33.join(npmRoot, scope);
-        if (!fs20.existsSync(scopeDir)) return;
-        for (const entry of fs20.readdirSync(scopeDir)) {
+        const scopeDir = path34.join(npmRoot, scope);
+        if (!fs21.existsSync(scopeDir)) return;
+        for (const entry of fs21.readdirSync(scopeDir)) {
           if (!entry.startsWith(`.${name}-`)) continue;
-          fs20.rmSync(path33.join(scopeDir, entry), { recursive: true, force: true });
-          appendUpgradeLog(`Removed stale scoped staging dir: ${path33.join(scopeDir, entry)}`);
+          fs21.rmSync(path34.join(scopeDir, entry), { recursive: true, force: true });
+          appendUpgradeLog(`Removed stale scoped staging dir: ${path34.join(scopeDir, entry)}`);
         }
       } else {
-        for (const entry of fs20.readdirSync(npmRoot)) {
+        for (const entry of fs21.readdirSync(npmRoot)) {
           if (!entry.startsWith(`.${pkgName}-`)) continue;
-          fs20.rmSync(path33.join(npmRoot, entry), { recursive: true, force: true });
-          appendUpgradeLog(`Removed stale staging dir: ${path33.join(npmRoot, entry)}`);
+          fs21.rmSync(path34.join(npmRoot, entry), { recursive: true, force: true });
+          appendUpgradeLog(`Removed stale staging dir: ${path34.join(npmRoot, entry)}`);
         }
       }
-      if (fs20.existsSync(binDir)) {
-        for (const entry of fs20.readdirSync(binDir)) {
+      if (fs21.existsSync(binDir)) {
+        for (const entry of fs21.readdirSync(binDir)) {
           if (!Array.from(binNames).some((name) => entry.startsWith(`.${name}-`))) continue;
-          fs20.rmSync(path33.join(binDir, entry), { recursive: true, force: true });
-          appendUpgradeLog(`Removed stale bin staging entry: ${path33.join(binDir, entry)}`);
+          fs21.rmSync(path34.join(binDir, entry), { recursive: true, force: true });
+          appendUpgradeLog(`Removed stale bin staging entry: ${path34.join(binDir, entry)}`);
         }
       }
     }
@@ -69260,7 +69806,7 @@ ${formatManifestValidationIssues2(validation2.issues)}`);
     init_mesh_work_queue();
     var import_os3 = require("os");
     var import_path10 = require("path");
-    var fs21 = __toESM2(require("fs"));
+    var fs222 = __toESM2(require("fs"));
     var import_node_child_process5 = require("child_process");
     var CHANNEL_NPM_TAG = { stable: "latest", preview: "next" };
     var CHANNEL_SERVER_URL = {
@@ -69387,12 +69933,12 @@ ${formatManifestValidationIssues2(validation2.issues)}`);
       if (!Array.isArray(value)) return void 0;
       const submodules = value.map((entry) => {
         const submodule = readObjectRecord(entry);
-        const path39 = readStringValue(submodule.path);
+        const path40 = readStringValue(submodule.path);
         const commit = readStringValue(submodule.commit);
-        const repoPath = readStringValue(submodule.repoPath, submodule.repo_root) ?? joinRepoPath(parentRepoRoot, path39);
-        if (!path39 || !commit || !repoPath) return null;
+        const repoPath = readStringValue(submodule.repoPath, submodule.repo_root) ?? joinRepoPath(parentRepoRoot, path40);
+        if (!path40 || !commit || !repoPath) return null;
         return {
-          path: path39,
+          path: path40,
           commit,
           repoPath,
           dirty: readBooleanValue(submodule.dirty) ?? false,
@@ -70034,7 +70580,7 @@ ${formatManifestValidationIssues2(validation2.issues)}`);
           if (!isSelfNode && daemonId) unavailableNodeIds.push(nodeId);
           continue;
         }
-        if (fs21.existsSync(workspace)) {
+        if (fs222.existsSync(workspace)) {
           try {
             const localGit = await getGitRepoStatus(workspace, { timeoutMs: 1e4, refreshUpstream: true });
             if (localGit?.isGitRepo) {
@@ -70119,7 +70665,7 @@ ${formatManifestValidationIssues2(validation2.issues)}`);
     }
     function collectLiveMeshSessionRecords(args) {
       const nodeWorkspace = readStringValue(args.node?.workspace);
-      const nodeIsMissingLocalWorktree = args.node?.isLocalWorktree === true && !!nodeWorkspace && !fs21.existsSync(nodeWorkspace);
+      const nodeIsMissingLocalWorktree = args.node?.isLocalWorktree === true && !!nodeWorkspace && !fs222.existsSync(nodeWorkspace);
       const matches = args.liveSessionRecords.filter((record2) => {
         const recordNodeId = readStringValue(record2?.meta?.meshNodeId);
         if (recordNodeId && recordNodeId !== args.nodeId) return false;
@@ -70146,7 +70692,7 @@ ${formatManifestValidationIssues2(validation2.issues)}`);
         const workspace = readStringValue(node?.workspace);
         if (nodeId) liveNodeIds.add(nodeId);
         if (workspace) liveWorkspaces.add(workspace);
-        if (nodeId && node?.isLocalWorktree === true && workspace && !fs21.existsSync(workspace)) {
+        if (nodeId && node?.isLocalWorktree === true && workspace && !fs222.existsSync(workspace)) {
           missingLocalWorktreeNodeIds.add(nodeId);
         }
       }
@@ -70345,10 +70891,10 @@ ${e?.stderr || ""}`
     }
     function buildPatchEquivalenceSubmoduleConflictHint(repoRoot, baseHead, branchHead, output) {
       if (!/(submodule|160000)/i.test(output) || !/(conflict|failed to merge)/i.test(output)) return void 0;
-      const conflicts = readChangedGitlinkPaths(repoRoot, baseHead, branchHead).map((path39) => ({
-        path: path39,
-        baseCommit: readTreeObject(repoRoot, baseHead, path39),
-        branchCommit: readTreeObject(repoRoot, branchHead, path39)
+      const conflicts = readChangedGitlinkPaths(repoRoot, baseHead, branchHead).map((path40) => ({
+        path: path40,
+        baseCommit: readTreeObject(repoRoot, baseHead, path40),
+        branchCommit: readTreeObject(repoRoot, branchHead, path40)
       }));
       if (conflicts.length === 0) return void 0;
       return {
@@ -70374,11 +70920,11 @@ ${e?.stderr || ""}`
           if (!line.trim()) continue;
           const metaAndPath = line.split("	");
           const meta3 = metaAndPath[0] || "";
-          const path39 = metaAndPath[metaAndPath.length - 1]?.trim();
-          if (!path39) continue;
+          const path40 = metaAndPath[metaAndPath.length - 1]?.trim();
+          if (!path40) continue;
           const parts = meta3.split(/\s+/);
           if (parts[0]?.includes("160000") || parts[1]?.includes("160000")) {
-            paths.add(path39);
+            paths.add(path40);
           }
         }
         return [...paths].sort();
@@ -70386,9 +70932,9 @@ ${e?.stderr || ""}`
         return [];
       }
     }
-    function readTreeObject(repoRoot, ref, path39) {
+    function readTreeObject(repoRoot, ref, path40) {
       try {
-        const output = (0, import_node_child_process5.execFileSync)("git", ["ls-tree", ref, "--", path39], {
+        const output = (0, import_node_child_process5.execFileSync)("git", ["ls-tree", ref, "--", path40], {
           cwd: repoRoot,
           encoding: "utf8",
           maxBuffer: 1024 * 1024
@@ -70401,7 +70947,7 @@ ${e?.stderr || ""}`
     }
     async function alignRefinerySubmodulesAfterMerge(repoRoot, previousBaseHead, currentHead, options = {}) {
