@agent-profile/cli 0.2.0 → 0.3.1

package/dist/index.js

@@ -1,10 +1,11 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import fsPromises3 from "node:fs/promises";
+import fsPromises4 from "node:fs/promises";
 import { createRequire } from "node:module";
-import path5 from "node:path";
+import path6 from "node:path";
 import { spawn } from "node:child_process";
+import { randomBytes } from "node:crypto";
 import { createServer } from "node:net";
 import { pathToFileURL } from "node:url";
 
@@ -31,8 +32,8 @@ function getDefaultTargetIds() {
     "claude-subagents"
   ];
 }
-function createGeneratedTextFile(path6, target, templateId, text) {
-  const safePath = safeOutputPath(path6);
+function createGeneratedTextFile(path7, target, templateId, text) {
+  const safePath = safeOutputPath(path7);
   const bytes = Buffer.from(normalizeGeneratedText(text), "utf8");
   return {
     path: safePath,
@@ -53,17 +54,17 @@ function normalizeGeneratedText(text) {
   return `${lines.join("\n").replace(/\n*$/u, "")}
 `;
 }
-function safeOutputPath(path6) {
-  if (path6.length === 0 || path6.includes("\\") || path6.startsWith("/") || /^[A-Za-z]:/u.test(path6)) {
-    throw new Error(`Invalid generated output path: ${path6}`);
+function safeOutputPath(path7) {
+  if (path7.length === 0 || path7.includes("\\") || path7.startsWith("/") || /^[A-Za-z]:/u.test(path7)) {
+    throw new Error(`Invalid generated output path: ${path7}`);
   }
-  const segments = path6.split("/");
+  const segments = path7.split("/");
   if (segments.some(
     (segment) => segment.length === 0 || segment === "." || segment === ".."
   )) {
-    throw new Error(`Invalid generated output path: ${path6}`);
+    throw new Error(`Invalid generated output path: ${path7}`);
   }
-  return path6;
+  return path7;
 }
 function sha256Hex(bytes) {
   return createHash("sha256").update(bytes).digest("hex");
@@ -79,10 +80,17 @@ function compareText(left, right) {
 }
 
 // ../../packages/compiler/src/lockfile.ts
+var SUPPORTED_VERSIONS = /* @__PURE__ */ new Set([1, 2]);
 function buildLockfile(input) {
   const profilePath = safeOutputPath(input.profilePath ?? "ai-profile.yaml");
+  const mixedByPath = new Map(
+    (input.mixedOutputs ?? []).map((entry) => [
+      safeOutputPath(entry.path),
+      entry
+    ])
+  );
   return {
-    version: 1,
+    version: 2,
     profile: {
       path: profilePath,
       schemaVersion: 1,
@@ -90,7 +98,7 @@ function buildLockfile(input) {
     },
     compiler: input.compiler ?? AGENT_PROFILE_COMPILER,
     templates: input.templates.map(toLockTemplate).sort(compareLockTemplates),
-    outputs: input.files.map(toLockOutput).sort(compareLockOutputs)
+    outputs: input.files.map((file) => toLockOutputV2(file, mixedByPath)).sort(compareLockOutputsV2)
   };
 }
 function serializeLockfile(lockfile) {
@@ -105,6 +113,21 @@ function createLockfileFile(input) {
     serializeLockfile(buildLockfile(input))
   );
 }
+function migrateLockfileV1ToV2(lockfile) {
+  return {
+    version: 2,
+    profile: lockfile.profile,
+    compiler: lockfile.compiler,
+    templates: [...lockfile.templates].sort(compareLockTemplates),
+    outputs: lockfile.outputs.map((output) => ({
+      path: output.path,
+      target: output.target,
+      templateId: output.templateId,
+      ownership: "generated-owned",
+      sha256: output.sha256
+    })).sort(compareLockOutputsV2)
+  };
+}
 function validateLockfileText(source) {
   try {
     return validateLockfileValue(JSON.parse(source));
@@ -125,17 +148,33 @@ function validateLockfileText(source) {
 }
 function validateLockfileValue(value) {
   const issues = [];
-  validateLockfileObject(value, issues);
+  if (!isRecord(value)) {
+    issues.push(schemaIssue("/", "object", describeValue(value)));
+    return { ok: false, issues };
+  }
+  const version = value.version;
+  if (typeof version !== "number" || !SUPPORTED_VERSIONS.has(version)) {
+    issues.push({
+      code: "lockfile_unsupported_version",
+      path: "/version",
+      expected: "supported lockfile version (1 or 2)",
+      actual: describeValue(version),
+      message: `/version is not a supported lockfile version.`
+    });
+    return { ok: false, issues };
+  }
+  if (version === 1) {
+    validateLockfileV1Object(value, issues);
+    if (issues.length > 0) {
+      return { ok: false, issues: issues.sort(compareLockfileIssues) };
+    }
+    return { ok: true, lockfile: value, version: 1 };
+  }
+  validateLockfileV2Object(value, issues);
   if (issues.length > 0) {
-    return {
-      ok: false,
-      issues: issues.sort(compareLockfileIssues)
-    };
+    return { ok: false, issues: issues.sort(compareLockfileIssues) };
   }
-  return {
-    ok: true,
-    lockfile: value
-  };
+  return { ok: true, lockfile: value, version: 2 };
 }
 function toLockTemplate(template) {
   return {
@@ -145,7 +184,7 @@ function toLockTemplate(template) {
     sha256: template.sha256
   };
 }
-function validateLockfileObject(value, issues) {
+function validateLockfileV1Object(value, issues) {
   if (!isRecord(value)) {
     issues.push(schemaIssue("/", "object", describeValue(value)));
     return;
@@ -164,7 +203,28 @@ function validateLockfileObject(value, issues) {
   validateProfile(value.profile, issues);
   validateCompiler(value.compiler, issues);
   validateTemplates(value.templates, issues);
-  validateOutputs(value.outputs, issues);
+  validateOutputsV1(value.outputs, issues);
+}
+function validateLockfileV2Object(value, issues) {
+  if (!isRecord(value)) {
+    issues.push(schemaIssue("/", "object", describeValue(value)));
+    return;
+  }
+  requireExactKeys(
+    value,
+    "/",
+    ["version", "profile", "compiler", "templates", "outputs"],
+    issues
+  );
+  if (value.version !== 2) {
+    issues.push(
+      schemaIssue("/version", "constant 2", describeValue(value.version))
+    );
+  }
+  validateProfile(value.profile, issues);
+  validateCompiler(value.compiler, issues);
+  validateTemplates(value.templates, issues);
+  validateOutputsV2(value.outputs, issues);
 }
 function validateProfile(value, issues) {
   if (!isRecord(value)) {
@@ -213,71 +273,190 @@ function validateTemplates(value, issues) {
   }
   let previous;
   value.forEach((item, index) => {
-    const path6 = `/templates/${index}`;
+    const path7 = `/templates/${index}`;
     if (!isRecord(item)) {
-      issues.push(schemaIssue(path6, "object", describeValue(item)));
+      issues.push(schemaIssue(path7, "object", describeValue(item)));
       return;
     }
-    requireExactKeys(item, path6, ["id", "target", "version", "sha256"], issues);
-    validateString(item.id, `${path6}/id`, issues);
-    validateString(item.target, `${path6}/target`, issues);
-    validateString(item.version, `${path6}/version`, issues);
-    validateHash(item.sha256, `${path6}/sha256`, issues);
+    requireExactKeys(item, path7, ["id", "target", "version", "sha256"], issues);
+    validateString(item.id, `${path7}/id`, issues);
+    validateString(item.target, `${path7}/target`, issues);
+    validateString(item.version, `${path7}/version`, issues);
+    validateHash(item.sha256, `${path7}/sha256`, issues);
     const current = item;
     if (previous && compareLockTemplates(previous, current) > 0) {
       issues.push({
         code: "lockfile_order_error",
-        path: path6,
+        path: path7,
         expected: "templates sorted by id then target",
         actual: "out of order",
-        message: `${path6} is not in deterministic order.`
+        message: `${path7} is not in deterministic order.`
       });
     }
     previous = current;
   });
 }
-function validateOutputs(value, issues) {
+function validateOutputsV1(value, issues) {
   if (!Array.isArray(value)) {
     issues.push(schemaIssue("/outputs", "array", describeValue(value)));
     return;
   }
   let previous;
   value.forEach((item, index) => {
-    const path6 = `/outputs/${index}`;
+    const path7 = `/outputs/${index}`;
     if (!isRecord(item)) {
-      issues.push(schemaIssue(path6, "object", describeValue(item)));
+      issues.push(schemaIssue(path7, "object", describeValue(item)));
       return;
     }
     requireExactKeys(
       item,
-      path6,
+      path7,
       ["path", "target", "templateId", "sha256"],
       issues
     );
-    validatePath(item.path, `${path6}/path`, issues);
-    validateString(item.target, `${path6}/target`, issues);
-    validateString(item.templateId, `${path6}/templateId`, issues);
-    validateHash(item.sha256, `${path6}/sha256`, issues);
+    validatePath(item.path, `${path7}/path`, issues);
+    validateString(item.target, `${path7}/target`, issues);
+    validateString(item.templateId, `${path7}/templateId`, issues);
+    validateHash(item.sha256, `${path7}/sha256`, issues);
     const current = item;
     if (previous && compareLockOutputs(previous, current) > 0) {
       issues.push({
         code: "lockfile_order_error",
-        path: path6,
+        path: path7,
+        expected: "outputs sorted by path then target",
+        actual: "out of order",
+        message: `${path7} is not in deterministic order.`
+      });
+    }
+    previous = current;
+  });
+}
+function validateOutputsV2(value, issues) {
+  if (!Array.isArray(value)) {
+    issues.push(schemaIssue("/outputs", "array", describeValue(value)));
+    return;
+  }
+  let previous;
+  value.forEach((item, index) => {
+    const path7 = `/outputs/${index}`;
+    if (!isRecord(item)) {
+      issues.push(schemaIssue(path7, "object", describeValue(item)));
+      return;
+    }
+    const ownership = item.ownership;
+    if (ownership === "generated-owned") {
+      requireExactKeys(
+        item,
+        path7,
+        ["path", "target", "templateId", "ownership", "sha256"],
+        issues
+      );
+      validatePath(item.path, `${path7}/path`, issues);
+      validateString(item.target, `${path7}/target`, issues);
+      validateString(item.templateId, `${path7}/templateId`, issues);
+      validateHash(item.sha256, `${path7}/sha256`, issues);
+    } else if (ownership === "mixed") {
+      requireExactKeys(
+        item,
+        path7,
+        ["path", "target", "templateId", "ownership", "regions"],
+        issues
+      );
+      validatePath(item.path, `${path7}/path`, issues);
+      validateString(item.target, `${path7}/target`, issues);
+      validateString(item.templateId, `${path7}/templateId`, issues);
+      validateRegions(item.regions, `${path7}/regions`, issues);
+    } else if (ownership === "manual-owned") {
+      requireExactKeys(
+        item,
+        path7,
+        ["path", "target", "templateId", "ownership"],
+        issues
+      );
+      validatePath(item.path, `${path7}/path`, issues);
+      if (item.target !== "manual") {
+        issues.push(
+          schemaIssue(`${path7}/target`, '"manual"', describeValue(item.target))
+        );
+      }
+      if (item.templateId !== "manual") {
+        issues.push(
+          schemaIssue(
+            `${path7}/templateId`,
+            '"manual"',
+            describeValue(item.templateId)
+          )
+        );
+      }
+    } else {
+      issues.push(
+        schemaIssue(
+          `${path7}/ownership`,
+          '"generated-owned" | "mixed" | "manual-owned"',
+          describeValue(ownership)
+        )
+      );
+    }
+    const current = item;
+    if (previous && compareLockOutputsV2(previous, current) > 0) {
+      issues.push({
+        code: "lockfile_order_error",
+        path: path7,
         expected: "outputs sorted by path then target",
         actual: "out of order",
-        message: `${path6} is not in deterministic order.`
+        message: `${path7} is not in deterministic order.`
       });
     }
     previous = current;
   });
 }
-function requireExactKeys(value, path6, keys, issues) {
+function validateRegions(value, pathPrefix, issues) {
+  if (!Array.isArray(value)) {
+    issues.push(schemaIssue(pathPrefix, "array", describeValue(value)));
+    return;
+  }
+  if (value.length !== 1) {
+    issues.push(
+      schemaIssue(
+        pathPrefix,
+        "exactly one generated region",
+        `${value.length} regions`
+      )
+    );
+  }
+  value.forEach((item, index) => {
+    const path7 = `${pathPrefix}/${index}`;
+    if (!isRecord(item)) {
+      issues.push(schemaIssue(path7, "object", describeValue(item)));
+      return;
+    }
+    requireExactKeys(
+      item,
+      path7,
+      ["id", "target", "templateId", "sha256"],
+      issues
+    );
+    if (item.id !== "agent-profile:generated") {
+      issues.push(
+        schemaIssue(
+          `${path7}/id`,
+          '"agent-profile:generated"',
+          describeValue(item.id)
+        )
+      );
+    }
+    validateString(item.target, `${path7}/target`, issues);
+    validateString(item.templateId, `${path7}/templateId`, issues);
+    validateHash(item.sha256, `${path7}/sha256`, issues);
+  });
+}
+function requireExactKeys(value, path7, keys, issues) {
   const allowed = new Set(keys);
   for (const key of keys) {
     if (!Object.prototype.hasOwnProperty.call(value, key)) {
       issues.push(
         schemaIssue(
-          `${path6}/${escapeJsonPointerSegment(key)}`,
+          `${path7}/${escapeJsonPointerSegment(key)}`,
           "required property",
           "missing"
         )
@@ -288,7 +467,7 @@ function requireExactKeys(value, path6, keys, issues) {
     if (!allowed.has(key)) {
       issues.push(
         schemaIssue(
-          `${path6}/${escapeJsonPointerSegment(key)}`,
+          `${path7}/${escapeJsonPointerSegment(key)}`,
           "no additional properties",
           "present"
         )
@@ -296,26 +475,26 @@ function requireExactKeys(value, path6, keys, issues) {
     }
   }
 }
-function validateString(value, path6, issues) {
+function validateString(value, path7, issues) {
   if (typeof value !== "string") {
-    issues.push(schemaIssue(path6, "string", describeValue(value)));
+    issues.push(schemaIssue(path7, "string", describeValue(value)));
   }
 }
-function validateHash(value, path6, issues) {
+function validateHash(value, path7, issues) {
   if (typeof value !== "string" || !/^[a-f0-9]{64}$/u.test(value)) {
     issues.push({
       code: "lockfile_hash_error",
-      path: path6,
+      path: path7,
       expected: "lowercase sha256 hex",
       actual: describeValue(value),
-      message: `${path6} must be a lowercase SHA-256 hex digest.`
+      message: `${path7} must be a lowercase SHA-256 hex digest.`
     });
   }
 }
-function validatePath(value, path6, issues) {
+function validatePath(value, path7, issues) {
   if (typeof value !== "string") {
     issues.push(
-      schemaIssue(path6, "repository-relative path", describeValue(value))
+      schemaIssue(path7, "repository-relative path", describeValue(value))
     );
     return;
   }
@@ -324,20 +503,20 @@ function validatePath(value, path6, issues) {
   } catch {
     issues.push({
       code: "lockfile_path_error",
-      path: path6,
+      path: path7,
       expected: "repository-relative forward-slash path",
       actual: "unsafe path",
-      message: `${path6} must be a safe repository-relative path.`
+      message: `${path7} must be a safe repository-relative path.`
     });
   }
 }
-function schemaIssue(path6, expected, actual) {
+function schemaIssue(path7, expected, actual) {
   return {
     code: "lockfile_schema_error",
-    path: path6,
+    path: path7,
     expected,
     actual,
-    message: `${path6} does not match the lockfile schema.`
+    message: `${path7} does not match the lockfile schema.`
   };
 }
 function compareLockfileIssues(left, right) {
@@ -358,11 +537,30 @@ function escapeJsonPointerSegment(segment) {
 function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function toLockOutput(file) {
+function toLockOutputV2(file, mixedByPath) {
+  const safePath = safeOutputPath(file.path);
+  const mixed = mixedByPath.get(safePath);
+  if (mixed) {
+    return {
+      path: safePath,
+      target: file.target,
+      templateId: file.templateId,
+      ownership: "mixed",
+      regions: [
+        {
+          id: "agent-profile:generated",
+          target: mixed.target,
+          templateId: mixed.templateId,
+          sha256: mixed.regionHash
+        }
+      ]
+    };
+  }
   return {
-    path: safeOutputPath(file.path),
+    path: safePath,
     target: file.target,
     templateId: file.templateId,
+    ownership: "generated-owned",
     sha256: file.sha256
   };
 }
@@ -372,6 +570,229 @@ function compareLockTemplates(left, right) {
 function compareLockOutputs(left, right) {
   return compareText(left.path, right.path) || compareText(left.target, right.target);
 }
+function compareLockOutputsV2(left, right) {
+  return compareText(left.path, right.path) || compareText(left.target, right.target);
+}
+function toLockfileV2View(lockfile) {
+  if (lockfile.version === 2) return lockfile;
+  return migrateLockfileV1ToV2(lockfile);
+}
+
+// ../../packages/compiler/src/regions.ts
+var GENERATED_START_MARKER = "<!-- agent-profile:generated:start -->";
+var GENERATED_END_MARKER = "<!-- agent-profile:generated:end -->";
+var MANUAL_START_MARKER = "<!-- agent-profile:manual:start -->";
+var MANUAL_END_MARKER = "<!-- agent-profile:manual:end -->";
+var REGION_PRECEDENCE_TEXT = "If generated and manual instructions conflict, follow the manual project instructions unless they would weaken safety, privacy, or permission limits. Safety, privacy, and explicit deny rules always win.";
+var LEGACY_GENERATED_MARKER = "<!-- Generated by Agent Profile Compiler. Do not edit by hand. -->";
+var GENERATED_START_RE = /^<!-- agent-profile:generated:start -->$/u;
+var GENERATED_END_RE = /^<!-- agent-profile:generated:end -->$/u;
+var MANUAL_START_RE = /^<!-- agent-profile:manual:start -->$/u;
+var MANUAL_END_RE = /^<!-- agent-profile:manual:end -->$/u;
+function parseMixedFile(bytes) {
+  const text = bytes.toString("utf8");
+  const lineEndings = [];
+  const lines = [];
+  let position = 0;
+  while (position < text.length) {
+    const newlineIndex = text.indexOf("\n", position);
+    if (newlineIndex === -1) {
+      lines.push(text.slice(position));
+      lineEndings.push("");
+      break;
+    }
+    let lineEnd = newlineIndex;
+    let ending = "\n";
+    if (lineEnd > position && text[lineEnd - 1] === "\r") {
+      lineEnd = newlineIndex - 1;
+      ending = "\r\n";
+    }
+    lines.push(text.slice(position, lineEnd));
+    lineEndings.push(ending);
+    position = newlineIndex + 1;
+  }
+  const inFence = computeCodeFenceMask(lines);
+  const matches = {
+    generatedStart: [],
+    generatedEnd: [],
+    manualStart: [],
+    manualEnd: []
+  };
+  lines.forEach((line, index) => {
+    if (inFence[index]) return;
+    if (GENERATED_START_RE.test(line)) matches.generatedStart.push(index);
+    if (GENERATED_END_RE.test(line)) matches.generatedEnd.push(index);
+    if (MANUAL_START_RE.test(line)) matches.manualStart.push(index);
+    if (MANUAL_END_RE.test(line)) matches.manualEnd.push(index);
+  });
+  const issues = [];
+  if (matches.generatedStart.length > 1 || matches.generatedEnd.length > 1 || matches.manualStart.length > 1 || matches.manualEnd.length > 1) {
+    issues.push({
+      code: "duplicate-markers",
+      message: "Mixed instruction file contains duplicate generated/manual region markers."
+    });
+    return { ok: false, issues };
+  }
+  if (matches.generatedStart.length !== 1 || matches.generatedEnd.length !== 1 || matches.manualStart.length !== 1 || matches.manualEnd.length !== 1) {
+    issues.push({
+      code: "missing-markers",
+      message: "Mixed instruction file is missing one or more required region markers."
+    });
+    return { ok: false, issues };
+  }
+  const gs = matches.generatedStart[0];
+  const ge = matches.generatedEnd[0];
+  const ms = matches.manualStart[0];
+  const me = matches.manualEnd[0];
+  if (!(gs < ge && ge < ms && ms < me)) {
+    issues.push({
+      code: "out-of-order",
+      message: "Mixed instruction file region markers must appear in generated-start, generated-end, manual-start, manual-end order."
+    });
+    return { ok: false, issues };
+  }
+  if (gs !== 0) {
+    issues.push({
+      code: "preamble",
+      message: "Mixed instruction file must begin with the generated start marker; no preamble bytes are allowed."
+    });
+    return { ok: false, issues };
+  }
+  if (ms !== ge + 2 || (lines[ge + 1] ?? "") !== "") {
+    issues.push({
+      code: "missing-blank-line",
+      message: "Mixed instruction file must have exactly one blank line between the generated and manual regions."
+    });
+    return { ok: false, issues };
+  }
+  const trailingOk = lines.length === me + 1 && (lineEndings[me] ?? "").length > 0;
+  if (!trailingOk) {
+    issues.push({
+      code: "missing-trailing-newline",
+      message: "Mixed instruction file must end with the manual end marker followed by exactly one trailing newline."
+    });
+    return { ok: false, issues };
+  }
+  const generatedInnerBytes = computeRangeBytes(bytes, lines, lineEndings, gs, ge);
+  const manualInnerBytes = computeRangeBytes(bytes, lines, lineEndings, ms, me);
+  return {
+    ok: true,
+    generatedInner: generatedInnerBytes,
+    manualInner: manualInnerBytes,
+    generatedInnerHash: sha256Hex(generatedInnerBytes)
+  };
+}
+function computeCodeFenceMask(lines) {
+  const mask = new Array(lines.length).fill(false);
+  let open = false;
+  for (let index = 0; index < lines.length; index += 1) {
+    const line = lines[index] ?? "";
+    if (/^\s{0,3}(?:```|~~~)/u.test(line)) {
+      mask[index] = open || true;
+      open = !open;
+      continue;
+    }
+    mask[index] = open;
+  }
+  return mask;
+}
+function computeRangeBytes(bytes, lines, lineEndings, startMarkerIndex, endMarkerIndex) {
+  const startByte = computeByteOffsetAfterLine(lines, lineEndings, startMarkerIndex);
+  const endByte = computeByteOffsetAtLineStart(lines, lineEndings, endMarkerIndex);
+  return bytes.subarray(startByte, endByte);
+}
+function computeByteOffsetAfterLine(lines, lineEndings, lineIndex) {
+  let offset = 0;
+  for (let index = 0; index <= lineIndex; index += 1) {
+    offset += Buffer.byteLength(lines[index] ?? "", "utf8");
+    offset += Buffer.byteLength(lineEndings[index] ?? "", "utf8");
+  }
+  return offset;
+}
+function computeByteOffsetAtLineStart(lines, lineEndings, lineIndex) {
+  let offset = 0;
+  for (let index = 0; index < lineIndex; index += 1) {
+    offset += Buffer.byteLength(lines[index] ?? "", "utf8");
+    offset += Buffer.byteLength(lineEndings[index] ?? "", "utf8");
+  }
+  return offset;
+}
+function hasAnyRegionMarker(bytes) {
+  const lines = bytes.toString("utf8").split(/\r?\n/u);
+  const fence = computeCodeFenceMask(lines);
+  return lines.some(
+    (line, index) => !fence[index] && (GENERATED_START_RE.test(line) || GENERATED_END_RE.test(line) || MANUAL_START_RE.test(line) || MANUAL_END_RE.test(line))
+  );
+}
+function hasAllRegionMarkers(bytes) {
+  const lines = bytes.toString("utf8").split(/\r?\n/u);
+  const fence = computeCodeFenceMask(lines);
+  const present = (re) => lines.some((line, index) => !fence[index] && re.test(line));
+  return present(GENERATED_START_RE) && present(GENERATED_END_RE) && present(MANUAL_START_RE) && present(MANUAL_END_RE);
+}
+function hasLegacyGeneratedMarker(bytes) {
+  const text = bytes.toString("utf8");
+  return text.split(/\r?\n/u).some((line) => line === LEGACY_GENERATED_MARKER);
+}
+function serializeMixedFile(input) {
+  const manualInner = endsWithNewline(input.manualInner) ? input.manualInner : Buffer.concat([input.manualInner, Buffer.from("\n", "utf8")]);
+  const parts = [
+    Buffer.from(`${GENERATED_START_MARKER}
+`, "utf8"),
+    input.generatedInner,
+    Buffer.from(`${GENERATED_END_MARKER}
+`, "utf8"),
+    Buffer.from("\n", "utf8"),
+    Buffer.from(`${MANUAL_START_MARKER}
+`, "utf8"),
+    manualInner,
+    Buffer.from(`${MANUAL_END_MARKER}
+`, "utf8")
+  ];
+  return Buffer.concat(parts);
+}
+function endsWithNewline(bytes) {
+  if (bytes.length === 0) return false;
+  return bytes[bytes.length - 1] === 10;
+}
+function replaceGeneratedRegion(existing, newGeneratedInner) {
+  const parsed = parseMixedFile(existing);
+  if (!parsed.ok) return void 0;
+  const text = existing.toString("utf8");
+  let cursor = 0;
+  let position = 0;
+  let generatedStartInnerByte = -1;
+  let generatedEndLineStartByte = -1;
+  while (position < text.length) {
+    const newlineIndex = text.indexOf("\n", position);
+    const hasNewline = newlineIndex !== -1;
+    let lineEnd = hasNewline ? newlineIndex : text.length;
+    let endingLength = 0;
+    if (hasNewline) {
+      endingLength = 1;
+      if (lineEnd > position && text[lineEnd - 1] === "\r") {
+        lineEnd -= 1;
+        endingLength = 2;
+      }
+    }
+    const line = text.slice(position, lineEnd);
+    const lineBytes = Buffer.byteLength(line, "utf8");
+    if (line === GENERATED_START_MARKER && generatedStartInnerByte === -1) {
+      generatedStartInnerByte = cursor + lineBytes + endingLength;
+    }
+    if (line === GENERATED_END_MARKER && generatedEndLineStartByte === -1) {
+      generatedEndLineStartByte = cursor;
+    }
+    cursor += lineBytes + endingLength;
+    position = hasNewline ? newlineIndex + 1 : text.length;
+  }
+  if (generatedStartInnerByte === -1 || generatedEndLineStartByte === -1) {
+    return void 0;
+  }
+  const before = existing.subarray(0, generatedStartInnerByte);
+  const after = existing.subarray(generatedEndLineStartByte);
+  return Buffer.concat([before, newGeneratedInner, after]);
+}
 
