@autorag/librarian 2.5.2 → 2.5.3

package/dist/index.js

@@ -3826,14 +3826,22 @@ var init_manifest = __esm(() => {
       revision: "370f27d7550e0def9b39c1f16d3fbaa13aa67728",
       sha256: "06507c7b42688469c4e7298b0a1e16deff06caf291cf0a5b278c308249c3e439",
       license: "Apache-2.0",
-      noticeReference: "Qwen3 model card and Apache-2.0 license"
+      noticeReference: "Qwen3 model card and Apache-2.0 license",
+      intendedUse: "Local loopback embedding for AutoRAG MinSync and native-datasource semantic retrieval. Not a generative model.",
+      unsuitableUse: "Chat or generation, remote embedding of corpus text, shipping weights in the npm package, any GGUF other than the pinned SHA-256.",
+      upstreamCardUrl: "https://huggingface.co/Qwen/Qwen3-Embedding-0.6B",
+      modelCard: "docs/model-cards/qwen3-embedding-0.6b.md"
     },
     embeddinggemma: {
       url: "https://huggingface.co/ggml-org/embeddinggemma-300M-GGUF/resolve/0f741b5a6585bd53aeb15cd1372c56f2a0f65e12/embeddinggemma-300M-Q8_0.gguf",
       revision: "0f741b5a6585bd53aeb15cd1372c56f2a0f65e12",
       sha256: "b5ce9d77a3fc4b3b39ccb5643c36777911cc4eb46a66962eadfa3f5f60490d63",
       license: "Gemma Terms of Use",
-      noticeReference: "Google EmbeddingGemma model card and Gemma Terms of Use"
+      noticeReference: "Google EmbeddingGemma model card and Gemma Terms of Use",
+      intendedUse: "Local loopback embedding for AutoRAG MinSync and native-datasource semantic retrieval. Not a generative model.",
+      unsuitableUse: "Chat or generation, remote embedding of corpus text, shipping weights in the npm package, any GGUF other than the pinned SHA-256, uses restricted by the Gemma Prohibited Use Policy.",
+      upstreamCardUrl: "https://ai.google.dev/gemma/docs/embeddinggemma/model_card",
+      modelCard: "docs/model-cards/embeddinggemma-300m.md"
     }
   };
 });
@@ -9243,68 +9251,8 @@ var init_search_all_tool = __esm(() => {
   });
 });
 
-// src/agent/search-datasource-tool.ts
-import { Type as Type12 } from "typebox";
-function createSearchDatasourceDocumentsTool(provider) {
-  return {
-    name: SEARCH_DATASOURCE_DOCUMENTS_TOOL_NAME,
-    label: "Search Datasource Documents",
-    description: "Search configured external datasource skills such as cloud drives and KakaoTalk chats, fanning out to every datasource CLI. When the question targets one connection, prefer its dedicated search_datasource_<name> tool, which spawns only that connection's CLIs. Load the matching datasource skill first; authority is server-configured and tool arguments can only provide query, topK, and an optional narrowing scope.",
-    parameters: searchDatasourceSchema,
-    async execute(_toolCallId, params) {
-      const query = params.query.trim();
-      if (query.length === 0) {
-        return {
-          content: [{ type: "text", text: "Datasource query was empty; no datasource documents searched." }],
-          details: { method: "datasource", resultCount: 0, sources: [], diagnostics: [] }
-        };
-      }
-      const { results, diagnostics } = await provider.searchDatasourceDocuments(query, {
-        topK: params.topK,
-        scope: params.scope
-      });
-      return {
-        content: [{ type: "text", text: formatDatasourceResults(results, diagnostics) }],
-        details: {
-          method: "datasource",
-          resultCount: results.length,
-          sources: [...new Set(results.map((result) => result.source))],
-          diagnostics,
-          results: toRetrievalTraceResults(results)
-        }
-      };
-    }
-  };
-}
-function formatDatasourceResults(results, diagnostics) {
-  const diagnosticSummary = diagnostics.length > 0 ? `
-
-Diagnostics: ${diagnostics.map((d) => `${d.source ?? "datasource"}:${d.code}`).join(", ")}` : "";
-  if (results.length === 0)
-    return `No datasource results.${diagnosticSummary}`;
-  const rows = results.map((result, index) => {
-    const line = result.content.replace(/\s+/gu, " ").slice(0, 500);
-    return `[${index + 1}] ${result.source} score=${result.score.toFixed(4)}
-${line}`;
-  });
-  return `Datasource results:
-
-${rows.join(`
-
-`)}${diagnosticSummary}`;
-}
-var SEARCH_DATASOURCE_DOCUMENTS_TOOL_NAME = "search_datasource_documents", searchDatasourceSchema;
-var init_search_datasource_tool = __esm(() => {
-  init_search_documents();
-  searchDatasourceSchema = Type12.Object({
-    query: Type12.String({ description: "Query to search across configured external datasource skills." }),
-    topK: Type12.Optional(Type12.Integer({ description: "Maximum number of datasource chunks to return. Defaults to 50." })),
-    scope: Type12.Optional(Type12.String({ description: "Optional opaque datasource scope, e.g. /kakao/account or /kakao/account/**." }))
-  });
-});
-
 // src/agent/search-minsync-tool.ts
-import { Type as Type13 } from "typebox";
+import { Type as Type12 } from "typebox";
 function createSearchMinSyncDocumentsTool(getMethod, resolveScope = (scope) => scope) {
   return {
     name: SEARCH_MINSYNC_DOCUMENTS_TOOL_NAME,
@@ -9375,12 +9323,12 @@ ${rows.join(`
 var SEARCH_MINSYNC_DOCUMENTS_TOOL_NAME = "semantic_search_local_docs", searchMinSyncSchema;
 var init_search_minsync_tool = __esm(() => {
   init_search_documents();
-  searchMinSyncSchema = Type13.Object({
-    query: Type13.String({
+  searchMinSyncSchema = Type12.Object({
+    query: Type12.String({
       description: "Semantic query to search parsed document mirrors with MinSync vector retrieval."
     }),
-    topK: Type13.Optional(Type13.Integer({ description: "Maximum number of MinSync semantic chunks to return. Defaults to 50." })),
-    scope: Type13.Optional(Type13.String({ description: "Optional opaque virtual-path scope, e.g. /docs or /docs/**." }))
+    topK: Type12.Optional(Type12.Integer({ description: "Maximum number of MinSync semantic chunks to return. Defaults to 50." })),
+    scope: Type12.Optional(Type12.String({ description: "Optional opaque virtual-path scope, e.g. /docs or /docs/**." }))
   });
 });
 
@@ -9398,7 +9346,7 @@ function datasourceSearchToolName(datasourceId) {
 }
 
 // src/agent/search-single-datasource-tool.ts
-import { Type as Type14 } from "typebox";
+import { Type as Type13 } from "typebox";
 function createSingleDatasourceSearchTools(provider, specs) {
   return specs.map((spec) => createTool(provider, spec));
 }
@@ -9407,7 +9355,7 @@ function createTool(provider, spec) {
   return {
     name: singleDatasourceToolName(spec.datasourceId),
     label: `Search ${spec.datasourceId}`,
-    description: `Search only the "${spec.datasourceId}" datasource connection: ${spec.description} ` + `Unlike search_datasource_documents this spawns no other datasource CLIs; prefer it whenever the question targets this connection.${scopeLine} ` + `Authority is server-configured; tool arguments can only provide query, topK, and an optional narrowing scope.`,
+    description: `Search only the "${spec.datasourceId}" datasource connection: ${spec.description} ` + `This tool spawns only this connection's CLIs and returns only this connection's hits.${scopeLine} ` + `Authority is server-configured; tool arguments can only provide query, topK, and an optional narrowing scope.`,
     parameters: searchSingleDatasourceSchema,
     async execute(_toolCallId, params) {
       const query = params.query.trim();
@@ -9441,15 +9389,31 @@ function createTool(provider, spec) {
     }
   };
 }
+function formatDatasourceResults(results, diagnostics) {
+  const diagnosticSummary = diagnostics.length > 0 ? `
+
+Diagnostics: ${diagnostics.map((d) => `${d.source ?? "datasource"}:${d.code}`).join(", ")}` : "";
+  if (results.length === 0)
+    return `No datasource results.${diagnosticSummary}`;
+  const rows = results.map((result, index) => {
+    const line = result.content.replace(/\s+/gu, " ").slice(0, 500);
+    return `[${index + 1}] ${result.source} score=${result.score.toFixed(4)}
+${line}`;
+  });
+  return `Datasource results:
+
+${rows.join(`
+
+`)}${diagnosticSummary}`;
+}
 var singleDatasourceToolName, searchSingleDatasourceSchema;
 var init_search_single_datasource_tool = __esm(() => {
-  init_search_datasource_tool();
   init_search_documents();
   singleDatasourceToolName = datasourceSearchToolName;
-  searchSingleDatasourceSchema = Type14.Object({
-    query: Type14.String({ description: "Query to search within this datasource connection." }),
-    topK: Type14.Optional(Type14.Integer({ description: "Maximum number of chunks to return. Defaults to 50." })),
-    scope: Type14.Optional(Type14.String({ description: "Optional scope narrowing inside this datasource, e.g. one instance root." }))
+  searchSingleDatasourceSchema = Type13.Object({
+    query: Type13.String({ description: "Query to search within this datasource connection." }),
+    topK: Type13.Optional(Type13.Integer({ description: "Maximum number of chunks to return. Defaults to 50." })),
+    scope: Type13.Optional(Type13.String({ description: "Optional scope narrowing inside this datasource, e.g. one instance root." }))
   });
 });
 
@@ -9467,7 +9431,6 @@ function buildSystemPrompt(config) {
     toolLine(config, "jikji_find", "local discovery through Jikji answer packs"),
     toolLine(config, "search_all_documents", "fan out across every configured retrieval method and merge results"),
     toolLine(config, "semantic_search_local_docs", "semantic MinSync search over parsed document mirrors"),
-    toolLine(config, "search_datasource_documents", "search authorized external datasources; scope may only narrow access"),
     toolLine(config, "load_datasource_skill", "load instructions for an authorized datasource"),
     toolLine(config, "scan_duplicate_documents", "read-only dupey scan of configured local document roots"),
     toolLine(config, "web_search", "search the public internet for current information beyond the local corpus and knowledge cutoff"),
@@ -9475,13 +9438,12 @@ function buildSystemPrompt(config) {
     toolLine(config, "check_memory", "inspect advisory retrieval hints from prior feedback"),
     toolLine(config, "recommend_peer_targets", "recommend local peer personas to ask about a topic without contacting them"),
     toolLine(config, "emit_autorag_results", "return the final structured answer and number-to-source mapping"),
-    ...config.toolNames.filter((name) => name.startsWith("search_datasource_") && name !== "search_datasource_documents").map((name) => `- **${name}**: search only the ${name.slice("search_datasource_".length).replace(/_/g, "-")} datasource connection, spawning no other datasource CLIs`),
+    ...config.toolNames.filter((name) => name.startsWith("search_datasource_")).map((name) => `- **${name}**: search only the ${name.slice("search_datasource_".length).replace(/_/g, "-")} datasource connection, spawning no other datasource CLIs`),
     ...config.toolNames.filter((name) => ![
       "bash",
       "jikji_find",
       "search_all_documents",
       "semantic_search_local_docs",
-      "search_datasource_documents",
       "load_datasource_skill",
       "scan_duplicate_documents",
       "web_search",
@@ -9514,7 +9476,7 @@ ${FENCING_GUARD_LINE}
 ` : "";
   const webResearch = toolAvailable(config, "web_search") || toolAvailable(config, "web_fetch") ? `## Web Research
 
-\`web_search\` searches the public internet for current information beyond the local corpus and the model's knowledge cutoff; prefer primary sources (official docs, papers) and corroborate key claims with multiple sources. \`web_fetch\` reads a specific http(s) URL as markdown/text — pages found via web_search, official docs, papers. web_fetch only accepts http(s) URLs: never local file paths (use bash) or datasource virtual ids such as /kakao/... (use search_datasource_documents). Keep result URLs for traceability. Web queries leave the machine: never include private corpus content or secrets in web_search queries or fetched URLs.
+\`web_search\` searches the public internet for current information beyond the local corpus and the model's knowledge cutoff; prefer primary sources (official docs, papers) and corroborate key claims with multiple sources. \`web_fetch\` reads a specific http(s) URL as markdown/text — pages found via web_search, official docs, papers. web_fetch only accepts http(s) URLs: never local file paths (use bash) or datasource virtual ids such as /kakao/... (use that connection's dedicated search_datasource_<id> tool). Keep result URLs for traceability. Web queries leave the machine: never include private corpus content or secrets in web_search queries or fetched URLs.
 ` : "";
   return `You are AutoRAG, a ${modelId} librarian agent for document collections, cloud drives, images, and messenger history.
 
@@ -9543,7 +9505,7 @@ ${noSearchTools}
 - Use MinSync lexical mode for exact terminology, MinSync vector search for semantic similarity, and \`search_all_documents\` when hybrid ranking over the same MinSync chunks can help.
 - Use \`bash\` to read already-retrieved local files with cat/head/sed. find/grep/rg must be small and bounded: one already-known directory from retrieval, a tight pattern, and a cap (head, maxdepth, or file types). Never recursively scan a whole search root (Downloads, Documents, Desktop, or /); those calls miss the bash timeout and stall the search loop.
 - If retrieval is empty, retry a simpler query or synonyms through retrieval tools first. Do not widen filesystem discovery to compensate.
-- Local retrieval sources are absolute filesystem paths and may be read with \`bash\` after verifying the returned path. Datasource retrieval sources use slash-prefixed virtual identifiers such as /kakao/..., /mailcrawl/..., /slack/..., /discord/..., and /github/...; they are not OS paths and must never be passed to \`cd\`, \`cat\`, or other filesystem tools. Search or fetch them through \`search_datasource_documents\` and the loaded datasource skill/native CLI.
+- Local retrieval sources are absolute filesystem paths and may be read with \`bash\` after verifying the returned path. Datasource retrieval sources use slash-prefixed virtual identifiers such as /kakao/..., /mailcrawl/..., /slack/..., /discord/..., and /github/...; they are not OS paths and must never be passed to \`cd\`, \`cat\`, or other filesystem tools. Search them through the connection's dedicated \`search_datasource_<id>\` tool and the loaded datasource skill/native CLI; every authorized connection has its own tool, and \`search_all_documents\` still spans all of them at once.
 - When exploring local files and folders, actively use \`jikji_find\` as your primary discovery tool. Do not manually traverse folders with exploratory bash commands; reserve \`bash\` for targeted reading of identified files (cat, head, sed).
 - When search results or evidence contain conflicting information, treat the freshest and most recent information as authoritative and correct.
 - Cross-check important claims against the original source and preserve real source paths.
@@ -11586,7 +11548,7 @@ var init_render = __esm(() => {
 });
 
 // src/agent/web-fetch-tool.ts
-import { Type as Type15 } from "typebox";
+import { Type as Type14 } from "typebox";
 function truncateHead(output, maxBytes, maxLines) {
   const lines = output.split(`
 `);
@@ -11618,7 +11580,7 @@ function createWebFetchTool(options = {}) {
           content: [
             {
               type: "text",
-              text: `web_fetch only reads http(s) URLs; received "${url}". Local files belong to bash and datasource virtual ids to search_datasource_documents.`
+              text: `web_fetch only reads http(s) URLs; received "${url}". Local files belong to bash and datasource virtual ids to their dedicated datasource search tools.`
             }
           ],
           details: {
@@ -11683,9 +11645,9 @@ var WEB_FETCH_TOOL_NAME = "web_fetch", FETCH_DEFAULT_MAX_LINES = 300, FETCH_MAX_
 var init_web_fetch_tool = __esm(() => {
   init_render();
   FETCH_MAX_OUTPUT_BYTES = 50 * 1024;
-  webFetchSchema = Type15.Object({
-    url: Type15.String({ description: "The http(s) URL to fetch and read." }),
-    raw: Type15.Optional(Type15.Boolean({ description: "Return the raw response body without markdown rendering or formatting." }))
+  webFetchSchema = Type14.Object({
+    url: Type14.String({ description: "The http(s) URL to fetch and read." }),
+    raw: Type14.Optional(Type14.Boolean({ description: "Return the raw response body without markdown rendering or formatting." }))
   });
 });
 
@@ -15205,7 +15167,7 @@ var init_search = __esm(() => {
 });
 
 // src/agent/web-search-tool.ts
-import { Type as Type16 } from "typebox";
+import { Type as Type15 } from "typebox";
 function createWebSearchTool(options = {}) {
   return {
     name: WEB_SEARCH_TOOL_NAME,
@@ -15275,15 +15237,15 @@ function createWebSearchTool(options = {}) {
 var WEB_SEARCH_TOOL_NAME = "web_search", webSearchSchema;
 var init_web_search_tool = __esm(() => {
   init_search();
-  webSearchSchema = Type16.Object({
-    query: Type16.String({
+  webSearchSchema = Type15.Object({
+    query: Type15.String({
       description: 'Search query. Supports Google-style directives: site:/-site:, after:/before: (YYYY-MM-DD), inurl:, intitle:, filetype:, "exact phrase", -term, OR.'
     }),
-    recency: Type16.Optional(Type16.Union([Type16.Literal("day"), Type16.Literal("week"), Type16.Literal("month"), Type16.Literal("year")], {
+    recency: Type15.Optional(Type15.Union([Type15.Literal("day"), Type15.Literal("week"), Type15.Literal("month"), Type15.Literal("year")], {
       description: "Optional recency window for results (pure time filter)."
     })),
-    limit: Type16.Optional(Type16.Integer({ description: "Maximum number of results to return." })),
-    num_search_results: Type16.Optional(Type16.Integer({ description: "Alias for limit (result count hint)." }))
+    limit: Type15.Optional(Type15.Integer({ description: "Maximum number of results to return." })),
+    num_search_results: Type15.Optional(Type15.Integer({ description: "Alias for limit (result count hint)." }))
   });
 });
 
