@codeworksh/cli 0.0.1-dev.20260922184805 → 0.0.1-dev.20260923102823

package/{error-BrbT9_4g.mjs → error-DG5INUkQ.mjs}

@@ -20,6 +20,7 @@ import { Buffer as Buffer$1 } from "node:buffer";
 import { Bash } from "just-bash";
 import { SandboxDriver as SandboxDriver$3, SandboxProvider } from "@codeworksh/plugin/sandbox";
 import { DirectoryNotFoundError, DirectoryNotFoundError as DirectoryNotFoundError$1, Info, NotDirectoryError, NotDirectoryError as NotDirectoryError$1, Service, Service as Service$8 } from "@codeworksh/plugin/location";
+import { generateModels } from "@codeworksh/aikit/modelgen";
 import { Script, constants } from "node:vm";
 import * as AikitFailure from "@codeworksh/aikit/failure";
 import { JsonGitHubCopilotAuthStorage, getGitHubCopilotApiKey } from "@codeworksh/aikit/oauth/github/copilot";
@@ -357,7 +358,7 @@ const setup = Effect.gen(function* () {
 	yield* sql`PRAGMA foreign_keys = ON`;
 	yield* SqliteMigrator.run({ loader: Migrator.fromRecord(migrations) });
 });
-function layer$26(location) {
+function layer$27(location) {
 	return Layer.unwrap(Effect.gen(function* () {
 		if (location !== ":memory:") yield* fileSystem.makeDirectory(posix.dirname(location), { recursive: true }).pipe(Effect.orDie);
 		return SqliteClient.layer({
@@ -376,7 +377,7 @@ const path$1 = Effect.fn("Database.path")(function* (data) {
 	const directory = data ?? (yield* resolve$3()).data;
 	return resolveDatabaseLocation(yield* locationConfig, directory);
 });
-const defaultLayer$1 = Layer.unwrap(path$1().pipe(Effect.map(layer$26)));
+const defaultLayer$1 = Layer.unwrap(path$1().pipe(Effect.map(layer$27)));
 //#endregion
 //#region ../harness/src/event/schema.ts
 var schema_exports$6 = /* @__PURE__ */ __exportAll({});
@@ -555,7 +556,7 @@ var SessionEntryPartRow = class extends Model$1.Class("SessionEntryPartRow")({
 /**
 * The public description of a failed execution.
 *
-* Open by design: `type` is a namespaced category string, not a closed union.
+* Open by design: `type` is a kebab-case category ending in `-error`, not a closed union.
 * A client older than the server degrades to the message instead of failing to
 * decode, and a new category is an additive change. The typed cause stays
 * server-side -- this is what crosses the wire.
@@ -568,40 +569,40 @@ const Error$1 = Schema.Struct({
 });
 const providerCategory$1 = (tag) => {
 	switch (tag) {
-		case "Runner.ProviderAuthenticationError": return "provider.auth";
-		case "Runner.ProviderAuthorizationError": return "provider.forbidden";
-		case "Runner.ProviderConfigurationError": return "provider.config";
-		case "Runner.ProviderModelUnavailableError": return "provider.model-unavailable";
-		case "Runner.ProviderRateLimitError": return "provider.rate-limit";
-		case "Runner.ProviderQuotaError": return "provider.quota";
-		case "Runner.ProviderInvalidRequestError": return "provider.invalid-request";
-		case "Runner.ProviderContentPolicyError": return "provider.content-filter";
-		case "Runner.ProviderTimeoutError": return "provider.timeout";
-		case "Runner.ProviderTransportError": return "provider.transport";
-		case "Runner.ProviderUnavailableError": return "provider.unavailable";
-		case "Runner.ProviderInvalidResponseError": return "provider.invalid-output";
-		default: return "provider.unknown";
+		case "Runner.ProviderAuthenticationError": return "provider-authentication-error";
+		case "Runner.ProviderAuthorizationError": return "provider-authorization-error";
+		case "Runner.ProviderConfigurationError": return "provider-configuration-error";
+		case "Runner.ProviderModelUnavailableError": return "provider-model-unavailable-error";
+		case "Runner.ProviderRateLimitError": return "provider-rate-limit-error";
+		case "Runner.ProviderQuotaError": return "provider-quota-error";
+		case "Runner.ProviderInvalidRequestError": return "provider-invalid-request-error";
+		case "Runner.ProviderContentPolicyError": return "provider-content-filter-error";
+		case "Runner.ProviderTimeoutError": return "provider-timeout-error";
+		case "Runner.ProviderTransportError": return "provider-transport-error";
+		case "Runner.ProviderUnavailableError": return "provider-unavailable-error";
+		case "Runner.ProviderInvalidResponseError": return "provider-invalid-response-error";
+		default: return "provider-unknown-error";
 	}
 };
 const category = (tag) => {
 	switch (tag) {
-		case "Runner.ModelCatalogError": return "model.catalog";
-		case "Runner.ModelNotFoundError": return "model.not-found";
-		case "Runner.LLMStreamError": return "llm.stream";
-		case "ContextDecodeError": return "context.decode";
-		case "ContextEncodeError": return "context.encode";
-		case "SessionNotFoundError": return "session.not-found";
-		case "SessionLinkedSpaceNotFoundError": return "session.space-not-found";
-		case "SettingsError": return "settings";
-		case "State.SnapshotError": return "state.snapshot";
-		case "Runner.SandboxDirectoryNotFoundError": return "sandbox.directory-not-found";
-		case "SandboxFileSystemError": return "sandbox.filesystem";
+		case "Runner.ModelCatalogError": return "model-catalog-error";
+		case "Runner.ModelNotFoundError": return "model-not-found-error";
+		case "Runner.LLMStreamError": return "llm-stream-error";
+		case "ContextDecodeError": return "context-decode-error";
+		case "ContextEncodeError": return "context-encode-error";
+		case "SessionNotFoundError": return "session-not-found-error";
+		case "SessionLinkedSpaceNotFoundError": return "session-space-not-found-error";
+		case "SettingsError": return "settings-error";
+		case "State.SnapshotError": return "state-snapshot-error";
+		case "Runner.SandboxDirectoryNotFoundError": return "sandbox-directory-not-found-error";
+		case "SandboxFileSystemError": return "sandbox-filesystem-error";
 		case "SandboxNotFoundError":
 		case "SandboxDriverNotRegisteredError":
 		case "SandboxUnavailError":
 		case "SandboxRemovedError":
-		case "SandboxProviderError": return "sandbox.mount";
-		default: return "unknown";
+		case "SandboxProviderError": return "sandbox-mount-error";
+		default: return "unknown-error";
 	}
 };
 const message = (cause) => cause instanceof globalThis.Error ? cause.message : typeof cause === "string" ? cause : "Session execution failed";
@@ -609,7 +610,7 @@ const message = (cause) => cause instanceof globalThis.Error ? cause.message : t
 const fromCause = (cause) => {
 	const tag = Predicate.hasProperty(cause, "_tag") && typeof cause._tag === "string" ? cause._tag : void 0;
 	if (tag === void 0) return {
-		type: "unknown",
+		type: "unknown-error",
 		message: message(cause)
 	};
 	if (tag === "Runner.ProviderError") {
@@ -872,7 +873,7 @@ var InvalidDurableEventError = class extends Schema.TaggedError()("InvalidDurabl
 }) {};
 var SubscriptionOverflowError = class extends Schema.TaggedError()("SubscriptionOverflowError", { capacity: Schema.Int }) {};
 var Service$16 = class extends Context.Service()("@codeworksh/harness/event/event/Service") {};
-const layer$25 = Layer.effect(Service$16, Effect.gen(function* () {
+const layer$26 = Layer.effect(Service$16, Effect.gen(function* () {
 	const sql = yield* SqlClient.SqlClient;
 	const pubsub = { durable: /* @__PURE__ */ new Map() };
 	const subscriptions = /* @__PURE__ */ new Set();
@@ -1235,7 +1236,7 @@ const archiveEnv = Effect.fn("Space.archiveEnv")(function* (env) {
 				`;
 	})).pipe(Effect.orDie);
 });
-const layer$24 = Layer.effect(Service$15, Effect.gen(function* () {
+const layer$25 = Layer.effect(Service$15, Effect.gen(function* () {
 	const sql = yield* SqlClient.SqlClient;
 	const fs = yield* io_exports.SandboxIO.FileSystem;
 	const { id: env } = yield* io_exports.SandboxIO.Current;
@@ -1403,7 +1404,7 @@ const decodeMessageEnvelopeIdentity = Schema.decodeUnknownEffect(MessageEnvelope
 const decodeCompactionData$1 = Schema.decodeUnknownEffect(CompactionData);
 const decodeJsonObject$1 = Schema.decodeUnknownEffect(JsonObject);
 const encodeJsonObject$1 = Schema.encodeEffect(JsonObject);
-const layer$23 = Layer.effect(Service$14, Effect.gen(function* () {
+const layer$24 = Layer.effect(Service$14, Effect.gen(function* () {
 	const sql = yield* SqlClient.SqlClient;
 	const events = yield* Service$16;
 	const findSession = SqlSchema.findOneOption({
@@ -2065,7 +2066,7 @@ const layer$23 = Layer.effect(Service$14, Effect.gen(function* () {
 		setLabel
 	});
 }));
-layer$23.pipe(Layer.provide(defaultLayer$1));
+layer$24.pipe(Layer.provide(defaultLayer$1));
 //#endregion
 //#region ../harness/src/context/errors.ts
 var ContextDecodeError = class extends Schema.TaggedError()("ContextDecodeError", {
@@ -2366,7 +2367,7 @@ const assemblePath = Effect.fn("Context.assemblePath")(function* (sessionId, pat
 //#endregion
 //#region ../harness/src/context/context.ts
 var Service$13 = class extends Context.Service()("@codeworksh/harness/context/context/Service") {};
-const layer$22 = Layer.effect(Service$13, Effect.gen(function* () {
+const layer$23 = Layer.effect(Service$13, Effect.gen(function* () {
 	const sessions = yield* Service$14;
 	const assemble = Effect.fn("Context.assemble")(function* (sessionId) {
 		const found = yield* sessions.get(sessionId);
@@ -2466,7 +2467,7 @@ const make$22 = (vfs) => {
 	};
 };
 /** The `SandboxFileSystem.Service` backed by the local {@link Vfs}. */
-const layer$21 = Layer.effect(filesystem_exports.SandboxFileSystem.Service, Effect.gen(function* () {
+const layer$22 = Layer.effect(filesystem_exports.SandboxFileSystem.Service, Effect.gen(function* () {
 	return filesystem_exports.SandboxFileSystem.fromProvider(make$22(yield* Vfs));
 }));
 //#endregion
@@ -2493,7 +2494,7 @@ var HostProvider = class extends RealFSProvider {
 * reason to keep relative paths above the mount, not below it — nothing here
 * resolves them, and nothing here should.
 */
-const layer$20 = () => {
+const layer$21 = () => {
 	const vfs = create(new HostProvider("/"), {
 		moduleHooks: false,
 		virtualCwd: true
@@ -2586,7 +2587,7 @@ const make$21 = (drivers) => Effect.gen(function* () {
 		encodeRuntimeConfig
 	});
 });
-const layer$19 = (...drivers) => Layer.effect(Registry, make$21(drivers));
+const layer$20 = (...drivers) => Layer.effect(Registry, make$21(drivers));
 //#endregion
 //#region ../harness/src/sandbox/shell/shell.ts
 var shell_exports = /* @__PURE__ */ __exportAll({});
@@ -2595,7 +2596,7 @@ __reExport(shell_exports, import__codeworksh_plugin_sandbox_shell);
 //#endregion
 //#region ../harness/src/sandbox/shell/host.ts
 const DEFAULT_SHELL = "sh";
-const layer$18 = (options = {}) => Layer.effect(shell_exports.Shell, Effect.gen(function* () {
+const layer$19 = (options = {}) => Layer.effect(shell_exports.Shell, Effect.gen(function* () {
 	const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
 	const run = (label, file, args, opts) => Effect.scoped(Effect.gen(function* () {
 		const handle = yield* spawner.spawn(ChildProcess.make(file, [...args], {
@@ -2686,7 +2687,7 @@ const make$20 = Effect.gen(function* () {
 //#endregion
 //#region ../harness/src/sandbox/control.ts
 var Controller = class extends Context.Service()("@codeworksh/harness/sandbox/control/Controller") {};
-const hostTransport = Layer.provide(Layer.merge(Layer.fresh(layer$21), layer$18()), layer$20());
+const hostTransport = Layer.provide(Layer.merge(Layer.fresh(layer$22), layer$19()), layer$21());
 const asDate = DateTime.toDateUtc;
 const optionalDate = Option.map(DateTime.toDateUtc);
 const MetadataJson = Schema.fromJsonString(Schema.Record(Schema.String, Schema.String));
@@ -3306,7 +3307,7 @@ const make$19 = Effect.fn("Sandbox.Controller.make")(function* (options) {
 		destroy
 	});
 });
-const layer$17 = (options) => Layer.effect(Controller, make$19(options));
+const layer$18 = (options) => Layer.effect(Controller, make$19(options));
 //#endregion
 //#region ../harness/src/sandbox/utils/seed.ts
 const copyDirectory = async (vfs, sourceDirectory, targetDirectory) => {
@@ -3562,7 +3563,7 @@ const transport$3 = (inner) => Layer.provideMerge(Layer.effect(shell_exports.She
 })), inner);
 //#endregion
 //#region ../harness/src/sandbox/virtual.ts
-const transportLayer = (primitives) => Layer.provideMerge(Layer.merge(Layer.fresh(layer$21), transport$3(primitives)), primitives);
+const transportLayer = (primitives) => Layer.provideMerge(Layer.merge(Layer.fresh(layer$22), transport$3(primitives)), primitives);
 /** A cwd-neutral FileSystem + just-bash transport over one retained VFS. */
 const transport$2 = (vfs) => {
 	const primitives = Layer.merge(Layer.succeed(Vfs, vfs), unsupported);
@@ -3669,7 +3670,7 @@ const make$15 = (location, options) => Effect.tryPromise({
 	})
 });
 const vfsLayer = (location, options) => Layer.effect(Vfs, Effect.acquireRelease(make$15(location, options), ({ provider }) => Effect.sync(() => provider.close())).pipe(Effect.map(({ vfs }) => vfs)));
-const layer$16 = (opts) => Layer.merge(vfsLayer(opts?.location, opts?.options), opts?.options?.hostProcess ? host : unsupported);
+const layer$17 = (opts) => Layer.merge(vfsLayer(opts?.location, opts?.options), opts?.options?.hostProcess ? host : unsupported);
 //#endregion
 //#region ../harness/src/sandbox/drivers/sqldb.ts
 const CreateConfig$2 = Schema.Struct({
@@ -3687,7 +3688,7 @@ const make$14 = () => {
 	const memory = /* @__PURE__ */ new Map();
 	const runtimeLocation = (input) => input.runtimeConfig.location ?? Option.getOrUndefined(input.providerResourceId);
 	const persistentTransport = (location) => {
-		const backend = layer$16({ location });
+		const backend = layer$17({ location });
 		return transportLayer(Layer.effectContext(Layer.build(backend).pipe(Effect.mapError((cause) => (0, errors_exports.providerError)({
 			driver: name,
 			operation: "attach",
@@ -4473,7 +4474,7 @@ var AppProcessError = class extends Schema.TaggedError()("AppProcessError", {
 	cause: Schema.optional(Schema.Defect())
 }) {};
 var Service$12 = class extends Context.Service()("@codeworksh/harness/git/git/Service") {};
-const layer$15 = Layer.effect(Service$12, Effect.gen(function* () {
+const layer$16 = Layer.effect(Service$12, Effect.gen(function* () {
 	const shell = yield* io_exports.SandboxIO.Shell;
 	const execute = (cwd) => (args, options) => shell.execArgv(["git", ...args], {
 		cwd,
@@ -4697,7 +4698,7 @@ function parts(host, name) {
 	if (!host || !pathname) return void 0;
 	return `${host}/${pathname}`.toLowerCase();
 }
-const layer$14 = Layer.effect(Service$11, Effect.gen(function* () {
+const layer$15 = Layer.effect(Service$11, Effect.gen(function* () {
 	const fs = yield* io_exports.SandboxIO.FileSystem;
 	const git = yield* Service$12;
 	const find = Effect.fn("Repo.find")(function* (input) {
@@ -4754,7 +4755,7 @@ var WorktreeError = class extends Schema.TaggedError()("Worktree.WorktreeError",
 	cause: Schema.optional(Schema.Defect())
 }) {};
 var Service$10 = class extends Context.Service()("@codeworksh/harness/worktree/worktree/Service") {};
-const layer$13 = Layer.effect(Service$10, Effect.gen(function* () {
+const layer$14 = Layer.effect(Service$10, Effect.gen(function* () {
 	const fs = yield* io_exports.SandboxIO.FileSystem;
 	const git = yield* Service$12;
 	const worktree = Effect.fnUntraced(function* (operation, cwd, args, directory) {
@@ -4809,7 +4810,7 @@ const provisional = (env, location) => schema_exports$5.ProjectSchema.ID.make(fa
 	location
 ])));
 var Service$9 = class extends Context.Service()("@codeworksh/harness/project/project/Service") {};
-const layer$12 = Layer.effect(Service$9, Effect.gen(function* () {
+const layer$13 = Layer.effect(Service$9, Effect.gen(function* () {
 	const sql = yield* SqlClient.SqlClient;
 	const fs = yield* io_exports.SandboxIO.FileSystem;
 	const repos = yield* Service$11;
@@ -4943,7 +4944,7 @@ const layer$12 = Layer.effect(Service$9, Effect.gen(function* () {
 }));
 //#endregion
 //#region ../harness/src/location/location.ts
-const layer$11 = (ref = {}) => Layer.effect(Service, Effect.gen(function* () {
+const layer$12 = (ref = {}) => Layer.effect(Service, Effect.gen(function* () {
 	const instance = yield* io_exports.SandboxIO.Current;
 	const directory = schema_exports$8.AbsolutePath.make(ref.directory ?? instance.cwd);
 	const resolved = yield* (yield* Service$9).resolveOrCreate(directory);
@@ -4958,7 +4959,7 @@ const layer$11 = (ref = {}) => Layer.effect(Service, Effect.gen(function* () {
 * folded in. What remains is exactly the mount and the database — for callers
 * that already hold both, such as the runner and `Session.create`.
 */
-const layerMounted = (ref = {}) => layer$11(ref).pipe(Layer.provide(layer$12.pipe(Layer.provide(Layer.mergeAll(layer$14, layer$13, layer$24)), Layer.provide(layer$15))));
+const layerMounted = (ref = {}) => layer$12(ref).pipe(Layer.provide(layer$13.pipe(Layer.provide(Layer.mergeAll(layer$15, layer$14, layer$25)), Layer.provide(layer$16))));
 //#endregion
 //#region ../harness/src/runner/run.ts
 var SandboxDirectoryNotFoundError = class extends Schema.TaggedError()("Runner.SandboxDirectoryNotFoundError", {
@@ -5292,7 +5293,7 @@ var PromptConflictError = class extends Schema.TaggedError()("PromptConflictErro
 	messageId: Schema.String
 }) {};
 var Service$5 = class extends Context.Service()("@codeworksh/harness/control/Service") {};
-const layer$10 = Layer.effect(Service$5, Effect.gen(function* () {
+const layer$11 = Layer.effect(Service$5, Effect.gen(function* () {
 	const sessions = yield* Service$14;
 	const inputs = yield* make$9;
 	const execution = yield* Service$6;
@@ -5400,7 +5401,7 @@ const flatten = Effect.fn("EventRegistry.flatten")(function* (plugins) {
 	}
 	return [...Definitions, ...definitions];
 });
-const layer$9 = (definitions = Definitions) => Layer.sync(Service$4, () => {
+const layer$10 = (definitions = Definitions) => Layer.sync(Service$4, () => {
 	let current = definitions;
 	let latest = schema_exports$6.EventSchema.latest(current);
 	const replace = Effect.fn("EventRegistry.replace")(function* (plugins) {
@@ -5417,2100 +5418,2211 @@ const layer$9 = (definitions = Definitions) => Layer.sync(Service$4, () => {
 	});
 });
 //#endregion
-//#region ../harness/src/settings/merge.ts
+//#region ../harness/src/model/catalog.ts
+const filename = "models.gen.json";
+/** How old the catalog may get before a check downloads a new one. */
+const ttlConfig = Config.Duration("CODEWORK_MODELS_TTL").pipe(Config.withDefault(Duration.minutes(15)));
+/** How often a server looks at the file. A look is a `stat`; only a stale file costs a download. */
+const checkEvery = Duration.minutes(1);
+var RefreshError = class extends Schema.TaggedError()("ModelCatalog.RefreshError", {
+	path: Schema.String,
+	detail: Schema.String
+}) {
+	get message() {
+		return `failed to refresh the model catalog at ${this.path}: ${this.detail}`;
+	}
+};
+/** Point aikit at `<home>/models.gen.json`, which `CODEWORK_MODELS_FILE` overrides. */
+const use = (home) => {
+	const own = hostPath.resolve(home, filename);
+	Model.configureCatalog(own);
+	const path = Model.catalogPath();
+	return {
+		path,
+		pinned: path !== own
+	};
+};
+const modified = (path) => fileSystem.stat(path).pipe(Effect.map((info) => Option.map(info.mtime, (date) => date.getTime())), Effect.orElseSucceed(() => Option.none()));
+const stale = Effect.fn("ModelCatalog.stale")(function* (path) {
+	const mtime = yield* modified(path);
+	if (Option.isNone(mtime)) return true;
+	const ttl = yield* ttlConfig;
+	return (yield* Clock.currentTimeMillis) - mtime.value >= Duration.toMillis(ttl);
+});
+const download$1 = (path) => Effect.tryPromise({
+	try: () => generateModels({ path }),
+	catch: (cause) => new RefreshError({
+		path,
+		detail: cause instanceof Error ? cause.message : String(cause)
+	})
+});
+/** Download a new catalog for the home when it is missing, older than the TTL, or `force` asks. */
+const refresh$1 = Effect.fn("ModelCatalog.refresh")(function* (home, options = {}) {
+	const { path } = use(home);
+	if (options.force !== true && !(yield* stale(path))) return {
+		path,
+		refreshed: false
+	};
+	yield* download$1(path);
+	return {
+		path,
+		refreshed: true
+	};
+});
 /**
-* A plain string-keyed record: what a settings patch merges, and what a plugin's `options` block
-* has to be. A Map, a typed array or a class instance is an object to `typeof` and not one of
-* these — `Object.freeze` alone does not tell them apart, and it throws on some of them.
+* The automatic check: refresh a stale catalog unless it is pinned, and never fail. A failed
+* download leaves the old file in place; a missing one surfaces later as a
+* `Runner.ModelCatalogError` from whatever needed it.
 */
-const isRecord$1 = (value) => Predicate.isObject(value) && !Array.isArray(value) && (Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null);
-const copy = (value) => {
-	if (Array.isArray(value)) return value.map(copy);
-	return isRecord$1(value) ? merge({}, value) : value;
+const check$1 = Effect.fn("ModelCatalog.check")(function* ({ path, pinned }) {
+	if (pinned || !(yield* stale(path))) return;
+	yield* download$1(path);
+});
+const quietly = (effect) => effect.pipe(Effect.asVoid, Effect.catch((error) => Effect.logWarning(`model catalog: ${error.message}`)));
+/** Check the home's catalog once, for a command that runs and exits; returns the file aikit reads. */
+const sync = Effect.fn("ModelCatalog.sync")(function* (home) {
+	const target = use(home);
+	yield* quietly(check$1(target));
+	return target.path;
+});
+/**
+* Check at boot, and with `watch`, keep checking for the life of the layer. A file whose mtime
+* moved -- refreshed here, by `codework models refresh`, or by hand -- is reloaded, so the
+* process never serves a catalog older than what is on disk.
+*/
+const layer$9 = (options) => Layer.effectDiscard(Effect.gen(function* () {
+	const target = use(options.home);
+	yield* quietly(check$1(target));
+	if (!options.watch) return;
+	const current = modified(target.path).pipe(Effect.map(Option.getOrUndefined));
+	const seen = yield* Ref.make(yield* current);
+	const tick = Effect.gen(function* () {
+		yield* quietly(check$1(target));
+		const mtime = yield* current;
+		if (mtime !== (yield* Ref.getAndSet(seen, mtime))) Model.reloadCatalog();
+	});
+	yield* Effect.forkScoped(tick.pipe(Effect.repeat(Schedule.spaced(checkEvery))));
+}));
+/** Translate aikit's catalog failure, or undefined for anything else. */
+const loadError = (cause) => {
+	if (typeof cause !== "object" || cause === null || !("name" in cause) || cause.name !== "ModelCatalogLoadError") return;
+	if (!("data" in cause) || typeof cause.data !== "object" || cause.data === null) return void 0;
+	const data = cause.data;
+	if (!("path" in data) || typeof data.path !== "string" || !("message" in data) || typeof data.message !== "string" || !("reason" in data) || data.reason !== "missing" && data.reason !== "unreadable" && data.reason !== "empty" && data.reason !== "invalid") return;
+	return new ModelCatalogError({
+		path: data.path,
+		reason: data.reason,
+		detail: data.message
+	});
 };
-/** Null/undefined properties are absent, objects merge, and arrays replace. Never mutates inputs. */
-function merge(base, ...patches) {
-	const result = /* @__PURE__ */ new Map();
-	for (const patch of [base, ...patches]) {
-		if (patch === void 0) continue;
-		for (const [key, value] of Object.entries(patch)) {
-			if (value === null || value === void 0) continue;
-			const previous = result.get(key);
-			result.set(key, isRecord$1(previous) && isRecord$1(value) ? merge(previous, value) : copy(value));
-		}
-	}
-	return Object.fromEntries(result);
-}
-/** Normalize nullable properties before schema validation, without changing array positions. */
-const normalize$1 = copy;
+const catalogError = (cause) => loadError(cause) ?? new ModelCatalogError({
+	path: Model.catalogPath(),
+	reason: "unreadable",
+	detail: cause instanceof Error ? cause.message : "failed to load the model catalog"
+});
+const models = Effect.tryPromise({
+	try: () => Model.getBuiltInModels(),
+	catch: catalogError
+});
+const providers = Effect.tryPromise({
+	try: () => Model.getProviders(),
+	catch: catalogError
+});
 //#endregion
-//#region ../harness/src/util/module.ts
-/*!
-* Adapted from OpenCode packages/util/src/runtime/import.node.ts.
-*
-* MIT License
-*
-* Copyright (c) 2025 opencode
-*
-* Permission is hereby granted, free of charge, to any person obtaining a copy
-* of this software and associated documentation files (the "Software"), to deal
-* in the Software without restriction, including without limitation the rights
-* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-* copies of the Software, and to permit persons to whom the Software is
-* furnished to do so, subject to the following conditions:
-*
-* The above copyright notice and this permission notice shall be included in all
-* copies or substantial portions of the Software.
-*
-* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-* AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-* SOFTWARE.
-*/
+//#region ../harness/src/plugin/plugin.ts
+var plugin_exports = /* @__PURE__ */ __exportAll({});
+import * as import__codeworksh_plugin_plugin from "@codeworksh/plugin/plugin";
+__reExport(plugin_exports, import__codeworksh_plugin_plugin);
+//#endregion
+//#region ../harness/src/plugin/builtin/prompt/default.ts
+/** The default coding-agent foundation, used unless `promptCustom` replaces it. */
+const foundation = `You are an expert coding assistant operating inside codework, a coding agent harness.`;
 /**
-* Packages a plugin must share with the harness instead of using the copy installed beside it.
-*
-* A plugin is installed into the store as its own npm tree, so `effect` and the plugin SDK land
-* there a second time. Two copies of the *same version* are still two module instances, and
-* Effect Schema's checks do not survive the crossing: a schema built by one copy and evaluated by
-* the other reports every check as failed, so a tool whose success type is `Schema.Finite` dies
-* on "Expected a finite number" for `22800`. Nothing about that is visible at registration --
-* `Schema.isSchema` passes, the JSON Schema is derived correctly, and the tool reaches the model
-* -- so it surfaces on the first call rather than at boot.
+* Guidelines that hold regardless of which tools are registered.
 *
-* Resolution is the right place to fix it. A symlink into the store cannot be: a generation is
-* immutable and shared by every project on the machine, while the harness doing the loading is
-* whichever one is running now, and two applications embedding the harness need not agree on
-* where their `effect` lives.
+* Kept short on purpose. Every line here is spent on every request, so a line
+* earns its place only if a model measurably behaves worse without it.
 */
-const sharedPackages = /* @__PURE__ */ new Set(["effect", "@codeworksh/plugin"]);
-/** The package a bare specifier names: `effect/Schema` -> `effect`, `@a/b/c` -> `@a/b`. */
-function packageOf(specifier) {
-	if (specifier.startsWith(".") || specifier.startsWith("/") || specifier.includes(":")) return "";
-	const segments = specifier.split("/");
-	return specifier.startsWith("@") ? segments.slice(0, 2).join("/") : segments[0] ?? "";
-}
+const standingGuidelines = [
+	"Be concise. Report what you did and what you found, not what you are about to do.",
+	"Quote exact paths and command output rather than paraphrasing them.",
+	"If a command fails, read the error before retrying."
+];
+/** Collapse whitespace so two spellings of one guideline dedupe against each other. */
+const normalize$1 = (value) => value.trim().replace(/\s+/g, " ");
 /**
-* Resolve the shared packages as though this module had imported them, for as long as `run`
-* takes. Anything else resolves exactly as it would have.
