@codeworksh/harness 0.0.1-dev.20260922184400 → 0.0.1-dev.20260923102526

package/effect.mjs

@@ -19,6 +19,7 @@ import { ChildProcess, ChildProcessSpawner } from "effect/unstable/process";
 import { Buffer as Buffer$1 } from "node:buffer";
 import { Bash } from "just-bash";
 import { DirectoryNotFoundError, DirectoryNotFoundError as DirectoryNotFoundError$1, Info, Info as Info$1, NotDirectoryError, NotDirectoryError as NotDirectoryError$1, Ref as Ref$2, Service, Service as Service$8 } from "@codeworksh/plugin/location";
+import { generateModels } from "@codeworksh/aikit/modelgen";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import path from "node:path";
 import { Script, constants } from "node:vm";
@@ -102,7 +103,7 @@ var global_exports = /* @__PURE__ */ __exportAll({
 	authFile: () => authFile,
 	defaultLayer: () => defaultLayer$4,
 	homeConfig: () => homeConfig,
-	layer: () => layer$26,
+	layer: () => layer$27,
 	layerWith: () => layerWith$1,
 	make: () => make$18,
 	resolve: () => resolve$3
@@ -148,8 +149,8 @@ const build = (input) => Effect.gen(function* () {
 	]).pipe(Effect.orDie);
 	return Service$17.of(paths);
 });
-const layer$26 = Layer.effect(Service$17, build({}));
-const defaultLayer$4 = layer$26;
+const layer$27 = Layer.effect(Service$17, build({}));
+const defaultLayer$4 = layer$27;
 const layerWith$1 = (input) => Layer.effect(Service$17, build(input));
 //#endregion
 //#region src/db/migrations.ts
@@ -337,7 +338,7 @@ var db_exports = /* @__PURE__ */ __exportAll({
 	SqlClient: () => SqlClient$1,
 	SqlSchema: () => SqlSchema$1,
 	defaultLayer: () => defaultLayer$3,
-	layer: () => layer$25,
+	layer: () => layer$26,
 	locationConfig: () => locationConfig,
 	path: () => path$1,
 	resolveDatabaseLocation: () => resolveDatabaseLocation
@@ -351,7 +352,7 @@ const setup = Effect.gen(function* () {
 	yield* sql`PRAGMA foreign_keys = ON`;
 	yield* SqliteMigrator.run({ loader: Migrator.fromRecord(migrations) });
 });
-function layer$25(location) {
+function layer$26(location) {
 	return Layer.unwrap(Effect.gen(function* () {
 		if (location !== ":memory:") yield* fileSystem.makeDirectory(posix.dirname(location), { recursive: true }).pipe(Effect.orDie);
 		return SqliteClient.layer({
@@ -370,7 +371,7 @@ const path$1 = Effect.fn("Database.path")(function* (data) {
 	const directory = data ?? (yield* resolve$3()).data;
 	return resolveDatabaseLocation(yield* locationConfig, directory);
 });
-const defaultLayer$3 = Layer.unwrap(path$1().pipe(Effect.map(layer$25)));
+const defaultLayer$3 = Layer.unwrap(path$1().pipe(Effect.map(layer$26)));
 //#endregion
 //#region src/event/schema.ts
 var schema_exports$7 = /* @__PURE__ */ __exportAll({});
@@ -549,7 +550,7 @@ var SessionEntryPartRow = class extends Model.Class("SessionEntryPartRow")({
 /**
 * The public description of a failed execution.
 *
-* Open by design: `type` is a namespaced category string, not a closed union.
+* Open by design: `type` is a kebab-case category ending in `-error`, not a closed union.
 * A client older than the server degrades to the message instead of failing to
 * decode, and a new category is an additive change. The typed cause stays
 * server-side -- this is what crosses the wire.
@@ -562,40 +563,40 @@ const Error$1 = Schema.Struct({
 });
 const providerCategory = (tag) => {
 	switch (tag) {
-		case "Runner.ProviderAuthenticationError": return "provider.auth";
-		case "Runner.ProviderAuthorizationError": return "provider.forbidden";
-		case "Runner.ProviderConfigurationError": return "provider.config";
-		case "Runner.ProviderModelUnavailableError": return "provider.model-unavailable";
-		case "Runner.ProviderRateLimitError": return "provider.rate-limit";
-		case "Runner.ProviderQuotaError": return "provider.quota";
-		case "Runner.ProviderInvalidRequestError": return "provider.invalid-request";
-		case "Runner.ProviderContentPolicyError": return "provider.content-filter";
-		case "Runner.ProviderTimeoutError": return "provider.timeout";
-		case "Runner.ProviderTransportError": return "provider.transport";
-		case "Runner.ProviderUnavailableError": return "provider.unavailable";
-		case "Runner.ProviderInvalidResponseError": return "provider.invalid-output";
-		default: return "provider.unknown";
+		case "Runner.ProviderAuthenticationError": return "provider-authentication-error";
+		case "Runner.ProviderAuthorizationError": return "provider-authorization-error";
+		case "Runner.ProviderConfigurationError": return "provider-configuration-error";
+		case "Runner.ProviderModelUnavailableError": return "provider-model-unavailable-error";
+		case "Runner.ProviderRateLimitError": return "provider-rate-limit-error";
+		case "Runner.ProviderQuotaError": return "provider-quota-error";
+		case "Runner.ProviderInvalidRequestError": return "provider-invalid-request-error";
+		case "Runner.ProviderContentPolicyError": return "provider-content-filter-error";
+		case "Runner.ProviderTimeoutError": return "provider-timeout-error";
+		case "Runner.ProviderTransportError": return "provider-transport-error";
+		case "Runner.ProviderUnavailableError": return "provider-unavailable-error";
+		case "Runner.ProviderInvalidResponseError": return "provider-invalid-response-error";
+		default: return "provider-unknown-error";
 	}
 };
 const category = (tag) => {
 	switch (tag) {
-		case "Runner.ModelCatalogError": return "model.catalog";
-		case "Runner.ModelNotFoundError": return "model.not-found";
-		case "Runner.LLMStreamError": return "llm.stream";
-		case "ContextDecodeError": return "context.decode";
-		case "ContextEncodeError": return "context.encode";
-		case "SessionNotFoundError": return "session.not-found";
-		case "SessionLinkedSpaceNotFoundError": return "session.space-not-found";
-		case "SettingsError": return "settings";
-		case "State.SnapshotError": return "state.snapshot";
-		case "Runner.SandboxDirectoryNotFoundError": return "sandbox.directory-not-found";
-		case "SandboxFileSystemError": return "sandbox.filesystem";
+		case "Runner.ModelCatalogError": return "model-catalog-error";
+		case "Runner.ModelNotFoundError": return "model-not-found-error";
+		case "Runner.LLMStreamError": return "llm-stream-error";
+		case "ContextDecodeError": return "context-decode-error";
+		case "ContextEncodeError": return "context-encode-error";
+		case "SessionNotFoundError": return "session-not-found-error";
+		case "SessionLinkedSpaceNotFoundError": return "session-space-not-found-error";
+		case "SettingsError": return "settings-error";
+		case "State.SnapshotError": return "state-snapshot-error";
+		case "Runner.SandboxDirectoryNotFoundError": return "sandbox-directory-not-found-error";
+		case "SandboxFileSystemError": return "sandbox-filesystem-error";
 		case "SandboxNotFoundError":
 		case "SandboxDriverNotRegisteredError":
 		case "SandboxUnavailError":
 		case "SandboxRemovedError":
-		case "SandboxProviderError": return "sandbox.mount";
-		default: return "unknown";
+		case "SandboxProviderError": return "sandbox-mount-error";
+		default: return "unknown-error";
 	}
 };
 const message = (cause) => cause instanceof globalThis.Error ? cause.message : typeof cause === "string" ? cause : "Session execution failed";
@@ -603,7 +604,7 @@ const message = (cause) => cause instanceof globalThis.Error ? cause.message : t
 const fromCause = (cause) => {
 	const tag = Predicate.hasProperty(cause, "_tag") && typeof cause._tag === "string" ? cause._tag : void 0;
 	if (tag === void 0) return {
-		type: "unknown",
+		type: "unknown-error",
 		message: message(cause)
 	};
 	if (tag === "Runner.ProviderError") {
@@ -902,7 +903,7 @@ var event_exports = /* @__PURE__ */ __exportAll({
 	Service: () => Service$16,
 	SubscriptionOverflowError: () => SubscriptionOverflowError,
 	isSynced: () => isSynced,
-	layer: () => layer$24
+	layer: () => layer$25
 });
 var InvalidDurableEventError = class extends Schema.TaggedError()("InvalidDurableEventError", {
 	type: Schema.String,
@@ -911,7 +912,7 @@ var InvalidDurableEventError = class extends Schema.TaggedError()("InvalidDurabl
 const isSynced = (item) => item.type === "log.synced";
 var SubscriptionOverflowError = class extends Schema.TaggedError()("SubscriptionOverflowError", { capacity: Schema.Int }) {};
 var Service$16 = class extends Context.Service()("@codeworksh/harness/event/event/Service") {};
-const layer$24 = Layer.effect(Service$16, Effect.gen(function* () {
+const layer$25 = Layer.effect(Service$16, Effect.gen(function* () {
 	const sql = yield* SqlClient.SqlClient;
 	const pubsub = { durable: /* @__PURE__ */ new Map() };
 	const subscriptions = /* @__PURE__ */ new Set();
@@ -1269,7 +1270,7 @@ const archiveEnv = Effect.fn("Space.archiveEnv")(function* (env) {
 				`;
 	})).pipe(Effect.orDie);
 });
-const layer$23 = Layer.effect(Service$15, Effect.gen(function* () {
+const layer$24 = Layer.effect(Service$15, Effect.gen(function* () {
 	const sql = yield* SqlClient.SqlClient;
 	const fs = yield* io_exports.SandboxIO.FileSystem;
 	const { id: env } = yield* io_exports.SandboxIO.Current;
@@ -1393,7 +1394,7 @@ var session_exports$1 = /* @__PURE__ */ __exportAll({
 	defaultLayer: () => defaultLayer$2,
 	entryStates: () => entryStates,
 	entryTypes: () => entryTypes,
-	layer: () => layer$22,
+	layer: () => layer$23,
 	messageEntryTypes: () => messageEntryTypes,
 	partTypes: () => partTypes,
 	rebaseDirectory: () => rebaseDirectory,
@@ -1459,7 +1460,7 @@ const decodeMessageEnvelopeIdentity = Schema.decodeUnknownEffect(MessageEnvelope
 const decodeCompactionData$1 = Schema.decodeUnknownEffect(CompactionData);
 const decodeJsonObject$1 = Schema.decodeUnknownEffect(JsonObject);
 const encodeJsonObject$1 = Schema.encodeEffect(JsonObject);
-const layer$22 = Layer.effect(Service$14, Effect.gen(function* () {
+const layer$23 = Layer.effect(Service$14, Effect.gen(function* () {
 	const sql = yield* SqlClient.SqlClient;
 	const events = yield* Service$16;
 	const findSession = SqlSchema.findOneOption({
@@ -2121,7 +2122,7 @@ const layer$22 = Layer.effect(Service$14, Effect.gen(function* () {
 		setLabel
 	});
 }));
-const defaultLayer$2 = layer$22.pipe(Layer.provide(defaultLayer$3));
+const defaultLayer$2 = layer$23.pipe(Layer.provide(defaultLayer$3));
 //#endregion
 //#region src/context/errors.ts
 var ContextDecodeError = class extends Schema.TaggedError()("ContextDecodeError", {
@@ -2422,7 +2423,7 @@ const assemblePath = Effect.fn("Context.assemblePath")(function* (sessionId, pat
 //#endregion
 //#region src/context/context.ts
 var Service$13 = class extends Context.Service()("@codeworksh/harness/context/context/Service") {};
-const layer$21 = Layer.effect(Service$13, Effect.gen(function* () {
+const layer$22 = Layer.effect(Service$13, Effect.gen(function* () {
 	const sessions = yield* Service$14;
 	const assemble = Effect.fn("Context.assemble")(function* (sessionId) {
 		const found = yield* sessions.get(sessionId);
@@ -2512,7 +2513,7 @@ const make$17 = (vfs) => {
 	};
 };
 /** The `SandboxFileSystem.Service` backed by the local {@link Vfs}. */
-const layer$20 = Layer.effect(filesystem_exports.SandboxFileSystem.Service, Effect.gen(function* () {
+const layer$21 = Layer.effect(filesystem_exports.SandboxFileSystem.Service, Effect.gen(function* () {
 	return filesystem_exports.SandboxFileSystem.fromProvider(make$17(yield* Vfs));
 }));
 //#endregion
@@ -2539,7 +2540,7 @@ var HostProvider = class extends RealFSProvider {
 * reason to keep relative paths above the mount, not below it — nothing here
 * resolves them, and nothing here should.