@@ -15411,7 +15373,6 @@ class AutoRAGAgent {
     this.memory.load();
     this.runLogger = new AutoRAGRunLogger(join22(dirname12(memPath), "logs", "runs.jsonl"));
     const checkMemoryTool = createCheckMemoryTool(this.memory);
-    const searchDatasourceTool = createSearchDatasourceDocumentsTool(this);
     const singleDatasourceTools = createSingleDatasourceSearchTools(this, this.singleDatasourceToolSpecs());
     this.searchToolNames = new Set([...SEARCH_TOOLS, ...singleDatasourceTools.map((tool) => tool.name)]);
     const searchMinSyncTool = createSearchMinSyncDocumentsTool(() => this.remoteFilteredRetrievalMethod(this.minSyncMethod), (scope) => this.resolveRetrievalScope(scope));
@@ -15431,7 +15392,6 @@ class AutoRAGAgent {
     const reservedNames = new Set([
       BASH_TOOL_NAME,
       "check_memory",
-      SEARCH_DATASOURCE_DOCUMENTS_TOOL_NAME,
       ...singleDatasourceTools.map((tool) => tool.name),
       LOAD_DATASOURCE_SKILL_TOOL_NAME,
       EMIT_AUTORAG_RESULTS_TOOL_NAME,
@@ -15459,7 +15419,6 @@ class AutoRAGAgent {
       checkMemoryTool,
       searchMinSyncTool,
       searchAllTool,
-      searchDatasourceTool,
       ...singleDatasourceTools,
       loadDatasourceSkillTool,
       ...webSearchTool !== undefined ? [webSearchTool] : [],
@@ -16628,30 +16587,6 @@ ${initialRetrievalContext ?? "Pending; continue only with a brief progress state
   async searchAllDocuments(query, options = {}) {
     return this.retrieveWithDiagnostics(query, { topK: options.topK, scope: options.scope });
   }
-  async searchDatasourceDocuments(query, options = {}) {
-    const retrievalOptions = {
-      ...this.activeRetrievalOptions,
-      topK: options.topK,
-      scope: options.scope
-    };
-    const ctx = this.datasourceAccessContext(retrievalOptions);
-    const methods = this.methodRegistry.list().filter((method) => {
-      const descriptor = method.describe();
-      return descriptor.datasourceId !== undefined && ctx.isAccessible(descriptor);
-    });
-    if (methods.length === 0)
-      return { results: [], diagnostics: [] };
-    const { results: byMethod, diagnostics } = await this.retriever.retrieveWithDiagnostics(methods, query, retrievalOptions);
-    const filteredByMethod = this.datasourceFilter.filter(byMethod, methods, ctx, options.scope);
-    for (const results of filteredByMethod.values()) {
-      for (const result of results)
-        retrievalOptions.observedSources?.add(result.source);
-    }
-    return {
-      results: this.rerankWithMemory(query, this.merger.merge(filteredByMethod, { topK: options.topK ?? MERGED_EVIDENCE_CEILING, dedup: true })),
-      diagnostics
-    };
-  }
   async searchSingleDatasourceDocuments(datasourceId, query, options = {}) {
     const retrievalOptions = {
       ...this.activeRetrievalOptions,
@@ -16888,7 +16823,6 @@ var init_agent = __esm(() => {
   init_local_model();
   init_peer_target_tool();
   init_search_all_tool();
-  init_search_datasource_tool();
   init_search_documents();
   init_search_minsync_tool();
   init_search_single_datasource_tool();
@@ -16899,7 +16833,6 @@ var init_agent = __esm(() => {
   SEARCH_TOOLS = [
     SEARCH_MINSYNC_DOCUMENTS_TOOL_NAME,
     SEARCH_ALL_DOCUMENTS_TOOL_NAME,
-    SEARCH_DATASOURCE_DOCUMENTS_TOOL_NAME,
     JIKJI_FIND_TOOL_NAME
   ];
   RemoteSessionRejectedError = class RemoteSessionRejectedError extends Error {
@@ -17577,7 +17510,7 @@ class ClawGallerySkill {
         "- Never use `lexical` unless a sparse V-SPLADE index exists; it must not fall back to dense vectors.",
         "- `hybrid` is the default and asks ClawGallery to RRF-fuse keyword results with every available dense and sparse vector channel.",
         "",
-        `Use the dedicated \`${datasourceSearchToolName(CLAWGALLERY_DATASOURCE_ID)}\` tool with a natural-language query. Do not use \`search_datasource_documents\` for this datasource — it fans out to every datasource CLI. Prefer hybrid/default search unless you know which index capability is available. If an explicit vector mode is needed, inspect \`clawgallery vdr status --json\` first when capability details are available.`,
+        `Use the dedicated \`${datasourceSearchToolName(CLAWGALLERY_DATASOURCE_ID)}\` tool with a natural-language query. Prefer hybrid/default search unless you know which index capability is available. If an explicit vector mode is needed, inspect \`clawgallery vdr status --json\` first when capability details are available.`,
         "",
         "With only V-SPLADE synced, use lexical or hybrid. With only dense VDR synced, use embedding or hybrid. When both are synced, use hybrid so dense VDR and sparse V-SPLADE results can coexist and be RRF-combined.",
         "",
@@ -18426,7 +18359,7 @@ class ConnectorDatasourceSkill {
         `Indexing is server-managed and refreshed ${cadence}. You do not trigger indexing; just search.`,
         "",
         "## How to search",
-        `Call the dedicated \`${datasourceSearchToolName(skillName)}\` tool with a natural-language \`query\`. Optionally pass \`topK\` and a narrowing \`scope\`. Do not use \`search_datasource_documents\` for this datasource — it fans out to every datasource CLI. Available authorized scopes:`,
+        `Call the dedicated \`${datasourceSearchToolName(skillName)}\` tool with a natural-language \`query\`. Optionally pass \`topK\` and a narrowing \`scope\`. Available authorized scopes:`,
         instanceScopes.length > 0 ? instanceScopes : "- (no authorized instances)",
         "",
         "`scope` can only narrow within already-authorized scopes; it can never widen access.",
@@ -18565,7 +18498,7 @@ function createCloudDriveSkillDefinition(skillName, provider) {
       "Configure and authenticate the remote with `rclone config`; AutoRAG never receives or stores provider credentials.",
       "Google Drive is Tier-1 supported. OneDrive and other rclone remotes use the same manifest contract. iCloud Drive is experimental and requires periodic Apple ID reauthentication.",
       "Indexing is incremental: `rclone lsjson` inventories metadata, then only added or changed indexable files are mirrored. Search uses the last completed snapshot while a failed sync is retried.",
-      `This connection is independently addressable. Load \`datasource-${skillName}\`, then call \`${datasourceSearchToolName(skillName)}\` with an optional narrowing scope under \`/${skillName}/<instance>/**\`. Do not use \`search_datasource_documents\` for this datasource — it fans out to every datasource CLI.`
+      `This connection is independently addressable. Load \`datasource-${skillName}\`, then call \`${datasourceSearchToolName(skillName)}\` with an optional narrowing scope under \`/${skillName}/<instance>/**\`.`
     ],
     nativeCliNote: "The underlying remote can be browsed directly with the `rclone` CLI through `bash` (e.g. `rclone lsl <remote>:<path>` or `rclone cat <remote>:<path>/<file>`); the dedicated tool searches the mirrored, parsed snapshot."
   };
@@ -18609,6 +18542,40 @@ var init_cloud_drive = __esm(() => {
   init_skill2();
 });
 
+// src/process/terminate-tree.ts
+import { spawn as spawn9 } from "node:child_process";
+function terminateProcessTree(child, signal = "SIGKILL") {
+  const pid = child.pid;
+  if (pid === undefined)
+    return false;
+  if (process.platform === "win32") {
+    const killer = spawn9("taskkill", ["/pid", String(pid), "/t", "/f"], { stdio: "ignore", windowsHide: true });
+    killer.on("error", () => killDirectChild(child, signal));
+    killer.on("close", (code) => {
+      if (code !== 0)
+        killDirectChild(child, signal);
+    });
+    return true;
+  }
+  try {
+    process.kill(-pid, signal);
+    return true;
+  } catch {
+    return killDirectChild(child, signal);
+  }
+}
+function killDirectChild(child, signal) {
+  if (child.exitCode !== null || child.signalCode !== null)
+    return false;
+  try {
+    return child.kill(signal);
+  } catch {
+    return false;
+  }
+}
+var TREE_KILL_GRACE_MS = 500;
+var init_terminate_tree = () => {};
+
 // src/datasource/skills/discrawl/types.ts
 var ENGLISH_ONLY_EMBEDDING_MODELS, DEFAULT_DISCRAWL_EMBEDDING_MODEL = "embeddinggemma", DEFAULT_DISCRAWL_BINARY = "discrawl", DEFAULT_DISCRAWL_TIMEOUT_MS = 30000, DEFAULT_DISCRAWL_MAX_BUFFER_BYTES = 1048576, DEFAULT_DISCRAWL_MODE = "hybrid";
 var init_types4 = __esm(() => {
@@ -18625,7 +18592,7 @@ var init_types4 = __esm(() => {
 });
 
 // src/datasource/skills/discrawl/client.ts
-import { spawn as spawn9 } from "node:child_process";
+import { spawn as spawn10 } from "node:child_process";
 import { mkdirSync as mkdirSync14, readFileSync as readFileSync15, writeFileSync as writeFileSync13 } from "node:fs";
 import { dirname as dirname15 } from "node:path";
 
@@ -18762,27 +18729,52 @@ function managedConfigPath(workspace) {
   return `${workspace}/.autorag/datasources/discrawl/config.toml`;
 }
 function spawnDiscrawl(request) {
-  return new Promise((resolve) => {
+  return new Promise((resolveResult) => {
     const { options, args, env, signal } = request;
     const portable = portableSpawnCommand(options.binaryPath ?? DEFAULT_DISCRAWL_BINARY, args);
-    const child = spawn9(portable.command, [...portable.args], {
+    const child = spawn10(portable.command, [...portable.args], {
       env,
       ...request.cwd === undefined ? {} : { cwd: request.cwd },
       detached: process.platform !== "win32",
+      windowsHide: true,
       stdio: ["ignore", "pipe", "pipe"]
     });
     let stdout = { text: "", bytes: 0, capped: false };
     let stderr = { text: "", bytes: 0, capped: false };
     let settled = false;
     let finalReason;
+    let pipeGuard;
     const maxBuffer = options.maxBufferBytes ?? DEFAULT_DISCRAWL_MAX_BUFFER_BYTES;
+    const settleWith = (result) => {
+      if (settled)
+        return;
+      settled = true;
+      clearTimeout(timeout);
+      if (pipeGuard !== undefined)
+        clearTimeout(pipeGuard);
+      signal?.removeEventListener("abort", abortHandler);
+      resolveResult(result);
+    };
+    const finish = (code) => {
+      if (finalReason !== undefined) {
+        settleWith({ ok: false, reason: finalReason, stdout: stdout.text, stderr: stderr.text, code });
+        return;
+      }
+      settleWith({
+        ok: code === 0,
+        reason: code === 0 ? undefined : "nonzero-exit",
+        stdout: stdout.text,
+        stderr: stderr.text,
+        code
+      });
+    };
     const timeout = setTimeout(() => {
       finalReason = "timeout";
-      terminate3(child);
+      terminateProcessTree(child, "SIGKILL");
     }, options.timeoutMs ?? DEFAULT_DISCRAWL_TIMEOUT_MS);
     const abortHandler = () => {
       finalReason = "aborted";
-      terminate3(child);
+      terminateProcessTree(child, "SIGKILL");
     };
     if (signal?.aborted)
       abortHandler();
@@ -18793,43 +18785,27 @@ function spawnDiscrawl(request) {
       stdout = appendBounded2(stdout, chunk, maxBuffer);
       if (stdout.capped) {
         finalReason = "stdout-too-large";
-        terminate3(child);
+        terminateProcessTree(child, "SIGKILL");
       }
     });
     child.stderr.on("data", (chunk) => {
       stderr = appendBounded2(stderr, chunk, maxBuffer);
       if (stderr.capped) {
         finalReason = "stderr-too-large";
-        terminate3(child);
+        terminateProcessTree(child, "SIGKILL");
       }
     });
-    child.on("error", (error) => {
+    child.on("exit", () => {
       if (settled)
         return;
-      settled = true;
-      clearTimeout(timeout);
-      signal?.removeEventListener("abort", abortHandler);
-      const reason = error.code === "ENOENT" ? "binary-missing" : "spawn-error";
-      resolve({ ok: false, reason, stdout: stdout.text, stderr: describeSpawnFailure(reason), code: null });
+      terminateProcessTree(child, "SIGKILL");
+      pipeGuard = setTimeout(() => finish(child.exitCode), TREE_KILL_GRACE_MS);
     });
-    child.on("close", (code) => {
-      if (settled)
-        return;
-      settled = true;
-      clearTimeout(timeout);
-      signal?.removeEventListener("abort", abortHandler);
-      if (finalReason !== undefined) {
-        resolve({ ok: false, reason: finalReason, stdout: stdout.text, stderr: stderr.text, code });
-        return;
-      }
-      resolve({
-        ok: code === 0,
-        reason: code === 0 ? undefined : "nonzero-exit",
-        stdout: stdout.text,
-        stderr: stderr.text,
-        code
-      });
+    child.on("error", (error) => {
+      const reason = error.code === "ENOENT" ? "binary-missing" : "spawn-error";
+      settleWith({ ok: false, reason, stdout: stdout.text, stderr: describeSpawnFailure(reason), code: null });
     });
+    child.on("close", (code) => finish(code));
   });
 }
 function nativeGatewayBaseUrl(baseUrl) {
@@ -18893,17 +18869,6 @@ function findUserTokenKey(env) {
   }
   return;
 }
-function terminate3(child) {
-  if (child.killed)
-    return;
-  if (process.platform !== "win32" && child.pid !== undefined) {
-    try {
-      process.kill(-child.pid, "SIGKILL");
-      return;
-    } catch {}
-  }
-  child.kill("SIGKILL");
-}
 function describeSpawnFailure(reason) {
   return reason === "binary-missing" ? "the discrawl binary could not be found" : "the discrawl binary could not be started";
 }
@@ -19123,6 +19088,7 @@ function ok2(data, result) {
 var USER_TOKEN_KEYS, SAFE_INHERITED_ENV_KEYS, SAFE_DISCRAWL_ENV_PREFIX = "DISCRAWL_";
 var init_client4 = __esm(() => {
   init_portable_spawn();
+  init_terminate_tree();
   init_types4();
   USER_TOKEN_KEYS = new Set([
     "discord_user_token",
@@ -19435,7 +19401,7 @@ class DiscrawlSkill {
         `Indexing is server-managed and refreshed ${cadence}. Sync is incremental (cursor-based) and embeddings are queued per changed message. You do not trigger indexing; just search.`,
         "",
         "## How to search",
-        `Call the dedicated \`${datasourceSearchToolName(DISCORD_DATASOURCE_ID2)}\` tool with a natural-language \`query\`. Optionally pass \`topK\` and a narrowing \`scope\`. Do not use \`search_datasource_documents\` for this datasource — it fans out to every datasource CLI. Available authorized scopes:`,
+        `Call the dedicated \`${datasourceSearchToolName(DISCORD_DATASOURCE_ID2)}\` tool with a natural-language \`query\`. Optionally pass \`topK\` and a narrowing \`scope\`. Available authorized scopes:`,
         instanceScopes.length > 0 ? instanceScopes : "- (no authorized instances)",
         "",
         "`scope` can only narrow within already-authorized scopes; it can never widen access.",
@@ -19674,47 +19640,1232 @@ var init_github = __esm(() => {
   init_skill4();
 });
 
-// src/datasource/skills/katok/types.ts
-var DEFAULT_KATOK_BINARY = "katok", DEFAULT_KATOK_TIMEOUT_MS = 60000, DEFAULT_KATOK_MAX_BUFFER_BYTES = 1048576;
-var init_types5 = () => {};
-
-// src/datasource/skills/katok/client.ts
-import { spawn as spawn10 } from "node:child_process";
+// src/datasource/skills/github-gist/connector.ts
+import { execFile as execFile3 } from "node:child_process";
+import { existsSync as existsSync20, mkdirSync as mkdirSync15, readFileSync as readFileSync16, writeFileSync as writeFileSync14 } from "node:fs";
+import { dirname as dirname16 } from "node:path";
+async function defaultGhTokenRunner() {
+  return new Promise((resolve) => {
+    execFile3("gh", ["auth", "token"], { timeout: GH_TOKEN_TIMEOUT_MS }, (error, stdout) => {
+      if (error) {
+        resolve(undefined);
+        return;
+      }
+      const token = stdout.trim();
+      resolve(token.length > 0 ? token : undefined);
+    });
+  });
+}
 