+* Tool-contributed guidelines followed by the standing ones, normalized and
+* deduplicated with first occurrence winning.
+*
+* Tool order is bucket order, which is the same order the index renders in and the
+* same order the provider receives definitions in -- one ordering, not three.
 */
-function withSharedModules(run) {
-	const hook = registerHooks({ resolve(specifier, context, nextResolve) {
-		return sharedPackages.has(packageOf(specifier)) ? nextResolve(specifier, {
-			...context,
-			parentURL: import.meta.url
-		}) : nextResolve(specifier, context);
-	} });
-	return run().finally(() => hook.deregister());
-}
-/** Use Node's main loader even when the caller runs inside a bundler or test VM. */
-async function importModule(specifier) {
-	const imported = await withSharedModules(() => new Script(`import(${JSON.stringify(specifier)})`, { importModuleDynamically: constants.USE_MAIN_CONTEXT_DEFAULT_LOADER }).runInThisContext());
-	if (typeof imported !== "object" || imported === null) return imported;
-	const module = imported;
-	const exports = module["module.exports"];
-	if (exports !== module.default || typeof exports !== "object" && typeof exports !== "function" || exports === null) return imported;
-	return Object.assign({}, module, exports);
-}
-/** Node resolution scoped synchronously to the caller. */
-function resolveModule(specifier, directory, conditions) {
-	const hook = registerHooks({ resolve(target, context, nextResolve) {
-		return nextResolve(target, {
-			...context,
-			parentURL: pathToFileURL(path.join(directory, "package.json")).href,
-			...conditions === void 0 ? {} : { conditions: [.../* @__PURE__ */ new Set([...context.conditions, ...conditions])] }
-		});
-	} });
-	try {
-		const resolve = (target) => {
-			const resolved = import.meta.resolve(path.isAbsolute(target) ? pathToFileURL(target).href : target);
-			if (resolved.startsWith("file:")) statSync(new URL(resolved));
-			return resolved;
-		};
-		try {
-			return resolve(specifier);
-		} catch (error) {
-			if (path.extname(specifier) || !missing(error)) throw error;
-			for (const extension of [
-				".ts",
-				".tsx",
-				".js",
-				".jsx",
-				".mts",
-				".mjs",
-				".cts",
-				".cjs"
-			]) try {
-				return resolve(specifier + extension);
-			} catch (cause) {
-				if (!missing(cause)) throw cause;
-			}
-			throw error;
-		}
-	} finally {
-		hook.deregister();
+const guidelines = (tools) => {
+	const seen = /* @__PURE__ */ new Set();
+	const collected = [];
+	for (const line of [...tools.flatMap((tool) => tool.promptGuidelines ?? []), ...standingGuidelines]) {
+		const normalized = normalize$1(line);
+		if (normalized.length === 0 || seen.has(normalized)) continue;
+		seen.add(normalized);
+		collected.push(normalized);
 	}
-}
-function missing(error) {
-	return error instanceof Error && "code" in error && [
-		"ENOENT",
-		"ENOTDIR",
-		"ERR_MODULE_NOT_FOUND"
-	].includes(String(error.code));
-}
-//#endregion
-//#region ../harness/src/plugin/error.ts
+	return collected;
+};
 /**
-* The reference as the person wrote it -- the string they will recognise in their settings file,
-* never the resolved path or the canonical spec. Every plugin failure carries one.
+* The rendered tool index.
+*
+* `(none)` rather than an omitted section: a model told it has no tools behaves
+* better than one left to infer it from silence.
 */
-const Reference = Schema.String;
+const toolIndex = (tools) => {
+	const listed = tools.filter((tool) => tool.promptSnippet !== void 0 && tool.promptSnippet.length > 0);
+	if (listed.length === 0) return "(none)";
+	return listed.map((tool) => `- ${tool.name}: ${tool.promptSnippet}`).join("\n");
+};
+const assemble = (input) => {
+	const sections = [input.promptCustom ?? foundation];
+	sections.push(`Available tools:\n${toolIndex(input.tools)}`);
+	const lines = guidelines(input.tools);
+	if (lines.length > 0) sections.push(`Guidelines:\n${lines.map((line) => `- ${line}`).join("\n")}`);
+	const append = input.promptSystemAppend?.trim();
+	if (append !== void 0 && append.length > 0) sections.push(append);
+	sections.push(`Current working directory: ${input.directory}`);
+	return sections.join("\n\n");
+};
 /**
-* The settings file that declared the entry, when one did.
-*
-* Absent for an embedder's own list and for anything the CLI was handed directly -- in both cases
-* the caller already knows where the string came from. It is the settings path that needs saying,
-* because several layers accumulate entries and "which file says this" is the question.
+* A caller slot, awaited lazily. A throw or rejection fails the snapshot, which the
+* host attributes to this plugin's id.
 */
-const File$1 = Schema.optional(Schema.String);
+const slot = (ctx, resolver) => Effect.tryPromise(() => Promise.resolve(resolver?.(ctx)));
+const defaultPromptPlugin = (0, plugin_exports.define)({
+	id: "codework.prompt.default",
+	kind: "prompt",
+	setup: Effect.fn("DefaultPromptPlugin.setup")(function* (ctx) {
+		const custom = yield* slot(ctx, ctx.config.promptCustom);
+		const append = yield* slot(ctx, ctx.config.promptSystemAppend);
+		ctx.plugin.prompt.set(assemble({
+			tools: ctx.plugin.tools.list(),
+			directory: ctx.location.directory,
+			...custom === void 0 ? {} : { promptCustom: custom },
+			...append === void 0 ? {} : { promptSystemAppend: append }
+		}));
+	})
+});
+//#endregion
+//#region ../harness/src/tool/truncate.ts
 /**
-* A spec that cannot be installed at all.
+* Shared truncation utilities for tool outputs.
 *
-* `plugin-not-found` is a local path with nothing at it; `plugin-not-installed` (the store's) is a
-* package spec with no entry. The first is a mistake in a settings file, the second is fixed by
-* `plugin install`, and keeping them apart is most of the value of having slugs.
-*/
-var SourceError = class extends Schema.TaggedError()("PluginSourceError", {
-	reason: Schema.Literals([
-		"plugin-unsupported-source",
-		"plugin-not-found",
-		"plugin-escapes-root"
-	]),
-	reference: Reference,
-	file: File$1,
-	message: Schema.String
-}) {};
-/** A spec that is installable, and whose install did not produce a usable package. */
-var InstallError = class extends Schema.TaggedError()("PluginInstallError", {
-	reason: Schema.Literals([
-		"plugin-resolve-failed",
-		"plugin-fetch-failed",
-		"plugin-no-commit",
-		"plugin-no-entrypoint"
-	]),
-	reference: Reference,
-	file: File$1,
-	message: Schema.String,
-	cause: Schema.optional(Schema.Defect())
-}) {};
-/**
-* A module that reached the import and did not come back as a plugin.
+* Truncation is based on two independent limits — whichever is hit first
+* wins: a line limit and a byte limit. Lines are never split (except the bash
+* tail edge case where a single line exceeds the byte limit).
 *
-* Distinct from {@link InstallError}: the bytes are here and are fine as *bytes*. What failed is
-* evaluating them, or what they turned out to export -- which is the distinction a caller acts on,
-* because one is fixed by installing and the other by editing code.
+* The bash tool uses {@link truncateTail} (keep the end — errors / final
+* results); file readers use {@link truncateHead} (keep the beginning).
 */
-var LoadError = class extends Schema.TaggedError()("PluginLoadError", {
-	reason: Schema.Literals([
-		"plugin-import-failed",
-		"plugin-missing-dependency",
-		"plugin-not-compiled",
-		"plugin-invalid-definition"
-	]),
-	reference: Reference,
-	file: File$1,
-	message: Schema.String,
-	/** The ID the module declared, when it got far enough to declare one. */
-	id: Schema.optional(Schema.String),
-	cause: Schema.optional(Schema.Defect())
-}) {};
-/** The store's own failures: what is filed, what is not, and what could not be claimed. */
-var StoreError = class extends Schema.TaggedError()("PluginStoreError", {
-	reason: Schema.Literals([
-		"plugin-not-installed",
-		"plugin-lock-timeout",
-		"plugin-marker-invalid",
-		"plugin-index-invalid",
-		"plugin-collect-failed"
-	]),
-	reference: Reference,
-	file: File$1,
-	message: Schema.String,
-	cause: Schema.optional(Schema.Defect())
-}) {};
+const DEFAULT_MAX_LINES = 2e3;
+const DEFAULT_MAX_BYTES = 51200;
+function splitLinesForCounting(content) {
+	if (content.length === 0) return [];
+	const lines = content.split("\n");
+	if (content.endsWith("\n")) lines.pop();
+	return lines;
+}
+/** Format bytes as a human-readable size. */
+function formatSize(bytes) {
+	if (bytes < 1024) return `${bytes}B`;
+	if (bytes < 1048576) return `${(bytes / 1024).toFixed(1)}KB`;
+	return `${(bytes / 1048576).toFixed(1)}MB`;
+}
 /**
-* Note which settings file declared the entry a failure came from.
-*
-* The store and the installer raise their own failures without knowing that, because neither is
-* told: they are handed a spec, not a settings layer. The loader knows, and this is where it says
-* so -- leaving an existing answer alone, since a more specific one is already better.
+* Truncate content from the tail (keep the last N lines/bytes). Suitable for
+* bash output where the end matters (errors, final results). May return a
+* partial first line if the last line of the original content exceeds the byte
+* limit.
 */
-const declaredIn = (error, file) => {
-	if (error.file !== void 0) return error;
-	const shared = {
-		reference: error.reference,
-		message: error.message,
-		file
+function truncateTail(content, options = {}) {
+	const maxLines = options.maxLines ?? 2e3;
+	const maxBytes = options.maxBytes ?? 51200;
+	const totalBytes = Buffer.byteLength(content, "utf-8");
+	const lines = splitLinesForCounting(content);
+	const totalLines = lines.length;
+	if (totalLines <= maxLines && totalBytes <= maxBytes) return {
+		content,
+		truncated: false,
+		truncatedBy: null,
+		totalLines,
+		totalBytes,
+		outputLines: totalLines,
+		outputBytes: totalBytes,
+		lastLinePartial: false,
+		firstLineExceedsLimit: false,
+		maxLines,
+		maxBytes
 	};
-	if (Schema.is(SourceError)(error)) return new SourceError({
-		...shared,
-		reason: error.reason
-	});
-	if (Schema.is(InstallError)(error)) return new InstallError({
-		...shared,
-		reason: error.reason,
-		cause: error.cause
-	});
-	if (Schema.is(LoadError)(error)) return new LoadError({
-		...shared,
-		reason: error.reason,
-		id: error.id,
-		cause: error.cause
-	});
-	if (Schema.is(StoreError)(error)) return new StoreError({
-		...shared,
-		reason: error.reason,
-		cause: error.cause
-	});
-	return error;
-};
-//#endregion
-//#region ../harness/src/util/path.ts
+	const outputLinesArr = [];
+	let outputBytesCount = 0;
+	let truncatedBy = "lines";
+	let lastLinePartial = false;
+	for (let i = lines.length - 1; i >= 0 && outputLinesArr.length < maxLines; i--) {
+		const line = lines[i] ?? "";
+		const lineBytes = Buffer.byteLength(line, "utf-8") + (outputLinesArr.length > 0 ? 1 : 0);
+		if (outputBytesCount + lineBytes > maxBytes) {
+			truncatedBy = "bytes";
+			if (outputLinesArr.length === 0) {
+				const truncatedLine = truncateStringToBytesFromEnd(line, maxBytes);
+				outputLinesArr.unshift(truncatedLine);
+				outputBytesCount = Buffer.byteLength(truncatedLine, "utf-8");
+				lastLinePartial = true;
+			}
+			break;
+		}
+		outputLinesArr.unshift(line);
+		outputBytesCount += lineBytes;
+	}
+	if (outputLinesArr.length >= maxLines && outputBytesCount <= maxBytes) truncatedBy = "lines";
+	const outputContent = outputLinesArr.join("\n");
+	const finalOutputBytes = Buffer.byteLength(outputContent, "utf-8");
+	return {
+		content: outputContent,
+		truncated: true,
+		truncatedBy,
+		totalLines,
+		totalBytes,
+		outputLines: outputLinesArr.length,
+		outputBytes: finalOutputBytes,
+		lastLinePartial,
+		firstLineExceedsLimit: false,
+		maxLines,
+		maxBytes
+	};
+}
 /**
-* A directory that crosses into the harness is absolute, and a relative one is a **defect** rather
-* than an error.
-*
-* A relative path is a disguised `process.cwd()` call: and every consumer
-* resolves it silently. `path.resolve("x")` anchors to the process directory, npm answers a
-* relative `cwd` with a `localPrefix` of whatever repository the process is inside (measured, not
-* assumed), and `Session.link` would write the *server's* directory into a field whose whole
-* purpose is to be a host path the client declared.
-*
-* For a long-running server the process directory is nobody's project, so the result is a
-* plausible answer to a question no one asked.
-* An absolute path is the one spelling none of them can quietly reinterpret.
-*
-* A defect rather than a typed error because nothing a user types reaches here. Every reference
-* goes through `parse`, and every directory comes from `Global.resolve`, a resolved `cwd` or a
-* session's `hostDir`, all of them already absolute. A relative one means a new call site got it
-* wrong, and a stack trace names that call site; a typed error would ask every caller to handle a
-* case none of them can cause.
+* Truncate a string to fit within a byte limit (from the end). Handles
+* multi-byte UTF-8 characters correctly (never splits a codepoint).
 */
-const rooted = (directory, role) => {
-	if (hostPath.isAbsolute(directory)) return directory;
-	throw new Error(`${role} must be an absolute path, got ${JSON.stringify(directory)}`);
-};
+function truncateStringToBytesFromEnd(str, maxBytes) {
+	const buf = Buffer.from(str, "utf-8");
+	if (buf.length <= maxBytes) return str;
+	let start = buf.length - maxBytes;
+	while (start < buf.length && (buf[start] & 192) === 128) start++;
+	return buf.subarray(start).toString("utf-8");
+}
 //#endregion
-//#region ../harness/src/plugin/npm.ts
-const Manifest$1 = Schema.Struct({ version: Schema.optional(Schema.String) });
-const Lockfile = Schema.Struct({ packages: Schema.optional(Schema.Record(Schema.String, Schema.Struct({ resolved: Schema.optional(Schema.String) }))) });
-/**
-* npm's flattened config: registry, scopes, auth, and cache paths.
-*
-* Built in one place, because two call sites deriving it separately is how the cache location
-* drifts between an install and the staleness check that is supposed to describe it.
-*
-* `dir` is where the `.npmrc` chain is read from, and it is the **host directory the caller
-* belongs to** -- never the staging directory and never the cache. A company repo keeps its
-* private registry and its scoped token in its own `.npmrc`, so a chain read anywhere else
-* resolves the plugin against the public registry and fails 404, or worse, installs a public
-* package of the same name. This is the registry half of auth; the git half is below.
-*
-* No `--prefix`. npm pins its local prefix to a `--prefix` on `argv` and stops walking, so
-* passing one would look up exactly `<dir>/.npmrc` and nothing above it -- wrong for a person
-* standing in `packages/x` whose token lives at the repository root. Without it npm walks up from
-* `cwd` to the nearest `package.json` or `node_modules` exactly as `npm` itself would if it were
-* run there, which is the only rule a user can predict.
-*
-* `--cache` is ours and is passed on `argv`, which outranks every `.npmrc`. npm's `flatten`
-* derives `_cacache`, `_npx` and `_tuf` from that one value, so naming the parent is enough --
-* and overriding `flat.cache` afterwards would redirect one of the three and leave `_tuf` pointing
-* at the user's home. `--home` exists to make a run self-contained; anything reached by an ambient
-* default is a test reading the developer's real machine.
-*
-* **Nothing here names an `env`.** npm hands git `opts.env` when one is present and falls back to
-* `{ ...gitDefaults, ...process.env }` when it is not, so leaving it out is what lets a git source
-* reach a private remote at all: `SSH_AUTH_SOCK` finds the agent, `HOME` finds the `~/.gitconfig`
-* that names the credential helper, and `PATH` finds `git`. Setting `env` to anything -- even to
-* a copy of `process.env` -- would be a standing invitation to prune it later and break private
-* git silently, months from the change. §15 Q2.
-*/
-const options = (dir, cache) => Effect.suspend(() => {
-	const root = rooted(dir, "the directory a plugin install reads its .npmrc chain from");
-	const store = rooted(cache, "the npm cache");
-	return npmOptions(root, store);
-});
-const npmOptions = (dir, cache) => Effect.gen(function* () {
-	const config = yield* Effect.tryPromise(async () => {
-		const { default: Config } = await import("./lib-CyynPpjH.mjs").then((m) => /* @__PURE__ */ __toESM(m.default, 1));
-		const { definitions, flatten, nerfDarts, shorthands } = (await import("./definitions-Dfwyyv_K.mjs").then((m) => /* @__PURE__ */ __toESM(m.default, 1))).default;
-		const created = new Config({
-			npmPath: fileURLToPath(new URL("..", import.meta.url)),
-			cwd: dir,
-			env: { ...process.env },
-			argv: [
-				process.execPath,
-				process.execPath,
-				"--cache",
-				hostPath.join(cache, "npm")
-			],
-			execPath: process.execPath,
-			platform: process.platform,
-			definitions,
-			flatten,
-			nerfDarts,
-			shorthands,
-			warn: false
+//#region ../harness/src/tool/accumulator.ts
+function defaultTempFilePath(prefix, suffix) {
+	return posix.join(tmpdir(), `${prefix}-${suffix}.log`);
+}
+function byteLength(text) {
+	return Buffer.byteLength(text, "utf-8");
+}
+var Accumulator = class {
+	maxLines;
+	maxBytes;
+	maxRollingBytes;
+	tempFilePrefix;
+	decoder = new TextDecoder();
+	rawChunks = [];
+	tailText = "";
+	tailBytes = 0;
+	tailStartsAtLineBoundary = true;
+	totalRawBytes = 0;
+	totalDecodedBytes = 0;
+	completedLines = 0;
+	totalLines = 0;
+	currentLineBytes = 0;
+	hasOpenLine = false;
+	finished = false;
+	tempFilePath;
+	tempFile;
+	constructor(options = {}) {
+		this.maxLines = options.maxLines ?? 2e3;
+		this.maxBytes = options.maxBytes ?? 51200;
+		this.maxRollingBytes = Math.max(this.maxBytes * 2, 1);
+		this.tempFilePrefix = options.tempFilePrefix ?? "codework-output";
+	}
+	append(data) {
+		return Effect.suspend(() => {
+			if (this.finished) return Effect.die(/* @__PURE__ */ new Error("cannot append to a finished output accumulator"));
+			this.totalRawBytes += data.length;
+			this.appendDecodedText(this.decoder.decode(data, { stream: true }));
+			if (this.tempFile !== void 0 || this.shouldUseTempFile()) return Effect.gen({ self: this }, function* () {
+				yield* this.ensureTempFile();
+				yield* this.tempFile.writeAll(data).pipe(Effect.orDie);
+			});
+			if (data.length > 0) this.rawChunks.push(data);
+			return Effect.void;
 		});
-		await created.load();
-		return created;
-	}).pipe(Effect.catch((cause) => Effect.logWarning(`cannot load npm configuration from ${dir}; npm defaults apply`, cause).pipe(Effect.as(void 0))));
-	if (config === void 0) return { allowGit: "root" };
-	for (const kind of [
-		"project",
-		"user",
-		"global"
-	]) {
-		const loaded = config.data.get(kind);
-		if (loaded?.loadError !== void 0 && loaded.loadError.code !== "ENOENT") yield* Effect.logWarning(`cannot read npm configuration ${loaded.source ?? `for ${kind}`}; npm defaults apply`, loaded.loadError);
 	}
-	return {
-		...config.flat,
-		allowGit: "root"
-	};
-});
-const PUBLIC_REGISTRY = "https://registry.npmjs.org/";
-/** Stable, credential-free registry identity used to address registry artifacts in the store. */
-const registry = Effect.fn("PluginNpm.registry")(function* (target, cache, from) {
-	const flat = yield* options(from, cache);
-	const scope = target.name.startsWith("@") ? target.name.slice(0, target.name.indexOf("/")) : void 0;
-	const configured = (scope === void 0 ? void 0 : flat[`${scope}:registry`]) ?? flat.registry ?? PUBLIC_REGISTRY;
-	if (typeof configured !== "string") return yield* new InstallError({
-		reason: "plugin-resolve-failed",
-		reference: target.spec,
-		message: `npm registry for ${target.name} is not a URL`
-	});
-	return yield* Effect.try({
-		try: () => {
-			const value = new URL(configured);
-			value.username = "";
-			value.password = "";
-			value.hash = "";
-			return value.href;
-		},
-		catch: (cause) => new InstallError({
-			reason: "plugin-resolve-failed",
-			reference: target.spec,
-			message: `npm registry for ${target.name} is not a valid URL: ${configured}`,
-			cause
-		})
-	});
-});
-/** A 40- or 64-hex commit out of the `resolved` URL arborist writes into the lockfile. */
-const commitIn = (resolved) => resolved?.match(/#([a-f0-9]{40}|[a-f0-9]{64})(?=::|$)/i)?.[1];
+	finish() {
+		return Effect.suspend(() => {
+			if (this.finished) return Effect.void;
+			this.finished = true;
+			this.appendDecodedText(this.decoder.decode());
+			return Effect.gen({ self: this }, function* () {
+				if (this.shouldUseTempFile()) yield* this.ensureTempFile();
+				if (this.tempFile !== void 0) yield* this.tempFile.sync.pipe(Effect.orDie);
+			});
+		});
+	}
+	snapshot() {
+		const tailTruncation = truncateTail(this.getSnapshotText(), {
+			maxLines: this.maxLines,
+			maxBytes: this.maxBytes
+		});
+		const truncated = this.totalLines > this.maxLines || this.totalDecodedBytes > this.maxBytes;
+		const truncatedBy = truncated ? tailTruncation.truncatedBy ?? (this.totalDecodedBytes > this.maxBytes ? "bytes" : "lines") : null;
+		const truncation = {
+			...tailTruncation,
+			truncated,
+			truncatedBy,
+			totalLines: this.totalLines,
+			totalBytes: this.totalDecodedBytes,
+			maxLines: this.maxLines,
+			maxBytes: this.maxBytes
+		};
+		return {
+			content: truncation.content,
+			truncation,
+			...this.tempFilePath === void 0 ? {} : { fullOutputPath: this.tempFilePath }
+		};
+	}
+	/** Bytes in the final (possibly unterminated) line — for the partial-line footer. */
+	getLastLineBytes() {
+		return this.currentLineBytes;
+	}
+	appendDecodedText(text) {
+		if (text.length === 0) return;
+		const bytes = byteLength(text);
+		this.totalDecodedBytes += bytes;
+		this.tailText += text;
+		this.tailBytes += bytes;
+		if (this.tailBytes > this.maxRollingBytes * 2) this.trimTail();
+		let newlines = 0;
+		let lastNewline = -1;
+		for (let i = text.indexOf("\n"); i !== -1; i = text.indexOf("\n", i + 1)) {
+			newlines++;
+			lastNewline = i;
+		}
+		if (newlines === 0) {
+			this.currentLineBytes += bytes;
+			this.hasOpenLine = true;
+		} else {
+			this.completedLines += newlines;
+			const tail = text.slice(lastNewline + 1);
+			this.currentLineBytes = byteLength(tail);
+			this.hasOpenLine = tail.length > 0;
+		}
+		this.totalLines = this.completedLines + (this.hasOpenLine ? 1 : 0);
+	}
+	trimTail() {
+		const buffer = Buffer.from(this.tailText, "utf-8");
+		if (buffer.length <= this.maxRollingBytes) {
+			this.tailBytes = buffer.length;
+			return;
+		}
+		let start = buffer.length - this.maxRollingBytes;
+		while (start < buffer.length && (buffer[start] & 192) === 128) start++;
+		this.tailStartsAtLineBoundary = start === 0 ? this.tailStartsAtLineBoundary : buffer[start - 1] === 10;
+		this.tailText = buffer.subarray(start).toString("utf-8");
+		this.tailBytes = byteLength(this.tailText);
+	}
+	getSnapshotText() {
+		if (this.tailStartsAtLineBoundary) return this.tailText;
+		const firstNewline = this.tailText.indexOf("\n");
+		return firstNewline === -1 ? this.tailText : this.tailText.slice(firstNewline + 1);
+	}
+	shouldUseTempFile() {
+		return this.totalRawBytes > this.maxBytes || this.totalDecodedBytes > this.maxBytes || this.totalLines > this.maxLines;
+	}
+	ensureTempFile() {
+		if (this.tempFile !== void 0) return Effect.void;
+		return Effect.gen({ self: this }, function* () {
+			const suffix = Encoding.encodeHex(yield* crypto.randomBytes(8));
+			this.tempFilePath = defaultTempFilePath(this.tempFilePrefix, suffix);
+			this.tempFile = yield* fileSystem.open(this.tempFilePath, { flag: "w" });
+			for (const chunk of this.rawChunks) yield* this.tempFile.writeAll(chunk);
+			this.rawChunks = [];
+		}).pipe(Effect.orDie);
+	}
+};
+//#endregion
+//#region ../harness/src/tool/progress.ts
+var progress_exports = /* @__PURE__ */ __exportAll({});
+import * as import__codeworksh_plugin_tool_progress from "@codeworksh/plugin/tool/progress";
+__reExport(progress_exports, import__codeworksh_plugin_tool_progress);
+//#endregion
+//#region ../harness/src/tool/shell.ts
 /**
-* The commit a git install actually landed on, read back from the lockfile arborist wrote.
+* `ToolShell` — the tool-owned, cancellable command-execution capability the bash tool depends on.
 *
-* Both spellings are tried because which one exists depends on whether the tree was saved.
+* It deliberately does **not** reuse `sandbox/Shell` directly: the local OS path
+* provides no `Shell` at all, and `sandbox/Shell` models neither cancellation
+* nor a timeout. `ToolShell` makes both part of the contract. Adapters honor the
+* mid-flight process kill where the SDK allows it (local, Vercel) and fall back
+* to the timeout where it does not (Daytona) — "kill where it's easy".
+*
+* Two modes, and Local has two variants:
+*   - Local / full OS shell  → {@link local} (default)
+*   - Local / just-bash      → {@link fromSandboxShell} over `EnvBash`
+*   - Remote / provider      → {@link fromSandboxShell} over `EnvDaytona` / `EnvVercel`
 */
-const commit = Effect.fn("PluginNpm.commit")(function* (root, name) {
-	for (const file of [hostPath.join(root, "package-lock.json"), hostPath.join(root, "node_modules", ".package-lock.json")]) {
-		const parsed = yield* fileSystem.readFileString(file).pipe(Effect.flatMap(Schema.decodeUnknownEffect(Schema.fromJsonString(Lockfile))), Effect.option);
-		if (Option.isNone(parsed)) continue;
-		const found = commitIn(parsed.value.packages?.[`node_modules/${name}`]?.resolved);
-		if (found !== void 0) return found;
-	}
-});
-/** Node error codes that mean "nothing here", as opposed to "this package is broken". */
-const notFound = /* @__PURE__ */ new Set([
-	"ENOENT",
-	"ENOTDIR",
-	"MODULE_NOT_FOUND",
-	"ERR_MODULE_NOT_FOUND",
-	"ERR_PACKAGE_PATH_NOT_EXPORTED",
-	"ERR_UNSUPPORTED_DIR_IMPORT"
-]);
+/** Infra/spawn failure — not model-actionable; handlers should treat it as a defect. */
+var ToolShellError = class extends Schema.TaggedError()("ToolShellError", {
+	command: Schema.String,
+	cause: Schema.optional(Schema.Defect())
+}) {};
+/** The command exceeded its deadline. Distinct so handlers can map it to a domain timeout. */
+var ToolShellTimeout = class extends Schema.TaggedError()("ToolShellTimeout", {
+	command: Schema.String,
+	timeoutMillis: Schema.Finite
+}) {};
+const widenExecError = (effect) => effect.pipe(Effect.mapError((error) => error));
+var ToolShell = class extends Context.Service()("@codeworksh/harness/tool/shell/ToolShell") {};
 /**
-* The module to import out of an installed package.
-*
-* Ordered subpaths through the package's own `exports`, so a package that publishes a dedicated
-* `./plugin` entry is honoured and one that does not falls back to its main.
+* Bridge the existing `sandbox/Shell` into a `ToolShell`. Used for just-bash
+* (in-process) and remote providers.
 *
-* Only "not found" is tolerated. Swallowing every error would turn a package that is broken --
-* a syntax error in its manifest, a permission problem -- into "no entrypoint", which is the
-* wrong diagnosis in the one place a person needs the right one.
+* `cwd` and `env` both pass through to the backing `sandbox/Shell`, which
+* resolves a relative `cwd` against its mount. The buffered `exec`
+* timeout is enforced here with `Effect.timeoutOption` (interruption always
+* returns control; the underlying command is only truly killed mid-flight on
+* signal-aware backends, handled in the provider layer). When the backend exposes
+* `stream` (e.g. Vercel `Command.logs`), it is bridged to {@link IToolShell.stream}
+* so the bash tool streams over it too.