 */
-const layer$19 = () => {
+const layer$20 = () => {
 	const vfs = create(new HostProvider("/"), {
 		moduleHooks: false,
 		virtualCwd: true
@@ -2632,11 +2633,11 @@ const make$16 = (drivers) => Effect.gen(function* () {
 		encodeRuntimeConfig
 	});
 });
-const layer$18 = (...drivers) => Layer.effect(Registry, make$16(drivers));
+const layer$19 = (...drivers) => Layer.effect(Registry, make$16(drivers));
 //#endregion
 //#region src/sandbox/shell/host.ts
 const DEFAULT_SHELL = "sh";
-const layer$17 = (options = {}) => Layer.effect(shell_exports.Shell, Effect.gen(function* () {
+const layer$18 = (options = {}) => Layer.effect(shell_exports.Shell, Effect.gen(function* () {
 	const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
 	const run = (label, file, args, opts) => Effect.scoped(Effect.gen(function* () {
 		const handle = yield* spawner.spawn(ChildProcess.make(file, [...args], {
@@ -2727,7 +2728,7 @@ const make$15 = Effect.gen(function* () {
 //#endregion
 //#region src/sandbox/control.ts
 var Controller = class extends Context.Service()("@codeworksh/harness/sandbox/control/Controller") {};
-const hostTransport = Layer.provide(Layer.merge(Layer.fresh(layer$20), layer$17()), layer$19());
+const hostTransport = Layer.provide(Layer.merge(Layer.fresh(layer$21), layer$18()), layer$20());
 const asDate = DateTime.toDateUtc;
 const optionalDate = Option.map(DateTime.toDateUtc);
 const MetadataJson = Schema.fromJsonString(Schema.Record(Schema.String, Schema.String));
@@ -3347,7 +3348,7 @@ const make$14 = Effect.fn("Sandbox.Controller.make")(function* (options) {
 		destroy
 	});
 });
-const layer$16 = (options) => Layer.effect(Controller, make$14(options));
+const layer$17 = (options) => Layer.effect(Controller, make$14(options));
 //#endregion
 //#region src/sandbox/utils/seed.ts
 const copyDirectory = async (vfs, sourceDirectory, targetDirectory) => {
@@ -3603,7 +3604,7 @@ const transport$1 = (inner) => Layer.provideMerge(Layer.effect(shell_exports.She
 })), inner);
 //#endregion
 //#region src/sandbox/virtual.ts
-const transportLayer = (primitives) => Layer.provideMerge(Layer.merge(Layer.fresh(layer$20), transport$1(primitives)), primitives);
+const transportLayer = (primitives) => Layer.provideMerge(Layer.merge(Layer.fresh(layer$21), transport$1(primitives)), primitives);
 /** A cwd-neutral FileSystem + just-bash transport over one retained VFS. */
 const transport = (vfs) => {
 	const primitives = Layer.merge(Layer.succeed(Vfs, vfs), unsupported);
@@ -3710,7 +3711,7 @@ const make$10 = (location, options) => Effect.tryPromise({
 	})
 });
 const vfsLayer = (location, options) => Layer.effect(Vfs, Effect.acquireRelease(make$10(location, options), ({ provider }) => Effect.sync(() => provider.close())).pipe(Effect.map(({ vfs }) => vfs)));
-const layer$15 = (opts) => Layer.merge(vfsLayer(opts?.location, opts?.options), opts?.options?.hostProcess ? host : unsupported);
+const layer$16 = (opts) => Layer.merge(vfsLayer(opts?.location, opts?.options), opts?.options?.hostProcess ? host : unsupported);
 //#endregion
 //#region src/sandbox/drivers/sqldb.ts
 const CreateConfig = Schema.Struct({
@@ -3728,7 +3729,7 @@ const make$9 = () => {
 	const memory = /* @__PURE__ */ new Map();
 	const runtimeLocation = (input) => input.runtimeConfig.location ?? Option.getOrUndefined(input.providerResourceId);
 	const persistentTransport = (location) => {
-		const backend = layer$15({ location });
+		const backend = layer$16({ location });
 		return transportLayer(Layer.effectContext(Layer.build(backend).pipe(Effect.mapError((cause) => (0, errors_exports.providerError)({
 			driver: name,
 			operation: "attach",
@@ -3863,9 +3864,9 @@ const make$9 = () => {
 * managers). For a sandbox whose shell should stay inside the VFS, use
 * `EnvBash.services` instead, which wires just-bash over the same tree.
 */
-const services = (backend, identity) => Layer.provideMerge(io_exports.SandboxIO.mount(identity), Layer.provideMerge(Layer.merge(layer$20, layer$17()), backend));
+const services = (backend, identity) => Layer.provideMerge(io_exports.SandboxIO.mount(identity), Layer.provideMerge(Layer.merge(layer$21, layer$18()), backend));
 /** Default sandbox: the real OS filesystem and processes, mounted at `cwd`. */
-const defaultLayer$1 = (cwd) => services(layer$19(), io_exports.SandboxIO.host(cwd));
+const defaultLayer$1 = (cwd) => services(layer$20(), io_exports.SandboxIO.host(cwd));
 //#endregion
 //#region src/git/git.ts
 var AppProcessError = class extends Schema.TaggedError()("AppProcessError", {
@@ -3875,7 +3876,7 @@ var AppProcessError = class extends Schema.TaggedError()("AppProcessError", {
 	cause: Schema.optional(Schema.Defect())
 }) {};
 var Service$12 = class extends Context.Service()("@codeworksh/harness/git/git/Service") {};
-const layer$14 = Layer.effect(Service$12, Effect.gen(function* () {
+const layer$15 = Layer.effect(Service$12, Effect.gen(function* () {
 	const shell = yield* io_exports.SandboxIO.Shell;
 	const execute = (cwd) => (args, options) => shell.execArgv(["git", ...args], {
 		cwd,
@@ -4099,7 +4100,7 @@ function parts(host, name) {
 	if (!host || !pathname) return void 0;
 	return `${host}/${pathname}`.toLowerCase();
 }
-const layer$13 = Layer.effect(Service$11, Effect.gen(function* () {
+const layer$14 = Layer.effect(Service$11, Effect.gen(function* () {
 	const fs = yield* io_exports.SandboxIO.FileSystem;
 	const git = yield* Service$12;
 	const find = Effect.fn("Repo.find")(function* (input) {
@@ -4156,7 +4157,7 @@ var WorktreeError = class extends Schema.TaggedError()("Worktree.WorktreeError",
 	cause: Schema.optional(Schema.Defect())
 }) {};
 var Service$10 = class extends Context.Service()("@codeworksh/harness/worktree/worktree/Service") {};
-const layer$12 = Layer.effect(Service$10, Effect.gen(function* () {
+const layer$13 = Layer.effect(Service$10, Effect.gen(function* () {
 	const fs = yield* io_exports.SandboxIO.FileSystem;
 	const git = yield* Service$12;
 	const worktree = Effect.fnUntraced(function* (operation, cwd, args, directory) {
@@ -4211,7 +4212,7 @@ const provisional = (env, location) => schema_exports$6.ProjectSchema.ID.make(fa
 	location
 ])));
 var Service$9 = class extends Context.Service()("@codeworksh/harness/project/project/Service") {};
-const layer$11 = Layer.effect(Service$9, Effect.gen(function* () {
+const layer$12 = Layer.effect(Service$9, Effect.gen(function* () {
 	const sql = yield* SqlClient.SqlClient;
 	const fs = yield* io_exports.SandboxIO.FileSystem;
 	const repos = yield* Service$11;
@@ -4353,11 +4354,11 @@ var location_exports = /* @__PURE__ */ __exportAll({
 	Ref: () => Ref$2,
 	Service: () => Service$8,
 	defaultLayer: () => defaultLayer,
-	layer: () => layer$10,
+	layer: () => layer$11,
 	layerMounted: () => layerMounted,
 	layerWith: () => layerWith
 });
-const layer$10 = (ref = {}) => Layer.effect(Service, Effect.gen(function* () {
+const layer$11 = (ref = {}) => Layer.effect(Service, Effect.gen(function* () {
 	const instance = yield* io_exports.SandboxIO.Current;
 	const directory = schema_exports$9.AbsolutePath.make(ref.directory ?? instance.cwd);
 	const resolved = yield* (yield* Service$9).resolveOrCreate(directory);
@@ -4372,7 +4373,7 @@ const layer$10 = (ref = {}) => Layer.effect(Service, Effect.gen(function* () {
 * folded in. What remains is exactly the mount and the database — for callers
 * that already hold both, such as the runner and `Session.create`.