 // ../../packages/core/src/profile.ts
 import {
@@ -1151,14 +1572,14 @@ function toValidationIssues(errors, rootValue) {
   return errors.map((error) => toValidationIssue(error, rootValue)).sort((left, right) => compareIssues(left, right));
 }
 function toValidationIssue(error, rootValue) {
-  const path6 = getErrorPath(error);
-  const code = path6 === "/version" && hasOwnProperty(rootValue, "version") ? "unsupported_schema_version" : "schema_validation_error";
+  const path7 = getErrorPath(error);
+  const code = path7 === "/version" && hasOwnProperty(rootValue, "version") ? "unsupported_schema_version" : "schema_validation_error";
   return {
     code,
-    path: path6,
+    path: path7,
     expected: getExpected(error),
     actual: getActual(error, rootValue),
-    message: getMessage(error, path6)
+    message: getMessage(error, path7)
   };
 }
 function getErrorPath(error) {
@@ -1209,20 +1630,20 @@ function getActual(error, rootValue) {
   }
   return describeValue2(getValueAtJsonPointer(rootValue, error.instancePath));
 }
-function getMessage(error, path6) {
+function getMessage(error, path7) {
   switch (error.keyword) {
     case "required":
-      return `${path6} is required.`;
+      return `${path7} is required.`;
     case "additionalProperties":
-      return `${path6} is not allowed.`;
+      return `${path7} is not allowed.`;
     case "const":
-      return `${path6} must match the supported constant.`;
+      return `${path7} must match the supported constant.`;
     case "enum":
-      return `${path6} must be one of the supported values.`;
+      return `${path7} must be one of the supported values.`;
     case "type":
-      return `${path6} has the wrong type.`;
+      return `${path7} has the wrong type.`;
     default:
-      return `${path6} ${error.message ?? "is invalid"}.`;
+      return `${path7} ${error.message ?? "is invalid"}.`;
   }
 }
 function compareIssues(left, right) {
@@ -2072,6 +2493,8 @@ ${topic.agentsMdChecklistReference}
 
 // ../../packages/compiler/src/compiler.ts
 var WORKFLOW_SKILLS = [
+  { id: "grill-change", workflowFlag: "sdd" },
+  { id: "request-to-spec-issues", workflowFlag: "sdd" },
   { id: "sdd-change", workflowFlag: "sdd" },
   { id: "tdd-change", workflowFlag: "tdd" },
   { id: "final-review", workflowFlag: "finalReview" },
@@ -2110,6 +2533,10 @@ var TEMPLATE_SOURCES = [
     "targets/tabnine-guidelines/00-general-agent-behavior@1",
     renderGeneralAgentBehaviorTemplateSource
   ),
+  guidelineTemplateSource(
+    "targets/tabnine-guidelines/05-planning-workflow@1",
+    renderPlanningWorkflowGuideline
+  ),
   guidelineTemplateSource(
     "targets/tabnine-guidelines/10-sdd-workflow@1",
     renderSddWorkflowGuideline
@@ -2162,6 +2589,16 @@ var TEMPLATE_SOURCES = [
     version: "1",
     source: renderCodexConfigToml()
   },
+  workflowSkillTemplateSource(
+    "targets/codex-workflow-skills/grill-change@1",
+    "codex-workflow-skills",
+    "grill-change"
+  ),
+  workflowSkillTemplateSource(
+    "targets/codex-workflow-skills/request-to-spec-issues@1",
+    "codex-workflow-skills",
+    "request-to-spec-issues"
+  ),
   workflowSkillTemplateSource(
     "targets/codex-workflow-skills/sdd-change@1",
     "codex-workflow-skills",
@@ -2200,6 +2637,16 @@ var TEMPLATE_SOURCES = [
     version: "1",
     source: renderClaudeMd()
   },
+  workflowSkillTemplateSource(
+    "targets/claude-workflow-skills/grill-change@1",
+    "claude-workflow-skills",
+    "grill-change"
+  ),
+  workflowSkillTemplateSource(
+    "targets/claude-workflow-skills/request-to-spec-issues@1",
+    "claude-workflow-skills",
+    "request-to-spec-issues"
+  ),
   workflowSkillTemplateSource(
     "targets/claude-workflow-skills/sdd-change@1",
     "claude-workflow-skills",
@@ -2233,7 +2680,10 @@ function compileProfile(request) {
   const targets = uniqueTargets(
     request.targets ?? getEnabledTargetIds(request.profile)
   );
-  const templates = request.templates ?? mergeTemplates(getDefaultTemplates(), getSubagentTemplates(request.profile));
+  const templates = request.templates ?? mergeTemplates(
+    getDefaultTemplates(),
+    getSubagentTemplates(request.profile)
+  );
   const issues = validateTargets(request.profile, targets, templates);
   if (issues.length > 0) {
     return {
@@ -2244,7 +2694,10 @@ function compileProfile(request) {
   const files = targets.flatMap(
     (target) => renderTarget(target, request.profile)
   );
-  const requiredTemplateIds = getRequiredTemplateIdSet(targets, request.profile);
+  const requiredTemplateIds = getRequiredTemplateIdSet(
+    targets,
+    request.profile
+  );
   return {
     ok: true,
     files: files.sort(compareGeneratedFiles),
@@ -2321,6 +2774,10 @@ ${renderTopicAsAgentsMdSection(REFACTORING_TOPIC)}` : "";
 ${renderTopicAsAgentsMdSection(DOCUMENTATION_TOPIC)}` : "";
   return normalizeGeneratedText(`# AGENTS.md
 
+## Instruction Precedence
+
+If generated and manual instructions conflict, follow the manual project instructions unless they would weaken safety, privacy, or permission limits. Safety, privacy, and explicit deny rules always win.
+
 ## Project
 
 Name: ${escapeMarkdownText(profile.profile.name)}
@@ -2380,6 +2837,10 @@ Cursor, Aider, Copilot, hosted gateways, enterprise RBAC, SIEM integrations, and
 function renderClaudeMd() {
   return `<!-- Generated by Agent Profile Compiler. Do not edit by hand. -->
 
+## Instruction Precedence
+
+If generated and manual instructions conflict, follow the manual project instructions unless they would weaken safety, privacy, or permission limits. Safety, privacy, and explicit deny rules always win.
+
 @AGENTS.md
 