 */
-const entrypoint = (directory, name) => Effect.gen(function* () {
-	for (const subpath of ["", "plugin"]) {
-		const specifier = name === void 0 ? hostPath.join(directory, subpath === "" ? "index" : subpath) : hostPath.join(name, subpath);
-		const resolved = yield* Effect.try(() => resolveModule(specifier, directory)).pipe(Effect.asSome, Effect.catchIf((error) => notFound.has(String(error.cause?.code)), () => Effect.succeed(Option.none())), Effect.mapError((error) => new InstallError({
-			reason: "plugin-no-entrypoint",
-			reference: name ?? directory,
-			message: `cannot resolve an entrypoint in ${directory}`,
-			cause: error
+const fromSandboxShell = Layer.effect(ToolShell, Effect.gen(function* () {
+	const shell = yield* shell_exports.Shell;
+	const exec = (command, options) => {
+		const run = shell.exec(command, {
+			...options?.env ? { env: options.env } : {},
+			...options?.cwd ? { cwd: options.cwd } : {}
+		}).pipe(Effect.mapError((cause) => new ToolShellError({
+			command,
+			cause
+		})));
+		if (options?.timeout === void 0) return widenExecError(run);
+		const timeout = options.timeout;
+		return run.pipe(Effect.timeoutOption(timeout), Effect.flatMap(Option.match({
+			onNone: () => Effect.fail(new ToolShellTimeout({
+				command,
+				timeoutMillis: Duration.toMillis(timeout)
+			})),
+			onSome: Effect.succeed
 		})));
-		if (Option.isSome(resolved)) return fileURLToPath(resolved.value);
-	}
-	return yield* new InstallError({
-		reason: "plugin-no-entrypoint",
-		reference: name ?? directory,
-		message: `no plugin entrypoint in ${directory}`
-	});
-});
-const reify = Effect.fn("PluginNpm.reify")(function* ({ target, into, cache, from }) {
-	const flat = yield* options(from, cache);
-	const { Arborist } = yield* Effect.promise(() => import("./lib-Dw7R2suc.mjs").then((m) => /* @__PURE__ */ __toESM(m.default, 1)));
-	const settings = {
-		...flat,
-		...target.mutable ? {
-			preferOnline: true,
-			noGitRevCache: true
-		} : {},
-		audit: false
 	};
-	const arborist = new Arborist({
-		...settings,
-		path: into,
-		binLinks: true,
-		progress: false,
-		savePrefix: "",
-		ignoreScripts: true
-	});
-	return yield* Effect.tryPromise({
-		try: () => arborist.reify({
-			...settings,
-			add: [target.spec],
-			update: target.mutable,
-			save: true,
-			saveType: "prod"
-		}),
-		catch: (cause) => new InstallError({
-			reason: "plugin-fetch-failed",
-			reference: target.spec,
-			message: `cannot install ${target.spec}`,
-			cause
-		})
-	});
-});
+	const sandboxStream = shell.stream;
+	const stream = sandboxStream ? (command, options) => sandboxStream(command, {
+		...options?.env ? { env: options.env } : {},
+		...options?.cwd ? { cwd: options.cwd } : {}
+	}).pipe(Stream.map((chunk) => chunk._tag === "exit" ? {
+		_tag: "Exit",
+		exitCode: chunk.exitCode
+	} : {
+		_tag: "Output",
+		bytes: chunk.bytes
+	}), Stream.mapError((cause) => new ToolShellError({
+		command,
+		cause
+	}))) : void 0;
+	return ToolShell.of(stream ? {
+		exec,
+		stream
+	} : { exec });
+}));
+Duration.seconds(1);
+//#endregion
+//#region ../harness/src/tool/tool.ts
+var tool_exports = /* @__PURE__ */ __exportAll({});
+import * as import__codeworksh_plugin_tool from "@codeworksh/plugin/tool";
+__reExport(tool_exports, import__codeworksh_plugin_tool);
+//#endregion
+//#region ../harness/src/plugin/builtin/tool/bash.ts
 /**
-* Fill `into` with the package `target` names, and report what landed there.
+* The self-contained bash plugin — a worked example for tool plugins. The definition is pure data;
+* the handler depends only on {@link ToolShell} / {@link ToolProgress}, never
+* `sandbox/Shell`, so the backend (local OS / just-bash / remote provider) is
+* swapped by changing the provided Layer with no change to the tool.
 *
-* A local target downloads nothing: the files on disk are already the answer, and a local plugin
-* is never copied into the store.
+* Two execution paths, picked by capability:
+*   - **variant A (buffered)** otherwise: `ToolShell.exec` returns the full output,
+*     truncated once after completion.
+*   - **variant B (streaming)** when the backend offers `ToolShell.stream`: output
+*     flows through an {@link Accumulator} (bounded memory + temp-file spill)
+*     and is reported live via {@link ToolProgress}; on timeout the partial output
+*     produced so far is preserved.
+*
+* Success and failure carry the *same* structured shape
+* (`output`, `exitCode`, `truncated`, `fullOutputPath`)
+* — a non-zero exit is just `exitCode !== 0`, not a different kind of result.
 */
-const download = Effect.fn("PluginNpm.download")(function* (input) {
-	const { target, into, cache, from, runner = reify } = input;
-	if (target.kind === "local") return {
-		directory: target.path,
-		name: hostPath.basename(target.path),
-		entrypoint: yield* entrypoint(target.path)
+const BashParams = Schema.Struct({
+	command: Schema.String.annotate({ description: "The bash command to execute." }),
+	timeout: Schema.optional(Schema.Finite.check(Schema.isGreaterThan(0)).annotate({ description: "Optional timeout in seconds (must be greater than 0)." }))
+});
+const outputFields = {
+	/** Combined stdout + stderr, truncated for display (full output is on disk when `truncated`). */
+	output: Schema.String,
+	truncated: Schema.Boolean,
+	fullOutputPath: Schema.optional(Schema.String)
+};
+const BashSuccess = Schema.Struct({
+	...outputFields,
+	exitCode: Schema.Finite
+});
+/** Non-zero exit — expected, model-visible. Carries the same shape as success. */
+var BashFailed = class extends Schema.TaggedError()("BashFailed", {
+	...outputFields,
+	exitCode: Schema.Finite
+}) {};
+/** Deadline exceeded — expected, model-visible. Carries the partial output produced so far. */
+var BashTimedOut = class extends Schema.TaggedError()("BashTimedOut", {
+	...outputFields,
+	timeoutSeconds: Schema.Finite
+}) {};
+const BashFailure = Schema.Union([BashFailed, BashTimedOut]);
+const bashDef = tool_exports.define({
+	name: "bash",
+	label: "bash",
+	promptSnippet: "Execute bash commands (ls, grep, find, etc.).",
+	description: `Execute a bash command in the working directory and return its combined stdout/stderr output. Output is truncated to the last ${DEFAULT_MAX_LINES} lines or ${DEFAULT_MAX_BYTES}KB (whichever is hit first); when truncated, the full output is saved to a temp file. A non-zero exit code is reported as an error carrying the captured output.`,
+	parameters: BashParams,
+	success: BashSuccess,
+	failure: BashFailure,
+	encodeContent: (success) => [{
+		type: "text",
+		text: success.output
+	}],
+	encodeFailureContent: (failure) => [{
+		type: "text",
+		text: failure.output
+	}]
+});
+/** Combine stdout and stderr into one stream of text, stderr after stdout. */
+const combineOutput = (stdout, stderr) => {
+	if (stderr.length === 0) return stdout;
+	if (stdout.length === 0) return stderr;
+	return `${stdout}\n${stderr}`;
+};
+/** One-line footer appended to truncated, model-facing output. */
+const footer = (t, fullOutputPath, lastLineBytes) => {
+	const where = fullOutputPath ? ` Full output: ${fullOutputPath}` : "";
+	const startLine = t.totalLines - t.outputLines + 1;
+	if (t.lastLinePartial) {
+		const lineSize = lastLineBytes !== void 0 ? ` (line is ${formatSize(lastLineBytes)})` : "";
+		return `\n\n[showing last ${formatSize(t.outputBytes)} of line ${t.totalLines}${lineSize}.${where}]`;
+	}
+	if (t.truncatedBy === "lines") return `\n\n[showing lines ${startLine}-${t.totalLines} of ${t.totalLines}.${where}]`;
+	return `\n\n[showing lines ${startLine}-${t.totalLines} of ${t.totalLines} (${formatSize(t.maxBytes)} limit).${where}]`;
+};
+/** Write full output to a host temp file (best-effort; undefined on failure). */
+const spillToTempFile = (content) => Effect.gen(function* () {
+	const suffix = Encoding.encodeHex(yield* crypto.randomBytes(6));
+	const path = posix.join(tmpdir(), `codework-bash-${suffix}.log`);
+	yield* fileSystem.writeFileString(path, content);
+	return path;
+}).pipe(Effect.orElseSucceed(() => void 0));
+/** Variant A: truncate the buffered output once, spilling the full output if truncated. */
+const presentBuffered = (combined) => Effect.gen(function* () {
+	const t = truncateTail(combined);
+	if (!t.truncated) return {
+		output: t.content,
+		truncated: false
 	};
-	const root = yield* fileSystem.realPath(into).pipe(Effect.mapError((cause) => new InstallError({
-		reason: "plugin-fetch-failed",
-		reference: target.spec,
-		message: `cannot resolve the staging directory ${into}`,
-		cause
-	})));
-	const node = (yield* runner({
-		target,
-		into: root,
-		cache,
-		from
-	})).edgesOut.values().next().value?.to;
-	if (node === void 0) return yield* new InstallError({
-		reason: "plugin-fetch-failed",
-		reference: target.spec,
-		message: `${target.spec} installed nothing`
-	});
-	const manifest = yield* fileSystem.readFileString(hostPath.join(node.path, "package.json")).pipe(Effect.flatMap(Schema.decodeUnknownEffect(Schema.fromJsonString(Manifest$1))), Effect.option);
-	const version = Option.isNone(manifest) ? void 0 : manifest.value.version;
-	const revision = target.kind === "registry" ? version : (yield* commit(root, node.name)) ?? (yield* noCommit(target.spec));
+	const fullOutputPath = yield* spillToTempFile(combined);
 	return {
-		directory: node.path,
-		name: node.name,
-		...version === void 0 ? {} : { version },
-		...revision === void 0 ? {} : { revision },
-		entrypoint: yield* entrypoint(node.path, node.name)
+		output: t.content + footer(t, fullOutputPath),
+		truncated: true,
+		...fullOutputPath !== void 0 ? { fullOutputPath } : {}
 	};
 });
-const noCommit = (spec) => new InstallError({
-	reason: "plugin-no-commit",
-	reference: spec,
-	message: `cannot resolve a commit for ${spec}`
-});
-/**
-* What a mutable target points at right now, without installing it.
-*
-* `preferOnline` and `noGitRevCache` are the whole point: without them pacote answers from its own
-* metadata cache, and a staleness check that reads a cache is not a staleness check. An immutable
-* target skips the call entirely -- a version and a SHA cannot move.
-*/
-const probe = Effect.fn("PluginNpm.probe")(function* (target, cache, from) {
-	if (target.kind === "local" || !target.mutable) return void 0;
-	const opts = {
-		...yield* options(from, cache),
-		preferOnline: true,
-		noGitRevCache: true,
-		_isRoot: true
+/** Variant B: present an accumulator snapshot (the temp file is spilled incrementally). */
+const presentSnapshot = (snap, lastLineBytes) => {
+	if (!snap.truncation.truncated) return {
+		output: snap.content,
+		truncated: false
+	};
+	return {
+		output: snap.content + footer(snap.truncation, snap.fullOutputPath, lastLineBytes),
+		truncated: true,
+		...snap.fullOutputPath !== void 0 ? { fullOutputPath: snap.fullOutputPath } : {}
 	};
-	const { default: pacote } = yield* Effect.promise(() => import("./lib-BkWR53Bz.mjs").then((n) => /* @__PURE__ */ __toESM(n.t(), 1)));
-	return yield* Effect.tryPromise({
-		try: async () => target.kind === "registry" ? (await pacote.manifest(target.spec, opts)).version : commitIn(await pacote.resolve(target.spec, opts)),
-		catch: (cause) => new InstallError({
-			reason: "plugin-resolve-failed",
-			reference: target.spec,
-			message: `cannot reach ${target.spec}`,
-			cause
-		})
-	});
-});
-/** A `file:` URL for an entrypoint, which is what the module loader takes. */
-const url = (entrypoint) => pathToFileURL(entrypoint).href;
-//#endregion
-//#region ../harness/src/plugin/plugin.ts
-var plugin_exports = /* @__PURE__ */ __exportAll({});
-import * as import__codeworksh_plugin_plugin from "@codeworksh/plugin/plugin";
-__reExport(plugin_exports, import__codeworksh_plugin_plugin);
-//#endregion
-//#region ../harness/src/plugin/source.ts
-/** A committish that names one artifact rather than a moving branch: an unabbreviated SHA. */
-const isCommit = (committish) => typeof committish === "string" && /^[a-f0-9]{40}$|^[a-f0-9]{64}$/i.test(committish);
-/**
-* A short, readable name for a git source, used to make a store path recognisable to a human
-* reading `ls`. It is never an identity: two remotes can slug alike, and the digest is what
-* separates them.
-*/
-const slug = (spec) => {
-	const withoutCommittish = spec.split("#")[0] ?? spec;
-	return (() => {
-		try {
-			return decodeURIComponent(withoutCommittish);
-		} catch {
-			return withoutCommittish;
-		}
-	})().replace(/\.git$/i, "").split(/[/:\\]/).at(-1)?.replace(/[^a-zA-Z0-9._-]+/g, "-").replace(/^-+|-+$/g, "") || "repository";
 };
-/** Whether a reference names a place on disk rather than something to fetch. */
-const isPath = (reference) => reference.startsWith("file:") || reference.startsWith("./") || reference.startsWith("../") || hostPath.isAbsolute(reference);
-/**
-* `from` is the directory a relative spec resolves against, and the caller picks it:
-*
-* - a **plugin entry** anchors to the directory holding the file that declared it --
-*   `<root>/.codework/` for a project entry, `<home>/` for a user one, the named directory for
-*   `--user-config-dir`. The rule is about the file, not the project.
-* - a **CLI argument** anchors to the process's startup directory, because that is where the
-*   person typed it.
-*/
-const parse$2 = (reference, from) => Effect.gen(function* () {
-	const fail = (reason, message) => new SourceError({
-		reason,
-		reference,
-		message
+/** Variant A — buffered: one `exec`, truncate after completion. No live progress. */
+const runBuffered = (shell, params) => Effect.gen(function* () {
+	const result = yield* shell.exec(params.command, params.timeout !== void 0 ? { timeout: Duration.seconds(params.timeout) } : void 0).pipe(Effect.catchTags({
+		ToolShellTimeout: (timeout) => Effect.fail(new BashTimedOut({
+			timeoutSeconds: timeout.timeoutMillis / 1e3,
+			output: "",
+			truncated: false
+		})),
+		ToolShellError: (cause) => Effect.die(cause)
+	}));
+	const present = yield* presentBuffered(combineOutput(result.stdout, result.stderr));
+	if (result.exitCode !== 0) return yield* new BashFailed({
+		exitCode: result.exitCode,
+		...present
 	});
-	rooted(from, "the directory a plugin reference anchors to");
-	if (reference.startsWith("file:")) {
-		if (!reference.startsWith("file:///")) return yield* fail("plugin-unsupported-source", `not an absolute file URL: ${reference}`);
-		return {
-			kind: "local",
-			path: fileURLToPath(reference)
-		};
-	}
-	const expanded = expandTilde(reference, hostPath);
-	if (isPath(expanded)) return {
-		kind: "local",
-		path: hostPath.resolve(from, expanded)
+	return {
+		exitCode: result.exitCode,
+		...present
 	};
-	const parsed = yield* Effect.try({
-		try: () => npa(reference),
-		catch: () => fail("plugin-unsupported-source", `cannot parse plugin source: ${reference}`)
-	});
-	if (parsed.type === "git") {
-		const { gitSubdir } = parsed;
-		return {
-			kind: "git",
-			slug: slug(reference),
-			spec: reference,
-			...parsed.gitCommittish == null ? {} : { committish: parsed.gitCommittish },
-			...gitSubdir == null ? {} : { subdir: gitSubdir },
-			mutable: !isCommit(parsed.gitCommittish)
-		};
-	}
-	if (parsed.name !== null && [
-		"version",
-		"range",
-		"tag"
-	].includes(parsed.type)) {
-		const omitted = parsed.raw === parsed.name || parsed.raw === `${parsed.name}@`;
-		return {
-			kind: "registry",
-			name: parsed.name,
-			spec: `${parsed.name}@${omitted ? "latest" : parsed.rawSpec}`,
-			mutable: parsed.type !== "version"
-		};
-	}
-	return yield* fail("plugin-unsupported-source", `unsupported plugin source: ${reference}`);
-});
-/**
-* What two references must share to be the same plugin, without installing either.
-*
-* A local path is the file it resolves to; a package is its name, so `@acme/x@1` and `@acme/x@2`
-* are one package at two versions. Pure -- nothing is installed, imported or read.
-*/
-const canonical$1 = (target) => {
-	switch (target.kind) {
-		case "local": return target.path;
-		case "registry": return target.name;
-		case "git": return target.spec;
-	}
-};
-//#endregion
-//#region ../harness/src/plugin/index.store.ts
-const Record_ = Schema.Struct({
-	spec: Schema.String,
-	source: Schema.Literals(["registry", "git"]),
-	name: Schema.String,
-	slug: Schema.String,
-	mutable: Schema.Boolean,
-	generation: Schema.Finite,
-	version: Schema.optional(Schema.String),
-	revision: Schema.optional(Schema.String),
-	entrypoint: Schema.String,
-	installedAt: Schema.Finite,
-	checkedAt: Schema.optional(Schema.Finite),
-	outdated: Schema.optional(Schema.Boolean),
-	/** The remote revision observed at `checkedAt`; distinct from the installed `revision`. */
-	available: Schema.optional(Schema.String)
-});
-const File = Schema.Struct({
-	version: Schema.Finite,
-	entries: Schema.Record(Schema.String, Record_)
-});
-const VERSION = 1;
-const NAME = "index.json";
-/**
-* Read the whole file, or start empty.
-*
-* An unreadable or unparseable index is not an error: it is a cold cache. Failing here would make
-* a corrupt accelerator break installs that do not need it.
-*/
-const read = Effect.fn("PluginIndex.read")(function* (root) {
-	const parsed = yield* fileSystem.readFileString(hostPath.join(root, NAME)).pipe(Effect.flatMap(Schema.decodeUnknownEffect(Schema.fromJsonString(File))), Effect.option);
-	if (Option.isNone(parsed) || parsed.value.version !== VERSION) return /* @__PURE__ */ new Map();
-	return new Map(Object.entries(parsed.value.entries));
 });
-/** Temp file plus rename, so a reader never sees a half-written index. */
-const write = Effect.fn("PluginIndex.write")(function* (root, entries) {
-	const encoded = yield* Schema.encodeEffect(Schema.fromJsonString(File))({
-		version: VERSION,
-		entries: Object.fromEntries(entries)
+/** Variant B — streaming: accumulate output, report progress, keep partial output on timeout. */
+const runStreaming = (stream, params) => Effect.scoped(Effect.gen(function* () {
+	const acc = new Accumulator({ tempFilePrefix: "codework-bash" });
+	const progress = yield* progress_exports.ToolProgress;
+	const exitCode = yield* Ref.make(null);
+	const consume = stream(params.command).pipe(Stream.runForEach((event) => event._tag === "Exit" ? Ref.set(exitCode, event.exitCode) : Effect.gen(function* () {
+		yield* acc.append(Buffer.from(event.bytes));
+		yield* progress.report({ content: [{
+			type: "text",
+			text: acc.snapshot().content
+		}] });
+	})), Effect.catchTag("ToolShellError", (cause) => Effect.die(cause)));
+	let timedOutAfter;
+	if (params.timeout !== void 0) {
+		const finished = yield* consume.pipe(Effect.timeoutOption(Duration.seconds(params.timeout)));
+		if (Option.isNone(finished)) timedOutAfter = params.timeout;
+	} else yield* consume;
+	yield* acc.finish();
+	const present = presentSnapshot(acc.snapshot(), acc.getLastLineBytes());
+	if (timedOutAfter !== void 0) return yield* new BashTimedOut({
+		timeoutSeconds: timedOutAfter,
+		...present
 	});
-	yield* fileSystem.makeDirectory(root, { recursive: true });
-	const temporary = yield* fileSystem.makeTempFile({
-		directory: root,
-		prefix: `.${NAME}.`,
-		suffix: ".tmp"
+	const code = yield* Ref.get(exitCode);
+	if (code === null || code !== 0) return yield* new BashFailed({
+		exitCode: code ?? -1,
+		...present
 	});
-	yield* fileSystem.writeFileString(temporary, encoded).pipe(Effect.andThen(fileSystem.rename(temporary, hostPath.join(root, NAME))), Effect.ensuring(fileSystem.remove(temporary, { force: true }).pipe(Effect.ignore)));
+	return {
+		exitCode: code,
+		...present
+	};
+}));
+const bashHandler = (params) => Effect.gen(function* () {
+	const shell = yield* ToolShell;
+	return shell.stream !== void 0 ? yield* runStreaming(shell.stream, params) : yield* runBuffered(shell, params);
 });
-/**
-* Record one entry, keeping whatever else the file holds.
-*
-* Ignores its own failures. A store that cannot write its accelerator still works; refusing the
-* install would be the accelerator deciding whether the install counted.
-*/
-const put = Effect.fn("PluginIndex.put")(function* (root, digest, record) {
-	const entries = yield* read(root);
-	entries.set(digest, record);
-	yield* write(root, entries).pipe(Effect.ignore);
+/** The bash tool: definition + handler, wired the testable (def/exec split) way. */
+const bashTool = tool_exports.implement(bashDef, bashHandler);
+const bashPlugin = (0, plugin_exports.define)({
+	id: "codework.tool.bash",
+	kind: "tool",
+	setup: Effect.fn("BashPlugin.setup")(function* (ctx) {
+		const shell = yield* io_exports.SandboxIO.Shell;
+		const mounted = fromSandboxShell.pipe(Layer.provide(Layer.succeed(io_exports.SandboxIO.Shell, shell)));
+		ctx.plugin.tools.add(tool_exports.provide(bashTool, mounted));
+	})
 });
+//#endregion
+//#region ../harness/src/plugin/builtin.ts
 /**
-* Merge fields into one record, if it is there.
-*
-* Unlocked, like every write here but the one that publishes a generation. Two processes checking
-* at once both read the whole file and both rewrite it, so one update is lost and a record added
-* in between can vanish -- and neither matters, because a lost `checkedAt` costs one network call
-* and a vanished record is a miss a scan repairs.
+* Every plugin the harness ships, and the selection a caller who passes no `plugins` gets. Tool
+* contributors come first so the Prompt plugin that indexes them runs after they registered.
 */
-const patch = Effect.fn("PluginIndex.patch")(function* (root, digest, fields) {
-	const entries = yield* read(root);
-	const existing = entries.get(digest);
-	if (existing === void 0) return;
-	entries.set(digest, {
-		...existing,
-		...fields
-	});
-	yield* write(root, entries).pipe(Effect.ignore);
-});
-/** Forget one entry, for a store entry that has been removed. */
-const drop = Effect.fn("PluginIndex.drop")(function* (root, digest) {
-	const entries = yield* read(root);
-	if (!entries.delete(digest)) return;
-	yield* write(root, entries).pipe(Effect.ignore);
-});
+const builtins = Object.freeze([bashPlugin, defaultPromptPlugin]);
 //#endregion
-//#region ../harness/src/plugin/lock.ts
-/** How long to wait for another holder before giving up. */
-const TIMEOUT = Duration.minutes(2);
-/** The holder refreshes the lock's mtime this often; one not refreshed for the timeout is stale. */
-const HEARTBEAT = Duration.seconds(15);
-const abandoned = (directory) => Effect.gen(function* () {
-	const info = yield* fileSystem.stat(directory);
-	const now = yield* Effect.clockWith((clock) => clock.currentTimeMillis);
-	return Option.exists(info.mtime, (mtime) => now - mtime.getTime() > Duration.toMillis(TIMEOUT));
-}).pipe(Effect.orElseSucceed(() => false));
-const heartbeat = (directory) => Effect.clockWith((clock) => clock.currentTimeMillis).pipe(Effect.flatMap((now) => fileSystem.utimes(directory, now, now)), Effect.ignore, Effect.repeat(Schedule.spaced(HEARTBEAT)));
+//#region ../harness/src/settings/merge.ts
 /**
-* Claims `directory` by creating it, polling while another process holds it, and releasing it when
-* the surrounding scope closes.
+* A plain string-keyed record: what a settings patch merges, and what a plugin's `options` block
+* has to be. A Map, a typed array or a class instance is an object to `typeof` and not one of
+* these — `Object.freeze` alone does not tell them apart, and it throws on some of them.
+*/
+const isRecord$1 = (value) => Predicate.isObject(value) && !Array.isArray(value) && (Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null);
+const copy = (value) => {
+	if (Array.isArray(value)) return value.map(copy);
+	return isRecord$1(value) ? merge({}, value) : value;
+};
+/** Null/undefined properties are absent, objects merge, and arrays replace. Never mutates inputs. */
+function merge(base, ...patches) {
+	const result = /* @__PURE__ */ new Map();
+	for (const patch of [base, ...patches]) {
+		if (patch === void 0) continue;
+		for (const [key, value] of Object.entries(patch)) {
+			if (value === null || value === void 0) continue;
+			const previous = result.get(key);
+			result.set(key, isRecord$1(previous) && isRecord$1(value) ? merge(previous, value) : copy(value));
+		}
+	}
+	return Object.fromEntries(result);
+}
+/** Normalize nullable properties before schema validation, without changing array positions. */
+const normalize = copy;
+//#endregion
+//#region ../harness/src/util/module.ts
+/*!
+* Adapted from OpenCode packages/util/src/runtime/import.node.ts.
 *
-* One finalizer is registered for the whole wait rather than one per 50ms poll, and a single
-* attempt is `uninterruptible` so `mkdir` and recording ownership cannot be split -- an interrupt
-* between them would leave behind a lock the finalizer does not know to remove.
+* MIT License
 *
-* `onTimeout` names the failure, because what a caller is waiting for is the caller's to describe.
+* Copyright (c) 2025 opencode
+*
+* Permission is hereby granted, free of charge, to any person obtaining a copy
+* of this software and associated documentation files (the "Software"), to deal
+* in the Software without restriction, including without limitation the rights
+* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+* copies of the Software, and to permit persons to whom the Software is
+* furnished to do so, subject to the following conditions:
+*
+* The above copyright notice and this permission notice shall be included in all
+* copies or substantial portions of the Software.
+*
+* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+* AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+* SOFTWARE.
 */
-const lock = Effect.fn("PluginLock.acquire")(function* (directory, onTimeout) {
-	const held = yield* Ref.make(false);
-	yield* Effect.acquireRelease(Effect.void, () => Ref.get(held).pipe(Effect.flatMap((owned) => owned ? fileSystem.remove(directory, {
-		recursive: true,
-		force: true
-	}) : Effect.void), Effect.orDie));
-	if (!(yield* fileSystem.makeDirectory(directory).pipe(Effect.andThen(Ref.set(held, true)), Effect.as(true), Effect.catchIf((error) => error.reason._tag === "AlreadyExists", () => abandoned(directory).pipe(Effect.flatMap((stale) => stale ? fileSystem.remove(directory, {
-		recursive: true,
-		force: true
-	}).pipe(Effect.as(false)) : Effect.succeed(false)))), Effect.uninterruptible).pipe(Effect.repeat({
-		schedule: Schedule.spaced("50 millis"),
-		until: (owned) => owned
-	}), Effect.timeoutOrElse({
-		duration: TIMEOUT,
-		orElse: () => Effect.succeed(false)
-	})))) return yield* Effect.fail(onTimeout());
-	yield* Effect.forkScoped(heartbeat(directory));
-});
-//#endregion
-//#region ../harness/src/plugin/store.ts
-/** Facts about the *package*, and nothing about the plugin inside it. */
-const Marker = Schema.Struct({
-	spec: Schema.String,
-	name: Schema.String,
-	version: Schema.optional(Schema.String),
-	revision: Schema.optional(Schema.String),
-	/** Relative to the generation directory, so the marker survives the publishing rename. */
-	entrypoint: Schema.String,
-	createdAt: Schema.Finite
-});
-const MARKER = ".complete.json";
-const STAGING = ".staging-";
-const root = (cache) => hostPath.join(cache, "plugins", "v2");
 /**
-* A readable label, never an identity: two specs that slug alike share a parent directory and
-* nothing more. Worth having because a greppable path is worth real money when debugging, and a
-* bare hash throws away every clue.
+* Packages a plugin must share with the harness instead of using the copy installed beside it.
+*
+* A plugin is installed into the store as its own npm tree, so `effect` and the plugin SDK land
+* there a second time. Two copies of the *same version* are still two module instances, and
+* Effect Schema's checks do not survive the crossing: a schema built by one copy and evaluated by
+* the other reports every check as failed, so a tool whose success type is `Schema.Finite` dies
+* on "Expected a finite number" for `22800`. Nothing about that is visible at registration --
+* `Schema.isSchema` passes, the JSON Schema is derived correctly, and the tool reaches the model
+* -- so it surfaces on the first call rather than at boot.
+*
+* Resolution is the right place to fix it. A symlink into the store cannot be: a generation is
+* immutable and shared by every project on the machine, while the harness doing the loading is
+* whichever one is running now, and two applications embedding the harness need not agree on
+* where their `effect` lives.