 */
-const layerMounted = (ref = {}) => layer$10(ref).pipe(Layer.provide(layer$11.pipe(Layer.provide(Layer.mergeAll(layer$13, layer$12, layer$23)), Layer.provide(layer$14))));
+const layerMounted = (ref = {}) => layer$11(ref).pipe(Layer.provide(layer$12.pipe(Layer.provide(Layer.mergeAll(layer$14, layer$13, layer$24)), Layer.provide(layer$15))));
 const layerWith = (ref, sandbox) => layerMounted(ref).pipe(Layer.provide(sandbox), Layer.provide(defaultLayer$3));
 const defaultLayer = (ref, path) => layerWith(ref, defaultLayer$1(path));
 //#endregion
@@ -4725,7 +4726,7 @@ var control_exports = /* @__PURE__ */ __exportAll({
 	Control: () => control_exports,
 	PromptConflictError: () => PromptConflictError,
 	Service: () => Service$5,
-	layer: () => layer$9
+	layer: () => layer$10
 });
 /**
 * The prompt could not be admitted under the id it was given: either that id
@@ -4737,7 +4738,7 @@ var PromptConflictError = class extends Schema.TaggedError()("PromptConflictErro
 	messageId: Schema.String
 }) {};
 var Service$5 = class extends Context.Service()("@codeworksh/harness/control/Service") {};
-const layer$9 = Layer.effect(Service$5, Effect.gen(function* () {
+const layer$10 = Layer.effect(Service$5, Effect.gen(function* () {
 	const sessions = yield* Service$14;
 	const inputs = yield* make$8;
 	const execution = yield* Service$6;
@@ -4806,7 +4807,7 @@ var registry_exports = /* @__PURE__ */ __exportAll({
 	EventRegistry: () => registry_exports,
 	Service: () => Service$4,
 	flatten: () => flatten,
-	layer: () => layer$8
+	layer: () => layer$9
 });
 var Service$4 = class extends Context.Service()("@codeworksh/harness/event/registry/Service") {};
 var EventRegistrationError = class extends Schema.TaggedError()("EventRegistrationError", {
@@ -4852,7 +4853,7 @@ const flatten = Effect.fn("EventRegistry.flatten")(function* (plugins) {
 	}
 	return [...Definitions, ...definitions];
 });
-const layer$8 = (definitions = Definitions) => Layer.sync(Service$4, () => {
+const layer$9 = (definitions = Definitions) => Layer.sync(Service$4, () => {
 	let current = definitions;
 	let latest = schema_exports$7.EventSchema.latest(current);
 	const replace = Effect.fn("EventRegistry.replace")(function* (plugins) {
@@ -4869,2100 +4870,2223 @@ const layer$8 = (definitions = Definitions) => Layer.sync(Service$4, () => {
 	});
 });
 //#endregion
-//#region src/settings/merge.ts
+//#region src/model/catalog.ts
+var catalog_exports = /* @__PURE__ */ __exportAll({
+	ModelCatalog: () => catalog_exports,
+	RefreshError: () => RefreshError,
+	filename: () => filename,
+	layer: () => layer$8,
+	loadError: () => loadError,
+	models: () => models,
+	providers: () => providers,
+	refresh: () => refresh$1,
+	sync: () => sync,
+	ttlConfig: () => ttlConfig
+});
+const filename = "models.gen.json";
+/** How old the catalog may get before a check downloads a new one. */
+const ttlConfig = Config.Duration("CODEWORK_MODELS_TTL").pipe(Config.withDefault(Duration.minutes(15)));
+/** How often a server looks at the file. A look is a `stat`; only a stale file costs a download. */
+const checkEvery = Duration.minutes(1);
+var RefreshError = class extends Schema.TaggedError()("ModelCatalog.RefreshError", {
+	path: Schema.String,
+	detail: Schema.String
+}) {
+	get message() {
+		return `failed to refresh the model catalog at ${this.path}: ${this.detail}`;
+	}
+};
+/** Point aikit at `<home>/models.gen.json`, which `CODEWORK_MODELS_FILE` overrides. */
+const use = (home) => {
+	const own = hostPath.resolve(home, filename);
+	Model$1.configureCatalog(own);
+	const path = Model$1.catalogPath();
+	return {
+		path,
+		pinned: path !== own
+	};
+};
+const modified = (path) => fileSystem.stat(path).pipe(Effect.map((info) => Option.map(info.mtime, (date) => date.getTime())), Effect.orElseSucceed(() => Option.none()));
+const stale = Effect.fn("ModelCatalog.stale")(function* (path) {
+	const mtime = yield* modified(path);
+	if (Option.isNone(mtime)) return true;
+	const ttl = yield* ttlConfig;
+	return (yield* Clock.currentTimeMillis) - mtime.value >= Duration.toMillis(ttl);
+});
+const download$1 = (path) => Effect.tryPromise({
+	try: () => generateModels({ path }),
+	catch: (cause) => new RefreshError({
+		path,
+		detail: cause instanceof Error ? cause.message : String(cause)
+	})
+});
+/** Download a new catalog for the home when it is missing, older than the TTL, or `force` asks. */
+const refresh$1 = Effect.fn("ModelCatalog.refresh")(function* (home, options = {}) {
+	const { path } = use(home);
+	if (options.force !== true && !(yield* stale(path))) return {
+		path,
+		refreshed: false
+	};
+	yield* download$1(path);
+	return {
+		path,
+		refreshed: true
+	};
+});
 /**
-* A plain string-keyed record: what a settings patch merges, and what a plugin's `options` block
-* has to be. A Map, a typed array or a class instance is an object to `typeof` and not one of
-* these — `Object.freeze` alone does not tell them apart, and it throws on some of them.
+* The automatic check: refresh a stale catalog unless it is pinned, and never fail. A failed
+* download leaves the old file in place; a missing one surfaces later as a
+* `Runner.ModelCatalogError` from whatever needed it.
 */
-const isRecord$1 = (value) => Predicate.isObject(value) && !Array.isArray(value) && (Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null);
-const copy = (value) => {
-	if (Array.isArray(value)) return value.map(copy);
-	return isRecord$1(value) ? merge({}, value) : value;
+const check$1 = Effect.fn("ModelCatalog.check")(function* ({ path, pinned }) {
+	if (pinned || !(yield* stale(path))) return;
+	yield* download$1(path);
+});
+const quietly = (effect) => effect.pipe(Effect.asVoid, Effect.catch((error) => Effect.logWarning(`model catalog: ${error.message}`)));
+/** Check the home's catalog once, for a command that runs and exits; returns the file aikit reads. */
+const sync = Effect.fn("ModelCatalog.sync")(function* (home) {
+	const target = use(home);
+	yield* quietly(check$1(target));
+	return target.path;
+});
+/**
+* Check at boot, and with `watch`, keep checking for the life of the layer. A file whose mtime
+* moved -- refreshed here, by `codework models refresh`, or by hand -- is reloaded, so the
+* process never serves a catalog older than what is on disk.
+*/
+const layer$8 = (options) => Layer.effectDiscard(Effect.gen(function* () {
+	const target = use(options.home);
+	yield* quietly(check$1(target));
+	if (!options.watch) return;
+	const current = modified(target.path).pipe(Effect.map(Option.getOrUndefined));
+	const seen = yield* Ref.make(yield* current);
+	const tick = Effect.gen(function* () {
+		yield* quietly(check$1(target));
+		const mtime = yield* current;
+		if (mtime !== (yield* Ref.getAndSet(seen, mtime))) Model$1.reloadCatalog();
+	});
+	yield* Effect.forkScoped(tick.pipe(Effect.repeat(Schedule.spaced(checkEvery))));
+}));
+/** Translate aikit's catalog failure, or undefined for anything else. */
+const loadError = (cause) => {
+	if (typeof cause !== "object" || cause === null || !("name" in cause) || cause.name !== "ModelCatalogLoadError") return;
+	if (!("data" in cause) || typeof cause.data !== "object" || cause.data === null) return void 0;
+	const data = cause.data;
+	if (!("path" in data) || typeof data.path !== "string" || !("message" in data) || typeof data.message !== "string" || !("reason" in data) || data.reason !== "missing" && data.reason !== "unreadable" && data.reason !== "empty" && data.reason !== "invalid") return;
+	return new ModelCatalogError({
+		path: data.path,
+		reason: data.reason,
+		detail: data.message
+	});
 };
-/** Null/undefined properties are absent, objects merge, and arrays replace. Never mutates inputs. */
-function merge(base, ...patches) {
-	const result = /* @__PURE__ */ new Map();
-	for (const patch of [base, ...patches]) {
-		if (patch === void 0) continue;
-		for (const [key, value] of Object.entries(patch)) {
-			if (value === null || value === void 0) continue;
-			const previous = result.get(key);
-			result.set(key, isRecord$1(previous) && isRecord$1(value) ? merge(previous, value) : copy(value));
-		}
-	}
-	return Object.fromEntries(result);
-}
-/** Normalize nullable properties before schema validation, without changing array positions. */
-const normalize$1 = copy;
+const catalogError = (cause) => loadError(cause) ?? new ModelCatalogError({
+	path: Model$1.catalogPath(),
+	reason: "unreadable",
+	detail: cause instanceof Error ? cause.message : "failed to load the model catalog"
+});
+const models = Effect.tryPromise({
+	try: () => Model$1.getBuiltInModels(),
+	catch: catalogError
+});
+const providers = Effect.tryPromise({
+	try: () => Model$1.getProviders(),
+	catch: catalogError
+});
 //#endregion
-//#region src/util/module.ts
-/*!
-* Adapted from OpenCode packages/util/src/runtime/import.node.ts.
-*
-* MIT License
-*
-* Copyright (c) 2025 opencode
-*
-* Permission is hereby granted, free of charge, to any person obtaining a copy
-* of this software and associated documentation files (the "Software"), to deal
-* in the Software without restriction, including without limitation the rights
-* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-* copies of the Software, and to permit persons to whom the Software is
-* furnished to do so, subject to the following conditions:
-*
-* The above copyright notice and this permission notice shall be included in all
-* copies or substantial portions of the Software.
-*
-* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-* AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-* SOFTWARE.
-*/
+//#region src/plugin/plugin.ts
+var plugin_exports$1 = /* @__PURE__ */ __exportAll({});
+import * as import__codeworksh_plugin_plugin from "@codeworksh/plugin/plugin";
+__reExport(plugin_exports$1, import__codeworksh_plugin_plugin);
+//#endregion
+//#region src/plugin/builtin/prompt/default.ts
+/** The default coding-agent foundation, used unless `promptCustom` replaces it. */
+const foundation = `You are an expert coding assistant operating inside codework, a coding agent harness.`;
 /**
-* Packages a plugin must share with the harness instead of using the copy installed beside it.
-*
-* A plugin is installed into the store as its own npm tree, so `effect` and the plugin SDK land
-* there a second time. Two copies of the *same version* are still two module instances, and
-* Effect Schema's checks do not survive the crossing: a schema built by one copy and evaluated by
-* the other reports every check as failed, so a tool whose success type is `Schema.Finite` dies
-* on "Expected a finite number" for `22800`. Nothing about that is visible at registration --
-* `Schema.isSchema` passes, the JSON Schema is derived correctly, and the tool reaches the model
-* -- so it surfaces on the first call rather than at boot.
+* Guidelines that hold regardless of which tools are registered.
 *
-* Resolution is the right place to fix it. A symlink into the store cannot be: a generation is
-* immutable and shared by every project on the machine, while the harness doing the loading is
-* whichever one is running now, and two applications embedding the harness need not agree on
-* where their `effect` lives.
+* Kept short on purpose. Every line here is spent on every request, so a line
+* earns its place only if a model measurably behaves worse without it.
 */
-const sharedPackages = /* @__PURE__ */ new Set(["effect", "@codeworksh/plugin"]);
-/** The package a bare specifier names: `effect/Schema` -> `effect`, `@a/b/c` -> `@a/b`. */
-function packageOf(specifier) {
-	if (specifier.startsWith(".") || specifier.startsWith("/") || specifier.includes(":")) return "";
-	const segments = specifier.split("/");
-	return specifier.startsWith("@") ? segments.slice(0, 2).join("/") : segments[0] ?? "";
-}
+const standingGuidelines = [
+	"Be concise. Report what you did and what you found, not what you are about to do.",
+	"Quote exact paths and command output rather than paraphrasing them.",
+	"If a command fails, read the error before retrying."
+];
+/** Collapse whitespace so two spellings of one guideline dedupe against each other. */
+const normalize$1 = (value) => value.trim().replace(/\s+/g, " ");
 /**
-* Resolve the shared packages as though this module had imported them, for as long as `run`
-* takes. Anything else resolves exactly as it would have.
+* Tool-contributed guidelines followed by the standing ones, normalized and
+* deduplicated with first occurrence winning.
+*
+* Tool order is bucket order, which is the same order the index renders in and the
+* same order the provider receives definitions in -- one ordering, not three.