       const startedAt = Date.now();
-      const changedGitlinkPaths = readChangedGitlinkPaths(repoRoot, previousBaseHead, currentHead).filter((path39) => !(options.submoduleIgnorePaths || []).includes(path39));
+      const changedGitlinkPaths = readChangedGitlinkPaths(repoRoot, previousBaseHead, currentHead).filter((path40) => !(options.submoduleIgnorePaths || []).includes(path40));
       const preStatus = await getGitRepoStatus(repoRoot, {
         includeSubmodules: true,
         submoduleIgnorePaths: options.submoduleIgnorePaths,
@@ -70442,7 +70988,7 @@ ${e?.stderr || ""}`
           changedGitlinkPaths,
           outOfSyncPaths,
           updatedPaths: updatePaths,
-          verifiedPaths: updatePaths.filter((path39) => !remaining.some((submodule) => submodule.path === path39)),
+          verifiedPaths: updatePaths.filter((path40) => !remaining.some((submodule) => submodule.path === path40)),
           durationMs: Date.now() - startedAt,
           command: `git ${commandArgs.join(" ")}`,
           stdout: truncateValidationOutput(result.stdout),
@@ -70497,7 +71043,7 @@ ${e?.stderr || ""}`
           return { stdout: String(stdout || ""), stderr: String(stderr || ""), refspec };
         };
         const importCommitFromWorktreeSubmodule = async (submodulePath, worktreeSubmodulePath, commit) => {
-          if (!fs21.existsSync(worktreeSubmodulePath)) return false;
+          if (!fs222.existsSync(worktreeSubmodulePath)) return false;
           try {
             await runGit3(worktreeSubmodulePath, ["cat-file", "-e", `${commit}^{commit}`]);
           } catch {
@@ -70520,7 +71066,7 @@ ${e?.stderr || ""}`
             reachable: false
           };
           try {
-            if (!fs21.existsSync(submodulePath)) {
+            if (!fs222.existsSync(submodulePath)) {
               entry.error = `Submodule checkout missing at ${gitlink.path}`;
               entry.publishRequired = true;
               if (options.allowAutoPublishSubmoduleMainCommits === true) {
@@ -70712,9 +71258,9 @@ ${e?.stderr || ""}`
         return ["npm", "pnpm", "yarn", "bun"].includes(command) && candidate.args.some((arg) => arg === "run" || arg === "test" || arg === "exec");
       };
       const dependenciesLikelyMissing = (cwd) => {
-        if (!fs21.existsSync((0, import_path10.join)(cwd, "package.json"))) return false;
-        if (fs21.existsSync((0, import_path10.join)(cwd, "node_modules"))) return false;
-        return ["package-lock.json", "npm-shrinkwrap.json", "pnpm-lock.yaml", "yarn.lock", "bun.lockb", "bun.lock"].some((lock) => fs21.existsSync((0, import_path10.join)(cwd, lock)));
+        if (!fs222.existsSync((0, import_path10.join)(cwd, "package.json"))) return false;
+        if (fs222.existsSync((0, import_path10.join)(cwd, "node_modules"))) return false;
+        return ["package-lock.json", "npm-shrinkwrap.json", "pnpm-lock.yaml", "yarn.lock", "bun.lockb", "bun.lock"].some((lock) => fs222.existsSync((0, import_path10.join)(cwd, lock)));
       };
       for (const candidate of selection.bootstrapCommands) {
         const startedAt = Date.now();
@@ -70811,9 +71357,9 @@ ${e?.stderr || ""}`
     function loadHermesCoordinatorBaseConfig(targetConfigPath) {
       const sourceHome = resolveHermesUserHome();
       const sourceConfigPath = (0, import_path10.join)(sourceHome, "config.yaml");
-      if (!fs21.existsSync(sourceConfigPath)) return { config: {}, sourceHome, sourceConfigPath };
+      if (!fs222.existsSync(sourceConfigPath)) return { config: {}, sourceHome, sourceConfigPath };
       if ((0, import_path10.resolve)(sourceConfigPath) === (0, import_path10.resolve)(targetConfigPath)) return { config: {}, sourceHome, sourceConfigPath };
-      const parsed = parseMeshCoordinatorMcpConfig(fs21.readFileSync(sourceConfigPath, "utf-8"), "hermes_config_yaml");
+      const parsed = parseMeshCoordinatorMcpConfig(fs222.readFileSync(sourceConfigPath, "utf-8"), "hermes_config_yaml");
       const { mcp_servers: _mcpServers, ...baseConfig } = parsed;
       return { config: baseConfig, sourceHome, sourceConfigPath };
     }
@@ -70850,9 +71396,9 @@ ${e?.stderr || ""}`
       for (const fileName of [".env", "auth.json"]) {
         const sourcePath = (0, import_path10.join)(sourceHome, fileName);
         const targetPath = (0, import_path10.join)(targetHome, fileName);
-        if (!fs21.existsSync(sourcePath)) continue;
+        if (!fs222.existsSync(sourcePath)) continue;
         try {
-          fs21.copyFileSync(sourcePath, targetPath);
+          fs222.copyFileSync(sourcePath, targetPath);
         } catch (error48) {
           LOG2.warn("MeshCoordinator", `Could not copy Hermes ${fileName} into isolated coordinator home: ${error48?.message || error48}`);
         }
@@ -71207,13 +71753,13 @@ ${e?.stderr || ""}`
             recoveryHint: "Inspect the mesh node record before removing it, or remove stale metadata manually only after confirming no managed worktree remains."
           };
         }
-        const worktreeExists = fs21.existsSync(workspace);
+        const worktreeExists = fs222.existsSync(workspace);
         const sourceNode = args.node?.clonedFromNodeId ? args.mesh?.nodes?.find((n) => n.id === args.node.clonedFromNodeId || n.nodeId === args.node.clonedFromNodeId) : args.mesh?.nodes?.find((n) => !n.isLocalWorktree);
         const repoRoot = typeof sourceNode?.repoRoot === "string" && sourceNode.repoRoot.trim() ? sourceNode.repoRoot.trim() : typeof sourceNode?.workspace === "string" && sourceNode.workspace.trim() ? sourceNode.workspace.trim() : "";
         if (!worktreeExists) {
           return { success: true, skipped: true, removedPath: workspace, repoRoot: repoRoot || void 0, reason: "worktree_path_missing" };
         }
-        if (!repoRoot || !fs21.existsSync(repoRoot)) {
+        if (!repoRoot || !fs222.existsSync(repoRoot)) {
           return {
             success: false,
             code: "mesh_worktree_cleanup_missing_source_repo",
@@ -71233,7 +71779,7 @@ ${e?.stderr || ""}`
         const normalizePath = (value) => {
           const resolved = (0, import_path10.resolve)(value);
           try {
-            return fs21.realpathSync(resolved);
+            return fs222.realpathSync(resolved);
           } catch {
             return resolved;
           }
@@ -72172,8 +72718,8 @@ ${e?.stderr || ""}`
               if (sinceTs > 0) {
                 return { success: true, logs: [], totalBuffered: 0 };
               }
-              if (fs21.existsSync(LOG_PATH)) {
-                const content = fs21.readFileSync(LOG_PATH, "utf-8");
+              if (fs222.existsSync(LOG_PATH)) {
+                const content = fs222.readFileSync(LOG_PATH, "utf-8");
                 const allLines = content.split("\n");
                 const recent = allLines.slice(-count).join("\n");
                 return { success: true, logs: recent, totalLines: allLines.length };
@@ -72563,24 +73109,24 @@ ${e?.stderr || ""}`
           //    Settings page in the dashboard reads/writes via these two
           //    commands instead of going through fs from the browser.