 # Claude Code
@@ -2498,6 +2959,14 @@ function renderTabnineGuidelines(profile) {
     )
   ];
   if (profile.workflow.sdd) {
+    files.push(
+      createGeneratedTextFile(
+        ".tabnine/guidelines/05-planning-workflow.md",
+        common.target,
+        "targets/tabnine-guidelines/05-planning-workflow@1",
+        renderPlanningWorkflowGuideline()
+      )
+    );
     files.push(
       createGeneratedTextFile(
         ".tabnine/guidelines/10-sdd-workflow.md",
@@ -2617,6 +3086,195 @@ function getWorkflowSkillTemplateId(target, skill) {
 }
 function renderWorkflowSkill(skill) {
   switch (skill) {
+    case "grill-change":
+      return `---
+name: grill-change
+description: Use when a stakeholder request is rough, ambiguous, or underspecified and needs clarification before planning, writing a spec, or creating issues.
+---
+
+<!-- Generated by Agent Profile Compiler. Do not edit by hand. -->
+
+# Grill Change
+
+## Purpose
+
+Clarify a stakeholder request before any spec, issue plan, or implementation work starts. The output is an agreement record for a follow-up synthesis workflow; it is not an implementation plan.
+
+## Operating Rules
+
+1. Ask one focused question, then wait for the user's answer.
+2. Include a recommended answer with the question and explain why that answer is safest for the project.
+3. Inspect relevant local specs, ADRs, docs, fixtures, and code before asking questions that local context can answer.
+4. Challenge vague terms, overloaded words, and claims that conflict with repository evidence.
+5. Prefer concrete examples, edge cases, and tradeoff choices over broad brainstorming.
+6. Keep implementation details provisional until the product intent and non-goals are settled.
+7. Capture durable terms and hard-to-reverse decisions in the agreement record when they crystallize.
+8. Do not create issue lists, edit files, or start implementation during the grill.
+
+## Question Format
+
+Use this shape for each question:
+
+Question: \`<one decision or missing fact>\`
+Recommended answer: \`<the default direction you would choose>\`
+Why: \`<short reason based on product intent, safety, contracts, or repo evidence>\`
+
+## Decision Checks
+
+Before ending the grill, confirm:
+
+- the problem in the stakeholder's terms
+- the desired outcome
+- explicit non-goals
+- product intent and why the change matters
+- tradeoff direction for ambiguous implementation choices
+- user-visible behavior changes
+- compatibility and migration expectations
+- durable terminology and hard-to-reverse decisions
+- safety and privacy constraints
+- unresolved unknowns, if any
+
+## Output
+
+When the user agrees the grill is complete, return:
+
+- Problem
+- Intent
+- Non-goals
+- Decisions made
+- Durable terms and hard-to-reverse decisions
+- Decision rules for implementation tradeoffs
+- Open questions or risks
+- Confirmation that post-grill synthesis can run next
+
+## Safety
+
+- Do not upload source code.
+- Do not read or print secrets.
+- Do not ask for credentials, environment values, production data, or private endpoints.
+- Do not propose \`bypassPermissions\`, tool pre-approval, dependency auto-installation, hosted execution, or remote MCP behavior.
+- Do not write files, create issues, commit changes, or run implementation commands during the grill.
+`;
+    case "request-to-spec-issues":
+      return `---
+name: request-to-spec-issues
+description: Use after a grill-change session is complete to turn the agreement record into an intent-first spec candidate and vertical TDD-ready issue briefs.
+---
+
+<!-- Generated by Agent Profile Compiler. Do not edit by hand. -->
+
+# Request To Spec Issues
+
+## Purpose
+
+Convert a completed \`grill-change\` agreement record into an intent-first spec candidate and vertical TDD-ready issue briefs. Preserve product intent and decision rules so implementation choices follow the agreed direction.
+
+## Preconditions
+
+- The grill is complete.
+- The user has confirmed the direction is ready for synthesis.
+- Relevant local specs, ADRs, docs, fixtures, and code context have been checked.
+- If there is no completed grill agreement, stop and run \`grill-change\` first.
+
+## Synthesis Rules
+
+1. Do not re-interview the user unless the grill record contains a contradiction or a genuinely missing decision.
+2. Keep product intent, non-goals, durable terms, and hard-to-reverse decisions above implementation mechanics.
+3. Preserve existing spec contracts and safety rules unless the user explicitly approved changing them.
+4. Split work into vertical behavior slices, not file layers.
+5. Make every issue small enough for a focused RED, GREEN, refactor loop.
+6. Mark dependencies and parallel-safe work explicitly.
+7. Propose architecture rescue candidates before feature slices when a change would deepen an already fragmented codebase.
+
+## Architecture Rescue Candidates
+
+When architecture rescue is needed, propose candidates before feature issues. Each candidate must include:
+
+- Files or modules involved
+- Current friction
+- Proposed deeper module or clearer interface
+- Expected locality and leverage improvement
+- Expected test improvement
+- ADR or spec conflicts
+- Recommended dependency state: prerequisite, parallel, or later cleanup
+
+## Spec Candidate
+
+Include these sections:
+
+- Status
+- Problem
+- Goal
+- Intent
+- Decision Rules
+- Non-Goals
+- User Flow
+- Inputs
+- Outputs
+- Contracts
+- Security Rules
+- Acceptance Criteria
+- Tests
+- TDD Strategy
+- Issue Plan
+- Documentation Updates
+- Final Review Checklist
+
+\`TDD Strategy\` complements \`Tests\`; it must not replace the required \`Tests\`
+section from \`docs/specs/SPEC_TEMPLATE.md\`.
+
+## Issue Brief Format
+
+Each issue brief must include:
+
+- Title
+- Parent spec or request
+- Intent summary
+- Behavior slice
+- Non-goals
+- Acceptance criteria
+- Expected RED proof
+- Expected GREEN proof
+- Test command guidance
+- Likely file ownership
+- Dependencies
+- Parallelism notes
+- Contract impact
+- Security impact
+- Documentation impact
+- Implementation context
+- Review expectations
+
+## Dependency States
+
+Use these states:
+
+- \`ready\`
+- \`blocked\`
+- \`parallel-safe\`
+- \`sequenced\`
+- \`human-gate\`
+
+## Output
+
+Return:
+
+- Spec candidate or spec patch
+- Vertical issue briefs
+- Dependency map
+- Parallelism map
+- Human gates
+- Recommended next step
+
+## Safety
+
+- Do not upload source code.
+- Do not read or print secrets.
+- Do not include credentials, environment values, production data, or private endpoints.
+- Do not create GitHub issues, labels, projects, or milestones.
+- Do not write files unless the user explicitly asks for local file writes after reviewing the synthesis.
+- Do not propose \`bypassPermissions\`, tool pre-approval, dependency auto-installation, hosted execution, or remote MCP behavior.
+`;
     case "sdd-change":
       return `---
 name: sdd-change
@@ -2790,6 +3448,23 @@ Use the repository-local profile as the source of truth for agent behavior.
 - Ask before mutating files, running shell commands, installing dependencies, or using external network access.
 `;
 }
+function renderPlanningWorkflowGuideline() {
+  return `<!-- Generated by Agent Profile Compiler. Do not edit by hand. -->
+
+# Planning Workflow
+
+Use this before implementation when a stakeholder request is rough, ambiguous, or not yet tied to an approved spec.
+
+- Clarify the request one decision at a time before writing or changing specs.
+- Provide a recommended answer and short rationale for each open decision.
+- Check local specs, ADRs, docs, fixtures, and generated artifacts before asking questions.
+- Preserve product intent, non-goals, tradeoffs, durable terms, and hard-to-reverse decisions.
+- If no completed clarification exists, complete the grill-style clarification first.
+- After clarification, prepare an intent-first spec candidate and vertical TDD-ready issue briefs.
+- Include dependencies, expected RED proof, expected GREEN proof, file ownership, contract impact, security impact, and review expectations in each issue brief.
+- Do not create GitHub issues, write files, upload source, read secrets, install dependencies, or change runtime permissions unless explicitly requested and allowed.
+`;
+}
 function renderSddWorkflowGuideline() {
   return `<!-- Generated by Agent Profile Compiler. Do not edit by hand. -->
 
@@ -2953,13 +3628,13 @@ function renderClaudeSubagent(agent, effective) {
     lines.push("tools: Read, Glob, Grep");
   } else {
     const tools = ["Read", "Glob", "Grep"];
-    if (effective.filesystem.write === "allow") {
+    if (effective.filesystem.write !== "deny") {
       tools.push("Edit", "Write");
     }
-    if (effective.shell.run === "allow") {
+    if (effective.shell.run !== "deny") {
       tools.push("Bash");
     }
-    if (effective.network.external === "allow") {
+    if (effective.network.external !== "deny") {
       tools.push("WebFetch");
     }
     lines.push(`tools: ${tools.join(", ")}`);
@@ -2973,7 +3648,9 @@ function renderClaudeSubagent(agent, effective) {
     lines.push(`maxTurns: ${agent.maxTurns}`);
   }
   lines.push("---", "");
-  lines.push("<!-- Generated by Agent Profile Compiler. Do not edit by hand. -->");
+  lines.push(
+    "<!-- Generated by Agent Profile Compiler. Do not edit by hand. -->"
+  );
   lines.push("");
   lines.push(`# ${titleCaseFromKebab(agent.name)}`);
   lines.push("");
@@ -3021,7 +3698,9 @@ function renderTabnineSubagent(agent) {
     lines.push(`timeout_mins: ${agent.timeoutMinutes}`);
   }
   lines.push("---", "");
-  lines.push("<!-- Generated by Agent Profile Compiler. Do not edit by hand. -->");
+  lines.push(
+    "<!-- Generated by Agent Profile Compiler. Do not edit by hand. -->"
+  );
   lines.push("");
   lines.push(`# ${titleCaseFromKebab(agent.name)}`);
   lines.push("");
@@ -3163,7 +3842,9 @@ function validateTargets(profile, targets, templates) {
   const enabledTargets = new Set(getEnabledTargetIds(profile));
   const issues = [];
   if (profile.workflow.subagentDrivenDevelopment === true) {
-    const refs = new Set(getSubagentTemplateRefs(profile));
+    const refs = new Set(
+      getSubagentTemplateRefs(profile)
+    );
     const missing = SUBAGENT_TEMPLATE_NAMES.filter((name) => !refs.has(name));
     if (missing.length > 0) {
       issues.push({
@@ -3320,6 +4001,7 @@ function getRequiredAgentsMdTopicTemplateIds(profile) {
 function getRequiredTabnineGuidelineTemplateIds(profile) {
   const ids = ["targets/tabnine-guidelines/00-general-agent-behavior@1"];
   if (profile.workflow.sdd) {
+    ids.push("targets/tabnine-guidelines/05-planning-workflow@1");
     ids.push("targets/tabnine-guidelines/10-sdd-workflow@1");
   }
   if (profile.workflow.tdd) {
@@ -3469,6 +4151,11 @@ async function assertWritePathContained(rootRealPath, relativePath) {
   }
   const existingTarget = await lstatOptional(absolutePath);
   if (existingTarget) {
+    if (existingTarget.isSymbolicLink()) {
+      throw new Error(
+        `Planned write target is a symlink (refusing to follow): ${safePath}`
+      );
+    }
     const targetRealPath = await fsPromises.realpath(absolutePath);
     if (!isContainedBy(rootRealPath, targetRealPath)) {
       throw new Error(`Planned write target escapes root: ${safePath}`);
@@ -3484,7 +4171,8 @@ async function assertWritePathContained(rootRealPath, relativePath) {
 async function findExistingAncestor(startPath) {
   let current = startPath;
   while (true) {
-    if (await lstatOptional(current)) {
+    const stat = await lstatOptional(current);
+    if (stat) {
       return current;
     }
     const parent = path.dirname(current);
@@ -3506,8 +4194,7 @@ async function readOptionalFile(absolutePath) {
 }
 async function lstatOptional(absolutePath) {
   try {
-    await fsPromises.lstat(absolutePath);
-    return true;
+    return await fsPromises.lstat(absolutePath);
   } catch (error) {
     if (isNodeError(error) && error.code === "ENOENT") {
       return void 0;
@@ -3523,28 +4210,648 @@ function isNodeError(error) {
   return error instanceof Error && "code" in error;
 }
 