 */
-const slugOf = (target) => target.kind === "git" ? target.slug : canonical$1(target).replace(/^@/, "").replace(/[^a-zA-Z0-9._-]+/g, "-").replace(/^-+|-+$/g, "") || "package";
+const sharedPackages = /* @__PURE__ */ new Set(["effect", "@codeworksh/plugin"]);
+/** The package a bare specifier names: `effect/Schema` -> `effect`, `@a/b/c` -> `@a/b`. */
+function packageOf(specifier) {
+	if (specifier.startsWith(".") || specifier.startsWith("/") || specifier.includes(":")) return "";
+	const segments = specifier.split("/");
+	return specifier.startsWith("@") ? segments.slice(0, 2).join("/") : segments[0] ?? "";
+}
 /**
-* The **full** SHA-256 of the source identity: canonical spec plus effective registry for a
-* registry package, and the canonical spec alone for git.
-*
-* Not truncated. The fast path proves a hit by checking that a marker *exists* rather than by
-* decoding it, and the index is keyed by digest alone, so a truncated digest would let a collision
-* return the wrong package silently.
+* Resolve the shared packages as though this module had imported them, for as long as `run`
+* takes. Anything else resolves exactly as it would have.
 */
-const digest = Effect.fn("PluginStore.digest")(function* (target, cache, from) {
-	const source = target.kind === "registry" ? `${yield* registry(target, cache, from)}\0${target.spec}` : target.spec;
-	return Encoding.encodeHex(yield* crypto.digest("SHA-256", new TextEncoder().encode(source)));
-});
-const entryDir = Effect.fn("PluginStore.entryDir")(function* (target, cache, from) {
-	const key = yield* digest(target, cache, from);
-	return {
-		key,
-		directory: hostPath.join(root(cache), slugOf(target), key)
-	};
-});
-const failure$1 = (target, reason, message, cause) => new StoreError({
-	reason,
-	reference: target.spec,
-	message,
-	...cause === void 0 ? {} : { cause }
-});
-/** Generation directories, oldest first. A name that is not a number is not a generation. */
-const generations = Effect.fn("PluginStore.generations")(function* (directory) {
-	return (yield* fileSystem.readDirectory(directory).pipe(Effect.orElseSucceed(() => []))).filter((name) => /^\d+$/.test(name)).map((name) => Number(name)).sort((left, right) => left - right);
-});
-const readMarker = (directory) => fileSystem.readFileString(hostPath.join(directory, MARKER)).pipe(Effect.flatMap(Schema.decodeUnknownEffect(Schema.fromJsonString(Marker))), Effect.option);
-const entryOf = (marker, input) => ({
-	...marker,
-	digest: input.digest,
-	generation: input.generation,
-	directory: input.directory,
-	url: url(hostPath.resolve(input.directory, marker.entrypoint))
-});
-/** The newest generation that carries a marker. Unmarked ones are invisible: they never happened. */
-const active = Effect.fn("PluginStore.active")(function* (directory, key) {
-	for (const generation of (yield* generations(directory)).reverse()) {
-		const where = hostPath.join(directory, String(generation));
-		const marker = yield* readMarker(where);
-		if (Option.isSome(marker)) return entryOf(marker.value, {
-			digest: key,
-			generation,
-			directory: where
+function withSharedModules(run) {
+	const hook = registerHooks({ resolve(specifier, context, nextResolve) {
+		return sharedPackages.has(packageOf(specifier)) ? nextResolve(specifier, {
+			...context,
+			parentURL: import.meta.url
+		}) : nextResolve(specifier, context);
+	} });
+	return run().finally(() => hook.deregister());
+}
+/** Use Node's main loader even when the caller runs inside a bundler or test VM. */
+async function importModule(specifier) {
+	const imported = await withSharedModules(() => new Script(`import(${JSON.stringify(specifier)})`, { importModuleDynamically: constants.USE_MAIN_CONTEXT_DEFAULT_LOADER }).runInThisContext());
+	if (typeof imported !== "object" || imported === null) return imported;
+	const module = imported;
+	const exports = module["module.exports"];
+	if (exports !== module.default || typeof exports !== "object" && typeof exports !== "function" || exports === null) return imported;
+	return Object.assign({}, module, exports);
+}
+/** Node resolution scoped synchronously to the caller. */
+function resolveModule(specifier, directory, conditions) {
+	const hook = registerHooks({ resolve(target, context, nextResolve) {
+		return nextResolve(target, {
+			...context,
+			parentURL: pathToFileURL(path.join(directory, "package.json")).href,
+			...conditions === void 0 ? {} : { conditions: [.../* @__PURE__ */ new Set([...context.conditions, ...conditions])] }
 		});
+	} });
+	try {
+		const resolve = (target) => {
+			const resolved = import.meta.resolve(path.isAbsolute(target) ? pathToFileURL(target).href : target);
+			if (resolved.startsWith("file:")) statSync(new URL(resolved));
+			return resolved;
+		};
+		try {
+			return resolve(specifier);
+		} catch (error) {
+			if (path.extname(specifier) || !missing(error)) throw error;
+			for (const extension of [
+				".ts",
+				".tsx",
+				".js",
+				".jsx",
+				".mts",
+				".mjs",
+				".cts",
+				".cjs"
+			]) try {
+				return resolve(specifier + extension);
+			} catch (cause) {
+				if (!missing(cause)) throw cause;
+			}
+			throw error;
+		}
+	} finally {
+		hook.deregister();
 	}
-});
-/** What the index files about an entry, all of it derivable from the spec and the marker. */
-const record = (target, entry, installedAt) => ({
-	spec: target.spec,
-	source: target.kind,
-	name: entry.name,
-	slug: slugOf(target),
-	mutable: target.mutable,
-	generation: entry.generation,
-	...entry.version === void 0 ? {} : { version: entry.version },
-	...entry.revision === void 0 ? {} : { revision: entry.revision },
-	entrypoint: entry.entrypoint,
-	installedAt
-});
+}
+function missing(error) {
+	return error instanceof Error && "code" in error && [
+		"ENOENT",
+		"ENOTDIR",
+		"ERR_MODULE_NOT_FOUND"
+	].includes(String(error.code));
+}
+//#endregion
+//#region ../harness/src/plugin/error.ts
 /**
-* Disk-only lookup. No network, no install -- this is what boot uses, and the reason booting
-* offline works.
+* The reference as the person wrote it -- the string they will recognise in their settings file,
+* never the resolved path or the canonical spec. Every plugin failure carries one.
+*/
+const Reference = Schema.String;
+/**
+* The settings file that declared the entry, when one did.
 *
-* The index is consulted first and is only ever a hint: a hit is proved by the marker still
-* existing, and anything else falls through to a scan that repairs the index on the way past.
+* Absent for an embedder's own list and for anything the CLI was handed directly -- in both cases
+* the caller already knows where the string came from. It is the settings path that needs saying,
+* because several layers accumulate entries and "which file says this" is the question.
 */
-const resolve$2 = Effect.fn("PluginStore.resolve")(function* (target, cache, from) {
-	const { key, directory } = yield* entryDir(target, cache, from);
-	const base = root(cache);
-	const hinted = (yield* read(base)).get(key);
-	if (hinted !== void 0) {
-		const where = hostPath.join(directory, String(hinted.generation));
-		const marker = yield* readMarker(where);
-		if (Option.isSome(marker)) return entryOf(marker.value, {
-			digest: key,
-			generation: hinted.generation,
-			directory: where
-		});
-	}
-	const scanned = yield* active(directory, key);
-	if (scanned === void 0) return void 0;
-	yield* put(base, key, record(target, scanned, scanned.createdAt));
-	return scanned;
-}, Effect.mapError((cause) => Schema.is(StoreError)(cause) || Schema.is(InstallError)(cause) ? cause : new StoreError({
-	reason: "plugin-marker-invalid",
-	reference: "",
-	message: "cannot read the plugin store",
-	cause
-})));
+const File$1 = Schema.optional(Schema.String);
 /**
-* `resolve`, for a caller that needs the entry rather than an answer about it.
+* A spec that cannot be installed at all.
 *
-* `plugin remove` uses this as its installer: it has to identify what an entry names without
-* fetching anything, and a spec with nothing filed is a real answer there -- the command reports
-* it and moves on.
+* `plugin-not-found` is a local path with nothing at it; `plugin-not-installed` (the store's) is a
+* package spec with no entry. The first is a mistake in a settings file, the second is fixed by
+* `plugin install`, and keeping them apart is most of the value of having slugs.
 */
-const required = Effect.fn("PluginStore.required")(function* (target, cache, from) {
-	const found = yield* resolve$2(target, cache, from);
-	if (found === void 0) return yield* failure$1(target, "plugin-not-installed", `${target.spec} is not installed`);
-	return found;
-});
+var SourceError = class extends Schema.TaggedError()("PluginSourceError", {
+	reason: Schema.Literals([
+		"plugin-unsupported-source",
+		"plugin-not-found",
+		"plugin-escapes-root"
+	]),
+	reference: Reference,
+	file: File$1,
+	message: Schema.String
+}) {};
+/** A spec that is installable, and whose install did not produce a usable package. */
+var InstallError = class extends Schema.TaggedError()("PluginInstallError", {
+	reason: Schema.Literals([
+		"plugin-resolve-failed",
+		"plugin-fetch-failed",
+		"plugin-no-commit",
+		"plugin-no-entrypoint"
+	]),
+	reference: Reference,
+	file: File$1,
+	message: Schema.String,
+	cause: Schema.optional(Schema.Defect())
+}) {};
 /**
-* Install if absent; hand back what is filed if present.
+* A module that reached the import and did not come back as a plugin.
 *
-* `refresh` forces past both the fast path and the double-check, which is what `update` needs and
-* nothing else should use.
+* Distinct from {@link InstallError}: the bytes are here and are fine as *bytes*. What failed is
+* evaluating them, or what they turned out to export -- which is the distinction a caller acts on,
+* because one is fixed by installing and the other by editing code.
 */
-const add = Effect.fn("PluginStore.add")(function* (target, cache, options) {
-	return yield* Effect.gen(function* () {
-		const { key, directory } = yield* entryDir(target, cache, options.from);
-		if (options.refresh !== true) {
-			const found = yield* resolve$2(target, cache, options.from);
-			if (found !== void 0) return { entry: found };
-		}
-		yield* fileSystem.makeDirectory(directory, { recursive: true });
-		yield* lock(hostPath.join(directory, ".lock"), () => failure$1(target, "plugin-lock-timeout", `timed out waiting for another installation of ${target.spec}`));
-		const current = yield* active(directory, key);
-		if (current !== void 0 && options.refresh !== true) return { entry: current };
-		const real = yield* fileSystem.realPath(directory).pipe(Effect.orElseSucceed(() => directory));
-		const staging = yield* Effect.acquireRelease(fileSystem.makeTempDirectory({
-			directory: real,
-			prefix: STAGING
-		}), (staged) => fileSystem.remove(staged, {
-			recursive: true,
-			force: true
-		}).pipe(Effect.orDie));
-		yield* fileSystem.writeFileString(hostPath.join(staging, "package.json"), "{\"private\":true,\"type\":\"module\"}");
-		const fetched = yield* download({
-			target,
-			into: staging,
-			cache,
-			from: options.from,
-			...options.runner === void 0 ? {} : { runner: options.runner }
-		});
-		if (current !== void 0 && current.revision === fetched.revision) return { entry: current };
-		const validated = yield* options.validate(fetched);
-		const entrypoint = hostPath.relative(yield* fileSystem.realPath(staging), fetched.entrypoint);
-		if (entrypoint.startsWith("..") || hostPath.isAbsolute(entrypoint)) return yield* new InstallError({
-			reason: "plugin-no-entrypoint",
-			reference: target.spec,
-			message: `entrypoint escapes its installation: ${entrypoint}`
-		});
-		const now = yield* Effect.clockWith((clock) => clock.currentTimeMillis);
-		const marker = {
-			spec: target.spec,
-			name: fetched.name,
-			...fetched.version === void 0 ? {} : { version: fetched.version },
-			...fetched.revision === void 0 ? {} : { revision: fetched.revision },
-			entrypoint,
-			createdAt: now
-		};
-		yield* fileSystem.writeFileString(hostPath.join(staging, MARKER), yield* Schema.encodeEffect(Schema.fromJsonString(Marker))(marker));
-		const previous = (yield* generations(directory)).at(-1) ?? 0;
-		const generation = Math.max(now, previous + 1);
-		const published = hostPath.join(directory, String(generation));
-		yield* fileSystem.rename(staging, published);
-		const entry = entryOf(marker, {
-			digest: key,
-			generation,
-			directory: published
-		});
-		yield* put(root(cache), key, record(target, entry, now));
-		yield* collect$1(directory);
-		return {
-			entry,
-			validated
-		};
-	}).pipe(Effect.scoped, Effect.mapError((cause) => Schema.is(InstallError)(cause) || Schema.is(StoreError)(cause) || Schema.is(LoadError)(cause) ? cause : failure$1(target, "plugin-marker-invalid", `cannot write the store entry for ${target.spec}`, cause)));
-});
+var LoadError = class extends Schema.TaggedError()("PluginLoadError", {
+	reason: Schema.Literals([
+		"plugin-import-failed",
+		"plugin-missing-dependency",
+		"plugin-not-compiled",
+		"plugin-invalid-definition"
+	]),
+	reference: Reference,
+	file: File$1,
+	message: Schema.String,
+	/** The ID the module declared, when it got far enough to declare one. */
+	id: Schema.optional(Schema.String),
+	cause: Schema.optional(Schema.Defect())
+}) {};
+/** The store's own failures: what is filed, what is not, and what could not be claimed. */
+var StoreError = class extends Schema.TaggedError()("PluginStoreError", {
+	reason: Schema.Literals([
+		"plugin-not-installed",
+		"plugin-lock-timeout",
+		"plugin-marker-invalid",
+		"plugin-index-invalid",
+		"plugin-collect-failed"
+	]),
+	reference: Reference,
+	file: File$1,
+	message: Schema.String,
+	cause: Schema.optional(Schema.Defect())
+}) {};
 /**
-* Expire what is superseded.
+* Note which settings file declared the entry a failure came from.
 *
-* The two newest generations are kept regardless of age: the newest is live, and the one before it
-* may still be imported by an exchange in flight. Runs at the end of an `add` that published
-* something -- no timer and no sweeper, because installs are the only thing that creates garbage.
+* The store and the installer raise their own failures without knowing that, because neither is
+* told: they are handed a spec, not a settings layer. The loader knows, and this is where it says
+* so -- leaving an existing answer alone, since a more specific one is already better.
 */
-const collect$1 = Effect.fn("PluginStore.collect")(function* (directory) {
-	const now = yield* Effect.clockWith((clock) => clock.currentTimeMillis);
-	const keep = new Set((yield* generations(directory)).slice(-2).map(String));
-	const names = yield* fileSystem.readDirectory(directory).pipe(Effect.orElseSucceed(() => []));
-	for (const name of names) {
-		if (keep.has(name) || name === ".lock") continue;
-		if (name.startsWith(STAGING)) {
-			const started = yield* fileSystem.stat(hostPath.join(directory, name)).pipe(Effect.option);
-			if ((Option.isNone(started) ? 0 : Option.match(started.value.mtime, {
-				onNone: () => 0,
-				onSome: (at) => now - at.getTime()
-			})) > HOUR) yield* fileSystem.remove(hostPath.join(directory, name), {
-				recursive: true,
-				force: true
-			}).pipe(Effect.ignore);
-			continue;
-		}
-		if (!/^\d+$/.test(name)) continue;
-		if (now - Number(name) > WEEK) yield* fileSystem.remove(hostPath.join(directory, name), {
-			recursive: true,
-			force: true
-		}).pipe(Effect.ignore);
-	}
-});
-const HOUR = 36e5;
-const WEEK = 168 * HOUR;
+const declaredIn = (error, file) => {
+	if (error.file !== void 0) return error;
+	const shared = {
+		reference: error.reference,
+		message: error.message,
+		file
+	};
+	if (Schema.is(SourceError)(error)) return new SourceError({
+		...shared,
+		reason: error.reason
+	});
+	if (Schema.is(InstallError)(error)) return new InstallError({
+		...shared,
+		reason: error.reason,
+		cause: error.cause
+	});
+	if (Schema.is(LoadError)(error)) return new LoadError({
+		...shared,
+		reason: error.reason,
+		id: error.id,
+		cause: error.cause
+	});
+	if (Schema.is(StoreError)(error)) return new StoreError({
+		...shared,
+		reason: error.reason,
+		cause: error.cause
+	});
+	return error;
+};
+//#endregion
+//#region ../harness/src/util/path.ts
 /**
-* How long a network answer is reused before `check` asks again.
+* A directory that crosses into the harness is absolute, and a relative one is a **defect** rather
+* than an error.
 *
-* Persisted in the index rather than held in memory, because the thing that benefits is a command
-* that exits: an in-memory staleness cache is worthless to `codework plugin check`.
-*/
-const CHECK_TTL = 36e5;
-/**
-* Is a newer revision available?
+* A relative path is a disguised `process.cwd()` call: and every consumer
+* resolves it silently. `path.resolve("x")` anchors to the process directory, npm answers a
+* relative `cwd` with a `localPrefix` of whatever repository the process is inside (measured, not
+* assumed), and `Session.link` would write the *server's* directory into a field whose whole
+* purpose is to be a host path the client declared.
 *
-* The only network call in the store's vocabulary, and it is the caller's to make. A `probe` that
-* fails -- offline, registry down, a remote that refuses -- propagates rather than answering
-* `current`: an outage must not read as "you are up to date".
+* For a long-running server the process directory is nobody's project, so the result is a
+* plausible answer to a question no one asked.
+* An absolute path is the one spelling none of them can quietly reinterpret.
+*
+* A defect rather than a typed error because nothing a user types reaches here. Every reference
+* goes through `parse`, and every directory comes from `Global.resolve`, a resolved `cwd` or a
+* session's `hostDir`, all of them already absolute. A relative one means a new call site got it
+* wrong, and a stack trace names that call site; a typed error would ask every caller to handle a
+* case none of them can cause.
 */
-const check = Effect.fn("PluginStore.check")(function* (target, cache, options) {
-	if (!target.mutable) return { _tag: "immutable" };
-	const entry = yield* resolve$2(target, cache, options.from);
-	if (entry === void 0) return { _tag: "not-installed" };
-	const key = yield* digest(target, cache, options.from).pipe(Effect.mapError((cause) => failure$1(target, "plugin-marker-invalid", `cannot address ${target.spec}`, cause)));
-	const base = root(cache);
-	const record = (yield* read(base)).get(key);
-	const now = yield* Effect.clockWith((clock) => clock.currentTimeMillis);
-	if (options.refresh !== true && record?.checkedAt !== void 0 && now - record.checkedAt < CHECK_TTL && (record.outdated !== true || record.available !== void 0)) return record.outdated === true ? {
-		_tag: "outdated",
-		available: record.available,
-		...entry.revision === void 0 ? {} : { filed: entry.revision }
-	} : {
-		_tag: "current",
-		...entry.revision === void 0 ? {} : { revision: entry.revision }
-	};
-	const available = yield* options.probe(target);
-	if (available === void 0) return {
-		_tag: "current",
-		...entry.revision === void 0 ? {} : { revision: entry.revision }
-	};
-	const outdated = available !== entry.revision;
-	yield* patch(base, key, {
-		checkedAt: now,
-		outdated,
-		available
-	});
-	return outdated ? {
-		_tag: "outdated",
-		available,
-		...entry.revision === void 0 ? {} : { filed: entry.revision }
-	} : {
-		_tag: "current",
-		...entry.revision === void 0 ? {} : { revision: entry.revision }
-	};
-});
+const rooted = (directory, role) => {
+	if (hostPath.isAbsolute(directory)) return directory;
+	throw new Error(`${role} must be an absolute path, got ${JSON.stringify(directory)}`);
+};
+//#endregion
+//#region ../harness/src/plugin/npm.ts
+const Manifest$1 = Schema.Struct({ version: Schema.optional(Schema.String) });
+const Lockfile = Schema.Struct({ packages: Schema.optional(Schema.Record(Schema.String, Schema.Struct({ resolved: Schema.optional(Schema.String) }))) });
 /**
-* Refresh a mutable target, if the network says there is anything to refresh.
+* npm's flattened config: registry, scopes, auth, and cache paths.
 *
-* `add` with `refresh` is what does the work; this is the guard in front of it, so an `update`
-* that finds nothing new neither stages nor publishes.
+* Built in one place, because two call sites deriving it separately is how the cache location
+* drifts between an install and the staleness check that is supposed to describe it.
+*
+* `dir` is where the `.npmrc` chain is read from, and it is the **host directory the caller
+* belongs to** -- never the staging directory and never the cache. A company repo keeps its
+* private registry and its scoped token in its own `.npmrc`, so a chain read anywhere else
+* resolves the plugin against the public registry and fails 404, or worse, installs a public
+* package of the same name. This is the registry half of auth; the git half is below.
+*
+* No `--prefix`. npm pins its local prefix to a `--prefix` on `argv` and stops walking, so
+* passing one would look up exactly `<dir>/.npmrc` and nothing above it -- wrong for a person
+* standing in `packages/x` whose token lives at the repository root. Without it npm walks up from
+* `cwd` to the nearest `package.json` or `node_modules` exactly as `npm` itself would if it were
+* run there, which is the only rule a user can predict.
+*
+* `--cache` is ours and is passed on `argv`, which outranks every `.npmrc`. npm's `flatten`
+* derives `_cacache`, `_npx` and `_tuf` from that one value, so naming the parent is enough --
+* and overriding `flat.cache` afterwards would redirect one of the three and leave `_tuf` pointing
+* at the user's home. `--home` exists to make a run self-contained; anything reached by an ambient
+* default is a test reading the developer's real machine.
+*
+* **Nothing here names an `env`.** npm hands git `opts.env` when one is present and falls back to
+* `{ ...gitDefaults, ...process.env }` when it is not, so leaving it out is what lets a git source
+* reach a private remote at all: `SSH_AUTH_SOCK` finds the agent, `HOME` finds the `~/.gitconfig`
+* that names the credential helper, and `PATH` finds `git`. Setting `env` to anything -- even to
+* a copy of `process.env` -- would be a standing invitation to prune it later and break private
+* git silently, months from the change. §15 Q2.
 */
-const update = Effect.fn("PluginStore.update")(function* (target, cache, options) {
-	const current = yield* resolve$2(target, cache, options.from);
-	if (current === void 0) return { _tag: "not-installed" };
-	if ((yield* check(target, cache, {
-		refresh: true,
-		probe: options.probe,
-		from: options.from
-	}))._tag !== "outdated") return {
-		_tag: "unchanged",
-		entry: current
-	};
-	const added = yield* add(target, cache, {
-		refresh: true,
-		validate: options.validate,
-		from: options.from,
-		...options.runner === void 0 ? {} : { runner: options.runner }
-	});
-	return added.entry.generation === current.generation ? {
-		_tag: "unchanged",
-		entry: current
-	} : {
-		_tag: "updated",
-		entry: added.entry,
-		...added.validated === void 0 ? {} : { validated: added.validated }
-	};
-});
-Effect.fn("PluginStore.remove")(function* (target, cache, from) {
-	const { key, directory } = yield* entryDir(target, cache, from);
-	const existed = yield* fileSystem.exists(directory).pipe(Effect.orElseSucceed(() => false));
-	yield* fileSystem.remove(directory, {
-		recursive: true,
-		force: true
-	}).pipe(Effect.ignore);
-	yield* drop(root(cache), key);
-	return existed;
+const options = (dir, cache) => Effect.suspend(() => {
+	const root = rooted(dir, "the directory a plugin install reads its .npmrc chain from");
+	const store = rooted(cache, "the npm cache");
+	return npmOptions(root, store);
 });
-Effect.fn("PluginStore.all")(function* (cache) {
-	const base = root(cache);
-	const slugs = yield* fileSystem.readDirectory(base).pipe(Effect.orElseSucceed(() => []));
-	const found = [];
-	for (const slug of slugs) {
-		const digests = yield* fileSystem.readDirectory(hostPath.join(base, slug)).pipe(Effect.orElseSucceed(() => []));
-		for (const key of digests) {
-			const entry = yield* active(hostPath.join(base, slug, key), key);
-			if (entry !== void 0) found.push(entry);
-		}
+const npmOptions = (dir, cache) => Effect.gen(function* () {
+	const config = yield* Effect.tryPromise(async () => {
+		const { default: Config } = await import("./lib-BCUUrctP.mjs").then((m) => /* @__PURE__ */ __toESM(m.default, 1));
+		const { definitions, flatten, nerfDarts, shorthands } = (await import("./definitions-XbglYT7Q.mjs").then((m) => /* @__PURE__ */ __toESM(m.default, 1))).default;
+		const created = new Config({
+			npmPath: fileURLToPath(new URL("..", import.meta.url)),
+			cwd: dir,
+			env: { ...process.env },
+			argv: [
+				process.execPath,
+				process.execPath,
+				"--cache",
+				hostPath.join(cache, "npm")
+			],
+			execPath: process.execPath,
+			platform: process.platform,
+			definitions,
+			flatten,
+			nerfDarts,
+			shorthands,
+			warn: false
+		});
+		await created.load();
+		return created;
+	}).pipe(Effect.catch((cause) => Effect.logWarning(`cannot load npm configuration from ${dir}; npm defaults apply`, cause).pipe(Effect.as(void 0))));
+	if (config === void 0) return { allowGit: "root" };
+	for (const kind of [
+		"project",
+		"user",
+		"global"
+	]) {
+		const loaded = config.data.get(kind);
+		if (loaded?.loadError !== void 0 && loaded.loadError.code !== "ENOENT") yield* Effect.logWarning(`cannot read npm configuration ${loaded.source ?? `for ${kind}`}; npm defaults apply`, loaded.loadError);
 	}
-	return found;
-});
-const Id = Schema.String.check(Schema.isPattern(/^[a-z0-9][a-z0-9-]*(\.[a-z0-9][a-z0-9-]*){2}$/));
-const Definition = Schema.Struct({
-	id: Id,
-	kind: Schema.Literals(Object.keys(plugin_exports.domains)),
-	events: Schema.optional(Schema.Array(Schema.declare((value) => Predicate.hasProperty(value, "type") && Predicate.isString(value.type)))),
-	setup: Schema.declare((value) => Predicate.isFunction(value))
-});
-/** Every plugin failure says which file to go and edit, when there is one. */
-const where = (origin) => origin.file === void 0 ? {} : { file: origin.file };
-const detail = (cause) => cause instanceof Error ? cause.message : typeof cause === "string" ? cause : String(cause);
-/** A reference that does not name anything loadable. */
-const sourceFailure = (origin, cause) => Schema.is(SourceError)(cause) ? cause : new SourceError({
-	reason: "plugin-not-found",
-	reference: origin.reference,
-	...where(origin),
-	message: detail(cause)
+	return {
+		...config.flat,
+		allowGit: "root"
+	};
 });
-/** Node's own code for a failure, when it set one. */
-const codeOf = (cause) => Predicate.hasProperty(cause, "code") && Predicate.isString(cause.code) ? cause.code : void 0;
+const PUBLIC_REGISTRY = "https://registry.npmjs.org/";
+/** Stable, credential-free registry identity used to address registry artifacts in the store. */
+const registry = Effect.fn("PluginNpm.registry")(function* (target, cache, from) {
+	const flat = yield* options(from, cache);
+	const scope = target.name.startsWith("@") ? target.name.slice(0, target.name.indexOf("/")) : void 0;
+	const configured = (scope === void 0 ? void 0 : flat[`${scope}:registry`]) ?? flat.registry ?? PUBLIC_REGISTRY;
+	if (typeof configured !== "string") return yield* new InstallError({
+		reason: "plugin-resolve-failed",
+		reference: target.spec,
+		message: `npm registry for ${target.name} is not a URL`
+	});
+	return yield* Effect.try({
+		try: () => {
+			const value = new URL(configured);
+			value.username = "";
+			value.password = "";
+			value.hash = "";
+			return value.href;
+		},
+		catch: (cause) => new InstallError({
+			reason: "plugin-resolve-failed",
+			reference: target.spec,
+			message: `npm registry for ${target.name} is not a valid URL: ${configured}`,
+			cause
+		})
+	});
+});
+/** A 40- or 64-hex commit out of the `resolved` URL arborist writes into the lockfile. */
+const commitIn = (resolved) => resolved?.match(/#([a-f0-9]{40}|[a-f0-9]{64})(?=::|$)/i)?.[1];
 /**
-* A module that would not import.
-*
-* Two of these get their own reason, because the remedy differs and that is the whole value of a
-* slug. A missing dependency means the plugin is fine and its `node_modules` is not, which a
-* person fixes in the package rather than in their settings. An uncompiled one means the plugin
-* shipped its sources: Node refuses to strip types under `node_modules`, and installing a plugin
-* runs no lifecycle scripts, so a `prepare` build never happens either -- the author has to ship
-* the build output, and nothing the user can do to their settings will help.
+* The commit a git install actually landed on, read back from the lockfile arborist wrote.
 *
-* `ERR_UNSUPPORTED_NODE_MODULES_TYPE_STRIPPING` is matched by code rather than by message: it is
-* Node's documented identifier and exact, where the wording is free to change under us. Only an
-* installed plugin can reach it -- a local path lives outside `node_modules`, where Node strips
-* types happily, which is what keeps the single-file dev workflow working.
+* Both spellings are tried because which one exists depends on whether the tree was saved.