           case "list_coordinator_prompts": {
-            const fs27 = await import("fs");
-            const path39 = await import("path");
-            const os28 = await import("os");
-            const dir = path39.join(os28.homedir(), ".adhdev", "coordinator-prompts");
+            const fs28 = await import("fs");
+            const path40 = await import("path");
+            const os29 = await import("os");
+            const dir = path40.join(os29.homedir(), ".adhdev", "coordinator-prompts");
             const entries = {};
             try {
-              if (fs27.existsSync(dir)) {
-                for (const name of fs27.readdirSync(dir)) {
+              if (fs28.existsSync(dir)) {
+                for (const name of fs28.readdirSync(dir)) {
                   const matchOverride = name.match(/^([a-zA-Z0-9_.-]+)\.md$/);
                   const matchAppend = name.match(/^([a-zA-Z0-9_.-]+)\.append\.md$/);
                   const m = matchAppend || matchOverride;
                   if (!m) continue;
                   const isAppend = !!matchAppend;
                   const key = m[1];
-                  const full = path39.join(dir, name);
+                  const full = path40.join(dir, name);
                   let content = "";
                   try {
-                    content = fs27.readFileSync(full, "utf8");
+                    content = fs28.readFileSync(full, "utf8");
                   } catch {
                   }
                   if (!entries[key]) entries[key] = { override: "", append: "" };
@@ -72594,24 +73140,24 @@ ${e?.stderr || ""}`
             return { success: true, dir, entries };
           }
           case "write_coordinator_prompt": {
-            const fs27 = await import("fs");
-            const path39 = await import("path");
-            const os28 = await import("os");
+            const fs28 = await import("fs");
+            const path40 = await import("path");
+            const os29 = await import("os");
             const key = typeof args?.key === "string" ? args.key.trim() : "";
             const kind = args?.kind === "append" ? "append" : "override";
             const content = typeof args?.content === "string" ? args.content : "";
             if (!key || !/^[a-zA-Z0-9_.-]+$/.test(key)) {
               return { success: false, error: "key must match [a-zA-Z0-9_.-]+" };
             }
-            const dir = path39.join(os28.homedir(), ".adhdev", "coordinator-prompts");
+            const dir = path40.join(os29.homedir(), ".adhdev", "coordinator-prompts");
             const filename = kind === "append" ? `${key}.append.md` : `${key}.md`;
-            const full = path39.join(dir, filename);
+            const full = path40.join(dir, filename);
             try {
-              fs27.mkdirSync(dir, { recursive: true });
+              fs28.mkdirSync(dir, { recursive: true });
               if (content.trim()) {
-                fs27.writeFileSync(full, content, { encoding: "utf8", mode: 384 });
-              } else if (fs27.existsSync(full)) {
-                fs27.unlinkSync(full);
+                fs28.writeFileSync(full, content, { encoding: "utf8", mode: 384 });
+              } else if (fs28.existsSync(full)) {
+                fs28.unlinkSync(full);
               }
               return { success: true, path: full, kind, key };
             } catch (error48) {
@@ -73820,7 +74366,7 @@ ${ptyResult.output.slice(-2e3)}`);
                   workspace
                 };
               }
-              const { existsSync: existsSync38, readFileSync: readFileSync32, writeFileSync: writeFileSync19, copyFileSync: copyFileSync4, mkdirSync: mkdirSync18 } = await import("fs");
+              const { existsSync: existsSync39, readFileSync: readFileSync33, writeFileSync: writeFileSync20, copyFileSync: copyFileSync4, mkdirSync: mkdirSync19 } = await import("fs");
               const { dirname: dirname11 } = await import("path");
               const mcpConfigPath = coordinatorSetup.configPath;
               const hermesManualFallback = cliType === "hermes-cli" && configFormat === "hermes_config_yaml" ? createHermesManualMeshCoordinatorSetup(meshId, workspace) : null;
@@ -73856,21 +74402,21 @@ ${ptyResult.output.slice(-2e3)}`);
                 };
               }
               try {
-                mkdirSync18(dirname11(mcpConfigPath), { recursive: true });
+                mkdirSync19(dirname11(mcpConfigPath), { recursive: true });
               } catch (error48) {
                 const message = `Could not prepare MCP config path for automatic setup: ${error48?.message || error48}`;
                 LOG2.error("MeshCoordinator", message);
                 if (hermesManualFallback) return returnManualFallback(message);
                 return { success: false, code: "mesh_coordinator_config_write_failed", error: message, meshId, cliType, workspace };
               }
-              const hadExistingMcpConfig = existsSync38(mcpConfigPath);
+              const hadExistingMcpConfig = existsSync39(mcpConfigPath);
               let existingMcpConfig = hermesBaseConfig?.config || {};
               if (hermesBaseConfig) {
                 copyHermesCoordinatorCredentialFiles(hermesBaseConfig.sourceHome, dirname11(mcpConfigPath));
               }
               if (hadExistingMcpConfig) {
                 try {
-                  const parsedExistingMcpConfig = parseMeshCoordinatorMcpConfig(readFileSync32(mcpConfigPath, "utf-8"), configFormat);
+                  const parsedExistingMcpConfig = parseMeshCoordinatorMcpConfig(readFileSync33(mcpConfigPath, "utf-8"), configFormat);
                   const existingCoordinatorConfig = hermesManualFallback ? stripHermesCoordinatorTempModelProviderOverrides(parsedExistingMcpConfig) : parsedExistingMcpConfig;
                   existingMcpConfig = { ...existingMcpConfig, ...existingCoordinatorConfig };
                   copyFileSync4(mcpConfigPath, mcpConfigPath + ".backup");
@@ -73893,7 +74439,7 @@ ${ptyResult.output.slice(-2e3)}`);
                 }
               };
               try {
-                writeFileSync19(mcpConfigPath, serializeMeshCoordinatorMcpConfig(mcpConfig, configFormat), "utf-8");
+                writeFileSync20(mcpConfigPath, serializeMeshCoordinatorMcpConfig(mcpConfig, configFormat), "utf-8");
               } catch (error48) {
                 const message = `Could not write MCP config for automatic setup: ${error48?.message || error48}`;
                 LOG2.error("MeshCoordinator", message);
@@ -74172,7 +74718,7 @@ ${ptyResult.output.slice(-2e3)}`);
                   }
                 }
                 if (workspace) {
-                  if (!fs21.existsSync(workspace)) {
+                  if (!fs222.existsSync(workspace)) {
                     const inlineTransitGit = buildInlineMeshTransitGitStatus(node);
                     let remoteProbeApplied = false;
                     if (inlineTransitGit) {
@@ -74285,7 +74831,7 @@ ${ptyResult.output.slice(-2e3)}`);
               const callerCoordinatorDaemonId = typeof args?.coordinatorDaemonId === "string" && args.coordinatorDaemonId.trim() ? args.coordinatorDaemonId.trim() : this.deps.statusInstanceId || void 0;
               const pendingCoordinatorEvents = drainPendingMeshCoordinatorEvents(meshId, callerCoordinatorDaemonId);
               const previewFreshness = (() => {
-                const localRepoRoot = nodeStatuses.map((node) => readStringValue(node?.git?.repoRoot, node?.repoRoot, node?.workspace)).find((candidate) => !!candidate && fs21.existsSync(candidate));
+                const localRepoRoot = nodeStatuses.map((node) => readStringValue(node?.git?.repoRoot, node?.repoRoot, node?.workspace)).find((candidate) => !!candidate && fs222.existsSync(candidate));
                 return localRepoRoot ? buildPreviewFreshness(localRepoRoot) : void 0;
               })();
               const asyncRefineJobs = buildMeshAsyncRefineJobs({
@@ -76010,12 +76556,12 @@ ${ptyResult.output.slice(-2e3)}`);
         this.eventListeners = [];
       }
     };
-    var fs222 = __toESM2(require("fs"));
-    var path34 = __toESM2(require("path"));
-    var os26 = __toESM2(require("os"));
+    var fs23 = __toESM2(require("fs"));
+    var path35 = __toESM2(require("path"));
+    var os27 = __toESM2(require("os"));
     var import_os4 = require("os");
     var import_child_process9 = require("child_process");
-    var ARCHIVE_PATH = path34.join(os26.homedir(), ".adhdev", "version-history.json");