-// ../../packages/scanner/src/stack.ts
+// ../../packages/compiler/src/import-report.ts
 import fsPromises2 from "node:fs/promises";
 import path2 from "node:path";
-import { parse as parseYaml } from "yaml";
-var EMPTY_STACK = {
-  languages: [],
-  frameworks: [],
-  packageManagers: [],
-  testing: []
-};
-var VITE_CONFIGS = [
-  "vite.config.js",
-  "vite.config.mjs",
-  "vite.config.cjs",
-  "vite.config.ts",
-  "vite.config.mts",
-  "vite.config.cts"
+var PHASE_14_SUPPORTED_PATHS = [
+  { path: "AGENTS.md", kind: "root-instructions", isLocalRuntime: false },
+  { path: "CLAUDE.md", kind: "root-instructions", isLocalRuntime: false },
+  { path: ".claude/settings.json", kind: "client-config", isLocalRuntime: false },
+  {
+    path: ".claude/settings.local.json",
+    kind: "client-config",
+    isLocalRuntime: true
+  },
+  { path: ".codex/config.toml", kind: "client-config", isLocalRuntime: true },
+  { path: ".codex/hooks.json", kind: "client-config", isLocalRuntime: true },
+  { path: ".mcp.json", kind: "mcp-config", isLocalRuntime: true }
 ];
-var SVELTE_CONFIGS = [
-  "svelte.config.js",
-  "svelte.config.mjs",
-  "svelte.config.cjs",
+var PHASE_14_SCAN_DIRS = [
+  {
+    root: ".agents/skills",
+    kind: "workflow-skill",
+    fileFilter: (rel) => rel.endsWith("/SKILL.md"),
+    recursive: true
+  },
+  {
+    root: ".claude/skills",
+    kind: "workflow-skill",
+    fileFilter: (rel) => rel.endsWith("/SKILL.md"),
+    recursive: true
+  },
+  {
+    root: ".claude/agents",
+    kind: "subagent",
+    fileFilter: (rel) => rel.endsWith(".md"),
+    recursive: false
+  },
+  {
+    root: ".codex/agents",
+    kind: "subagent",
+    fileFilter: (rel) => rel.endsWith(".toml"),
+    recursive: false
+  },
+  {
+    root: ".tabnine/agent/agents",
+    kind: "subagent",
+    fileFilter: (rel) => rel.endsWith(".md"),
+    recursive: false
+  }
+];
+var RECOMMENDED_IGNORE_LINES = [
+  ".cce/",
+  ".mcp.json",
+  ".claude/settings.local.json",
+  ".claude/worktrees/",
+  ".codex/config.toml",
+  ".codex/hooks.json"
+];
+async function buildPhase14ImportReport(input) {
+  const files = [];
+  let wouldUpdateRegions = 0;
+  let preservedManualFiles = 0;
+  let conflicts = 0;
+  const collisionsByKey = /* @__PURE__ */ new Map();
+  const lockfile = await readLockfileForRegions(input.rootDir);
+  const ownershipByPath = /* @__PURE__ */ new Map();
+  if (lockfile) {
+    for (const output of lockfile.outputs) {
+      ownershipByPath.set(output.path, output.ownership);
+    }
+  }
+  for (const entry of PHASE_14_SUPPORTED_PATHS) {
+    const read = await readRegionAwareFile(input.rootDir, entry.path);
+    if (read.refused) {
+      files.push({
+        path: entry.path,
+        exists: true,
+        kind: entry.kind,
+        ownership: "unknown",
+        tags: [],
+        action: "refuse-conflict",
+        notes: ["symlinked; Phase 14 refuses to follow file symlinks"]
+      });
+      conflicts += 1;
+      continue;
+    }
+    const existing = read.bytes;
+    if (!existing) {
+      if (entry.kind === "root-instructions") {
+        files.push({
+          path: entry.path,
+          exists: false,
+          kind: entry.kind,
+          ownership: "unknown",
+          tags: [],
+          action: "create",
+          notes: []
+        });
+      }
+      continue;
+    }
+    const bytes = Buffer.from(existing);
+    const tags = [];
+    if (entry.isLocalRuntime) {
+      tags.push("local-runtime");
+    }
+    if (containsAbsolutePathLiteral(bytes)) {
+      tags.push("contains-absolute-path");
+    }
+    if (entry.kind === "client-config" && !entry.isLocalRuntime) {
+      const ownership = ownershipByPath.get(entry.path) ?? "generated-owned";
+      files.push({
+        path: entry.path,
+        exists: true,
+        kind: entry.kind,
+        ownership,
+        tags,
+        action: "preserve",
+        notes: [
+          "generated client config; refresh via `agent-profile compile --write`"
+        ]
+      });
+      preservedManualFiles += 1;
+      continue;
+    }
+    if (entry.kind !== "root-instructions") {
+      files.push({
+        path: entry.path,
+        exists: true,
+        kind: entry.kind,
+        ownership: "manual-owned",
+        tags,
+        action: "ignore-local-runtime",
+        notes: entry.kind === "mcp-config" ? [
+          "contains MCP entries; not imported into ai-profile.yaml in Phase 14"
+        ] : ["local runtime config; not adopted by Phase 14"]
+      });
+      preservedManualFiles += 1;
+      continue;
+    }
+    if (hasAllRegionMarkers(bytes)) {
+      const parsed = parseMixedFile(bytes);
+      if (!parsed.ok) {
+        files.push({
+          path: entry.path,
+          exists: true,
+          kind: entry.kind,
+          ownership: "unknown",
+          tags,
+          action: "refuse-conflict",
+          notes: parsed.issues.map((item) => item.message)
+        });
+        conflicts += 1;
+        continue;
+      }
+      files.push({
+        path: entry.path,
+        exists: true,
+        kind: entry.kind,
+        ownership: "mixed",
+        tags,
+        action: "update-generated-region",
+        notes: []
+      });
+      if (input.strategy === "regions") {
+        wouldUpdateRegions += 1;
+      }
+      continue;
+    }
+    if (hasAnyRegionMarker(bytes)) {
+      files.push({
+        path: entry.path,
+        exists: true,
+        kind: entry.kind,
+        ownership: "unknown",
+        tags,
+        action: "refuse-conflict",
+        notes: ["partial region markers; manual repair required"]
+      });
+      conflicts += 1;
+      continue;
+    }
+    if (hasLegacyGeneratedMarker(bytes)) {
+      tags.push("generated-looking");
+    }
+    if (input.strategy === "regions") {
+      files.push({
+        path: entry.path,
+        exists: true,
+        kind: entry.kind,
+        ownership: "unknown",
+        tags,
+        action: "insert-regions",
+        notes: ["existing content will be preserved in manual region"]
+      });
+      wouldUpdateRegions += 1;
+    } else {
+      files.push({
+        path: entry.path,
+        exists: true,
+        kind: entry.kind,
+        ownership: "unknown",
+        tags,
+        action: "preserve",
+        notes: [
+          "Run init --import --strategy regions --write to adopt into mixed ownership"
+        ]
+      });
+      preservedManualFiles += 1;
+    }
+  }
+  for (const scan of PHASE_14_SCAN_DIRS) {
+    const { files: discovered, refusals: scanRefusals } = await listFilesUnder(
+      input.rootDir,
+      scan.root,
+      scan.recursive
+    );
+    for (const refusedPath of scanRefusals) {
+      files.push({
+        path: refusedPath,
+        exists: true,
+        kind: scan.kind,
+        ownership: "unknown",
+        tags: [],
+        action: "refuse-conflict",
+        notes: ["symlinked; Phase 14 refuses to follow file symlinks"]
+      });
+      conflicts += 1;
+    }
+    for (const relativePath of discovered) {
+      if (!scan.fileFilter(relativePath)) continue;
+      const read = await readRegionAwareFile(input.rootDir, relativePath);
+      const tags = [];
+      if (read.bytes) {
+        const name = extractDeclaredName(
+          Buffer.from(read.bytes),
+          relativePath
+        );
+        if (name) {
+          recordName(
+            scan.kind === "workflow-skill" ? "workflow-skill" : "subagent",
+            name,
+            relativePath,
+            collisionsByKey
+          );
+        }
+      }
+      if (read.refused) {
+        files.push({
+          path: relativePath,
+          exists: true,
+          kind: scan.kind,
+          ownership: "unknown",
+          tags,
+          action: "refuse-conflict",
+          notes: ["symlinked; Phase 14 refuses to follow file symlinks"]
+        });
+        conflicts += 1;
+        continue;
+      }
+      if (!read.bytes) continue;
+      const lockOwnership = ownershipByPath.get(relativePath);
+      if (lockOwnership === "generated-owned") {
+        files.push({
+          path: relativePath,
+          exists: true,
+          kind: scan.kind,
+          ownership: "generated-owned",
+          tags,
+          action: "preserve",
+          notes: [
+            "lockfile-owned generated output; refresh via `agent-profile compile --write`"
+          ]
+        });
+        preservedManualFiles += 1;
+        continue;
+      }
+      if (lockOwnership === "mixed") {
+        files.push({
+          path: relativePath,
+          exists: true,
+          kind: scan.kind,
+          ownership: "mixed",
+          tags,
+          action: "update-generated-region",
+          notes: [
+            "lockfile-owned mixed file; generated region is updated on compile --write"
+          ]
+        });
+        if (input.strategy === "regions") {
+          wouldUpdateRegions += 1;
+        }
+        continue;
+      }
+      files.push({
+        path: relativePath,
+        exists: true,
+        kind: scan.kind,
+        ownership: "manual-owned",
+        tags,
+        action: "preserve",
+        notes: [
+          scan.kind === "workflow-skill" ? "existing workflow skill; not adopted as generated output" : "existing subagent file; not adopted as generated output"
+        ]
+      });
+      preservedManualFiles += 1;
+    }
+  }
+  const gitignoreFindings = await getLocalRuntimeGitignoreFindings(
+    input.rootDir
+  );
+  const gitignore = gitignoreFindings.map(
+    (finding) => ({
+      path: ".gitignore",
+      line: finding.line,
+      action: finding.action === "already-present" ? "already-present" : input.mode === "write" ? "would-add" : "suggest-add",
+      reason: finding.reason
+    })
+  );
+  const collisions = [];
+  for (const [key, paths] of collisionsByKey) {
+    if (paths.length < 2) continue;
+    const [kindPart, name] = key.split("\0");
+    collisions.push({
+      name,
+      kind: kindPart === "workflow-skill" ? "workflow-skill" : "subagent",
+      paths: [...paths].sort()
+    });
+    for (const collidingPath of paths) {
+      const row = files.find((f) => f.path === collidingPath);
+      if (row && !row.notes.some((n) => n.startsWith("name collision"))) {
+        const others = paths.filter((p) => p !== collidingPath).sort();
+        row.notes.push(
+          `name collision: "${name}" also declared by ${others.join(", ")}`
+        );
+      }
+    }
+  }
+  collisions.sort((left, right) => {
+    if (left.kind !== right.kind) {
+      return left.kind === "workflow-skill" ? -1 : 1;
+    }
+    return left.name < right.name ? -1 : left.name > right.name ? 1 : 0;
+  });
+  return {
+    command: "init",
+    mode: input.mode,
+    strategy: input.strategy,
+    root: ".",
+    profilePath: input.profilePath,
+    stack: {
+      languages: [...input.stack.languages].sort(),
+      frameworks: [...input.stack.frameworks].sort(),
+      packageManagers: [...input.stack.packageManagers].sort(),
+      testing: [...input.stack.testing].sort()
+    },
+    files: files.sort(
+      (left, right) => left.path < right.path ? -1 : left.path > right.path ? 1 : 0
+    ),
+    gitignore,
+    collisions,
+    summary: {
+      wouldCreateProfile: input.wouldCreateProfile,
+      wouldUpdateRegions,
+      preservedManualFiles,
+      conflicts,
+      nameCollisions: collisions.length
+    }
+  };
+}
+function recordName(kind, name, path7, map) {
+  const key = `${kind}\0${name}`;
+  const existing = map.get(key);
+  if (existing) {
+    existing.push(path7);
+  } else {
+    map.set(key, [path7]);
+  }
+}
+function extractDeclaredName(bytes, relativePath) {
+  const text = bytes.toString("utf8");
+  if (relativePath.endsWith(".toml")) {
+    return findTomlTopLevelName(text);
+  }
+  if (relativePath.endsWith(".md")) {
+    return findYamlFrontmatterName(text);
+  }
+  return void 0;
+}
+function findYamlFrontmatterName(text) {
+  const lines = text.split(/\r?\n/u);
+  if (lines.length === 0 || lines[0].trim() !== "---") return void 0;
+  for (let index = 1; index < lines.length; index += 1) {
+    const line = lines[index];
+    const trimmed = line.trim();
+    if (trimmed === "---") return void 0;
+    if (!line.startsWith("name")) continue;
+    const match = line.match(/^name\s*:\s*(.+?)\s*$/u);
+    if (!match) continue;
+    return stripYamlQuotes(match[1]);
+  }
+  return void 0;
+}
+function findTomlTopLevelName(text) {
+  const lines = text.split(/\r?\n/u);
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (trimmed.startsWith("#") || trimmed === "") continue;
+    if (trimmed.startsWith("[")) break;
+    const match = trimmed.match(/^name\s*=\s*(.+?)\s*$/u);
+    if (!match) continue;
+    return stripTomlQuotes(stripInlineTomlComment(match[1]));
+  }
+  return void 0;
+}
+function stripInlineTomlComment(value) {
+  let inDoubleQuote = false;
+  let inSingleQuote = false;
+  for (let index = 0; index < value.length; index += 1) {
+    const char = value[index];
+    if (char === '"' && !inSingleQuote) {
+      if (inDoubleQuote && value[index - 1] === "\\") continue;
+      inDoubleQuote = !inDoubleQuote;
+      continue;
+    }
+    if (char === "'" && !inDoubleQuote) {
+      inSingleQuote = !inSingleQuote;
+      continue;
+    }
+    if (char === "#" && !inDoubleQuote && !inSingleQuote) {
+      return value.slice(0, index).replace(/\s+$/u, "");
+    }
+  }
+  return value.replace(/\s+$/u, "");
+}
+function stripYamlQuotes(value) {
+  if (value.length >= 2) {
+    const first = value[0];
+    const last = value[value.length - 1];
+    if (first === '"' && last === '"' || first === "'" && last === "'") {
+      return value.slice(1, -1);
+    }
+  }
+  return value;
+}
+function stripTomlQuotes(value) {
+  if (value.startsWith('"') && value.endsWith('"') && value.length >= 2) {
+    return value.slice(1, -1);
+  }
+  if (value.startsWith("'") && value.endsWith("'") && value.length >= 2) {
+    return value.slice(1, -1);
+  }
+  return value;
+}
+async function readRegionAwareFile(rootDir, relativePath) {
+  const safePath = safeOutputPath(relativePath);
+  const absolutePath = path2.resolve(rootDir, ...safePath.split("/"));
+  let stat;
+  try {
+    stat = await fsPromises2.lstat(absolutePath);
+  } catch (error) {
+    if (isNodeNotFound(error)) {
+      return { refused: false, bytes: void 0 };
+    }
+    throw error;
+  }
+  if (stat.isSymbolicLink()) {
+    return { refused: true };
+  }
+  if (!stat.isFile()) {
+    return { refused: false, bytes: void 0 };
+  }
+  return { refused: false, bytes: await fsPromises2.readFile(absolutePath) };
+}
+async function listFilesUnder(rootDir, relativeRoot, recursive) {
+  const files = [];
+  const refusals = [];
+  const rootStat = await lstatOptional2(path2.join(rootDir, relativeRoot));
+  if (!rootStat) {
+    return { files: [], refusals: [] };
+  }
+  if (rootStat.isSymbolicLink()) {
+    return { files: [], refusals: [relativeRoot] };
+  }
+  if (!rootStat.isDirectory()) {
+    return { files: [], refusals: [] };
+  }
+  await walk(rootDir, relativeRoot, recursive, files, refusals);
+  return { files: files.sort(), refusals: refusals.sort() };
+}
+async function walk(rootDir, relativeRoot, recursive, out, refusals) {
+  let entries;
+  try {
+    entries = await fsPromises2.readdir(path2.join(rootDir, relativeRoot), {
+      withFileTypes: true
+    });
+  } catch (error) {
+    if (isNodeNotFound(error)) return;
+    throw error;
+  }
+  for (const entry of entries) {
+    const child = `${relativeRoot}/${entry.name}`;
+    if (entry.isSymbolicLink()) {
+      refusals.push(child);
+      continue;
+    }
+    if (entry.isDirectory() && recursive) {
+      await walk(rootDir, child, recursive, out, refusals);
+      continue;
+    }
+    if (entry.isFile()) {
+      out.push(child);
+    }
+  }
+}
+async function lstatOptional2(absolutePath) {
+  try {
+    return await fsPromises2.lstat(absolutePath);
+  } catch (error) {
+    if (isNodeNotFound(error)) return void 0;
+    throw error;
+  }
+}
+async function readOptionalBytes(rootDir, relativePath) {
+  const result = await readRegionAwareFile(rootDir, relativePath);
+  if (result.refused) return void 0;
+  return result.bytes;
+}
+async function readOptionalText(rootDir, relativePath) {
+  const bytes = await readOptionalBytes(rootDir, relativePath);
+  if (!bytes) return void 0;
+  return Buffer.from(bytes).toString("utf8");
+}
+async function readLockfileForRegions(rootDir) {
+  const bytes = await readOptionalBytes(rootDir, "ai-profile.lock");
+  if (!bytes) return void 0;
+  const result = validateLockfileText(Buffer.from(bytes).toString("utf8"));
+  if (!result.ok) return void 0;
+  return toLockfileV2View(result.lockfile);
+}
+async function getLocalRuntimeGitignoreFindings(rootDir) {
+  const gitignore = await readOptionalText(rootDir, ".gitignore").catch(
+    () => void 0
+  );
+  const lines = (gitignore ?? "").split(/\r?\n/u).map((line) => line.trim()).filter((line) => line !== "" && !line.startsWith("#"));
+  const findings = [];
+  for (const recommended of RECOMMENDED_IGNORE_LINES) {
+    const present = lines.some((line) => {
+      const a = line.replace(/^\//u, "").replace(/\/$/u, "");
+      const b = recommended.replace(/\/$/u, "");
+      return a === b;
+    });
+    findings.push({
+      line: recommended,
+      action: present ? "already-present" : "would-add",
+      reason: "local runtime or machine-specific path"
+    });
+  }
+  return findings;
+}
+function containsAbsolutePathLiteral(bytes) {
+  const text = bytes.toString("utf8");
+  return /[A-Z]:\\\\|"\/[A-Za-z]/u.test(text);
+}
+function isNodeNotFound(error) {
+  return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
+}
+var REGION_AWARE_ROOT_PATHS = ["AGENTS.md", "CLAUDE.md"];
+async function planRootInstructionsAdoption(rootDir, generatedBytesByPath = /* @__PURE__ */ new Map()) {
+  const results = [];
+  for (const relativePath of REGION_AWARE_ROOT_PATHS) {
+    const read = await readRegionAwareFile(rootDir, relativePath);
+    if (read.refused) {
+      results.push({ ok: false, path: relativePath, reason: "symlink" });
+      continue;
+    }
+    const existing = read.bytes;
+    if (!existing) {
+      results.push({ ok: false, path: relativePath, reason: "missing-file" });
+      continue;
+    }
+    const compiled = generatedBytesByPath.get(relativePath);
+    if (!compiled) {
+      results.push({
+        ok: false,
+        path: relativePath,
+        reason: "missing-generated-bytes"
+      });
+      continue;
+    }
+    const generatedInner = Buffer.from(compiled);
+    const existingBuffer = Buffer.from(existing);
+    if (hasAllRegionMarkers(existingBuffer)) {
+      const updated = replaceGeneratedRegion(existingBuffer, generatedInner);
+      if (updated) {
+        results.push({ ok: true, path: relativePath, bytes: updated });
+      } else {
+        results.push({
+          ok: false,
+          path: relativePath,
+          reason: "duplicate-markers"
+        });
+      }
+      continue;
+    }
+    if (hasAnyRegionMarker(existingBuffer)) {
+      results.push({
+        ok: false,
+        path: relativePath,
+        reason: "partial-markers"
+      });
+      continue;
+    }
+    const mixed = serializeMixedFile({
+      generatedInner,
+      manualInner: existingBuffer
+    });
+    results.push({ ok: true, path: relativePath, bytes: mixed });
+  }
+  return results;
+}
+
+// ../../packages/scanner/src/stack.ts
+import fsPromises3 from "node:fs/promises";
+import path3 from "node:path";
+import { parse as parseYaml } from "yaml";
+var EMPTY_STACK = {
+  languages: [],
+  frameworks: [],
+  packageManagers: [],
+  testing: []
+};
+var VITE_CONFIGS = [
+  "vite.config.js",
+  "vite.config.mjs",
+  "vite.config.cjs",
+  "vite.config.ts",
+  "vite.config.mts",
+  "vite.config.cts"
+];
+var SVELTE_CONFIGS = [
+  "svelte.config.js",
+  "svelte.config.mjs",
+  "svelte.config.cjs",
   "svelte.config.ts"
 ];
 var PLAYWRIGHT_CONFIGS = [
@@ -3556,7 +4863,7 @@ var PLAYWRIGHT_CONFIGS = [
   "playwright.config.cts"
 ];
 async function detectStack(rootDir) {
-  const rootPath = path2.resolve(rootDir);
+  const rootPath = path3.resolve(rootDir);
   const stack = cloneStack(EMPTY_STACK);
   const warnings = [];
   if (await fileExists(rootPath, "tsconfig.json")) {
@@ -3599,7 +4906,7 @@ async function detectPackageJson(rootPath, stack, warnings) {
   let value;
   try {
     value = JSON.parse(
-      await fsPromises2.readFile(path2.join(rootPath, "package.json"), "utf8")
+      await fsPromises3.readFile(path3.join(rootPath, "package.json"), "utf8")
     );
   } catch {
     warnings.push({
@@ -3686,7 +4993,7 @@ async function detectPubspecYaml(rootPath, stack, warnings) {
   let value;
   try {
     value = parseYaml(
-      await fsPromises2.readFile(path2.join(rootPath, "pubspec.yaml"), "utf8")
+      await fsPromises3.readFile(path3.join(rootPath, "pubspec.yaml"), "utf8")
     );
   } catch {
     warnings.push({
@@ -3762,8 +5069,8 @@ function hasAny(keys, allowlist) {
   return false;
 }
 async function detectJavaMetadata(rootPath, relativePath, stack) {
-  const source = await fsPromises2.readFile(
-    path2.join(rootPath, relativePath),
+  const source = await fsPromises3.readFile(
+    path3.join(rootPath, relativePath),
     "utf8"
   );
   if (source.includes("spring-boot-starter")) {
@@ -3783,7 +5090,7 @@ async function anyFileExists(rootPath, relativePaths) {
 }
 async function fileExists(rootPath, relativePath) {
   try {
-    const stats = await fsPromises2.lstat(path2.join(rootPath, relativePath));
+    const stats = await fsPromises3.lstat(path3.join(rootPath, relativePath));
     return stats.isFile();
   } catch (error) {
     if (isNodeError2(error) && error.code === "ENOENT") {
@@ -3855,7 +5162,7 @@ function isNodeError2(error) {
 
 // ../../packages/scanner/src/import-artifacts.ts
 import { lstat, readdir, readFile, realpath } from "node:fs/promises";
-import path3 from "node:path";
+import path4 from "node:path";
 var GENERATED_MARKDOWN_MARKER = "<!-- Generated by Agent Profile Compiler. Do not edit by hand. -->";
 var SUPPORTED_CONFIG_PATHS = [
   "AGENTS.md",
@@ -3866,7 +5173,7 @@ var SUPPORTED_CONFIG_PATHS = [
   ".mcp.json"
 ];
 async function analyzeExistingArtifacts(rootDir) {
-  const rootPath = await realpath(path3.resolve(rootDir));
+  const rootPath = await realpath(path4.resolve(rootDir));
   const findings = [];
   const clients = {
     tabnine: false,
@@ -3878,7 +5185,7 @@ async function analyzeExistingArtifacts(rootDir) {
     ...await collectTabnineGuidelines(rootPath, findings)
   ].sort(compareText3);
   for (const relativePath of paths) {
-    const source = await readOptionalText(rootPath, relativePath, findings);
+    const source = await readOptionalText2(rootPath, relativePath, findings);
     if (source === void 0) {
       continue;
     }
@@ -3932,7 +5239,7 @@ async function collectTabnineGuidelines(rootPath, findings) {
   }
   return entries.filter((entry) => entry.endsWith(".md")).map((entry) => `.tabnine/guidelines/${entry}`);
 }
-async function readOptionalText(rootPath, relativePath, findings) {
+async function readOptionalText2(rootPath, relativePath, findings) {
   const artifactPath = resolveArtifactPath(rootPath, relativePath);
   try {
     const stats = await lstat(artifactPath);
@@ -3957,7 +5264,7 @@ async function readOptionalText(rootPath, relativePath, findings) {
   }
 }
 function resolveArtifactPath(rootPath, relativePath) {
-  return path3.join(rootPath, ...relativePath.split("/"));
+  return path4.join(rootPath, ...relativePath.split("/"));
 }
 function unsafeSymlinkFinding(relativePath) {
   return {
@@ -4028,8 +5335,8 @@ function compareText3(left, right) {
   return 0;
 }
 function isContainedBy2(rootPath, candidatePath) {
-  const relative = path3.relative(rootPath, candidatePath);
-  return relative === "" || !relative.startsWith("..") && !path3.isAbsolute(relative);
+  const relative = path4.relative(rootPath, candidatePath);
+  return relative === "" || !relative.startsWith("..") && !path4.isAbsolute(relative);
 }
 function getRecord2(value) {
   if (typeof value === "object" && value !== null && !Array.isArray(value)) {
@@ -4042,8 +5349,8 @@ function isNodeError3(error) {
 }
 