 */
-const importFailure = (origin, cause) => new LoadError({
-	reason: codeOf(cause) === "ERR_UNSUPPORTED_NODE_MODULES_TYPE_STRIPPING" ? "plugin-not-compiled" : /cannot find (package|module)/i.test(detail(cause)) ? "plugin-missing-dependency" : "plugin-import-failed",
-	reference: origin.reference,
-	...where(origin),
-	message: detail(cause),
-	cause
-});
-/** A module that imported and is not a plugin. */
-const definitionFailure = (origin, cause, id) => new LoadError({
-	reason: "plugin-invalid-definition",
-	reference: origin.reference,
-	...where(origin),
-	message: detail(cause),
-	...id === void 0 ? {} : { id },
-	cause
-});
-const validate = Effect.fn("PluginLoader.validate")(function* (input, origin, builtin = false) {
-	yield* Schema.decodeUnknownEffect(Definition)(input).pipe(Effect.mapError((cause) => definitionFailure(origin, cause)));
-	const plugin = input;
-	if (!builtin && plugin.id.startsWith("codework.")) return yield* definitionFailure(origin, /* @__PURE__ */ new Error("codework namespace is reserved for builtins"), plugin.id);
-	return plugin;
-});
-const Manifest = Schema.Struct({
-	name: Schema.optional(Schema.String),
-	exports: Schema.optional(Schema.Unknown)
-});
-const localUrl = Effect.fn("PluginLoader.localUrl")(function* (location, origin) {
-	const escapes = (message) => new SourceError({
-		reason: "plugin-escapes-root",
-		reference: origin.reference,
-		...where(origin),
-		message
-	});
-	if ((yield* fileSystem.stat(location)).type !== "Directory") return { url: yield* Effect.try(() => resolveModule(location, hostPath.dirname(location))) };
-	const manifestPath = hostPath.join(location, "package.json");
-	if (!(yield* fileSystem.exists(manifestPath))) return { url: yield* Effect.try(() => resolveModule("./index", location)) };
-	const manifest = yield* fileSystem.readFileString(manifestPath).pipe(Effect.flatMap(Schema.decodeUnknownEffect(Schema.fromJsonString(Manifest))));
-	if (manifest.exports !== void 0) {
-		const name = manifest.name;
-		if (!name) return yield* escapes("a local package with exports must declare its name");
-		const url = yield* Effect.try(() => resolveModule(name, location));
-		const resolved = yield* fileSystem.realPath(fileURLToPath(url));
-		if (hostPath.relative(yield* fileSystem.realPath(location), resolved).startsWith("..")) return yield* escapes("package export escapes its root");
-		return {
-			url: pathToFileURL(resolved).href,
-			name
-		};
+const commit = Effect.fn("PluginNpm.commit")(function* (root, name) {
+	for (const file of [hostPath.join(root, "package-lock.json"), hostPath.join(root, "node_modules", ".package-lock.json")]) {
+		const parsed = yield* fileSystem.readFileString(file).pipe(Effect.flatMap(Schema.decodeUnknownEffect(Schema.fromJsonString(Lockfile))), Effect.option);
+		if (Option.isNone(parsed)) continue;
+		const found = commitIn(parsed.value.packages?.[`node_modules/${name}`]?.resolved);
+		if (found !== void 0) return found;
 	}
-	const url = yield* Effect.try(() => resolveModule(createRequire(pathToFileURL(manifestPath)).resolve(location), location));
-	return manifest.name === void 0 ? { url } : {
-		url,
-		name: manifest.name
-	};
 });
+/** Node error codes that mean "nothing here", as opposed to "this package is broken". */
+const notFound = /* @__PURE__ */ new Set([
+	"ENOENT",
+	"ENOTDIR",
+	"MODULE_NOT_FOUND",
+	"ERR_MODULE_NOT_FOUND",
+	"ERR_PACKAGE_PATH_NOT_EXPORTED",
+	"ERR_UNSUPPORTED_DIR_IMPORT"
+]);
 /**
-* Install a package into the store, importing and validating it **while it is still staged**.
+* The module to import out of an installed package.
 *
-* The validation is passed down rather than done afterwards for one reason: the store publishes by
-* rename, so a package that turns out not to be a plugin must be rejected before it is published.
-* Publishing first would make the broken generation the newest marked one, which `resolve` returns
-* forever after -- and re-running `add` would hit the fast path and return it again.
+* Ordered subpaths through the package's own `exports`, so a package that publishes a dedicated
+* `./plugin` entry is honoured and one that does not falls back to its main.
+*
+* Only "not found" is tolerated. Swallowing every error would turn a package that is broken --
+* a syntax error in its manifest, a permission problem -- into "no entrypoint", which is the
+* wrong diagnosis in the one place a person needs the right one.
 */
-const install = Effect.fn("PluginLoader.install")(function* (target, cache, origin, options) {
-	const added = yield* add(target, cache, {
-		from: anchor$1(origin.file, options.hostDir),
-		validate: (fetched) => imported(url(fetched.entrypoint), origin, options.import)
+const entrypoint = (directory, name) => Effect.gen(function* () {
+	for (const subpath of ["", "plugin"]) {
+		const specifier = name === void 0 ? hostPath.join(directory, subpath === "" ? "index" : subpath) : hostPath.join(name, subpath);
+		const resolved = yield* Effect.try(() => resolveModule(specifier, directory)).pipe(Effect.asSome, Effect.catchIf((error) => notFound.has(String(error.cause?.code)), () => Effect.succeed(Option.none())), Effect.mapError((error) => new InstallError({
+			reason: "plugin-no-entrypoint",
+			reference: name ?? directory,
+			message: `cannot resolve an entrypoint in ${directory}`,
+			cause: error
+		})));
+		if (Option.isSome(resolved)) return fileURLToPath(resolved.value);
+	}
+	return yield* new InstallError({
+		reason: "plugin-no-entrypoint",
+		reference: name ?? directory,
+		message: `no plugin entrypoint in ${directory}`
 	});
-	return {
-		url: added.entry.url,
-		...added.entry.version === void 0 ? {} : { version: added.entry.version },
-		generation: added.entry.generation,
-		...added.validated === void 0 ? {} : { plugin: added.validated }
-	};
 });
-/**
-* The directory whose `.npmrc` chain names the artifact a reference resolves to: the project that
-* declared it. A settings file sits in `<root>/.codework/`, but npm reads a project `.npmrc` at the
-* package boundary discovered upward from the chain's start -- the root itself -- so anchoring at
-* the file's own directory would miss it. Absent a declaring file the host context stands in.
-*/
-const anchor$1 = (file, fallback) => {
-	if (file === void 0) return fallback;
-	const directory = hostPath.dirname(file);
-	return hostPath.basename(directory) === ".codework" ? hostPath.dirname(directory) : directory;
-};
-/** The default installer, or the one the caller injected. */
-const installer = (target, origin, options) => options.install === void 0 ? install(target, options.cache, origin, options) : options.install(target, options.cache, anchor$1(origin.file, options.hostDir));
-/** Import a module and confirm it default-exports a plugin. */
-const imported = Effect.fn("PluginLoader.imported")(function* (url, origin, load) {
-	const module = yield* Effect.tryPromise({
-		try: () => (load ?? importModule)(url),
-		catch: (cause) => importFailure(origin, cause)
+const reify = Effect.fn("PluginNpm.reify")(function* ({ target, into, cache, from }) {
+	const flat = yield* options(from, cache);
+	const { Arborist } = yield* Effect.promise(() => import("./lib-CNtGmPS7.mjs").then((m) => /* @__PURE__ */ __toESM(m.default, 1)));
+	const settings = {
+		...flat,
+		...target.mutable ? {
+			preferOnline: true,
+			noGitRevCache: true
+		} : {},
+		audit: false
+	};
+	const arborist = new Arborist({
+		...settings,
+		path: into,
+		binLinks: true,
+		progress: false,
+		savePrefix: "",
+		ignoreScripts: true
+	});
+	return yield* Effect.tryPromise({
+		try: () => arborist.reify({
+			...settings,
+			add: [target.spec],
+			update: target.mutable,
+			save: true,
+			saveType: "prod"
+		}),
+		catch: (cause) => new InstallError({
+			reason: "plugin-fetch-failed",
+			reference: target.spec,
+			message: `cannot install ${target.spec}`,
+			cause
+		})
 	});
-	return yield* validate(Predicate.isObject(module) && "default" in module ? module.default : void 0, origin);
 });
 /**
-* Import one entrypoint and confirm it is a plugin, without touching the store.
+* Fill `into` with the package `target` names, and report what landed there.
 *
-* This is what a caller hands the store as its `validate`: the artifact is checked while it is
-* still staged, so a package that turns out not to be a plugin is never published.
-*/
-const definition$1 = (entrypoint, reference) => imported(url(entrypoint), {
-	index: 0,
-	reference
-});
-/**
-* Install and import one reference, and report what it turned out to be, without selecting it.
-* `codework plugin add` uses this to prove a package really is a plugin before it writes the
-* reference into a settings file: the failure a user gets is the one they can act on — a bad
-* spec, an install that did not resolve, a module that exports no plugin — rather than a broken
-* configuration that only fails at the next run.
+* A local target downloads nothing: the files on disk are already the answer, and a local plugin
+* is never copied into the store.
 */
-const inspect = Effect.fn("PluginLoader.inspect")(function* (reference, options) {
-	const origin = {
-		index: 0,
-		reference,
-		file: options.file
+const download = Effect.fn("PluginNpm.download")(function* (input) {
+	const { target, into, cache, from, runner = reify } = input;
+	if (target.kind === "local") return {
+		directory: target.path,
+		name: hostPath.basename(target.path),
+		entrypoint: yield* entrypoint(target.path)
 	};
-	const target = yield* parse$2(reference, options.hostDir);
-	const loaded = yield* load$3(target, origin, options);
+	const root = yield* fileSystem.realPath(into).pipe(Effect.mapError((cause) => new InstallError({
+		reason: "plugin-fetch-failed",
+		reference: target.spec,
+		message: `cannot resolve the staging directory ${into}`,
+		cause
+	})));
+	const node = (yield* runner({
+		target,
+		into: root,
+		cache,
+		from
+	})).edgesOut.values().next().value?.to;
+	if (node === void 0) return yield* new InstallError({
+		reason: "plugin-fetch-failed",
+		reference: target.spec,
+		message: `${target.spec} installed nothing`
+	});
+	const manifest = yield* fileSystem.readFileString(hostPath.join(node.path, "package.json")).pipe(Effect.flatMap(Schema.decodeUnknownEffect(Schema.fromJsonString(Manifest$1))), Effect.option);
+	const version = Option.isNone(manifest) ? void 0 : manifest.value.version;
+	const revision = target.kind === "registry" ? version : (yield* commit(root, node.name)) ?? (yield* noCommit(target.spec));
 	return {
-		id: loaded.plugin.id,
-		...loaded.version === void 0 ? {} : { version: loaded.version },
-		...loaded.name === void 0 ? {} : { name: loaded.name }
+		directory: node.path,
+		name: node.name,
+		...version === void 0 ? {} : { version },
+		...revision === void 0 ? {} : { revision },
+		entrypoint: yield* entrypoint(node.path, node.name)
 	};
 });
-const load$3 = Effect.fn("PluginLoader.load")(function* (target, origin, options) {
-	const installed = yield* target.kind === "local" ? localUrl(target.path, origin).pipe(Effect.mapError((cause) => sourceFailure(origin, cause))) : installer(target, origin, options).pipe(Effect.mapError((cause) => origin.file === void 0 ? cause : declaredIn(cause, origin.file)));
-	const address = target.kind === "local" && options.reload !== void 0 && options.reload > 0 ? `${installed.url}?reload=${options.reload}` : installed.url;
-	return {
-		plugin: installed.plugin ?? (yield* imported(address, origin, options.import)),
-		source: origin.reference,
-		..."version" in installed && installed.version !== void 0 ? { version: installed.version } : {},
-		..."generation" in installed && installed.generation !== void 0 ? { generation: installed.generation } : {},
-		...installed.name === void 0 ? {} : { name: installed.name }
+const noCommit = (spec) => new InstallError({
+	reason: "plugin-no-commit",
+	reference: spec,
+	message: `cannot resolve a commit for ${spec}`
+});
+/**
+* What a mutable target points at right now, without installing it.
+*
+* `preferOnline` and `noGitRevCache` are the whole point: without them pacote answers from its own
+* metadata cache, and a staleness check that reads a cache is not a staleness check. An immutable
+* target skips the call entirely -- a version and a SHA cannot move.
+*/
+const probe = Effect.fn("PluginNpm.probe")(function* (target, cache, from) {
+	if (target.kind === "local" || !target.mutable) return void 0;
+	const opts = {
+		...yield* options(from, cache),
+		preferOnline: true,
+		noGitRevCache: true,
+		_isRoot: true
 	};
+	const { default: pacote } = yield* Effect.promise(() => import("./lib-DHoZNIet.mjs").then((n) => /* @__PURE__ */ __toESM(n.t(), 1)));
+	return yield* Effect.tryPromise({
+		try: async () => target.kind === "registry" ? (await pacote.manifest(target.spec, opts)).version : commitIn(await pacote.resolve(target.spec, opts)),
+		catch: (cause) => new InstallError({
+			reason: "plugin-resolve-failed",
+			reference: target.spec,
+			message: `cannot reach ${target.spec}`,
+			cause
+		})
+	});
 });
-/**
-* The version-free, location-anchored spelling of a reference.
-*
-* Two references naming the same module compare equal through it: `@acme/x@1.2.0` and `@acme/x`
-* are one package, and `./plugins/x.ts` is the file it resolves to from the directory that
-* declared it. Pure -- nothing is installed, imported or read.
-*/
-const canonical = (reference, hostDir) => Effect.map(parse$2(reference, hostDir), canonical$1);
+/** A `file:` URL for an entrypoint, which is what the module loader takes. */
+const url = (entrypoint) => pathToFileURL(entrypoint).href;
 //#endregion
-//#region ../harness/src/plugin/catalog.ts
+//#region ../harness/src/plugin/source.ts
+/** A committish that names one artifact rather than a moving branch: an unabbreviated SHA. */
+const isCommit = (committish) => typeof committish === "string" && /^[a-f0-9]{40}$|^[a-f0-9]{64}$/i.test(committish);
 /**
-* A definition carries `setup`; a patch carries `plugin` or `package` and no `setup`. Checking
-* `setup` first matters because `Plugin` permits extra properties, so a definition holding its
-* own `plugin` property must not be read as configuration.
-*
-* e.g
-* "acme/tool@1.2.0"                    → module (load me)
-* define({id, kind, setup, ...})       → module (I AM the definition — embedder code only)
-* { plugin: "x", enabled: false }      → config (don't load — adjust something already loaded)
-*
-* setup present → definition, always (even with a stray plugin: key)
-* setup absent + plugin:/package: present → config patch
-* setup absent + neither key → malformed
+* A short, readable name for a git source, used to make a store path recognisable to a human
+* reading `ls`. It is never an identity: two remotes can slug alike, and the digest is what
+* separates them.
 */
-const isPatch = (reference) => Predicate.isObject(reference) && !Predicate.isFunction(reference) && !("setup" in reference) && ("plugin" in reference || "package" in reference);
+const slug = (spec) => {
+	const withoutCommittish = spec.split("#")[0] ?? spec;
+	return (() => {
+		try {
+			return decodeURIComponent(withoutCommittish);
+		} catch {
+			return withoutCommittish;
+		}
+	})().replace(/\.git$/i, "").split(/[/:\\]/).at(-1)?.replace(/[^a-zA-Z0-9._-]+/g, "-").replace(/^-+|-+$/g, "") || "repository";
+};
+/** Whether a reference names a place on disk rather than something to fetch. */
+const isPath = (reference) => reference.startsWith("file:") || reference.startsWith("./") || reference.startsWith("../") || hostPath.isAbsolute(reference);
 /**
-* The **load pass**: store lookup and ESM import, never the network.
-*
-* Runs at boot, at `reload`, and at any exchange that finds a reference it cannot satisfy. It
-* deliberately knows nothing about `enabled`, options or order -- those are data over modules that
-* are already loaded, they cost a walk of a short array, and they belong to every exchange.
+* `from` is the directory a relative spec resolves against, and the caller picks it:
 *
-* Loading is keyed by what a reference resolves to, so naming one module twice imports it once.
+* - a **plugin entry** anchors to the directory holding the file that declared it --
+*   `<root>/.codework/` for a project entry, `<home>/` for a user one, the named directory for
+*   `--user-config-dir`. The rule is about the file, not the project.
+* - a **CLI argument** anchors to the process's startup directory, because that is where the
+*   person typed it.
 */
-const load$2 = Effect.fn("PluginCatalog.load")(function* (references, options) {
-	const plugins = /* @__PURE__ */ new Map();
-	const aliases = /* @__PURE__ */ new Map();
-	const versions = /* @__PURE__ */ new Map();
-	const origins = /* @__PURE__ */ new Map();
-	const seen = /* @__PURE__ */ new Map();
-	const remember = (plugin, names, from) => {
-		plugins.set(plugin.id, plugin);
-		aliases.set(plugin.id, plugin.id);
-		for (const name of names) aliases.set(name, plugin.id);
-		if (from?.version !== void 0) versions.set(plugin.id, from.version);
-		if (from !== void 0) origins.set(plugin.id, from.origin);
-	};
-	/** Source metadata exists for diagnostics; a silent ID replacement is where it earns that. */
-	const note = (plugin, source) => plugins.has(plugin.id) ? Effect.logDebug(`plugin ${plugin.id} redefined by ${source}; the earlier definition is discarded`) : Effect.void;
-	for (const builtin of options.builtins) remember(yield* validate(builtin, {
-		index: -1,
-		reference: builtin.id
-	}, true), []);
-	for (const [index, reference] of references.entries()) {
-		if (isPatch(reference)) continue;
-		const declared = typeof reference === "string" ? reference : Predicate.hasProperty(reference, "id") ? reference.id : void 0;
-		const named = typeof declared === "string" ? declared : `<plugin object #${index}>`;
-		const origin = {
-			index,
-			reference: named,
-			file: options.declared?.get(named)
+const parse$2 = (reference, from) => Effect.gen(function* () {
+	const fail = (reason, message) => new SourceError({
+		reason,
+		reference,
+		message
+	});
+	rooted(from, "the directory a plugin reference anchors to");
+	if (reference.startsWith("file:")) {
+		if (!reference.startsWith("file:///")) return yield* fail("plugin-unsupported-source", `not an absolute file URL: ${reference}`);
+		return {
+			kind: "local",
+			path: fileURLToPath(reference)
 		};
-		if (typeof reference !== "string") {
-			if (typeof declared === "string" && plugins.get(declared) === reference) continue;
-			const plugin = yield* validate(reference, origin);
-			yield* note(plugin, "a supplied object");
-			remember(plugin, []);
-			continue;
-		}
-		const target = yield* parse$2(reference, options.hostDir);
-		const key = target.kind === "local" ? target.path : target.spec;
-		const already = seen.get(key);
-		if (already !== void 0) {
-			aliases.set(reference, already);
-			continue;
-		}
-		const definition = yield* load$3(target, origin, options);
-		yield* note(definition.plugin, definition.version === void 0 ? key : `${key}@${definition.version}`);
-		const names = target.kind === "local" ? [target.path, ...definition.name === void 0 ? [] : [definition.name]] : [canonical$1(target), target.spec];
-		remember(definition.plugin, [reference, ...names], {
-			...definition.version === void 0 ? {} : { version: definition.version },
-			origin: {
-				reference,
-				...definition.generation === void 0 ? {} : { generation: definition.generation },
-				...origin.file === void 0 ? {} : { file: origin.file }
-			}
-		});
-		seen.set(key, definition.plugin.id);
 	}
-	return {
-		plugins,
-		aliases,
-		versions,
-		origins
+	const expanded = expandTilde(reference, hostPath);
+	if (isPath(expanded)) return {
+		kind: "local",
+		path: hostPath.resolve(from, expanded)
 	};
+	const parsed = yield* Effect.try({
+		try: () => npa(reference),
+		catch: () => fail("plugin-unsupported-source", `cannot parse plugin source: ${reference}`)
+	});
+	if (parsed.type === "git") {
+		const { gitSubdir } = parsed;
+		return {
+			kind: "git",
+			slug: slug(reference),
+			spec: reference,
+			...parsed.gitCommittish == null ? {} : { committish: parsed.gitCommittish },
+			...gitSubdir == null ? {} : { subdir: gitSubdir },
+			mutable: !isCommit(parsed.gitCommittish)
+		};
+	}
+	if (parsed.name !== null && [
+		"version",
+		"range",
+		"tag"
+	].includes(parsed.type)) {
+		const omitted = parsed.raw === parsed.name || parsed.raw === `${parsed.name}@`;
+		return {
+			kind: "registry",
+			name: parsed.name,
+			spec: `${parsed.name}@${omitted ? "latest" : parsed.rawSpec}`,
+			mutable: parsed.type !== "version"
+		};
+	}
+	return yield* fail("plugin-unsupported-source", `unsupported plugin source: ${reference}`);
 });
 /**
-* The **config pass**: pure data over modules that are already loaded, run at every exchange.
-*
-* An array entry is a **module** — a definition object, a path, a `file:` URL, or a package
-* spec. It takes the position it is written at, so naming a module again moves it.
-*
-* An object entry is **configuration** for a plugin an earlier entry (or the built-in list)
-* already selected, addressed by its ID (`plugin`) or the module string (`package`) that selected
-* it. It never loads, installs or reorders anything, and a name matching nothing in the selection
-* is ignored rather than failing the boot — a typo costs a debug line, never a fetch.
+* What two references must share to be the same plugin, without installing either.
 *
-* Nothing here touches the disk, which is the whole point of the split: an `options` edit, an
-* `enabled` flip or a reordering applies at the next exchange without importing anything.
+* A local path is the file it resolves to; a package is its name, so `@acme/x@1` and `@acme/x@2`
+* are one package at two versions. Pure -- nothing is installed, imported or read.
 */
-const select = Effect.fn("PluginCatalog.select")(function* (references, pool) {
-	const operations = /* @__PURE__ */ new Map();
-	const missing = [];
-	const choose = (id, index) => operations.set(id, {
-		enabled: true,
-		index,
-		options: operations.get(id)?.options ?? {}
-	});
-	for (const [index, reference] of references.entries()) {
-		if (isPatch(reference)) {
-			const named = reference.plugin ?? reference.package;
-			const origin = {
-				index,
-				reference: typeof named === "string" ? named : `<plugin entry #${index}>`
-			};
-			const invalid = reference.plugin !== void 0 && reference.package !== void 0 ? "names both `plugin` and `package`" : typeof named !== "string" || named.length === 0 ? "names neither `plugin` nor `package`" : reference.enabled !== void 0 && typeof reference.enabled !== "boolean" ? "`enabled` is not a boolean" : reference.options !== void 0 && !isRecord$1(reference.options) ? "`options` is not a plain object" : void 0;
-			if (invalid !== void 0) return yield* definitionFailure(origin, /* @__PURE__ */ new Error(`plugin entry ${invalid}`));
-			const id = reference.plugin === void 0 ? pool.aliases.get(reference.package) : reference.plugin;
-			const operation = id === void 0 ? void 0 : operations.get(id);
-			if (id === void 0 || operation === void 0) {
-				yield* Effect.logDebug(`plugin configuration ignored: nothing selected under ${named}`);
-				continue;
-			}
-			operations.set(id, {
-				enabled: reference.enabled ?? operation.enabled,
-				index: operation.index,
-				options: reference.options ?? operation.options
-			});
-			continue;
-		}
-		if (typeof reference !== "string") {
-			const declared = Predicate.hasProperty(reference, "id") ? reference.id : void 0;
-			if (typeof declared === "string" && pool.plugins.has(declared)) choose(declared, index);
-			continue;
-		}
-		const id = pool.aliases.get(reference);
-		if (id === void 0) missing.push(reference);
-		else choose(id, index);
-	}
-	const selection = [];
-	for (const [id, operation] of operations) {
-		if (!operation.enabled) continue;
-		const plugin = pool.plugins.get(id);
-		if (plugin !== void 0) selection.push({
-			plugin,
-			options: Object.freeze(operation.options),
-			index: operation.index
-		});
+const canonical$1 = (target) => {
+	switch (target.kind) {
+		case "local": return target.path;
+		case "registry": return target.name;
+		case "git": return target.spec;
 	}
-	selection.sort((a, b) => (0, plugin_exports.rank)(a.plugin.kind) - (0, plugin_exports.rank)(b.plugin.kind) || a.index - b.index);
-	return {
-		selection: Object.freeze(selection.map(({ plugin, options }) => ({
-			plugin,
-			options
-		}))),
-		missing
-	};
+};
+//#endregion
+//#region ../harness/src/plugin/index.store.ts
+const Record_ = Schema.Struct({
+	spec: Schema.String,
+	source: Schema.Literals(["registry", "git"]),
+	name: Schema.String,
+	slug: Schema.String,
+	mutable: Schema.Boolean,
+	generation: Schema.Finite,
+	version: Schema.optional(Schema.String),
+	revision: Schema.optional(Schema.String),
+	entrypoint: Schema.String,
+	installedAt: Schema.Finite,
+	checkedAt: Schema.optional(Schema.Finite),
+	outdated: Schema.optional(Schema.Boolean),
+	/** The remote revision observed at `checkedAt`; distinct from the installed `revision`. */
+	available: Schema.optional(Schema.String)
+});
+const File = Schema.Struct({
+	version: Schema.Finite,
+	entries: Schema.Record(Schema.String, Record_)
 });
+const VERSION = 1;
+const NAME = "index.json";
 /**
-* The exchange-boundary check: has the store moved under this pool?
-*
-* Every exchange already re-reads every settings layer from disk, and the config pass already
-* walks those entries against the loaded set. Two things can be settled right there, and they are
-* the same question asked twice:
-*
-* 1. a settings entry names a module that is not loaded, and the store holds it;
-* 2. a loaded module is not the newest generation the store has.
+* Read the whole file, or start empty.
 *
-* The second is what makes `plugin update` finish. Without it the question is "is this entry
-* loaded?", the answer after an update is still yes, and the bytes just fetched sit on disk until
-* something else forces an import.
+* An unreadable or unparseable index is not an error: it is a cold cache. Failing here would make
+* a corrupt accelerator break installs that do not need it.
+*/
+const read = Effect.fn("PluginIndex.read")(function* (root) {
+	const parsed = yield* fileSystem.readFileString(hostPath.join(root, NAME)).pipe(Effect.flatMap(Schema.decodeUnknownEffect(Schema.fromJsonString(File))), Effect.option);
+	if (Option.isNone(parsed) || parsed.value.version !== VERSION) return /* @__PURE__ */ new Map();
+	return new Map(Object.entries(parsed.value.entries));
+});
+/** Temp file plus rename, so a reader never sees a half-written index. */
+const write = Effect.fn("PluginIndex.write")(function* (root, entries) {
+	const encoded = yield* Schema.encodeEffect(Schema.fromJsonString(File))({
+		version: VERSION,
+		entries: Object.fromEntries(entries)
+	});
+	yield* fileSystem.makeDirectory(root, { recursive: true });
+	const temporary = yield* fileSystem.makeTempFile({
+		directory: root,
+		prefix: `.${NAME}.`,
+		suffix: ".tmp"
+	});
+	yield* fileSystem.writeFileString(temporary, encoded).pipe(Effect.andThen(fileSystem.rename(temporary, hostPath.join(root, NAME))), Effect.ensuring(fileSystem.remove(temporary, { force: true }).pipe(Effect.ignore)));
+});
+/**
+* Record one entry, keeping whatever else the file holds.
 *
-* Returns the new pool, or nothing when nothing moved -- which is the common case, and costs one
-* store lookup per filed module.
+* Ignores its own failures. A store that cannot write its accelerator still works; refusing the
+* install would be the accelerator deciding whether the install counted.
+*/
+const put = Effect.fn("PluginIndex.put")(function* (root, digest, record) {
+	const entries = yield* read(root);
+	entries.set(digest, record);
+	yield* write(root, entries).pipe(Effect.ignore);
+});
+/**
+* Merge fields into one record, if it is there.
 *
-* **This is not a watcher.** Nothing polls and no fiber exists; it is the observation that we were
-* already paying for the I/O that would tell us, and discarding the answer. Three bounds keep it
-* safe: the store only and never the network, so an exchange cannot block on a registry;
-* resolve-only, so it cannot install; and once, at the top of a snapshot, so an exchange already
-* running is unaffected.
+* Unlocked, like every write here but the one that publishes a generation. Two processes checking
+* at once both read the whole file and both rewrite it, so one update is lost and a record added
+* in between can vanish -- and neither matters, because a lost `checkedAt` costs one network call
+* and a vanished record is a miss a scan repairs.