-class KatokClient {
+class GitHubGistConnector {
   options;
   constructor(options = {}) {
     this.options = options;
   }
-  async doctor(signal) {
-    const result = await this.run(["doctor", "--json"], signal);
-    if (!result.ok)
-      return toFailure2(result);
-    const parsed = parseJsonObject2(result.stdout);
-    if (parsed === undefined)
-      return toFailure2(result, "invalid-json");
-    const data = normalizeDoctor2(parsed);
-    return data === undefined ? toFailure2(result, "invalid-shape") : ok3(data, result);
+  async fetch(signal) {
+    const token = await this.resolveAuth();
+    if (token === undefined) {
+      return {
+        ok: false,
+        reason: "not-configured",
+        message: "no GitHub token: set GITHUB_TOKEN (or connector.tokenEnv) or authenticate the gh CLI"
+      };
+    }
+    const baseUrl = this.options.baseUrl ?? DEFAULT_BASE_URL4;
+    const request = {
+      headers: {
+        Accept: "application/vnd.github+json",
+        "X-GitHub-Api-Version": "2022-11-28",
+        "User-Agent": "autorag-datasource",
+        Authorization: `Bearer ${token}`
+      },
+      timeoutMs: this.options.timeoutMs,
+      fetchImpl: this.options.fetchImpl,
+      signal
+    };
+    const maxPages = this.options.maxPages ?? DEFAULT_MAX_PAGES2;
+    const maxGists = this.options.maxGists ?? DEFAULT_MAX_GISTS;
+    const listed = new Map;
+    for (let page = 1;page <= maxPages && listed.size < maxGists; page += 1) {
+      const url = `${baseUrl}/gists?per_page=100&page=${page}`;
+      const result = await httpJson(url, request);
+      if (!result.ok) {
+        if (result.reason === "auth")
+          return { ok: false, reason: "auth", message: "github: unauthorized" };
+        if (result.reason === "rate-limited" || result.reason === "permission") {
+          return { ok: false, reason: "rate-limited", message: "github: rate limited or forbidden" };
+        }
+        return { ok: false, reason: "api-error", message: `github: gist list failed: ${result.message}` };
+      }
+      const items = asArray(result.json);
+      if (items.length === 0)
+        break;
+      for (const raw of items) {
+        if (listed.size >= maxGists)
+          break;
+        const item = asRecord(raw);
+        const id = asString(item?.id);
+        const updatedAt = asString(item?.updated_at);
+        if (id === undefined || updatedAt === undefined)
+          continue;
+        listed.set(id, { updatedAt });
+      }
+      if (items.length < 100)
+        break;
+    }
+    const previous = this.loadState();
+    const changedIds = [];
+    for (const [id, entry] of listed) {
+      if (previous.gists[id] !== entry.updatedAt)
+        changedIds.push(id);
+    }
+    const deletedDocIds = Object.keys(previous.gists).filter((id) => !listed.has(id));
+    const documents = [];
+    const warnings = [];
+    const failedIds = new Set;
+    for (const id of changedIds) {
+      const result = await httpJson(`${baseUrl}/gists/${encodeURIComponent(id)}`, request);
+      if (!result.ok) {
+        warnings.push(`gist ${id} fetch failed: ${result.message}`);
+        failedIds.add(id);
+        continue;
+      }
+      const document = toDocument(asRecord(result.json));
+      if (document !== undefined)
+        documents.push(document);
+    }
+    this.saveState({
+      version: STATE_VERSION,
+      gists: Object.fromEntries([...listed].filter(([id]) => !failedIds.has(id)).map(([id, e]) => [id, e.updatedAt]))
+    });
+    const changed = changedIds.length > 0 || deletedDocIds.length > 0;
+    return {
+      ok: true,
+      documents,
+      changed,
+      deletedDocIds,
+      ...warnings.length > 0 ? { warnings } : {}
+    };
   }
-  async sync(signal) {
-    const result = await this.run(["sync", "--json"], signal);
-    if (!result.ok)
-      return toFailure2(result);
-    const parsed = parseJsonObject2(result.stdout);
-    if (parsed === undefined)
-      return toFailure2(result, "invalid-json");
-    const data = normalizeSync2(parsed);
-    return data === undefined ? toFailure2(result, "invalid-shape") : ok3(data, result);
+  async resolveAuth() {
+    const direct = resolveToken(this.options.token, this.options.tokenEnv ?? DEFAULT_TOKEN_ENV2);
+    if (direct !== undefined)
+      return direct;
+    if (this.options.ghCliFallback === false)
+      return;
+    const runner = this.options.ghTokenRunner ?? defaultGhTokenRunner;
+    try {
+      return await runner();
+    } catch {
+      return;
+    }
   }
-  async index(signal) {
-    const result = await this.run(["index", "--json"], signal);
+  loadState() {
+    const statePath = this.options.statePath;
+    if (statePath === undefined || !existsSync20(statePath))
+      return { version: STATE_VERSION, gists: {} };
+    try {
+      const parsed = JSON.parse(readFileSync16(statePath, "utf8"));
+      if (parsed.version !== STATE_VERSION || typeof parsed.gists !== "object" || parsed.gists === null) {
+        return { version: STATE_VERSION, gists: {} };
+      }
+      return parsed;
+    } catch {
+      return { version: STATE_VERSION, gists: {} };
+    }
+  }
+  saveState(state) {
+    const statePath = this.options.statePath;
+    if (statePath === undefined)
+      return;
+    try {
+      mkdirSync15(dirname16(statePath), { recursive: true });
+      writeFileSync14(statePath, `${JSON.stringify(state)}
+`, "utf8");
+    } catch {}
+  }
+}
+function toDocument(gist) {
+  if (gist === undefined)
+    return;
+  const id = asString(gist.id);
+  if (id === undefined)
+    return;
+  const description = asString(gist.description) ?? "";
+  const filesRecord = asRecord(gist.files) ?? {};
+  const fileNames = Object.keys(filesRecord);
+  const sections = [];
+  for (const name of fileNames) {
+    const file = asRecord(filesRecord[name]);
+    const filename = asString(file?.filename) ?? name;
+    const content = asString(file?.content) ?? "";
+    sections.push(`## ${filename}
+${content}`);
+  }
+  const title = description.length > 0 ? description : fileNames[0] ?? id;
+  const content = [description, ...sections].filter((part) => part.length > 0).join(`
+
+`);
+  return {
+    docId: id,
+    hierarchy: ["gists"],
+    title,
+    content: content.length > 0 ? content : title,
+    publishedAt: parseEpochMs(gist.updated_at),
+    metadata: {
+      gistId: id,
+      public: gist.public === true,
+      files: fileNames,
+      ...asString(gist.html_url) !== undefined ? { htmlUrl: asString(gist.html_url) } : {}
+    }
+  };
+}
+var DEFAULT_BASE_URL4 = "https://api.github.com", DEFAULT_TOKEN_ENV2 = "GITHUB_TOKEN", DEFAULT_MAX_PAGES2 = 10, DEFAULT_MAX_GISTS = 500, GH_TOKEN_TIMEOUT_MS = 5000, STATE_VERSION = 1;
+var init_connector3 = () => {};
+
+// src/datasource/skills/github-gist/semantic.ts
+import { createHash as createHash7 } from "node:crypto";
+import { existsSync as existsSync21, mkdirSync as mkdirSync16, readFileSync as readFileSync17, writeFileSync as writeFileSync15 } from "node:fs";
+import { dirname as dirname17 } from "node:path";
+function contentHash(chunk) {
+  return createHash7("sha256").update(`${chunk.title ?? ""}
+${chunk.content}`).digest("hex");
+}
+function sameIdentity(a, b) {
+  return a.provider === b.provider && a.model === b.model && a.dimension === b.dimension;
+}
+function cosine(a, b) {
+  let dot = 0;
+  let normA = 0;
+  let normB = 0;
+  const length = Math.min(a.length, b.length);
+  for (let i = 0;i < length; i += 1) {
+    const x = a[i] ?? 0;
+    const y = b[i] ?? 0;
+    dot += x * y;
+    normA += x * x;
+    normB += y * y;
+  }
+  if (normA === 0 || normB === 0)
+    return 0;
+  return dot / (Math.sqrt(normA) * Math.sqrt(normB));
+}
+
+class GistSemanticIndex {
+  statePath;
+  identity;
+  entries = {};
+  loaded = false;
+  constructor(options = {}) {
+    this.statePath = options.statePath;
+  }
+  async sync(chunks, embedder) {
+    this.ensureLoaded();
+    let identity;
+    try {
+      identity = await embedder.identity();
+    } catch (error) {
+      return { ok: false, message: error instanceof Error ? error.message : String(error) };
+    }
+    if (this.identity === undefined || !sameIdentity(this.identity, identity)) {
+      this.entries = {};
+      this.identity = identity;
+    }
+    const currentIds = new Set(chunks.map((chunk) => chunk.chunkId));
+    for (const chunkId of Object.keys(this.entries)) {
+      if (!currentIds.has(chunkId))
+        delete this.entries[chunkId];
+    }
+    const pending = chunks.filter((chunk) => {
+      const entry = this.entries[chunk.chunkId];
+      return entry === undefined || entry.hash !== contentHash(chunk);
+    });
+    if (pending.length === 0) {
+      this.persist();
+      return { ok: true, embedded: 0 };
+    }
+    let vectors;
+    try {
+      vectors = await embedder.embed(pending.map((chunk) => `${chunk.title ?? ""}
+${chunk.content}`));
+    } catch (error) {
+      return { ok: false, message: error instanceof Error ? error.message : String(error) };
+    }
+    if (vectors.length !== pending.length) {
+      return { ok: false, message: `embedder returned ${vectors.length} vectors for ${pending.length} chunks` };
+    }
+    for (const [index, chunk] of pending.entries()) {
+      const vector = vectors[index] ?? [];
+      this.entries[chunk.chunkId] = { hash: contentHash(chunk), vector };
+    }
+    this.persist();
+    return { ok: true, embedded: pending.length };
+  }
+  searchByVector(queryVector, topK) {
+    this.ensureLoaded();
+    const scored = [];
+    for (const [chunkId, entry] of Object.entries(this.entries)) {
+      const score = cosine(queryVector, entry.vector);
+      if (score > 0)
+        scored.push({ chunkId, score });
+    }
+    scored.sort((a, b) => b.score - a.score || a.chunkId.localeCompare(b.chunkId));
+    return scored.slice(0, topK);
+  }
+  ensureLoaded() {
+    if (this.loaded)
+      return;
+    this.loaded = true;
+    if (this.statePath === undefined || !existsSync21(this.statePath))
+      return;
+    try {
+      const parsed = JSON.parse(readFileSync17(this.statePath, "utf8"));
+      if (parsed.version !== VECTORS_VERSION || typeof parsed.entries !== "object" || parsed.entries === null)
+        return;
+      if (typeof parsed.identity?.dimension !== "number")
+        return;
+      this.identity = parsed.identity;
+      this.entries = { ...parsed.entries };
+    } catch {}
+  }
+  persist() {
+    if (this.statePath === undefined)
+      return;
+    if (this.identity === undefined)
+      return;
+    try {
+      mkdirSync16(dirname17(this.statePath), { recursive: true });
+      const payload = {
+        version: VECTORS_VERSION,
+        identity: this.identity,
+        entries: this.entries
+      };
+      writeFileSync15(this.statePath, `${JSON.stringify(payload)}
+`, "utf8");
+    } catch {}
+  }
+}
+
+class GitHubGistSemanticMethod {
+  options;
+  constructor(options) {
+    this.options = options;
+  }
+  describe() {
+    const { skillName, skillType, tags } = this.options;
+    return {
+      name: `${skillName}-semantic`,
+      type: "vector",
+      description: `Semantic retrieval over embedded ${skillType} chunks`,
+      status: "active",
+      capabilities: ["semantic", "scoped", "path-opaque-sources"],
+      datasourceId: skillName,
+      tags: [...tags]
+    };
+  }
+  async retrieve(query, options) {
+    const trimmed = query.trim();
+    if (trimmed.length === 0)
+      return [];
+    const topK = options.topK ?? DEFAULT_TOP_K3;
+    let queryVector;
+    try {
+      queryVector = (await this.options.embedder.embed([trimmed]))[0];
+    } catch {
+      return [];
+    }
+    if (queryVector === undefined)
+      return [];
+    const hits = this.options.index.searchByVector(queryVector, Math.max(topK * 3, topK));
+    if (hits.length === 0)
+      return [];
+    const byChunkId = new Map(this.options.store.chunks().map((chunk) => [chunk.chunkId, chunk]));
+    const { skillName, instanceId } = this.options;
+    const mapped = [];
+    for (const { chunkId, score } of hits) {
+      const chunk = byChunkId.get(chunkId);
+      if (chunk === undefined)
+        continue;
+      const source = datasourceSourcePath(skillName, instanceId, chunk.chunkId);
+      if (!this.matchesScope(source, options.scope, options.allowedScopes))
+        continue;
+      mapped.push({
+        id: `${skillName}:${instanceId}:${chunk.chunkId}`,
+        content: chunk.content,
+        source,
+        score,
+        metadata: {
+          ...chunk.metadata,
+          method: `${skillName}-semantic`,
+          datasourceId: skillName,
+          instanceId,
+          chunkId: chunk.chunkId,
+          ...chunk.title !== undefined ? { title: chunk.title } : {},
+          ...chunk.hierarchy.length > 0 ? { hierarchy: chunk.hierarchy.join("/") } : {},
+          ...chunk.publishedAt !== undefined ? { publishedAt: chunk.publishedAt } : {}
+        }
+      });
+      if (mapped.length >= topK)
+        break;
+    }
+    return mapped;
+  }
+  matchesScope(source, scope, allowedScopes) {
+    if (!matchesDatasourceScope(source, scope))
+      return false;
+    if (allowedScopes === undefined || allowedScopes.length === 0)
+      return true;
+    return allowedScopes.some((entry) => matchesDatasourceScope(source, entry));
+  }
+}
+function createGatewayGistEmbedder(options = {}) {
+  let ensured;
+  async function ensure() {
+    if (ensured !== undefined)
+      return ensured;
+    let runtime = options.runtime;
+    if (runtime === undefined) {
+      const module = await Promise.resolve().then(() => (init_embedding_runtime(), {}));
+      runtime = { ensureRuntime };
+    }
+    const result = await runtime.ensureRuntime({ profileId: options.profileId, cachedOnly: true });
+    ensured = {
+      baseUrl: result.baseUrl,
+      identity: {
+        provider: result.identity.provider,
+        model: result.identity.model,
+        dimension: result.identity.dimension
+      }
+    };
+    return ensured;
+  }
+  return {
+    identity: async () => (await ensure()).identity,
+    async embed(texts) {
+      if (texts.length === 0)
+        return [];
+      const { baseUrl, identity } = await ensure();
+      const fetchImpl = options.fetchImpl ?? fetch;
+      const embeddings = [];
+      for (let offset = 0;offset < texts.length; offset += GIST_EMBED_BATCH_SIZE) {
+        const batch = texts.slice(offset, offset + GIST_EMBED_BATCH_SIZE);
+        const response = await fetchImpl(`${baseUrl}/v1/embeddings`, {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ model: identity.model, input: [...batch] })
+        });
+        if (!response.ok)
+          throw new Error(`gateway /v1/embeddings returned HTTP ${response.status}`);
+        const json = await response.json();
+        const rows = [...json.data ?? []].sort((a, b) => (a.index ?? 0) - (b.index ?? 0));
+        const batchEmbeddings = rows.map((row) => row.embedding ?? []);
+        if (batchEmbeddings.length !== batch.length || batchEmbeddings.some((row) => row.length !== identity.dimension)) {
+          throw new Error("gateway /v1/embeddings returned an invalid embedding batch");
+        }
+        embeddings.push(...batchEmbeddings);
+      }
+      return embeddings;
+    }
+  };
+}
+var VECTORS_VERSION = 1, DEFAULT_TOP_K3 = 20, GIST_EMBED_BATCH_SIZE = 32;
+var init_semantic = __esm(() => {
+  init_scope2();
+});
+
+// src/datasource/skills/github-gist/skill.ts
+import { join as join25 } from "node:path";
+function gistDatasourceDir(workspaceRoot, skillName, instanceId) {
+  return join25(workspaceRoot, ".autorag", "datasources", sanitizeIdSegment(skillName), sanitizeIdSegment(instanceId));
+}
+var GITHUB_GIST_SKILL_DEFINITION, DEFAULT_INSTANCE_ID3 = "default", GitHubGistSkill;
+var init_skill5 = __esm(() => {
+  init_connector();
+  init_connector_skill();
+  init_connector3();
+  init_semantic();
+  GITHUB_GIST_SKILL_DEFINITION = {
+    skillName: "github-gist",
+    skillType: "github-gist",
+    description: "GitHub Gist datasource (authenticated account)",
+    capabilities: ["gists", "api", "polling", "incremental", "lexical", "semantic"],
+    defaultTags: ["github", "gists"],
+    contentType: "gist",
+    manifestDescription: "Search the authenticated GitHub account's indexed gists — code snippets, notes, and design memos. Use for questions about content the user saved as a gist.",
+    manifestNotes: [
+      "Gist visibility is bounded by the configured token scopes; secret gists are included when the token allows.",
+      "Semantic retrieval embeds chunks through the local loopback embedding gateway; gist content never leaves the machine for embeddings."
+    ]
+  };
+  GitHubGistSkill = class GitHubGistSkill extends ConnectorDatasourceSkill {
+    semanticIndex;
+    semanticEmbedder;
+    semanticMethod;
+    constructor(options = {}) {
+      const { connector, connectorOptions, semantic, ...rest } = options;
+      const instanceId = options.instanceId ?? DEFAULT_INSTANCE_ID3;
+      const statePath = connectorOptions?.statePath ?? (options.workspaceRoot === undefined ? undefined : join25(gistDatasourceDir(options.workspaceRoot, GITHUB_GIST_SKILL_DEFINITION.skillName, instanceId), "state.json"));
+      super(GITHUB_GIST_SKILL_DEFINITION, {
+        ...rest,
+        connector: connector ?? new GitHubGistConnector({
+          ...connectorOptions ?? {},
+          ...statePath !== undefined && connectorOptions?.statePath === undefined ? { statePath } : {}
+        })
+      });
+      if (semantic?.enabled !== false) {
+        this.semanticIndex = new GistSemanticIndex({
+          statePath: semantic?.statePath ?? (options.workspaceRoot === undefined ? undefined : join25(gistDatasourceDir(options.workspaceRoot, GITHUB_GIST_SKILL_DEFINITION.skillName, instanceId), "vectors.json"))
+        });
+        this.semanticEmbedder = semantic?.embedder ?? createGatewayGistEmbedder(semantic?.embedderOptions ?? {});
+        this.semanticMethod = new GitHubGistSemanticMethod({
+          skillName: this.describe().name,
+          skillType: GITHUB_GIST_SKILL_DEFINITION.skillType,
+          instanceId: this.instanceId,
+          tags: this.describe().tags,
+          store: this.store,
+          index: this.semanticIndex,
+          embedder: this.semanticEmbedder
+        });
+      }
+    }
+    async index() {
+      const result = await super.index();
+      if (!result.ok || this.semanticIndex === undefined || this.semanticEmbedder === undefined)
+        return result;
+      const sync = await this.semanticIndex.sync(this.store.chunks(), this.semanticEmbedder);
+      if (sync.ok)
+        return result;
+      return {
+        ...result,
+        diagnostics: [
+          ...result.diagnostics,
+          {
+            code: "datasource-index-failed",
+            severity: "warning",
+            message: boundDiagnosticText2(`semantic-unavailable: ${sync.message}`),
+            instanceId: this.instanceId,
+            source: this.describe().name
+          }
+        ]
+      };
+    }
+    retrievalMethods() {
+      const methods = super.retrievalMethods();
+      return this.semanticMethod === undefined ? methods : [...methods, this.semanticMethod];
+    }
+  };
+});
+
+// src/datasource/skills/github-gist/index.ts
+var init_github_gist = __esm(() => {
+  init_connector3();
+  init_semantic();
+  init_skill5();
+});
+
+// src/datasource/crawler-client.ts
+import { spawn as spawn11 } from "node:child_process";
+
+class CrawlerCliClient {
+  profile;
+  options;
+  constructor(profile, options = {}) {
+    this.profile = profile;
+    this.options = options;
+  }
+  async sync(signal) {
+    const result = await this.run(this.profile.syncArgs(this.options), signal);
+    if (!result.ok)
+      return toFailure2(result);
+    const count = this.profile.parseSyncCount(result.stdout);
+    if (count === undefined)
+      return toFailure2(result, "invalid-output");
+    return { ok: true, count, stdout: result.stdout, stderr: result.stderr, code: result.code ?? 0 };
+  }
+  async search(query, options = {}) {
+    const topK = options.topK ?? 20;
+    const result = await this.run(this.profile.searchArgs(this.options, query, topK), options.signal);
+    if (!result.ok)
+      return toFailure2(result);
+    const hits = this.profile.parseHits(result.stdout);
+    if (hits === undefined)
+      return toFailure2(result, "invalid-output");
+    return { ok: true, hits, stdout: result.stdout, stderr: result.stderr, code: result.code ?? 0 };
+  }
+  async run(args, signal) {
+    const env = controlledEnv3(this.profile.allowedEnvPrefixes, this.options.env);
+    env.CRAWLKIT_NO_UPDATE_CHECK = "1";
+    return spawnCrawler(this.options.binaryPath ?? this.profile.binaryName, args, env, signal, this.options, this.options.workspacePath);
+  }
+}
+function spawnCrawler(command, args, env, signal, options, cwd) {
+  return new Promise((resolve) => {
+    const portable = portableSpawnCommand(command, args);
+    const child = spawn11(portable.command, [...portable.args], {
+      env,
+      ...cwd === undefined ? {} : { cwd },
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    let stdout = { text: "", bytes: 0, capped: false };
+    let stderr = { text: "", bytes: 0, capped: false };
+    let settled = false;
+    let finalReason;
+    const maxBuffer = options.maxBufferBytes ?? DEFAULT_MAX_BUFFER_BYTES3;
+    const timeout = setTimeout(() => {
+      finalReason = "timeout";
+      terminate3(child);
+    }, options.timeoutMs ?? DEFAULT_TIMEOUT_MS8);
+    const abortHandler = () => {
+      finalReason = "aborted";
+      terminate3(child);
+    };
+    if (signal?.aborted)
+      abortHandler();
+    signal?.addEventListener("abort", abortHandler, { once: true });
+    child.stdout.setEncoding("utf8");
+    child.stderr.setEncoding("utf8");
+    child.stdout.on("data", (chunk) => {
+      stdout = appendBounded3(stdout, chunk, maxBuffer);
+      if (stdout.capped) {
+        finalReason = "stdout-too-large";
+        terminate3(child);
+      }
+    });
+    child.stderr.on("data", (chunk) => {
+      stderr = appendBounded3(stderr, chunk, maxBuffer);
+      if (stderr.capped) {
+        finalReason = "stderr-too-large";
+        terminate3(child);
+      }
+    });
+    child.on("error", (error) => {
+      if (settled)
+        return;
+      settled = true;
+      clearTimeout(timeout);
+      signal?.removeEventListener("abort", abortHandler);
+      resolve({
+        ok: false,
+        reason: error.code === "ENOENT" ? "binary-missing" : "spawn-error",
+        stdout: stdout.text,
+        stderr: "",
+        code: null
+      });
+    });
+    child.on("close", (code) => {
+      if (settled)
+        return;
+      settled = true;
+      clearTimeout(timeout);
+      signal?.removeEventListener("abort", abortHandler);
+      resolve({
+        ok: code === 0 && finalReason === undefined,
+        ...finalReason !== undefined ? { reason: finalReason } : code === 0 ? {} : { reason: "nonzero-exit" },
+        stdout: stdout.text,
+        stderr: stderr.text,
+        code
+      });
+    });
+  });
+}
+function controlledEnv3(allowedPrefixes, configured) {
+  const env = {};
+  for (const [key, value] of Object.entries(process.env)) {
+    if (value !== undefined && isAllowedEnvKey(key, allowedPrefixes))
+      env[key] = value;
+  }
+  for (const [key, value] of Object.entries(configured ?? {})) {
+    if (value === undefined)
+      delete env[key];
+    else if (isAllowedEnvKey(key, allowedPrefixes))
+      env[key] = value;
+  }
+  return env;
+}
+function isAllowedEnvKey(key, allowedPrefixes) {
+  return SAFE_ENV_KEYS.has(key) || process.platform === "win32" && [...SAFE_ENV_KEYS].some((safeKey) => safeKey.toUpperCase() === key.toUpperCase()) || key.startsWith("CRAWLKIT_") || allowedPrefixes.some((prefix) => key.startsWith(prefix));
+}
+function appendBounded3(state, chunk, maxBytes) {
+  const nextBytes = state.bytes + Buffer.byteLength(chunk);
+  if (nextBytes <= maxBytes)
+    return { text: state.text + chunk, bytes: nextBytes, capped: false };
+  const remaining = Math.max(maxBytes - state.bytes, 0);
+  return { text: state.text + chunk.slice(0, remaining), bytes: maxBytes, capped: true };
+}
+function terminate3(child) {
+  if (!child.killed)
+    child.kill("SIGTERM");
+}
+function toFailure2(result, reason) {
+  return {
+    ok: false,
+    reason: reason ?? result.reason ?? "nonzero-exit",
+    stdout: result.stdout,
+    stderr: boundDiagnosticText4(result),
+    code: result.code
+  };
+}
+function boundDiagnosticText4(result) {
+  if (result.stderr.length > 0)
+    return result.stderr.trim().slice(0, 4000);
+  if (result.stdout.length > 0)
+    return result.stdout.trim().slice(0, 4000);
+  return "";
+}
+var DEFAULT_TIMEOUT_MS8 = 60000, DEFAULT_MAX_BUFFER_BYTES3 = 1048576, SAFE_ENV_KEYS;
+var init_crawler_client = __esm(() => {
+  init_portable_spawn();
+  SAFE_ENV_KEYS = new Set([
+    "HOME",
+    "LANG",
+    "LC_ALL",
+    "PATH",
+    "TMPDIR",
+    "TMP",
+    "TEMP",
+    "NO_COLOR",
+    "APPDATA",
+    "ComSpec",
+    "LOCALAPPDATA",
+    "PATHEXT",
+    "SystemDrive",
+    "SystemRoot",
+    "USERPROFILE",
+    "WINDIR"
+  ]);
+});
+
+// src/datasource/skills/lark/client.ts
+class LarkClient {
+  version;
+  auth;
+  messages;
+  docs;
+  sleep;
+  constructor(options = {}) {
+    const cli = {
+      binaryPath: options.binaryPath ?? "lark-cli",
+      ...options.env !== undefined ? { env: options.env } : {},
+      ...options.timeoutMs !== undefined ? { timeoutMs: options.timeoutMs } : {}
+    };
+    const chatIds = (options.chatIds ?? []).filter(isSafeId);
+    this.version = new CrawlerCliClient(VERSION_PROFILE, cli);
+    this.auth = new CrawlerCliClient(AUTH_PROFILE, cli);
+    this.messages = new CrawlerCliClient(messageProfile(chatIds), cli);
+    this.docs = new CrawlerCliClient(DOC_PROFILE, cli);
+    this.sleep = options.sleep ?? delay2;
+  }
+  probeVersion() {
+    return this.version.sync();
+  }
+  probeAuth() {
+    return this.auth.sync();
+  }
+  searchMessages(query, topK) {
+    return this.retry(() => this.messages.search(query, topK === undefined ? {} : { topK }));
+  }
+  searchDocs(query, topK) {
+    return this.retry(() => this.docs.search(query, topK === undefined ? {} : { topK }));
+  }
+  async retry(run) {
+    let failure;
+    for (let attempt = 0;attempt < MAX_ATTEMPTS; attempt += 1) {
+      const result = await run();
+      if (result.ok)
+        return result;
+      failure = result;
+      if (!isRateLimited(result) || attempt === MAX_ATTEMPTS - 1)
+        return result;
+      await this.sleep(200 * 2 ** attempt);
+    }
+    return failure ?? { ok: false, reason: "spawn-error", stdout: "", stderr: "", code: null };
+  }
+}
+function messageProfile(chatIds) {
+  return {
+    binaryName: "lark-cli",
+    allowedEnvPrefixes: [],
+    syncArgs: () => [],
+    searchArgs: (_options, query, topK) => {
+      const args = [
+        "im",
+        "+messages-search",
+        "--query",
+        query,
+        "--format",
+        "json",
+        "--page-size",
+        String(clampPageSize(topK, MESSAGE_PAGE_MAX))
+      ];
+      if (chatIds.length > 0)
+        args.push("--chat-id", chatIds.join(","));
+      return args;
+    },
+    parseSyncCount: () => 0,
+    parseHits: parseMessages
+  };
+}
+function parseMessages(stdout) {
+  const data = envelopeData(stdout);
+  if (data === undefined)
+    return;
+  const rows = data.messages;
+  if (!Array.isArray(rows))
+    return;
+  const hits = [];
+  for (const row of rows) {
+    if (!isRecord12(row))
+      return;
+    const id = scalarString(row.message_id);
+    const content = scalarString(row.content);
+    if (id === undefined || content === undefined || !isSafeId(id))
+      continue;
+    const chatId = scalarString(row.chat_id);
+    const observedAt = scalarString(row.create_time);
+    hits.push({
+      id,
+      content,
+      score: 1 / (hits.length + 1),
+      ...scalarString(row.chat_name) !== undefined ? { title: scalarString(row.chat_name) } : {},
+      metadata: {
+        ...chatId !== undefined ? { chatId } : {},
+        ...scalarString(row.chat_type) !== undefined ? { chatType: scalarString(row.chat_type) } : {},
+        ...scalarString(row.chat_name) !== undefined ? { chatName: scalarString(row.chat_name) } : {},
+        ...observedAt !== undefined ? { observedAt } : {},
+        coverage: "server-side-unverified"
+      }
+    });
+  }
+  return hits;
+}
+function parseDocs(stdout) {
+  const data = envelopeData(stdout);
+  if (data === undefined)
+    return;
+  const rows = data.results;
+  if (!Array.isArray(rows))
+    return;
+  const hits = [];
+  for (const row of rows) {
+    if (!isRecord12(row))
+      return;
+    const meta = isRecord12(row.result_meta) ? row.result_meta : {};
+    const token = firstString(meta, ["token", "docs_token"]) ?? firstString(row, ["token", "docs_token"]) ?? tokenFromUrl(firstString(meta, ["url"]));
+    const content = stripHighlight(firstString(row, ["summary_highlighted", "title_highlighted", "summary", "title"]) ?? "");
+    if (token === undefined || !isSafeId(token) || content.length === 0)
+      continue;
+    const permalink = firstString(meta, ["url"]);
+    const observedAt = firstString(meta, ["update_time_iso", "update_time"]) ?? scalarString(meta.update_time);
+    hits.push({
+      id: token,
+      content,
+      score: 1 / (hits.length + 1),
+      ...firstString(row, ["title", "title_highlighted"]) !== undefined ? { title: stripHighlight(firstString(row, ["title", "title_highlighted"]) ?? "") } : {},
+      metadata: {
+        ...permalink !== undefined ? { permalink } : {},
+        ...observedAt !== undefined ? { observedAt } : {},
+        coverage: "server-side-unverified"
+      }
+    });
+  }
+  return hits;
+}
+function envelopeData(stdout) {
+  const trimmed = stdout.trim();
+  if (trimmed.length === 0)
+    return;
+  let parsed;
+  try {
+    parsed = JSON.parse(trimmed);
+  } catch {
+    return;
+  }
+  if (!isRecord12(parsed) || parsed.ok !== true || !isRecord12(parsed.data))
+    return;
+  return parsed.data;
+}
+function firstString(record, keys) {
+  for (const key of keys) {
+    const value = scalarString(record[key]);
+    if (value !== undefined)
+      return value;
+  }
+  return;
+}
+function scalarString(value) {
+  if (typeof value === "string" && value.length > 0)
+    return value;
+  if (typeof value === "number" && Number.isFinite(value))
+    return String(value);
+  return;
+}
+function tokenFromUrl(url) {
+  if (url === undefined)
+    return;
+  const path = url.split("?")[0]?.split("#")[0] ?? "";
+  const parts = path.split("/").filter((part) => part.length > 0);
+  const segment = parts[parts.length - 1];
+  return segment !== undefined && isSafeId(segment) ? segment : undefined;
+}
+function stripHighlight(value) {