+    var ARCHIVE_PATH = path35.join(os27.homedir(), ".adhdev", "version-history.json");
     var MAX_ENTRIES_PER_PROVIDER = 20;
     var VersionArchive = class {
       history = {};
@@ -76024,8 +76570,8 @@ ${ptyResult.output.slice(-2e3)}`);
       }
       load() {
         try {
-          if (fs222.existsSync(ARCHIVE_PATH)) {
-            this.history = JSON.parse(fs222.readFileSync(ARCHIVE_PATH, "utf-8"));
+          if (fs23.existsSync(ARCHIVE_PATH)) {
+            this.history = JSON.parse(fs23.readFileSync(ARCHIVE_PATH, "utf-8"));
           }
         } catch {
           this.history = {};
@@ -76062,8 +76608,8 @@ ${ptyResult.output.slice(-2e3)}`);
       }
       save() {
         try {
-          fs222.mkdirSync(path34.dirname(ARCHIVE_PATH), { recursive: true });
-          fs222.writeFileSync(ARCHIVE_PATH, JSON.stringify(this.history, null, 2));
+          fs23.mkdirSync(path35.dirname(ARCHIVE_PATH), { recursive: true });
+          fs23.writeFileSync(ARCHIVE_PATH, JSON.stringify(this.history, null, 2));
         } catch {
         }
       }
@@ -76086,10 +76632,10 @@ ${ptyResult.output.slice(-2e3)}`);
       for (const p of paths) {
         if (!p) continue;
         for (const ext of exes) {
-          const fullPath = path34.join(p, name + ext);
+          const fullPath = path35.join(p, name + ext);
           try {
-            if (fs222.existsSync(fullPath)) {
-              const stat2 = fs222.statSync(fullPath);
+            if (fs23.existsSync(fullPath)) {
+              const stat2 = fs23.statSync(fullPath);
               if (stat2.isFile() && (isWin || stat2.mode & 73)) {
                 return fullPath;
               }
@@ -76134,19 +76680,19 @@ ${ptyResult.output.slice(-2e3)}`);
     function checkPathExists2(paths) {
       for (const p of paths) {
         if (p.includes("*")) {
-          const home = os26.homedir();
-          const resolved = p.replace(/\*/g, home.split(path34.sep).pop() || "");
-          if (fs222.existsSync(resolved)) return resolved;
+          const home = os27.homedir();
+          const resolved = p.replace(/\*/g, home.split(path35.sep).pop() || "");
+          if (fs23.existsSync(resolved)) return resolved;
         } else {
-          if (fs222.existsSync(p)) return p;
+          if (fs23.existsSync(p)) return p;
         }
       }
       return null;
     }
     async function getMacAppVersion(appPath) {
       if ((0, import_os4.platform)() !== "darwin" || !appPath.endsWith(".app")) return null;
-      const plistPath = path34.join(appPath, "Contents", "Info.plist");
-      if (!fs222.existsSync(plistPath)) return null;
+      const plistPath = path35.join(appPath, "Contents", "Info.plist");
+      if (!fs23.existsSync(plistPath)) return null;
       const raw = await runCommand(`/usr/libexec/PlistBuddy -c "Print CFBundleShortVersionString" "${plistPath}"`);
       return raw || null;
     }
@@ -76171,8 +76717,8 @@ ${ptyResult.output.slice(-2e3)}`);
           const cliBin = provider.cli ? findBinary2(provider.cli) : null;
           let resolvedBin = cliBin;
           if (!resolvedBin && appPath && currentOs === "darwin") {
-            const bundled = path34.join(appPath, "Contents", "Resources", "app", "bin", provider.cli || "");
-            if (provider.cli && fs222.existsSync(bundled)) resolvedBin = bundled;
+            const bundled = path35.join(appPath, "Contents", "Resources", "app", "bin", provider.cli || "");
+            if (provider.cli && fs23.existsSync(bundled)) resolvedBin = bundled;
           }
           info.installed = !!(appPath || resolvedBin);
           info.path = appPath || null;
@@ -76209,8 +76755,8 @@ ${ptyResult.output.slice(-2e3)}`);
       return results;
     }
     var http2 = __toESM2(require("http"));
-    var fs26 = __toESM2(require("fs"));
-    var path38 = __toESM2(require("path"));
+    var fs27 = __toESM2(require("fs"));
+    var path39 = __toESM2(require("path"));
     init_config();
     function generateFiles(type, name, category, opts = {}) {
       const { cdpPorts, cli, processName, installPath, binary, extensionId, version: version2 = "0.1" } = opts;
@@ -76554,8 +77100,8 @@ async (params) => {
       };
     }
     init_logger();
-    var fs23 = __toESM2(require("fs"));
-    var path35 = __toESM2(require("path"));
+    var fs24 = __toESM2(require("fs"));
+    var path36 = __toESM2(require("path"));
     init_logger();
     async function handleCdpEvaluate(ctx, req, res) {
       const body = await ctx.readBody(req);
@@ -76734,18 +77280,18 @@ async (params) => {
         return;
       }
       let scriptsPath = "";
-      const directScripts = path35.join(dir, "scripts.js");
-      if (fs23.existsSync(directScripts)) {
+      const directScripts = path36.join(dir, "scripts.js");
+      if (fs24.existsSync(directScripts)) {
         scriptsPath = directScripts;
       } else {
-        const scriptsDir = path35.join(dir, "scripts");
-        if (fs23.existsSync(scriptsDir)) {
-          const versions = fs23.readdirSync(scriptsDir).filter((d) => {
-            return fs23.statSync(path35.join(scriptsDir, d)).isDirectory();
+        const scriptsDir = path36.join(dir, "scripts");
+        if (fs24.existsSync(scriptsDir)) {
+          const versions = fs24.readdirSync(scriptsDir).filter((d) => {
+            return fs24.statSync(path36.join(scriptsDir, d)).isDirectory();
           }).sort().reverse();
           for (const ver of versions) {
-            const p = path35.join(scriptsDir, ver, "scripts.js");
-            if (fs23.existsSync(p)) {
+            const p = path36.join(scriptsDir, ver, "scripts.js");
+            if (fs24.existsSync(p)) {
               scriptsPath = p;
               break;
             }
@@ -76757,7 +77303,7 @@ async (params) => {
         return;
       }
       try {
-        const source = fs23.readFileSync(scriptsPath, "utf-8");
+        const source = fs24.readFileSync(scriptsPath, "utf-8");
         const hints = {};
         const funcRegex = /module\.exports\.(\w+)\s*=\s*function\s+\w+\s*\(params\)/g;
         let match;
@@ -77570,8 +78116,8 @@ async (params) => {
         ctx.json(res, 500, { error: `DOM context collection failed: ${e.message}` });
       }
     }
-    var fs24 = __toESM2(require("fs"));
-    var path36 = __toESM2(require("path"));
+    var fs25 = __toESM2(require("fs"));
+    var path37 = __toESM2(require("path"));
     function slugifyFixtureName(value) {
       const normalized = String(value || "").trim().toLowerCase().replace(/[^a-z0-9._-]+/g, "-").replace(/^-+|-+$/g, "");
       return normalized || `fixture-${Date.now()}`;
@@ -77581,15 +78127,15 @@ async (params) => {
       if (!providerDir) {
         throw new Error(`Provider directory not found for '${type}'`);
       }
-      return path36.join(providerDir, "fixtures");
+      return path37.join(providerDir, "fixtures");
     }
     function readCliFixture(ctx, type, name) {
       const fixtureDir = getCliFixtureDir(ctx, type);
-      const filePath = path36.join(fixtureDir, `${name}.json`);
-      if (!fs24.existsSync(filePath)) {
+      const filePath = path37.join(fixtureDir, `${name}.json`);
+      if (!fs25.existsSync(filePath)) {
         throw new Error(`Fixture not found: ${filePath}`);
       }
-      return JSON.parse(fs24.readFileSync(filePath, "utf-8"));
+      return JSON.parse(fs25.readFileSync(filePath, "utf-8"));
     }
     function getExerciseTranscriptText(result) {
       const parts = [];
@@ -78334,7 +78880,7 @@ async (params) => {
           return;
         }
         const fixtureDir = getCliFixtureDir(ctx, type);
-        fs24.mkdirSync(fixtureDir, { recursive: true });
+        fs25.mkdirSync(fixtureDir, { recursive: true });
         const name = slugifyFixtureName(String(body?.name || `${type}-${Date.now()}`));
         const result = await runCliExerciseInternal(ctx, { ...request, type });
         const fixture = {
@@ -78361,8 +78907,8 @@ async (params) => {
           },
           notes: typeof body?.notes === "string" ? body.notes : void 0
         };
-        const filePath = path36.join(fixtureDir, `${name}.json`);
-        fs24.writeFileSync(filePath, JSON.stringify(fixture, null, 2));
+        const filePath = path37.join(fixtureDir, `${name}.json`);
+        fs25.writeFileSync(filePath, JSON.stringify(fixture, null, 2));
         ctx.json(res, 200, {
           saved: true,
           name,
@@ -78380,14 +78926,14 @@ async (params) => {