 */
-const follow = Effect.fn("PluginCatalog.follow")(function* (references, pool, options, filed) {
-	let moved = false;
-	for (const reference of references) {
-		if (typeof reference !== "string" || pool.aliases.has(reference)) continue;
-		if (Option.isSome(yield* filed(reference, anchor$1(options.declared?.get(reference), options.hostDir)))) {
-			moved = true;
-			break;
-		}
-	}
-	if (!moved) for (const origin of pool.origins.values()) {
-		if (origin.generation === void 0) continue;
-		const current = yield* filed(origin.reference, anchor$1(origin.file, options.hostDir));
-		if (Option.isSome(current) && current.value.generation !== void 0 && current.value.generation > origin.generation) {
-			moved = true;
-			break;
-		}
-	}
-	if (!moved) return Option.none();
-	const retained = [];
-	for (const origin of pool.origins.values()) {
-		if (references.includes(origin.reference) || Option.isSome(yield* filed(origin.reference, anchor$1(origin.file, options.hostDir)))) {
-			retained.push(origin);
-			continue;
-		}
-		yield* Effect.logWarning(`plugin ${origin.reference} no longer resolves; it is dropped from the loaded set`);
-	}
-	const accumulated = [...Array.from(retained, (origin) => origin.reference), ...references];
-	const known = /* @__PURE__ */ new Map();
-	for (const origin of retained) if (origin.file !== void 0) known.set(origin.reference, origin.file);
-	for (const [reference, file] of options.declared ?? /* @__PURE__ */ new Map()) known.set(reference, file);
-	return Option.some(yield* load$2(accumulated, {
-		...options,
-		declared: known
-	}));
+const patch = Effect.fn("PluginIndex.patch")(function* (root, digest, fields) {
+	const entries = yield* read(root);
+	const existing = entries.get(digest);
+	if (existing === void 0) return;
+	entries.set(digest, {
+		...existing,
+		...fields
+	});
+	yield* write(root, entries).pipe(Effect.ignore);
 });
-Effect.fn("PluginCatalog.prepare")(function* (references, options) {
-	const pool = yield* load$2(references, options);
-	return (yield* select(references, pool)).selection;
+/** Forget one entry, for a store entry that has been removed. */
+const drop = Effect.fn("PluginIndex.drop")(function* (root, digest) {
+	const entries = yield* read(root);
+	if (!entries.delete(digest)) return;
+	yield* write(root, entries).pipe(Effect.ignore);
 });
 //#endregion
-//#region ../harness/src/plugin/builtin/prompt/default.ts
-/** The default coding-agent foundation, used unless `promptCustom` replaces it. */
-const foundation = `You are an expert coding assistant operating inside codework, a coding agent harness.`;
+//#region ../harness/src/plugin/lock.ts
+/** How long to wait for another holder before giving up. */
+const TIMEOUT = Duration.minutes(2);
+/** The holder refreshes the lock's mtime this often; one not refreshed for the timeout is stale. */
+const HEARTBEAT = Duration.seconds(15);
+const abandoned = (directory) => Effect.gen(function* () {
+	const info = yield* fileSystem.stat(directory);
+	const now = yield* Effect.clockWith((clock) => clock.currentTimeMillis);
+	return Option.exists(info.mtime, (mtime) => now - mtime.getTime() > Duration.toMillis(TIMEOUT));
+}).pipe(Effect.orElseSucceed(() => false));
+const heartbeat = (directory) => Effect.clockWith((clock) => clock.currentTimeMillis).pipe(Effect.flatMap((now) => fileSystem.utimes(directory, now, now)), Effect.ignore, Effect.repeat(Schedule.spaced(HEARTBEAT)));
 /**
-* Guidelines that hold regardless of which tools are registered.
+* Claims `directory` by creating it, polling while another process holds it, and releasing it when
+* the surrounding scope closes.
 *
-* Kept short on purpose. Every line here is spent on every request, so a line
-* earns its place only if a model measurably behaves worse without it.
+* One finalizer is registered for the whole wait rather than one per 50ms poll, and a single
+* attempt is `uninterruptible` so `mkdir` and recording ownership cannot be split -- an interrupt
+* between them would leave behind a lock the finalizer does not know to remove.
+*
+* `onTimeout` names the failure, because what a caller is waiting for is the caller's to describe.
 */
-const standingGuidelines = [
-	"Be concise. Report what you did and what you found, not what you are about to do.",
-	"Quote exact paths and command output rather than paraphrasing them.",
-	"If a command fails, read the error before retrying."
-];
-/** Collapse whitespace so two spellings of one guideline dedupe against each other. */
-const normalize = (value) => value.trim().replace(/\s+/g, " ");
+const lock = Effect.fn("PluginLock.acquire")(function* (directory, onTimeout) {
+	const held = yield* Ref.make(false);
+	yield* Effect.acquireRelease(Effect.void, () => Ref.get(held).pipe(Effect.flatMap((owned) => owned ? fileSystem.remove(directory, {
+		recursive: true,
+		force: true
+	}) : Effect.void), Effect.orDie));
+	if (!(yield* fileSystem.makeDirectory(directory).pipe(Effect.andThen(Ref.set(held, true)), Effect.as(true), Effect.catchIf((error) => error.reason._tag === "AlreadyExists", () => abandoned(directory).pipe(Effect.flatMap((stale) => stale ? fileSystem.remove(directory, {
+		recursive: true,
+		force: true
+	}).pipe(Effect.as(false)) : Effect.succeed(false)))), Effect.uninterruptible).pipe(Effect.repeat({
+		schedule: Schedule.spaced("50 millis"),
+		until: (owned) => owned
+	}), Effect.timeoutOrElse({
+		duration: TIMEOUT,
+		orElse: () => Effect.succeed(false)
+	})))) return yield* Effect.fail(onTimeout());
+	yield* Effect.forkScoped(heartbeat(directory));
+});
+//#endregion
+//#region ../harness/src/plugin/store.ts
+/** Facts about the *package*, and nothing about the plugin inside it. */
+const Marker = Schema.Struct({
+	spec: Schema.String,
+	name: Schema.String,
+	version: Schema.optional(Schema.String),
+	revision: Schema.optional(Schema.String),
+	/** Relative to the generation directory, so the marker survives the publishing rename. */
+	entrypoint: Schema.String,
+	createdAt: Schema.Finite
+});
+const MARKER = ".complete.json";
+const STAGING = ".staging-";
+const root = (cache) => hostPath.join(cache, "plugins", "v2");
 /**
-* Tool-contributed guidelines followed by the standing ones, normalized and
-* deduplicated with first occurrence winning.
+* A readable label, never an identity: two specs that slug alike share a parent directory and
+* nothing more. Worth having because a greppable path is worth real money when debugging, and a
+* bare hash throws away every clue.
+*/
+const slugOf = (target) => target.kind === "git" ? target.slug : canonical$1(target).replace(/^@/, "").replace(/[^a-zA-Z0-9._-]+/g, "-").replace(/^-+|-+$/g, "") || "package";
+/**
+* The **full** SHA-256 of the source identity: canonical spec plus effective registry for a
+* registry package, and the canonical spec alone for git.
 *
-* Tool order is bucket order, which is the same order the index renders in and the
-* same order the provider receives definitions in -- one ordering, not three.
+* Not truncated. The fast path proves a hit by checking that a marker *exists* rather than by
+* decoding it, and the index is keyed by digest alone, so a truncated digest would let a collision
+* return the wrong package silently.
 */
-const guidelines = (tools) => {
-	const seen = /* @__PURE__ */ new Set();
-	const collected = [];
-	for (const line of [...tools.flatMap((tool) => tool.promptGuidelines ?? []), ...standingGuidelines]) {
-		const normalized = normalize(line);
-		if (normalized.length === 0 || seen.has(normalized)) continue;
-		seen.add(normalized);
-		collected.push(normalized);
+const digest = Effect.fn("PluginStore.digest")(function* (target, cache, from) {
+	const source = target.kind === "registry" ? `${yield* registry(target, cache, from)}\0${target.spec}` : target.spec;
+	return Encoding.encodeHex(yield* crypto.digest("SHA-256", new TextEncoder().encode(source)));
+});
+const entryDir = Effect.fn("PluginStore.entryDir")(function* (target, cache, from) {
+	const key = yield* digest(target, cache, from);
+	return {
+		key,
+		directory: hostPath.join(root(cache), slugOf(target), key)
+	};
+});
+const failure$1 = (target, reason, message, cause) => new StoreError({
+	reason,
+	reference: target.spec,
+	message,
+	...cause === void 0 ? {} : { cause }
+});
+/** Generation directories, oldest first. A name that is not a number is not a generation. */
+const generations = Effect.fn("PluginStore.generations")(function* (directory) {
+	return (yield* fileSystem.readDirectory(directory).pipe(Effect.orElseSucceed(() => []))).filter((name) => /^\d+$/.test(name)).map((name) => Number(name)).sort((left, right) => left - right);
+});
+const readMarker = (directory) => fileSystem.readFileString(hostPath.join(directory, MARKER)).pipe(Effect.flatMap(Schema.decodeUnknownEffect(Schema.fromJsonString(Marker))), Effect.option);
+const entryOf = (marker, input) => ({
+	...marker,
+	digest: input.digest,
+	generation: input.generation,
+	directory: input.directory,
+	url: url(hostPath.resolve(input.directory, marker.entrypoint))
+});
+/** The newest generation that carries a marker. Unmarked ones are invisible: they never happened. */
+const active = Effect.fn("PluginStore.active")(function* (directory, key) {
+	for (const generation of (yield* generations(directory)).reverse()) {
+		const where = hostPath.join(directory, String(generation));
+		const marker = yield* readMarker(where);
+		if (Option.isSome(marker)) return entryOf(marker.value, {
+			digest: key,
+			generation,
+			directory: where
+		});
 	}
-	return collected;
-};
+});
+/** What the index files about an entry, all of it derivable from the spec and the marker. */
+const record = (target, entry, installedAt) => ({
+	spec: target.spec,
+	source: target.kind,
+	name: entry.name,
+	slug: slugOf(target),
+	mutable: target.mutable,
+	generation: entry.generation,
+	...entry.version === void 0 ? {} : { version: entry.version },
+	...entry.revision === void 0 ? {} : { revision: entry.revision },
+	entrypoint: entry.entrypoint,
+	installedAt
+});
 /**
-* The rendered tool index.
+* Disk-only lookup. No network, no install -- this is what boot uses, and the reason booting
+* offline works.
 *
-* `(none)` rather than an omitted section: a model told it has no tools behaves
-* better than one left to infer it from silence.
+* The index is consulted first and is only ever a hint: a hit is proved by the marker still
+* existing, and anything else falls through to a scan that repairs the index on the way past.
 */
-const toolIndex = (tools) => {
-	const listed = tools.filter((tool) => tool.promptSnippet !== void 0 && tool.promptSnippet.length > 0);
-	if (listed.length === 0) return "(none)";
-	return listed.map((tool) => `- ${tool.name}: ${tool.promptSnippet}`).join("\n");
-};
-const assemble = (input) => {
-	const sections = [input.promptCustom ?? foundation];
-	sections.push(`Available tools:\n${toolIndex(input.tools)}`);
-	const lines = guidelines(input.tools);
-	if (lines.length > 0) sections.push(`Guidelines:\n${lines.map((line) => `- ${line}`).join("\n")}`);
-	const append = input.promptSystemAppend?.trim();
-	if (append !== void 0 && append.length > 0) sections.push(append);
-	sections.push(`Current working directory: ${input.directory}`);
-	return sections.join("\n\n");
-};
+const resolve$2 = Effect.fn("PluginStore.resolve")(function* (target, cache, from) {
+	const { key, directory } = yield* entryDir(target, cache, from);
+	const base = root(cache);
+	const hinted = (yield* read(base)).get(key);
+	if (hinted !== void 0) {
+		const where = hostPath.join(directory, String(hinted.generation));
+		const marker = yield* readMarker(where);
+		if (Option.isSome(marker)) return entryOf(marker.value, {
+			digest: key,
+			generation: hinted.generation,
+			directory: where
+		});
+	}
+	const scanned = yield* active(directory, key);
+	if (scanned === void 0) return void 0;
+	yield* put(base, key, record(target, scanned, scanned.createdAt));
+	return scanned;
+}, Effect.mapError((cause) => Schema.is(StoreError)(cause) || Schema.is(InstallError)(cause) ? cause : new StoreError({
+	reason: "plugin-marker-invalid",
+	reference: "",
+	message: "cannot read the plugin store",
+	cause
+})));
 /**
-* A caller slot, awaited lazily. A throw or rejection fails the snapshot, which the
-* host attributes to this plugin's id.
+* `resolve`, for a caller that needs the entry rather than an answer about it.
+*
+* `plugin remove` uses this as its installer: it has to identify what an entry names without
+* fetching anything, and a spec with nothing filed is a real answer there -- the command reports
+* it and moves on.
 */
-const slot = (ctx, resolver) => Effect.tryPromise(() => Promise.resolve(resolver?.(ctx)));
-const defaultPromptPlugin = (0, plugin_exports.define)({
-	id: "codework.prompt.default",
-	kind: "prompt",
-	setup: Effect.fn("DefaultPromptPlugin.setup")(function* (ctx) {
-		const custom = yield* slot(ctx, ctx.config.promptCustom);
-		const append = yield* slot(ctx, ctx.config.promptSystemAppend);
-		ctx.plugin.prompt.set(assemble({
-			tools: ctx.plugin.tools.list(),
-			directory: ctx.location.directory,
-			...custom === void 0 ? {} : { promptCustom: custom },
-			...append === void 0 ? {} : { promptSystemAppend: append }
-		}));
-	})
+const required = Effect.fn("PluginStore.required")(function* (target, cache, from) {
+	const found = yield* resolve$2(target, cache, from);
+	if (found === void 0) return yield* failure$1(target, "plugin-not-installed", `${target.spec} is not installed`);
+	return found;
 });
-//#endregion
-//#region ../harness/src/tool/truncate.ts
 /**
-* Shared truncation utilities for tool outputs.
-*
-* Truncation is based on two independent limits — whichever is hit first
-* wins: a line limit and a byte limit. Lines are never split (except the bash
-* tail edge case where a single line exceeds the byte limit).
+* Install if absent; hand back what is filed if present.
 *
-* The bash tool uses {@link truncateTail} (keep the end — errors / final
-* results); file readers use {@link truncateHead} (keep the beginning).
-*/
-const DEFAULT_MAX_LINES = 2e3;
-const DEFAULT_MAX_BYTES = 51200;
-function splitLinesForCounting(content) {
-	if (content.length === 0) return [];
-	const lines = content.split("\n");
-	if (content.endsWith("\n")) lines.pop();
-	return lines;
-}
-/** Format bytes as a human-readable size. */
-function formatSize(bytes) {
-	if (bytes < 1024) return `${bytes}B`;
-	if (bytes < 1048576) return `${(bytes / 1024).toFixed(1)}KB`;
-	return `${(bytes / 1048576).toFixed(1)}MB`;
-}
-/**
-* Truncate content from the tail (keep the last N lines/bytes). Suitable for
-* bash output where the end matters (errors, final results). May return a
-* partial first line if the last line of the original content exceeds the byte
-* limit.
+* `refresh` forces past both the fast path and the double-check, which is what `update` needs and
+* nothing else should use.
 */
-function truncateTail(content, options = {}) {
-	const maxLines = options.maxLines ?? 2e3;
-	const maxBytes = options.maxBytes ?? 51200;
-	const totalBytes = Buffer.byteLength(content, "utf-8");
-	const lines = splitLinesForCounting(content);
-	const totalLines = lines.length;
-	if (totalLines <= maxLines && totalBytes <= maxBytes) return {
-		content,
-		truncated: false,
-		truncatedBy: null,
-		totalLines,
-		totalBytes,
-		outputLines: totalLines,
-		outputBytes: totalBytes,
-		lastLinePartial: false,
-		firstLineExceedsLimit: false,
-		maxLines,
-		maxBytes
-	};
-	const outputLinesArr = [];
-	let outputBytesCount = 0;
-	let truncatedBy = "lines";
-	let lastLinePartial = false;
-	for (let i = lines.length - 1; i >= 0 && outputLinesArr.length < maxLines; i--) {
-		const line = lines[i] ?? "";
-		const lineBytes = Buffer.byteLength(line, "utf-8") + (outputLinesArr.length > 0 ? 1 : 0);
-		if (outputBytesCount + lineBytes > maxBytes) {
-			truncatedBy = "bytes";
-			if (outputLinesArr.length === 0) {
-				const truncatedLine = truncateStringToBytesFromEnd(line, maxBytes);
-				outputLinesArr.unshift(truncatedLine);
-				outputBytesCount = Buffer.byteLength(truncatedLine, "utf-8");
-				lastLinePartial = true;
-			}
-			break;
+const add = Effect.fn("PluginStore.add")(function* (target, cache, options) {
+	return yield* Effect.gen(function* () {
+		const { key, directory } = yield* entryDir(target, cache, options.from);
+		if (options.refresh !== true) {
+			const found = yield* resolve$2(target, cache, options.from);
+			if (found !== void 0) return { entry: found };
 		}
-		outputLinesArr.unshift(line);
-		outputBytesCount += lineBytes;
-	}
-	if (outputLinesArr.length >= maxLines && outputBytesCount <= maxBytes) truncatedBy = "lines";
-	const outputContent = outputLinesArr.join("\n");
-	const finalOutputBytes = Buffer.byteLength(outputContent, "utf-8");
-	return {
-		content: outputContent,
-		truncated: true,
-		truncatedBy,
-		totalLines,
-		totalBytes,
-		outputLines: outputLinesArr.length,
-		outputBytes: finalOutputBytes,
-		lastLinePartial,
-		firstLineExceedsLimit: false,
-		maxLines,
-		maxBytes
-	};
-}
-/**
-* Truncate a string to fit within a byte limit (from the end). Handles
-* multi-byte UTF-8 characters correctly (never splits a codepoint).
-*/
-function truncateStringToBytesFromEnd(str, maxBytes) {
-	const buf = Buffer.from(str, "utf-8");
-	if (buf.length <= maxBytes) return str;
-	let start = buf.length - maxBytes;
-	while (start < buf.length && (buf[start] & 192) === 128) start++;
-	return buf.subarray(start).toString("utf-8");
-}
-//#endregion
-//#region ../harness/src/tool/accumulator.ts
-function defaultTempFilePath(prefix, suffix) {
-	return posix.join(tmpdir(), `${prefix}-${suffix}.log`);
-}
-function byteLength(text) {
-	return Buffer.byteLength(text, "utf-8");
-}
-var Accumulator = class {
-	maxLines;
-	maxBytes;
-	maxRollingBytes;
-	tempFilePrefix;
-	decoder = new TextDecoder();
-	rawChunks = [];
-	tailText = "";
-	tailBytes = 0;
-	tailStartsAtLineBoundary = true;
-	totalRawBytes = 0;
-	totalDecodedBytes = 0;
-	completedLines = 0;
-	totalLines = 0;
-	currentLineBytes = 0;
-	hasOpenLine = false;
-	finished = false;
-	tempFilePath;
-	tempFile;
-	constructor(options = {}) {
-		this.maxLines = options.maxLines ?? 2e3;
-		this.maxBytes = options.maxBytes ?? 51200;
-		this.maxRollingBytes = Math.max(this.maxBytes * 2, 1);
-		this.tempFilePrefix = options.tempFilePrefix ?? "codework-output";
-	}
-	append(data) {
-		return Effect.suspend(() => {
-			if (this.finished) return Effect.die(/* @__PURE__ */ new Error("cannot append to a finished output accumulator"));
-			this.totalRawBytes += data.length;
-			this.appendDecodedText(this.decoder.decode(data, { stream: true }));
-			if (this.tempFile !== void 0 || this.shouldUseTempFile()) return Effect.gen({ self: this }, function* () {
-				yield* this.ensureTempFile();
-				yield* this.tempFile.writeAll(data).pipe(Effect.orDie);
-			});
-			if (data.length > 0) this.rawChunks.push(data);
-			return Effect.void;
-		});
-	}
-	finish() {
-		return Effect.suspend(() => {
-			if (this.finished) return Effect.void;
-			this.finished = true;
-			this.appendDecodedText(this.decoder.decode());
-			return Effect.gen({ self: this }, function* () {
-				if (this.shouldUseTempFile()) yield* this.ensureTempFile();
-				if (this.tempFile !== void 0) yield* this.tempFile.sync.pipe(Effect.orDie);
-			});
+		yield* fileSystem.makeDirectory(directory, { recursive: true });
+		yield* lock(hostPath.join(directory, ".lock"), () => failure$1(target, "plugin-lock-timeout", `timed out waiting for another installation of ${target.spec}`));
+		const current = yield* active(directory, key);
+		if (current !== void 0 && options.refresh !== true) return { entry: current };
+		const real = yield* fileSystem.realPath(directory).pipe(Effect.orElseSucceed(() => directory));
+		const staging = yield* Effect.acquireRelease(fileSystem.makeTempDirectory({
+			directory: real,
+			prefix: STAGING
+		}), (staged) => fileSystem.remove(staged, {
+			recursive: true,
+			force: true
+		}).pipe(Effect.orDie));
+		yield* fileSystem.writeFileString(hostPath.join(staging, "package.json"), "{\"private\":true,\"type\":\"module\"}");
+		const fetched = yield* download({
+			target,
+			into: staging,
+			cache,
+			from: options.from,
+			...options.runner === void 0 ? {} : { runner: options.runner }
 		});
-	}
-	snapshot() {
-		const tailTruncation = truncateTail(this.getSnapshotText(), {
-			maxLines: this.maxLines,
-			maxBytes: this.maxBytes
+		if (current !== void 0 && current.revision === fetched.revision) return { entry: current };
+		const validated = yield* options.validate(fetched);
+		const entrypoint = hostPath.relative(yield* fileSystem.realPath(staging), fetched.entrypoint);
+		if (entrypoint.startsWith("..") || hostPath.isAbsolute(entrypoint)) return yield* new InstallError({
+			reason: "plugin-no-entrypoint",
+			reference: target.spec,
+			message: `entrypoint escapes its installation: ${entrypoint}`
 		});
-		const truncated = this.totalLines > this.maxLines || this.totalDecodedBytes > this.maxBytes;
-		const truncatedBy = truncated ? tailTruncation.truncatedBy ?? (this.totalDecodedBytes > this.maxBytes ? "bytes" : "lines") : null;
-		const truncation = {
-			...tailTruncation,
-			truncated,
-			truncatedBy,
-			totalLines: this.totalLines,
-			totalBytes: this.totalDecodedBytes,
-			maxLines: this.maxLines,
-			maxBytes: this.maxBytes
+		const now = yield* Effect.clockWith((clock) => clock.currentTimeMillis);
+		const marker = {
+			spec: target.spec,
+			name: fetched.name,
+			...fetched.version === void 0 ? {} : { version: fetched.version },
+			...fetched.revision === void 0 ? {} : { revision: fetched.revision },
+			entrypoint,
+			createdAt: now
 		};
+		yield* fileSystem.writeFileString(hostPath.join(staging, MARKER), yield* Schema.encodeEffect(Schema.fromJsonString(Marker))(marker));
+		const previous = (yield* generations(directory)).at(-1) ?? 0;
+		const generation = Math.max(now, previous + 1);
+		const published = hostPath.join(directory, String(generation));
+		yield* fileSystem.rename(staging, published);
+		const entry = entryOf(marker, {
+			digest: key,
+			generation,
+			directory: published
+		});
+		yield* put(root(cache), key, record(target, entry, now));
+		yield* collect$1(directory);
 		return {
-			content: truncation.content,
-			truncation,
-			...this.tempFilePath === void 0 ? {} : { fullOutputPath: this.tempFilePath }
+			entry,
+			validated
 		};
-	}
-	/** Bytes in the final (possibly unterminated) line — for the partial-line footer. */
-	getLastLineBytes() {
-		return this.currentLineBytes;
-	}
-	appendDecodedText(text) {
-		if (text.length === 0) return;
-		const bytes = byteLength(text);
-		this.totalDecodedBytes += bytes;
-		this.tailText += text;
-		this.tailBytes += bytes;
-		if (this.tailBytes > this.maxRollingBytes * 2) this.trimTail();
-		let newlines = 0;
-		let lastNewline = -1;
-		for (let i = text.indexOf("\n"); i !== -1; i = text.indexOf("\n", i + 1)) {
-			newlines++;
-			lastNewline = i;
-		}
-		if (newlines === 0) {
-			this.currentLineBytes += bytes;
-			this.hasOpenLine = true;
-		} else {
-			this.completedLines += newlines;
-			const tail = text.slice(lastNewline + 1);
-			this.currentLineBytes = byteLength(tail);
-			this.hasOpenLine = tail.length > 0;
-		}
-		this.totalLines = this.completedLines + (this.hasOpenLine ? 1 : 0);
-	}
-	trimTail() {
-		const buffer = Buffer.from(this.tailText, "utf-8");
-		if (buffer.length <= this.maxRollingBytes) {
-			this.tailBytes = buffer.length;
-			return;
+	}).pipe(Effect.scoped, Effect.mapError((cause) => Schema.is(InstallError)(cause) || Schema.is(StoreError)(cause) || Schema.is(LoadError)(cause) ? cause : failure$1(target, "plugin-marker-invalid", `cannot write the store entry for ${target.spec}`, cause)));
+});
+/**
+* Expire what is superseded.
+*
+* The two newest generations are kept regardless of age: the newest is live, and the one before it
+* may still be imported by an exchange in flight. Runs at the end of an `add` that published
+* something -- no timer and no sweeper, because installs are the only thing that creates garbage.
+*/
+const collect$1 = Effect.fn("PluginStore.collect")(function* (directory) {
+	const now = yield* Effect.clockWith((clock) => clock.currentTimeMillis);
+	const keep = new Set((yield* generations(directory)).slice(-2).map(String));
+	const names = yield* fileSystem.readDirectory(directory).pipe(Effect.orElseSucceed(() => []));
+	for (const name of names) {
+		if (keep.has(name) || name === ".lock") continue;
+		if (name.startsWith(STAGING)) {
+			const started = yield* fileSystem.stat(hostPath.join(directory, name)).pipe(Effect.option);
+			if ((Option.isNone(started) ? 0 : Option.match(started.value.mtime, {
+				onNone: () => 0,
+				onSome: (at) => now - at.getTime()
+			})) > HOUR) yield* fileSystem.remove(hostPath.join(directory, name), {
+				recursive: true,
+				force: true
+			}).pipe(Effect.ignore);
+			continue;
 		}
-		let start = buffer.length - this.maxRollingBytes;
-		while (start < buffer.length && (buffer[start] & 192) === 128) start++;
-		this.tailStartsAtLineBoundary = start === 0 ? this.tailStartsAtLineBoundary : buffer[start - 1] === 10;
-		this.tailText = buffer.subarray(start).toString("utf-8");
-		this.tailBytes = byteLength(this.tailText);
-	}
-	getSnapshotText() {
-		if (this.tailStartsAtLineBoundary) return this.tailText;
-		const firstNewline = this.tailText.indexOf("\n");
-		return firstNewline === -1 ? this.tailText : this.tailText.slice(firstNewline + 1);
-	}
-	shouldUseTempFile() {
-		return this.totalRawBytes > this.maxBytes || this.totalDecodedBytes > this.maxBytes || this.totalLines > this.maxLines;
-	}
-	ensureTempFile() {
-		if (this.tempFile !== void 0) return Effect.void;
-		return Effect.gen({ self: this }, function* () {
-			const suffix = Encoding.encodeHex(yield* crypto.randomBytes(8));
-			this.tempFilePath = defaultTempFilePath(this.tempFilePrefix, suffix);
-			this.tempFile = yield* fileSystem.open(this.tempFilePath, { flag: "w" });
-			for (const chunk of this.rawChunks) yield* this.tempFile.writeAll(chunk);
-			this.rawChunks = [];
-		}).pipe(Effect.orDie);
+		if (!/^\d+$/.test(name)) continue;
+		if (now - Number(name) > WEEK) yield* fileSystem.remove(hostPath.join(directory, name), {
+			recursive: true,
+			force: true
+		}).pipe(Effect.ignore);
 	}
-};
-//#endregion
-//#region ../harness/src/tool/progress.ts
-var progress_exports = /* @__PURE__ */ __exportAll({});
-import * as import__codeworksh_plugin_tool_progress from "@codeworksh/plugin/tool/progress";
-__reExport(progress_exports, import__codeworksh_plugin_tool_progress);
-//#endregion
-//#region ../harness/src/tool/shell.ts
+});
+const HOUR = 36e5;
+const WEEK = 168 * HOUR;
 /**
-* `ToolShell` — the tool-owned, cancellable command-execution capability the bash tool depends on.
-*
-* It deliberately does **not** reuse `sandbox/Shell` directly: the local OS path
-* provides no `Shell` at all, and `sandbox/Shell` models neither cancellation
-* nor a timeout. `ToolShell` makes both part of the contract. Adapters honor the
-* mid-flight process kill where the SDK allows it (local, Vercel) and fall back
-* to the timeout where it does not (Daytona) — "kill where it's easy".
+* How long a network answer is reused before `check` asks again.
 *
-* Two modes, and Local has two variants:
-*   - Local / full OS shell  → {@link local} (default)
-*   - Local / just-bash      → {@link fromSandboxShell} over `EnvBash`
-*   - Remote / provider      → {@link fromSandboxShell} over `EnvDaytona` / `EnvVercel`
+* Persisted in the index rather than held in memory, because the thing that benefits is a command
+* that exits: an in-memory staleness cache is worthless to `codework plugin check`.
 */
-/** Infra/spawn failure — not model-actionable; handlers should treat it as a defect. */
-var ToolShellError = class extends Schema.TaggedError()("ToolShellError", {
-	command: Schema.String,
-	cause: Schema.optional(Schema.Defect())
-}) {};
-/** The command exceeded its deadline. Distinct so handlers can map it to a domain timeout. */
-var ToolShellTimeout = class extends Schema.TaggedError()("ToolShellTimeout", {
-	command: Schema.String,
-	timeoutMillis: Schema.Finite
-}) {};
-const widenExecError = (effect) => effect.pipe(Effect.mapError((error) => error));
-var ToolShell = class extends Context.Service()("@codeworksh/harness/tool/shell/ToolShell") {};
+const CHECK_TTL = 36e5;
 /**
-* Bridge the existing `sandbox/Shell` into a `ToolShell`. Used for just-bash
-* (in-process) and remote providers.