+  return value.replaceAll("<h>", "").replaceAll("</h>", "").replaceAll("<hb>", "").replaceAll("</hb>", "").trim();
+}
+function isSafeId(value) {
+  return value.length > 0 && value !== "." && value !== ".." && !value.includes("#") && !value.includes("/");
+}
+function isRecord12(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isRateLimited(failure) {
+  return failure.stderr.includes(RATE_LIMIT_CODE) || failure.stdout.includes(RATE_LIMIT_CODE);
+}
+function clampPageSize(topK, max) {
+  if (!Number.isFinite(topK))
+    return Math.min(20, max);
+  const truncated = Math.trunc(topK);
+  if (truncated < 1)
+    return 1;
+  if (truncated > max)
+    return max;
+  return truncated;
+}
+function delay2(ms) {
+  return new Promise((resolve) => {
+    setTimeout(resolve, ms);
+  });
+}
+var MESSAGE_PAGE_MAX = 50, DOC_PAGE_MAX = 20, RATE_LIMIT_CODE = "99991400", MAX_ATTEMPTS = 7, VERSION_PROFILE, AUTH_PROFILE, DOC_PROFILE;
+var init_client5 = __esm(() => {
+  init_crawler_client();
+  VERSION_PROFILE = {
+    binaryName: "lark-cli",
+    allowedEnvPrefixes: [],
+    syncArgs: () => ["--version"],
+    searchArgs: () => [],
+    parseSyncCount: () => 0,
+    parseHits: () => []
+  };
+  AUTH_PROFILE = {
+    binaryName: "lark-cli",
+    allowedEnvPrefixes: [],
+    syncArgs: () => ["auth", "status", "--json"],
+    searchArgs: () => [],
+    parseSyncCount: () => 0,
+    parseHits: () => []
+  };
+  DOC_PROFILE = {
+    binaryName: "lark-cli",
+    allowedEnvPrefixes: [],
+    syncArgs: () => [],
+    searchArgs: (_options, query, topK) => [
+      "drive",
+      "+search",
+      "--query",
+      query,
+      "--format",
+      "json",
+      "--page-size",
+      String(clampPageSize(topK, DOC_PAGE_MAX))
+    ],
+    parseSyncCount: () => 0,
+    parseHits: parseDocs
+  };
+});
+
+// src/datasource/skills/lark/skill.ts
+class LarkSkill {
+  client;
+  datasourceId;
+  instanceId;
+  instances;
+  tags;
+  chatIds;
+  embedderBaseUrl;
+  lastIndexedAt;
+  lastError;
+  constructor(options = {}) {
+    this.datasourceId = options.datasourceId ?? "lark";
+    this.instanceId = isSafeId(options.instanceId ?? "default") ? options.instanceId ?? "default" : "default";
+    this.instances = options.instances !== undefined && options.instances.length > 0 ? options.instances : [this.instanceId];
+    this.tags = options.tags ?? DEFAULT_TAGS2;
+    this.chatIds = options.chatIds ?? [];
+    this.embedderBaseUrl = options.embedderBaseUrl;
+    this.client = options.client ?? new LarkClient({
+      ...options.binaryPath !== undefined ? { binaryPath: options.binaryPath } : {},
+      ...options.env !== undefined ? { env: options.env } : {},
+      ...options.timeoutMs !== undefined ? { timeoutMs: options.timeoutMs } : {},
+      ...options.chatIds !== undefined ? { chatIds: options.chatIds } : {},
+      ...options.sleep !== undefined ? { sleep: options.sleep } : {}
+    });
+  }
+  describe() {
+    return {
+      name: this.datasourceId,
+      id: this.datasourceId,
+      type: "lark-remote",
+      description: "Lark/Feishu remote search via lark-cli. Credentials stay in the CLI keychain.",
+      capabilities: ["external-cli", "remote-search", "scoped"],
+      tags: this.tags,
+      status: "active",
+      requiresExternalCli: true,
+      datasourceId: this.datasourceId,
+      instanceId: this.instanceId,
+      instances: this.instances
+    };
+  }
+  polling() {
+    return {
+      mode: "none",
+      ...this.lastIndexedAt !== undefined ? { lastIndexedAt: this.lastIndexedAt } : {},
+      ...this.lastError !== undefined ? { lastError: this.lastError } : {}
+    };
+  }
+  async index() {
+    try {
+      if (isRemoteEmbedder(this.embedderBaseUrl)) {
+        return this.fail("datasource-embedding-egress-rejected", "remote embedding egress is not allowed for lark");
+      }
+      const diagnostics = [this.note(REMOTE_NOTE, "datasource-empty", "info")];
+      const version = await this.client.probeVersion();
+      if (!version.ok) {
+        const message = probeMessage("--version", version);
+        this.lastError = message;
+        diagnostics.push(this.note(message, "datasource-unavailable", "warning"));
+        return this.ok(diagnostics);
+      }
+      const auth = await this.client.probeAuth();
+      if (!auth.ok) {
+        const message = probeMessage("auth status", auth);
+        this.lastError = message;
+        diagnostics.push(this.note(message, "datasource-auth-error", "warning"));
+        return this.ok(diagnostics);
+      }
+      this.lastError = undefined;
+      this.lastIndexedAt = Date.now();
+      return this.ok(diagnostics);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "lark index failed";
+      return this.fail("datasource-unavailable", message);
+    }
+  }
+  retrievalMethods() {
+    return [new LarkRemoteMethod(this, "messages"), new LarkRemoteMethod(this, "docs")];
+  }
+  describeSources() {
+    return this.instances.map((instanceId) => ({
+      source: normalizeVirtualPath2(`/${this.datasourceId}/${instanceId}`),
+      datasourceId: this.datasourceId,
+      skill: this.datasourceId,
+      instanceId,
+      contentType: "lark",
+      metadata: { datasourceId: this.datasourceId, instanceId, tags: this.tags }
+    }));
+  }
+  skillManifest() {
+    const scopes = this.instances.map((instanceId) => `- \`${normalizeVirtualPath2(`/${this.datasourceId}/${instanceId}`)}\``).join(`
+`);
+    const chats = this.chatIds.length === 0 ? "Message search covers every chat the logged-in identity can already see." : `Message search is limited to configured chat ids: ${this.chatIds.join(", ")}.`;
+    return {
+      name: `datasource-${this.datasourceId}`,
+      description: "Search the signed-in Lark or Feishu tenant for messages and cloud documents. The tenant keeps the index; AutoRAG does not copy it.",
+      content: [
+        "# Lark / Feishu (lark-cli remote search)",
+        "",
+        "Search live Lark/Feishu messages and cloud documents through the official `lark-cli`. AutoRAG does not open the desktop client's private databases, does not keep a local archive, and never sees app secrets or user tokens. Those stay in the CLI keychain.",
+        "",
+        "## When to use",
+        "Questions about Lark/Feishu chats or docs (docx, wiki, drive, sheets, bitable) the signed-in user can already open.",
+        "",
+        "## How to search",
+        `Call the dedicated \`${datasourceSearchToolName(this.datasourceId)}\` tool with a query and optional narrowing scope. Available authorized scopes:`,
+        scopes,
+        "",
+        "`scope` can only narrow within already-authorized scopes; it can never widen access. A scope under `messages` searches chats. A scope under `docs` searches documents.",
+        "",
+        chats,
+        "",
+        "Server ranking is not BM25, vector, or hybrid. Coverage of old messages, retention, and chat types is whatever the tenant indexed for this token, and that coverage is not guaranteed. A hit is a live pointer: later edits or recalls change the text. Document search rejects a query longer than 30 Unicode characters.",
+        "",
+        "## Read a hit",
+        "Search snippets are not the whole record. Read them with the CLI, not with `bash` on the `/lark/...` identity:",
+        "- `lark-cli im +messages-mget --message-ids <message_id> --format json`",
+        "- `lark-cli docs +fetch --doc <token> --doc-format markdown`",
+        "",
+        "## Native CLI",
+        "The external `lark-cli` owns login and credentials. When the dedicated tool cannot express a filter, call it through `bash`:",
+        '- `lark-cli im +messages-search --query "<query>" --format json`',
+        '- `lark-cli drive +search --query "<query>" --format json`',
+        "Login is `lark-cli auth login` with explicit scopes (`search:message` for chats, `search:docs:read` for documents), then `lark-cli auth status`. `auth login --recommend` does not grant those scopes by itself.",
+        `Never pass datasource virtual paths (\`/${this.datasourceId}/...\`) to bash; they are not OS paths.`
+      ].join(`
+`)
+    };
+  }
+  async search(surface, query, options) {
+    const trimmed = query.trim();
+    if (trimmed.length === 0)
+      return [];
+    if (!surfaceSelected(options.scope, this.datasourceId, this.instanceId, surface))
+      return [];
+    const result = surface === "messages" ? await this.client.searchMessages(trimmed, options.topK) : await this.client.searchDocs(trimmed, options.topK);
+    if (!result.ok)
+      throw datasourceCliError(this.datasourceId, "search", result);
+    const hits = [];
+    for (const hit of result.hits) {
+      if (!isSafeId(hit.id))
+        continue;
+      const source = normalizeVirtualPath2(`/${this.datasourceId}/${this.instanceId}/${surface}/${hit.id}`);
+      if (source.includes("#"))
+        continue;
+      hits.push({
+        id: hit.id,
+        content: hit.content,
+        source,
+        score: hit.score,
+        metadata: {
+          ...hit.metadata ?? {},
+          datasourceId: this.datasourceId,
+          instanceId: this.instanceId,
+          surface
+        }
+      });
+    }
+    return hits;
+  }
+  methodTags(surface) {
+    if (this.tags === DEFAULT_TAGS2)
+      return [surface === "messages" ? CHAT_TAG : DOCS_TAG];
+    return this.tags;
+  }
+  ok(diagnostics) {
+    return {
+      ok: true,
+      instanceId: this.instanceId,
+      skill: this.datasourceId,
+      chunkCount: 0,
+      indexedAt: this.lastIndexedAt ?? Date.now(),
+      diagnostics
+    };
+  }
+  fail(code, message) {
+    return {
+      ok: false,
+      instanceId: this.instanceId,
+      skill: this.datasourceId,
+      indexedAt: Date.now(),
+      diagnostics: [this.note(message, code, "error")],
+      error: message,
+      code,
+      message
+    };
+  }
+  note(message, code, severity) {
+    return { code, severity, message, instanceId: this.instanceId, source: this.datasourceId };
+  }
+}
+
+class LarkRemoteMethod {
+  skill;
+  surface;
+  constructor(skill, surface) {
+    this.skill = skill;
+    this.surface = surface;
+  }
+  describe() {
+    const descriptor = this.skill.describe();
+    return {
+      name: `${descriptor.datasourceId ?? "lark"}-${this.surface}`,
+      type: "remote",
+      description: this.surface === "messages" ? "Server-side Lark/Feishu message search via lark-cli" : "Server-side Lark/Feishu document search via lark-cli",
+      status: "active",
+      capabilities: ["remote-search", "scoped", "external-cli", "path-opaque-sources"],
+      datasourceId: descriptor.datasourceId,
+      tags: this.skill.methodTags(this.surface)
+    };
+  }
+  retrieve(query, options) {
+    return this.skill.search(this.surface, query, options);
+  }
+}
+function surfaceSelected(scope, datasourceId, instanceId, surface) {
+  if (scope === undefined || scope.trim().length === 0)
+    return true;
+  const root = normalizeVirtualPath2(`/${datasourceId}/${instanceId}/${surface}`);
+  const normalized = normalizeVirtualPath2(scope);
+  if (normalized === root || normalized.startsWith(`${root}/`))
+    return true;
+  return matchesDatasourceScope(root, normalized);
+}
+function probeMessage(command, failure) {
+  const stderr = failure.stderr.trim();
+  const exit = failure.code === null || failure.code === undefined ? "no exit code" : `exit code ${failure.code}`;
+  return `lark-cli ${command} failed (${failure.reason}, ${exit})${stderr.length > 0 ? `: ${stderr}` : ""}`;
+}
+function isRemoteEmbedder(value) {
+  if (value === undefined)
+    return false;
+  const trimmed = value.trim().toLowerCase();
+  return trimmed.startsWith("https://") || trimmed.startsWith("http://");
+}
+var CHAT_TAG = "lark:chat", DOCS_TAG = "lark:docs", DEFAULT_TAGS2, REMOTE_NOTE = "remote-search datasource: no local mirror";
+var init_skill6 = __esm(() => {
+  init_errors2();
+  init_scope2();
+  init_client5();
+  DEFAULT_TAGS2 = [CHAT_TAG, DOCS_TAG];
+});
+
+// src/datasource/skills/lark/index.ts
+var init_lark = __esm(() => {
+  init_client5();
+  init_skill6();
+});
+
+// src/datasource/skills/lazykatok/types.ts
+var DEFAULT_LAZYKATOK_BINARY = "lazykatok", DEFAULT_LAZYKATOK_TIMEOUT_MS = 60000, DEFAULT_LAZYKATOK_SOURCE = "macos", DEFAULT_LAZYKATOK_MAX_BUFFER_BYTES;
+var init_types5 = __esm(() => {
+  DEFAULT_LAZYKATOK_MAX_BUFFER_BYTES = 16 * 1048576;
+});
+
+// src/datasource/skills/lazykatok/client.ts
+import { spawn as spawn12 } from "node:child_process";
+import { existsSync as existsSync22 } from "node:fs";
+import { delimiter as delimiter4, join as join26 } from "node:path";
+
+class LazykatokClient {
+  options;
+  constructor(options = {}) {
+    this.options = options;
+  }
+  async doctor(signal) {
+    const result = await this.run(["doctor", "--json"], signal);
     if (!result.ok)
-      return toFailure2(result);
+      return toFailure3(result);
+    const parsed = parseJsonObject2(result.stdout);
+    if (parsed === undefined)
+      return toFailure3(result, "invalid-json");
+    const data = normalizeDoctor2(parsed);
+    return data === undefined ? toFailure3(result, "invalid-shape") : ok3(data, result);
+  }
+  async sync(signal) {
+    const result = await this.run(syncArgs(this.options, process.platform), signal);
+    if (!result.ok)
+      return toFailure3(result);
+    const parsed = parseJsonObject2(result.stdout);
+    if (parsed === undefined)
+      return toFailure3(result, "invalid-json");
+    const data = normalizeSync2(parsed);
+    return data === undefined ? toFailure3(result, "invalid-shape") : ok3(data, result);
+  }
+  async index(signal) {
+    const result = await this.run(["index", "--json"], signal);
+    if (!result.ok)
+      return toFailure3(result);
     const parsed = parseJsonObject2(result.stdout);
     if (parsed === undefined)
-      return toFailure2(result, "invalid-json");
+      return toFailure3(result, "invalid-json");
     const data = normalizeIndex(parsed);
-    return data === undefined ? toFailure2(result, "invalid-shape") : ok3(data, result);
+    return data === undefined ? toFailure3(result, "invalid-shape") : ok3(data, result);
   }
   async search(mode, query, options) {
     const args = ["search", mode, query, "--json"];
@@ -19722,74 +20873,100 @@ class KatokClient {
       args.push("--limit", String(options.topK));
     const result = await this.run(args, options?.signal);
     if (!result.ok)
-      return toFailure2(result);
+      return toFailure3(result);
     const parsed = parseJsonValue(result.stdout);
     if (parsed === undefined)
-      return toFailure2(result, "invalid-json");
+      return toFailure3(result, "invalid-json");
     const hits = normalizeHits2(parsed);
-    return hits === undefined ? toFailure2(result, "invalid-shape") : searchOk2(hits, result);
+    return hits === undefined ? toFailure3(result, "invalid-shape") : searchOk2(hits, result);
   }
   async chunkGet(chunkId, signal) {
     const result = await this.run(["chunk", "get", chunkId, "--json"], signal);
     if (!result.ok)
-      return toFailure2(result);
+      return toFailure3(result);
     const parsed = parseJsonObject2(result.stdout);
     if (parsed === undefined)
-      return toFailure2(result, "invalid-json");
+      return toFailure3(result, "invalid-json");
     const data = normalizeChunk(parsed);
-    return data === undefined ? toFailure2(result, "invalid-shape") : ok3(data, result);
+    return data === undefined ? toFailure3(result, "invalid-shape") : ok3(data, result);
   }
   async context(chunkId, signal) {
-    const result = await this.run(["context", chunkId, "--json"], signal);
+    const result = await this.run(["chunk", "context", chunkId, "--json"], signal);
     if (!result.ok)
-      return toFailure2(result);
+      return toFailure3(result);
     const parsed = parseJsonObject2(result.stdout);
     if (parsed === undefined)
-      return toFailure2(result, "invalid-json");
+      return toFailure3(result, "invalid-json");
     const data = normalizeContext(parsed);
-    return data === undefined ? toFailure2(result, "invalid-shape") : ok3(data, result);
+    return data === undefined ? toFailure3(result, "invalid-shape") : ok3(data, result);
   }
   async parent(chunkId, signal) {
-    const result = await this.run(["parent", chunkId, "--json"], signal);
+    const result = await this.run(["chunk", "parent", chunkId, "--json"], signal);
     if (!result.ok)
-      return toFailure2(result);
-    const parsed = parseJsonObject2(result.stdout);
+      return toFailure3(result);
+    const parsed = parseJsonValue(result.stdout);
     if (parsed === undefined)
-      return toFailure2(result, "invalid-json");
-    const data = normalizeChunk(parsed);
-    return data === undefined ? toFailure2(result, "invalid-shape") : ok3(data, result);
+      return toFailure3(result, "invalid-json");
+    const data = normalizeParentWindows(parsed);
+    return data === undefined ? toFailure3(result, "invalid-shape") : ok3(data, result);
   }
   async run(args, signal) {
-    const env = controlledEnv3(this.options.env);
-    return spawnKatok({
+    const env = controlledEnv4(this.options.env);
+    return spawnLazykatok({
       options: this.options,
-      args: [...args, ...commonArgs2(this.options)],
+      args: [...commonArgs2(this.options), ...args],
       env,
       signal
     });
   }
 }
-function spawnKatok(request) {
+function spawnLazykatok(request) {
   return new Promise((resolve) => {
     const { options, args, env, signal } = request;
-    const portable = portableSpawnCommand(commandFor2(options.binaryPath), args);
-    const child = spawn10(portable.command, [...portable.args], {
+    const portable = portableSpawnCommand(commandFor2(options, env), args);
+    const child = spawn12(portable.command, [...portable.args], {
       env,
       ...request.cwd === undefined ? {} : { cwd: request.cwd },
+      detached: process.platform !== "win32",
+      windowsHide: true,
       stdio: ["ignore", "pipe", "pipe"]
     });
     let stdout = { text: "", bytes: 0, capped: false };
     let stderr = { text: "", bytes: 0, capped: false };
     let settled = false;
     let finalReason;
-    const maxBuffer = options.maxBufferBytes ?? DEFAULT_KATOK_MAX_BUFFER_BYTES;
+    let pipeGuard;
+    const maxBuffer = options.maxBufferBytes ?? DEFAULT_LAZYKATOK_MAX_BUFFER_BYTES;
+    const settleWith = (result) => {
+      if (settled)
+        return;
+      settled = true;
+      clearTimeout(timeout);
+      if (pipeGuard !== undefined)
+        clearTimeout(pipeGuard);
+      signal?.removeEventListener("abort", abortHandler);
+      resolve(result);
+    };
+    const finish = (code) => {
+      if (finalReason !== undefined) {
+        settleWith({ ok: false, reason: finalReason, stdout: stdout.text, stderr: stderr.text, code });
+        return;
+      }
+      settleWith({
+        ok: code === 0,
+        reason: code === 0 ? undefined : "nonzero-exit",
+        stdout: stdout.text,
+        stderr: stderr.text,
+        code
+      });
+    };
     const timeout = setTimeout(() => {
       finalReason = "timeout";
-      terminate4(child);
-    }, options.timeoutMs ?? DEFAULT_KATOK_TIMEOUT_MS);
+      terminateProcessTree(child, "SIGKILL");
+    }, options.timeoutMs ?? DEFAULT_LAZYKATOK_TIMEOUT_MS);
     const abortHandler = () => {
       finalReason = "aborted";
-      terminate4(child);
+      terminateProcessTree(child, "SIGKILL");
     };
     if (signal?.aborted)
       abortHandler();
@@ -19797,50 +20974,55 @@ function spawnKatok(request) {
     child.stdout.setEncoding("utf8");
     child.stderr.setEncoding("utf8");
     child.stdout.on("data", (chunk) => {
-      stdout = appendBounded3(stdout, chunk, maxBuffer);
+      stdout = appendBounded4(stdout, chunk, maxBuffer);
       if (stdout.capped) {
         finalReason = "stdout-too-large";
-        terminate4(child);
+        terminateProcessTree(child, "SIGKILL");
       }
     });
     child.stderr.on("data", (chunk) => {
-      stderr = appendBounded3(stderr, chunk, maxBuffer);
+      stderr = appendBounded4(stderr, chunk, maxBuffer);
       if (stderr.capped) {
         finalReason = "stderr-too-large";
-        terminate4(child);
+        terminateProcessTree(child, "SIGKILL");
       }
     });
     child.on("error", (error) => {
-      if (settled)
-        return;
-      settled = true;
-      clearTimeout(timeout);
-      signal?.removeEventListener("abort", abortHandler);
       const reason = error.code === "ENOENT" ? "binary-missing" : "spawn-error";
-      resolve({ ok: false, reason, stdout: stdout.text, stderr: describeSpawnFailure2(reason), code: null });
+      settleWith({ ok: false, reason, stdout: stdout.text, stderr: describeSpawnFailure2(reason), code: null });
     });
-    child.on("close", (code) => {
+    child.on("exit", () => {
       if (settled)
         return;
-      settled = true;
-      clearTimeout(timeout);
-      signal?.removeEventListener("abort", abortHandler);
-      if (finalReason !== undefined) {
-        resolve({ ok: false, reason: finalReason, stdout: stdout.text, stderr: stderr.text, code });
-        return;
-      }
-      resolve({
-        ok: code === 0,
-        reason: code === 0 ? undefined : "nonzero-exit",
-        stdout: stdout.text,
-        stderr: stderr.text,
-        code
-      });
+      terminateProcessTree(child, "SIGKILL");
+      pipeGuard = setTimeout(() => finish(child.exitCode), TREE_KILL_GRACE_MS);
+    });
+    child.on("close", (code) => {
+      finish(code);
     });
   });
 }
-function commandFor2(binaryPath) {
-  return binaryPath === undefined ? DEFAULT_KATOK_BINARY : binaryPath;
+function commandFor2(options, env) {
+  if (options.binaryPath !== undefined)
+    return options.binaryPath;
+  return lookupInPath2(DEFAULT_LAZYKATOK_BINARY, env) ?? DEFAULT_LAZYKATOK_BINARY;
+}
+function lookupInPath2(executable, env) {
+  const pathEnv = env.PATH;
+  if (typeof pathEnv !== "string" || pathEnv.length === 0)
+    return;
+  for (const dir of pathEnv.split(delimiter4)) {
+    if (dir.length === 0)
+      continue;
+    const candidate = join26(dir, executable);
+    if (existsSync22(candidate))
+      return candidate;
+  }
+  return;
+}
+function syncArgs(options, platform = process.platform) {
+  const source = options.source ?? (platform === "darwin" ? DEFAULT_LAZYKATOK_SOURCE : undefined);
+  return ["sync", ...source === undefined ? [] : ["--source", source], "--json"];
 }
 function commonArgs2(options) {
   const args = [];
@@ -19850,42 +21032,31 @@ function commonArgs2(options) {
     args.push("--config", options.configPath);
   return args;
 }
-function controlledEnv3(configuredEnv) {
+function controlledEnv4(configuredEnv) {
   const env = {};
   for (const [key, value] of Object.entries(process.env)) {
-    if (value !== undefined && isAllowedKatokEnvKey(key))
+    if (value !== undefined && isAllowedLazykatokEnvKey(key))
       env[key] = value;
   }
   for (const [key, value] of Object.entries(configuredEnv ?? {})) {
     if (value === undefined) {
       delete env[key];
-    } else if (isAllowedKatokEnvKey(key)) {
+    } else if (isAllowedLazykatokEnvKey(key)) {
       env[key] = value;
     }
   }
   return env;
 }
-function isAllowedKatokEnvKey(key) {
-  return SAFE_INHERITED_ENV_KEYS2.has(key) || key.startsWith(SAFE_KATOK_ENV_PREFIX);
+function isAllowedLazykatokEnvKey(key) {
+  return SAFE_INHERITED_ENV_KEYS2.has(key) || SAFE_CLI_ENV_PREFIXES.some((prefix) => key.startsWith(prefix));
 }
 function searchOk2(hits, result) {
   return { ok: true, hits, data: { hits }, stdout: result.stdout, stderr: result.stderr, code: result.code ?? 0 };
 }
-function terminate4(child) {
-  if (child.killed)
-    return;
-  if (process.platform !== "win32" && child.pid !== undefined) {
-    try {
-      process.kill(-child.pid, "SIGKILL");
-      return;
-    } catch {}
-  }
-  child.kill("SIGKILL");
-}
 function describeSpawnFailure2(reason) {
-  return reason === "binary-missing" ? "the katok binary could not be found" : "the katok binary could not be started";
+  return reason === "binary-missing" ? "the lazykatok binary could not be found" : "the lazykatok binary could not be started";
 }
-function appendBounded3(state, chunk, maxBytes) {
+function appendBounded4(state, chunk, maxBytes) {
   const chunkBytes = Buffer.byteLength(chunk);
   const nextBytes = state.bytes + chunkBytes;
   if (nextBytes <= maxBytes)
@@ -19925,25 +21096,25 @@ function asBoolean(value) {
 }
 function normalizeDoctor2(raw) {
   const version = asString3(raw.version);
-  const ready = asBoolean(raw.ready);
+  const ready = asBoolean(raw.ready) ?? (asRecord3(raw.freshness) === undefined ? undefined : true);
   if (ready === undefined)
     return;
   const metadata = stripKnown(raw, new Set(["version", "ready"]));
   return { ...version !== undefined ? { version } : {}, ready, metadata };
 }
 function normalizeSync2(raw) {
-  const synced = asBoolean(raw.synced);
-  if (synced === undefined)
+  const synced = asBoolean(raw.synced) ?? (asNumber3(raw.total_messages) === undefined ? undefined : true);
+  if (synced === undefined || raw.ok === false)
     return;
-  const messageCount = asNumber3(raw.messageCount);
+  const messageCount = asNumber3(raw.messageCount) ?? asNumber3(raw.total_messages);
   const metadata = stripKnown(raw, new Set(["synced", "messageCount"]));
   return { synced, ...messageCount !== undefined ? { messageCount } : {}, metadata };
 }
 function normalizeIndex(raw) {
-  const chunkCount = asNumber3(raw.chunkCount);
+  const chunkCount = asNumber3(raw.chunkCount) ?? asNumber3(raw.candidate_chunks);
   if (chunkCount === undefined)
     return;
-  const metadata = stripKnown(raw, new Set(["chunkCount"]));
+  const metadata = stripKnown(raw, new Set(["chunkCount", "candidate_chunks", "documents"]));
   return { chunkCount, metadata };
 }
 function normalizeHits2(raw) {
@@ -19962,6 +21133,18 @@ function normalizeHits2(raw) {
   }
   return normalized;
 }
+function chatIdentityMetadata(record) {
+  const chatName = asString3(record.chat_name);
+  const senderNickname = asString3(record.sender_nickname);
+  const startedAt = asString3(record.started_at);
+  const endedAt = asString3(record.ended_at);
+  return {
+    ...chatName !== undefined ? { chatName } : {},
+    ...senderNickname !== undefined ? { senderNickname } : {},
+    ...startedAt !== undefined ? { startedAt } : {},
+    ...endedAt !== undefined ? { endedAt } : {}
+  };
+}
 function normalizeHit(record) {
   const chunkId = asString3(record.chunkId) ?? asString3(record.chunk_id);
   const score = asNumber3(record.score);
@@ -19969,47 +21152,55 @@ function normalizeHit(record) {
   if (chunkId === undefined || chunkId.length === 0 || score === undefined || content === undefined)
     return;
   const metadata = stripKnown(record, new Set(["chunkId", "chunk_id", "score", "content", "snippet"]));
-  const chatName = asString3(record.chat_name);
-  const senderNickname = asString3(record.sender_nickname);
-  const startedAt = asString3(record.started_at);
-  const endedAt = asString3(record.ended_at);
-  return {
-    chunkId,
-    score,
-    content,
-    metadata: {
-      ...metadata,
-      ...chatName !== undefined ? { chatName } : {},
-      ...senderNickname !== undefined ? { senderNickname } : {},
-      ...startedAt !== undefined ? { startedAt } : {},
-      ...endedAt !== undefined ? { endedAt } : {}
-    }
-  };
+  return { chunkId, score, content, metadata: { ...metadata, ...chatIdentityMetadata(record) } };
 }
 function normalizeChunk(raw) {
-  const chunkId = asString3(raw.chunkId);
-  const content = asString3(raw.content);
+  const chunkId = asString3(raw.chunkId) ?? asString3(raw.chunk_id) ?? asString3(raw.parent_id);
+  const content = asString3(raw.content) ?? asString3(raw.text);
   if (chunkId === undefined || chunkId.length === 0 || content === undefined)
     return;
-  const metadata = stripKnown(raw, new Set(["chunkId", "content"]));
-  return { chunkId, content, metadata };
+  const metadata = stripKnown(raw, new Set(["chunkId", "chunk_id", "parent_id", "content", "text"]));
+  return { chunkId, content, metadata: { ...metadata, ...chatIdentityMetadata(raw) } };
 }
 function normalizeContext(raw) {
-  const chunksValue = raw.chunks;
-  if (!Array.isArray(chunksValue))
+  const legacyChunks = raw.chunks;
+  if (Array.isArray(legacyChunks)) {
+    const chunks = normalizeChunkList(legacyChunks);
+    return chunks === undefined ? undefined : { chunks, metadata: stripKnown(raw, new Set(["chunks"])) };
+  }
+  const target = asRecord3(raw.chunk);
+  if (target === undefined)
+    return;
+  const chunk = normalizeChunk(target);
+  if (chunk === undefined)
+    return;
+  const before = normalizeChunkList(raw.previous) ?? [];
+  const after = normalizeChunkList(raw.next) ?? [];
+  return {
+    chunks: [...before, chunk, ...after],
+    metadata: stripKnown(raw, new Set(["chunk"]))
+  };
+}
+function normalizeChunkList(value) {
+  if (!Array.isArray(value))
     return;
   const chunks = [];
-  for (const entry of chunksValue) {
+  for (const entry of value) {
     const record = asRecord3(entry);
     if (record === undefined)
-      return;
+      continue;
     const chunk = normalizeChunk(record);
-    if (chunk === undefined)
-      return;
-    chunks.push(chunk);
+    if (chunk !== undefined)
+      chunks.push(chunk);
   }
-  const metadata = stripKnown(raw, new Set(["chunks"]));
-  return { chunks, metadata };
+  return chunks;
+}
+function normalizeParentWindows(raw) {
+  const windows = normalizeChunkList(raw);
+  if (windows !== undefined)
+    return windows;
+  const nested = asRecord3(raw)?.parent_windows;
+  return normalizeChunkList(nested);
 }
 function stripKnown(raw, known) {
   const metadata = {};
@@ -20019,16 +21210,16 @@ function stripKnown(raw, known) {
   }
   return metadata;
 }
-function toFailure2(result, reason) {
+function toFailure3(result, reason) {
   return {
     ok: false,
     reason: reason ?? result.reason ?? "nonzero-exit",
     stdout: result.stdout,
-    stderr: boundDiagnosticText4(result.stderr),
+    stderr: boundDiagnosticText5(result.stderr),
     code: result.code
   };
 }
-function boundDiagnosticText4(value) {
+function boundDiagnosticText5(value) {
   if (value.length === 0)
     return "";
   return value.trim().slice(0, 4000);
@@ -20036,22 +21227,24 @@ function boundDiagnosticText4(value) {
 function ok3(data, result) {
   return { ok: true, data, stdout: result.stdout, stderr: result.stderr, code: result.code ?? 0 };
 }
-var SAFE_INHERITED_ENV_KEYS2, SAFE_KATOK_ENV_PREFIX = "KATOK_";
-var init_client5 = __esm(() => {
+var SAFE_INHERITED_ENV_KEYS2, SAFE_CLI_ENV_PREFIXES;
+var init_client6 = __esm(() => {
   init_portable_spawn();
+  init_terminate_tree();
   init_types5();
   SAFE_INHERITED_ENV_KEYS2 = new Set(["HOME", "LANG", "LC_ALL", "PATH", "TMPDIR", "TMP", "TEMP"]);
+  SAFE_CLI_ENV_PREFIXES = ["KATOK_", "LAZYKATOK_"];
 });
 