 */
-function withSharedModules(run) {
-	const hook = registerHooks({ resolve(specifier, context, nextResolve) {
-		return sharedPackages.has(packageOf(specifier)) ? nextResolve(specifier, {
-			...context,
-			parentURL: import.meta.url
-		}) : nextResolve(specifier, context);
-	} });
-	return run().finally(() => hook.deregister());
-}
-/** Use Node's main loader even when the caller runs inside a bundler or test VM. */
-async function importModule(specifier) {
-	const imported = await withSharedModules(() => new Script(`import(${JSON.stringify(specifier)})`, { importModuleDynamically: constants.USE_MAIN_CONTEXT_DEFAULT_LOADER }).runInThisContext());
-	if (typeof imported !== "object" || imported === null) return imported;
-	const module = imported;
-	const exports = module["module.exports"];
-	if (exports !== module.default || typeof exports !== "object" && typeof exports !== "function" || exports === null) return imported;
-	return Object.assign({}, module, exports);
-}
-/** Node resolution scoped synchronously to the caller. */
-function resolveModule(specifier, directory, conditions) {
-	const hook = registerHooks({ resolve(target, context, nextResolve) {
-		return nextResolve(target, {
-			...context,
-			parentURL: pathToFileURL(path.join(directory, "package.json")).href,
-			...conditions === void 0 ? {} : { conditions: [.../* @__PURE__ */ new Set([...context.conditions, ...conditions])] }
-		});
-	} });
-	try {
-		const resolve = (target) => {
-			const resolved = import.meta.resolve(path.isAbsolute(target) ? pathToFileURL(target).href : target);
-			if (resolved.startsWith("file:")) statSync(new URL(resolved));
-			return resolved;
-		};
-		try {
-			return resolve(specifier);
-		} catch (error) {
-			if (path.extname(specifier) || !missing(error)) throw error;
-			for (const extension of [
-				".ts",
-				".tsx",
-				".js",
-				".jsx",
-				".mts",
-				".mjs",
-				".cts",
-				".cjs"
-			]) try {
-				return resolve(specifier + extension);
-			} catch (cause) {
-				if (!missing(cause)) throw cause;
-			}
-			throw error;
-		}
-	} finally {
-		hook.deregister();
+const guidelines = (tools) => {
+	const seen = /* @__PURE__ */ new Set();
+	const collected = [];
+	for (const line of [...tools.flatMap((tool) => tool.promptGuidelines ?? []), ...standingGuidelines]) {
+		const normalized = normalize$1(line);
+		if (normalized.length === 0 || seen.has(normalized)) continue;
+		seen.add(normalized);
+		collected.push(normalized);
 	}
-}
-function missing(error) {
-	return error instanceof Error && "code" in error && [
-		"ENOENT",
-		"ENOTDIR",
-		"ERR_MODULE_NOT_FOUND"
-	].includes(String(error.code));
-}
-//#endregion
-//#region src/plugin/error.ts
+	return collected;
+};
 /**
-* The reference as the person wrote it -- the string they will recognise in their settings file,
-* never the resolved path or the canonical spec. Every plugin failure carries one.
+* The rendered tool index.
+*
+* `(none)` rather than an omitted section: a model told it has no tools behaves
+* better than one left to infer it from silence.
 */
-const Reference = Schema.String;
+const toolIndex = (tools) => {
+	const listed = tools.filter((tool) => tool.promptSnippet !== void 0 && tool.promptSnippet.length > 0);
+	if (listed.length === 0) return "(none)";
+	return listed.map((tool) => `- ${tool.name}: ${tool.promptSnippet}`).join("\n");
+};
+const assemble = (input) => {
+	const sections = [input.promptCustom ?? foundation];
+	sections.push(`Available tools:\n${toolIndex(input.tools)}`);
+	const lines = guidelines(input.tools);
+	if (lines.length > 0) sections.push(`Guidelines:\n${lines.map((line) => `- ${line}`).join("\n")}`);
+	const append = input.promptSystemAppend?.trim();
+	if (append !== void 0 && append.length > 0) sections.push(append);
+	sections.push(`Current working directory: ${input.directory}`);
+	return sections.join("\n\n");
+};
 /**
-* The settings file that declared the entry, when one did.
-*
-* Absent for an embedder's own list and for anything the CLI was handed directly -- in both cases
-* the caller already knows where the string came from. It is the settings path that needs saying,
-* because several layers accumulate entries and "which file says this" is the question.
+* A caller slot, awaited lazily. A throw or rejection fails the snapshot, which the
+* host attributes to this plugin's id.
 */
-const File$1 = Schema.optional(Schema.String);
+const slot = (ctx, resolver) => Effect.tryPromise(() => Promise.resolve(resolver?.(ctx)));
+const defaultPromptPlugin = (0, plugin_exports$1.define)({
+	id: "codework.prompt.default",
+	kind: "prompt",
+	setup: Effect.fn("DefaultPromptPlugin.setup")(function* (ctx) {
+		const custom = yield* slot(ctx, ctx.config.promptCustom);
+		const append = yield* slot(ctx, ctx.config.promptSystemAppend);
+		ctx.plugin.prompt.set(assemble({
+			tools: ctx.plugin.tools.list(),
+			directory: ctx.location.directory,
+			...custom === void 0 ? {} : { promptCustom: custom },
+			...append === void 0 ? {} : { promptSystemAppend: append }
+		}));
+	})
+});
+//#endregion
+//#region src/tool/truncate.ts
 /**
-* A spec that cannot be installed at all.
+* Shared truncation utilities for tool outputs.
 *
-* `plugin-not-found` is a local path with nothing at it; `plugin-not-installed` (the store's) is a
-* package spec with no entry. The first is a mistake in a settings file, the second is fixed by
-* `plugin install`, and keeping them apart is most of the value of having slugs.
-*/
-var SourceError = class extends Schema.TaggedError()("PluginSourceError", {
-	reason: Schema.Literals([
-		"plugin-unsupported-source",
-		"plugin-not-found",
-		"plugin-escapes-root"
-	]),
-	reference: Reference,
-	file: File$1,
-	message: Schema.String
-}) {};
-/** A spec that is installable, and whose install did not produce a usable package. */
-var InstallError = class extends Schema.TaggedError()("PluginInstallError", {
-	reason: Schema.Literals([
-		"plugin-resolve-failed",
-		"plugin-fetch-failed",
-		"plugin-no-commit",
-		"plugin-no-entrypoint"
-	]),
-	reference: Reference,
-	file: File$1,
-	message: Schema.String,
-	cause: Schema.optional(Schema.Defect())
-}) {};
-/**
-* A module that reached the import and did not come back as a plugin.
-*
-* Distinct from {@link InstallError}: the bytes are here and are fine as *bytes*. What failed is
-* evaluating them, or what they turned out to export -- which is the distinction a caller acts on,
-* because one is fixed by installing and the other by editing code.
-*/
-var LoadError = class extends Schema.TaggedError()("PluginLoadError", {
-	reason: Schema.Literals([
-		"plugin-import-failed",
-		"plugin-missing-dependency",
-		"plugin-not-compiled",
-		"plugin-invalid-definition"
-	]),
-	reference: Reference,
-	file: File$1,
-	message: Schema.String,
-	/** The ID the module declared, when it got far enough to declare one. */
-	id: Schema.optional(Schema.String),
-	cause: Schema.optional(Schema.Defect())
-}) {};
-/** The store's own failures: what is filed, what is not, and what could not be claimed. */
-var StoreError = class extends Schema.TaggedError()("PluginStoreError", {
-	reason: Schema.Literals([
-		"plugin-not-installed",
-		"plugin-lock-timeout",
-		"plugin-marker-invalid",
-		"plugin-index-invalid",
-		"plugin-collect-failed"
-	]),
-	reference: Reference,
-	file: File$1,
-	message: Schema.String,
-	cause: Schema.optional(Schema.Defect())
-}) {};
-/**
-* Note which settings file declared the entry a failure came from.
-*
-* The store and the installer raise their own failures without knowing that, because neither is
-* told: they are handed a spec, not a settings layer. The loader knows, and this is where it says
-* so -- leaving an existing answer alone, since a more specific one is already better.
-*/
-const declaredIn = (error, file) => {
-	if (error.file !== void 0) return error;
-	const shared = {
-		reference: error.reference,
-		message: error.message,
-		file
-	};
-	if (Schema.is(SourceError)(error)) return new SourceError({
-		...shared,
-		reason: error.reason
-	});
-	if (Schema.is(InstallError)(error)) return new InstallError({
-		...shared,
-		reason: error.reason,
-		cause: error.cause
-	});
-	if (Schema.is(LoadError)(error)) return new LoadError({
-		...shared,
-		reason: error.reason,
-		id: error.id,
-		cause: error.cause
-	});
-	if (Schema.is(StoreError)(error)) return new StoreError({
-		...shared,
-		reason: error.reason,
-		cause: error.cause
-	});
-	return error;
-};
-//#endregion
-//#region src/util/path.ts
-/**
-* A directory that crosses into the harness is absolute, and a relative one is a **defect** rather
-* than an error.
-*
-* A relative path is a disguised `process.cwd()` call: and every consumer
-* resolves it silently. `path.resolve("x")` anchors to the process directory, npm answers a
-* relative `cwd` with a `localPrefix` of whatever repository the process is inside (measured, not
-* assumed), and `Session.link` would write the *server's* directory into a field whose whole
-* purpose is to be a host path the client declared.
-*
-* For a long-running server the process directory is nobody's project, so the result is a
-* plausible answer to a question no one asked.
-* An absolute path is the one spelling none of them can quietly reinterpret.
-*
-* A defect rather than a typed error because nothing a user types reaches here. Every reference
-* goes through `parse`, and every directory comes from `Global.resolve`, a resolved `cwd` or a
-* session's `hostDir`, all of them already absolute. A relative one means a new call site got it
-* wrong, and a stack trace names that call site; a typed error would ask every caller to handle a
-* case none of them can cause.
-*/
-const rooted = (directory, role) => {
-	if (hostPath.isAbsolute(directory)) return directory;
-	throw new Error(`${role} must be an absolute path, got ${JSON.stringify(directory)}`);
-};
-//#endregion
-//#region src/plugin/npm.ts
-const Manifest$1 = Schema.Struct({ version: Schema.optional(Schema.String) });
-const Lockfile = Schema.Struct({ packages: Schema.optional(Schema.Record(Schema.String, Schema.Struct({ resolved: Schema.optional(Schema.String) }))) });
-/**
-* npm's flattened config: registry, scopes, auth, and cache paths.
-*
-* Built in one place, because two call sites deriving it separately is how the cache location
-* drifts between an install and the staleness check that is supposed to describe it.
-*
-* `dir` is where the `.npmrc` chain is read from, and it is the **host directory the caller
-* belongs to** -- never the staging directory and never the cache. A company repo keeps its
-* private registry and its scoped token in its own `.npmrc`, so a chain read anywhere else
-* resolves the plugin against the public registry and fails 404, or worse, installs a public
-* package of the same name. This is the registry half of auth; the git half is below.
-*
-* No `--prefix`. npm pins its local prefix to a `--prefix` on `argv` and stops walking, so
-* passing one would look up exactly `<dir>/.npmrc` and nothing above it -- wrong for a person
-* standing in `packages/x` whose token lives at the repository root. Without it npm walks up from
-* `cwd` to the nearest `package.json` or `node_modules` exactly as `npm` itself would if it were
-* run there, which is the only rule a user can predict.
-*
-* `--cache` is ours and is passed on `argv`, which outranks every `.npmrc`. npm's `flatten`
-* derives `_cacache`, `_npx` and `_tuf` from that one value, so naming the parent is enough --
-* and overriding `flat.cache` afterwards would redirect one of the three and leave `_tuf` pointing
-* at the user's home. `--home` exists to make a run self-contained; anything reached by an ambient
-* default is a test reading the developer's real machine.
-*
-* **Nothing here names an `env`.** npm hands git `opts.env` when one is present and falls back to
-* `{ ...gitDefaults, ...process.env }` when it is not, so leaving it out is what lets a git source
-* reach a private remote at all: `SSH_AUTH_SOCK` finds the agent, `HOME` finds the `~/.gitconfig`
-* that names the credential helper, and `PATH` finds `git`. Setting `env` to anything -- even to
-* a copy of `process.env` -- would be a standing invitation to prune it later and break private
-* git silently, months from the change. §15 Q2.
