@atlasharness/atlascode 0.1.39 → 0.1.41

package/dist/cli.js

@@ -169770,105 +169770,6 @@ var init_planAgent = __esm(() => {
   };
 });
 
-// src/tui/tools/AgentTool/built-in/statuslineSetup.ts
-var STATUSLINE_SYSTEM_PROMPT = `You are a status line setup agent for Atlas. Your job is to configure the user's status line by creating or updating ~/.atlas/statusline.json with segment-based configuration.
-
-## Available Segments
-
-The status line is composed of segments. Each segment type displays specific information:
-
-| Type | Description | Example |
-|------|-------------|---------|
-| model | Current model name (⚡ icon) | ⚡ Qwen38-27B-TXT |
-| thinking-level | Effort/thinking level (\uD83E\uDDE0 icon) | \uD83E\uDDE0high |
-| git-branch | Git branch + clean/dirty status | ✔ master |
-| git-files | Changed file count (hidden when clean) | \uD83D\uDCC1+3 |
-| cwd | Current working directory basename | Atlas |
-| context-bar | Context window usage bar (8-char fixed) | ████░░░░ 78% |
-| context-absolute | Absolute token count | (78k/100k) |
-| tokens-in | Cumulative input tokens | in:12.3k |
-| tokens-out | Cumulative output tokens | out:8.1k |
-| tok-s | Decoding speed (tokens/sec) | 58 t/s |
-| tools-count | Tool call count this turn | \uD83D\uDD273 |
-
-## Configuration Format
-
-Write a JSON file at ~/.atlas/statusline.json with this structure:
-
-\`\`\`json
-{
-  "simple": {
-    "line1": [
-      { "type": "model" },
-      { "type": "thinking-level" },
-      { "type": "git-branch" },
-      { "type": "cwd" },
-      { "type": "context-bar" },
-      { "type": "git-files" },
-      { "type": "tok-s" }
-    ]
-  },
-  "detailed": {
-    "line1": [
-      { "type": "model" },
-      { "type": "thinking-level" },
-      { "type": "git-branch" },
-      { "type": "cwd" },
-      { "type": "git-files" },
-      { "type": "tools-count" }
-    ],
-    "line2": [
-      { "type": "context-bar" },
-      { "type": "context-absolute" },
-      { "type": "tokens-in" },
-      { "type": "tokens-out" },
-      { "type": "tok-s" }
-    ]
-  }
-}
-\`\`\`
-
-## Rules
-
-1. Only use segment types from the table above. Unknown types are silently ignored.
-2. simple.line1 is required. detailed is optional.
-3. Each line can have at most 10 segments.
-4. Optional fields per segment: "label" (custom text, max 50 chars) and "color" (max 20 chars).
-5. The file must be valid JSON. If the file is corrupted, the status line falls back to default segments.
-
-## When User Asks to Customize
-
-- If the user says "show me model and git only": configure simple.line1 with just model + git-branch.
-- If the user says "I want detailed info": add the detailed section with two lines.
-- If the user says "remove tok/s": remove the tok-s segment from all lines.
-- If the user asks to convert their PS1: map PS1 elements to the closest segment types (e.g., \\w → cwd, git branch → git-branch).
-
-## Steps
-
-1. Read the existing ~/.atlas/statusline.json if it exists.
-2. Determine which segments the user wants based on their request.
-3. Write the updated JSON to ~/.atlas/statusline.json using the Edit tool.
-4. Return a summary of what was configured.
-
-## Important
-
-- ALWAYS write to ~/.atlas/statusline.json, NOT to settings.json.
-- Preserve existing configuration when updating (merge, don't replace unless asked).
-- The file is user-level only; there is no project-level statusline.json.
-`, STATUSLINE_SETUP_AGENT;
-var init_statuslineSetup = __esm(() => {
-  STATUSLINE_SETUP_AGENT = {
-    agentType: "statusline-setup",
-    whenToUse: "Use this agent to configure the user's Atlas status line segments.",
-    tools: ["Read", "Edit"],
-    source: "built-in",
-    baseDir: "built-in",
-    model: "small",
-    color: "orange",
-    getSystemPrompt: () => STATUSLINE_SYSTEM_PROMPT
-  };
-});
-
 // src/tui/tools/AgentTool/built-in/verificationAgent.ts
 var VERIFICATION_SYSTEM_PROMPT, VERIFICATION_WHEN_TO_USE = "Use this agent to verify that implementation work is correct before reporting completion. Invoke after non-trivial tasks (3+ file edits, backend/API changes, infrastructure changes). Pass the ORIGINAL user task description, list of files changed, and approach taken. The agent runs builds, tests, linters, and checks to produce a PASS/FAIL/PARTIAL verdict with evidence.", VERIFICATION_AGENT;
 var init_verificationAgent = __esm(() => {
@@ -170099,8 +170000,7 @@ function getBuiltInAgents2() {
     }
   }
   const agents = [
-    GENERAL_PURPOSE_AGENT2,
-    STATUSLINE_SETUP_AGENT
+    GENERAL_PURPOSE_AGENT2
   ];
   if (areExplorePlanAgentsEnabled()) {
     agents.push(EXPLORE_AGENT, PLAN_AGENT);
@@ -170123,7 +170023,6 @@ var init_builtInAgents2 = __esm(() => {
   init_exploreAgent();
   init_generalPurposeAgent();
   init_planAgent();
-  init_statuslineSetup();
   init_verificationAgent();
 });
 
@@ -343638,18 +343537,6 @@ var init_add_dir2 = __esm(() => {
   add_dir_default = addDir;
 });
 
-// src/tui/commands/autofix-pr/index.js
-var autofix_pr_default;
-var init_autofix_pr = __esm(() => {
-  autofix_pr_default = { isEnabled: () => false, isHidden: true, name: "stub" };
-});
-
-// src/tui/commands/backfill-sessions/index.js
-var backfill_sessions_default;
-var init_backfill_sessions = __esm(() => {
-  backfill_sessions_default = { isEnabled: () => false, isHidden: true, name: "stub" };
-});
-
 // src/tui/components/Spinner/SpinnerGlyph.tsx
 function SpinnerGlyph(t0) {
   const $ = import_compiler_runtime111.c(8);
@@ -344285,18 +344172,6 @@ var init_btw2 = __esm(() => {
   btw_default = btw;
 });
 
-// src/tui/commands/good-atlas/index.js
-var good_atlas_default;
-var init_good_atlas = __esm(() => {
-  good_atlas_default = { isEnabled: () => false, isHidden: true, name: "stub" };
-});
-
-// src/tui/commands/issue/index.js
-var issue_default;
-var init_issue = __esm(() => {
-  issue_default = { isEnabled: () => false, isHidden: true, name: "stub" };
-});
-
 // src/tui/components/Feedback.tsx
 import { readFile as readFile44, stat as stat43 } from "fs/promises";
 function redactSensitiveInfo(text) {
@@ -358139,12 +358014,6 @@ var init_diff4 = __esm(() => {
   };
 });
 