+* Is a newer revision available?
 *
-* `cwd` and `env` both pass through to the backing `sandbox/Shell`, which
-* resolves a relative `cwd` against its mount. The buffered `exec`
-* timeout is enforced here with `Effect.timeoutOption` (interruption always
-* returns control; the underlying command is only truly killed mid-flight on
-* signal-aware backends, handled in the provider layer). When the backend exposes
-* `stream` (e.g. Vercel `Command.logs`), it is bridged to {@link IToolShell.stream}
-* so the bash tool streams over it too.
+* The only network call in the store's vocabulary, and it is the caller's to make. A `probe` that
+* fails -- offline, registry down, a remote that refuses -- propagates rather than answering
+* `current`: an outage must not read as "you are up to date".
 */
-const fromSandboxShell = Layer.effect(ToolShell, Effect.gen(function* () {
-	const shell = yield* shell_exports.Shell;
-	const exec = (command, options) => {
-		const run = shell.exec(command, {
-			...options?.env ? { env: options.env } : {},
-			...options?.cwd ? { cwd: options.cwd } : {}
-		}).pipe(Effect.mapError((cause) => new ToolShellError({
-			command,
-			cause
-		})));
-		if (options?.timeout === void 0) return widenExecError(run);
-		const timeout = options.timeout;
-		return run.pipe(Effect.timeoutOption(timeout), Effect.flatMap(Option.match({
-			onNone: () => Effect.fail(new ToolShellTimeout({
-				command,
-				timeoutMillis: Duration.toMillis(timeout)
-			})),
-			onSome: Effect.succeed
-		})));
+const check = Effect.fn("PluginStore.check")(function* (target, cache, options) {
+	if (!target.mutable) return { _tag: "immutable" };
+	const entry = yield* resolve$2(target, cache, options.from);
+	if (entry === void 0) return { _tag: "not-installed" };
+	const key = yield* digest(target, cache, options.from).pipe(Effect.mapError((cause) => failure$1(target, "plugin-marker-invalid", `cannot address ${target.spec}`, cause)));
+	const base = root(cache);
+	const record = (yield* read(base)).get(key);
+	const now = yield* Effect.clockWith((clock) => clock.currentTimeMillis);
+	if (options.refresh !== true && record?.checkedAt !== void 0 && now - record.checkedAt < CHECK_TTL && (record.outdated !== true || record.available !== void 0)) return record.outdated === true ? {
+		_tag: "outdated",
+		available: record.available,
+		...entry.revision === void 0 ? {} : { filed: entry.revision }
+	} : {
+		_tag: "current",
+		...entry.revision === void 0 ? {} : { revision: entry.revision }
 	};
-	const sandboxStream = shell.stream;
-	const stream = sandboxStream ? (command, options) => sandboxStream(command, {
-		...options?.env ? { env: options.env } : {},
-		...options?.cwd ? { cwd: options.cwd } : {}
-	}).pipe(Stream.map((chunk) => chunk._tag === "exit" ? {
-		_tag: "Exit",
-		exitCode: chunk.exitCode
+	const available = yield* options.probe(target);
+	if (available === void 0) return {
+		_tag: "current",
+		...entry.revision === void 0 ? {} : { revision: entry.revision }
+	};
+	const outdated = available !== entry.revision;
+	yield* patch(base, key, {
+		checkedAt: now,
+		outdated,
+		available
+	});
+	return outdated ? {
+		_tag: "outdated",
+		available,
+		...entry.revision === void 0 ? {} : { filed: entry.revision }
+	} : {
+		_tag: "current",
+		...entry.revision === void 0 ? {} : { revision: entry.revision }
+	};
+});
+/**
+* Refresh a mutable target, if the network says there is anything to refresh.
+*
+* `add` with `refresh` is what does the work; this is the guard in front of it, so an `update`
+* that finds nothing new neither stages nor publishes.
+*/
+const update = Effect.fn("PluginStore.update")(function* (target, cache, options) {
+	const current = yield* resolve$2(target, cache, options.from);
+	if (current === void 0) return { _tag: "not-installed" };
+	if ((yield* check(target, cache, {
+		refresh: true,
+		probe: options.probe,
+		from: options.from
+	}))._tag !== "outdated") return {
+		_tag: "unchanged",
+		entry: current
+	};
+	const added = yield* add(target, cache, {
+		refresh: true,
+		validate: options.validate,
+		from: options.from,
+		...options.runner === void 0 ? {} : { runner: options.runner }
+	});
+	return added.entry.generation === current.generation ? {
+		_tag: "unchanged",
+		entry: current
 	} : {
-		_tag: "Output",
-		bytes: chunk.bytes
-	}), Stream.mapError((cause) => new ToolShellError({
-		command,
-		cause
-	}))) : void 0;
-	return ToolShell.of(stream ? {
-		exec,
-		stream
-	} : { exec });
-}));
-Duration.seconds(1);
-//#endregion
-//#region ../harness/src/tool/tool.ts
-var tool_exports = /* @__PURE__ */ __exportAll({});
-import * as import__codeworksh_plugin_tool from "@codeworksh/plugin/tool";
-__reExport(tool_exports, import__codeworksh_plugin_tool);
-//#endregion
-//#region ../harness/src/plugin/builtin/tool/bash.ts
+		_tag: "updated",
+		entry: added.entry,
+		...added.validated === void 0 ? {} : { validated: added.validated }
+	};
+});
+Effect.fn("PluginStore.remove")(function* (target, cache, from) {
+	const { key, directory } = yield* entryDir(target, cache, from);
+	const existed = yield* fileSystem.exists(directory).pipe(Effect.orElseSucceed(() => false));
+	yield* fileSystem.remove(directory, {
+		recursive: true,
+		force: true
+	}).pipe(Effect.ignore);
+	yield* drop(root(cache), key);
+	return existed;
+});
+Effect.fn("PluginStore.all")(function* (cache) {
+	const base = root(cache);
+	const slugs = yield* fileSystem.readDirectory(base).pipe(Effect.orElseSucceed(() => []));
+	const found = [];
+	for (const slug of slugs) {
+		const digests = yield* fileSystem.readDirectory(hostPath.join(base, slug)).pipe(Effect.orElseSucceed(() => []));
+		for (const key of digests) {
+			const entry = yield* active(hostPath.join(base, slug, key), key);
+			if (entry !== void 0) found.push(entry);
+		}
+	}
+	return found;
+});
+const Id = Schema.String.check(Schema.isPattern(/^[a-z0-9][a-z0-9-]*(\.[a-z0-9][a-z0-9-]*){2}$/));
+const Definition = Schema.Struct({
+	id: Id,
+	kind: Schema.Literals(Object.keys(plugin_exports.domains)),
+	events: Schema.optional(Schema.Array(Schema.declare((value) => Predicate.hasProperty(value, "type") && Predicate.isString(value.type)))),
+	setup: Schema.declare((value) => Predicate.isFunction(value))
+});
+/** Every plugin failure says which file to go and edit, when there is one. */
+const where = (origin) => origin.file === void 0 ? {} : { file: origin.file };
+const detail = (cause) => cause instanceof Error ? cause.message : typeof cause === "string" ? cause : String(cause);
+/** A reference that does not name anything loadable. */
+const sourceFailure = (origin, cause) => Schema.is(SourceError)(cause) ? cause : new SourceError({
+	reason: "plugin-not-found",
+	reference: origin.reference,
+	...where(origin),
+	message: detail(cause)
+});
+/** Node's own code for a failure, when it set one. */
+const codeOf = (cause) => Predicate.hasProperty(cause, "code") && Predicate.isString(cause.code) ? cause.code : void 0;
 /**
-* The self-contained bash plugin — a worked example for tool plugins. The definition is pure data;
-* the handler depends only on {@link ToolShell} / {@link ToolProgress}, never
-* `sandbox/Shell`, so the backend (local OS / just-bash / remote provider) is
-* swapped by changing the provided Layer with no change to the tool.
+* A module that would not import.
 *
-* Two execution paths, picked by capability:
-*   - **variant A (buffered)** otherwise: `ToolShell.exec` returns the full output,
-*     truncated once after completion.
-*   - **variant B (streaming)** when the backend offers `ToolShell.stream`: output
-*     flows through an {@link Accumulator} (bounded memory + temp-file spill)
-*     and is reported live via {@link ToolProgress}; on timeout the partial output
-*     produced so far is preserved.
+* Two of these get their own reason, because the remedy differs and that is the whole value of a
+* slug. A missing dependency means the plugin is fine and its `node_modules` is not, which a
+* person fixes in the package rather than in their settings. An uncompiled one means the plugin
+* shipped its sources: Node refuses to strip types under `node_modules`, and installing a plugin
+* runs no lifecycle scripts, so a `prepare` build never happens either -- the author has to ship
+* the build output, and nothing the user can do to their settings will help.
 *
-* Success and failure carry the *same* structured shape
-* (`output`, `exitCode`, `truncated`, `fullOutputPath`)
-* — a non-zero exit is just `exitCode !== 0`, not a different kind of result.
+* `ERR_UNSUPPORTED_NODE_MODULES_TYPE_STRIPPING` is matched by code rather than by message: it is
+* Node's documented identifier and exact, where the wording is free to change under us. Only an
+* installed plugin can reach it -- a local path lives outside `node_modules`, where Node strips
+* types happily, which is what keeps the single-file dev workflow working.
 */
-const BashParams = Schema.Struct({
-	command: Schema.String.annotate({ description: "The bash command to execute." }),
-	timeout: Schema.optional(Schema.Finite.check(Schema.isGreaterThan(0)).annotate({ description: "Optional timeout in seconds (must be greater than 0)." }))
+const importFailure = (origin, cause) => new LoadError({
+	reason: codeOf(cause) === "ERR_UNSUPPORTED_NODE_MODULES_TYPE_STRIPPING" ? "plugin-not-compiled" : /cannot find (package|module)/i.test(detail(cause)) ? "plugin-missing-dependency" : "plugin-import-failed",
+	reference: origin.reference,
+	...where(origin),
+	message: detail(cause),
+	cause
 });
-const outputFields = {
-	/** Combined stdout + stderr, truncated for display (full output is on disk when `truncated`). */
-	output: Schema.String,
-	truncated: Schema.Boolean,
-	fullOutputPath: Schema.optional(Schema.String)
-};
-const BashSuccess = Schema.Struct({
-	...outputFields,
-	exitCode: Schema.Finite
+/** A module that imported and is not a plugin. */
+const definitionFailure = (origin, cause, id) => new LoadError({
+	reason: "plugin-invalid-definition",
+	reference: origin.reference,
+	...where(origin),
+	message: detail(cause),
+	...id === void 0 ? {} : { id },
+	cause
 });
-/** Non-zero exit — expected, model-visible. Carries the same shape as success. */
-var BashFailed = class extends Schema.TaggedError()("BashFailed", {
-	...outputFields,
-	exitCode: Schema.Finite
-}) {};
-/** Deadline exceeded — expected, model-visible. Carries the partial output produced so far. */
-var BashTimedOut = class extends Schema.TaggedError()("BashTimedOut", {
-	...outputFields,
-	timeoutSeconds: Schema.Finite
-}) {};
-const BashFailure = Schema.Union([BashFailed, BashTimedOut]);
-const bashDef = tool_exports.define({
-	name: "bash",
-	label: "bash",
-	promptSnippet: "Execute bash commands (ls, grep, find, etc.).",
-	description: `Execute a bash command in the working directory and return its combined stdout/stderr output. Output is truncated to the last ${DEFAULT_MAX_LINES} lines or ${DEFAULT_MAX_BYTES}KB (whichever is hit first); when truncated, the full output is saved to a temp file. A non-zero exit code is reported as an error carrying the captured output.`,
-	parameters: BashParams,
-	success: BashSuccess,
-	failure: BashFailure,
-	encodeContent: (success) => [{
-		type: "text",
-		text: success.output
-	}],
-	encodeFailureContent: (failure) => [{
-		type: "text",
-		text: failure.output
-	}]
+const validate = Effect.fn("PluginLoader.validate")(function* (input, origin, builtin = false) {
+	yield* Schema.decodeUnknownEffect(Definition)(input).pipe(Effect.mapError((cause) => definitionFailure(origin, cause)));
+	const plugin = input;
+	if (!builtin && plugin.id.startsWith("codework.")) return yield* definitionFailure(origin, /* @__PURE__ */ new Error("codework namespace is reserved for builtins"), plugin.id);
+	return plugin;
 });
-/** Combine stdout and stderr into one stream of text, stderr after stdout. */
-const combineOutput = (stdout, stderr) => {
-	if (stderr.length === 0) return stdout;
-	if (stdout.length === 0) return stderr;
-	return `${stdout}\n${stderr}`;
-};
-/** One-line footer appended to truncated, model-facing output. */
-const footer = (t, fullOutputPath, lastLineBytes) => {
-	const where = fullOutputPath ? ` Full output: ${fullOutputPath}` : "";
-	const startLine = t.totalLines - t.outputLines + 1;
-	if (t.lastLinePartial) {
-		const lineSize = lastLineBytes !== void 0 ? ` (line is ${formatSize(lastLineBytes)})` : "";
-		return `\n\n[showing last ${formatSize(t.outputBytes)} of line ${t.totalLines}${lineSize}.${where}]`;
+const Manifest = Schema.Struct({
+	name: Schema.optional(Schema.String),
+	exports: Schema.optional(Schema.Unknown)
+});
+const localUrl = Effect.fn("PluginLoader.localUrl")(function* (location, origin) {
+	const escapes = (message) => new SourceError({
+		reason: "plugin-escapes-root",
+		reference: origin.reference,
+		...where(origin),
+		message
+	});
+	if ((yield* fileSystem.stat(location)).type !== "Directory") return { url: yield* Effect.try(() => resolveModule(location, hostPath.dirname(location))) };
+	const manifestPath = hostPath.join(location, "package.json");
+	if (!(yield* fileSystem.exists(manifestPath))) return { url: yield* Effect.try(() => resolveModule("./index", location)) };
+	const manifest = yield* fileSystem.readFileString(manifestPath).pipe(Effect.flatMap(Schema.decodeUnknownEffect(Schema.fromJsonString(Manifest))));
+	if (manifest.exports !== void 0) {
+		const name = manifest.name;
+		if (!name) return yield* escapes("a local package with exports must declare its name");
+		const url = yield* Effect.try(() => resolveModule(name, location));
+		const resolved = yield* fileSystem.realPath(fileURLToPath(url));
+		if (hostPath.relative(yield* fileSystem.realPath(location), resolved).startsWith("..")) return yield* escapes("package export escapes its root");
+		return {
+			url: pathToFileURL(resolved).href,
+			name
+		};
 	}
-	if (t.truncatedBy === "lines") return `\n\n[showing lines ${startLine}-${t.totalLines} of ${t.totalLines}.${where}]`;
-	return `\n\n[showing lines ${startLine}-${t.totalLines} of ${t.totalLines} (${formatSize(t.maxBytes)} limit).${where}]`;
+	const url = yield* Effect.try(() => resolveModule(createRequire(pathToFileURL(manifestPath)).resolve(location), location));
+	return manifest.name === void 0 ? { url } : {
+		url,
+		name: manifest.name
+	};
+});
+/**
+* Install a package into the store, importing and validating it **while it is still staged**.
+*
+* The validation is passed down rather than done afterwards for one reason: the store publishes by
+* rename, so a package that turns out not to be a plugin must be rejected before it is published.
+* Publishing first would make the broken generation the newest marked one, which `resolve` returns
+* forever after -- and re-running `add` would hit the fast path and return it again.
+*/
+const install = Effect.fn("PluginLoader.install")(function* (target, cache, origin, options) {
+	const added = yield* add(target, cache, {
+		from: anchor$1(origin.file, options.hostDir),
+		validate: (fetched) => imported(url(fetched.entrypoint), origin, options.import)
+	});
+	return {
+		url: added.entry.url,
+		...added.entry.version === void 0 ? {} : { version: added.entry.version },
+		generation: added.entry.generation,
+		...added.validated === void 0 ? {} : { plugin: added.validated }
+	};
+});
+/**
+* The directory whose `.npmrc` chain names the artifact a reference resolves to: the project that
+* declared it. A settings file sits in `<root>/.codework/`, but npm reads a project `.npmrc` at the
+* package boundary discovered upward from the chain's start -- the root itself -- so anchoring at
+* the file's own directory would miss it. Absent a declaring file the host context stands in.
+*/
+const anchor$1 = (file, fallback) => {
+	if (file === void 0) return fallback;
+	const directory = hostPath.dirname(file);
+	return hostPath.basename(directory) === ".codework" ? hostPath.dirname(directory) : directory;
 };
-/** Write full output to a host temp file (best-effort; undefined on failure). */
-const spillToTempFile = (content) => Effect.gen(function* () {
-	const suffix = Encoding.encodeHex(yield* crypto.randomBytes(6));
-	const path = posix.join(tmpdir(), `codework-bash-${suffix}.log`);
-	yield* fileSystem.writeFileString(path, content);
-	return path;
-}).pipe(Effect.orElseSucceed(() => void 0));
-/** Variant A: truncate the buffered output once, spilling the full output if truncated. */
-const presentBuffered = (combined) => Effect.gen(function* () {
-	const t = truncateTail(combined);
-	if (!t.truncated) return {
-		output: t.content,
-		truncated: false
+/** The default installer, or the one the caller injected. */
+const installer = (target, origin, options) => options.install === void 0 ? install(target, options.cache, origin, options) : options.install(target, options.cache, anchor$1(origin.file, options.hostDir));
+/** Import a module and confirm it default-exports a plugin. */
+const imported = Effect.fn("PluginLoader.imported")(function* (url, origin, load) {
+	const module = yield* Effect.tryPromise({
+		try: () => (load ?? importModule)(url),
+		catch: (cause) => importFailure(origin, cause)
+	});
+	return yield* validate(Predicate.isObject(module) && "default" in module ? module.default : void 0, origin);
+});
+/**
+* Import one entrypoint and confirm it is a plugin, without touching the store.
+*
+* This is what a caller hands the store as its `validate`: the artifact is checked while it is
+* still staged, so a package that turns out not to be a plugin is never published.
+*/
+const definition$1 = (entrypoint, reference) => imported(url(entrypoint), {
+	index: 0,
+	reference
+});
+/**
+* Install and import one reference, and report what it turned out to be, without selecting it.
+* `codework plugin add` uses this to prove a package really is a plugin before it writes the
+* reference into a settings file: the failure a user gets is the one they can act on — a bad
+* spec, an install that did not resolve, a module that exports no plugin — rather than a broken
+* configuration that only fails at the next run.
+*/
+const inspect = Effect.fn("PluginLoader.inspect")(function* (reference, options) {
+	const origin = {
+		index: 0,
+		reference,
+		file: options.file
 	};
-	const fullOutputPath = yield* spillToTempFile(combined);
+	const target = yield* parse$2(reference, options.hostDir);
+	const loaded = yield* load$3(target, origin, options);
 	return {
-		output: t.content + footer(t, fullOutputPath),
-		truncated: true,
-		...fullOutputPath !== void 0 ? { fullOutputPath } : {}
+		id: loaded.plugin.id,
+		...loaded.version === void 0 ? {} : { version: loaded.version },
+		...loaded.name === void 0 ? {} : { name: loaded.name }
 	};
 });
-/** Variant B: present an accumulator snapshot (the temp file is spilled incrementally). */
-const presentSnapshot = (snap, lastLineBytes) => {
-	if (!snap.truncation.truncated) return {
-		output: snap.content,
-		truncated: false
-	};
+const load$3 = Effect.fn("PluginLoader.load")(function* (target, origin, options) {
+	const installed = yield* target.kind === "local" ? localUrl(target.path, origin).pipe(Effect.mapError((cause) => sourceFailure(origin, cause))) : installer(target, origin, options).pipe(Effect.mapError((cause) => origin.file === void 0 ? cause : declaredIn(cause, origin.file)));
+	const address = target.kind === "local" && options.reload !== void 0 && options.reload > 0 ? `${installed.url}?reload=${options.reload}` : installed.url;
 	return {
-		output: snap.content + footer(snap.truncation, snap.fullOutputPath, lastLineBytes),
-		truncated: true,
-		...snap.fullOutputPath !== void 0 ? { fullOutputPath: snap.fullOutputPath } : {}
+		plugin: installed.plugin ?? (yield* imported(address, origin, options.import)),
+		source: origin.reference,
+		..."version" in installed && installed.version !== void 0 ? { version: installed.version } : {},
+		..."generation" in installed && installed.generation !== void 0 ? { generation: installed.generation } : {},
+		...installed.name === void 0 ? {} : { name: installed.name }
 	};
-};
-/** Variant A — buffered: one `exec`, truncate after completion. No live progress. */
-const runBuffered = (shell, params) => Effect.gen(function* () {
-	const result = yield* shell.exec(params.command, params.timeout !== void 0 ? { timeout: Duration.seconds(params.timeout) } : void 0).pipe(Effect.catchTags({
-		ToolShellTimeout: (timeout) => Effect.fail(new BashTimedOut({
-			timeoutSeconds: timeout.timeoutMillis / 1e3,
-			output: "",
-			truncated: false
-		})),
-		ToolShellError: (cause) => Effect.die(cause)
-	}));
-	const present = yield* presentBuffered(combineOutput(result.stdout, result.stderr));
-	if (result.exitCode !== 0) return yield* new BashFailed({
-		exitCode: result.exitCode,
-		...present
-	});
+});
+/**
+* The version-free, location-anchored spelling of a reference.
+*
+* Two references naming the same module compare equal through it: `@acme/x@1.2.0` and `@acme/x`
+* are one package, and `./plugins/x.ts` is the file it resolves to from the directory that
+* declared it. Pure -- nothing is installed, imported or read.
+*/
+const canonical = (reference, hostDir) => Effect.map(parse$2(reference, hostDir), canonical$1);
+//#endregion
+//#region ../harness/src/plugin/catalog.ts
+/**
+* A definition carries `setup`; a patch carries `plugin` or `package` and no `setup`. Checking
+* `setup` first matters because `Plugin` permits extra properties, so a definition holding its
+* own `plugin` property must not be read as configuration.
+*
+* e.g
+* "acme/tool@1.2.0"                    → module (load me)
+* define({id, kind, setup, ...})       → module (I AM the definition — embedder code only)
+* { plugin: "x", enabled: false }      → config (don't load — adjust something already loaded)
+*
+* setup present → definition, always (even with a stray plugin: key)
+* setup absent + plugin:/package: present → config patch
+* setup absent + neither key → malformed
+*/
+const isPatch = (reference) => Predicate.isObject(reference) && !Predicate.isFunction(reference) && !("setup" in reference) && ("plugin" in reference || "package" in reference);
+/**
+* The **load pass**: store lookup and ESM import, never the network.
+*
+* Runs at boot, at `reload`, and at any exchange that finds a reference it cannot satisfy. It
+* deliberately knows nothing about `enabled`, options or order -- those are data over modules that
+* are already loaded, they cost a walk of a short array, and they belong to every exchange.
+*
+* Loading is keyed by what a reference resolves to, so naming one module twice imports it once.
+*/
+const load$2 = Effect.fn("PluginCatalog.load")(function* (references, options) {
+	const plugins = /* @__PURE__ */ new Map();
+	const aliases = /* @__PURE__ */ new Map();
+	const versions = /* @__PURE__ */ new Map();
+	const origins = /* @__PURE__ */ new Map();
+	const seen = /* @__PURE__ */ new Map();
+	const remember = (plugin, names, from) => {
+		plugins.set(plugin.id, plugin);
+		aliases.set(plugin.id, plugin.id);
+		for (const name of names) aliases.set(name, plugin.id);
+		if (from?.version !== void 0) versions.set(plugin.id, from.version);
+		if (from !== void 0) origins.set(plugin.id, from.origin);
+	};
+	/** Source metadata exists for diagnostics; a silent ID replacement is where it earns that. */
+	const note = (plugin, source) => plugins.has(plugin.id) ? Effect.logDebug(`plugin ${plugin.id} redefined by ${source}; the earlier definition is discarded`) : Effect.void;
+	for (const builtin of options.builtins) remember(yield* validate(builtin, {
+		index: -1,
+		reference: builtin.id
+	}, true), []);
+	for (const [index, reference] of references.entries()) {
+		if (isPatch(reference)) continue;
+		const declared = typeof reference === "string" ? reference : Predicate.hasProperty(reference, "id") ? reference.id : void 0;
+		const named = typeof declared === "string" ? declared : `<plugin object #${index}>`;
+		const origin = {
+			index,
+			reference: named,
+			file: options.declared?.get(named)
+		};
+		if (typeof reference !== "string") {
+			if (typeof declared === "string" && plugins.get(declared) === reference) continue;
+			const plugin = yield* validate(reference, origin);
+			yield* note(plugin, "a supplied object");
+			remember(plugin, []);
+			continue;
+		}
+		const target = yield* parse$2(reference, options.hostDir);
+		const key = target.kind === "local" ? target.path : target.spec;
+		const already = seen.get(key);
+		if (already !== void 0) {
+			aliases.set(reference, already);
+			continue;
+		}
+		const definition = yield* load$3(target, origin, options);
+		yield* note(definition.plugin, definition.version === void 0 ? key : `${key}@${definition.version}`);
+		const names = target.kind === "local" ? [target.path, ...definition.name === void 0 ? [] : [definition.name]] : [canonical$1(target), target.spec];
+		remember(definition.plugin, [reference, ...names], {
+			...definition.version === void 0 ? {} : { version: definition.version },
+			origin: {
+				reference,
+				...definition.generation === void 0 ? {} : { generation: definition.generation },
+				...origin.file === void 0 ? {} : { file: origin.file }
+			}
+		});
+		seen.set(key, definition.plugin.id);
+	}
 	return {
-		exitCode: result.exitCode,
-		...present
+		plugins,
+		aliases,
+		versions,
+		origins
 	};
 });
-/** Variant B — streaming: accumulate output, report progress, keep partial output on timeout. */
-const runStreaming = (stream, params) => Effect.scoped(Effect.gen(function* () {
-	const acc = new Accumulator({ tempFilePrefix: "codework-bash" });
-	const progress = yield* progress_exports.ToolProgress;
-	const exitCode = yield* Ref.make(null);
-	const consume = stream(params.command).pipe(Stream.runForEach((event) => event._tag === "Exit" ? Ref.set(exitCode, event.exitCode) : Effect.gen(function* () {
-		yield* acc.append(Buffer.from(event.bytes));
-		yield* progress.report({ content: [{
-			type: "text",
-			text: acc.snapshot().content
-		}] });
-	})), Effect.catchTag("ToolShellError", (cause) => Effect.die(cause)));
-	let timedOutAfter;
-	if (params.timeout !== void 0) {
-		const finished = yield* consume.pipe(Effect.timeoutOption(Duration.seconds(params.timeout)));
-		if (Option.isNone(finished)) timedOutAfter = params.timeout;
-	} else yield* consume;
-	yield* acc.finish();
-	const present = presentSnapshot(acc.snapshot(), acc.getLastLineBytes());
-	if (timedOutAfter !== void 0) return yield* new BashTimedOut({
-		timeoutSeconds: timedOutAfter,
-		...present
-	});
-	const code = yield* Ref.get(exitCode);
-	if (code === null || code !== 0) return yield* new BashFailed({
-		exitCode: code ?? -1,
-		...present
+/**
+* The **config pass**: pure data over modules that are already loaded, run at every exchange.
+*
+* An array entry is a **module** — a definition object, a path, a `file:` URL, or a package
+* spec. It takes the position it is written at, so naming a module again moves it.
+*
+* An object entry is **configuration** for a plugin an earlier entry (or the built-in list)
+* already selected, addressed by its ID (`plugin`) or the module string (`package`) that selected
+* it. It never loads, installs or reorders anything, and a name matching nothing in the selection
+* is ignored rather than failing the boot — a typo costs a debug line, never a fetch.
+*
+* Nothing here touches the disk, which is the whole point of the split: an `options` edit, an
+* `enabled` flip or a reordering applies at the next exchange without importing anything.