     async function handleCliFixtureList(ctx, type, _req, res) {
       try {
         const fixtureDir = getCliFixtureDir(ctx, type);
-        if (!fs24.existsSync(fixtureDir)) {
+        if (!fs25.existsSync(fixtureDir)) {
           ctx.json(res, 200, { fixtures: [], count: 0 });
           return;
         }
-        const fixtures = fs24.readdirSync(fixtureDir).filter((file2) => file2.endsWith(".json")).sort((a, b) => b.localeCompare(a, void 0, { numeric: true, sensitivity: "base" })).map((file2) => {
-          const fullPath = path36.join(fixtureDir, file2);
+        const fixtures = fs25.readdirSync(fixtureDir).filter((file2) => file2.endsWith(".json")).sort((a, b) => b.localeCompare(a, void 0, { numeric: true, sensitivity: "base" })).map((file2) => {
+          const fullPath = path37.join(fixtureDir, file2);
           try {
-            const raw = JSON.parse(fs24.readFileSync(fullPath, "utf-8"));
+            const raw = JSON.parse(fs25.readFileSync(fullPath, "utf-8"));
             return {
               name: raw.name || file2.replace(/\.json$/i, ""),
               path: fullPath,
@@ -78518,9 +79064,9 @@ async (params) => {
         ctx.json(res, 500, { error: `Raw send failed: ${e.message}` });
       }
     }
-    var fs25 = __toESM2(require("fs"));
-    var path37 = __toESM2(require("path"));
-    var os27 = __toESM2(require("os"));
+    var fs26 = __toESM2(require("fs"));
+    var path38 = __toESM2(require("path"));
+    var os28 = __toESM2(require("os"));
     function getAutoImplPid(ctx) {
       const pid = ctx.autoImplProcess?.pid;
       return typeof pid === "number" && pid > 0 ? pid : null;
@@ -78566,38 +79112,38 @@ async (params) => {
       return fallback?.type || null;
     }
     function getLatestScriptVersionDir(scriptsDir) {
-      if (!fs25.existsSync(scriptsDir)) return null;
-      const versions = fs25.readdirSync(scriptsDir).filter((d) => {
+      if (!fs26.existsSync(scriptsDir)) return null;
+      const versions = fs26.readdirSync(scriptsDir).filter((d) => {
         try {
-          return fs25.statSync(path37.join(scriptsDir, d)).isDirectory();
+          return fs26.statSync(path38.join(scriptsDir, d)).isDirectory();
         } catch {
           return false;
         }
       }).sort((a, b) => b.localeCompare(a, void 0, { numeric: true, sensitivity: "base" }));
       if (versions.length === 0) return null;
-      return path37.join(scriptsDir, versions[0]);
+      return path38.join(scriptsDir, versions[0]);
     }
     function resolveAutoImplWritableProviderDir(ctx, category, type, requestedDir) {
-      const canonicalUserDir = path37.resolve(ctx.providerLoader.getUserProviderDir(category, type));
-      const desiredDir = requestedDir ? path37.resolve(requestedDir) : canonicalUserDir;
-      const upstreamRoot = path37.resolve(ctx.providerLoader.getUpstreamDir());
-      if (desiredDir === upstreamRoot || desiredDir.startsWith(`${upstreamRoot}${path37.sep}`)) {
+      const canonicalUserDir = path38.resolve(ctx.providerLoader.getUserProviderDir(category, type));
+      const desiredDir = requestedDir ? path38.resolve(requestedDir) : canonicalUserDir;
+      const upstreamRoot = path38.resolve(ctx.providerLoader.getUpstreamDir());
+      if (desiredDir === upstreamRoot || desiredDir.startsWith(`${upstreamRoot}${path38.sep}`)) {
         return { dir: null, reason: `Refusing to write into upstream provider directory: ${desiredDir}` };
       }
-      if (path37.basename(desiredDir) !== type) {
+      if (path38.basename(desiredDir) !== type) {
         return { dir: null, reason: `Requested writable provider directory must end with '${type}': ${desiredDir}` };
       }
       const sourceDir = ctx.findProviderDir(type);
       if (!sourceDir) {
         return { dir: null, reason: `Provider source directory not found for '${type}'` };
       }
-      if (!fs25.existsSync(desiredDir)) {
-        fs25.mkdirSync(path37.dirname(desiredDir), { recursive: true });
-        fs25.cpSync(sourceDir, desiredDir, { recursive: true });
+      if (!fs26.existsSync(desiredDir)) {
+        fs26.mkdirSync(path38.dirname(desiredDir), { recursive: true });
+        fs26.cpSync(sourceDir, desiredDir, { recursive: true });
         ctx.log(`Auto-implement writable copy created: ${desiredDir}`);
       }
-      const providerJson = path37.join(desiredDir, "provider.json");
-      if (!fs25.existsSync(providerJson)) {
+      const providerJson = path38.join(desiredDir, "provider.json");
+      if (!fs26.existsSync(providerJson)) {
         return { dir: null, reason: `provider.json not found in writable provider directory: ${desiredDir}` };
       }
       return { dir: desiredDir };
@@ -78605,15 +79151,15 @@ async (params) => {
     function loadAutoImplReferenceScripts(ctx, referenceType) {
       if (!referenceType) return {};
       const refDir = ctx.findProviderDir(referenceType);
-      if (!refDir || !fs25.existsSync(refDir)) return {};
+      if (!refDir || !fs26.existsSync(refDir)) return {};
       const referenceScripts = {};
-      const scriptsDir = path37.join(refDir, "scripts");
+      const scriptsDir = path38.join(refDir, "scripts");
       const latestDir = getLatestScriptVersionDir(scriptsDir);
       if (!latestDir) return referenceScripts;
-      for (const file2 of fs25.readdirSync(latestDir)) {
+      for (const file2 of fs26.readdirSync(latestDir)) {
         if (!file2.endsWith(".js")) continue;
         try {
-          referenceScripts[file2] = fs25.readFileSync(path37.join(latestDir, file2), "utf-8");
+          referenceScripts[file2] = fs26.readFileSync(path38.join(latestDir, file2), "utf-8");
         } catch {
         }
       }
@@ -78721,16 +79267,16 @@ async (params) => {
         });
         const referenceScripts = loadAutoImplReferenceScripts(ctx, resolvedReference);
         const prompt = buildAutoImplPrompt(ctx, type, provider, providerDir, functions, domContext, referenceScripts, comment, resolvedReference, verification);
-        const tmpDir = path37.join(os27.tmpdir(), "adhdev-autoimpl");
-        if (!fs25.existsSync(tmpDir)) fs25.mkdirSync(tmpDir, { recursive: true });
-        const promptFile = path37.join(tmpDir, `prompt-${type}-${Date.now()}.md`);
-        fs25.writeFileSync(promptFile, prompt, "utf-8");
+        const tmpDir = path38.join(os28.tmpdir(), "adhdev-autoimpl");
+        if (!fs26.existsSync(tmpDir)) fs26.mkdirSync(tmpDir, { recursive: true });
+        const promptFile = path38.join(tmpDir, `prompt-${type}-${Date.now()}.md`);
+        fs26.writeFileSync(promptFile, prompt, "utf-8");
         ctx.log(`Auto-implement prompt written to ${promptFile} (${prompt.length} chars)`);
         const agentProvider = ctx.providerLoader.resolve(agent) || ctx.providerLoader.getMeta(agent);
         const spawn4 = agentProvider?.spawn;
         if (!spawn4?.command) {
           try {
-            fs25.unlinkSync(promptFile);
+            fs26.unlinkSync(promptFile);
           } catch {
           }
           ctx.json(res, 400, { error: `Agent '${agent}' has no spawn config. Select a CLI provider with a spawn configuration.` });
@@ -78832,7 +79378,7 @@ async (params) => {
             } catch {
             }
             try {
-              fs25.unlinkSync(promptFile);
+              fs26.unlinkSync(promptFile);
             } catch {
             }
             ctx.log(`Auto-implement (ACP) ${success2 ? "completed" : "failed"}: ${type} (exit: ${code})`);
@@ -78876,7 +79422,7 @@ async (params) => {
         const interactiveFlags = ["--yolo", "--interactive", "-i"];
         const baseArgs = [...spawn4.args || []].filter((a) => !interactiveFlags.includes(a));
         let shellCmd;
-        const isWin = os27.platform() === "win32";
+        const isWin = os28.platform() === "win32";
         const escapeArg = (a) => isWin ? `"${a.replace(/"/g, '""')}"` : `'${a.replace(/'/g, "'\\''")}'`;
         const promptMode = autoImpl?.promptMode ?? "stdin";
         const extraArgs = autoImpl?.extraArgs ?? [];
@@ -78915,7 +79461,7 @@ async (params) => {
         try {
           const pty = require("node-pty");
           ctx.log(`Auto-implement spawn (PTY): ${shellCmd}`);
-          const isWin2 = os27.platform() === "win32";
+          const isWin2 = os28.platform() === "win32";
           child = pty.spawn(isWin2 ? "cmd.exe" : process.env.SHELL || "/bin/zsh", [isWin2 ? "/c" : "-c", shellCmd], {
             name: "xterm-256color",
             cols: 120,