-// src/tui/commands/ctx_viz/index.js
-var ctx_viz_default;
-var init_ctx_viz = __esm(() => {
-  ctx_viz_default = { isEnabled: () => false, isHidden: true, name: "stub" };
-});
-
 // src/tui/components/KeybindingWarnings.tsx
 function KeybindingWarnings() {
   const $ = import_compiler_runtime133.c(2);
@@ -364093,55 +363962,6 @@ var init_logout2 = __esm(() => {
   };
 });
 
-// src/tui/commands/install-slack-app/install-slack-app.ts
-var exports_install_slack_app = {};
-__export(exports_install_slack_app, {
-  call: () => call22
-});
-async function call22() {
-  saveGlobalConfig((current) => ({
-    ...current,
-    slackAppInstallCount: (current.slackAppInstallCount ?? 0) + 1
-  }));
-  const success = await openBrowser(SLACK_APP_URL);
-  if (success) {
-    return {
-      type: "text",
-      value: "Opening Slack app installation page in browser…"
-    };
-  } else {
-    return {
-      type: "text",
-      value: `Couldn't open browser. Visit: ${SLACK_APP_URL}`
-    };
-  }
-}
-var SLACK_APP_URL = "https://slack.com/marketplace/A08SF47R6P4-claude";
-var init_install_slack_app = __esm(() => {
-  init_browser();
-  init_config6();
-});
-
-// src/tui/commands/install-slack-app/index.ts
-var installSlackApp, install_slack_app_default;
-var init_install_slack_app2 = __esm(() => {
-  installSlackApp = {
-    type: "local",
-    name: "install-slack-app",
-    description: "Install the Atlas Slack app",
-    availability: ["claude-ai"],
-    supportsNonInteractive: false,
-    load: () => Promise.resolve().then(() => (init_install_slack_app(), exports_install_slack_app))
-  };
-  install_slack_app_default = installSlackApp;
-});
-
-// src/tui/commands/break-cache/index.js
-var break_cache_default;
-var init_break_cache = __esm(() => {
-  break_cache_default = { isEnabled: () => false, isHidden: true, name: "stub" };
-});
-
 // src/tui/utils/activityManager.ts
 class ActivityManager {
   activeOperations = new Set;
@@ -370275,7 +370095,7 @@ var init_mcp5 = __esm(() => {
 // src/tui/commands/mcp/mcp.tsx
 var exports_mcp = {};
 __export(exports_mcp, {
-  call: () => call23
+  call: () => call22
 });
 function MCPToggle(t0) {
   const $ = import_compiler_runtime161.c(7);
@@ -370328,7 +370148,7 @@ function _temp235(c) {
 function _temp89(s) {
   return s.mcp.clients;
 }
-async function call23(onDone, _context, args) {
+async function call22(onDone, _context, args) {
   if (args) {
     const parts = args.trim().split(/\s+/);
     if (parts[0] === "no-redirect") {
@@ -370379,90 +370199,6 @@ var init_mcp7 = __esm(() => {
   mcp_default = mcp;
 });
 
-// src/tui/commands/onboarding/index.js
-var onboarding_default;
-var init_onboarding = __esm(() => {
-  onboarding_default = { isEnabled: () => false, isHidden: true, name: "stub" };
-});
-
-// src/tui/commands/createMovedToPluginCommand.ts
-function createMovedToPluginCommand({
-  name,
-  description,
-  progressMessage,
-  pluginName,
-  pluginCommand,
-  getPromptWhileMarketplaceIsPrivate
-}) {
-  return {
-    type: "prompt",
-    name,
-    description,
-    progressMessage,
-    contentLength: 0,
-    userFacingName() {
-      return name;
-    },
-    source: "builtin",
-    async getPromptForCommand(args, context) {
-      return getPromptWhileMarketplaceIsPrivate(args, context);
-    }
-  };
-}
-
-// src/tui/commands/pr_comments/index.ts
-var pr_comments_default;
-var init_pr_comments = __esm(() => {
-  pr_comments_default = createMovedToPluginCommand({
-    name: "pr-comments",
-    description: "Get comments from a GitHub pull request",
-    progressMessage: "fetching PR comments",
-    pluginName: "pr-comments",
-    pluginCommand: "pr-comments",
-    async getPromptWhileMarketplaceIsPrivate(args) {
-      return [
-        {
-          type: "text",
-          text: `You are an AI assistant integrated into a git-based version control system. Your task is to fetch and display comments from a GitHub pull request.
-
-Follow these steps:
-
-1. Use \`gh pr view --json number,headRepository\` to get the PR number and repository info
-2. Use \`gh api /repos/{owner}/{repo}/issues/{number}/comments\` to get PR-level comments
-3. Use \`gh api /repos/{owner}/{repo}/pulls/{number}/comments\` to get review comments. Pay particular attention to the following fields: \`body\`, \`diff_hunk\`, \`path\`, \`line\`, etc. If the comment references some code, consider fetching it using eg \`gh api /repos/{owner}/{repo}/contents/{path}?ref={branch} | jq .content -r | base64 -d\`
-4. Parse and format all comments in a readable way
-5. Return ONLY the formatted comments, with no additional text
-
-Format the comments as:
-
-## Comments
-
-[For each comment thread:]
-- @author file.ts#line:
-  \`\`\`diff
-  [diff_hunk from the API response]
-  \`\`\`
-  > quoted comment text
-
-  [any replies indented]
-
-If there are no comments, return "No comments found."
-
-Remember:
-1. Only show the actual comments, no explanatory text
-2. Include both PR-level and code review comments
-3. Preserve the threading/nesting of comment replies
-4. Show the file and line number context for code review comments
-5. Use jq to parse the JSON responses from the GitHub API
-
-${args ? "Additional user input: " + args : ""}
-`
-        }
-      ];
-    }
-  });
-});
-
 // src/tui/utils/releaseNotes.ts
 import { mkdir as mkdir44, readFile as readFile48, writeFile as writeFile39 } from "fs/promises";
 import { dirname as dirname71, join as join140 } from "path";
@@ -370618,7 +370354,7 @@ var init_releaseNotes = __esm(() => {
 // src/tui/commands/release-notes/release-notes.ts
 var exports_release_notes = {};
 __export(exports_release_notes, {
-  call: () => call24
+  call: () => call23
 });
 function formatReleaseNotes(notes) {
   return notes.map(([version, notes]) => {
@@ -370631,7 +370367,7 @@ ${bulletPoints}`;
 