 // ../../packages/doctor/src/doctor.ts
-import { readdir as readdir2, readFile as readFile2 } from "node:fs/promises";
-import path4 from "node:path";
+import { lstat as lstat2, readdir as readdir2, readFile as readFile2 } from "node:fs/promises";
+import path5 from "node:path";
 var PROFILE_PATH = "ai-profile.yaml";
 var LOCKFILE_PATH = "ai-profile.lock";
 var SKILL_ROOTS = [".agents/skills", ".claude/skills"];
@@ -4053,7 +5360,7 @@ var SEVERITY_ORDER = {
   info: 2
 };
 async function runDoctor(request = {}) {
-  const rootDir = path4.resolve(request.rootDir ?? ".");
+  const rootDir = path5.resolve(request.rootDir ?? ".");
   const issues = [];
   const profileBytes = await readKnownFile(rootDir, PROFILE_PATH);
   if (!profileBytes.ok) {
@@ -4113,13 +5420,15 @@ async function runDoctor(request = {}) {
   await checkSemanticWarnings(rootDir, compileResult.files, issues);
   await checkGitignoreSecretHygiene(rootDir, issues);
   const lockfile = await readAndValidateLockfile(rootDir, issues);
-  if (lockfile) {
+  const lockfileV2 = lockfile ? toLockfileV2View(lockfile) : void 0;
+  await checkRegionFiles(rootDir, compileResult.files, lockfileV2, issues);
+  if (lockfileV2) {
     await checkLockfileDrift({
       rootDir,
       profileBytes: profileBytes.bytes,
       templates: compileResult.templates,
       files: compileResult.files,
-      lockfile,
+      lockfile: lockfileV2,
       issues
     });
   }
@@ -4129,9 +5438,16 @@ async function runDoctor(request = {}) {
     profile: profileResult.profile,
     effective: deriveEffectivePermissions(profileResult.profile),
     generatedFiles: compileResult.files,
-    lockfile,
+    lockfile: lockfileV2,
     issues
   });
+  await checkLocalRuntimeGitignore(rootDir, issues);
+  await checkForeignSkillAndSubagentCollisions(
+    rootDir,
+    compileResult.files,
+    lockfileV2,
+    issues
+  );
   return toResult(issues);
 }
 async function checkGeneratedArtifactsExist(rootDir, files, issues) {
@@ -4358,7 +5674,8 @@ async function checkLockfileDrift(input) {
   const expectedLockfileText = createLockfileFile({
     profileBytes: input.profileBytes,
     templates: input.templates,
-    files: input.files
+    files: input.files,
+    mixedOutputs: collectMixedOutputDescriptorsFromLockfile(input.lockfile)
   });
   const expectedLockfile = JSON.parse(
     Buffer.from(expectedLockfileText.bytes).toString("utf8")
@@ -4391,23 +5708,51 @@ async function checkLockfileDrift(input) {
     input.lockfile.outputs.map((output) => [outputKey(output), output])
   );
   for (const output of expectedLockfile.outputs) {
+    if (output.ownership === "manual-owned") {
+      continue;
+    }
     const lockOutput = lockOutputsByKey.get(outputKey(output));
-    const expectedHash = lockOutput?.sha256 ?? output.sha256;
     const current = await readKnownFile(input.rootDir, output.path);
     if (!current.ok) {
+      const isLocalRuntime = LOCAL_RUNTIME_IGNORE_PATHS.some(
+        (line) => line.replace(/\/$/u, "") === output.path
+      );
       input.issues.push(
         issue(
           "LINT-LOCK-006",
-          "error",
+          isLocalRuntime ? "warning" : "error",
           output.path,
           "generated file present",
           "missing",
-          `${output.path} is listed in ai-profile.lock but is missing.`,
-          "Run the compiler after reviewing generated file changes."
+          `${output.path} is listed in ai-profile.lock but is missing${isLocalRuntime ? " (local-runtime path; regenerated by compile --write)" : ""}.`,
+          isLocalRuntime ? "Run agent-profile compile --write to materialize the local-runtime file; it is intentionally not committed." : "Run the compiler after reviewing generated file changes."
         )
       );
       continue;
     }
+    if (output.ownership === "mixed") {
+      const lockRegion = lockOutput && lockOutput.ownership === "mixed" ? lockOutput.regions[0] : output.regions[0];
+      const expectedHash2 = lockRegion?.sha256 ?? output.regions[0]?.sha256 ?? "";
+      const parsed = parseMixedFile(Buffer.from(current.bytes));
+      if (!parsed.ok) {
+        continue;
+      }
+      if (parsed.generatedInnerHash !== expectedHash2) {
+        input.issues.push(
+          issue(
+            "LINT-REGION-004",
+            "error",
+            output.path,
+            expectedHash2,
+            parsed.generatedInnerHash,
+            `${output.path} generated region hash differs from ai-profile.lock.`,
+            "Run the compiler after reviewing the generated region diff."
+          )
+        );
+      }
+      continue;
+    }
+    const expectedHash = lockOutput && lockOutput.ownership === "generated-owned" ? lockOutput.sha256 : output.sha256;
     const currentHash = sha256Hex(current.bytes);
     if (currentHash !== expectedHash) {
       input.issues.push(
@@ -4424,6 +5769,21 @@ async function checkLockfileDrift(input) {
     }
   }
 }
+function collectMixedOutputDescriptorsFromLockfile(lockfile) {
+  const result = [];
+  for (const output of lockfile.outputs) {
+    if (output.ownership !== "mixed") continue;
+    const region = output.regions[0];
+    if (!region) continue;
+    result.push({
+      path: output.path,
+      target: region.target,
+      templateId: region.templateId,
+      regionHash: region.sha256
+    });
+  }
+  return result;
+}
 function compareTemplates2(actual, expected, issues) {
   const actualMap = new Map(
     actual.map((template) => [templateKey(template), template])
@@ -4500,14 +5860,16 @@ function compareOutputs(actual, expected, issues) {
       );
       continue;
     }
-    if (actualOutput.templateId !== expectedOutput.templateId || actualOutput.sha256 !== expectedOutput.sha256) {
+    const expectedSig = describeOutputSignature(expectedOutput);
+    const actualSig = describeOutputSignature(actualOutput);
+    if (expectedSig !== actualSig) {
       issues.push(
         issue(
           "LINT-LOCK-005",
           "error",
           expectedOutput.path,
-          `${expectedOutput.templateId}/${expectedOutput.sha256}`,
-          `${actualOutput.templateId}/${actualOutput.sha256}`,
+          expectedSig,
+          actualSig,
           `${expectedOutput.path} lockfile output metadata differs from current compiler output.`,
           "Regenerate generated outputs and ai-profile.lock after reviewing changes."
         )
@@ -4530,6 +5892,16 @@ function compareOutputs(actual, expected, issues) {
     }
   }
 }
+function describeOutputSignature(output) {
+  if (output.ownership === "mixed") {
+    const region = output.regions[0];
+    return `mixed/${output.templateId}/${region?.sha256 ?? ""}`;
+  }
+  if (output.ownership === "manual-owned") {
+    return "manual-owned/manual/-";
+  }
+  return `generated/${output.templateId}/${output.sha256}`;
+}
 async function checkPermissionPosture(rootDir, profile, issues) {
   const safety = normalizeSafety(profile);
   const effective = deriveEffectivePermissions(profile);
@@ -5281,42 +6653,42 @@ function checkClaudeSubagentFile(relativePath, text, effective, issues) {
     );
   }
   const tools = parseClaudeToolList(frontmatter.tools);
-  if (tools.includes("Bash") && effective.shell.run !== "allow") {
+  if (tools.includes("Bash") && effective.shell.run === "deny") {
     issues.push(
       issue(
         "LINT-SUBAGENT-001",
         "error",
         relativePath,
-        "tools narrower than effectivePermissions.shell.run",
+        "tools narrower than effectivePermissions.shell.run=deny",
         "Bash tool granted",
-        `${relativePath} grants the Bash tool while effectivePermissions.shell.run is ${effective.shell.run}.`,
-        "Remove Bash from the Claude subagent tools list or tighten effectivePermissions."
+        `${relativePath} grants the Bash tool while effectivePermissions.shell.run is deny.`,
+        "Remove Bash from the Claude subagent tools list or relax shell.run from deny."
       )
     );
   }
-  if (tools.some((tool) => CLAUDE_WRITE_TOOLS.has(tool)) && effective.filesystem.write !== "allow") {
+  if (tools.some((tool) => CLAUDE_WRITE_TOOLS.has(tool)) && effective.filesystem.write === "deny") {
     issues.push(
       issue(
         "LINT-SUBAGENT-001",
         "error",
         relativePath,
-        "tools narrower than effectivePermissions.filesystem.write",
+        "tools narrower than effectivePermissions.filesystem.write=deny",
         "Edit/Write tool granted",
-        `${relativePath} grants write tools while effectivePermissions.filesystem.write is ${effective.filesystem.write}.`,
-        "Remove Edit/Write from the Claude subagent tools list or tighten effectivePermissions."
+        `${relativePath} grants write tools while effectivePermissions.filesystem.write is deny.`,
+        "Remove Edit/Write from the Claude subagent tools list or relax filesystem.write from deny."
       )
     );
   }
-  if (tools.includes("WebFetch") && effective.network.external !== "allow") {
+  if (tools.includes("WebFetch") && effective.network.external === "deny") {
     issues.push(
       issue(
         "LINT-SUBAGENT-001",
         "error",
         relativePath,
-        "tools narrower than effectivePermissions.network.external",
+        "tools narrower than effectivePermissions.network.external=deny",
         "WebFetch tool granted",
-        `${relativePath} grants the WebFetch tool while effectivePermissions.network.external is ${effective.network.external}.`,
-        "Remove WebFetch from the Claude subagent tools list or tighten effectivePermissions."
+        `${relativePath} grants the WebFetch tool while effectivePermissions.network.external is deny.`,
+        "Remove WebFetch from the Claude subagent tools list or relax network.external from deny."
       )
     );
   }
@@ -5419,7 +6791,7 @@ function parseTabnineToolList(text, inlineValue) {
 async function collectSubagentFilesUnder(rootDir, relativeRoot) {
   let entries;
   try {
-    entries = await readdir2(path4.join(rootDir, relativeRoot), {
+    entries = await readdir2(path5.join(rootDir, relativeRoot), {
       withFileTypes: true
     });
   } catch (error) {
@@ -5445,7 +6817,7 @@ async function collectSkillFiles(rootDir) {
 async function collectSkillFilesUnder(rootDir, relativeRoot, files) {
   let entries;
   try {
-    entries = await readdir2(path4.join(rootDir, relativeRoot), {
+    entries = await readdir2(path5.join(rootDir, relativeRoot), {
       withFileTypes: true
     });
   } catch (error) {
@@ -5468,10 +6840,22 @@ async function readKnownFile(rootDir, relativePath) {
   if (safePath === ".env" || safePath.startsWith(".env.")) {
     return { ok: false };
   }
+  const absolutePath = path5.join(rootDir, safePath);
+  try {
+    const stat = await lstat2(absolutePath);
+    if (stat.isSymbolicLink()) {
+      return { ok: false };
+    }
+  } catch (error) {
+    if (isNodeError4(error) && error.code === "ENOENT") {
+      return { ok: false };
+    }
+    throw error;
+  }
   try {
     return {
       ok: true,
-      bytes: await readFile2(path4.join(rootDir, safePath))
+      bytes: await readFile2(absolutePath)
     };
   } catch (error) {
     if (isNodeError4(error) && error.code === "ENOENT") {
@@ -5646,19 +7030,662 @@ function decodeUtf8(bytes) {
 function isNodeError4(error) {
   return error instanceof Error && "code" in error;
 }
-
-// src/index.ts
-var DEFAULT_UI_HOST = "127.0.0.1";
-var DEFAULT_UI_PORT = 5174;
-var require2 = createRequire(import.meta.url);
-var CLIENT_IDS = ["tabnine", "codex", "claude"];
-var DEFAULT_IO = {
-  stdout: (text) => process.stdout.write(text),
-  stderr: (text) => process.stderr.write(text)
-};
+var REGION_FILE_PATHS = ["AGENTS.md", "CLAUDE.md"];
+var LOCAL_RUNTIME_IGNORE_PATHS = [
+  ".cce/",
+  ".mcp.json",
+  ".claude/settings.local.json",
+  ".claude/worktrees/",
+  ".codex/config.toml",
+  ".codex/hooks.json"
+];
+async function checkRegionFiles(rootDir, generatedFiles, lockfile, issues) {
+  const ownershipByPath = new Map(
+    (lockfile?.outputs ?? []).map((output) => [output.path, output.ownership])
+  );
+  for (const relativePath of REGION_FILE_PATHS) {
+    const current = await readKnownFile(rootDir, relativePath);
+    if (!current.ok) continue;
+    const bytes = Buffer.from(current.bytes);
+    const ownership = ownershipByPath.get(relativePath);
+    const allMarkers = hasAllRegionMarkers(bytes);
+    const anyMarkers = hasAnyRegionMarker(bytes);
+    const generatedFile = generatedFiles.find(
+      (file) => file.path === relativePath
+    );
+    if (ownership === "mixed") {
+      const parsed = parseMixedFile(bytes);
+      if (!parsed.ok) {
+        const code = parsed.issues.some(
+          (item) => item.code === "duplicate-markers"
+        ) ? "LINT-REGION-002" : "LINT-REGION-001";
+        issues.push(
+          issue(
+            code,
+            "error",
+            relativePath,
+            "valid generated/manual region markers",
+            "invalid region markers",
+            `${relativePath} region markers are not valid for a mixed-ownership file.`,
+            "Move or remove the file and re-run init --import --strategy regions --write."
+          )
+        );
+        continue;
+      }
+      if (!parsed.generatedInner.toString("utf8").includes(REGION_PRECEDENCE_TEXT)) {
+        issues.push(
+          issue(
+            "LINT-REGION-003",
+            "warning",
+            relativePath,
+            "required instruction precedence text in generated region",
+            "missing precedence text",
+            `${relativePath} generated region is missing the required precedence sentence.`,
+            "Re-run compile --write to refresh the generated region."
+          )
+        );
+      }
+      continue;
+    }
+    if (anyMarkers && !allMarkers) {
+      issues.push(
+        issue(
+          "LINT-REGION-001",
+          "error",
+          relativePath,
+          "valid generated/manual region markers",
+          "partial region markers",
+          `${relativePath} contains partial region markers.`,
+          "Move or remove the file and re-run init --import --strategy regions --write; the compiler will not auto-repair markers."
+        )
+      );
+      continue;
+    }
+    if (allMarkers) {
+      const parsed = parseMixedFile(bytes);
+      if (!parsed.ok) {
+        const code = parsed.issues.some(
+          (item) => item.code === "duplicate-markers"
+        ) ? "LINT-REGION-002" : "LINT-REGION-001";
+        issues.push(
+          issue(
+            code,
+            "error",
+            relativePath,
+            "valid generated/manual region markers",
+            "invalid region markers",
+            `${relativePath} region markers are not valid.`,
+            "Move or remove the file and re-run init --import --strategy regions --write."
+          )
+        );
+      }
+      continue;
+    }
+    if (generatedFile && ownership !== "generated-owned" && !allMarkers && hasLegacyGeneratedMarker(bytes)) {
+      issues.push(
+        issue(
+          "LINT-OWN-002",
+          "warning",
+          relativePath,
+          "lockfile-owned generated file",
+          "generated-looking file without lockfile ownership",
+          `${relativePath} contains the legacy generated marker but is not lockfile-owned.`,
+          "Run init --import --strategy regions --write to adopt the file into mixed ownership, or remove and re-run compile --write."
+        )
+      );
+      continue;
+    }
+    if (generatedFile && ownership !== "generated-owned" && !allMarkers) {
+      issues.push(
+        issue(
+          "LINT-OWN-001",
+          "error",
+          relativePath,
+          "lockfile-owned or mixed ownership",
+          "unknown ownership conflicts with generated output",
+          `${relativePath} exists but ownership cannot be proven; the compiler will refuse to write it.`,
+          "Run init --import --strategy regions --write to adopt the file into mixed ownership."
+        )
+      );
+    }
+  }
+}
+async function checkLocalRuntimeGitignore(rootDir, issues) {
+  const gitignore = await readKnownFile(rootDir, ".gitignore");
+  const lines = gitignore.ok ? decodeUtf8(gitignore.bytes).split(/\r?\n/u).map((line) => line.trim()).filter((line) => line !== "" && !line.startsWith("#")) : [];
+  for (const recommended of LOCAL_RUNTIME_IGNORE_PATHS) {
+    const targetPath = recommended.replace(/\/$/u, "");
+    const exists = await pathExists(rootDir, targetPath);
+    if (!exists) continue;
+    if (!isIgnoreLinePresent(lines, recommended)) {
+      issues.push(
+        issue(
+          "LINT-GITIGNORE-002",
+          "warning",
+          ".gitignore",
+          `ignore line for ${recommended}`,
+          "missing",
+          `${recommended} exists locally but is not listed in .gitignore.`,
+          "Run agent-profile init --update-gitignore --write to add recommended ignore lines."
+        )
+      );
+    }
+  }
+}
+async function pathExists(rootDir, relativePath) {
+  try {
+    safeOutputPath(relativePath);
+  } catch {
+    return false;
+  }
+  try {
+    const { lstat: lstat3 } = await import("node:fs/promises");
+    await lstat3(path5.join(rootDir, relativePath));
+    return true;
+  } catch (error) {
+    if (isNodeError4(error) && error.code === "ENOENT") {
+      return false;
+    }
+    throw error;
+  }
+}
+function isIgnoreLinePresent(lines, target) {
+  const trimmed = target.replace(/\/$/u, "");
+  return lines.some((line) => {
+    const normalized = line.replace(/^\//u, "").replace(/\/$/u, "");
+    return normalized === trimmed;
+  });
+}
+async function checkForeignSkillAndSubagentCollisions(rootDir, generatedFiles, lockfile, issues) {
+  const ownedPaths = new Set(
+    (lockfile?.outputs ?? []).map((output) => output.path)
+  );
+  const generatedSkillByName = /* @__PURE__ */ new Map();
+  const generatedSubagentByName = /* @__PURE__ */ new Map();
+  const pushByName = (map, name, entry) => {
+    const list = map.get(name) ?? [];
+    list.push(entry);
+    map.set(name, list);
+  };
+  for (const file of generatedFiles) {
+    const name = parseSkillOrSubagentName(decodeUtf8(file.bytes));
+    if (!name) continue;
+    if (file.target === "codex-workflow-skills" || file.target === "claude-workflow-skills") {
+      pushByName(generatedSkillByName, name, {
+        path: file.path,
+        runtime: pathRuntime(file.path)
+      });
+    }
+    if (file.target === "claude-subagents" || file.target === "codex-subagents" || file.target === "tabnine-subagents") {
+      pushByName(generatedSubagentByName, name, {
+        path: file.path,
+        runtime: pathRuntime(file.path)
+      });
+    }
+  }
+  const skillFiles = await collectSkillFiles(rootDir);
+  for (const skillPath of skillFiles) {
+    if (ownedPaths.has(skillPath)) continue;
+    const generatedPath = generatedFiles.find(
+      (file2) => file2.path === skillPath
+    );
+    const file = await readKnownFile(rootDir, skillPath);
+    if (!file.ok) continue;
+    const text = decodeUtf8(file.bytes);
+    const name = parseSkillOrSubagentName(text);
+    if (generatedPath) {
+      issues.push(
+        issue(
+          "LINT-OWN-001",
+          "error",
+          skillPath,
+          "lockfile-owned generated skill",
+          "foreign skill at generated path",
+          `${skillPath} exists at a generated output path but is not lockfile-owned.`,
+          "Move or rename the existing skill, or run compile --write --force only after reviewing the diff."
+        )
+      );
+      continue;
+    }
+    if (name && generatedSkillByName.has(name)) {
+      const entries = generatedSkillByName.get(name);
+      const others = entries.filter((entry) => entry.path !== skillPath);
+      if (others.length > 0) {
+        const foreignRuntime = pathRuntime(skillPath);
+        const matching = others.find(
+          (entry) => entry.runtime !== void 0 && entry.runtime === foreignRuntime
+        );
+        const referencePath = (matching ?? others[0]).path;
+        const severity = matching ? "error" : "warning";
+        issues.push(
+          issue(
+            "LINT-SKILL-009",
+            severity,
+            skillPath,
+            "skill name distinct from generated skills",
+            `name collides with generated ${referencePath}`,
+            `${skillPath} declares skill name ${name}, which collides with generated ${referencePath}${matching ? ` for the ${matching.runtime} runtime` : ""}.`,
+            matching ? `Rename the foreign skill; both files target the ${matching.runtime} runtime and would load the same name.` : "Rename the foreign skill or move it to a different name to avoid runtime collision."
+          )
+        );
+      }
+    }
+  }
+  const subagentFiles = [];
+  for (const root of SUBAGENT_ROOTS) {
+    const files = await collectSubagentFilesUnder(rootDir, root);
+    for (const file of files) subagentFiles.push(file);
+  }
+  for (const subagentPath of subagentFiles) {
+    if (ownedPaths.has(subagentPath)) continue;
+    const generatedPath = generatedFiles.find(
+      (file2) => file2.path === subagentPath
+    );
+    const file = await readKnownFile(rootDir, subagentPath);
+    if (!file.ok) continue;
+    const text = decodeUtf8(file.bytes);
+    const name = parseSkillOrSubagentName(text);
+    if (generatedPath) {
+      issues.push(
+        issue(
+          "LINT-OWN-001",
+          "error",
+          subagentPath,
+          "lockfile-owned generated subagent",
+          "foreign subagent at generated path",
+          `${subagentPath} exists at a generated output path but is not lockfile-owned.`,