-*/
-const options = (dir, cache) => Effect.suspend(() => {
-	const root = rooted(dir, "the directory a plugin install reads its .npmrc chain from");
-	const store = rooted(cache, "the npm cache");
-	return npmOptions(root, store);
-});
-const npmOptions = (dir, cache) => Effect.gen(function* () {
-	const config = yield* Effect.tryPromise(async () => {
-		const { default: Config } = await import("@npmcli/config");
-		const { definitions, flatten, nerfDarts, shorthands } = (await import("@npmcli/config/lib/definitions/index.js")).default;
-		const created = new Config({
-			npmPath: fileURLToPath(new URL("..", import.meta.url)),
-			cwd: dir,
-			env: { ...process.env },
-			argv: [
-				process.execPath,
-				process.execPath,
-				"--cache",
-				hostPath.join(cache, "npm")
-			],
-			execPath: process.execPath,
-			platform: process.platform,
-			definitions,
-			flatten,
-			nerfDarts,
-			shorthands,
-			warn: false
-		});
-		await created.load();
-		return created;
-	}).pipe(Effect.catch((cause) => Effect.logWarning(`cannot load npm configuration from ${dir}; npm defaults apply`, cause).pipe(Effect.as(void 0))));
-	if (config === void 0) return { allowGit: "root" };
-	for (const kind of [
-		"project",
-		"user",
-		"global"
-	]) {
-		const loaded = config.data.get(kind);
-		if (loaded?.loadError !== void 0 && loaded.loadError.code !== "ENOENT") yield* Effect.logWarning(`cannot read npm configuration ${loaded.source ?? `for ${kind}`}; npm defaults apply`, loaded.loadError);
-	}
-	return {
-		...config.flat,
-		allowGit: "root"
-	};
-});
-const PUBLIC_REGISTRY = "https://registry.npmjs.org/";
-/** Stable, credential-free registry identity used to address registry artifacts in the store. */
-const registry = Effect.fn("PluginNpm.registry")(function* (target, cache, from) {
-	const flat = yield* options(from, cache);
-	const scope = target.name.startsWith("@") ? target.name.slice(0, target.name.indexOf("/")) : void 0;
-	const configured = (scope === void 0 ? void 0 : flat[`${scope}:registry`]) ?? flat.registry ?? PUBLIC_REGISTRY;
-	if (typeof configured !== "string") return yield* new InstallError({
-		reason: "plugin-resolve-failed",
-		reference: target.spec,
-		message: `npm registry for ${target.name} is not a URL`
-	});
-	return yield* Effect.try({
-		try: () => {
-			const value = new URL(configured);
-			value.username = "";
-			value.password = "";
-			value.hash = "";
-			return value.href;
-		},
-		catch: (cause) => new InstallError({
-			reason: "plugin-resolve-failed",
-			reference: target.spec,
-			message: `npm registry for ${target.name} is not a valid URL: ${configured}`,
-			cause
-		})
-	});
-});
-/** A 40- or 64-hex commit out of the `resolved` URL arborist writes into the lockfile. */
-const commitIn = (resolved) => resolved?.match(/#([a-f0-9]{40}|[a-f0-9]{64})(?=::|$)/i)?.[1];
-/**
-* The commit a git install actually landed on, read back from the lockfile arborist wrote.
-*
-* Both spellings are tried because which one exists depends on whether the tree was saved.
-*/
-const commit = Effect.fn("PluginNpm.commit")(function* (root, name) {
-	for (const file of [hostPath.join(root, "package-lock.json"), hostPath.join(root, "node_modules", ".package-lock.json")]) {
-		const parsed = yield* fileSystem.readFileString(file).pipe(Effect.flatMap(Schema.decodeUnknownEffect(Schema.fromJsonString(Lockfile))), Effect.option);
-		if (Option.isNone(parsed)) continue;
-		const found = commitIn(parsed.value.packages?.[`node_modules/${name}`]?.resolved);
-		if (found !== void 0) return found;
-	}
-});
-/** Node error codes that mean "nothing here", as opposed to "this package is broken". */
-const notFound = /* @__PURE__ */ new Set([
-	"ENOENT",
-	"ENOTDIR",
-	"MODULE_NOT_FOUND",
-	"ERR_MODULE_NOT_FOUND",
-	"ERR_PACKAGE_PATH_NOT_EXPORTED",
-	"ERR_UNSUPPORTED_DIR_IMPORT"
-]);
-/**
-* The module to import out of an installed package.
-*
-* Ordered subpaths through the package's own `exports`, so a package that publishes a dedicated
-* `./plugin` entry is honoured and one that does not falls back to its main.
-*
-* Only "not found" is tolerated. Swallowing every error would turn a package that is broken --
-* a syntax error in its manifest, a permission problem -- into "no entrypoint", which is the
-* wrong diagnosis in the one place a person needs the right one.
-*/
-const entrypoint = (directory, name) => Effect.gen(function* () {
-	for (const subpath of ["", "plugin"]) {
-		const specifier = name === void 0 ? hostPath.join(directory, subpath === "" ? "index" : subpath) : hostPath.join(name, subpath);
-		const resolved = yield* Effect.try(() => resolveModule(specifier, directory)).pipe(Effect.asSome, Effect.catchIf((error) => notFound.has(String(error.cause?.code)), () => Effect.succeed(Option.none())), Effect.mapError((error) => new InstallError({
-			reason: "plugin-no-entrypoint",
-			reference: name ?? directory,
-			message: `cannot resolve an entrypoint in ${directory}`,
-			cause: error
-		})));
-		if (Option.isSome(resolved)) return fileURLToPath(resolved.value);
-	}
-	return yield* new InstallError({
-		reason: "plugin-no-entrypoint",
-		reference: name ?? directory,
-		message: `no plugin entrypoint in ${directory}`
-	});
-});
-const reify = Effect.fn("PluginNpm.reify")(function* ({ target, into, cache, from }) {
-	const flat = yield* options(from, cache);
-	const { Arborist } = yield* Effect.promise(() => import("@npmcli/arborist"));
-	const settings = {
-		...flat,
-		...target.mutable ? {
-			preferOnline: true,
-			noGitRevCache: true
-		} : {},
-		audit: false
-	};
-	const arborist = new Arborist({
-		...settings,
-		path: into,
-		binLinks: true,
-		progress: false,
-		savePrefix: "",
-		ignoreScripts: true
-	});
-	return yield* Effect.tryPromise({
-		try: () => arborist.reify({
-			...settings,
-			add: [target.spec],
-			update: target.mutable,
-			save: true,
-			saveType: "prod"
-		}),
-		catch: (cause) => new InstallError({
-			reason: "plugin-fetch-failed",
-			reference: target.spec,
-			message: `cannot install ${target.spec}`,
-			cause
-		})
-	});
-});
-/**
-* Fill `into` with the package `target` names, and report what landed there.
+* Truncation is based on two independent limits — whichever is hit first
+* wins: a line limit and a byte limit. Lines are never split (except the bash
+* tail edge case where a single line exceeds the byte limit).
 *
-* A local target downloads nothing: the files on disk are already the answer, and a local plugin
-* is never copied into the store.
+* The bash tool uses {@link truncateTail} (keep the end — errors / final
+* results); file readers use {@link truncateHead} (keep the beginning).
 */
-const download = Effect.fn("PluginNpm.download")(function* (input) {
-	const { target, into, cache, from, runner = reify } = input;
-	if (target.kind === "local") return {
-		directory: target.path,
-		name: hostPath.basename(target.path),
-		entrypoint: yield* entrypoint(target.path)
-	};
-	const root = yield* fileSystem.realPath(into).pipe(Effect.mapError((cause) => new InstallError({
-		reason: "plugin-fetch-failed",
-		reference: target.spec,
-		message: `cannot resolve the staging directory ${into}`,
-		cause
-	})));
-	const node = (yield* runner({
-		target,
-		into: root,
-		cache,
-		from
-	})).edgesOut.values().next().value?.to;
-	if (node === void 0) return yield* new InstallError({
-		reason: "plugin-fetch-failed",
-		reference: target.spec,
-		message: `${target.spec} installed nothing`
-	});
-	const manifest = yield* fileSystem.readFileString(hostPath.join(node.path, "package.json")).pipe(Effect.flatMap(Schema.decodeUnknownEffect(Schema.fromJsonString(Manifest$1))), Effect.option);
-	const version = Option.isNone(manifest) ? void 0 : manifest.value.version;
-	const revision = target.kind === "registry" ? version : (yield* commit(root, node.name)) ?? (yield* noCommit(target.spec));
-	return {
-		directory: node.path,
-		name: node.name,
-		...version === void 0 ? {} : { version },
-		...revision === void 0 ? {} : { revision },
-		entrypoint: yield* entrypoint(node.path, node.name)
-	};
-});
-const noCommit = (spec) => new InstallError({
-	reason: "plugin-no-commit",
-	reference: spec,
-	message: `cannot resolve a commit for ${spec}`
-});
+const DEFAULT_MAX_LINES = 2e3;
+const DEFAULT_MAX_BYTES = 51200;
+function splitLinesForCounting(content) {
+	if (content.length === 0) return [];
+	const lines = content.split("\n");
+	if (content.endsWith("\n")) lines.pop();
+	return lines;
+}
+/** Format bytes as a human-readable size. */
+function formatSize(bytes) {
+	if (bytes < 1024) return `${bytes}B`;
+	if (bytes < 1048576) return `${(bytes / 1024).toFixed(1)}KB`;
+	return `${(bytes / 1048576).toFixed(1)}MB`;
+}
 /**
-* What a mutable target points at right now, without installing it.
-*
-* `preferOnline` and `noGitRevCache` are the whole point: without them pacote answers from its own
-* metadata cache, and a staleness check that reads a cache is not a staleness check. An immutable
-* target skips the call entirely -- a version and a SHA cannot move.
+* Truncate content from the tail (keep the last N lines/bytes). Suitable for
+* bash output where the end matters (errors, final results). May return a
+* partial first line if the last line of the original content exceeds the byte
+* limit.
 */
-const probe = Effect.fn("PluginNpm.probe")(function* (target, cache, from) {
-	if (target.kind === "local" || !target.mutable) return void 0;
-	const opts = {
-		...yield* options(from, cache),
-		preferOnline: true,
-		noGitRevCache: true,
-		_isRoot: true
+function truncateTail(content, options = {}) {
+	const maxLines = options.maxLines ?? 2e3;
+	const maxBytes = options.maxBytes ?? 51200;
+	const totalBytes = Buffer.byteLength(content, "utf-8");
+	const lines = splitLinesForCounting(content);
+	const totalLines = lines.length;
+	if (totalLines <= maxLines && totalBytes <= maxBytes) return {
+		content,
+		truncated: false,
+		truncatedBy: null,
+		totalLines,
+		totalBytes,
+		outputLines: totalLines,
+		outputBytes: totalBytes,
+		lastLinePartial: false,
+		firstLineExceedsLimit: false,
+		maxLines,
+		maxBytes
 	};
-	const { default: pacote } = yield* Effect.promise(() => import("pacote"));
-	return yield* Effect.tryPromise({
-		try: async () => target.kind === "registry" ? (await pacote.manifest(target.spec, opts)).version : commitIn(await pacote.resolve(target.spec, opts)),
-		catch: (cause) => new InstallError({
-			reason: "plugin-resolve-failed",
-			reference: target.spec,
-			message: `cannot reach ${target.spec}`,
-			cause
-		})
-	});
-});
-/** A `file:` URL for an entrypoint, which is what the module loader takes. */
-const url = (entrypoint) => pathToFileURL(entrypoint).href;
-//#endregion
-//#region src/plugin/plugin.ts
-var plugin_exports$1 = /* @__PURE__ */ __exportAll({});
-import * as import__codeworksh_plugin_plugin from "@codeworksh/plugin/plugin";
-__reExport(plugin_exports$1, import__codeworksh_plugin_plugin);
-//#endregion
-//#region src/plugin/source.ts
-/** A committish that names one artifact rather than a moving branch: an unabbreviated SHA. */
-const isCommit = (committish) => typeof committish === "string" && /^[a-f0-9]{40}$|^[a-f0-9]{64}$/i.test(committish);
-/**
-* A short, readable name for a git source, used to make a store path recognisable to a human
-* reading `ls`. It is never an identity: two remotes can slug alike, and the digest is what
-* separates them.