-// src/datasource/skills/katok/paths.ts
-function katokSourcePath(instanceId, chunkId) {
-  return `/${KATOK_SOURCE_KIND}/${instanceId}/chunks/${chunkId}`;
+// src/datasource/skills/lazykatok/paths.ts
+function lazykatokSourcePath(instanceId, chunkId) {
+  return `/${LAZYKATOK_SOURCE_KIND}/${instanceId}/chunks/${chunkId}`;
 }
-var KATOK_SOURCE_KIND = "kakao";
+var LAZYKATOK_SOURCE_KIND = "kakao";
 var init_paths4 = () => {};
 
-// src/datasource/skills/katok/methods.ts
-class KatokBm25Method {
+// src/datasource/skills/lazykatok/methods.ts
+class LazykatokBm25Method {
   client;
   instanceId;
   tags;
@@ -20064,7 +21257,7 @@ class KatokBm25Method {
     return {
       name: "kakao-bm25",
       type: "bm25",
-      description: "BM25 lexical retrieval over KakaoTalk chat chunks via the external katok CLI",
+      description: "BM25 lexical retrieval over KakaoTalk chat chunks via the external lazykatok CLI",
       status: "active",
       capabilities: ["lexical", "keyword-mode", "external-cli", "path-opaque-sources"],
       datasourceId: KAKAO_DATASOURCE_ID,
@@ -20072,11 +21265,11 @@ class KatokBm25Method {
     };
   }
   retrieve(query, options) {
-    return retrieveKatok(this.client, "keyword", "kakao-bm25", this.instanceId, query, options);
+    return retrieveLazykatok(this.client, "keyword", "kakao-bm25", this.instanceId, query, options);
   }
 }
 
-class KatokSemanticMethod {
+class LazykatokSemanticMethod {
   client;
   instanceId;
   tags;
@@ -20089,7 +21282,7 @@ class KatokSemanticMethod {
     return {
       name: "kakao-semantic",
       type: "vector",
-      description: "Semantic vector retrieval over KakaoTalk chat chunks via the external katok CLI",
+      description: "Semantic vector retrieval over KakaoTalk chat chunks via the external lazykatok CLI",
       status: "active",
       capabilities: ["semantic", "vector-mode", "external-cli", "path-opaque-sources"],
       datasourceId: KAKAO_DATASOURCE_ID,
@@ -20097,29 +21290,29 @@ class KatokSemanticMethod {
     };
   }
   retrieve(query, options) {
-    return retrieveKatok(this.client, "semantic", "kakao-semantic", this.instanceId, query, options);
+    return retrieveLazykatok(this.client, "semantic", "kakao-semantic", this.instanceId, query, options);
   }
 }
-async function retrieveKatok(client, mode, methodName, instanceId, query, options) {
+async function retrieveLazykatok(client, mode, methodName, instanceId, query, options) {
   const trimmed = query.trim();
   if (trimmed.length === 0)
     return [];
-  const topK = options.topK ?? DEFAULT_TOP_K3;
+  const topK = options.topK ?? DEFAULT_TOP_K4;
   const searchOptions = { topK, signal: options.signal };
   const result = await client.search(mode, trimmed, searchOptions);
   if (!result.ok)
     throw datasourceCliError(KAKAO_DATASOURCE_ID, `search --mode ${mode}`, result);
   const mapped = [];
   for (const hit of result.hits) {
-    const source = katokSource(instanceId, hit);
+    const source = lazykatokSource(instanceId, hit);
     mapped.push(toRetrievalResult2(hit, source, methodName, instanceId, mode));
     if (mapped.length >= topK)
       break;
   }
   return mapped;
 }
-function katokSource(instanceId, hit) {
-  return katokSourcePath(instanceId, hit.chunkId);
+function lazykatokSource(instanceId, hit) {
+  return lazykatokSourcePath(instanceId, hit.chunkId);
 }
 function toRetrievalResult2(hit, source, methodName, instanceId, mode) {
   return {
@@ -20137,15 +21330,15 @@ function toRetrievalResult2(hit, source, methodName, instanceId, mode) {
     }
   };
 }
-var KAKAO_DATASOURCE_ID = "kakao", DEFAULT_KAKAO_TAGS, DEFAULT_TOP_K3 = 20;
+var KAKAO_DATASOURCE_ID = "kakao", DEFAULT_KAKAO_TAGS, DEFAULT_TOP_K4 = 20;
 var init_methods3 = __esm(() => {
   init_errors2();
   init_paths4();
   DEFAULT_KAKAO_TAGS = ["kakaotalk", "personal", "pii"];
 });
 