@@ -79058,7 +79604,7 @@ async (params) => {
             }
           });
           try {
-            fs25.unlinkSync(promptFile);
+            fs26.unlinkSync(promptFile);
           } catch {
           }
           ctx.log(`Auto-implement ${success2 ? "completed" : "failed"}: ${type} (exit: ${code})${verificationSummary ? ` verify=${verificationSummary.pass ? "pass" : "fail"}` : ""}`);
@@ -79155,7 +79701,7 @@ async (params) => {
         setMode: "set_mode.js"
       };
       const targetFileNames = new Set(functions.map((fn) => funcToFile[fn]).filter(Boolean));
-      const scriptsDir = path37.join(providerDir, "scripts");
+      const scriptsDir = path38.join(providerDir, "scripts");
       const latestScriptsDir = getLatestScriptVersionDir(scriptsDir);
       if (latestScriptsDir) {
         lines.push(`Scripts version directory: \`${latestScriptsDir}\``);
@@ -79163,10 +79709,10 @@ async (params) => {
         lines.push("## \u270F\uFE0F Target Files (EDIT THESE)");
         lines.push("These are the ONLY files you are allowed to modify. Replace the TODO stubs with working implementations.");
         lines.push("");
-        for (const file2 of fs25.readdirSync(latestScriptsDir)) {
+        for (const file2 of fs26.readdirSync(latestScriptsDir)) {
           if (file2.endsWith(".js") && targetFileNames.has(file2)) {
             try {
-              const content = fs25.readFileSync(path37.join(latestScriptsDir, file2), "utf-8");
+              const content = fs26.readFileSync(path38.join(latestScriptsDir, file2), "utf-8");
               lines.push(`### \`${file2}\` \u270F\uFE0F EDIT`);
               lines.push("```javascript");
               lines.push(content);
@@ -79176,14 +79722,14 @@ async (params) => {
             }
           }
         }
-        const refFiles = fs25.readdirSync(latestScriptsDir).filter((f) => f.endsWith(".js") && !targetFileNames.has(f));
+        const refFiles = fs26.readdirSync(latestScriptsDir).filter((f) => f.endsWith(".js") && !targetFileNames.has(f));
         if (refFiles.length > 0) {
           lines.push("## \u{1F512} Other Scripts (REFERENCE ONLY \u2014 DO NOT EDIT)");
           lines.push("These files are shown for context only. Do NOT modify them under any circumstances.");
           lines.push("");
           for (const file2 of refFiles) {
             try {
-              const content = fs25.readFileSync(path37.join(latestScriptsDir, file2), "utf-8");
+              const content = fs26.readFileSync(path38.join(latestScriptsDir, file2), "utf-8");
               lines.push(`### \`${file2}\` \u{1F512}`);
               lines.push("```javascript");
               lines.push(content);
@@ -79224,11 +79770,11 @@ async (params) => {
           lines.push("");
         }
       }
-      const docsDir = path37.join(providerDir, "../../docs");
+      const docsDir = path38.join(providerDir, "../../docs");
       const loadGuide = (name) => {
         try {
-          const p = path37.join(docsDir, name);
-          if (fs25.existsSync(p)) return fs25.readFileSync(p, "utf-8");
+          const p = path38.join(docsDir, name);
+          if (fs26.existsSync(p)) return fs26.readFileSync(p, "utf-8");
         } catch {
         }
         return null;
@@ -79464,7 +80010,7 @@ async (params) => {
         parseApproval: "parse_approval.js"
       };
       const targetFileNames = new Set(functions.map((fn) => funcToFile[fn]).filter(Boolean));
-      const scriptsDir = path37.join(providerDir, "scripts");
+      const scriptsDir = path38.join(providerDir, "scripts");
       const latestScriptsDir = getLatestScriptVersionDir(scriptsDir);
       if (latestScriptsDir) {
         lines.push(`Scripts version directory: \`${latestScriptsDir}\``);
@@ -79472,11 +80018,11 @@ async (params) => {
         lines.push("## \u270F\uFE0F Target Files (EDIT THESE)");
         lines.push("These are the ONLY files you are allowed to modify. Replace TODO or heuristic-only logic with working PTY-aware implementations.");
         lines.push("");
-        for (const file2 of fs25.readdirSync(latestScriptsDir)) {
+        for (const file2 of fs26.readdirSync(latestScriptsDir)) {
           if (!file2.endsWith(".js")) continue;
           if (!targetFileNames.has(file2)) continue;
           try {
-            const content = fs25.readFileSync(path37.join(latestScriptsDir, file2), "utf-8");
+            const content = fs26.readFileSync(path38.join(latestScriptsDir, file2), "utf-8");
             lines.push(`### \`${file2}\` \u270F\uFE0F EDIT`);
             lines.push("```javascript");
             lines.push(content);
@@ -79485,14 +80031,14 @@ async (params) => {
           } catch {
           }
         }
-        const refFiles = fs25.readdirSync(latestScriptsDir).filter((f) => f.endsWith(".js") && !targetFileNames.has(f));
+        const refFiles = fs26.readdirSync(latestScriptsDir).filter((f) => f.endsWith(".js") && !targetFileNames.has(f));
         if (refFiles.length > 0) {
           lines.push("## \u{1F512} Other Scripts (REFERENCE ONLY \u2014 DO NOT EDIT)");
           lines.push("These files are shown for context only. Do NOT modify them under any circumstances.");
           lines.push("");
           for (const file2 of refFiles) {
             try {
-              const content = fs25.readFileSync(path37.join(latestScriptsDir, file2), "utf-8");
+              const content = fs26.readFileSync(path38.join(latestScriptsDir, file2), "utf-8");
               lines.push(`### \`${file2}\` \u{1F512}`);
               lines.push("```javascript");
               lines.push(content);
@@ -79525,11 +80071,11 @@ async (params) => {
           lines.push("");
         }
       }
-      const docsDir = path37.join(providerDir, "../../docs");
+      const docsDir = path38.join(providerDir, "../../docs");
       const loadGuide = (name) => {
         try {
-          const p = path37.join(docsDir, name);
-          if (fs25.existsSync(p)) return fs25.readFileSync(p, "utf-8");
+          const p = path38.join(docsDir, name);
+          if (fs26.existsSync(p)) return fs26.readFileSync(p, "utf-8");
         } catch {
         }
         return null;
@@ -79973,8 +80519,8 @@ data: ${JSON.stringify(msg.data)}
       }
       getEndpointList() {
         return this.routes.map((r) => {
-          const path39 = typeof r.pattern === "string" ? r.pattern : r.pattern.source.replace(/\\\//g, "/").replace(/\(\[.*?\]\+\)/g, ":type").replace(/[\^$]/g, "");
-          return `${r.method.padEnd(5)} ${path39}`;
+          const path40 = typeof r.pattern === "string" ? r.pattern : r.pattern.source.replace(/\\\//g, "/").replace(/\(\[.*?\]\+\)/g, ":type").replace(/[\^$]/g, "");
+          return `${r.method.padEnd(5)} ${path40}`;
         });
       }
       async start(port = DEV_SERVER_PORT) {
@@ -80262,12 +80808,12 @@ data: ${JSON.stringify(msg.data)}
       // ─── DevConsole SPA ───
       getConsoleDistDir() {
         const candidates = [
-          path38.resolve(__dirname, "../../web-devconsole/dist"),
-          path38.resolve(__dirname, "../../../web-devconsole/dist"),
-          path38.join(process.cwd(), "packages/web-devconsole/dist")
+          path39.resolve(__dirname, "../../web-devconsole/dist"),
+          path39.resolve(__dirname, "../../../web-devconsole/dist"),
+          path39.join(process.cwd(), "packages/web-devconsole/dist")
         ];
         for (const dir of candidates) {
-          if (fs26.existsSync(path38.join(dir, "index.html"))) return dir;
+          if (fs27.existsSync(path39.join(dir, "index.html"))) return dir;
         }
         return null;
       }
@@ -80277,9 +80823,9 @@ data: ${JSON.stringify(msg.data)}
           this.json(res, 500, { error: "DevConsole not found. Run: npm run build -w packages/web-devconsole" });
           return;
         }
-        const htmlPath = path38.join(distDir, "index.html");
+        const htmlPath = path39.join(distDir, "index.html");
         try {
-          const html = fs26.readFileSync(htmlPath, "utf-8");
+          const html = fs27.readFileSync(htmlPath, "utf-8");
           res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
           res.end(html);
         } catch (e) {
@@ -80302,15 +80848,15 @@ data: ${JSON.stringify(msg.data)}
           this.json(res, 404, { error: "Not found" });
           return;
         }
-        const safePath = path38.normalize(pathname).replace(/^\.\.\//, "");
-        const filePath = path38.join(distDir, safePath);