-*/
-const slug = (spec) => {
-	const withoutCommittish = spec.split("#")[0] ?? spec;
-	return (() => {
-		try {
-			return decodeURIComponent(withoutCommittish);
-		} catch {
-			return withoutCommittish;
+	const outputLinesArr = [];
+	let outputBytesCount = 0;
+	let truncatedBy = "lines";
+	let lastLinePartial = false;
+	for (let i = lines.length - 1; i >= 0 && outputLinesArr.length < maxLines; i--) {
+		const line = lines[i] ?? "";
+		const lineBytes = Buffer.byteLength(line, "utf-8") + (outputLinesArr.length > 0 ? 1 : 0);
+		if (outputBytesCount + lineBytes > maxBytes) {
+			truncatedBy = "bytes";
+			if (outputLinesArr.length === 0) {
+				const truncatedLine = truncateStringToBytesFromEnd(line, maxBytes);
+				outputLinesArr.unshift(truncatedLine);
+				outputBytesCount = Buffer.byteLength(truncatedLine, "utf-8");
+				lastLinePartial = true;
+			}
+			break;
 		}
-	})().replace(/\.git$/i, "").split(/[/:\\]/).at(-1)?.replace(/[^a-zA-Z0-9._-]+/g, "-").replace(/^-+|-+$/g, "") || "repository";
-};
-/** Whether a reference names a place on disk rather than something to fetch. */
-const isPath = (reference) => reference.startsWith("file:") || reference.startsWith("./") || reference.startsWith("../") || hostPath.isAbsolute(reference);
+		outputLinesArr.unshift(line);
+		outputBytesCount += lineBytes;
+	}
+	if (outputLinesArr.length >= maxLines && outputBytesCount <= maxBytes) truncatedBy = "lines";
+	const outputContent = outputLinesArr.join("\n");
+	const finalOutputBytes = Buffer.byteLength(outputContent, "utf-8");
+	return {
+		content: outputContent,
+		truncated: true,
+		truncatedBy,
+		totalLines,
+		totalBytes,
+		outputLines: outputLinesArr.length,
+		outputBytes: finalOutputBytes,
+		lastLinePartial,
+		firstLineExceedsLimit: false,
+		maxLines,
+		maxBytes
+	};
+}
 /**
-* `from` is the directory a relative spec resolves against, and the caller picks it:
-*
-* - a **plugin entry** anchors to the directory holding the file that declared it --
-*   `<root>/.codework/` for a project entry, `<home>/` for a user one, the named directory for
-*   `--user-config-dir`. The rule is about the file, not the project.
-* - a **CLI argument** anchors to the process's startup directory, because that is where the
-*   person typed it.
+* Truncate a string to fit within a byte limit (from the end). Handles
+* multi-byte UTF-8 characters correctly (never splits a codepoint).
 */
-const parse$2 = (reference, from) => Effect.gen(function* () {
-	const fail = (reason, message) => new SourceError({
-		reason,
-		reference,
-		message
-	});
-	rooted(from, "the directory a plugin reference anchors to");
-	if (reference.startsWith("file:")) {
-		if (!reference.startsWith("file:///")) return yield* fail("plugin-unsupported-source", `not an absolute file URL: ${reference}`);
-		return {
-			kind: "local",
-			path: fileURLToPath(reference)
-		};
+function truncateStringToBytesFromEnd(str, maxBytes) {
+	const buf = Buffer.from(str, "utf-8");
+	if (buf.length <= maxBytes) return str;
+	let start = buf.length - maxBytes;
+	while (start < buf.length && (buf[start] & 192) === 128) start++;
+	return buf.subarray(start).toString("utf-8");
+}
+//#endregion
+//#region src/tool/accumulator.ts
+function defaultTempFilePath(prefix, suffix) {
+	return posix.join(tmpdir(), `${prefix}-${suffix}.log`);
+}
+function byteLength(text) {
+	return Buffer.byteLength(text, "utf-8");
+}
+var Accumulator = class {
+	maxLines;
+	maxBytes;
+	maxRollingBytes;
+	tempFilePrefix;
+	decoder = new TextDecoder();
+	rawChunks = [];
+	tailText = "";
+	tailBytes = 0;
+	tailStartsAtLineBoundary = true;
+	totalRawBytes = 0;
+	totalDecodedBytes = 0;
+	completedLines = 0;
+	totalLines = 0;
+	currentLineBytes = 0;
+	hasOpenLine = false;
+	finished = false;
+	tempFilePath;
+	tempFile;
+	constructor(options = {}) {
+		this.maxLines = options.maxLines ?? 2e3;
+		this.maxBytes = options.maxBytes ?? 51200;
+		this.maxRollingBytes = Math.max(this.maxBytes * 2, 1);
+		this.tempFilePrefix = options.tempFilePrefix ?? "codework-output";
 	}
-	const expanded = expandTilde(reference, hostPath);
-	if (isPath(expanded)) return {
-		kind: "local",
-		path: hostPath.resolve(from, expanded)
-	};
-	const parsed = yield* Effect.try({
-		try: () => npa(reference),
-		catch: () => fail("plugin-unsupported-source", `cannot parse plugin source: ${reference}`)
-	});
-	if (parsed.type === "git") {
-		const { gitSubdir } = parsed;
-		return {
-			kind: "git",
-			slug: slug(reference),
-			spec: reference,
-			...parsed.gitCommittish == null ? {} : { committish: parsed.gitCommittish },
-			...gitSubdir == null ? {} : { subdir: gitSubdir },
-			mutable: !isCommit(parsed.gitCommittish)
-		};
+	append(data) {
+		return Effect.suspend(() => {
+			if (this.finished) return Effect.die(/* @__PURE__ */ new Error("cannot append to a finished output accumulator"));
+			this.totalRawBytes += data.length;
+			this.appendDecodedText(this.decoder.decode(data, { stream: true }));
+			if (this.tempFile !== void 0 || this.shouldUseTempFile()) return Effect.gen({ self: this }, function* () {
+				yield* this.ensureTempFile();
+				yield* this.tempFile.writeAll(data).pipe(Effect.orDie);
+			});
+			if (data.length > 0) this.rawChunks.push(data);
+			return Effect.void;
+		});
 	}
-	if (parsed.name !== null && [
-		"version",
-		"range",
-		"tag"
-	].includes(parsed.type)) {
-		const omitted = parsed.raw === parsed.name || parsed.raw === `${parsed.name}@`;
+	finish() {
+		return Effect.suspend(() => {
+			if (this.finished) return Effect.void;
+			this.finished = true;
+			this.appendDecodedText(this.decoder.decode());
+			return Effect.gen({ self: this }, function* () {
+				if (this.shouldUseTempFile()) yield* this.ensureTempFile();
+				if (this.tempFile !== void 0) yield* this.tempFile.sync.pipe(Effect.orDie);
+			});
+		});
+	}
+	snapshot() {
+		const tailTruncation = truncateTail(this.getSnapshotText(), {
+			maxLines: this.maxLines,
+			maxBytes: this.maxBytes
+		});
+		const truncated = this.totalLines > this.maxLines || this.totalDecodedBytes > this.maxBytes;
+		const truncatedBy = truncated ? tailTruncation.truncatedBy ?? (this.totalDecodedBytes > this.maxBytes ? "bytes" : "lines") : null;
+		const truncation = {
+			...tailTruncation,
+			truncated,
+			truncatedBy,
+			totalLines: this.totalLines,
+			totalBytes: this.totalDecodedBytes,
+			maxLines: this.maxLines,
+			maxBytes: this.maxBytes
+		};
 		return {
-			kind: "registry",
-			name: parsed.name,
-			spec: `${parsed.name}@${omitted ? "latest" : parsed.rawSpec}`,
-			mutable: parsed.type !== "version"
+			content: truncation.content,
+			truncation,
+			...this.tempFilePath === void 0 ? {} : { fullOutputPath: this.tempFilePath }
 		};
 	}
-	return yield* fail("plugin-unsupported-source", `unsupported plugin source: ${reference}`);
-});
+	/** Bytes in the final (possibly unterminated) line — for the partial-line footer. */
+	getLastLineBytes() {
+		return this.currentLineBytes;
+	}
+	appendDecodedText(text) {
+		if (text.length === 0) return;
+		const bytes = byteLength(text);
+		this.totalDecodedBytes += bytes;
+		this.tailText += text;
+		this.tailBytes += bytes;
+		if (this.tailBytes > this.maxRollingBytes * 2) this.trimTail();
+		let newlines = 0;
+		let lastNewline = -1;
+		for (let i = text.indexOf("\n"); i !== -1; i = text.indexOf("\n", i + 1)) {
+			newlines++;
+			lastNewline = i;
+		}
+		if (newlines === 0) {
+			this.currentLineBytes += bytes;
+			this.hasOpenLine = true;
+		} else {
+			this.completedLines += newlines;
+			const tail = text.slice(lastNewline + 1);
+			this.currentLineBytes = byteLength(tail);
+			this.hasOpenLine = tail.length > 0;
+		}
+		this.totalLines = this.completedLines + (this.hasOpenLine ? 1 : 0);
+	}
+	trimTail() {
+		const buffer = Buffer.from(this.tailText, "utf-8");
+		if (buffer.length <= this.maxRollingBytes) {
+			this.tailBytes = buffer.length;
+			return;
+		}
+		let start = buffer.length - this.maxRollingBytes;
+		while (start < buffer.length && (buffer[start] & 192) === 128) start++;
+		this.tailStartsAtLineBoundary = start === 0 ? this.tailStartsAtLineBoundary : buffer[start - 1] === 10;
+		this.tailText = buffer.subarray(start).toString("utf-8");
+		this.tailBytes = byteLength(this.tailText);
+	}
+	getSnapshotText() {
+		if (this.tailStartsAtLineBoundary) return this.tailText;
+		const firstNewline = this.tailText.indexOf("\n");
+		return firstNewline === -1 ? this.tailText : this.tailText.slice(firstNewline + 1);
+	}
+	shouldUseTempFile() {
+		return this.totalRawBytes > this.maxBytes || this.totalDecodedBytes > this.maxBytes || this.totalLines > this.maxLines;
+	}
+	ensureTempFile() {
+		if (this.tempFile !== void 0) return Effect.void;
+		return Effect.gen({ self: this }, function* () {
+			const suffix = Encoding.encodeHex(yield* crypto.randomBytes(8));
+			this.tempFilePath = defaultTempFilePath(this.tempFilePrefix, suffix);
+			this.tempFile = yield* fileSystem.open(this.tempFilePath, { flag: "w" });
+			for (const chunk of this.rawChunks) yield* this.tempFile.writeAll(chunk);
+			this.rawChunks = [];
+		}).pipe(Effect.orDie);
+	}
+};
+//#endregion
+//#region src/tool/progress.ts
+var progress_exports = /* @__PURE__ */ __exportAll({});
+import * as import__codeworksh_plugin_tool_progress from "@codeworksh/plugin/tool/progress";
+__reExport(progress_exports, import__codeworksh_plugin_tool_progress);
+//#endregion
+//#region src/tool/shell.ts
+/**
+* `ToolShell` — the tool-owned, cancellable command-execution capability the bash tool depends on.
+*
+* It deliberately does **not** reuse `sandbox/Shell` directly: the local OS path
+* provides no `Shell` at all, and `sandbox/Shell` models neither cancellation
+* nor a timeout. `ToolShell` makes both part of the contract. Adapters honor the
+* mid-flight process kill where the SDK allows it (local, Vercel) and fall back
+* to the timeout where it does not (Daytona) — "kill where it's easy".