 `);
 }
-async function call24() {
+async function call23() {
   let freshNotes = [];
   try {
     const timeoutPromise = new Promise((_, reject) => {
@@ -370822,9 +370558,9 @@ var init_generateSessionName = __esm(() => {
 // src/tui/commands/rename/rename.ts
 var exports_rename = {};
 __export(exports_rename, {
-  call: () => call25
+  call: () => call24
 });
-async function call25(onDone, context, args) {
+async function call24(onDone, context, args) {
   if (isTeammate2()) {
     onDone("Cannot rename: This session is a swarm teammate. Teammate names are set by the team leader.", { display: "system" });
     return null;
@@ -378791,7 +378527,7 @@ var init_crossProjectResume = __esm(() => {
 // src/tui/commands/resume/resume.tsx
 var exports_resume = {};
 __export(exports_resume, {
-  call: () => call26,
+  call: () => call25,
   filterResumableSessions: () => filterResumableSessions
 });
 function resumeHelpMessage(result) {
@@ -378977,7 +378713,7 @@ function ResumeCommand({
 function filterResumableSessions(logs, currentSessionId) {
   return logs.filter((l) => !l.isSidechain && getSessionIdFromLog(l) !== currentSessionId);
 }
-var import_compiler_runtime179, React69, jsx_dev_runtime221, call26 = async (onDone, context, args) => {
+var import_compiler_runtime179, React69, jsx_dev_runtime221, call25 = async (onDone, context, args) => {
   const onResume = async (sessionId, log, entrypoint) => {
     try {
       await context.resume?.(sessionId, log, entrypoint);
@@ -383375,7 +383111,7 @@ var init_server = __esm(() => {
 // src/tui/commands/session/session.tsx
 var exports_session = {};
 __export(exports_session, {
-  call: () => call27
+  call: () => call26
 });
 function SessionInfo(t0) {
   const $ = import_compiler_runtime180.c(19);
@@ -383565,7 +383301,7 @@ function _temp241(e) {
 function _temp105(s) {
   return s.remoteSessionUrl;
 }
-var import_compiler_runtime180, import_react131, jsx_dev_runtime222, call27 = async (onDone) => {
+var import_compiler_runtime180, import_react131, jsx_dev_runtime222, call26 = async (onDone) => {
   return /* @__PURE__ */ jsx_dev_runtime222.jsxDEV(SessionInfo, {
     onDone
   }, undefined, false, undefined, this);
@@ -383596,12 +383332,6 @@ var init_session3 = __esm(() => {
   session_default = session;
 });
 
-// src/tui/commands/share/index.js
-var share_default;
-var init_share = __esm(() => {
-  share_default = { isEnabled: () => false, isHidden: true, name: "stub" };
-});
-
 // src/tui/components/skills/SkillsMenu.tsx
 function getSourceTitle(source) {
   if (source === "plugin") {
@@ -383927,9 +383657,9 @@ var init_SkillsMenu = __esm(() => {
 // src/tui/commands/skills/skills.tsx
 var exports_skills = {};
 __export(exports_skills, {
-  call: () => call28
+  call: () => call27
 });
-async function call28(onDone, context) {
+async function call27(onDone, context) {
   return /* @__PURE__ */ jsx_dev_runtime224.jsxDEV(SkillsMenu, {
     onExit: onDone,
     commands: context.options.commands
@@ -383956,9 +383686,9 @@ var init_skills3 = __esm(() => {
 // src/tui/commands/status/status.tsx
 var exports_status = {};
 __export(exports_status, {
-  call: () => call29
+  call: () => call28
 });
-async function call29(onDone, context) {
+async function call28(onDone, context) {
   return /* @__PURE__ */ jsx_dev_runtime225.jsxDEV(Settings, {
     onClose: onDone,
     context,
@@ -387154,9 +386884,9 @@ var init_BackgroundTasksDialog = __esm(() => {
 // src/tui/commands/tasks/tasks.tsx
 var exports_tasks = {};
 __export(exports_tasks, {
-  call: () => call30
+  call: () => call29
 });
-async function call30(onDone, context) {
+async function call29(onDone, context) {
   return /* @__PURE__ */ jsx_dev_runtime234.jsxDEV(BackgroundTasksDialog, {
     toolUseContext: context,
     onDone
@@ -387603,9 +387333,9 @@ var init_FileTaskDialog = __esm(() => {
 // src/tui/commands/tasklist/tasklist.tsx
 var exports_tasklist = {};
 __export(exports_tasklist, {
-  call: () => call31
+  call: () => call30
 });
-async function call31(onDone, _context) {
+async function call30(onDone, _context) {
   return /* @__PURE__ */ jsx_dev_runtime236.jsxDEV(FileTaskDialog, {
     onDone
   }, undefined, false, undefined, this);
@@ -387629,243 +387359,6 @@ var init_tasklist2 = __esm(() => {
   tasklist_default = tasklist;
 });
 