+        const safePath = path39.normalize(pathname).replace(/^\.\.\//, "");
+        const filePath = path39.join(distDir, safePath);
         if (!filePath.startsWith(distDir)) {
           this.json(res, 403, { error: "Forbidden" });
           return;
         }
         try {
-          const content = fs26.readFileSync(filePath);
-          const ext = path38.extname(filePath);
+          const content = fs27.readFileSync(filePath);
+          const ext = path39.extname(filePath);
           const contentType = _DevServer.MIME_MAP[ext] || "application/octet-stream";
           res.writeHead(200, { "Content-Type": contentType, "Cache-Control": "public, max-age=31536000, immutable" });
           res.end(content);
@@ -80418,14 +80964,14 @@ data: ${JSON.stringify(msg.data)}
         const files = [];
         const scan = (d, prefix) => {
           try {
-            for (const entry of fs26.readdirSync(d, { withFileTypes: true })) {
+            for (const entry of fs27.readdirSync(d, { withFileTypes: true })) {
               if (entry.name.startsWith(".") || entry.name.endsWith(".bak")) continue;
               const rel = prefix ? `${prefix}/${entry.name}` : entry.name;
               if (entry.isDirectory()) {
                 files.push({ path: rel, size: 0, type: "dir" });
-                scan(path38.join(d, entry.name), rel);
+                scan(path39.join(d, entry.name), rel);
               } else {
-                const stat2 = fs26.statSync(path38.join(d, entry.name));
+                const stat2 = fs27.statSync(path39.join(d, entry.name));
                 files.push({ path: rel, size: stat2.size, type: "file" });
               }
             }
@@ -80448,16 +80994,16 @@ data: ${JSON.stringify(msg.data)}
           this.json(res, 404, { error: `Provider directory not found: ${type}` });
           return;
         }
-        const fullPath = path38.resolve(dir, path38.normalize(filePath));
+        const fullPath = path39.resolve(dir, path39.normalize(filePath));
         if (!fullPath.startsWith(dir)) {
           this.json(res, 403, { error: "Forbidden" });
           return;
         }
-        if (!fs26.existsSync(fullPath) || fs26.statSync(fullPath).isDirectory()) {
+        if (!fs27.existsSync(fullPath) || fs27.statSync(fullPath).isDirectory()) {
           this.json(res, 404, { error: `File not found: ${filePath}` });
           return;
         }
-        const content = fs26.readFileSync(fullPath, "utf-8");
+        const content = fs27.readFileSync(fullPath, "utf-8");
         this.json(res, 200, { type, path: filePath, content, lines: content.split("\n").length });
       }
       /** POST /api/providers/:type/file — write a file { path, content } */
@@ -80473,15 +81019,15 @@ data: ${JSON.stringify(msg.data)}
           this.json(res, 404, { error: `Provider directory not found: ${type}` });
           return;
         }
-        const fullPath = path38.resolve(dir, path38.normalize(filePath));
+        const fullPath = path39.resolve(dir, path39.normalize(filePath));
         if (!fullPath.startsWith(dir)) {
           this.json(res, 403, { error: "Forbidden" });
           return;
         }
         try {
-          if (fs26.existsSync(fullPath)) fs26.copyFileSync(fullPath, fullPath + ".bak");
-          fs26.mkdirSync(path38.dirname(fullPath), { recursive: true });
-          fs26.writeFileSync(fullPath, content, "utf-8");
+          if (fs27.existsSync(fullPath)) fs27.copyFileSync(fullPath, fullPath + ".bak");
+          fs27.mkdirSync(path39.dirname(fullPath), { recursive: true });
+          fs27.writeFileSync(fullPath, content, "utf-8");
           this.log(`File saved: ${fullPath} (${content.length} chars)`);
           this.providerLoader.reload();
           this.json(res, 200, { saved: true, path: filePath, chars: content.length });
@@ -80497,9 +81043,9 @@ data: ${JSON.stringify(msg.data)}
           return;
         }
         for (const name of ["scripts.js", "provider.json"]) {
-          const p = path38.join(dir, name);
-          if (fs26.existsSync(p)) {
-            const source = fs26.readFileSync(p, "utf-8");
+          const p = path39.join(dir, name);
+          if (fs27.existsSync(p)) {
+            const source = fs27.readFileSync(p, "utf-8");
             this.json(res, 200, { type, path: p, source, lines: source.split("\n").length });
             return;
           }
@@ -80518,11 +81064,11 @@ data: ${JSON.stringify(msg.data)}
           this.json(res, 404, { error: `Provider not found: ${type}` });
           return;
         }
-        const target = fs26.existsSync(path38.join(dir, "scripts.js")) ? "scripts.js" : "provider.json";
-        const targetPath = path38.join(dir, target);
+        const target = fs27.existsSync(path39.join(dir, "scripts.js")) ? "scripts.js" : "provider.json";
+        const targetPath = path39.join(dir, target);
         try {
-          if (fs26.existsSync(targetPath)) fs26.copyFileSync(targetPath, targetPath + ".bak");
-          fs26.writeFileSync(targetPath, source, "utf-8");
+          if (fs27.existsSync(targetPath)) fs27.copyFileSync(targetPath, targetPath + ".bak");
+          fs27.writeFileSync(targetPath, source, "utf-8");
           this.log(`Saved provider: ${targetPath} (${source.length} chars)`);
           this.providerLoader.reload();
           this.json(res, 200, { saved: true, path: targetPath, chars: source.length });
@@ -80666,21 +81212,21 @@ data: ${JSON.stringify(msg.data)}
         }
         let targetDir;
         targetDir = this.providerLoader.getUserProviderDir(category, type);
-        const jsonPath = path38.join(targetDir, "provider.json");
-        if (fs26.existsSync(jsonPath)) {
+        const jsonPath = path39.join(targetDir, "provider.json");
+        if (fs27.existsSync(jsonPath)) {
           this.json(res, 409, { error: `Provider already exists at ${targetDir}`, path: targetDir });
           return;
         }
         try {
           const result = generateFiles(type, name, category, { cdpPorts, cli, processName, installPath, binary, extensionId, version: version2, osPaths, processNames });
-          fs26.mkdirSync(targetDir, { recursive: true });
-          fs26.writeFileSync(jsonPath, result["provider.json"], "utf-8");
+          fs27.mkdirSync(targetDir, { recursive: true });
+          fs27.writeFileSync(jsonPath, result["provider.json"], "utf-8");
           const createdFiles = ["provider.json"];
           if (result.files) {
             for (const [relPath, content] of Object.entries(result.files)) {
-              const fullPath = path38.join(targetDir, relPath);
-              fs26.mkdirSync(path38.dirname(fullPath), { recursive: true });
-              fs26.writeFileSync(fullPath, content, "utf-8");
+              const fullPath = path39.join(targetDir, relPath);
+              fs27.mkdirSync(path39.dirname(fullPath), { recursive: true });
+              fs27.writeFileSync(fullPath, content, "utf-8");
               createdFiles.push(relPath);
             }
           }
@@ -80729,38 +81275,38 @@ data: ${JSON.stringify(msg.data)}
       }
       // ─── Phase 2: Auto-Implement Backend ───
       getLatestScriptVersionDir(scriptsDir) {
-        if (!fs26.existsSync(scriptsDir)) return null;
-        const versions = fs26.readdirSync(scriptsDir).filter((d) => {
+        if (!fs27.existsSync(scriptsDir)) return null;
+        const versions = fs27.readdirSync(scriptsDir).filter((d) => {
           try {
-            return fs26.statSync(path38.join(scriptsDir, d)).isDirectory();
+            return fs27.statSync(path39.join(scriptsDir, d)).isDirectory();
           } catch {
             return false;
           }
         }).sort((a, b) => b.localeCompare(a, void 0, { numeric: true, sensitivity: "base" }));
         if (versions.length === 0) return null;
-        return path38.join(scriptsDir, versions[0]);
+        return path39.join(scriptsDir, versions[0]);
       }
       resolveAutoImplWritableProviderDir(category, type, requestedDir) {
-        const canonicalUserDir = path38.resolve(this.providerLoader.getUserProviderDir(category, type));
-        const desiredDir = requestedDir ? path38.resolve(requestedDir) : canonicalUserDir;
-        const upstreamRoot = path38.resolve(this.providerLoader.getUpstreamDir());
-        if (desiredDir === upstreamRoot || desiredDir.startsWith(`${upstreamRoot}${path38.sep}`)) {
+        const canonicalUserDir = path39.resolve(this.providerLoader.getUserProviderDir(category, type));