+*
+* Two modes, and Local has two variants:
+*   - Local / full OS shell  → {@link local} (default)
+*   - Local / just-bash      → {@link fromSandboxShell} over `EnvBash`
+*   - Remote / provider      → {@link fromSandboxShell} over `EnvDaytona` / `EnvVercel`
+*/
+/** Infra/spawn failure — not model-actionable; handlers should treat it as a defect. */
+var ToolShellError = class extends Schema.TaggedError()("ToolShellError", {
+	command: Schema.String,
+	cause: Schema.optional(Schema.Defect())
+}) {};
+/** The command exceeded its deadline. Distinct so handlers can map it to a domain timeout. */
+var ToolShellTimeout = class extends Schema.TaggedError()("ToolShellTimeout", {
+	command: Schema.String,
+	timeoutMillis: Schema.Finite
+}) {};
+const widenExecError = (effect) => effect.pipe(Effect.mapError((error) => error));
+var ToolShell = class extends Context.Service()("@codeworksh/harness/tool/shell/ToolShell") {};
 /**
-* What two references must share to be the same plugin, without installing either.
+* Bridge the existing `sandbox/Shell` into a `ToolShell`. Used for just-bash
+* (in-process) and remote providers.
 *
-* A local path is the file it resolves to; a package is its name, so `@acme/x@1` and `@acme/x@2`
-* are one package at two versions. Pure -- nothing is installed, imported or read.
+* `cwd` and `env` both pass through to the backing `sandbox/Shell`, which
+* resolves a relative `cwd` against its mount. The buffered `exec`
+* timeout is enforced here with `Effect.timeoutOption` (interruption always
+* returns control; the underlying command is only truly killed mid-flight on
+* signal-aware backends, handled in the provider layer). When the backend exposes
+* `stream` (e.g. Vercel `Command.logs`), it is bridged to {@link IToolShell.stream}
+* so the bash tool streams over it too.
 */
-const canonical$1 = (target) => {
-	switch (target.kind) {
-		case "local": return target.path;
-		case "registry": return target.name;
-		case "git": return target.spec;
-	}
-};
+const fromSandboxShell = Layer.effect(ToolShell, Effect.gen(function* () {
+	const shell = yield* shell_exports.Shell;
+	const exec = (command, options) => {
+		const run = shell.exec(command, {
+			...options?.env ? { env: options.env } : {},
+			...options?.cwd ? { cwd: options.cwd } : {}
+		}).pipe(Effect.mapError((cause) => new ToolShellError({
+			command,
+			cause
+		})));
+		if (options?.timeout === void 0) return widenExecError(run);
+		const timeout = options.timeout;
+		return run.pipe(Effect.timeoutOption(timeout), Effect.flatMap(Option.match({
+			onNone: () => Effect.fail(new ToolShellTimeout({
+				command,
+				timeoutMillis: Duration.toMillis(timeout)
+			})),
+			onSome: Effect.succeed
+		})));
+	};
+	const sandboxStream = shell.stream;
+	const stream = sandboxStream ? (command, options) => sandboxStream(command, {
+		...options?.env ? { env: options.env } : {},
+		...options?.cwd ? { cwd: options.cwd } : {}
+	}).pipe(Stream.map((chunk) => chunk._tag === "exit" ? {
+		_tag: "Exit",
+		exitCode: chunk.exitCode
+	} : {
+		_tag: "Output",
+		bytes: chunk.bytes
+	}), Stream.mapError((cause) => new ToolShellError({
+		command,
+		cause
+	}))) : void 0;
+	return ToolShell.of(stream ? {
+		exec,
+		stream
+	} : { exec });
+}));
+Duration.seconds(1);
 //#endregion
-//#region src/plugin/index.store.ts
-const Record_ = Schema.Struct({
-	spec: Schema.String,
-	source: Schema.Literals(["registry", "git"]),
-	name: Schema.String,
-	slug: Schema.String,
-	mutable: Schema.Boolean,
-	generation: Schema.Finite,
-	version: Schema.optional(Schema.String),
-	revision: Schema.optional(Schema.String),
-	entrypoint: Schema.String,
-	installedAt: Schema.Finite,
-	checkedAt: Schema.optional(Schema.Finite),
-	outdated: Schema.optional(Schema.Boolean),
-	/** The remote revision observed at `checkedAt`; distinct from the installed `revision`. */
-	available: Schema.optional(Schema.String)
-});
-const File = Schema.Struct({
-	version: Schema.Finite,
-	entries: Schema.Record(Schema.String, Record_)
-});
-const VERSION = 1;
-const NAME = "index.json";
+//#region src/tool/tool.ts
+var tool_exports = /* @__PURE__ */ __exportAll({});
+import * as import__codeworksh_plugin_tool from "@codeworksh/plugin/tool";
+__reExport(tool_exports, import__codeworksh_plugin_tool);
+//#endregion
+//#region src/plugin/builtin/tool/bash.ts
 /**
-* Read the whole file, or start empty.
+* The self-contained bash plugin — a worked example for tool plugins. The definition is pure data;
+* the handler depends only on {@link ToolShell} / {@link ToolProgress}, never
+* `sandbox/Shell`, so the backend (local OS / just-bash / remote provider) is
+* swapped by changing the provided Layer with no change to the tool.
 *
-* An unreadable or unparseable index is not an error: it is a cold cache. Failing here would make
-* a corrupt accelerator break installs that do not need it.
+* Two execution paths, picked by capability:
+*   - **variant A (buffered)** otherwise: `ToolShell.exec` returns the full output,
+*     truncated once after completion.
+*   - **variant B (streaming)** when the backend offers `ToolShell.stream`: output
+*     flows through an {@link Accumulator} (bounded memory + temp-file spill)
+*     and is reported live via {@link ToolProgress}; on timeout the partial output
+*     produced so far is preserved.
+*
+* Success and failure carry the *same* structured shape
+* (`output`, `exitCode`, `truncated`, `fullOutputPath`)
+* — a non-zero exit is just `exitCode !== 0`, not a different kind of result.
 */
-const read = Effect.fn("PluginIndex.read")(function* (root) {
-	const parsed = yield* fileSystem.readFileString(hostPath.join(root, NAME)).pipe(Effect.flatMap(Schema.decodeUnknownEffect(Schema.fromJsonString(File))), Effect.option);
-	if (Option.isNone(parsed) || parsed.value.version !== VERSION) return /* @__PURE__ */ new Map();
-	return new Map(Object.entries(parsed.value.entries));
+const BashParams = Schema.Struct({
+	command: Schema.String.annotate({ description: "The bash command to execute." }),
+	timeout: Schema.optional(Schema.Finite.check(Schema.isGreaterThan(0)).annotate({ description: "Optional timeout in seconds (must be greater than 0)." }))
 });
-/** Temp file plus rename, so a reader never sees a half-written index. */
-const write = Effect.fn("PluginIndex.write")(function* (root, entries) {
-	const encoded = yield* Schema.encodeEffect(Schema.fromJsonString(File))({
-		version: VERSION,
-		entries: Object.fromEntries(entries)
+const outputFields = {
+	/** Combined stdout + stderr, truncated for display (full output is on disk when `truncated`). */
+	output: Schema.String,
+	truncated: Schema.Boolean,
+	fullOutputPath: Schema.optional(Schema.String)
+};
+const BashSuccess = Schema.Struct({
+	...outputFields,
+	exitCode: Schema.Finite
+});
+/** Non-zero exit — expected, model-visible. Carries the same shape as success. */
+var BashFailed = class extends Schema.TaggedError()("BashFailed", {
+	...outputFields,
+	exitCode: Schema.Finite
+}) {};
+/** Deadline exceeded — expected, model-visible. Carries the partial output produced so far. */
+var BashTimedOut = class extends Schema.TaggedError()("BashTimedOut", {
+	...outputFields,
+	timeoutSeconds: Schema.Finite
+}) {};
+const BashFailure = Schema.Union([BashFailed, BashTimedOut]);
+const bashDef = tool_exports.define({
+	name: "bash",
+	label: "bash",
+	promptSnippet: "Execute bash commands (ls, grep, find, etc.).",
+	description: `Execute a bash command in the working directory and return its combined stdout/stderr output. Output is truncated to the last ${DEFAULT_MAX_LINES} lines or ${DEFAULT_MAX_BYTES}KB (whichever is hit first); when truncated, the full output is saved to a temp file. A non-zero exit code is reported as an error carrying the captured output.`,
+	parameters: BashParams,
+	success: BashSuccess,
+	failure: BashFailure,
+	encodeContent: (success) => [{
+		type: "text",
+		text: success.output
+	}],
+	encodeFailureContent: (failure) => [{
+		type: "text",
+		text: failure.output
+	}]
+});
+/** Combine stdout and stderr into one stream of text, stderr after stdout. */
+const combineOutput = (stdout, stderr) => {
+	if (stderr.length === 0) return stdout;
+	if (stdout.length === 0) return stderr;
+	return `${stdout}\n${stderr}`;
+};
+/** One-line footer appended to truncated, model-facing output. */
+const footer = (t, fullOutputPath, lastLineBytes) => {
+	const where = fullOutputPath ? ` Full output: ${fullOutputPath}` : "";
+	const startLine = t.totalLines - t.outputLines + 1;
+	if (t.lastLinePartial) {
+		const lineSize = lastLineBytes !== void 0 ? ` (line is ${formatSize(lastLineBytes)})` : "";
+		return `\n\n[showing last ${formatSize(t.outputBytes)} of line ${t.totalLines}${lineSize}.${where}]`;
+	}
+	if (t.truncatedBy === "lines") return `\n\n[showing lines ${startLine}-${t.totalLines} of ${t.totalLines}.${where}]`;
+	return `\n\n[showing lines ${startLine}-${t.totalLines} of ${t.totalLines} (${formatSize(t.maxBytes)} limit).${where}]`;
+};
+/** Write full output to a host temp file (best-effort; undefined on failure). */
+const spillToTempFile = (content) => Effect.gen(function* () {
+	const suffix = Encoding.encodeHex(yield* crypto.randomBytes(6));
+	const path = posix.join(tmpdir(), `codework-bash-${suffix}.log`);
+	yield* fileSystem.writeFileString(path, content);
+	return path;
+}).pipe(Effect.orElseSucceed(() => void 0));
+/** Variant A: truncate the buffered output once, spilling the full output if truncated. */
+const presentBuffered = (combined) => Effect.gen(function* () {
+	const t = truncateTail(combined);
+	if (!t.truncated) return {
+		output: t.content,
+		truncated: false
+	};
+	const fullOutputPath = yield* spillToTempFile(combined);
+	return {
+		output: t.content + footer(t, fullOutputPath),
+		truncated: true,
+		...fullOutputPath !== void 0 ? { fullOutputPath } : {}
+	};
+});
+/** Variant B: present an accumulator snapshot (the temp file is spilled incrementally). */
+const presentSnapshot = (snap, lastLineBytes) => {
+	if (!snap.truncation.truncated) return {
+		output: snap.content,
+		truncated: false
+	};
+	return {
+		output: snap.content + footer(snap.truncation, snap.fullOutputPath, lastLineBytes),
+		truncated: true,
+		...snap.fullOutputPath !== void 0 ? { fullOutputPath: snap.fullOutputPath } : {}
+	};
+};
+/** Variant A — buffered: one `exec`, truncate after completion. No live progress. */
+const runBuffered = (shell, params) => Effect.gen(function* () {
+	const result = yield* shell.exec(params.command, params.timeout !== void 0 ? { timeout: Duration.seconds(params.timeout) } : void 0).pipe(Effect.catchTags({
+		ToolShellTimeout: (timeout) => Effect.fail(new BashTimedOut({
+			timeoutSeconds: timeout.timeoutMillis / 1e3,
+			output: "",
+			truncated: false
+		})),
+		ToolShellError: (cause) => Effect.die(cause)
+	}));
+	const present = yield* presentBuffered(combineOutput(result.stdout, result.stderr));
+	if (result.exitCode !== 0) return yield* new BashFailed({
+		exitCode: result.exitCode,
+		...present
 	});
-	yield* fileSystem.makeDirectory(root, { recursive: true });
-	const temporary = yield* fileSystem.makeTempFile({
-		directory: root,
-		prefix: `.${NAME}.`,
-		suffix: ".tmp"
+	return {
+		exitCode: result.exitCode,
+		...present
+	};
+});
+/** Variant B — streaming: accumulate output, report progress, keep partial output on timeout. */
+const runStreaming = (stream, params) => Effect.scoped(Effect.gen(function* () {
+	const acc = new Accumulator({ tempFilePrefix: "codework-bash" });
+	const progress = yield* progress_exports.ToolProgress;
+	const exitCode = yield* Ref.make(null);
+	const consume = stream(params.command).pipe(Stream.runForEach((event) => event._tag === "Exit" ? Ref.set(exitCode, event.exitCode) : Effect.gen(function* () {
+		yield* acc.append(Buffer.from(event.bytes));
+		yield* progress.report({ content: [{
+			type: "text",
+			text: acc.snapshot().content
+		}] });
+	})), Effect.catchTag("ToolShellError", (cause) => Effect.die(cause)));
+	let timedOutAfter;
+	if (params.timeout !== void 0) {
+		const finished = yield* consume.pipe(Effect.timeoutOption(Duration.seconds(params.timeout)));
+		if (Option.isNone(finished)) timedOutAfter = params.timeout;
+	} else yield* consume;
+	yield* acc.finish();
+	const present = presentSnapshot(acc.snapshot(), acc.getLastLineBytes());
+	if (timedOutAfter !== void 0) return yield* new BashTimedOut({
+		timeoutSeconds: timedOutAfter,
+		...present
 	});
-	yield* fileSystem.writeFileString(temporary, encoded).pipe(Effect.andThen(fileSystem.rename(temporary, hostPath.join(root, NAME))), Effect.ensuring(fileSystem.remove(temporary, { force: true }).pipe(Effect.ignore)));
-});
-/**
-* Record one entry, keeping whatever else the file holds.