-// src/tui/commands/security-review.ts
-var SECURITY_REVIEW_MARKDOWN = `---
-allowed-tools: Bash(git diff:*), Bash(git status:*), Bash(git log:*), Bash(git show:*), Bash(git remote show:*), Read, Glob, Grep, LS, Task
-description: Complete a security review of the pending changes on the current branch
----
-
-You are a senior security engineer conducting a focused security review of the changes on this branch.
-
-GIT STATUS:
-
-\`\`\`
-!\`git status\`
-\`\`\`
-
-FILES MODIFIED:
-
-\`\`\`
-!\`git diff --name-only origin/HEAD...\`
-\`\`\`
-
-COMMITS:
-
-\`\`\`
-!\`git log --no-decorate origin/HEAD...\`
-\`\`\`
-
-DIFF CONTENT:
-
-\`\`\`
-!\`git diff origin/HEAD...\`
-\`\`\`
-
-Review the complete diff above. This contains all code changes in the PR.
-
-
-OBJECTIVE:
-Perform a security-focused code review to identify HIGH-CONFIDENCE security vulnerabilities that could have real exploitation potential. This is not a general code review - focus ONLY on security implications newly added by this PR. Do not comment on existing security concerns.
-
-CRITICAL INSTRUCTIONS:
-1. MINIMIZE FALSE POSITIVES: Only flag issues where you're >80% confident of actual exploitability
-2. AVOID NOISE: Skip theoretical issues, style concerns, or low-impact findings
-3. FOCUS ON IMPACT: Prioritize vulnerabilities that could lead to unauthorized access, data breaches, or system compromise
-4. EXCLUSIONS: Do NOT report the following issue types:
-   - Denial of Service (DOS) vulnerabilities, even if they allow service disruption
-   - Secrets or sensitive data stored on disk (these are handled by other processes)
-   - Rate limiting or resource exhaustion issues
-
-SECURITY CATEGORIES TO EXAMINE:
-
-**Input Validation Vulnerabilities:**
-- SQL injection via unsanitized user input
-- Command injection in system calls or subprocesses
-- XXE injection in XML parsing
-- Template injection in templating engines
-- NoSQL injection in database queries
-- Path traversal in file operations
-
-**Authentication & Authorization Issues:**
-- Authentication bypass logic
-- Privilege escalation paths
-- Session management flaws
-- JWT token vulnerabilities
-- Authorization logic bypasses
-
-**Crypto & Secrets Management:**
-- Hardcoded API keys, passwords, or tokens
-- Weak cryptographic algorithms or implementations
-- Improper key storage or management
-- Cryptographic randomness issues
-- Certificate validation bypasses
-
-**Injection & Code Execution:**
-- Remote code execution via deseralization
-- Pickle injection in Python
-- YAML deserialization vulnerabilities
-- Eval injection in dynamic code execution
-- XSS vulnerabilities in web applications (reflected, stored, DOM-based)
-
-**Data Exposure:**
-- Sensitive data logging or storage
-- PII handling violations
-- API endpoint data leakage
-- Debug information exposure
-
-Additional notes:
-- Even if something is only exploitable from the local network, it can still be a HIGH severity issue
-
-ANALYSIS METHODOLOGY:
-
-Phase 1 - Repository Context Research (Use file search tools):
-- Identify existing security frameworks and libraries in use
-- Look for established secure coding patterns in the codebase
-- Examine existing sanitization and validation patterns
-- Understand the project's security model and threat model
-
-Phase 2 - Comparative Analysis:
-- Compare new code changes against existing security patterns
-- Identify deviations from established secure practices
-- Look for inconsistent security implementations
-- Flag code that introduces new attack surfaces
-
-Phase 3 - Vulnerability Assessment:
-- Examine each modified file for security implications
-- Trace data flow from user inputs to sensitive operations
-- Look for privilege boundaries being crossed unsafely
-- Identify injection points and unsafe deserialization
-
-REQUIRED OUTPUT FORMAT:
-
-You MUST output your findings in markdown. The markdown output should contain the file, line number, severity, category (e.g. \`sql_injection\` or \`xss\`), description, exploit scenario, and fix recommendation.
-
-For example:
-
-# Vuln 1: XSS: \`foo.py:42\`
-
-* Severity: High
-* Description: User input from \`username\` parameter is directly interpolated into HTML without escaping, allowing reflected XSS attacks
-* Exploit Scenario: Attacker crafts URL like /bar?q=<script>alert(document.cookie)</script> to execute JavaScript in victim's browser, enabling session hijacking or data theft
-* Recommendation: Use Flask's escape() function or Jinja2 templates with auto-escaping enabled for all user inputs rendered in HTML
-
-SEVERITY GUIDELINES:
-- **HIGH**: Directly exploitable vulnerabilities leading to RCE, data breach, or authentication bypass
-- **MEDIUM**: Vulnerabilities requiring specific conditions but with significant impact
-- **LOW**: Defense-in-depth issues or lower-impact vulnerabilities
-
-CONFIDENCE SCORING:
-- 0.9-1.0: Certain exploit path identified, tested if possible
-- 0.8-0.9: Clear vulnerability pattern with known exploitation methods
-- 0.7-0.8: Suspicious pattern requiring specific conditions to exploit
-- Below 0.7: Don't report (too speculative)
-
-FINAL REMINDER:
-Focus on HIGH and MEDIUM findings only. Better to miss some theoretical issues than flood the report with false positives. Each finding should be something a security engineer would confidently raise in a PR review.
-
-FALSE POSITIVE FILTERING:
-
-> You do not need to run commands to reproduce the vulnerability, just read the code to determine if it is a real vulnerability. Do not use the bash tool or write to any files.
->
-> HARD EXCLUSIONS - Automatically exclude findings matching these patterns:
-> 1. Denial of Service (DOS) vulnerabilities or resource exhaustion attacks.
-> 2. Secrets or credentials stored on disk if they are otherwise secured.
-> 3. Rate limiting concerns or service overload scenarios.
-> 4. Memory consumption or CPU exhaustion issues.
-> 5. Lack of input validation on non-security-critical fields without proven security impact.
-> 6. Input sanitization concerns for GitHub Action workflows unless they are clearly triggerable via untrusted input.
-> 7. A lack of hardening measures. Code is not expected to implement all security best practices, only flag concrete vulnerabilities.
-> 8. Race conditions or timing attacks that are theoretical rather than practical issues. Only report a race condition if it is concretely problematic.
-> 9. Vulnerabilities related to outdated third-party libraries. These are managed separately and should not be reported here.
-> 10. Memory safety issues such as buffer overflows or use-after-free-vulnerabilities are impossible in rust. Do not report memory safety issues in rust or any other memory safe languages.
-> 11. Files that are only unit tests or only used as part of running tests.
-> 12. Log spoofing concerns. Outputting un-sanitized user input to logs is not a vulnerability.
-> 13. SSRF vulnerabilities that only control the path. SSRF is only a concern if it can control the host or protocol.
-> 14. Including user-controlled content in AI system prompts is not a vulnerability.
-> 15. Regex injection. Injecting untrusted content into a regex is not a vulnerability.
-> 16. Regex DOS concerns.
-> 16. Insecure documentation. Do not report any findings in documentation files such as markdown files.
-> 17. A lack of audit logs is not a vulnerability.
->
-> PRECEDENTS -
-> 1. Logging high value secrets in plaintext is a vulnerability. Logging URLs is assumed to be safe.
-> 2. UUIDs can be assumed to be unguessable and do not need to be validated.
-> 3. Environment variables and CLI flags are trusted values. Attackers are generally not able to modify them in a secure environment. Any attack that relies on controlling an environment variable is invalid.
-> 4. Resource management issues such as memory or file descriptor leaks are not valid.
-> 5. Subtle or low impact web vulnerabilities such as tabnabbing, XS-Leaks, prototype pollution, and open redirects should not be reported unless they are extremely high confidence.
-> 6. React and Angular are generally secure against XSS. These frameworks do not need to sanitize or escape user input unless it is using dangerouslySetInnerHTML, bypassSecurityTrustHtml, or similar methods. Do not report XSS vulnerabilities in React or Angular components or tsx files unless they are using unsafe methods.
-> 7. Most vulnerabilities in github action workflows are not exploitable in practice. Before validating a github action workflow vulnerability ensure it is concrete and has a very specific attack path.
-> 8. A lack of permission checking or authentication in client-side JS/TS code is not a vulnerability. Client-side code is not trusted and does not need to implement these checks, they are handled on the server-side. The same applies to all flows that send untrusted data to the backend, the backend is responsible for validating and sanitizing all inputs.
-> 9. Only include MEDIUM findings if they are obvious and concrete issues.
-> 10. Most vulnerabilities in ipython notebooks (*.ipynb files) are not exploitable in practice. Before validating a notebook vulnerability ensure it is concrete and has a very specific attack path where untrusted input can trigger the vulnerability.
-> 11. Logging non-PII data is not a vulnerability even if the data may be sensitive. Only report logging vulnerabilities if they expose sensitive information such as secrets, passwords, or personally identifiable information (PII).
-> 12. Command injection vulnerabilities in shell scripts are generally not exploitable in practice since shell scripts generally do not run with untrusted user input. Only report command injection vulnerabilities in shell scripts if they are concrete and have a very specific attack path for untrusted input.
->
-> SIGNAL QUALITY CRITERIA - For remaining findings, assess:
-> 1. Is there a concrete, exploitable vulnerability with a clear attack path?
-> 2. Does this represent a real security risk vs theoretical best practice?
-> 3. Are there specific code locations and reproduction steps?
-> 4. Would this finding be actionable for a security team?
->
-> For each finding, assign a confidence score from 1-10:
-> - 1-3: Low confidence, likely false positive or noise