+          "Move or rename the existing subagent, or run compile --write --force only after reviewing the diff."
+        )
+      );
+      continue;
+    }
+    if (name && generatedSubagentByName.has(name)) {
+      const entries = generatedSubagentByName.get(name);
+      const others = entries.filter((entry) => entry.path !== subagentPath);
+      if (others.length > 0) {
+        const foreignRuntime = pathRuntime(subagentPath);
+        const matching = others.find(
+          (entry) => entry.runtime !== void 0 && entry.runtime === foreignRuntime
+        );
+        const referencePath = (matching ?? others[0]).path;
+        const severity = matching ? "error" : "warning";
+        issues.push(
+          issue(
+            "LINT-SUBAGENT-009",
+            severity,
+            subagentPath,
+            "subagent name distinct from generated subagents",
+            `name collides with generated ${referencePath}`,
+            `${subagentPath} declares subagent name ${name}, which collides with generated ${referencePath}${matching ? ` for the ${matching.runtime} runtime` : ""}.`,
+            matching ? `Rename the foreign subagent; both files target the ${matching.runtime} runtime and would load the same name.` : "Rename the foreign subagent to avoid runtime collision."
+          )
+        );
+      }
+    }
+  }
+}
+function pathRuntime(filePath) {
+  if (filePath.startsWith(".agents/skills/") || filePath.startsWith(".codex/agents/")) {
+    return "codex";
+  }
+  if (filePath.startsWith(".claude/skills/") || filePath.startsWith(".claude/agents/")) {
+    return "claude";
+  }
+  if (filePath.startsWith(".tabnine/agent/agents/")) {
+    return "tabnine";
+  }
+  return void 0;
+}
+function parseSkillOrSubagentName(text) {
+  const fm = parseMarkdownFrontmatter(text);
+  if (typeof fm.name === "string" && fm.name.length > 0) return fm.name;
+  const tomlMatch = /^\s*name\s*=\s*"([^"]+)"/mu.exec(text);
+  if (tomlMatch && tomlMatch[1]) return tomlMatch[1];
+  return void 0;
+}
+
+// src/wizard.ts
+import { createInterface } from "node:readline/promises";
+var WIZARD_CLIENT_IDS = [
+  "tabnine",
+  "codex",
+  "claude"
+];
+function isNonInteractive(input) {
+  if (input.flag) return true;
+  if (input.override === true) return true;
+  if (input.override === false) return false;
+  if (input.env.CI === "true" || input.env.CI === "1") return true;
+  if (!input.stdin || input.stdin.isTTY !== true) return true;
+  if (!input.stdout || input.stdout.isTTY !== true) return true;
+  return false;
+}
+function parseWizardClientSelection(raw) {
+  const normalized = raw.trim().toLowerCase();
+  if (normalized === "" || normalized === "none") return [];
+  const selected = [];
+  for (const token of normalized.split(/[;,]/u).map((item) => item.trim()).filter((item) => item !== "")) {
+    let client;
+    if (/^[0-9]+$/u.test(token)) {
+      client = WIZARD_CLIENT_IDS[Number.parseInt(token, 10) - 1];
+    } else if (WIZARD_CLIENT_IDS.includes(token)) {
+      client = token;
+    }
+    if (client && !selected.includes(client)) {
+      selected.push(client);
+    }
+  }
+  return WIZARD_CLIENT_IDS.filter((id) => selected.includes(id));
+}
+function formatWizardClientSelectionQuestion(defaults) {
+  const summary = WIZARD_CLIENT_IDS.map((id, index) => {
+    const enabled = defaults.includes(id);
+    return `  ${index + 1}) ${id}${enabled ? " (default)" : ""}`;
+  }).join("\n");
+  const fallback = defaults.length > 0 ? defaults.join(",") : "none";
+  return `Which clients should this profile enable?
+${summary}
+Select multiple with commas or semicolons, for example 2,3.
+Enter numbers or names, or press enter for defaults [${fallback}]: `;
+}
+function recommendStrategy(report) {
+  const warnings = [];
+  const rootFiles = report.files.filter(
+    (file) => file.kind === "root-instructions" && file.exists
+  );
+  const hasConflict = report.files.some(
+    (file) => file.action === "refuse-conflict"
+  );
+  if (hasConflict) {
+    warnings.push(
+      "foreign skill or subagent path conflict detected; review the wizard report before writing."
+    );
+  }
+  const hasLegacyMarker = rootFiles.some(
+    (file) => file.tags.includes("generated-looking")
+  );
+  if (hasLegacyMarker) {
+    warnings.push(
+      "existing instruction file looks generated by a previous compiler version; preserved as manual content."
+    );
+  }
+  const hasUnmarkedSupported = rootFiles.some(
+    (file) => file.ownership !== "mixed" && file.ownership !== "generated-owned" && !file.tags.includes("generated-looking") && file.action !== "refuse-conflict"
+  );
+  if (hasConflict || hasLegacyMarker) {
+    return {
+      strategy: "preserve",
+      reason: hasConflict ? "conflicts must be resolved before adopting region ownership." : "legacy generated marker detected; preserve until lockfile v2 records ownership.",
+      warnings
+    };
+  }
+  if (hasUnmarkedSupported) {
+    return {
+      strategy: "regions",
+      reason: "existing root instruction files can be adopted into mixed ownership and preserved in a manual region.",
+      warnings
+    };
+  }
+  const onlyMixed = rootFiles.length > 0 && rootFiles.every(
+    (file) => file.ownership === "mixed" || file.ownership === "generated-owned"
+  );
+  if (onlyMixed) {
+    return {
+      strategy: "preserve",
+      reason: "existing instruction files already use mixed ownership.",
+      warnings
+    };
+  }
+  return {
+    strategy: "preserve",
+    reason: "no existing agent instruction files detected; create profile only.",
+    warnings
+  };
+}
+function formatWizardIntro(context, recommendation) {
+  const lines = [];
+  lines.push("Agent Profile Init", "");
+  lines.push("Detected:");
+  lines.push(`- languages: ${formatList(context.stack.languages)}`);
+  lines.push(
+    `- package managers: ${formatList(context.stack.packageManagers)}`
+  );
+  lines.push(
+    `- clients from existing files: ${formatList(context.detectedClients)}`
+  );
+  lines.push(
+    `- existing instruction files: ${formatList(existingRootInstructions(context.report))}`
+  );
+  lines.push(`- local runtime files: ${formatList(localRuntimePaths(context.report))}`);
+  lines.push(
+    `- generated client config: ${formatList(generatedClientConfigPaths(context.report))}`
+  );
+  const foreign = foreignWorkflowPaths(context.report);
+  if (foreign.length > 0) {
+    lines.push(`- foreign skills/subagents: ${formatList(foreign)}`);
+  }
+  lines.push("");
+  lines.push(`Recommended strategy: ${formatStrategyLabel(recommendation.strategy)}`);
+  lines.push(`Reason: ${recommendation.reason}`);
+  const conflictRows = context.report.files.filter(
+    (file) => file.action === "refuse-conflict"
+  );
+  if (conflictRows.length > 0) {
+    lines.push("", "Conflicts (must be resolved before writing):");
+    for (const row of conflictRows) {
+      lines.push(`  - ${row.path}: ${row.notes.join("; ") || "conflict"}`);
+    }
+  }
+  if (recommendation.warnings.length > 0) {
+    lines.push("", "Warnings:");
+    for (const warning of recommendation.warnings) {
+      lines.push(`  - ${warning}`);
+    }
+  }
+  lines.push("");
+  return `${lines.join("\n")}
+`;
+}
+function formatWizardPlan(context, outcome) {
+  const lines = [];
+  lines.push("Write plan:");
+  if (!context.hasExistingProfile) {
+    lines.push("- create ai-profile.yaml");
+  } else {
+    lines.push(
+      "- preserve ai-profile.yaml (already exists; init does not edit existing profiles)"
+    );
+  }
+  for (const file of context.report.files) {
+    if (file.kind === "root-instructions") {
+      if (!file.exists) {
+        continue;
+      }
+      if (outcome.strategy === "regions" && file.action === "insert-regions") {
+        lines.push(`- adopt ${file.path} into mixed ownership (manual region preserves existing content)`);
+      } else if (file.action === "update-generated-region") {
+        lines.push(`- update generated region in ${file.path}`);
+      } else {
+        lines.push(`- preserve ${file.path}`);
+      }
+      continue;
+    }
+    if (file.action === "refuse-conflict") {
+      lines.push(`- refuse ${file.path} (${file.notes.join("; ") || "conflict"})`);
+      continue;
+    }
+    if (file.tags.includes("local-runtime")) {
+      lines.push(`- preserve ${file.path} (local runtime)`);
+      continue;
+    }
+    if (file.kind === "client-config") {
+      lines.push(`- preserve ${file.path} (refresh via \`agent-profile compile --write\`)`);
+    }
+  }
+  if (outcome.updateGitignore) {
+    const adds = context.report.gitignore.filter(
+      (item) => item.action !== "already-present"
+    );
+    if (adds.length > 0) {
+      lines.push(
+        `- update .gitignore (${adds.map((item) => item.line).join(", ")})`
+      );
+    }
+  }
+  lines.push("");
+  lines.push(`Strategy: ${formatStrategyLabel(outcome.strategy)}`);
+  if (context.hasExistingProfile) {
+    lines.push("Clients: unchanged (existing profile)");
+  } else {
+    lines.push(`Clients to enable: ${formatList(outcome.clients)}`);
+  }
+  lines.push(`Update .gitignore: ${outcome.updateGitignore ? "yes" : "no"}`);
+  lines.push("");
+  return `${lines.join("\n")}
+`;
+}
+function formatWizardDeclined() {
+  return [
+    "No files written.",
+    "Re-run with --write or confirm in the wizard to write.",
+    ""
+  ].join("\n");
+}
+async function runInitWizard(input) {
+  const recommendation = input.recommendation ?? recommendStrategy(input.context.report);
+  input.io.stdout(formatWizardIntro(input.context, recommendation));
+  const strategy = await input.prompts.selectStrategy({
+    default: recommendation.strategy,
+    recommendation
+  });
+  let context = input.context;
+  if (input.rebuildReport && strategy !== "preserve") {
+    const refreshed = await input.rebuildReport(strategy);
+    context = { ...input.context, report: refreshed };
+  }
+  let normalizedClients;
+  if (context.hasExistingProfile) {
+    normalizedClients = WIZARD_CLIENT_IDS.filter(
+      (id) => context.detectedClients.includes(id)
+    );
+  } else {
+    const clientDefaults = context.detectedClients.length > 0 ? [...context.detectedClients] : [];
+    const clients = await input.prompts.selectClients({
+      defaults: clientDefaults
+    });
+    normalizedClients = WIZARD_CLIENT_IDS.filter(
+      (client) => clients.includes(client)
+    );
+  }
+  const gitignoreNeedsRecommendation = context.report.gitignore.some(
+    (item) => item.action !== "already-present"
+  );
+  const updateGitignore = gitignoreNeedsRecommendation ? await input.prompts.confirmGitignore({ default: false }) : false;
+  const outcomeDraft = {
+    confirmed: false,
+    strategy,
+    clients: normalizedClients,
+    updateGitignore
+  };
+  input.io.stdout(formatWizardPlan(context, outcomeDraft));
+  const confirmed = await input.prompts.confirmWritePlan({ default: false });
+  if (!confirmed) {
+    input.io.stdout(formatWizardDeclined());
+  }
+  return {
+    ...outcomeDraft,
+    confirmed
+  };
+}
+function createDefaultPrompts(io) {
+  const rl = createInterface({
+    input: process.stdin,
+    output: process.stdout,
+    terminal: true
+  });
+  const ask = async (question, fallback) => {
+    io.stdout(question);
+    const answer = await rl.question("");
+    return answer.trim() === "" ? fallback : answer.trim();
+  };
+  const confirm = async (question, def) => {
+    const suffix = def ? "[Y/n]" : "[y/N]";
+    const fallback = def ? "y" : "n";
+    const raw = await ask(`${question} ${suffix} `, fallback);
+    const lower = raw.toLowerCase();
+    if (lower === "y" || lower === "yes") return true;
+    if (lower === "n" || lower === "no") return false;
+    return def;
+  };
+  return {
+    async selectStrategy({ default: def }) {
+      const raw = await ask(
+        `How should existing agent instruction files be handled?
+  1) Preserve existing files${def === "preserve" ? " (default)" : ""}
+  2) Add generated regions${def === "regions" ? " (default)" : ""}
+Choose [1/2]: `,
+        def === "preserve" ? "1" : "2"
+      );
+      if (raw === "2" || raw.toLowerCase().startsWith("r")) return "regions";
+      if (raw === "1" || raw.toLowerCase().startsWith("p")) return "preserve";
+      return def;
+    },
+    async selectClients({ defaults }) {
+      const raw = await ask(
+        formatWizardClientSelectionQuestion(defaults),
+        defaults.join(",")
+      );
+      return parseWizardClientSelection(raw);
+    },
+    async confirmGitignore({ default: def }) {
+      return confirm(
+        "Add recommended local-runtime ignore entries to .gitignore?",
+        def
+      );
+    },
+    async confirmWritePlan({ default: def }) {
+      try {
+        return await confirm("Write this plan?", def);
+      } finally {
+        rl.close();
+      }
+    }
+  };
+}
+function formatList(values) {
+  return values.length === 0 ? "(none)" : values.join(", ");
+}
+function formatStrategyLabel(strategy) {
+  return strategy === "regions" ? "Add generated regions" : "Preserve existing files";
+}
+function existingRootInstructions(report) {
+  return report.files.filter((file) => file.kind === "root-instructions" && file.exists).map((file) => file.path);
+}
+function localRuntimePaths(report) {
+  return report.files.filter((file) => file.tags.includes("local-runtime") && file.exists).map((file) => file.path);
+}
+function generatedClientConfigPaths(report) {
+  return report.files.filter(
+    (file) => file.kind === "client-config" && !file.tags.includes("local-runtime") && file.exists
+  ).map((file) => file.path);
+}
+function foreignWorkflowPaths(report) {
+  return report.files.filter(
+    (file) => (file.kind === "workflow-skill" || file.kind === "subagent") && file.exists && file.ownership !== "generated-owned"
+  ).map((file) => file.path);
+}
+
+// src/index.ts
+var DEFAULT_UI_HOST = "127.0.0.1";
+var require2 = createRequire(import.meta.url);
+var CLIENT_IDS = ["tabnine", "codex", "claude"];
+var DEFAULT_IO = {
+  stdout: (text) => process.stdout.write(text),
+  stderr: (text) => process.stderr.write(text)
+};
 async function runCli(argv = process.argv.slice(2), options = {}) {
   const io = { ...DEFAULT_IO, ...options.io };
-  const cwd = path5.resolve(options.cwd ?? process.cwd());
+  const cwd = path6.resolve(options.cwd ?? process.cwd());
   if (argv.length === 0 || argv[0] === "--help" || argv[0] === "-h") {
     io.stdout(formatHelp());
     return 0;
@@ -5670,13 +7697,12 @@ async function runCli(argv = process.argv.slice(2), options = {}) {
     case "doctor":
       return runDoctorCommand(rest, cwd, io);
     case "init":
-      return runInit(
-        rest,
-        cwd,
-        io,
-        options.presetNow,
-        options.presetVerificationKeys
-      );
+      return runInit(rest, cwd, io, {
+        ...options.presetNow ? { presetNow: options.presetNow } : {},
+        ...options.presetVerificationKeys ? { presetVerificationKeys: options.presetVerificationKeys } : {},
+        ...options.prompts ? { prompts: options.prompts } : {},
+        ...options.nonInteractive !== void 0 ? { nonInteractive: options.nonInteractive } : {}
+      });
     case "ui":
       return runUi(rest, cwd, io, options.launchUi ?? launchPublishedUi);
     default:
@@ -5698,16 +7724,32 @@ ${formatHelp()}`);
     io.stdout(formatHelp());
     return 0;
   }
-  const rootDir = path5.resolve(cwd, parsed.root);
-  const portCheck = await assertPortAvailable(parsed.host, parsed.port);
-  if (!portCheck.ok) {
-    io.stderr(
-      `Port ${parsed.port} is not available on ${parsed.host}. Another process may be listening; choose a different port with --port <number>.
+  const rootDir = path6.resolve(cwd, parsed.root);
+  let resolvedPort;
+  if (parsed.port === "auto") {
+    const ephemeral = await reserveEphemeralPort(parsed.host);
+    if (!ephemeral.ok) {
+      io.stderr(
+        `No ephemeral loopback port could be reserved on ${parsed.host}. Specify --port <number> explicitly.
 `
-    );
-    return 1;
+      );
+      return 1;
+    }
+    resolvedPort = ephemeral.port;
+  } else {
+    const portCheck = await assertPortAvailable(parsed.host, parsed.port);
+    if (!portCheck.ok) {
+      io.stderr(
+        `Port ${parsed.port} is not available on ${parsed.host}. Another process may be listening; choose a different port with --port <number>.
+`
+      );
+      return 1;
+    }
+    resolvedPort = parsed.port;
   }
-  const url = formatUiUrl(parsed.host, parsed.port);
+  const sessionToken = generateSessionToken();
+  const url = formatUiUrl(parsed.host, resolvedPort, sessionToken);
+  const open = parsed.open ?? isInteractiveTty(io);
   io.stdout(`Agent Profile UI
 `);
   io.stdout(`url: ${url}
@@ -5721,8 +7763,9 @@ ${formatHelp()}`);
   return launchUi({
     rootDir,
     host: parsed.host,
-    port: parsed.port,
-    open: parsed.open
+    port: resolvedPort,
+    open,
+    sessionToken
   });
 }
 async function runDoctorCommand(args, cwd, io) {
@@ -5738,7 +7781,7 @@ ${formatHelp()}`);
     return 0;
   }
   const result = await runDoctor({
-    rootDir: path5.resolve(cwd, parsed.root)
+    rootDir: path6.resolve(cwd, parsed.root)
   });
   if (parsed.json) {
     io.stdout(`${JSON.stringify(result, null, 2)}
@@ -5760,7 +7803,7 @@ ${formatHelp()}`);
     io.stdout(formatHelp());
     return 0;
   }
-  const rootDir = path5.resolve(cwd, parsed.root);
+  const rootDir = path6.resolve(cwd, parsed.root);
   const safeProfilePath = toSafeCliPath(parsed.profile);
   if (!safeProfilePath.ok) {
     io.stderr(`${safeProfilePath.message}
@@ -5769,7 +7812,7 @@ ${formatHelp()}`);
   }
   let profileBytes;
   try {
-    profileBytes = await readOptionalBytes(rootDir, safeProfilePath.path);
+    profileBytes = await readOptionalBytes2(rootDir, safeProfilePath.path);
   } catch (error) {
     if (!isUnsafePathError(error)) {
       io.stderr(
@@ -5821,13 +7864,60 @@ ${formatHelp()}`);
     io.stderr(formatCompileIssues(compileResult.issues));
     return 1;
   }
+  let regionPlan;
+  try {
+    regionPlan = await planRegionAwareWrites(rootDir, compileResult.files, {
+      force: parsed.force
+    });
+  } catch {
+    io.stderr(
+      formatSimpleError(
+        "generated outputs",
+        "safe repository-local readable paths",
+        "unsafe path",
+        "Existing generated output paths could not be safely read under --root."
+      )
+    );
+    return 1;
+  }
+  if (regionPlan.refusals.length > 0) {
+    const hashMismatches = regionPlan.refusals.filter(
+      (item) => item.reason === "hash-mismatch"
+    );
+    const adoptionRefusals = regionPlan.refusals.filter(
+      (item) => item.reason !== "hash-mismatch"
+    );
+    const lines = [];
+    if (adoptionRefusals.length > 0) {
+      lines.push(
+        "Refusing to overwrite region-aware instruction files without explicit adoption:",
+        ...adoptionRefusals.map(
+          (item) => `- ${item.path} (${item.reason})`
+        ),
+        "Run `agent-profile init --import --strategy regions --write` to adopt existing files into mixed ownership."
+      );
+    }
+    if (hashMismatches.length > 0) {
+      lines.push(
+        "Refusing to overwrite lockfile-owned generated region files that differ from ai-profile.lock:",
+        ...hashMismatches.map(
+          (item) => `- ${item.path} (${item.reason})`
+        ),
+        "Re-run with --force after reviewing the diff, or regenerate ai-profile.lock to record the new bytes."
+      );
+    }
+    io.stderr(`${lines.join("\n")}
+`);
+    return 3;
+  }
   const lockfile = createLockfileFile({
     profilePath: safeProfilePath.path,
     profileBytes,
     templates: compileResult.templates,
-    files: compileResult.files
+    files: compileResult.files,
+    mixedOutputs: regionPlan.mixedOutputs
   });
-  const writes = toPlannedWrites([...compileResult.files, lockfile]);
+  const writes = [...regionPlan.writes, { path: lockfile.path, bytes: lockfile.bytes }];
   if (parsed.write && !parsed.force) {
     let protectedPaths;
     try {
@@ -5862,7 +7952,7 @@ ${protectedPaths.map((item) => `- ${item.path} (${item.reason})`).join("\n")}
   io.stdout(formatWritePlan("Agent Profile Compile", parsed.write, plan));
   return 0;
 }
-async function runInit(args, cwd, io, presetNow, presetVerificationKeys) {
+async function runInit(args, cwd, io, options = {}) {
   const parsed = parseInitArgs(args);
   if (!parsed.ok) {
     io.stderr(`${parsed.message}
@@ -5874,7 +7964,9 @@ ${formatHelp()}`);
     io.stdout(formatHelp());
     return 0;
   }
-  const rootDir = path5.resolve(cwd, parsed.root);
+  const presetNow = options.presetNow;
+  const presetVerificationKeys = options.presetVerificationKeys;
+  const rootDir = path6.resolve(cwd, parsed.root);
   const safeProfilePath = toSafeCliPath(parsed.profile);
   if (!safeProfilePath.ok) {
     emitInitOutput(
@@ -5902,7 +7994,7 @@ ${formatHelp()}`);
   }
   let existingProfileBytes;
   try {
-    existingProfileBytes = await readOptionalBytes(
+    existingProfileBytes = await readOptionalBytes2(
       rootDir,
       safeProfilePath.path
     );
@@ -5918,11 +8010,77 @@ ${formatHelp()}`);
     );
     return 1;
   }
+  if (isWizardEligibleArgs(args) && presetPayload === void 0) {
+    const dispatch = await dispatchInitWizard({
+      args: parsed,
+      rootDir,
+      profilePath: safeProfilePath.path,
+      existingProfileBytes,
+      io,
+      promptsOverride: options.prompts,
+      nonInteractiveOverride: options.nonInteractive
+    });
+    if (dispatch === "declined") {
+      return 0;
+    }
+  }
   if (existingProfileBytes) {
     const existingClients = getExistingProfileClients(
       existingProfileBytes,