-// src/datasource/skills/katok/skill.ts
-class KatokSkill {
+// src/datasource/skills/lazykatok/skill.ts
+class LazykatokSkill {
   client;
   instanceId;
   instances;
@@ -20154,7 +21347,7 @@ class KatokSkill {
   lastIndexedAt;
   constructor(options) {
     this.client = options.client;
-    this.instanceId = options.instanceId ?? DEFAULT_INSTANCE_ID3;
+    this.instanceId = options.instanceId ?? DEFAULT_INSTANCE_ID4;
     this.instances = options.instances !== undefined && options.instances.length > 0 ? options.instances : [this.instanceId];
     this.pollingIntervalMs = options.pollingIntervalMs ?? DEFAULT_POLLING_INTERVAL_MS3;
     this.tags = options.tags ?? DEFAULT_KAKAO_TAGS2;
@@ -20165,7 +21358,7 @@ class KatokSkill {
       name: KAKAO_DATASOURCE_ID2,
       id: KAKAO_DATASOURCE_ID2,
       type: KAKAO_SKILL_TYPE,
-      description: "KakaoTalk datasource via the external katok CLI",
+      description: "KakaoTalk datasource via the external lazykatok CLI",
       capabilities: ["chat", "external-cli", "polling", "bm25", "semantic"],
       tags: this.tags,
       status: "active",
@@ -20215,8 +21408,8 @@ class KatokSkill {
   }
   retrievalMethods() {
     return [
-      new KatokBm25Method({ client: this.client, instanceId: this.instanceId, tags: this.tags }),
-      new KatokSemanticMethod({ client: this.client, instanceId: this.instanceId, tags: this.tags })
+      new LazykatokBm25Method({ client: this.client, instanceId: this.instanceId, tags: this.tags }),
+      new LazykatokSemanticMethod({ client: this.client, instanceId: this.instanceId, tags: this.tags })
     ];
   }
   describeSources() {
@@ -20243,7 +21436,7 @@ class KatokSkill {
       content: [
         `# KakaoTalk datasource (${KAKAO_SKILL_TYPE})`,
         "",
-        "This skill searches KakaoTalk chats that are indexed through the external `katok` CLI. AutoRAG never reads KakaoTalk databases directly.",
+        "This skill searches KakaoTalk chats that are indexed through the external `lazykatok` CLI. AutoRAG never reads KakaoTalk databases directly.",
         "",
         "## When to use",
         "Use this skill when the question is about KakaoTalk conversations, chat participants, or content shared inside chats.",
@@ -20252,16 +21445,16 @@ class KatokSkill {
         `Indexing is server-managed and refreshed ${cadence}. You do not trigger indexing; just search.`,
         "",
         "## How to search",
-        `Call the dedicated \`${datasourceSearchToolName(KAKAO_DATASOURCE_ID2)}\` tool with a natural-language \`query\` and \`topK\`. Do not use \`search_datasource_documents\` for this datasource — it fans out to every datasource CLI. This datasource does not support per-source scope narrowing. Authorized datasource:`,
+        `Call the dedicated \`${datasourceSearchToolName(KAKAO_DATASOURCE_ID2)}\` tool with a natural-language \`query\` and \`topK\`. This datasource does not support per-source scope narrowing. Authorized datasource:`,
         instanceSources.length > 0 ? instanceSources : "- (no configured instances)",
         "",
-        "Access is controlled by the trusted datasource tag; chat/channel filtering is owned by katok.",
+        "Access is controlled by the trusted datasource tag; chat/channel filtering is owned by lazykatok.",
         "",
         "## Native CLI",
-        "The external `katok` CLI owns the archive, index, and credentials. When the dedicated tool cannot express what you need, call katok directly through `bash`:",
-        '- `katok search bm25 "<query>" --json --limit 20` — lexical search (`semantic` mode also available)',
-        "- `katok chunk get <chunkId> --json` — fetch one chunk by id (chunk ids appear in result metadata)",
-        "- `katok chunk context <chunkId> --json` — surrounding messages of a chunk",
+        "The external `lazykatok` CLI owns the archive, index, and credentials. When the dedicated tool cannot express what you need, call lazykatok directly through `bash`:",
+        '- `lazykatok search bm25 "<query>" --json --limit 20` — lexical search (`semantic` mode also available)',
+        "- `lazykatok chunk get <chunkId> --json` — fetch one chunk by id (chunk ids appear in result metadata)",
+        "- `lazykatok chunk context <chunkId> --json` — surrounding messages of a chunk",
         "Never pass datasource virtual paths (`/kakao/...`) to bash; they are not OS paths.",
         "",
         "## Output rules",
@@ -20291,8 +21484,8 @@ class KatokSkill {
     };
   }
 }
-var KAKAO_DATASOURCE_ID2 = "kakao", KAKAO_SKILL_TYPE = "kakaotalk", DEFAULT_INSTANCE_ID3 = "default", DEFAULT_POLLING_INTERVAL_MS3, DEFAULT_KAKAO_TAGS2;
-var init_skill5 = __esm(() => {
+var KAKAO_DATASOURCE_ID2 = "kakao", KAKAO_SKILL_TYPE = "kakaotalk", DEFAULT_INSTANCE_ID4 = "default", DEFAULT_POLLING_INTERVAL_MS3, DEFAULT_KAKAO_TAGS2;
+var init_skill7 = __esm(() => {
   init_skip();
   init_scope2();
   init_methods3();
@@ -20300,17 +21493,17 @@ var init_skill5 = __esm(() => {
   DEFAULT_KAKAO_TAGS2 = ["kakaotalk", "personal", "pii"];
 });
 
-// src/datasource/skills/katok/index.ts
-var init_katok = __esm(() => {
-  init_client5();
+// src/datasource/skills/lazykatok/index.ts
+var init_lazykatok = __esm(() => {
+  init_client6();
   init_methods3();
-  init_skill5();
+  init_skill7();
   init_types5();
 });
 
 // src/datasource/skills/mail-export/connector.ts
 import { readdir as readdir2, readFile as readFile7, stat as stat5 } from "node:fs/promises";
-import { basename as basename10, dirname as dirname16, extname as extname9, join as join25 } from "node:path";
+import { basename as basename10, dirname as dirname18, extname as extname9, join as join27 } from "node:path";
 import { simpleParser as simpleParser2 } from "mailparser";
 
 class MailExportConnector {
@@ -20336,7 +21529,7 @@ class MailExportConnector {
               continue;
             const extension = extname9(entry.name).toLowerCase();
             if (extension === ".eml" || extension === ".mbox") {
-              files.push(join25(entry.parentPath, entry.name));
+              files.push(join27(entry.parentPath, entry.name));
             }
           }
         } else if (info.isFile()) {
@@ -20371,7 +21564,7 @@ class MailExportConnector {
         continue;
       }
       const stem = basename10(file, extname9(file));
-      const mailboxDir = basename10(dirname16(file));
+      const mailboxDir = basename10(dirname18(file));
       const hierarchy = ["mailboxes", mailboxDir, stem];
       const extension = extname9(file).toLowerCase();
       const rawMessages = extension === ".mbox" ? splitMbox(bytes.toString("utf8")) : [bytes.toString("utf8")];
@@ -20441,16 +21634,16 @@ function splitMbox(text) {
   return messages.filter((message) => message.trim().length > 0);
 }
 var DEFAULT_MAX_DOCUMENTS3 = 500, DEFAULT_MAX_BYTES_PER_FILE2, MAX_BODY_CHARS = 50000, MBOX_SEPARATOR;
-var init_connector3 = __esm(() => {
+var init_connector4 = __esm(() => {
   DEFAULT_MAX_BYTES_PER_FILE2 = 50 * 1024 * 1024;
   MBOX_SEPARATOR = /^From .*\d{4}$/mu;
 });
 
 // src/datasource/skills/mail-export/skill.ts
 var MAIL_EXPORT_SKILL_DEFINITION, MailExportSkill;
-var init_skill6 = __esm(() => {
+var init_skill8 = __esm(() => {
   init_connector_skill();
-  init_connector3();
+  init_connector4();
   MAIL_EXPORT_SKILL_DEFINITION = {
     skillName: "mail-export",
     skillType: "mail-export",
@@ -20476,26 +21669,26 @@ var init_skill6 = __esm(() => {
 
 // src/datasource/skills/mail-export/index.ts
 var init_mail_export = __esm(() => {
-  init_connector3();
-  init_skill6();
+  init_connector4();
+  init_skill8();
 });
 
 // src/datasource/skills/mailcrawl/config.ts
-import { chmodSync, mkdirSync as mkdirSync15 } from "node:fs";
+import { chmodSync, mkdirSync as mkdirSync17 } from "node:fs";
 function validateMailcrawlInstanceId(instanceId) {
   if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u.test(instanceId)) {
     throw new Error("mailcrawl instanceId must be a safe single path segment");
   }
 }
 function ensurePrivateMailcrawlDataDir(path) {
-  mkdirSync15(path, { recursive: true, mode: 448 });
+  mkdirSync17(path, { recursive: true, mode: 448 });
   if (process.platform !== "win32")
     chmodSync(path, 448);
 }
 var init_config = () => {};
 
 // src/datasource/skills/mailcrawl/client.ts
-import { spawn as spawn11 } from "node:child_process";
+import { spawn as spawn13 } from "node:child_process";
 
 class MailcrawlClient {
   options;
@@ -20515,7 +21708,7 @@ class MailcrawlClient {
       ...this.options.fixture === undefined ? [] : ["--fixture", this.options.fixture],
       ...this.options.himalayaConfig === undefined ? [] : ["--himalaya-config", this.options.himalayaConfig]
     ];
-    const result = await this.run(args, signal);
+    const result = await this.run(args, signal, this.indexTimeoutMs());
     if (!result.ok)
       return failure2(result);
     const parsed = parseObject2(result.stdout);
@@ -20547,7 +21740,7 @@ class MailcrawlClient {
       "--json",
       query.trim()
     ];
-    const result = await this.run(args, options?.signal);
+    const result = await this.run(args, options?.signal, this.options.timeoutMs ?? DEFAULT_SEARCH_TIMEOUT_MS2);
     if (!result.ok)
       return failure2(result);
     const parsed = parseJson3(result.stdout);
@@ -20568,7 +21761,10 @@ class MailcrawlClient {
       code: result.code ?? 0
     };
   }
-  async run(args, signal) {
+  indexTimeoutMs() {
+    return this.options.indexTimeoutMs ?? this.options.timeoutMs ?? DEFAULT_INDEX_TIMEOUT_MS;
+  }
+  async run(args, signal, timeoutMs) {
     const violation = findRemoteEmbeddingViolation({ ...process.env, ...this.options.env ?? {} });
     if (violation !== undefined) {
       return { ok: false, reason: "remote-embedding-rejected", stdout: "", stderr: "", code: null };
@@ -20578,21 +21774,21 @@ class MailcrawlClient {
       ensurePrivateMailcrawlDataDir(dataDir);
     const env = {};
     for (const [key, value] of Object.entries(process.env)) {
-      if (value !== undefined && (SAFE_ENV_KEYS.has(key) || SAFE_MAILCRAWL_ENV_KEYS.has(key)))
+      if (value !== undefined && (SAFE_ENV_KEYS2.has(key) || SAFE_MAILCRAWL_ENV_KEYS.has(key)))
         env[key] = value;
     }
     for (const [key, value] of Object.entries(this.options.env ?? {})) {
       if (value === undefined)
         delete env[key];
-      else if (SAFE_ENV_KEYS.has(key) || SAFE_MAILCRAWL_ENV_KEYS.has(key))
+      else if (SAFE_ENV_KEYS2.has(key) || SAFE_MAILCRAWL_ENV_KEYS.has(key))
         env[key] = value;
     }
     if (dataDir !== undefined)
       env.MAILCRAWL_DATA_DIR = dataDir;
-    return spawnMailcrawl(this.options.binaryPath ?? DEFAULT_BINARY4, args, env, this.options, signal);
+    return spawnMailcrawl(this.options.binaryPath ?? DEFAULT_BINARY4, args, env, this.options, signal, timeoutMs);
   }
   async index(signal) {
-    const result = await this.run(["index", "--json"], signal);
+    const result = await this.run(["index", "--json"], signal, this.indexTimeoutMs());
     if (!result.ok)
       return failure2(result);
     const parsed = parseObject2(result.stdout);
@@ -20602,27 +21798,30 @@ class MailcrawlClient {
     return ok4({
       embedded: number(parsed, "embedded"),
       reused: number(parsed, "reused"),
-      generation: string(parsed, "generation")
+      generation: string(parsed, "generation"),
+      archiveRevision: string(parsed, "archiveRevision"),
+      rebuilt: typeof parsed.rebuilt === "boolean" ? parsed.rebuilt : undefined,
+      embedder: string(parsed, "embedder")
     }, result);
   }
 }
-function spawnMailcrawl(binary, args, env, options, signal) {
+function spawnMailcrawl(binary, args, env, options, signal, timeoutMs) {
   return new Promise((resolveResult) => {
     const portable = portableSpawnCommand(binary, args);
-    const child = spawn11(portable.command, portable.args, {
+    const child = spawn13(portable.command, portable.args, {
       env,
       detached: process.platform !== "win32",
       stdio: ["ignore", "pipe", "pipe"]
     });
     let stdout = { text: "", bytes: 0, exceeded: false }, stderr = { text: "", bytes: 0, exceeded: false }, settled = false, reason;
-    const max = options.maxBufferBytes ?? DEFAULT_MAX_BUFFER_BYTES3;
+    const max = options.maxBufferBytes ?? DEFAULT_MAX_BUFFER_BYTES4;
     const timer = setTimeout(() => {
       reason = "timeout";
-      terminate5(child);
-    }, options.timeoutMs ?? DEFAULT_TIMEOUT_MS8);
+      terminate4(child);
+    }, timeoutMs);
     const abort = () => {
       reason = "aborted";
-      terminate5(child);
+      terminate4(child);
     };
     if (signal?.aborted)
       abort();
@@ -20633,14 +21832,14 @@ function spawnMailcrawl(binary, args, env, options, signal) {
       stdout = appendOutput(stdout, chunk, max);
       if (stdout.exceeded && reason === undefined) {
         reason = "stdout-too-large";
-        terminate5(child);
+        terminate4(child);
       }
     });
     child.stderr.on("data", (chunk) => {
       stderr = appendOutput(stderr, chunk, max);
       if (stderr.exceeded && reason === undefined) {
         reason = "stderr-too-large";
-        terminate5(child);
+        terminate4(child);
       }
     });
     child.on("error", (error) => {
@@ -20673,7 +21872,7 @@ function spawnMailcrawl(binary, args, env, options, signal) {
     });
   });
 }
-function terminate5(child) {
+function terminate4(child) {
   if (child.killed)
     return;
   if (process.platform !== "win32" && child.pid !== undefined) {
@@ -20748,11 +21947,11 @@ function failure2(result) {
     ok: false,
     reason: result.reason ?? "nonzero-exit",
     stdout: result.stdout,
-    stderr: boundDiagnosticText5(result.stderr),
+    stderr: boundDiagnosticText6(result.stderr),
     code: result.code
   };
 }
-function boundDiagnosticText5(value) {
+function boundDiagnosticText6(value) {
   if (value.length === 0)
     return "";
   return value.trim().slice(0, 4000);
@@ -20780,10 +21979,22 @@ function findRemoteEmbeddingViolation(env) {
     const lower = key.toLowerCase();
     if (REMOTE_EMBEDDING_ENV_KEYS.has(lower))
       return key;
-    if (lower === "mailcrawl_embedder" && /^https?:\/\//iu.test(value.trim()))
-      return key;
+    if (lower === "mailcrawl_embedder" || lower === "mailcrawl_embed_url") {
+      if (isRemoteHttpEndpoint(value))
+        return key;
+    }
+  }
+  return;
+}
+function isRemoteHttpEndpoint(value) {
+  const trimmed = value.trim();
+  if (!/^https?:\/\//iu.test(trimmed))
+    return false;
+  try {
+    return !LOOPBACK_HOSTS2.has(new URL(trimmed).hostname);
+  } catch {
+    return true;
   }
-  return;
 }
 function truncateUtf8(value, maxBytes) {
   if (Buffer.byteLength(value) <= maxBytes)
@@ -20797,14 +22008,26 @@ function truncateUtf8(value, maxBytes) {
   }
   return "";
 }
-var DEFAULT_BINARY4 = "mailcrawl", DEFAULT_TIMEOUT_MS8 = 60000, DEFAULT_MAX_BUFFER_BYTES3 = 1048576, SAFE_ENV_KEYS, SAFE_MAILCRAWL_ENV_KEYS, REMOTE_EMBEDDING_ENV_KEYS;
-var init_client6 = __esm(() => {
+var DEFAULT_BINARY4 = "mailcrawl", DEFAULT_SEARCH_TIMEOUT_MS2 = 60000, DEFAULT_INDEX_TIMEOUT_MS = 1800000, DEFAULT_MAX_BUFFER_BYTES4 = 1048576, LOOPBACK_HOSTS2, SAFE_ENV_KEYS2, SAFE_MAILCRAWL_ENV_KEYS, REMOTE_EMBEDDING_ENV_KEYS;
+var init_client7 = __esm(() => {
   init_portable_spawn();
   init_config();
-  SAFE_ENV_KEYS = new Set(["HOME", "LANG", "LC_ALL", "PATH", "TMPDIR", "TMP", "TEMP", "NO_COLOR"]);
+  LOOPBACK_HOSTS2 = new Set(["127.0.0.1", "localhost", "[::1]", "::1"]);
+  SAFE_ENV_KEYS2 = new Set(["HOME", "LANG", "LC_ALL", "PATH", "TMPDIR", "TMP", "TEMP", "NO_COLOR"]);
   SAFE_MAILCRAWL_ENV_KEYS = new Set([
     "MAILCRAWL_DATA_DIR",
     "MAILCRAWL_EMBEDDER",
+    "MAILCRAWL_EMBEDDER_PROVIDER",
+    "MAILCRAWL_EMBED_URL",
+    "MAILCRAWL_EMBED_MODEL",
+    "MAILCRAWL_EMBED_DIM",
+    "MAILCRAWL_EMBED_TIMEOUT",
+    "MAILCRAWL_EMBED_BATCH_SIZE",
+    "MAILCRAWL_QUERY_PREFIX",
+    "MAILCRAWL_PASSAGE_PREFIX",
+    "MAILCRAWL_NATIVE_MODEL",
+    "MAILCRAWL_NATIVE_DEVICE",
+    "MAILCRAWL_NATIVE_DTYPE",
     "MAILCRAWL_KIWI_MODEL",
     "MAILCRAWL_JA_HELPER",
     "MAILCRAWL_ZH_HELPER"
@@ -20999,7 +22222,7 @@ Use this skill for authorized local email retrieval. AutoRAG invokes the externa
 Indexing is server-managed and incremental; do not trigger sync yourself.
 