-> - 4-6: Medium confidence, needs investigation
-> - 7-10: High confidence, likely true vulnerability
-
-START ANALYSIS:
-
-Begin your analysis now. Do this in 3 steps:
-
-1. Use a sub-task to identify vulnerabilities. Use the repository exploration tools to understand the codebase context, then analyze the PR changes for security implications. In the prompt for this sub-task, include all of the above.
-2. Then for each vulnerability identified by the above sub-task, create a new sub-task to filter out false-positives. Launch these sub-tasks as parallel sub-tasks. In the prompt for these sub-tasks, include everything in the "FALSE POSITIVE FILTERING" instructions.
-3. Filter out any vulnerabilities where the sub-task reported a confidence less than 8.
-
-Your final reply must contain the markdown report and nothing else.`, security_review_default;
-var init_security_review = __esm(() => {
-  init_frontmatterParser2();
-  init_markdownConfigLoader();
-  init_promptShellExecution2();
-  security_review_default = createMovedToPluginCommand({
-    name: "security-review",
-    description: "Complete a security review of the pending changes on the current branch",
-    progressMessage: "analyzing code changes for security risks",
-    pluginName: "security-review",
-    pluginCommand: "security-review",
-    async getPromptWhileMarketplaceIsPrivate(_args, context) {
-      const parsed = parseFrontmatter2(SECURITY_REVIEW_MARKDOWN);
-      const allowedTools = parseSlashCommandToolsFromFrontmatter2(parsed.frontmatter["allowed-tools"]);
-      const processedContent = await executeShellCommandsInPrompt2(parsed.content, {
-        ...context,
-        getAppState() {
-          const appState = context.getAppState();
-          return {
-            ...appState,
-            toolPermissionContext: {
-              ...appState.toolPermissionContext,
-              alwaysAllowRules: {
-                ...appState.toolPermissionContext.alwaysAllowRules,
-                command: allowedTools
-              }
-            }
-          };
-        }
-      }, "security-review");
-      return [
-        {
-          type: "text",
-          text: processedContent
-        }
-      ];
-    }
-  });
-});
-
-// src/tui/commands/bughunter/index.js
-var bughunter_default;
-var init_bughunter = __esm(() => {
-  bughunter_default = { isEnabled: () => false, isHidden: true, name: "stub" };
-});
-
 // src/tui/commands/terminalSetup/index.ts
 var NATIVE_CSIU_TERMINALS2, terminalSetup, terminalSetup_default;
 var init_terminalSetup2 = __esm(() => {
@@ -387889,9 +387382,9 @@ var init_terminalSetup2 = __esm(() => {
 // src/tui/commands/usage/usage.tsx
 var exports_usage2 = {};
 __export(exports_usage2, {
-  call: () => call32
+  call: () => call31
 });
-var jsx_dev_runtime237, call32 = async (onDone, context) => {
+var jsx_dev_runtime237, call31 = async (onDone, context) => {
   return /* @__PURE__ */ jsx_dev_runtime237.jsxDEV(Settings, {
     onClose: onDone,
     context,
@@ -387918,7 +387411,7 @@ var init_usage4 = __esm(() => {
 // src/tui/commands/theme/theme.tsx
 var exports_theme = {};
 __export(exports_theme, {
-  call: () => call33
+  call: () => call32
 });
 function ThemePickerCommand(t0) {
   const $ = import_compiler_runtime189.c(8);
@@ -387968,7 +387461,7 @@ function ThemePickerCommand(t0) {
   }
   return t3;
 }
-var import_compiler_runtime189, jsx_dev_runtime238, call33 = async (onDone, _context) => {
+var import_compiler_runtime189, jsx_dev_runtime238, call32 = async (onDone, _context) => {
   return /* @__PURE__ */ jsx_dev_runtime238.jsxDEV(ThemePickerCommand, {
     onDone
   }, undefined, false, undefined, this);
@@ -387996,9 +387489,9 @@ var init_theme3 = __esm(() => {
 // src/tui/commands/vim/vim.ts
 var exports_vim = {};
 __export(exports_vim, {
-  call: () => call34
+  call: () => call33
 });
-var call34 = async () => {
+var call33 = async () => {
   const config = getGlobalConfig();
   let currentMode = config.editorMode || "normal";
   if (currentMode === "emacs") {
@@ -388710,7 +388203,7 @@ var init_pluginOperations = __esm(() => {
 // src/tui/commands/thinkback/thinkback.tsx
 var exports_thinkback = {};
 __export(exports_thinkback, {
-  call: () => call35,
+  call: () => call34,
   playAnimation: () => playAnimation
 });
 import { readFile as readFile49 } from "fs/promises";
@@ -389248,7 +388741,7 @@ function ThinkbackFlow(t0) {
   }
   return t8;
 }
-async function call35(onDone) {
+async function call34(onDone) {
   return /* @__PURE__ */ jsx_dev_runtime239.jsxDEV(ThinkbackFlow, {
     onDone
   }, undefined, false, undefined, this);
@@ -389296,13 +388789,13 @@ var init_thinkback2 = __esm(() => {
 // src/tui/commands/thinkback-play/thinkback-play.ts
 var exports_thinkback_play = {};
 __export(exports_thinkback_play, {
-  call: () => call36
+  call: () => call35
 });
 import { join as join144 } from "path";
 function getPluginId2() {
   return `thinkback@${OFFICIAL_MARKETPLACE_NAME}`;
 }
-async function call36() {
+async function call35() {
   const v2Data = loadInstalledPluginsV2();
   const pluginId = getPluginId2();
   const installations = v2Data.plugins[pluginId];
@@ -391804,9 +391297,9 @@ var init_PermissionRuleList = __esm(() => {
 // src/tui/commands/permissions/permissions.tsx
 var exports_permissions2 = {};
 __export(exports_permissions2, {
-  call: () => call37
+  call: () => call36
 });
-var jsx_dev_runtime247, call37 = async (onDone, context) => {
+var jsx_dev_runtime247, call36 = async (onDone, context) => {
   return /* @__PURE__ */ jsx_dev_runtime247.jsxDEV(PermissionRuleList, {
     onExit: onDone,
     onRetryDenials: (commands) => {
@@ -391836,7 +391329,7 @@ var init_permissions8 = __esm(() => {
 // src/tui/commands/plan/plan.tsx
 var exports_plan = {};
 __export(exports_plan, {
-  call: () => call38
+  call: () => call37
 });
 function PlanDisplay(t0) {
   const $ = import_compiler_runtime198.c(11);
@@ -391924,7 +391417,7 @@ function PlanDisplay(t0) {
   }
   return t5;
 }
-async function call38(onDone, context, args) {
+async function call37(onDone, context, args) {
   const {
     getAppState,
     setAppState
@@ -393762,9 +393255,9 @@ var init_HooksConfigMenu = __esm(() => {
 // src/tui/commands/hooks/hooks.tsx
 var exports_hooks = {};
 __export(exports_hooks, {
-  call: () => call39
+  call: () => call38
 });
-var jsx_dev_runtime254, call39 = async (onDone, context) => {
+var jsx_dev_runtime254, call38 = async (onDone, context) => {
   const appState = context.getAppState();
   const permissionContext = appState.toolPermissionContext;
   const toolNames = getTools2(permissionContext).map((tool) => tool.name);
@@ -393795,10 +393288,10 @@ var init_hooks5 = __esm(() => {
 // src/tui/commands/files/files.ts
 var exports_files4 = {};
 __export(exports_files4, {
-  call: () => call40
+  call: () => call39
 });
 import { relative as relative27 } from "path";
-async function call40(_args, context) {
+async function call39(_args, context) {
   const files = context.readFileState ? cacheKeys(context.readFileState) : [];
   if (files.length === 0) {
     return { type: "text", value: "No files in context" };
@@ -393820,7 +393313,7 @@ var init_files8 = __esm(() => {
     type: "local",
     name: "files",
     description: "List all files currently in context",
-    isEnabled: () => false,
+    isEnabled: () => true,
     supportsNonInteractive: true,
     load: () => Promise.resolve().then(() => (init_files7(), exports_files4))
   };
@@ -393830,7 +393323,7 @@ var init_files8 = __esm(() => {
 // src/tui/commands/branch/branch.ts
 var exports_branch = {};
 __export(exports_branch, {
-  call: () => call41,
+  call: () => call40,
   createFork: () => createFork,
   deriveFirstPrompt: () => deriveFirstPrompt,
   getUniqueForkName: () => getUniqueForkName
@@ -393939,7 +393432,7 @@ async function getUniqueForkName(baseName) {
   }
   return `${baseName} (Branch ${nextNumber})`;
 }
-async function call41(onDone, context, args) {
+async function call40(onDone, context, args) {
   const customTitle = args?.trim() || undefined;
   const originalSessionId = getSessionId();
   try {
@@ -399983,9 +399476,9 @@ var init_AgentsMenu = __esm(() => {
 // src/tui/commands/agents/agents.tsx
 var exports_agents2 = {};
 __export(exports_agents2, {
-  call: () => call42
+  call: () => call41
 });
-async function call42(onDone, context) {
+async function call41(onDone, context) {
   const appState = context.getAppState();
   const permissionContext = appState.toolPermissionContext;
   const tools = getTools2(permissionContext);
@@ -410274,9 +409767,9 @@ var init_PluginSettings = __esm(() => {
 // src/tui/commands/plugin/plugin.tsx
 var exports_plugin = {};
 __export(exports_plugin, {
-  call: () => call43
+  call: () => call42
 });
-async function call43(onDone, _context, args) {
+async function call42(onDone, _context, args) {
   return /* @__PURE__ */ jsx_dev_runtime294.jsxDEV(PluginSettings, {
     onComplete: onDone,
     args
@@ -410305,12 +409798,12 @@ var init_plugin3 = __esm(() => {
 // src/tui/commands/reload-plugins/reload-plugins.ts
 var exports_reload_plugins = {};
 __export(exports_reload_plugins, {
-  call: () => call44
+  call: () => call43
 });
 function n2(count, noun) {
   return `${count} ${plural2(count, noun)}`;
 }
-var call44 = async (_args, context) => {
+var call43 = async (_args, context) => {
   const r = await refreshActivePlugins(context.setAppState);
   const parts = [
     n2(r.enabled_count, "plugin"),
@@ -410348,9 +409841,9 @@ var init_reload_plugins2 = __esm(() => {
 // src/tui/commands/rewind/rewind.ts
 var exports_rewind = {};
 __export(exports_rewind, {
-  call: () => call45
+  call: () => call44
 });
-async function call45(_args, context) {
+async function call44(_args, context) {
   if (context.openMessageSelector) {
     context.openMessageSelector();
   }
@@ -410523,9 +410016,9 @@ var init_heapDumpService = __esm(() => {
 // src/tui/commands/heapdump/heapdump.ts
 var exports_heapdump = {};
 __export(exports_heapdump, {
-  call: () => call46
+  call: () => call45
 });
-async function call46() {
+async function call45() {
   const result = await performHeapDump();
   if (!result.success) {
     return {
@@ -410558,7 +410051,7 @@ var init_heapdump2 = __esm(() => {
 });
 