+*/
+const select = Effect.fn("PluginCatalog.select")(function* (references, pool) {
+	const operations = /* @__PURE__ */ new Map();
+	const missing = [];
+	const choose = (id, index) => operations.set(id, {
+		enabled: true,
+		index,
+		options: operations.get(id)?.options ?? {}
 	});
+	for (const [index, reference] of references.entries()) {
+		if (isPatch(reference)) {
+			const named = reference.plugin ?? reference.package;
+			const origin = {
+				index,
+				reference: typeof named === "string" ? named : `<plugin entry #${index}>`
+			};
+			const invalid = reference.plugin !== void 0 && reference.package !== void 0 ? "names both `plugin` and `package`" : typeof named !== "string" || named.length === 0 ? "names neither `plugin` nor `package`" : reference.enabled !== void 0 && typeof reference.enabled !== "boolean" ? "`enabled` is not a boolean" : reference.options !== void 0 && !isRecord$1(reference.options) ? "`options` is not a plain object" : void 0;
+			if (invalid !== void 0) return yield* definitionFailure(origin, /* @__PURE__ */ new Error(`plugin entry ${invalid}`));
+			const id = reference.plugin === void 0 ? pool.aliases.get(reference.package) : reference.plugin;
+			const operation = id === void 0 ? void 0 : operations.get(id);
+			if (id === void 0 || operation === void 0) {
+				yield* Effect.logDebug(`plugin configuration ignored: nothing selected under ${named}`);
+				continue;
+			}
+			operations.set(id, {
+				enabled: reference.enabled ?? operation.enabled,
+				index: operation.index,
+				options: reference.options ?? operation.options
+			});
+			continue;
+		}
+		if (typeof reference !== "string") {
+			const declared = Predicate.hasProperty(reference, "id") ? reference.id : void 0;
+			if (typeof declared === "string" && pool.plugins.has(declared)) choose(declared, index);
+			continue;
+		}
+		const id = pool.aliases.get(reference);
+		if (id === void 0) missing.push(reference);
+		else choose(id, index);
+	}
+	const selection = [];
+	for (const [id, operation] of operations) {
+		if (!operation.enabled) continue;
+		const plugin = pool.plugins.get(id);
+		if (plugin !== void 0) selection.push({
+			plugin,
+			options: Object.freeze(operation.options),
+			index: operation.index
+		});
+	}
+	selection.sort((a, b) => (0, plugin_exports.rank)(a.plugin.kind) - (0, plugin_exports.rank)(b.plugin.kind) || a.index - b.index);
 	return {
-		exitCode: code,
-		...present
+		selection: Object.freeze(selection.map(({ plugin, options }) => ({
+			plugin,
+			options
+		}))),
+		missing
 	};
-}));
-const bashHandler = (params) => Effect.gen(function* () {
-	const shell = yield* ToolShell;
-	return shell.stream !== void 0 ? yield* runStreaming(shell.stream, params) : yield* runBuffered(shell, params);
-});
-/** The bash tool: definition + handler, wired the testable (def/exec split) way. */
-const bashTool = tool_exports.implement(bashDef, bashHandler);
-const bashPlugin = (0, plugin_exports.define)({
-	id: "codework.tool.bash",
-	kind: "tool",
-	setup: Effect.fn("BashPlugin.setup")(function* (ctx) {
-		const shell = yield* io_exports.SandboxIO.Shell;
-		const mounted = fromSandboxShell.pipe(Layer.provide(Layer.succeed(io_exports.SandboxIO.Shell, shell)));
-		ctx.plugin.tools.add(tool_exports.provide(bashTool, mounted));
-	})
 });
-//#endregion
-//#region ../harness/src/plugin/builtin.ts
 /**
-* Every plugin the harness ships, and the selection a caller who passes no `plugins` gets. Tool
-* contributors come first so the Prompt plugin that indexes them runs after they registered.
+* The exchange-boundary check: has the store moved under this pool?
+*
+* Every exchange already re-reads every settings layer from disk, and the config pass already
+* walks those entries against the loaded set. Two things can be settled right there, and they are
+* the same question asked twice:
+*
+* 1. a settings entry names a module that is not loaded, and the store holds it;
+* 2. a loaded module is not the newest generation the store has.
+*
+* The second is what makes `plugin update` finish. Without it the question is "is this entry
+* loaded?", the answer after an update is still yes, and the bytes just fetched sit on disk until
+* something else forces an import.
+*
+* Returns the new pool, or nothing when nothing moved -- which is the common case, and costs one
+* store lookup per filed module.
+*
+* **This is not a watcher.** Nothing polls and no fiber exists; it is the observation that we were
+* already paying for the I/O that would tell us, and discarding the answer. Three bounds keep it
+* safe: the store only and never the network, so an exchange cannot block on a registry;
+* resolve-only, so it cannot install; and once, at the top of a snapshot, so an exchange already
+* running is unaffected.
 */
-const builtins = Object.freeze([bashPlugin, defaultPromptPlugin]);
+const follow = Effect.fn("PluginCatalog.follow")(function* (references, pool, options, filed) {
+	let moved = false;
+	for (const reference of references) {
+		if (typeof reference !== "string" || pool.aliases.has(reference)) continue;
+		if (Option.isSome(yield* filed(reference, anchor$1(options.declared?.get(reference), options.hostDir)))) {
+			moved = true;
+			break;
+		}
+	}
+	if (!moved) for (const origin of pool.origins.values()) {
+		if (origin.generation === void 0) continue;
+		const current = yield* filed(origin.reference, anchor$1(origin.file, options.hostDir));
+		if (Option.isSome(current) && current.value.generation !== void 0 && current.value.generation > origin.generation) {
+			moved = true;
+			break;
+		}
+	}
+	if (!moved) return Option.none();
+	const retained = [];
+	for (const origin of pool.origins.values()) {
+		if (references.includes(origin.reference) || Option.isSome(yield* filed(origin.reference, anchor$1(origin.file, options.hostDir)))) {
+			retained.push(origin);
+			continue;
+		}
+		yield* Effect.logWarning(`plugin ${origin.reference} no longer resolves; it is dropped from the loaded set`);
+	}
+	const accumulated = [...Array.from(retained, (origin) => origin.reference), ...references];
+	const known = /* @__PURE__ */ new Map();
+	for (const origin of retained) if (origin.file !== void 0) known.set(origin.reference, origin.file);
+	for (const [reference, file] of options.declared ?? /* @__PURE__ */ new Map()) known.set(reference, file);
+	return Option.some(yield* load$2(accumulated, {
+		...options,
+		declared: known
+	}));
+});
+Effect.fn("PluginCatalog.prepare")(function* (references, options) {
+	const pool = yield* load$2(references, options);
+	return (yield* select(references, pool)).selection;
+});
 //#endregion
 //#region ../harness/src/runner/coordinator.ts
 const make$8 = (options) => Effect.gen(function* () {
@@ -7652,6 +7764,82 @@ const layer$8 = Layer.effect(Service$6, Effect.gen(function* () {
 	});
 }));
 //#endregion
+//#region ../harness/src/settings/schema.ts
+var schema_exports$1 = /* @__PURE__ */ __exportAll({});
+import * as import__codeworksh_plugin_settings from "@codeworksh/plugin/settings";
+__reExport(schema_exports$1, import__codeworksh_plugin_settings);
+//#endregion
+//#region ../harness/src/settings/resolve.ts
+const patternMatches = (pattern, id) => new RegExp(`^${pattern.split("*").map((part) => part.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join(".*")}$`).test(id);
+function collect(settings, provider, id) {
+	const config = settings.model;
+	const blocks = config.providerOptions?.[provider] ?? {};
+	const patterns = Object.keys(blocks).filter((key) => key !== "*" && key !== id && key.includes("*") && patternMatches(key, id)).sort((a, b) => a.indexOf("*") - b.indexOf("*"));
+	return merge({
+		thinkingLevel: config.thinkingLevel,
+		toolExecution: config.toolExecution,
+		...config.thinkingBudgets === void 0 ? {} : { thinkingBudgets: config.thinkingBudgets }
+	}, config.options, blocks["*"], ...patterns.map((key) => blocks[key]), blocks[id]);
+}
+/**
+* Corrections to the catalog entry itself, applied before lookup.
+*
+* `protocol` is here rather than in the request bag because it is model shape: it decides which
+* wire protocol aikit speaks, and through `Model.optionsKey` which namespace the provider bag is
+* keyed by. A catalog cannot know it for a local OpenAI-compatible server, and the person
+* pointing at one does.
+*/
+const resolveOverrides = (block) => ({
+	...block.contextWindow === void 0 ? {} : { contextWindow: block.contextWindow },
+	...block.protocol === void 0 ? {} : { protocol: block.protocol }
+});
+/** Protocol-independent request attributes can already be captured by State. */
+function resolveOptions(block) {
+	return {
+		...Object.fromEntries(Object.entries(block).filter(([key]) => Object.hasOwn(schema_exports$1.requestFields, key))),
+		...block.extras === void 0 ? {} : { factoryOptions: merge({}, block.extras) }
+	};
+}
+/** The bag key becomes knowable only after lookup at the LLM boundary. */
+function resolveRequest(block, model) {
+	const bag = Object.fromEntries(Object.entries(block).filter(([key]) => !Object.hasOwn(schema_exports$1.requestFields, key) && ![
+		"thinkingLevel",
+		"toolExecution",
+		"contextWindow",
+		"protocol",
+		"extras"
+	].includes(key)));
+	return {
+		...resolveOptions(block),
+		...Object.keys(bag).length === 0 ? {} : { providerOptions: { [Model.optionsKey(model)]: bag } }
+	};
+}
+/**
+* Harness-owned controls, which never reach a provider.
+*
+* Separate from {@link resolveRequest} because these steer the loop itself -- how hard to
+* think, how to schedule tool calls -- rather than the request body. Runtime bindings
+* outrank a matched block, which outranks the file's top level.
+*/
+const resolveControls = (settings, block, runtime) => ({
+	thinkingLevel: runtime.thinkingLevel ?? block.thinkingLevel ?? settings.model.thinkingLevel,
+	toolExecution: runtime.toolExecution ?? block.toolExecution ?? settings.model.toolExecution
+});
+/** Pure configuration composition. Domain selections need not exist in the catalog. */
+function compose(settings, options = {}, session = {}) {
+	const runtime = merge(options, session);
+	const provider = runtime.provider ?? settings.model.provider;
+	const model = runtime.model ?? settings.model.id;
+	const block = collect(settings, provider, model);
+	return {
+		provider,
+		model,
+		...resolveControls(settings, block, runtime),
+		block,
+		runtime
+	};
+}
+//#endregion
 //#region ../harness/src/runner/event.ts
 const make$7 = Effect.fn("LLMEventPublisher.make")(function* (input) {
 	const events = yield* Service$16;
@@ -7801,82 +7989,6 @@ const make$7 = Effect.fn("LLMEventPublisher.make")(function* (input) {
 	};
 });
 //#endregion
-//#region ../harness/src/settings/schema.ts
-var schema_exports$1 = /* @__PURE__ */ __exportAll({});
-import * as import__codeworksh_plugin_settings from "@codeworksh/plugin/settings";
-__reExport(schema_exports$1, import__codeworksh_plugin_settings);
-//#endregion
-//#region ../harness/src/settings/resolve.ts
-const patternMatches = (pattern, id) => new RegExp(`^${pattern.split("*").map((part) => part.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join(".*")}$`).test(id);
-function collect(settings, provider, id) {
-	const config = settings.model;
-	const blocks = config.providerOptions?.[provider] ?? {};
-	const patterns = Object.keys(blocks).filter((key) => key !== "*" && key !== id && key.includes("*") && patternMatches(key, id)).sort((a, b) => a.indexOf("*") - b.indexOf("*"));
-	return merge({
-		thinkingLevel: config.thinkingLevel,
-		toolExecution: config.toolExecution,
-		...config.thinkingBudgets === void 0 ? {} : { thinkingBudgets: config.thinkingBudgets }
-	}, config.options, blocks["*"], ...patterns.map((key) => blocks[key]), blocks[id]);
-}
-/**
-* Corrections to the catalog entry itself, applied before lookup.
-*
-* `protocol` is here rather than in the request bag because it is model shape: it decides which
-* wire protocol aikit speaks, and through `Model.optionsKey` which namespace the provider bag is
-* keyed by. A catalog cannot know it for a local OpenAI-compatible server, and the person
-* pointing at one does.
-*/
-const resolveOverrides = (block) => ({
-	...block.contextWindow === void 0 ? {} : { contextWindow: block.contextWindow },
-	...block.protocol === void 0 ? {} : { protocol: block.protocol }
-});
-/** Protocol-independent request attributes can already be captured by State. */
-function resolveOptions(block) {
-	return {
-		...Object.fromEntries(Object.entries(block).filter(([key]) => Object.hasOwn(schema_exports$1.requestFields, key))),
-		...block.extras === void 0 ? {} : { factoryOptions: merge({}, block.extras) }
-	};
-}
-/** The bag key becomes knowable only after lookup at the LLM boundary. */
-function resolveRequest(block, model) {
-	const bag = Object.fromEntries(Object.entries(block).filter(([key]) => !Object.hasOwn(schema_exports$1.requestFields, key) && ![
-		"thinkingLevel",
-		"toolExecution",
-		"contextWindow",
-		"protocol",
-		"extras"
-	].includes(key)));
-	return {
-		...resolveOptions(block),
-		...Object.keys(bag).length === 0 ? {} : { providerOptions: { [Model.optionsKey(model)]: bag } }
-	};
-}
-/**
-* Harness-owned controls, which never reach a provider.
-*
-* Separate from {@link resolveRequest} because these steer the loop itself -- how hard to
-* think, how to schedule tool calls -- rather than the request body. Runtime bindings
-* outrank a matched block, which outranks the file's top level.
-*/
-const resolveControls = (settings, block, runtime) => ({
-	thinkingLevel: runtime.thinkingLevel ?? block.thinkingLevel ?? settings.model.thinkingLevel,
-	toolExecution: runtime.toolExecution ?? block.toolExecution ?? settings.model.toolExecution
-});
-/** Pure configuration composition. Domain selections need not exist in the catalog. */
-function compose(settings, options = {}, session = {}) {
-	const runtime = merge(options, session);
-	const provider = runtime.provider ?? settings.model.provider;
-	const model = runtime.model ?? settings.model.id;
-	const block = collect(settings, provider, model);
-	return {
-		provider,
-		model,
-		...resolveControls(settings, block, runtime),
-		block,
-		runtime
-	};
-}
-//#endregion
 //#region ../harness/src/runner/llm.ts
 const runtimeOptions = (input, model, signal) => {
 	const { activeTools, ...options } = merge(resolveRequest(input.settings ?? {}, model), input.options);
@@ -7926,17 +8038,6 @@ const providerError = (input, failure) => {
 	});
 };
 const providerErrorFromUnknown = (input, cause) => providerError(input, AikitFailure.normalize(cause));
-const modelCatalogFailure = (cause) => {
-	if (typeof cause !== "object" || cause === null || !("name" in cause) || cause.name !== "ModelCatalogLoadError") return;
-	if (!("data" in cause) || typeof cause.data !== "object" || cause.data === null) return void 0;
-	const data = cause.data;
-	if (!("path" in data) || typeof data.path !== "string" || !("message" in data) || typeof data.message !== "string" || !("reason" in data) || data.reason !== "missing" && data.reason !== "unreadable" && data.reason !== "empty" && data.reason !== "invalid") return;
-	return {
-		path: data.path,
-		reason: data.reason,
-		message: data.message
-	};
-};
 /** Read structured terminal data while remaining compatible with older Aikit messages. */
 const messageFailure = (message) => {
 	const candidate = message.failure;
@@ -7946,14 +8047,7 @@ const messageFailure = (message) => {
 const resolve$1 = Effect.fn("LLM.resolve")(function* (input) {
 	const model = yield* Effect.tryPromise({
 		try: () => llm(input.provider, input.model, resolveOverrides(input.settings ?? {})),
-		catch: (cause) => {
-			const catalog = modelCatalogFailure(cause);
-			return catalog === void 0 ? providerErrorFromUnknown(input, cause) : new ModelCatalogError({
-				path: catalog.path,
-				reason: catalog.reason,
-				detail: catalog.message
-			});
-		}
+		catch: (cause) => loadError(cause) ?? providerErrorFromUnknown(input, cause)
 	});
 	if (model === void 0) return yield* new ModelNotFoundError({
 		provider: input.provider,
@@ -8623,7 +8717,7 @@ const parse$1 = Effect.fn("Settings.parse")(function* (path, source) {
 		reason: "parse",
 		detail: `${printParseErrorCode(first.error)} at ${at(source, first.offset)}`
 	});
-	const document = normalize$1(json);
+	const document = normalize(json);
 	if (Predicate.isObject(document) && Predicate.isObject(json) && "plugins" in json) Object.assign(document, { plugins: json.plugins });
 	return yield* Schema.decodeUnknownEffect(schema_exports$1.Patch)(document).pipe(Effect.mapError((error) => new SettingsError({
 		path,
@@ -9300,7 +9394,7 @@ const layer$3 = Layer.effectDiscard(Effect.gen(function* () {
 }));
 //#endregion
 //#region ../harness/src/session/live.ts
-const layer$2 = Layer.provideMerge(layer$3, layer$23);
+const layer$2 = Layer.provideMerge(layer$3, layer$24);
 //#endregion
 //#region ../harness/src/effect/harness.ts
 const layer$1 = (options = {}) => Layer.unwrap(Effect.gen(function* () {
@@ -9361,14 +9455,17 @@ const layer$1 = (options = {}) => Layer.unwrap(Effect.gen(function* () {
 		});
 	});
 	const definitions = yield* flatten([...(yield* Ref.get(pool)).plugins.values()]);
-	const database = layer$26(resolveDatabaseLocation(options.database ?? (yield* locationConfig), paths.data));
+	const database = layer$27(resolveDatabaseLocation(options.database ?? (yield* locationConfig), paths.data));
 	const configured = yield* loadAll(options.sandboxes ?? [], { hostCwd });
-	const drivers = layer$19(driver_exports.SandboxDriver.withSource(make$16().driver, "core"), driver_exports.SandboxDriver.withSource(make$14().driver, "core"), ...configured);
-	const sandboxes = layer$17({ hostCwd }).pipe(Layer.provideMerge(drivers), Layer.provideMerge(database));
+	const drivers = layer$20(driver_exports.SandboxDriver.withSource(make$16().driver, "core"), driver_exports.SandboxDriver.withSource(make$14().driver, "core"), ...configured);
+	const sandboxes = layer$18({ hostCwd }).pipe(Layer.provideMerge(drivers), Layer.provideMerge(database));
 	const authFile$1 = authFile(options.home === void 0 ? void 0 : paths.home);
 	const open = options.llm ?? openWith(authFile$1 === void 0 ? {} : { authFile: authFile$1 });
 	const loop = layer$4({ request: make$6(open) });
-	return layer$10.pipe(Layer.provideMerge(layer$8.pipe(Layer.provide(loop))), Layer.provideMerge(layer$5({}, pool, references, followStore, rebuild)), Layer.provideMerge(layer$6(settingsOptions)), Layer.provideMerge(layer$7), Layer.provideMerge(sandboxes), Layer.provideMerge(layer$22), Layer.provideMerge(layer$2), Layer.provideMerge(layer$25), Layer.provideMerge(layer$9(definitions)), Layer.provideMerge(database), Layer.provideMerge(global));
+	return layer$11.pipe(Layer.provideMerge(layer$8.pipe(Layer.provide(loop))), Layer.provideMerge(layer$5({}, pool, references, followStore, rebuild)), Layer.provideMerge(layer$6(settingsOptions)), Layer.provideMerge(layer$7), Layer.provideMerge(sandboxes), Layer.provideMerge(layer$23), Layer.provideMerge(layer$2), Layer.provideMerge(layer$26), Layer.provideMerge(layer$10(definitions)), Layer.provideMerge(database), Layer.provideMerge(global), Layer.provideMerge(layer$9({
+		home: paths.home,
+		watch: options.watchModels ?? false
+	})));
 }));
 //#endregion
 //#region ../harness/src/effect/sandbox.ts
@@ -10067,16 +10164,15 @@ const terminalColumns = () => process.stderr.isTTY ? process.stderr.columns ?? 7
 //#region src/cli/error.ts
 /** Bad flag or argument combinations the parser cannot express on its own. */
 var InvalidInputError = class extends Schema.TaggedError()("CLI.InvalidInputError", { message: Schema.String }) {};
-var ModelgenError = class extends Schema.TaggedError()("CLI.ModelgenError", { cause: Schema.Defect() }) {};
 var OAuthError = class extends Schema.TaggedError()("CLI.OAuthError", {
 	message: Schema.String,
 	cause: Schema.optional(Schema.Defect())
 }) {};
 const isInvalidInputError = Schema.is(InvalidInputError);
-const isModelgenError = Schema.is(ModelgenError);
 const isOAuthError = Schema.is(OAuthError);
 const isProviderError = Schema.is(ProviderError);
 const isModelCatalogError = Schema.is(ModelCatalogError);
+const isModelCatalogRefreshError = Schema.is(RefreshError);
 const isModelNotFoundError = Schema.is(ModelNotFoundError);
 const isLLMStreamError = Schema.is(LLMStreamError);
 const isSandboxProviderError = Schema.is(SandboxProvider.SandboxProviderError);
@@ -10089,23 +10185,6 @@ const isSettingsError = Schema.is(SettingsError);
 const isSandboxDriverNotRegisteredError = Schema.is(errors_exports.SandboxError.SandboxDriverNotRegisteredError);
 const isSandboxDriverRegistrationError = Schema.is(errors_exports.SandboxError.SandboxDriverRegistrationError);
 const isExecutionError = Schema.is(ExecutionError);
-const providerCategory = (reason) => {
-	switch (reason._tag) {
-		case "Runner.ProviderAuthenticationError": return "authentication";
-		case "Runner.ProviderConfigurationError": return "configuration";
-		case "Runner.ProviderAuthorizationError": return "authorization";
-		case "Runner.ProviderModelUnavailableError": return "model_unavailable";
-		case "Runner.ProviderRateLimitError": return "rate_limited";
-		case "Runner.ProviderQuotaError": return "quota";
-		case "Runner.ProviderInvalidRequestError": return "invalid_request";
-		case "Runner.ProviderContentPolicyError": return "content_policy";
-		case "Runner.ProviderTimeoutError": return "timeout";
-		case "Runner.ProviderTransportError": return "transport";
-		case "Runner.ProviderUnavailableError": return "provider_unavailable";
-		case "Runner.ProviderInvalidResponseError": return "invalid_response";
-		case "Runner.ProviderUnknownError": return "provider";
-	}
-};
 const credentialHint = (provider) => {
 	switch (provider) {
 		case "openrouter": return "set OPENROUTER_API_KEY and retry";
@@ -10142,6 +10221,23 @@ const unknownMessage = (error) => {
 * usually hand-written in a settings file, so the phase is worth translating.
 */
 /** One hint per reason. Lowercase, like everything else a plugin failure prints. */
+const providerCategory = (reason) => {
+	switch (reason._tag) {
+		case "Runner.ProviderAuthenticationError": return "provider-authentication-error";
+		case "Runner.ProviderConfigurationError": return "provider-configuration-error";
+		case "Runner.ProviderAuthorizationError": return "provider-authorization-error";
+		case "Runner.ProviderModelUnavailableError": return "provider-model-unavailable-error";
+		case "Runner.ProviderRateLimitError": return "provider-rate-limit-error";
+		case "Runner.ProviderQuotaError": return "provider-quota-error";
+		case "Runner.ProviderInvalidRequestError": return "provider-invalid-request-error";
+		case "Runner.ProviderContentPolicyError": return "provider-content-filter-error";
+		case "Runner.ProviderTimeoutError": return "provider-timeout-error";
+		case "Runner.ProviderTransportError": return "provider-transport-error";
+		case "Runner.ProviderUnavailableError": return "provider-unavailable-error";
+		case "Runner.ProviderInvalidResponseError": return "provider-invalid-response-error";
+		case "Runner.ProviderUnknownError": return "provider-unknown-error";
+	}
+};
 const pluginReasonHint = (reason) => {
 	switch (reason) {
 		case "plugin-unsupported-source": return "a path entry starts with `./`, `../`, `~/` or `/`; anything else is a package or a git spec, and a remote tarball is not supported";
@@ -10174,8 +10270,7 @@ const renderError = (error) => {
 	if (isSandboxDriverNotRegisteredError(error)) return `error: sandbox driver "${error.driver}" is not registered (available: ${error.registered?.join(", ") ?? "none"})\n`;
 	if (isSandboxDriverRegistrationError(error)) return `error: ${error.reason}\n`;
 	if (isInvalidInputError(error)) return `error: ${error.message}\n`;
-	if (isModelgenError(error)) return ["error[model-catalog]: failed to generate the model catalog", "hint: check the output path and retry"].join("\n") + "\n";
-	if (isOAuthError(error)) return [`error[oauth]: ${error.message}`, ...error.cause === void 0 ? [] : [`detail: ${unknownMessage(error.cause)}`]].join("\n") + "\n";
+	if (isOAuthError(error)) return [`error[oauth-credential-error]: ${error.message}`, ...error.cause === void 0 ? [] : [`detail: ${unknownMessage(error.cause)}`]].join("\n") + "\n";
 	if (isSandboxProviderError(error)) return [
 		`error: SandboxProviderError - ${error.sanitized.message}`,
 		`driver: ${error.driver}`,
@@ -10189,8 +10284,7 @@ const renderError = (error) => {
 		"hint: run `codework session link <session-id>` from the directory to anchor it to"
 	].join("\n") + "\n";
 	if (isSettingsError(error)) return [
-		`error[settings]: ${error.path}`,
-		`reason: ${error.reason}`,
+		`error[settings-${error.reason}-failed]: ${error.path}`,
 		`detail: ${error.detail}`,
 		`hint: ${settingsHint(error.reason)}`
 	].join("\n") + "\n";
@@ -10211,9 +10305,10 @@ const renderError = (error) => {
 			...hint === void 0 ? [] : [`hint: ${hint}`]
 		].join("\n") + "\n";
 	}
-	if (isModelCatalogError(error)) return [`error[model-catalog]: ${error.message}`, "hint: run `codework models generate` or set CODEWORK_MODELS_FILE to a generated catalog"].join("\n") + "\n";
-	if (isModelNotFoundError(error)) return [`error[model-not-found]: ${error.message}`, "hint: check the provider/model IDs in models.gen.json or regenerate the catalog"].join("\n") + "\n";
-	if (isLLMStreamError(error)) return `error[stream]: ${error.message}\n`;
+	if (isModelCatalogError(error)) return [`error[model-catalog-${error.reason}]: ${error.message}`, "hint: run `codework models refresh`"].join("\n") + "\n";
+	if (isModelCatalogRefreshError(error)) return [`error[catalog-refresh-failed]: ${error.message}`, "hint: check the network connection and retry"].join("\n") + "\n";
+	if (isModelNotFoundError(error)) return [`error[model-not-found-error]: ${error.message}`, "hint: check the provider/model IDs in models.gen.json or regenerate the catalog"].join("\n") + "\n";
+	if (isLLMStreamError(error)) return `error[llm-stream-error]: ${error.message}\n`;
 	if (isExecutionError(error)) return [error.type === "aborted" ? `error: ${error.message}` : `error[${error.type}]: ${error.message}`, ...error.status === void 0 ? [] : [`status: ${error.status}`]].join("\n") + "\n";
 	return `error: ${unknownMessage(error)}\n`;
 };
@@ -10221,6 +10316,6 @@ const reportFailure = (error) => writeError(renderError(error)).pipe(Effect.andT
 	process.exitCode = 1;
 })));
 //#endregion
-export { Service$5 as $, resolve as A, inspect as B, get as C, __commonJSMin as Ct, drivers as D, __toCommonJS as Dt, create$2 as E, __require as Et, paths as F, lock as G, required as H, projectRoot as I, InstallError as J, parse$2 as K, anchor$1 as L, layer$1 as M, Service$1 as N, list as O, __toESM as Ot, load$1 as P, Service$4 as Q, canonical as R, create$1 as S, schema_exports$8 as St, relink as T, __exportAll as Tt, resolve$2 as U, check as V, update as W, SourceError as X, LoadError as Y, StoreError as Z, OAuthError$1 as _, path$1 as _t, reportFailure as a, SessionNotLinkedError as at, encode as b, resolve$3 as bt, header as c, SubscriptionOverflowError as ct, writeError as d, LLMTextDelta as dt, ModelCatalogError as et, writeOut as f, TurnEnded as ft, Api as g, layer$26 as gt, run as h, schema_exports$6 as ht, renderError as i, SessionNotFoundError as it, stop as j, register as k, terminalColumns as l, layer$25 as lt, make as m, instance_exports as mt, ModelgenError as n, sandbox$1 as nt, addUsage as o, layer$23 as ot, layer as p, Prompt as pt, probe as q, OAuthError as r, Service$14 as rt, emptyUsage as s, Service$16 as st, InvalidInputError as t, sandbox as tt, usage as u, LLMEnded as ut, Connected as v, Service$17 as vt, link as w, __esmMin as wt, attach as x, ID$1 as xt, Core as y, authFile as yt, definition$1 as z };
+export { refresh$1 as $, stop as A, __toESM as At, check as B, link as C, ID$1 as Ct, list as D, __exportAll as Dt, drivers as E, __esmMin as Et, projectRoot as F, parse$2 as G, resolve$2 as H, anchor$1 as I, LoadError as J, probe as K, canonical as L, Service$1 as M, load$1 as N, register as O, __require as Ot, paths as P, providers as Q, definition$1 as R, get as S, resolve$3 as St, create$2 as T, __commonJSMin as Tt, update as U, required as V, lock as W, StoreError as X, SourceError as Y, models as Z, Connected as _, schema_exports$6 as _t, addUsage as a, Service$14 as at, attach as b, Service$17 as bt, terminalColumns as c, layer$24 as ct, writeOut as d, layer$26 as dt, sync as et, layer as f, LLMEnded as ft, OAuthError$1 as g, instance_exports as gt, Api as h, Prompt as ht, reportFailure as i, sandbox$1 as it, layer$1 as j, resolve as k, __toCommonJS as kt, usage as l, Service$16 as lt, run as m, TurnEnded as mt, OAuthError as n, Service$5 as nt, emptyUsage as o, SessionNotFoundError as ot, make as p, LLMTextDelta as pt, InstallError as q, renderError as r, sandbox as rt, header as s, SessionNotLinkedError as st, InvalidInputError as t, Service$4 as tt, writeError as u, SubscriptionOverflowError as ut, Core as v, layer$27 as vt, relink as w, schema_exports$8 as wt, create$1 as x, authFile as xt, encode as y, path$1 as yt, inspect as z };
 
-//# sourceMappingURL=error-BrbT9_4g.mjs.map
+//# sourceMappingURL=error-DG5INUkQ.mjs.map