 ## Search
-Call the dedicated \`${datasourceSearchToolName("mailcrawl")}\` tool with a natural-language query. Do not use \`search_datasource_documents\` for this datasource — it fans out to every datasource CLI. Available scopes:
+Call the dedicated \`${datasourceSearchToolName("mailcrawl")}\` tool with a natural-language query. Available scopes:
 ${scopes}
 
 The selectable retrieval modes are BM25, semantic, and hybrid. Scope arguments can only narrow trusted access. Source identifiers remain opaque and hierarchical.
@@ -21032,9 +22255,9 @@ Never pass datasource virtual paths (\`/mailcrawl/...\`) to bash; they are not O
   }
 }
 var TAGS;
-var init_skill7 = __esm(() => {
+var init_skill9 = __esm(() => {
   init_scope2();
-  init_client6();
+  init_client7();
   init_config();
   init_methods4();
   TAGS = ["mailcrawl", "email", "pii"];
@@ -21042,181 +22265,9 @@ var init_skill7 = __esm(() => {
 
 // src/datasource/skills/mailcrawl/index.ts
 var init_mailcrawl = __esm(() => {
-  init_client6();
+  init_client7();
   init_methods4();
-  init_skill7();
-});
-
-// src/datasource/crawler-client.ts
-import { spawn as spawn12 } from "node:child_process";
-
-class CrawlerCliClient {
-  profile;
-  options;
-  constructor(profile, options = {}) {
-    this.profile = profile;
-    this.options = options;
-  }
-  async sync(signal) {
-    const result = await this.run(this.profile.syncArgs(this.options), signal);
-    if (!result.ok)
-      return toFailure3(result);
-    const count = this.profile.parseSyncCount(result.stdout);
-    if (count === undefined)
-      return toFailure3(result, "invalid-output");
-    return { ok: true, count, stdout: result.stdout, stderr: result.stderr, code: result.code ?? 0 };
-  }
-  async search(query, options = {}) {
-    const topK = options.topK ?? 20;
-    const result = await this.run(this.profile.searchArgs(this.options, query, topK), options.signal);
-    if (!result.ok)
-      return toFailure3(result);
-    const hits = this.profile.parseHits(result.stdout);
-    if (hits === undefined)
-      return toFailure3(result, "invalid-output");
-    return { ok: true, hits, stdout: result.stdout, stderr: result.stderr, code: result.code ?? 0 };
-  }
-  async run(args, signal) {
-    const env = controlledEnv4(this.profile.allowedEnvPrefixes, this.options.env);
-    env.CRAWLKIT_NO_UPDATE_CHECK = "1";
-    return spawnCrawler(this.options.binaryPath ?? this.profile.binaryName, args, env, signal, this.options, this.options.workspacePath);
-  }
-}
-function spawnCrawler(command, args, env, signal, options, cwd) {
-  return new Promise((resolve) => {
-    const portable = portableSpawnCommand(command, args);
-    const child = spawn12(portable.command, [...portable.args], {
-      env,
-      ...cwd === undefined ? {} : { cwd },
-      stdio: ["ignore", "pipe", "pipe"]
-    });
-    let stdout = { text: "", bytes: 0, capped: false };
-    let stderr = { text: "", bytes: 0, capped: false };
-    let settled = false;
-    let finalReason;
-    const maxBuffer = options.maxBufferBytes ?? DEFAULT_MAX_BUFFER_BYTES4;
-    const timeout = setTimeout(() => {
-      finalReason = "timeout";
-      terminate6(child);
-    }, options.timeoutMs ?? DEFAULT_TIMEOUT_MS9);
-    const abortHandler = () => {
-      finalReason = "aborted";
-      terminate6(child);
-    };
-    if (signal?.aborted)
-      abortHandler();
-    signal?.addEventListener("abort", abortHandler, { once: true });
-    child.stdout.setEncoding("utf8");
-    child.stderr.setEncoding("utf8");
-    child.stdout.on("data", (chunk) => {
-      stdout = appendBounded4(stdout, chunk, maxBuffer);
-      if (stdout.capped) {
-        finalReason = "stdout-too-large";
-        terminate6(child);
-      }
-    });
-    child.stderr.on("data", (chunk) => {
-      stderr = appendBounded4(stderr, chunk, maxBuffer);
-      if (stderr.capped) {
-        finalReason = "stderr-too-large";
-        terminate6(child);
-      }
-    });
-    child.on("error", (error) => {
-      if (settled)
-        return;
-      settled = true;
-      clearTimeout(timeout);
-      signal?.removeEventListener("abort", abortHandler);
-      resolve({
-        ok: false,
-        reason: error.code === "ENOENT" ? "binary-missing" : "spawn-error",
-        stdout: stdout.text,
-        stderr: "",
-        code: null
-      });
-    });
-    child.on("close", (code) => {
-      if (settled)
-        return;
-      settled = true;
-      clearTimeout(timeout);
-      signal?.removeEventListener("abort", abortHandler);
-      resolve({
-        ok: code === 0 && finalReason === undefined,
-        ...finalReason !== undefined ? { reason: finalReason } : code === 0 ? {} : { reason: "nonzero-exit" },
-        stdout: stdout.text,
-        stderr: stderr.text,
-        code
-      });
-    });
-  });
-}
-function controlledEnv4(allowedPrefixes, configured) {
-  const env = {};
-  for (const [key, value] of Object.entries(process.env)) {
-    if (value !== undefined && isAllowedEnvKey(key, allowedPrefixes))
-      env[key] = value;
-  }
-  for (const [key, value] of Object.entries(configured ?? {})) {
-    if (value === undefined)
-      delete env[key];
-    else if (isAllowedEnvKey(key, allowedPrefixes))
-      env[key] = value;
-  }
-  return env;
-}
-function isAllowedEnvKey(key, allowedPrefixes) {
-  return SAFE_ENV_KEYS2.has(key) || process.platform === "win32" && [...SAFE_ENV_KEYS2].some((safeKey) => safeKey.toUpperCase() === key.toUpperCase()) || key.startsWith("CRAWLKIT_") || allowedPrefixes.some((prefix) => key.startsWith(prefix));
-}
-function appendBounded4(state, chunk, maxBytes) {
-  const nextBytes = state.bytes + Buffer.byteLength(chunk);
-  if (nextBytes <= maxBytes)
-    return { text: state.text + chunk, bytes: nextBytes, capped: false };
-  const remaining = Math.max(maxBytes - state.bytes, 0);
-  return { text: state.text + chunk.slice(0, remaining), bytes: maxBytes, capped: true };
-}
-function terminate6(child) {
-  if (!child.killed)
-    child.kill("SIGTERM");
-}
-function toFailure3(result, reason) {
-  return {
-    ok: false,
-    reason: reason ?? result.reason ?? "nonzero-exit",
-    stdout: result.stdout,
-    stderr: boundDiagnosticText6(result),
-    code: result.code
-  };
-}
-function boundDiagnosticText6(result) {
-  if (result.stderr.length > 0)
-    return result.stderr.trim().slice(0, 4000);
-  if (result.stdout.length > 0)
-    return result.stdout.trim().slice(0, 4000);
-  return "";
-}
-var DEFAULT_TIMEOUT_MS9 = 60000, DEFAULT_MAX_BUFFER_BYTES4 = 1048576, SAFE_ENV_KEYS2;
-var init_crawler_client = __esm(() => {
-  init_portable_spawn();
-  SAFE_ENV_KEYS2 = new Set([
-    "HOME",
-    "LANG",
-    "LC_ALL",
-    "PATH",
-    "TMPDIR",
-    "TMP",
-    "TEMP",
-    "NO_COLOR",
-    "APPDATA",
-    "ComSpec",
-    "LOCALAPPDATA",
-    "PATHEXT",
-    "SystemDrive",
-    "SystemRoot",
-    "USERPROFILE",
-    "WINDIR"
-  ]);
+  init_skill9();
 });
 
 // src/datasource/crawler-skill.ts
@@ -21237,7 +22288,7 @@ class CrawlerDatasourceSkill {
       description: `${definition.description} (${options.datasourceId})`
     };
     this.client = options.client;
-    this.instanceId = options.instanceId ?? DEFAULT_INSTANCE_ID4;
+    this.instanceId = options.instanceId ?? DEFAULT_INSTANCE_ID5;
     this.instances = options.instances !== undefined && options.instances.length > 0 ? options.instances : [this.instanceId];
     this.pollingIntervalMs = options.pollingIntervalMs ?? DEFAULT_POLLING_INTERVAL_MS4;
     this.tags = options.tags ?? definition.defaultTags;
@@ -21324,7 +22375,7 @@ class CrawlerDatasourceSkill {
         this.definition.manifestDescription,
         "",
         "## How to search",
-        `Call the dedicated \`${datasourceSearchToolName(this.definition.datasourceId)}\` tool with a query and optional narrowing scope. Do not use \`search_datasource_documents\` for this datasource — it fans out to every datasource CLI. Available authorized scopes:`,
+        `Call the dedicated \`${datasourceSearchToolName(this.definition.datasourceId)}\` tool with a query and optional narrowing scope. Available authorized scopes:`,
         scopes,
         "",
         "`scope` can only narrow within already-authorized scopes; it can never widen access.",
@@ -21431,7 +22482,7 @@ function matchesScope2(source, scope, allowedScopes) {
 function failureCode2(reason) {
   return reason === "binary-missing" || reason === "spawn-error" || reason === "timeout" || reason === "aborted" ? "datasource-unavailable" : "datasource-index-failed";
 }
-var DEFAULT_INSTANCE_ID4 = "default", DEFAULT_POLLING_INTERVAL_MS4;
+var DEFAULT_INSTANCE_ID5 = "default", DEFAULT_POLLING_INTERVAL_MS4;
 var init_crawler_skill = __esm(() => {
   init_errors2();
   init_scope2();
@@ -21453,7 +22504,7 @@ function parseCount(stdout) {
     return;
   if (Array.isArray(parsed))
     return parsed.length;
-  if (!isRecord12(parsed))
+  if (!isRecord13(parsed))
     return;
   for (const key of ["pages", "page_count", "pageCount", "synced", "count"]) {
     const value = parsed[key];
@@ -21468,12 +22519,12 @@ function parseHits(stdout) {
     return parseTabSeparatedHits(trimmed);
   }
   const parsed = parseJson4(stdout);
-  const rows = Array.isArray(parsed) ? parsed : isRecord12(parsed) && Array.isArray(parsed.results) ? parsed.results : undefined;
+  const rows = Array.isArray(parsed) ? parsed : isRecord13(parsed) && Array.isArray(parsed.results) ? parsed.results : undefined;
   if (rows === undefined)
     return;
   const hits = [];
   for (const [index, row] of rows.entries()) {
-    if (!isRecord12(row))
+    if (!isRecord13(row))
       return;
     const id = stringValue2(row, ["page_id", "id"]);
     const content = stringValue2(row, ["snippet", "text", "content"]);
@@ -21537,7 +22588,7 @@ function parseJson4(stdout) {
     return;
   }
 }
-function isRecord12(value) {
+function isRecord13(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function stringValue2(record, keys) {
@@ -21586,46 +22637,16 @@ var init_notion = __esm(() => {
   };
 });
 
-// src/process/terminate-tree.ts
-import { spawn as spawn13 } from "node:child_process";
-function terminateProcessTree(child, signal = "SIGTERM") {
-  const pid = child.pid;
-  if (pid === undefined)
-    return false;
-  if (process.platform === "win32") {
-    const killer = spawn13("taskkill", ["/pid", String(pid), "/t", "/f"], { stdio: "ignore", windowsHide: true });
-    killer.on("error", () => killDirectChild(child, signal));
-    return true;
-  }
-  try {
-    process.kill(-pid, signal);
-    return true;
-  } catch {
-    return killDirectChild(child, signal);
-  }
-}
-function killDirectChild(child, signal) {
-  if (child.exitCode !== null || child.signalCode !== null)
-    return false;
-  try {
-    return child.kill(signal);
-  } catch {
-    return false;
-  }
-}
-var TREE_KILL_GRACE_MS = 500;
-var init_terminate_tree = () => {};
-
 // src/datasource/skills/obsidian/paths.ts
-import { join as join26 } from "node:path";
+import { join as join28 } from "node:path";
 function obsidianDatasourceRoot(workspaceRoot, instanceId) {
-  return join26(workspaceRoot, AUTORAG_DIRNAME, DATASOURCES_DIRNAME, OBSIDIAN_DATASOURCE_DIRNAME, instanceId);
+  return join28(workspaceRoot, AUTORAG_DIRNAME, DATASOURCES_DIRNAME, OBSIDIAN_DATASOURCE_DIRNAME, instanceId);
 }
 function obsidianQmdConfigDir(workspaceRoot, instanceId) {
-  return join26(obsidianDatasourceRoot(workspaceRoot, instanceId), "config");
+  return join28(obsidianDatasourceRoot(workspaceRoot, instanceId), "config");
 }
 function obsidianQmdCacheDir(workspaceRoot, instanceId) {
-  return join26(obsidianDatasourceRoot(workspaceRoot, instanceId), "cache");
+  return join28(obsidianDatasourceRoot(workspaceRoot, instanceId), "cache");
 }
 function stripEdgeDashes(value) {
   let start = 0;
@@ -21648,7 +22669,7 @@ var DEFAULT_QMD_BINARY = "qmd", DEFAULT_QMD_TIMEOUT_MS = 60000, DEFAULT_QMD_MAX_
 
 // src/datasource/skills/obsidian/client.ts
 import { spawn as spawn14 } from "node:child_process";
-import { mkdirSync as mkdirSync16, writeFileSync as writeFileSync14 } from "node:fs";
+import { mkdirSync as mkdirSync18, writeFileSync as writeFileSync16 } from "node:fs";
 import { isAbsolute as isAbsolute6, resolve as resolve12 } from "node:path";
 
 class QmdClient {
@@ -21668,10 +22689,10 @@ class QmdClient {
     const cacheDir = obsidianQmdCacheDir(workspaceRoot, instanceId);
     try {
       if (this.options.configPath === undefined) {
-        mkdirSync16(configDir, { recursive: true });
-        writeFileSync14(resolve12(configDir, "index.yml"), renderIndexYaml(collectionName, vaultPath), "utf8");
+        mkdirSync18(configDir, { recursive: true });
+        writeFileSync16(resolve12(configDir, "index.yml"), renderIndexYaml(collectionName, vaultPath), "utf8");
       }
-      mkdirSync16(cacheDir, { recursive: true });
+      mkdirSync18(cacheDir, { recursive: true });
     } catch (error) {
       return failure3("spawn-error", error instanceof Error ? error.message : "failed to write qmd config");
     }
@@ -21894,7 +22915,7 @@ ${stderr}`;
   }
   try {
     const parsed = JSON.parse(stdout);
-    if (isRecord13(parsed)) {
+    if (isRecord14(parsed)) {
       return {
         indexed: numberField(parsed, "indexed") ?? numberField(parsed, "new") ?? 0,
         updated: numberField(parsed, "updated") ?? 0,
@@ -21923,7 +22944,7 @@ function parseSearchHits(stdout) {
 function extractHitRows(parsed) {
   if (Array.isArray(parsed))
     return parsed;
-  if (!isRecord13(parsed))
+  if (!isRecord14(parsed))
     return;
   for (const key of ["results", "hits", "documents", "items"]) {
     const value = parsed[key];
@@ -21935,7 +22956,7 @@ function extractHitRows(parsed) {
   return;
 }
 function normalizeHit3(raw) {
-  if (!isRecord13(raw))
+  if (!isRecord14(raw))
     return;
   const score = numberField(raw, "score") ?? numberField(raw, "relevance") ?? 0;
   const docid = stringField(raw, "docid") ?? stringField(raw, "id");
@@ -21981,11 +23002,11 @@ function numberField(record, key) {
   const value = record[key];
   return typeof value === "number" && Number.isFinite(value) ? value : undefined;
 }
-function isRecord13(value) {
+function isRecord14(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 var SAFE_INHERITED_ENV_KEYS3, SAFE_QMD_ENV_PREFIX = "QMD_";
-var init_client7 = __esm(() => {
+var init_client8 = __esm(() => {
   init_portable_spawn();
   init_terminate_tree();
   init_paths5();
@@ -22064,7 +23085,7 @@ async function retrieveObsidian(client, mode, methodName, instanceId, query, opt
   const trimmed = query.trim();
   if (trimmed.length === 0)
     return [];
-  const topK = options.topK ?? DEFAULT_TOP_K4;
+  const topK = options.topK ?? DEFAULT_TOP_K5;
   const searchOptions = { topK, signal: options.signal };
   const result = await client.search(mode, trimmed, searchOptions);
   if (!result.ok)
@@ -22106,7 +23127,7 @@ function toRetrievalResult3(hit, source, methodName, instanceId, mode) {
     }
   };
 }
-var OBSIDIAN_DATASOURCE_ID = "obsidian", DEFAULT_OBSIDIAN_TAGS, DEFAULT_TOP_K4 = 20;
+var OBSIDIAN_DATASOURCE_ID = "obsidian", DEFAULT_OBSIDIAN_TAGS, DEFAULT_TOP_K5 = 20;
 var init_methods5 = __esm(() => {
   init_errors2();
   init_scope2();
@@ -22124,7 +23145,7 @@ class ObsidianSkill {
   lastIndexedAt;
   lastError;
   constructor(options = {}) {
-    this.instanceId = options.instanceId ?? DEFAULT_INSTANCE_ID5;
+    this.instanceId = options.instanceId ?? DEFAULT_INSTANCE_ID6;
     this.instances = options.instances !== undefined && options.instances.length > 0 ? options.instances : [this.instanceId];
     this.pollingIntervalMs = options.pollingIntervalMs ?? DEFAULT_POLLING_INTERVAL_MS5;
     this.tags = options.tags ?? DEFAULT_OBSIDIAN_TAGS2;
@@ -22246,7 +23267,7 @@ class ObsidianSkill {
         `Indexing is server-managed and refreshed ${cadence} via \`qmd update\` (+ \`qmd embed\` for semantic). You do not trigger indexing; just search.`,
         "",
         "## How to search",
-        `Call the dedicated \`${datasourceSearchToolName(OBSIDIAN_DATASOURCE_ID2)}\` tool with a natural-language \`query\`. Optionally pass \`topK\` and a narrowing \`scope\`. Do not use \`search_datasource_documents\` for this datasource — it fans out to every datasource CLI. Available authorized scopes:`,
+        `Call the dedicated \`${datasourceSearchToolName(OBSIDIAN_DATASOURCE_ID2)}\` tool with a natural-language \`query\`. Optionally pass \`topK\` and a narrowing \`scope\`. Available authorized scopes:`,
         instanceScopes.length > 0 ? instanceScopes : "- (no authorized instances)",
         "",
         "`scope` can only narrow within already-authorized scopes; it can never widen access.",
@@ -22293,10 +23314,10 @@ function boundDiagnostic(value) {
   const trimmed = value.trim();
   return trimmed.length > 500 ? `${trimmed.slice(0, 500)}...` : trimmed;
 }
-var OBSIDIAN_DATASOURCE_ID2 = "obsidian", OBSIDIAN_SKILL_TYPE = "obsidian-vault", DEFAULT_INSTANCE_ID5 = "default", DEFAULT_POLLING_INTERVAL_MS5, DEFAULT_OBSIDIAN_TAGS2;
-var init_skill8 = __esm(() => {
+var OBSIDIAN_DATASOURCE_ID2 = "obsidian", OBSIDIAN_SKILL_TYPE = "obsidian-vault", DEFAULT_INSTANCE_ID6 = "default", DEFAULT_POLLING_INTERVAL_MS5, DEFAULT_OBSIDIAN_TAGS2;
+var init_skill10 = __esm(() => {
   init_scope2();
-  init_client7();
+  init_client8();
   init_methods5();
   init_paths5();
   DEFAULT_POLLING_INTERVAL_MS5 = 15 * 60 * 1000;
@@ -22305,10 +23326,10 @@ var init_skill8 = __esm(() => {
 
 // src/datasource/skills/obsidian/index.ts
 var init_obsidian = __esm(() => {
-  init_client7();
+  init_client8();
   init_methods5();
   init_paths5();
-  init_skill8();
+  init_skill10();
 });
 
 // src/datasource/skills/rss/connector.ts
@@ -22458,13 +23479,13 @@ function present(item) {
   return item !== undefined;
 }
 var DEFAULT_MAX_DOCUMENTS4 = 500, DEFAULT_MAX_ITEMS_PER_FEED = 100, DEFAULT_FEED_TIMEOUT_MS = 30000, MAX_CONTENT_CHARS2 = 20000, ACCEPT_HEADER = "application/rss+xml, application/atom+xml, application/xml, text/xml";
-var init_connector4 = () => {};
+var init_connector5 = () => {};
 
 // src/datasource/skills/rss/skill.ts
 var RSS_SKILL_DEFINITION, DEFAULT_DEDUPE_WINDOW_MS, RssSkill;
-var init_skill9 = __esm(() => {
+var init_skill11 = __esm(() => {
   init_connector_skill();
-  init_connector4();
+  init_connector5();
   RSS_SKILL_DEFINITION = {
     skillName: "rss",
     skillType: "rss-feeds",
@@ -22490,8 +23511,8 @@ var init_skill9 = __esm(() => {
 
 // src/datasource/skills/rss/index.ts
 var init_rss = __esm(() => {
-  init_connector4();
-  init_skill9();
+  init_connector5();
+  init_skill11();
 });
 