       safeProfilePath.path
     );
+    if (parsed.importExisting && parsed.strategy === "regions" && parsed.write) {
+      const parsedProfile = parseProfileYaml(
+        Buffer.from(existingProfileBytes).toString("utf8"),
+        { sourcePath: safeProfilePath.path }
+      );
+      if (parsedProfile.ok) {
+        const result = await planRegionAdoptions(
+          rootDir,
+          parsedProfile.profile
+        );
+        if (result.refusals.length > 0) {
+          io.stderr(formatRegionAdoptionRefusals(result.refusals));
+          return 3;
+        }
+        if (result.adoptions.length > 0) {
+          await applyWritePlan({
+            rootDir,
+            writes: result.adoptions.map((adoption) => ({
+              path: adoption.path,
+              bytes: adoption.bytes
+            }))
+          });
+        }
+      }
+    }
+    if (parsed.updateGitignore && parsed.write) {
+      const findings = await getLocalRuntimeGitignoreFindings(rootDir);
+      try {
+        await appendMissingGitignoreLines(
+          rootDir,
+          findings.filter((finding) => finding.action === "would-add").map((finding) => finding.line)
+        );
+      } catch {
+      }
+    }
+    let importReport2;
+    if (parsed.importExisting) {
+      const parsedProfile = parseProfileYaml(
+        Buffer.from(existingProfileBytes).toString("utf8"),
+        { sourcePath: safeProfilePath.path }
+      );
+      const existingStack = await detectStack(rootDir);
+      importReport2 = await buildPhase14ImportReport({
+        rootDir,
+        mode: parsed.write ? "write" : "dry-run",
+        strategy: parsed.strategy,
+        profilePath: safeProfilePath.path,
+        profile: parsedProfile.ok ? parsedProfile.profile : void 0,
+        wouldCreateProfile: false,
+        stack: existingStack.stack
+      });
+    }
     emitInitOutput(parsed, io, {
       mode: parsed.write ? "write" : "dry-run",
       status: "ok",
@@ -5936,7 +8094,8 @@ ${formatHelp()}`);
       ignoredClientFlags: parsed.clients.length > 0 || parsed.noClients.length > 0,
       stackWarnings: [],
       importFindings: [],
-      gitignoreSuggestions: []
+      gitignoreSuggestions: [],
+      ...importReport2 ? { import: importReport2 } : {}
     });
     return 0;
   }
@@ -5985,6 +8144,35 @@ ${formatHelp()}`);
       bytes: profileText
     }
   ];
+  let regionAdoptions = [];
+  if (parsed.importExisting && parsed.strategy === "regions") {
+    let result;
+    try {
+      result = await planRegionAdoptions(rootDir, validation.profile);
+    } catch (error) {
+      const reason = classifyInitWriteFailure(error);
+      emitInitOutput(
+        parsed,
+        io,
+        createInitRefusal({
+          profilePath: safeProfilePath.path,
+          reason,
+          message: formatInitFailureMessage(reason),
+          clients,
+          detectedStack: stackResult.stack.languages
+        })
+      );
+      return 1;
+    }
+    if (result.refusals.length > 0) {
+      io.stderr(formatRegionAdoptionRefusals(result.refusals));
+      return 3;
+    }
+    regionAdoptions = result.adoptions;
+    for (const adoption of regionAdoptions) {
+      writes.push({ path: adoption.path, bytes: adoption.bytes });
+    }
+  }
   let plan;
   try {
     plan = parsed.write ? await applyWritePlan({ rootDir, writes }) : await planWrites({ rootDir, writes });
@@ -6005,7 +8193,7 @@ ${formatHelp()}`);
   }
   if (parsed.write) {
     try {
-      const written = await readOptionalBytes(rootDir, safeProfilePath.path);
+      const written = await readOptionalBytes2(rootDir, safeProfilePath.path);
       if (!written || !Buffer.from(written).equals(Buffer.from(profileText, "utf8"))) {
         emitInitOutput(
           parsed,
@@ -6036,6 +8224,28 @@ ${formatHelp()}`);
     }
   }
   const suggestions = presetPayload === void 0 ? await getGitignoreSuggestions(rootDir) : [];
+  const gitignoreFindings = presetPayload === void 0 ? await getLocalRuntimeGitignoreFindings(rootDir) : [];
+  if (parsed.updateGitignore && parsed.write) {
+    try {
+      await appendMissingGitignoreLines(
+        rootDir,
+        gitignoreFindings.filter((finding) => finding.action === "would-add").map((finding) => finding.line)
+      );
+    } catch {
+    }
+  }
+  let importReport;
+  if (parsed.importExisting) {
+    importReport = await buildPhase14ImportReport({
+      rootDir,
+      mode: parsed.write ? "write" : "dry-run",
+      strategy: parsed.strategy,
+      profilePath: safeProfilePath.path,
+      profile: validation.profile,
+      wouldCreateProfile: !parsed.write,
+      stack: stackResult.stack
+    });
+  }
   emitInitOutput(parsed, io, {
     mode: parsed.write ? "write" : "dry-run",
     status: "ok",
@@ -6049,10 +8259,114 @@ ${formatHelp()}`);
     preset: presetPayload,
     stackWarnings: stackResult.warnings,
     importFindings: importResult?.findings ?? [],
-    gitignoreSuggestions: suggestions
+    gitignoreSuggestions: suggestions,
+    ...importReport ? { import: importReport } : {}
   });
   return 0;
 }
+async function dispatchInitWizard(input) {
+  const nonInteractive = isNonInteractive({
+    env: process.env,
+    stdin: process.stdin,
+    stdout: process.stdout,
+    flag: input.args.nonInteractive,
+    ...input.nonInteractiveOverride !== void 0 ? { override: input.nonInteractiveOverride } : {}
+  });
+  if (nonInteractive) {
+    input.args.importExisting = true;
+    return "non-interactive";
+  }
+  let profileForReport;
+  if (input.existingProfileBytes) {
+    const parsedProfile = parseProfileYaml(
+      Buffer.from(input.existingProfileBytes).toString("utf8"),
+      { sourcePath: input.profilePath }
+    );
+    if (parsedProfile.ok) {
+      profileForReport = parsedProfile.profile;
+    }
+  }
+  const stackForWizard = await detectStack(input.rootDir);
+  const importForWizard = await analyzeExistingArtifacts(input.rootDir);
+  const wizardPhaseReport = await buildPhase14ImportReport({
+    rootDir: input.rootDir,
+    mode: "dry-run",
+    strategy: "preserve",
+    profilePath: input.profilePath,
+    profile: profileForReport,
+    wouldCreateProfile: input.existingProfileBytes === void 0,
+    stack: stackForWizard.stack
+  });
+  const detectedClients = WIZARD_CLIENT_IDS.filter(
+    (id) => importForWizard.clients[id]
+  );
+  const context = {
+    stack: {
+      languages: stackForWizard.stack.languages,
+      frameworks: stackForWizard.stack.frameworks,
+      packageManagers: stackForWizard.stack.packageManagers,
+      testing: stackForWizard.stack.testing
+    },
+    detectedClients,
+    hasExistingProfile: input.existingProfileBytes !== void 0,
+    report: toWizardImportReport(wizardPhaseReport)
+  };
+  const prompts = input.promptsOverride ?? createDefaultPrompts(input.io);
+  const outcome = await runInitWizard({
+    context,
+    io: input.io,
+    prompts,
+    rebuildReport: async (strategy) => {
+      const refreshed = await buildPhase14ImportReport({
+        rootDir: input.rootDir,
+        mode: "dry-run",
+        strategy,
+        profilePath: input.profilePath,
+        profile: profileForReport,
+        wouldCreateProfile: input.existingProfileBytes === void 0,
+        stack: stackForWizard.stack
+      });
+      return toWizardImportReport(refreshed);
+    }
+  });
+  if (!outcome.confirmed) {
+    return "declined";
+  }
+  input.args.importExisting = true;
+  input.args.strategy = outcome.strategy;
+  input.args.updateGitignore = outcome.updateGitignore;
+  input.args.write = true;
+  input.args.clients = WIZARD_CLIENT_IDS.filter(
+    (id) => outcome.clients.includes(id)
+  );
+  input.args.noClients = WIZARD_CLIENT_IDS.filter(
+    (id) => !outcome.clients.includes(id)
+  );
+  return "confirmed";
+}
+function toWizardImportReport(report) {
+  return {
+    files: report.files.map((file) => ({
+      path: file.path,
+      exists: file.exists,
+      kind: file.kind,
+      ownership: file.ownership,
+      tags: [...file.tags],
+      action: file.action,
+      notes: [...file.notes]
+    })),
+    gitignore: report.gitignore.map((finding) => ({
+      line: finding.line,
+      action: finding.action
+    })),
+    summary: {
+      wouldCreateProfile: report.summary.wouldCreateProfile,
+      wouldUpdateRegions: report.summary.wouldUpdateRegions,
+      preservedManualFiles: report.summary.preservedManualFiles,
+      conflicts: report.summary.conflicts
+    }
+  };
+}
 function parseDoctorArgs(args) {
   let root = ".";
   let json = false;
@@ -6153,11 +8467,15 @@ function parseInitArgs(args) {
   let dryRun = false;
   let write = false;
   let importExisting = false;
+  let strategy = "preserve";
+  let strategyProvided = false;
+  let updateGitignore = false;
   const clients = [];
   const noClients = [];
   let json = false;
   let quiet = false;
   let help = false;
+  let nonInteractive = false;
   for (let index = 0; index < args.length; index += 1) {
     const arg = args[index];
     switch (arg) {
@@ -6201,6 +8519,28 @@ function parseInitArgs(args) {
       case "--import":
         importExisting = true;
         break;
+      case "--strategy": {
+        const value = args[index + 1];
+        if (!value || value.startsWith("--")) {
+          return {
+            ok: false,
+            message: "--strategy requires preserve or regions."
+          };
+        }
+        if (value !== "preserve" && value !== "regions") {
+          return {
+            ok: false,
+            message: `--strategy must be preserve or regions. Got: ${value}.`
+          };
+        }
+        strategy = value;
+        strategyProvided = true;
+        index += 1;
+        break;
+      }
+      case "--update-gitignore":
+        updateGitignore = true;
+        break;
       case "--client": {
         const value = args[index + 1];
         if (!value || value.startsWith("--")) {
@@ -6239,6 +8579,9 @@ function parseInitArgs(args) {
       case "--quiet":
         quiet = true;
         break;
+      case "--non-interactive":
+        nonInteractive = true;
+        break;
       case "--interactive":
         return {
           ok: false,
@@ -6270,6 +8613,18 @@ function parseInitArgs(args) {
       message: "--preset cannot be used with --profile in Phase 9; preset init writes only ai-profile.yaml."
     };
   }
+  if (strategyProvided && !importExisting) {
+    return {
+      ok: false,
+      message: "--strategy is only valid with --import."
+    };
+  }
+  if (updateGitignore && !write) {
+    return {
+      ok: false,
+      message: "--update-gitignore requires --write."
+    };
+  }
   return {
     ok: true,
     root,
@@ -6279,13 +8634,32 @@ function parseInitArgs(args) {
     dryRun,
     write,
     importExisting,
+    strategy,
+    updateGitignore,
     clients: uniqueClients(clients),
     noClients: uniqueClients(noClients),
     json,
     quiet,
-    help
+    help,
+    nonInteractive
   };
 }
+var WIZARD_BYPASS_FLAGS = /* @__PURE__ */ new Set([
+  "--preset",
+  "--dry-run",
+  "--write",
+  "--import",
+  "--strategy",
+  "--update-gitignore",
+  "--client",
+  "--no-client",
+  "--profile",
+  "--json",
+  "--quiet"
+]);
+function isWizardEligibleArgs(args) {
+  return !args.some((arg) => WIZARD_BYPASS_FLAGS.has(arg));
+}
 function parseClientList(value, optionName) {
   if (value.trim() === "") {
     return {
@@ -6325,8 +8699,8 @@ function uniqueClients(clients) {
 function parseUiArgs(args) {
   let root = ".";
   let host = DEFAULT_UI_HOST;
-  let port = DEFAULT_UI_PORT;
-  let open = false;
+  let port = "auto";
+  let open;
   let help = false;
   for (let index = 0; index < args.length; index += 1) {
     const arg = args[index];
@@ -6358,22 +8732,37 @@ function parseUiArgs(args) {
       case "--port": {
         const value = args[index + 1];
         if (!value || value.startsWith("--")) {
-          return { ok: false, message: "--port requires a number." };
+          return {
+            ok: false,
+            message: "--port requires a number or the literal 'auto'."
+          };
+        }
+        if (value === "auto") {
+          port = "auto";
+          index += 1;
+          break;
         }
         const parsed = Number(value);
         if (!Number.isInteger(parsed) || parsed < 1 || parsed > 65535) {
           return {
             ok: false,
-            message: "--port must be an integer between 1 and 65535."
+            message: "--port must be 'auto' or an integer between 1 and 65535."
           };
         }
         port = parsed;
         index += 1;
         break;
       }
-      case "--open":
-        open = true;
+      case "--open": {
+        const value = args[index + 1];
+        if (value === "true" || value === "false") {
+          open = value === "true";
+          index += 1;
+        } else {
+          open = true;
+        }
         break;
+      }
       case "--help":
       case "-h":
         help = true;
@@ -6414,7 +8803,7 @@ function renderInitialProfile(input) {
   };
   return `version: 1
 profile:
-  name: ${slugifyProfileName(path5.basename(input.rootDir))}
+  name: ${slugifyProfileName(path6.basename(input.rootDir))}
   description: Local AI-agent setup.
 stack:
   languages:
@@ -6474,6 +8863,11 @@ function createInitRefusal(input) {
 }
 function emitInitOutput(parsed, io, report) {
   if (parsed.json) {
+    if (parsed.importExisting && report.import) {
+      io.stdout(`${JSON.stringify(report.import)}
+`);
+      return;
+    }
     io.stdout(`${JSON.stringify(toInitJson(report))}
 `);
     return;
@@ -6502,6 +8896,9 @@ function toInitJson(report) {
   if (report.error) {
     summary.error = report.error;
   }
+  if (report.import) {
+    summary.import = report.import;
+  }
   return summary;
 }
 function defaultClients() {
@@ -6623,7 +9020,8 @@ function slugifyProfileName(value) {
 async function getProtectedGeneratedPaths(rootDir, files) {
   const existingFiles = [];
   for (const file of files) {
-    const current = await readOptionalBytes(rootDir, file.path);
+    if (REGION_AWARE_PATHS.has(file.path)) continue;
+    const current = await readOptionalBytes2(rootDir, file.path);
     if (current) {
       existingFiles.push({ file, bytes: current });
     }
@@ -6631,7 +9029,7 @@ async function getProtectedGeneratedPaths(rootDir, files) {
   if (existingFiles.length === 0) {
     return [];
   }
-  const lockfileBytes = await readOptionalBytes(rootDir, "ai-profile.lock");
+  const lockfileBytes = await readOptionalBytes2(rootDir, "ai-profile.lock");
   if (!lockfileBytes) {
     return existingFiles.map((item) => ({
       path: item.file.path,
@@ -6647,8 +9045,9 @@ async function getProtectedGeneratedPaths(rootDir, files) {
       reason: "invalid lockfile"
     })).sort(compareProtectedPaths);
   }
+  const lockfileV2 = toLockfileV2View(lockfileResult.lockfile);
   const outputsByPath = new Map(
-    lockfileResult.lockfile.outputs.map((output) => [output.path, output])
+    lockfileV2.outputs.map((output) => [output.path, output])
   );
   const protectedPaths = [];
   for (const item of existingFiles) {
@@ -6658,7 +9057,23 @@ async function getProtectedGeneratedPaths(rootDir, files) {
         path: item.file.path,
         reason: "missing lockfile entry"
       });
-    } else if (sha256Hex(item.bytes) !== lockOutput.sha256) {
+      continue;
+    }
+    if (lockOutput.ownership === "manual-owned") {
+      continue;
+    }
+    if (lockOutput.ownership === "mixed") {
+      const parsed = parseMixedFile(Buffer.from(item.bytes));
+      const expectedHash = lockOutput.regions[0]?.sha256;
+      if (!parsed.ok || !expectedHash || parsed.generatedInnerHash !== expectedHash) {
+        protectedPaths.push({
+          path: item.file.path,
+          reason: "hash mismatch"
+        });
+      }
+      continue;
+    }
+    if (sha256Hex(item.bytes) !== lockOutput.sha256) {
       protectedPaths.push({
         path: item.file.path,
         reason: "hash mismatch"
@@ -6670,7 +9085,7 @@ async function getProtectedGeneratedPaths(rootDir, files) {
 async function getGitignoreSuggestions(rootDir) {
   let gitignore;
   try {
-    gitignore = await readOptionalText2(rootDir, ".gitignore");
+    gitignore = await readOptionalText3(rootDir, ".gitignore");
   } catch {
     gitignore = void 0;
   }
@@ -6689,19 +9104,13 @@ async function getGitignoreSuggestions(rootDir) {
   }
   return suggestions;
 }
-function toPlannedWrites(files) {
-  return files.map((file) => ({
-    path: file.path,
-    bytes: file.bytes
-  }));
-}
-async function readOptionalBytes(rootDir, relativePath) {
+async function readOptionalBytes2(rootDir, relativePath) {
   const safePath = safeOutputPath(relativePath);
-  const rootRealPath = await fsPromises3.realpath(path5.resolve(rootDir));
-  const absolutePath = path5.resolve(rootRealPath, ...safePath.split("/"));
+  const rootRealPath = await fsPromises4.realpath(path6.resolve(rootDir));
+  const absolutePath = path6.resolve(rootRealPath, ...safePath.split("/"));
   try {
     await assertReadPathContained(rootRealPath, absolutePath);
-    return await fsPromises3.readFile(absolutePath);
+    return await fsPromises4.readFile(absolutePath);
   } catch (error) {
     if (isNodeError5(error) && error.code === "ENOENT") {
       return void 0;
@@ -6736,6 +9145,29 @@ async function assertPortAvailable(host, port) {
     server.listen(port, host);
   });
 }
+async function reserveEphemeralPort(host) {
+  return new Promise((resolve) => {
+    const server = createServer();
+    server.once("error", () => resolve({ ok: false }));
+    server.once("listening", () => {
+      const address = server.address();
+      if (address && typeof address === "object") {
+        const port = address.port;
+        server.close(() => resolve({ ok: true, port }));
+      } else {
+        server.close(() => resolve({ ok: false }));
+      }
+    });
+    server.listen(0, host);
+  });
+}
+function generateSessionToken() {
+  return randomBytes(24).toString("base64url");
+}
+function isInteractiveTty(io) {
+  if (io.stdout !== DEFAULT_IO.stdout) return false;
+  return Boolean(process.stdout.isTTY) && process.env.CI !== "true";
+}
 async function launchPublishedUi(request) {
   let serverEntry;
   try {
@@ -6750,6 +9182,7 @@ async function launchPublishedUi(request) {
     env: {
       ...process.env,
       AGENT_PROFILE_ROOT: request.rootDir,
+      AGENT_PROFILE_SESSION_TOKEN: request.sessionToken,
       HOST: request.host,
       PORT: String(request.port)
     },
@@ -6758,7 +9191,9 @@ async function launchPublishedUi(request) {
   if (request.open) {
     void waitForPortInUse(request.host, request.port).then((ready) => {
       if (ready) {
-        openInBrowser(formatUiUrl(request.host, request.port));
+        openInBrowser(
+          formatUiUrl(request.host, request.port, request.sessionToken)
+        );
       }
     });
   }
@@ -6795,8 +9230,10 @@ async function waitForPortInUse(host, port, timeoutMs = 5e3, intervalMs = 50) {
   }
   return false;
 }
-function formatUiUrl(host, port) {
-  return `http://${host === "::1" ? "[::1]" : host}:${port}`;
+function formatUiUrl(host, port, sessionToken) {
+  const base = `http://${host === "::1" ? "[::1]" : host}:${port}`;
+  if (!sessionToken) return base;
+  return `${base}/?session=${encodeURIComponent(sessionToken)}`;
 }
 function openInBrowser(url) {
   const command = process.platform === "win32" ? "cmd" : process.platform === "darwin" ? "open" : "xdg-open";
@@ -6811,8 +9248,8 @@ async function assertReadPathContained(rootRealPath, absolutePath) {
   if (!isContainedBy3(rootRealPath, absolutePath)) {
     throw new UnsafePathError("Read path escapes root.");
   }
-  await fsPromises3.lstat(absolutePath);
-  const targetRealPath = await fsPromises3.realpath(absolutePath);
+  await fsPromises4.lstat(absolutePath);
+  const targetRealPath = await fsPromises4.realpath(absolutePath);
   if (!isContainedBy3(rootRealPath, targetRealPath)) {
     throw new UnsafePathError("Read path target escapes root.");
   }
@@ -6826,11 +9263,11 @@ function compareProtectedPaths(left, right) {
   return compareText5(left.path, right.path) || compareText5(left.reason, right.reason);
 }
 function isContainedBy3(rootPath, candidatePath) {
-  const relative = path5.relative(rootPath, candidatePath);
-  return relative === "" || !relative.startsWith("..") && !path5.isAbsolute(relative);
+  const relative = path6.relative(rootPath, candidatePath);
+  return relative === "" || !relative.startsWith("..") && !path6.isAbsolute(relative);
 }
-async function readOptionalText2(rootDir, relativePath) {
-  const bytes = await readOptionalBytes(rootDir, relativePath);
+async function readOptionalText3(rootDir, relativePath) {
+  const bytes = await readOptionalBytes2(rootDir, relativePath);
   return bytes ? Buffer.from(bytes).toString("utf8") : void 0;
 }
 function toSafeCliPath(value) {
@@ -6849,15 +9286,21 @@ function formatHelp() {
 Usage:
   agent-profile compile [--root <path>] [--profile <path>] [--target <id>] [--dry-run|--write] [--force]
   agent-profile doctor [--root <path>] [--json]
-  agent-profile init [--root <path>] [--profile <path>] [--import] [--preset <token>] [--client <list>] [--no-client <list>] [--json] [--quiet] [--dry-run|--write]
-  agent-profile ui [--root <path>] [--host <host>] [--port <number>] [--open]
+  agent-profile init [--root <path>] [--profile <path>] [--import] [--strategy preserve|regions] [--update-gitignore] [--preset <token>] [--client <list>] [--no-client <list>] [--non-interactive] [--json] [--quiet] [--dry-run|--write]
+  agent-profile ui [--root <path>] [--host <host>] [--port auto|<number>] [--open true|false]
 