 // src/tui/commands/version.ts
-var call47 = async () => {
+var call46 = async () => {
   return {
     type: "text",
     value: MACRO.BUILD_TIME ? `${MACRO.VERSION} (built ${MACRO.BUILD_TIME})` : MACRO.VERSION
@@ -410569,25 +410062,13 @@ var init_version = __esm(() => {
     type: "local",
     name: "version",
     description: "Print the version this session is running (not what autoupdate downloaded)",
-    isEnabled: () => false,
+    isEnabled: () => true,
     supportsNonInteractive: true,
-    load: () => Promise.resolve({ call: call47 })
+    load: () => Promise.resolve({ call: call46 })
   };
   version_default = version2;
 });
 
-// src/tui/commands/summary/index.js
-var summary_default;
-var init_summary = __esm(() => {
-  summary_default = { isEnabled: () => false, isHidden: true, name: "stub" };
-});
-
-// src/tui/commands/perf-issue/index.js
-var perf_issue_default;
-var init_perf_issue = __esm(() => {
-  perf_issue_default = { isEnabled: () => false, isHidden: true, name: "stub" };
-});
-
 // src/tui/components/sandbox/SandboxConfigTab.tsx
 function SandboxConfigTab() {
   const $ = import_compiler_runtime232.c(3);
@@ -411689,10 +411170,10 @@ var init_SandboxSettings = __esm(() => {
 // src/tui/commands/sandbox-toggle/sandbox-toggle.tsx
 var exports_sandbox_toggle = {};
 __export(exports_sandbox_toggle, {
-  call: () => call48
+  call: () => call47
 });
 import { relative as relative28 } from "path";
-async function call48(onDone, _context, args) {
+async function call47(onDone, _context, args) {
   const settings = getSettings_DEPRECATED();
   const themeName = settings.theme || "light";
   const platform = getPlatform3();
@@ -411799,9 +411280,9 @@ var init_sandbox_toggle2 = __esm(() => {
 // src/tui/commands/stickers/stickers.ts
 var exports_stickers = {};
 __export(exports_stickers, {
-  call: () => call49
+  call: () => call48
 });
-async function call49() {
+async function call48() {
   const url = "https://www.stickermule.com/claudecode";
   const success = await openBrowser(url);
   if (success) {
@@ -411946,12 +411427,6 @@ var init_bundledSkills2 = __esm(() => {
   SAFE_WRITE_FLAGS2 = process.platform === "win32" ? "wx" : fsConstants8.O_WRONLY | fsConstants8.O_CREAT | fsConstants8.O_EXCL | O_NOFOLLOW3;
 });
 