+        const desiredDir = requestedDir ? path39.resolve(requestedDir) : canonicalUserDir;
+        const upstreamRoot = path39.resolve(this.providerLoader.getUpstreamDir());
+        if (desiredDir === upstreamRoot || desiredDir.startsWith(`${upstreamRoot}${path39.sep}`)) {
           return { dir: null, reason: `Refusing to write into upstream provider directory: ${desiredDir}` };
         }
-        if (path38.basename(desiredDir) !== type) {
+        if (path39.basename(desiredDir) !== type) {
           return { dir: null, reason: `Requested writable provider directory must end with '${type}': ${desiredDir}` };
         }
         const sourceDir = this.findProviderDir(type);
         if (!sourceDir) {
           return { dir: null, reason: `Provider source directory not found for '${type}'` };
         }
-        if (!fs26.existsSync(desiredDir)) {
-          fs26.mkdirSync(path38.dirname(desiredDir), { recursive: true });
-          fs26.cpSync(sourceDir, desiredDir, { recursive: true });
+        if (!fs27.existsSync(desiredDir)) {
+          fs27.mkdirSync(path39.dirname(desiredDir), { recursive: true });
+          fs27.cpSync(sourceDir, desiredDir, { recursive: true });
           this.log(`Auto-implement writable copy created: ${desiredDir}`);
         }
-        const providerJson = path38.join(desiredDir, "provider.json");
-        if (!fs26.existsSync(providerJson)) {
+        const providerJson = path39.join(desiredDir, "provider.json");
+        if (!fs27.existsSync(providerJson)) {
           return { dir: null, reason: `provider.json not found in writable provider directory: ${desiredDir}` };
         }
         return { dir: desiredDir };
@@ -80795,7 +81341,7 @@ data: ${JSON.stringify(msg.data)}
           setMode: "set_mode.js"
         };
         const targetFileNames = new Set(functions.map((fn) => funcToFile[fn]).filter(Boolean));
-        const scriptsDir = path38.join(providerDir, "scripts");
+        const scriptsDir = path39.join(providerDir, "scripts");
         const latestScriptsDir = this.getLatestScriptVersionDir(scriptsDir);
         if (latestScriptsDir) {
           lines.push(`Scripts version directory: \`${latestScriptsDir}\``);
@@ -80803,10 +81349,10 @@ data: ${JSON.stringify(msg.data)}
           lines.push("## \u270F\uFE0F Target Files (EDIT THESE)");
           lines.push("These are the ONLY files you are allowed to modify. Replace the TODO stubs with working implementations.");
           lines.push("");
-          for (const file2 of fs26.readdirSync(latestScriptsDir)) {
+          for (const file2 of fs27.readdirSync(latestScriptsDir)) {
             if (file2.endsWith(".js") && targetFileNames.has(file2)) {
               try {
-                const content = fs26.readFileSync(path38.join(latestScriptsDir, file2), "utf-8");
+                const content = fs27.readFileSync(path39.join(latestScriptsDir, file2), "utf-8");
                 lines.push(`### \`${file2}\` \u270F\uFE0F EDIT`);
                 lines.push("```javascript");
                 lines.push(content);
@@ -80816,14 +81362,14 @@ data: ${JSON.stringify(msg.data)}
               }
             }
           }
-          const refFiles = fs26.readdirSync(latestScriptsDir).filter((f) => f.endsWith(".js") && !targetFileNames.has(f));
+          const refFiles = fs27.readdirSync(latestScriptsDir).filter((f) => f.endsWith(".js") && !targetFileNames.has(f));
           if (refFiles.length > 0) {
             lines.push("## \u{1F512} Other Scripts (REFERENCE ONLY \u2014 DO NOT EDIT)");
             lines.push("These files are shown for context only. Do NOT modify them under any circumstances.");
             lines.push("");
             for (const file2 of refFiles) {
               try {
-                const content = fs26.readFileSync(path38.join(latestScriptsDir, file2), "utf-8");
+                const content = fs27.readFileSync(path39.join(latestScriptsDir, file2), "utf-8");
                 lines.push(`### \`${file2}\` \u{1F512}`);
                 lines.push("```javascript");
                 lines.push(content);
@@ -80864,11 +81410,11 @@ data: ${JSON.stringify(msg.data)}
             lines.push("");
           }
         }
-        const docsDir = path38.join(providerDir, "../../docs");
+        const docsDir = path39.join(providerDir, "../../docs");
         const loadGuide = (name) => {
           try {
-            const p = path38.join(docsDir, name);
-            if (fs26.existsSync(p)) return fs26.readFileSync(p, "utf-8");
+            const p = path39.join(docsDir, name);
+            if (fs27.existsSync(p)) return fs27.readFileSync(p, "utf-8");
           } catch {
           }
           return null;
@@ -81041,7 +81587,7 @@ data: ${JSON.stringify(msg.data)}
           parseApproval: "parse_approval.js"
         };
         const targetFileNames = new Set(functions.map((fn) => funcToFile[fn]).filter(Boolean));
-        const scriptsDir = path38.join(providerDir, "scripts");
+        const scriptsDir = path39.join(providerDir, "scripts");
         const latestScriptsDir = this.getLatestScriptVersionDir(scriptsDir);
         if (latestScriptsDir) {
           lines.push(`Scripts version directory: \`${latestScriptsDir}\``);
@@ -81049,11 +81595,11 @@ data: ${JSON.stringify(msg.data)}
           lines.push("## \u270F\uFE0F Target Files (EDIT THESE)");
           lines.push("These are the ONLY files you are allowed to modify. Replace TODO or heuristic-only logic with working PTY-aware implementations.");
           lines.push("");
-          for (const file2 of fs26.readdirSync(latestScriptsDir)) {
+          for (const file2 of fs27.readdirSync(latestScriptsDir)) {
             if (!file2.endsWith(".js")) continue;
             if (!targetFileNames.has(file2)) continue;
             try {
-              const content = fs26.readFileSync(path38.join(latestScriptsDir, file2), "utf-8");
+              const content = fs27.readFileSync(path39.join(latestScriptsDir, file2), "utf-8");
               lines.push(`### \`${file2}\` \u270F\uFE0F EDIT`);
               lines.push("```javascript");
               lines.push(content);
@@ -81062,14 +81608,14 @@ data: ${JSON.stringify(msg.data)}
             } catch {
             }
           }
-          const refFiles = fs26.readdirSync(latestScriptsDir).filter((f) => f.endsWith(".js") && !targetFileNames.has(f));
+          const refFiles = fs27.readdirSync(latestScriptsDir).filter((f) => f.endsWith(".js") && !targetFileNames.has(f));
           if (refFiles.length > 0) {
             lines.push("## \u{1F512} Other Scripts (REFERENCE ONLY \u2014 DO NOT EDIT)");
             lines.push("These files are shown for context only. Do NOT modify them under any circumstances.");
             lines.push("");
             for (const file2 of refFiles) {
               try {
-                const content = fs26.readFileSync(path38.join(latestScriptsDir, file2), "utf-8");
+                const content = fs27.readFileSync(path39.join(latestScriptsDir, file2), "utf-8");
                 lines.push(`### \`${file2}\` \u{1F512}`);
                 lines.push("```javascript");
                 lines.push(content);
@@ -81102,11 +81648,11 @@ data: ${JSON.stringify(msg.data)}
             lines.push("");
           }
         }
-        const docsDir = path38.join(providerDir, "../../docs");
+        const docsDir = path39.join(providerDir, "../../docs");
         const loadGuide = (name) => {
           try {
-            const p = path38.join(docsDir, name);
-            if (fs26.existsSync(p)) return fs26.readFileSync(p, "utf-8");
+            const p = path39.join(docsDir, name);
+            if (fs27.existsSync(p)) return fs27.readFileSync(p, "utf-8");
           } catch {
           }
           return null;
@@ -81999,8 +82545,8 @@ data: ${JSON.stringify(msg.data)}
           const res = await fetch(extension.vsixUrl);
           if (res.ok) {
             const buffer = Buffer.from(await res.arrayBuffer());
-            const fs27 = await import("fs");
-            fs27.writeFileSync(vsixPath, buffer);
+            const fs28 = await import("fs");
+            fs28.writeFileSync(vsixPath, buffer);
             return new Promise((resolve23) => {
               const cmd = `"${ide.cliCommand}" --install-extension "${vsixPath}" --force`;
               (0, import_child_process10.exec)(cmd, { timeout: 6e4 }, (error48, _stdout, stderr) => {