 Commands:
   compile   Preview or write generated agent artifacts.
   doctor    Run local profile, lockfile, and permission checks.
-  init      Create a starting ai-profile.yaml.
+  init      Create a starting ai-profile.yaml (interactive wizard with no args).
   ui        Start the local read-only UI.
 
+Init wizard (Phase 15):
+  Plain \`agent-profile init\` opens a friendly wizard that maps to Phase 14
+  --import / --strategy / --update-gitignore / --write. In non-interactive
+  environments (no TTY, CI=true, or --non-interactive), init defaults to
+  --import --strategy preserve --dry-run and writes nothing.
+
 Init presets:
   --preset verifies a short-lived hosted preset token offline. Repository
   analysis happens locally and no source code is uploaded. Dry-run is the
@@ -6907,6 +9350,49 @@ function formatWritePlan(title, wrote, plan) {
   return `${lines.join("\n").replace(/\n*$/u, "")}
 `;
 }
+function formatPhase14ImportReportLines(report) {
+  const lines = ["", "Phase 14 import report:"];
+  lines.push(`  command: ${report.command}`);
+  lines.push(`  strategy: ${report.strategy}`);
+  lines.push(`  mode: ${report.mode}`);
+  lines.push(`  root: ${report.root}`);
+  lines.push(`  profile: ${report.profilePath}`);
+  lines.push(
+    `  stack: languages=[${report.stack.languages.join(", ")}] frameworks=[${report.stack.frameworks.join(", ")}] packageManagers=[${report.stack.packageManagers.join(", ")}] testing=[${report.stack.testing.join(", ")}]`
+  );
+  if (report.files.length > 0) {
+    lines.push("  files:");
+    for (const finding of report.files) {
+      const tags = finding.tags.length > 0 ? ` [${finding.tags.join(", ")}]` : "";
+      lines.push(
+        `    - ${finding.path} (${finding.kind}, ${finding.ownership}, action=${finding.action})${tags}`
+      );
+      for (const note of finding.notes) {
+        lines.push(`        note: ${note}`);
+      }
+    }
+  }
+  if (report.gitignore.length > 0) {
+    lines.push("  gitignore:");
+    for (const finding of report.gitignore) {
+      lines.push(
+        `    - ${finding.line}: ${finding.action} (${finding.reason})`
+      );
+    }
+  }
+  if (report.collisions.length > 0) {
+    lines.push("  collisions:");
+    for (const collision of report.collisions) {
+      lines.push(
+        `    - ${collision.kind} name="${collision.name}" in [${collision.paths.join(", ")}]`
+      );
+    }
+  }
+  lines.push(
+    `  summary: wouldCreateProfile=${report.summary.wouldCreateProfile} wouldUpdateRegions=${report.summary.wouldUpdateRegions} preservedManualFiles=${report.summary.preservedManualFiles} conflicts=${report.summary.conflicts} nameCollisions=${report.summary.nameCollisions}`
+  );
+  return lines;
+}
 function formatInitText(input) {
   const lines = [];
   if (input.preset !== void 0) {
@@ -6925,6 +9411,9 @@ function formatInitText(input) {
     if (input.ignoredClientFlags) {
       lines.push("client flags ignored: init does not edit existing profiles.");
     }
+    if (input.import) {
+      lines.push(...formatPhase14ImportReportLines(input.import));
+    }
     lines.push(
       "run `agent-profile compile --dry-run` to inspect compiled artifacts."
     );
@@ -6958,6 +9447,9 @@ function formatInitText(input) {
       lines.push(`  .gitignore: add \`${suggestion}\``);
     }
   }
+  if (input.import) {
+    lines.push(...formatPhase14ImportReportLines(input.import));
+  }
   lines.push(
     "",
     input.wrote ? "run `agent-profile compile --dry-run` to inspect compiled artifacts." : "run `agent-profile init --write` to create the profile."
@@ -7046,6 +9538,134 @@ function compareText5(left, right) {
 function isNodeError5(error) {
   return error instanceof Error && "code" in error;
 }
+async function planRegionAdoptions(rootDir, profile) {
+  const compileResult = compileProfile({ profile });
+  if (!compileResult.ok) return { adoptions: [], refusals: [] };
+  const generatedBytesByPath = /* @__PURE__ */ new Map();
+  for (const file of compileResult.files) {
+    if (file.path !== "AGENTS.md" && file.path !== "CLAUDE.md") continue;
+    generatedBytesByPath.set(file.path, file.bytes);
+  }
+  const outcomes = await planRootInstructionsAdoption(
+    rootDir,
+    generatedBytesByPath
+  );
+  const adoptions = [];
+  const refusals = [];
+  for (const outcome of outcomes) {
+    if (outcome.ok) {
+      adoptions.push({ path: outcome.path, bytes: outcome.bytes });
+      continue;
+    }
+    if (outcome.reason === "missing-file" || outcome.reason === "missing-generated-bytes") {
+      continue;
+    }
+    refusals.push({ path: outcome.path, reason: outcome.reason });
+  }
+  return { adoptions, refusals };
+}
+async function appendMissingGitignoreLines(rootDir, lines) {
+  if (lines.length === 0) return;
+  const existing = await readOptionalText3(rootDir, ".gitignore") ?? "";
+  const trailing = existing.endsWith("\n") || existing === "" ? "" : "\n";
+  const addition = `${lines.join("\n")}
+`;
+  const next = `${existing}${trailing}${addition}`;
+  await applyWritePlan({
+    rootDir,
+    writes: [{ path: ".gitignore", bytes: next }]
+  });
+}
+function formatRegionAdoptionRefusals(refusals) {
+  const lines = [
+    "Refusing to adopt region-aware instruction files:",
+    ...refusals.map((item) => `- ${item.path} (${item.reason})`),
+    "Repair the listed files (move, rename, or remove the symlink / partial markers) and re-run init --import --strategy regions --write.",
+    ""
+  ];
+  return lines.join("\n");
+}
+var REGION_AWARE_PATHS = /* @__PURE__ */ new Set(["AGENTS.md", "CLAUDE.md"]);
+async function planRegionAwareWrites(rootDir, files, options = { force: false }) {
+  const lockfile = await readLockfileForRegions(rootDir);
+  const writes = [];
+  const mixedOutputs = [];
+  const refusals = [];
+  for (const file of files) {
+    if (!REGION_AWARE_PATHS.has(file.path)) {
+      writes.push({ path: file.path, bytes: file.bytes });
+      continue;
+    }
+    const existingRead = await readRegionAwareFile(rootDir, file.path);
+    if (existingRead.refused) {
+      refusals.push({ path: file.path, reason: "symlink" });
+      continue;
+    }
+    const existing = existingRead.bytes;
+    const lockOutput = lockfile?.outputs.find(
+      (output) => output.path === file.path
+    );
+    if (!existing) {
+      writes.push({ path: file.path, bytes: file.bytes });
+      continue;
+    }
+    if (lockOutput?.ownership === "generated-owned") {
+      if (!options.force && sha256Hex(existing) !== lockOutput.sha256) {
+        refusals.push({ path: file.path, reason: "hash-mismatch" });
+        continue;
+      }
+      writes.push({ path: file.path, bytes: file.bytes });
+      continue;
+    }
+    if (lockOutput?.ownership === "mixed") {
+      const buffer = Buffer.from(existing);
+      if (!hasAllRegionMarkers(buffer)) {
+        refusals.push({ path: file.path, reason: "partial-markers" });
+        continue;
+      }
+      const generatedInner = generatedInnerBytesFor(file);
+      const updated = replaceGeneratedRegion(buffer, generatedInner);
+      if (!updated) {
+        refusals.push({ path: file.path, reason: "duplicate-markers" });
+        continue;
+      }
+      writes.push({ path: file.path, bytes: updated });
+      mixedOutputs.push({
+        path: file.path,
+        target: file.target,
+        templateId: file.templateId,
+        regionHash: sha256Hex(generatedInner)
+      });
+      continue;
+    }
+    const existingBuffer = Buffer.from(existing);
+    if (hasAllRegionMarkers(existingBuffer)) {
+      const generatedInner = generatedInnerBytesFor(file);
+      const updated = replaceGeneratedRegion(existingBuffer, generatedInner);
+      if (!updated) {
+        refusals.push({ path: file.path, reason: "duplicate-markers" });
+        continue;
+      }
+      writes.push({ path: file.path, bytes: updated });
+      mixedOutputs.push({
+        path: file.path,
+        target: file.target,
+        templateId: file.templateId,
+        regionHash: sha256Hex(generatedInner)
+      });
+      continue;
+    }
+    if (hasAnyRegionMarker(existingBuffer)) {
+      refusals.push({ path: file.path, reason: "partial-markers" });
+      continue;
+    }
+    refusals.push({ path: file.path, reason: "unknown-ownership" });
+  }
+  return { writes, mixedOutputs, refusals };
+}
+function generatedInnerBytesFor(file) {
+  return Buffer.from(file.bytes);
+}
 async function main() {
   process.exitCode = await runCli();
 }