-// src/tui/commands/env/index.js
-var env_default;
-var init_env3 = __esm(() => {
-  env_default = { isEnabled: () => false, isHidden: true, name: "stub" };
-});
-
 // src/tui/components/WorktreeExitDialog.tsx
 function recordWorktreeExit() {
   (init_sessionStorage(), __toCommonJS(exports_sessionStorage)).saveWorktreeState(null);
@@ -412341,13 +411816,13 @@ var init_concurrentSessions2 = __esm(() => {
 // src/tui/commands/exit/exit.tsx
 var exports_exit = {};
 __export(exports_exit, {
-  call: () => call50
+  call: () => call49
 });
 import { spawnSync as spawnSync5 } from "child_process";
 function getRandomGoodbyeMessage2() {
   return sample_default(GOODBYE_MESSAGES2) ?? "Goodbye!";
 }
-async function call50(onDone) {
+async function call49(onDone) {
   if (feature("BG_SESSIONS") && isBgSession2()) {
     onDone();
     spawnSync5("tmux", ["detach-client"], {
@@ -412646,7 +412121,7 @@ var init_exportRenderer = __esm(() => {
 // src/tui/commands/export/export.tsx
 var exports_export = {};
 __export(exports_export, {
-  call: () => call51,
+  call: () => call50,
   extractFirstPrompt: () => extractFirstPrompt2,
   sanitizeFilename: () => sanitizeFilename
 });
@@ -412689,7 +412164,7 @@ async function exportWithReactRenderer(context) {
   const tools = context.options.tools || [];
   return renderMessagesToPlainText(context.messages, tools);
 }
-async function call51(onDone, context, args) {
+async function call50(onDone, context, args) {
   const content = await exportWithReactRenderer(context);
   const filename = args.trim();
   if (filename) {
@@ -412754,7 +412229,7 @@ function shouldInferenceConfigCommandBeImmediate() {
 // src/tui/commands/model/model.tsx
 var exports_model = {};
 __export(exports_model, {
-  call: () => call52
+  call: () => call51
 });
 function ModelPickerWrapper(t0) {
   const $ = import_compiler_runtime237.c(17);
@@ -412930,7 +412405,7 @@ function renderModelLabel(model) {
   const rendered = renderDefaultModelSetting(model ?? getDefaultMainLoopModelSetting());
   return model === null ? `${rendered} (default)` : rendered;
 }
-var import_compiler_runtime237, React90, jsx_dev_runtime306, call52 = async (onDone, _context, args) => {
+var import_compiler_runtime237, React90, jsx_dev_runtime306, call51 = async (onDone, _context, args) => {
   args = args?.trim() || "";
   if (COMMON_INFO_ARGS.includes(args)) {
     return /* @__PURE__ */ jsx_dev_runtime306.jsxDEV(ShowModelAndClose, {
@@ -412989,7 +412464,7 @@ var init_model3 = __esm(() => {
 // src/tui/commands/tag/tag.tsx
 var exports_tag = {};
 __export(exports_tag, {
-  call: () => call53
+  call: () => call52
 });
 function ConfirmRemoveTag(t0) {
   const $ = import_compiler_runtime238.c(11);
@@ -413207,7 +412682,7 @@ Examples:
   React91.useEffect(t1, t2);
   return null;
 }
-async function call53(onDone, _context, args) {
+async function call52(onDone, _context, args) {
   args = args?.trim() || "";
   if (COMMON_INFO_ARGS.includes(args) || COMMON_HELP_ARGS.includes(args)) {
     return /* @__PURE__ */ jsx_dev_runtime307.jsxDEV(ShowHelp, {
@@ -413245,62 +412720,13 @@ var init_tag2 = __esm(() => {
     type: "local-jsx",
     name: "tag",
     description: "Toggle a searchable tag on the current session",
-    isEnabled: () => false,
+    isEnabled: () => true,
     argumentHint: "<tag-name>",
     load: () => Promise.resolve().then(() => (init_tag(), exports_tag))
   };
   tag_default = tag;
 });
 
-// src/tui/commands/output-style/output-style.tsx
-var exports_output_style = {};
-__export(exports_output_style, {
-  call: () => call54
-});
-async function call54(onDone) {
-  onDone("/output-style has been deprecated. Use /config to change your output style, or set it in your settings file. Changes take effect on the next session.", {
-    display: "system"
-  });
-}
-
-// src/tui/commands/output-style/index.ts
-var outputStyle, output_style_default;
-var init_output_style = __esm(() => {
-  outputStyle = {
-    type: "local-jsx",
-    name: "output-style",
-    description: "Deprecated: use /config to change output style",
-    isHidden: true,
-    load: () => Promise.resolve().then(() => exports_output_style)
-  };
-  output_style_default = outputStyle;
-});
-
-// src/tui/commands/statusline.tsx
-var statusline, statusline_default;
-var init_statusline = __esm(() => {
-  init_constants6();
-  statusline = {
-    type: "prompt",
-    description: "Set up Atlas's status line UI with segment-based configuration",
-    contentLength: 0,
-    aliases: [],
-    name: "statusline",
-    progressMessage: "setting up statusLine",
-    allowedTools: [AGENT_TOOL_NAME2, "Read(~/**)", "Edit(~/.atlas/statusline.json)"],
-    source: "builtin",
-    disableNonInteractive: true,
-    async getPromptForCommand(args) {
-      const prompt = args.trim() || "Configure my status line with model, thinking level, git branch, cwd, context bar, git files, and tok/s";
-      return [{
-        type: "text",
-        text: `Create an ${AGENT_TOOL_NAME2} with subagent_type "statusline-setup" and the prompt "${prompt}"`
-      }];
-    }
-  };
-  statusline_default = statusline;
-});
-
 // src/tui/commands/sessionlist.tsx
 var sessionlist;
 var init_sessionlist = __esm(() => {
@@ -413328,7 +412754,7 @@ var init_sessionlist = __esm(() => {
 // src/tui/commands/effort/effort.tsx
 var exports_effort = {};
 __export(exports_effort, {
-  call: () => call55,
+  call: () => call53,
   executeEffort: () => executeEffort,
   showCurrentEffort: () => showCurrentEffort
 });
@@ -413477,7 +412903,7 @@ function ApplyEffortAndClose(t0) {
   React92.useEffect(t1, t2);
   return null;
 }
-async function call55(onDone, _context, args) {
+async function call53(onDone, _context, args) {
   args = args?.trim() || "";
   if (COMMON_HELP_ARGS2.includes(args)) {
     onDone(`Usage: /effort [low|medium|high|xhigh|max|auto]
@@ -416501,9 +415927,9 @@ var init_Stats = __esm(() => {
 // src/tui/commands/stats/stats.tsx
 var exports_stats = {};
 __export(exports_stats, {
-  call: () => call56
+  call: () => call54
 });
-var jsx_dev_runtime310, call56 = async (onDone) => {
+var jsx_dev_runtime310, call54 = async (onDone) => {
   return /* @__PURE__ */ jsx_dev_runtime310.jsxDEV(Stats2, {
     onClose: onDone
   }, undefined, false, undefined, this);
@@ -416525,18 +415951,6 @@ var init_stats3 = __esm(() => {
   stats_default = stats;
 });
 
-// src/tui/commands/oauth-refresh/index.js
-var oauth_refresh_default;
-var init_oauth_refresh = __esm(() => {
-  oauth_refresh_default = { isEnabled: () => false, isHidden: true, name: "stub" };
-});
-
-// src/tui/commands/debug-tool-call/index.js
-var debug_tool_call_default;
-var init_debug_tool_call = __esm(() => {
-  debug_tool_call_default = { isEnabled: () => false, isHidden: true, name: "stub" };
-});
-
 // src/tui/types/command.ts
 function getCommandName2(cmd) {
   return cmd.userFacingName?.() ?? cmd.name;
@@ -417267,9 +416681,9 @@ var init_useVoice = __esm(() => {
 // src/tui/commands/voice/voice.ts
 var exports_voice3 = {};
 __export(exports_voice3, {
-  call: () => call57
+  call: () => call55
 });
-var LANG_HINT_MAX_SHOWS = 2, call57 = async () => {
+var LANG_HINT_MAX_SHOWS = 2, call55 = async () => {
   if (!isVoiceModeEnabled()) {
     return {
       type: "text",
@@ -417436,13 +416850,6 @@ var init_workflows = __esm(() => {
   workflows_default = _default2;
 });
 