 // src/datasource/skills/slack/index.ts
@@ -22508,7 +23529,7 @@ function parseCount2(stdout) {
     return;
   if (Array.isArray(parsed))
     return parsed.length;
-  if (!isRecord14(parsed))
+  if (!isRecord15(parsed))
     return;
   for (const key of ["messages", "message_count", "messageCount", "synced", "count"]) {
     const value = parsed[key];
@@ -22521,12 +23542,12 @@ function parseHits2(stdout) {
   const parsed = parseJson5(stdout);
   if (parsed === null)
     return [];
-  const rows = Array.isArray(parsed) ? parsed : isRecord14(parsed) && Array.isArray(parsed.messages) ? parsed.messages : undefined;
+  const rows = Array.isArray(parsed) ? parsed : isRecord15(parsed) && Array.isArray(parsed.messages) ? parsed.messages : undefined;
   if (rows === undefined)
     return;
   const hits = [];
   for (const [index, row] of rows.entries()) {
-    if (!isRecord14(row))
+    if (!isRecord15(row))
       return;
     const workspaceId = stringValue3(row, ["workspace_id"]);
     const workspaceName = stringValue3(row, ["workspace_name"]);
@@ -22581,7 +23602,7 @@ function parseJson5(stdout) {
     return;
   }
 }
-function isRecord14(value) {
+function isRecord15(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function stringValue3(record, keys) {
@@ -22645,7 +23666,7 @@ var init_slack = __esm(() => {
 
 // src/datasource/skills/spotlight/connector.ts
 import { spawn as spawn15 } from "node:child_process";
-import { createHash as createHash7 } from "node:crypto";
+import { createHash as createHash8 } from "node:crypto";
 import { readFile as fsReadFile, stat as stat6 } from "node:fs/promises";
 import { basename as basename11, extname as extname10 } from "node:path";
 
@@ -22668,7 +23689,7 @@ class SpotlightConnector {
     if (queries.length === 0) {
       return { ok: false, reason: "not-configured", message: "no spotlight queries configured" };
     }
-    const timeoutMs = this.options.timeoutMs ?? DEFAULT_TIMEOUT_MS10;
+    const timeoutMs = this.options.timeoutMs ?? DEFAULT_TIMEOUT_MS9;
     const status = await this.run("mdutil", ["-s", "/"], timeoutMs);
     if (status.ok && /indexing disabled/iu.test(status.stdout)) {
       return {
@@ -22729,7 +23750,7 @@ class SpotlightConnector {
         if (content.length === 0)
           continue;
         documents.push({
-          docId: createHash7("sha256").update(path).digest("hex").slice(0, 16),
+          docId: createHash8("sha256").update(path).digest("hex").slice(0, 16),
           hierarchy: ["files"],
           title: basename11(path),
           content,
@@ -22762,7 +23783,7 @@ class SpotlightConnector {
     return { ok: true, documents, ...warnings.length > 0 ? { warnings } : {} };
   }
 }
-var DEFAULT_MAX_RESULTS_PER_QUERY = 100, DEFAULT_MAX_DOCUMENTS5 = 300, DEFAULT_MAX_BYTES_PER_FILE3, DEFAULT_TIMEOUT_MS10 = 15000, MAX_CONTENT_CHARS3 = 1e5, MAX_BUFFER_BYTES, FDA_GUIDANCE = "grant Full Disk Access to the terminal or app running AutoRAG (System Settings -> Privacy & Security -> Full Disk Access), then restart it", spawnRunner = (command, args, timeoutMs) => new Promise((resolve) => {
+var DEFAULT_MAX_RESULTS_PER_QUERY = 100, DEFAULT_MAX_DOCUMENTS5 = 300, DEFAULT_MAX_BYTES_PER_FILE3, DEFAULT_TIMEOUT_MS9 = 15000, MAX_CONTENT_CHARS3 = 1e5, MAX_BUFFER_BYTES, FDA_GUIDANCE = "grant Full Disk Access to the terminal or app running AutoRAG (System Settings -> Privacy & Security -> Full Disk Access), then restart it", spawnRunner = (command, args, timeoutMs) => new Promise((resolve) => {
   const child = spawn15(command, [...args], { stdio: ["ignore", "pipe", "pipe"] });
   let stdout = "";
   let stderr = "";
@@ -22795,16 +23816,16 @@ var DEFAULT_MAX_RESULTS_PER_QUERY = 100, DEFAULT_MAX_DOCUMENTS5 = 300, DEFAULT_M
     finish({ ok: code === 0, stdout, stderr, code });
   });
 });
-var init_connector5 = __esm(() => {
+var init_connector6 = __esm(() => {
   DEFAULT_MAX_BYTES_PER_FILE3 = 256 * 1024;
   MAX_BUFFER_BYTES = 4 * 1024 * 1024;
 });
 
 // src/datasource/skills/spotlight/skill.ts
 var SPOTLIGHT_SKILL_DEFINITION, SpotlightSkill;
-var init_skill10 = __esm(() => {
+var init_skill12 = __esm(() => {
   init_connector_skill();
-  init_connector5();
+  init_connector6();
   SPOTLIGHT_SKILL_DEFINITION = {
     skillName: "spotlight",
     skillType: "spotlight-search",
@@ -22841,8 +23862,8 @@ var init_skill10 = __esm(() => {
 
 // src/datasource/skills/spotlight/index.ts
 var init_spotlight = __esm(() => {
-  init_connector5();
-  init_skill10();
+  init_connector6();
+  init_skill12();
 });
 
 // src/datasource/skills/telecrawl/index.ts
@@ -22859,7 +23880,7 @@ function parseCount3(stdout) {
     return;
   if (Array.isArray(parsed))
     return parsed.length;
-  if (!isRecord15(parsed))
+  if (!isRecord16(parsed))
     return;
   for (const key of ["messages", "message_count", "messageCount", "imported", "count"]) {
     const value = parsed[key];
@@ -22872,12 +23893,12 @@ function parseHits3(stdout) {
   const parsed = parseJson6(stdout);
   if (parsed === null)
     return [];
-  const rows = Array.isArray(parsed) ? parsed : isRecord15(parsed) && Array.isArray(parsed.messages) ? parsed.messages : undefined;
+  const rows = Array.isArray(parsed) ? parsed : isRecord16(parsed) && Array.isArray(parsed.messages) ? parsed.messages : undefined;
   if (rows === undefined)
     return;
   const hits = [];
   for (const [index, row] of rows.entries()) {
-    if (!isRecord15(row))
+    if (!isRecord16(row))
       return;
     const id = stringValue4(row, ["message_id", "event_id", "id"]);
     const content = stringValue4(row, ["snippet", "text", "content"]);
@@ -22916,7 +23937,7 @@ function parseJson6(stdout) {
     return;
   }
 }
-function isRecord15(value) {
+function isRecord16(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function stringValue4(record, keys) {
@@ -22979,7 +24000,7 @@ function parseCount4(stdout) {
     return;
   if (Array.isArray(parsed))
     return parsed.length;
-  if (!isRecord16(parsed))
+  if (!isRecord17(parsed))
     return;
   for (const key of ["messages", "message_count", "messageCount", "imported", "count"]) {
     const value = parsed[key];
@@ -22992,12 +24013,12 @@ function parseHits4(stdout) {
   const parsed = parseJson7(stdout);
   if (parsed === null)
     return [];
-  const rows = Array.isArray(parsed) ? parsed : isRecord16(parsed) && Array.isArray(parsed.messages) ? parsed.messages : undefined;
+  const rows = Array.isArray(parsed) ? parsed : isRecord17(parsed) && Array.isArray(parsed.messages) ? parsed.messages : undefined;
   if (rows === undefined)
     return;
   const hits = [];
   for (const [index, row] of rows.entries()) {
-    if (!isRecord16(row))
+    if (!isRecord17(row))
       return;
     const id = stringValue5(row, ["message_id", "event_id", "id"]);
     const content = stringValue5(row, ["snippet", "text", "content"]);
@@ -23034,7 +24055,7 @@ function parseJson7(stdout) {
     return;
   }
 }
-function isRecord16(value) {
+function isRecord17(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function stringValue5(record, keys) {
@@ -23092,6 +24113,16 @@ var init_wacrawl = __esm(() => {
 });
 
 // src/datasource/skills/factory.ts
+function larkConnectorOptions(connector) {
+  if (connector === undefined)
+    return {};
+  const binaryPath = connector.binaryPath;
+  const embedderBaseUrl = connector.embedderBaseUrl;
+  return {
+    ...typeof binaryPath === "string" ? { binaryPath } : {},
+    ...typeof embedderBaseUrl === "string" ? { embedderBaseUrl } : {}
+  };
+}
 function common(config, workspaceRoot) {
   return {
     ...config.instanceId !== undefined ? { instanceId: config.instanceId } : {},
@@ -23125,13 +24156,14 @@ function buildDatasourceSkills(config, workspaceRoot, embeddingRuntime) {
       unknown.push(name);
       continue;
     }
-    const hasChannelFilter = (entry.channels?.ids?.length ?? 0) > 0 || (entry.channels?.names?.length ?? 0) > 0;
+    const larkOwnsChannels = templateName === "lark";
+    const hasChannelFilter = !larkOwnsChannels && ((entry.channels?.ids?.length ?? 0) > 0 || (entry.channels?.names?.length ?? 0) > 0);
     let aliased = skill;
     if (name !== templateName || hasChannelFilter) {
       aliased = new AliasedDatasourceSkill(skill, {
         alias: name,
-        ...entry.channels?.ids !== undefined ? { channelIds: entry.channels.ids } : {},
-        ...entry.channels?.names !== undefined ? { channelNames: entry.channels.names } : {}
+        ...!larkOwnsChannels && entry.channels?.ids !== undefined ? { channelIds: entry.channels.ids } : {},
+        ...!larkOwnsChannels && entry.channels?.names !== undefined ? { channelNames: entry.channels.names } : {}
       });
     }
     skills.push(typeof entry.description === "string" && entry.description.trim().length > 0 ? new DescribedDatasourceSkill(aliased, entry.description.trim()) : aliased);
@@ -23145,7 +24177,9 @@ var init_factory = __esm(() => {
   init_cloud_drive();
   init_discrawl();
   init_github();
-  init_katok();
+  init_github_gist();
+  init_lark();
+  init_lazykatok();
   init_mail_export();
   init_mailcrawl();
   init_notion();
@@ -23240,8 +24274,15 @@ var init_factory = __esm(() => {
         ...workspaceRoot === undefined ? {} : { workspacePath: workspaceRoot }
       }
     }),
-    kakao: (config, _workspaceRoot, _registrationName) => new KatokSkill({
-      client: new KatokClient({
+    lark: (config, _workspaceRoot, registrationName) => new LarkSkill({
+      datasourceId: registrationName,
+      ...config.instanceId !== undefined ? { instanceId: config.instanceId } : {},
+      ...config.tags !== undefined ? { tags: config.tags } : {},
+      ...config.channels?.ids !== undefined ? { chatIds: config.channels.ids } : {},
+      ...larkConnectorOptions(config.connector)
+    }),
+    kakao: (config, _workspaceRoot, _registrationName) => new LazykatokSkill({
+      client: new LazykatokClient({
         ...config.connector
       }),
       ...config.instanceId !== undefined ? { instanceId: config.instanceId } : {},
@@ -23253,6 +24294,11 @@ var init_factory = __esm(() => {
       skillName: registrationName,
       connectorOptions: config.connector
     }),
+    "github-gist": (config, workspaceRoot, registrationName) => new GitHubGistSkill({
+      ...common(config, workspaceRoot),
+      skillName: registrationName,
+      connectorOptions: config.connector
+    }),
     "cloud-drive": (config, workspaceRoot, registrationName) => new CloudDriveSkill({
       ...common(config, workspaceRoot),
       skillName: registrationName,
@@ -23298,8 +24344,8 @@ var init_factory = __esm(() => {
 
 // src/cli/config.ts
 import { randomUUID as randomUUID7 } from "node:crypto";
-import { existsSync as existsSync20, mkdirSync as mkdirSync17, readFileSync as readFileSync16, renameSync as renameSync8, unlinkSync as unlinkSync4, writeFileSync as writeFileSync15 } from "node:fs";
-import { basename as basename12, dirname as dirname17, isAbsolute as isAbsolute7, join as join27, resolve as resolve13 } from "node:path";
+import { existsSync as existsSync23, mkdirSync as mkdirSync19, readFileSync as readFileSync18, renameSync as renameSync8, unlinkSync as unlinkSync4, writeFileSync as writeFileSync17 } from "node:fs";
+import { basename as basename12, dirname as dirname19, isAbsolute as isAbsolute7, join as join29, resolve as resolve13 } from "node:path";
 import { findEnvKeys, getEnvApiKey, getModel, getProviders } from "@earendil-works/pi-ai/compat";
 function resolveConfigPath(input) {
   const flags = input.flags;
@@ -23314,15 +24360,15 @@ function resolveConfigPath(input) {
     return { configPath: envConfig, explicit: true };
   }
   return {
-    configPath: join27(resolveAutoRAGHome(env), DEFAULT_CONFIG_FILENAME),
+    configPath: join29(resolveAutoRAGHome(env), DEFAULT_CONFIG_FILENAME),
     explicit: false,
-    legacyPath: join27(cwd, LEGACY_CONFIG_FILENAME)
+    legacyPath: join29(cwd, LEGACY_CONFIG_FILENAME)
   };
 }
 function readConfigFile(configPath, explicit) {
   let exists;
   try {
-    exists = existsSync20(configPath);
+    exists = existsSync23(configPath);
   } catch {
     exists = false;
   }
@@ -23334,7 +24380,7 @@ function readConfigFile(configPath, explicit) {
   }
   let text;
   try {
-    text = readFileSync16(configPath, "utf8");
+    text = readFileSync18(configPath, "utf8");
   } catch (err) {
     throw new ConfigError(`Failed to read config file: ${err.message}`);
   }
@@ -23372,9 +24418,9 @@ function acquireConfigWriteLock(configPath) {
   });
 }
 function replaceFileAtomically(path, contents, assertCommitAllowed) {
-  const temporaryPath = join27(dirname17(path), `.${basename12(path)}.${process.pid}.${randomUUID7()}.tmp`);
+  const temporaryPath = join29(dirname19(path), `.${basename12(path)}.${process.pid}.${randomUUID7()}.tmp`);
   try {
-    writeFileSync15(temporaryPath, contents, { encoding: "utf8", flag: "wx", flush: true, mode: 384 });
+    writeFileSync17(temporaryPath, contents, { encoding: "utf8", flag: "wx", flush: true, mode: 384 });
     assertCommitAllowed?.();
     renameSync8(temporaryPath, path);
   } finally {
@@ -23382,15 +24428,15 @@ function replaceFileAtomically(path, contents, assertCommitAllowed) {
   }
 }
 function migrateLegacyConfig(configPath, legacyPath) {
-  if (existsSync20(configPath) || !existsSync20(legacyPath))
+  if (existsSync23(configPath) || !existsSync23(legacyPath))
     return;
   const legacy = readConfigFile(legacyPath, true);
-  const legacyBytes = readFileSync16(legacyPath);
-  const migrated = normalizeLegacyConfigPaths(legacy ?? {}, dirname17(legacyPath));
+  const legacyBytes = readFileSync18(legacyPath);
+  const migrated = normalizeLegacyConfigPaths(legacy ?? {}, dirname19(legacyPath));
   const migratedPathsUnchanged = legacy?.workspacePath === migrated.workspacePath && legacy?.memoryPath === migrated.memoryPath && JSON.stringify(legacy?.searchPaths) === JSON.stringify(migrated.searchPaths);
   const migratedBytes = migratedPathsUnchanged ? legacyBytes : `${JSON.stringify(migrated, null, 2)}
 `;
-  mkdirSync17(dirname17(configPath), { recursive: true });
+  mkdirSync19(dirname19(configPath), { recursive: true });
   const lock = acquireConfigWriteLock(configPath);
   try {
     const winner = readConfigFile(configPath, false);
@@ -23420,7 +24466,7 @@ function resolveConfigFileReadOnly(configPath, explicit, legacyPath) {
   const legacy = readConfigFile(legacyPath, false);
   if (legacy === undefined)
     return {};
-  return normalizeLegacyConfigPaths(legacy, dirname17(legacyPath));
+  return normalizeLegacyConfigPaths(legacy, dirname19(legacyPath));
 }
 function resolveSearchPaths(searchPaths, origin) {
   return searchPaths.map((searchPath) => resolvePersistedPath(searchPath, origin));
@@ -23865,10 +24911,10 @@ function resolveConfig(input) {
   const file = readOnly ? resolveConfigFileReadOnly(configPath, explicit, legacyPath) : !explicit && legacyPath ? migrateLegacyConfig(configPath, legacyPath) ?? readConfigFile(configPath, explicit) ?? {} : readConfigFile(configPath, explicit) ?? {};
   const defaultSearchPaths = ["."];
   const defaultWorkspacePath = cwd;
-  const defaultMemoryPath = join27(resolveAutoRAGHome(env), "memory.json");
+  const defaultMemoryPath = join29(resolveAutoRAGHome(env), "memory.json");
   const flagSearchPaths = parseCsv(flagString(flags, "search-paths"));
   const envSearchPaths = parseCsv(envString(env, "AUTORAG_SEARCH_PATHS"));
-  const configOrigin = dirname17(resolve13(configPath));
+  const configOrigin = dirname19(resolve13(configPath));
   const fileWorkspacePath = typeof file.workspacePath === "string" ? resolvePersistedPath(file.workspacePath, configOrigin) : undefined;
   const fileSearchPaths = file.searchPaths ? resolveSearchPaths(file.searchPaths, fileWorkspacePath ?? configOrigin) : undefined;
   const searchPaths = flagSearchPaths ?? envSearchPaths ?? fileSearchPaths ?? defaultSearchPaths;
@@ -24225,7 +25271,7 @@ function writeConfigObject(path, config) {
   if (config === null || typeof config !== "object" || Array.isArray(config)) {
     throw new ConfigError("Config file must be a JSON object");
   }
-  mkdirSync17(dirname17(path), { recursive: true });
+  mkdirSync19(dirname19(path), { recursive: true });
   const contents = `${JSON.stringify(config, null, 2)}
 `;
   const lock = acquireConfigWriteLock(path);
@@ -24238,7 +25284,7 @@ function writeConfigObject(path, config) {
 function writeDefaultConfig(path, partial, opts = {}) {
   const cwd = resolve13(opts.cwd ?? process.cwd());
   const workspacePath = resolvePersistedPath(partial.workspacePath ?? ".", cwd);
-  const memoryPath = partial.memoryPath === undefined ? join27(resolveAutoRAGHome(opts.env), "memory.json") : resolvePersistedPath(partial.memoryPath, workspacePath);
+  const memoryPath = partial.memoryPath === undefined ? join29(resolveAutoRAGHome(opts.env), "memory.json") : resolvePersistedPath(partial.memoryPath, workspacePath);
   const full = {
     searchPaths: resolveSearchPaths(partial.searchPaths ?? ["."], cwd),
     workspacePath,
@@ -24261,19 +25307,19 @@ function writeDefaultConfig(path, partial, opts = {}) {
     full.p2p = normalizeP2pConfig(partial.p2p);
   else
     full.p2p = { enabled: false };
-  mkdirSync17(dirname17(path), { recursive: true });
+  mkdirSync19(dirname19(path), { recursive: true });
   const contents = `${JSON.stringify(full, null, 2)}
 `;
   const lock = acquireConfigWriteLock(path);
   try {
-    if (!opts.force && existsSync20(path)) {
+    if (!opts.force && existsSync23(path)) {
       throw new ConfigError(`Config file already exists: ${path}`);
     }
     if (opts.force || opts.atomicCreate)
       replaceFileAtomically(path, contents, lock.assertOwned);
     else {
       lock.assertOwned();
-      writeFileSync15(path, contents, { encoding: "utf8", flag: "wx", flush: true, mode: 384 });
+      writeFileSync17(path, contents, { encoding: "utf8", flag: "wx", flush: true, mode: 384 });
     }
   } catch (error) {
     if (!opts.force && isEexistError(error)) {
@@ -24449,7 +25495,6 @@ init_dupey_tool();
 init_emit_results_tool();
 init_jikji_find_tool();
 init_search_all_tool();
-init_search_datasource_tool();
 init_search_minsync_tool();
 init_search_single_datasource_tool();
 init_system_prompt();
@@ -24638,7 +25683,8 @@ init_cloud_drive();
 init_discrawl();
 init_factory();
 init_github();
-init_katok();
+init_lark();
+init_lazykatok();
 init_mail_export();
 init_mailcrawl();
 init_notion();
@@ -24707,10 +25753,12 @@ export {
   JIKJI_CRATE_NAME,
   JIKJI_INSTALL_TIMEOUT_MS,
   JikjiClient,
-  KatokBm25Method,
-  KatokClient,
-  KatokSemanticMethod,
-  KatokSkill,
+  LarkClient,
+  LarkSkill,
+  LazykatokBm25Method,
+  LazykatokClient,
+  LazykatokSemanticMethod,
+  LazykatokSkill,
   LocalEmbedderError,
   MAILCRAWL_MODES,
   MINSYNC_CONFIG_DIR,