-// src/tui/commands/torch.ts
-var exports_torch = {};
-__export(exports_torch, {
-  default: () => torch_default
-});
-var torch_default = null;
-
 // src/tui/commands/peers/index.ts
 var exports_peers = {};
 __export(exports_peers, {
@@ -419606,14 +419013,10 @@ function formatDescriptionWithSource2(cmd) {
   }
   return `${cmd.description} (${getSettingSourceName(cmd.source)})`;
 }
-var IS_ATLAS_DEV2, agentsPlatform, voiceCommand, forceSnip, workflowsCmd, torch, peersCmd, forkCmd, usageReport2, INTERNAL_ONLY_COMMANDS2, COMMANDS, builtInCommandNames3, loadAllCommands2, getSkillToolCommands2, getSlashCommandToolSkills2, REMOTE_SAFE_COMMANDS, BRIDGE_SAFE_COMMANDS;
+var IS_ATLAS_DEV2, agentsPlatform, voiceCommand, forceSnip, workflowsCmd, peersCmd, forkCmd, usageReport2, INTERNAL_ONLY_COMMANDS2, COMMANDS, builtInCommandNames3, loadAllCommands2, getSkillToolCommands2, getSlashCommandToolSkills2, REMOTE_SAFE_COMMANDS, BRIDGE_SAFE_COMMANDS;
 var init_commands5 = __esm(() => {
   init_add_dir2();
-  init_autofix_pr();
-  init_backfill_sessions();
   init_btw2();
-  init_good_atlas();
-  init_issue();
   init_feedback2();
   init_clear2();
   init_color3();
@@ -419626,7 +419029,6 @@ var init_commands5 = __esm(() => {
   init_context4();
   init_cost2();
   init_diff4();
-  init_ctx_viz();
   init_doctor2();
   init_memory3();
   init_help3();
@@ -419636,23 +419038,16 @@ var init_commands5 = __esm(() => {
   init_keybindings2();
   init_login2();
   init_logout2();
-  init_install_slack_app2();
-  init_break_cache();
   init_mcp7();
-  init_onboarding();
-  init_pr_comments();
   init_release_notes2();
   init_rename2();
   init_resume2();
   init_review();
   init_session3();
-  init_share();
   init_skills3();
   init_status3();
   init_tasks8();
   init_tasklist2();
-  init_security_review();
-  init_bughunter();
   init_terminalSetup2();
   init_usage4();
   init_theme3();
@@ -419671,8 +419066,6 @@ var init_commands5 = __esm(() => {
   init_rewind();
   init_heapdump2();
   init_version();
-  init_summary();
-  init_perf_issue();
   init_sandbox_toggle2();
   init_stickers2();
   init_log5();
@@ -419683,25 +419076,19 @@ var init_commands5 = __esm(() => {
   init_builtinPlugins();
   init_loadPluginCommands();
   init_memoize();
-  init_env3();
   init_exit2();
   init_export2();
   init_model3();
   init_tag2();
-  init_output_style();
-  init_statusline();
   init_sessionlist();
   init_effort4();
   init_stats3();
-  init_oauth_refresh();
-  init_debug_tool_call();
   init_constants5();
   IS_ATLAS_DEV2 = process.env.ATLAS_DEV === "1" || process.env.ATLAS_DEV === "true";
   agentsPlatform = IS_ATLAS_DEV2 ? __toCommonJS(exports_agents_platform).default : null;
   voiceCommand = feature("VOICE_MODE") ? (init_voice4(), __toCommonJS(exports_voice4)).default : null;
   forceSnip = feature("HISTORY_SNIP") ? (init_force_snip(), __toCommonJS(exports_force_snip)).default : null;
   workflowsCmd = feature("WORKFLOW_SCRIPTS") ? (init_workflows(), __toCommonJS(exports_workflows)).default : null;
-  torch = feature("TORCH") ? __toCommonJS(exports_torch).default : null;
   peersCmd = feature("UDS_INBOX") ? (init_peers(), __toCommonJS(exports_peers)).default : null;
   forkCmd = feature("FORK_SUBAGENT") ? (init_fork(), __toCommonJS(exports_fork)).default : null;
   usageReport2 = {
@@ -419719,26 +419106,12 @@ var init_commands5 = __esm(() => {
     }
   };
   INTERNAL_ONLY_COMMANDS2 = [
-    backfill_sessions_default,
-    break_cache_default,
-    bughunter_default,
     commit_default,
     commit_push_pr_default,
-    ctx_viz_default,
-    good_atlas_default,
-    issue_default,
     init_verifiers_default,
     ...forceSnip ? [forceSnip] : [],
     version_default,
-    onboarding_default,
-    share_default,
-    summary_default,
-    perf_issue_default,
-    env_default,
-    oauth_refresh_default,
-    debug_tool_call_default,
-    agentsPlatform,
-    autofix_pr_default
+    agentsPlatform
   ].filter(Boolean);
   COMMANDS = memoize_default(() => [
     add_dir_default,
@@ -419764,13 +419137,10 @@ var init_commands5 = __esm(() => {
     ide_default,
     init_default3,
     keybindings_default,
-    install_slack_app_default,
     mcp_default,
     memory_default,
     model_default,
-    output_style_default,
     plugin_default,
-    pr_comments_default,
     release_notes_default,
     reload_plugins_default,
     rename_default,
@@ -419779,7 +419149,6 @@ var init_commands5 = __esm(() => {
     skills_default,
     stats_default,
     status_default,
-    statusline_default,
     sessionlist,
     stickers_default,
     tag_default,
@@ -419787,7 +419156,6 @@ var init_commands5 = __esm(() => {
     feedback_default,
     review_default,
     rewind_default,
-    security_review_default,
     terminalSetup_default,
     usage_default,
     usageReport2,
@@ -419806,7 +419174,6 @@ var init_commands5 = __esm(() => {
     tasks_default,
     tasklist_default,
     ...workflowsCmd ? [workflowsCmd] : [],
-    ...torch ? [torch] : [],
     ...IS_ATLAS_DEV2 && !process.env.IS_DEMO ? INTERNAL_ONLY_COMMANDS2 : []
   ]);
   builtInCommandNames3 = memoize_default(() => new Set(COMMANDS().flatMap((_) => [_.name, ..._.aliases ?? []])));
@@ -419859,7 +419226,6 @@ var init_commands5 = __esm(() => {
     feedback_default,
     plan_default,
     keybindings_default,
-    statusline_default,
     sessionlist,
     stickers_default
   ]);
@@ -419867,7 +419233,6 @@ var init_commands5 = __esm(() => {
     compact_default,
     clear_default,
     cost_default,
-    summary_default,
     release_notes_default,
     files_default
   ].filter((c) => c !== null));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atlasharness/atlascode",
-  "version": "0.1.39",
+  "version": "0.1.41",
   "description": "AtlasCode — Coding Agent for the domestic computing ecosystem (Ascend NPU + domestic LLM backends)",
   "bin": {
     "atlas": "dist/cli.js",