-*
-* Ignores its own failures. A store that cannot write its accelerator still works; refusing the
-* install would be the accelerator deciding whether the install counted.
-*/
-const put = Effect.fn("PluginIndex.put")(function* (root, digest, record) {
-	const entries = yield* read(root);
-	entries.set(digest, record);
-	yield* write(root, entries).pipe(Effect.ignore);
-});
-/**
-* Merge fields into one record, if it is there.
-*
-* Unlocked, like every write here but the one that publishes a generation. Two processes checking
-* at once both read the whole file and both rewrite it, so one update is lost and a record added
-* in between can vanish -- and neither matters, because a lost `checkedAt` costs one network call
-* and a vanished record is a miss a scan repairs.
-*/
-const patch = Effect.fn("PluginIndex.patch")(function* (root, digest, fields) {
-	const entries = yield* read(root);
-	const existing = entries.get(digest);
-	if (existing === void 0) return;
-	entries.set(digest, {
-		...existing,
-		...fields
+	const code = yield* Ref.get(exitCode);
+	if (code === null || code !== 0) return yield* new BashFailed({
+		exitCode: code ?? -1,
+		...present
 	});
-	yield* write(root, entries).pipe(Effect.ignore);
+	return {
+		exitCode: code,
+		...present
+	};
+}));
+const bashHandler = (params) => Effect.gen(function* () {
+	const shell = yield* ToolShell;
+	return shell.stream !== void 0 ? yield* runStreaming(shell.stream, params) : yield* runBuffered(shell, params);
 });
-/** Forget one entry, for a store entry that has been removed. */
-const drop = Effect.fn("PluginIndex.drop")(function* (root, digest) {
-	const entries = yield* read(root);
-	if (!entries.delete(digest)) return;
-	yield* write(root, entries).pipe(Effect.ignore);
+/** The bash tool: definition + handler, wired the testable (def/exec split) way. */
+const bashTool = tool_exports.implement(bashDef, bashHandler);
+const bashPlugin = (0, plugin_exports$1.define)({
+	id: "codework.tool.bash",
+	kind: "tool",
+	setup: Effect.fn("BashPlugin.setup")(function* (ctx) {
+		const shell = yield* io_exports.SandboxIO.Shell;
+		const mounted = fromSandboxShell.pipe(Layer.provide(Layer.succeed(io_exports.SandboxIO.Shell, shell)));
+		ctx.plugin.tools.add(tool_exports.provide(bashTool, mounted));
+	})
 });
 //#endregion
-//#region src/plugin/lock.ts
-/** How long to wait for another holder before giving up. */
-const TIMEOUT = Duration.minutes(2);
-/** The holder refreshes the lock's mtime this often; one not refreshed for the timeout is stale. */
-const HEARTBEAT = Duration.seconds(15);
-const abandoned = (directory) => Effect.gen(function* () {
-	const info = yield* fileSystem.stat(directory);
-	const now = yield* Effect.clockWith((clock) => clock.currentTimeMillis);
-	return Option.exists(info.mtime, (mtime) => now - mtime.getTime() > Duration.toMillis(TIMEOUT));
-}).pipe(Effect.orElseSucceed(() => false));
-const heartbeat = (directory) => Effect.clockWith((clock) => clock.currentTimeMillis).pipe(Effect.flatMap((now) => fileSystem.utimes(directory, now, now)), Effect.ignore, Effect.repeat(Schedule.spaced(HEARTBEAT)));
+//#region src/plugin/builtin.ts
 /**
-* Claims `directory` by creating it, polling while another process holds it, and releasing it when
-* the surrounding scope closes.
-*
-* One finalizer is registered for the whole wait rather than one per 50ms poll, and a single
-* attempt is `uninterruptible` so `mkdir` and recording ownership cannot be split -- an interrupt
-* between them would leave behind a lock the finalizer does not know to remove.
-*
-* `onTimeout` names the failure, because what a caller is waiting for is the caller's to describe.
+* Every plugin the harness ships, and the selection a caller who passes no `plugins` gets. Tool
+* contributors come first so the Prompt plugin that indexes them runs after they registered.
 */
-const lock = Effect.fn("PluginLock.acquire")(function* (directory, onTimeout) {
-	const held = yield* Ref.make(false);
-	yield* Effect.acquireRelease(Effect.void, () => Ref.get(held).pipe(Effect.flatMap((owned) => owned ? fileSystem.remove(directory, {
-		recursive: true,
-		force: true
-	}) : Effect.void), Effect.orDie));
-	if (!(yield* fileSystem.makeDirectory(directory).pipe(Effect.andThen(Ref.set(held, true)), Effect.as(true), Effect.catchIf((error) => error.reason._tag === "AlreadyExists", () => abandoned(directory).pipe(Effect.flatMap((stale) => stale ? fileSystem.remove(directory, {
-		recursive: true,
-		force: true
-	}).pipe(Effect.as(false)) : Effect.succeed(false)))), Effect.uninterruptible).pipe(Effect.repeat({
-		schedule: Schedule.spaced("50 millis"),
-		until: (owned) => owned
-	}), Effect.timeoutOrElse({
-		duration: TIMEOUT,
-		orElse: () => Effect.succeed(false)
-	})))) return yield* Effect.fail(onTimeout());
-	yield* Effect.forkScoped(heartbeat(directory));
-});
+const builtins = Object.freeze([bashPlugin, defaultPromptPlugin]);
 //#endregion
-//#region src/plugin/store.ts
-/** Facts about the *package*, and nothing about the plugin inside it. */
-const Marker = Schema.Struct({
-	spec: Schema.String,
-	name: Schema.String,
-	version: Schema.optional(Schema.String),
-	revision: Schema.optional(Schema.String),
-	/** Relative to the generation directory, so the marker survives the publishing rename. */
-	entrypoint: Schema.String,
-	createdAt: Schema.Finite
-});
-const MARKER = ".complete.json";
-const STAGING = ".staging-";
-const root = (cache) => hostPath.join(cache, "plugins", "v2");
+//#region src/settings/merge.ts
 /**
-* A readable label, never an identity: two specs that slug alike share a parent directory and
-* nothing more. Worth having because a greppable path is worth real money when debugging, and a
-* bare hash throws away every clue.
+* A plain string-keyed record: what a settings patch merges, and what a plugin's `options` block
+* has to be. A Map, a typed array or a class instance is an object to `typeof` and not one of
+* these — `Object.freeze` alone does not tell them apart, and it throws on some of them.
 */
-const slugOf = (target) => target.kind === "git" ? target.slug : canonical$1(target).replace(/^@/, "").replace(/[^a-zA-Z0-9._-]+/g, "-").replace(/^-+|-+$/g, "") || "package";
-/**
-* The **full** SHA-256 of the source identity: canonical spec plus effective registry for a
-* registry package, and the canonical spec alone for git.
+const isRecord$1 = (value) => Predicate.isObject(value) && !Array.isArray(value) && (Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null);
+const copy = (value) => {
+	if (Array.isArray(value)) return value.map(copy);
+	return isRecord$1(value) ? merge({}, value) : value;
+};
+/** Null/undefined properties are absent, objects merge, and arrays replace. Never mutates inputs. */
+function merge(base, ...patches) {
+	const result = /* @__PURE__ */ new Map();
+	for (const patch of [base, ...patches]) {
+		if (patch === void 0) continue;
+		for (const [key, value] of Object.entries(patch)) {
+			if (value === null || value === void 0) continue;
+			const previous = result.get(key);
+			result.set(key, isRecord$1(previous) && isRecord$1(value) ? merge(previous, value) : copy(value));
+		}
+	}
+	return Object.fromEntries(result);
+}
+/** Normalize nullable properties before schema validation, without changing array positions. */
+const normalize = copy;
+//#endregion
+//#region src/util/module.ts
+/*!
+* Adapted from OpenCode packages/util/src/runtime/import.node.ts.
 *
-* Not truncated. The fast path proves a hit by checking that a marker *exists* rather than by
-* decoding it, and the index is keyed by digest alone, so a truncated digest would let a collision
-* return the wrong package silently.
+* MIT License
+*
+* Copyright (c) 2025 opencode
+*
+* Permission is hereby granted, free of charge, to any person obtaining a copy
+* of this software and associated documentation files (the "Software"), to deal
+* in the Software without restriction, including without limitation the rights
+* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+* copies of the Software, and to permit persons to whom the Software is
+* furnished to do so, subject to the following conditions:
+*
+* The above copyright notice and this permission notice shall be included in all
+* copies or substantial portions of the Software.
+*
+* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+* AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+* SOFTWARE.
 */
-const digest = Effect.fn("PluginStore.digest")(function* (target, cache, from) {
-	const source = target.kind === "registry" ? `${yield* registry(target, cache, from)}\0${target.spec}` : target.spec;
-	return Encoding.encodeHex(yield* crypto.digest("SHA-256", new TextEncoder().encode(source)));
-});
-const entryDir = Effect.fn("PluginStore.entryDir")(function* (target, cache, from) {
-	const key = yield* digest(target, cache, from);
-	return {
-		key,
-		directory: hostPath.join(root(cache), slugOf(target), key)
-	};
-});
-const failure$1 = (target, reason, message, cause) => new StoreError({
-	reason,
-	reference: target.spec,
-	message,
-	...cause === void 0 ? {} : { cause }
-});
-/** Generation directories, oldest first. A name that is not a number is not a generation. */
-const generations = Effect.fn("PluginStore.generations")(function* (directory) {
-	return (yield* fileSystem.readDirectory(directory).pipe(Effect.orElseSucceed(() => []))).filter((name) => /^\d+$/.test(name)).map((name) => Number(name)).sort((left, right) => left - right);
-});
-const readMarker = (directory) => fileSystem.readFileString(hostPath.join(directory, MARKER)).pipe(Effect.flatMap(Schema.decodeUnknownEffect(Schema.fromJsonString(Marker))), Effect.option);
-const entryOf = (marker, input) => ({
-	...marker,
-	digest: input.digest,
-	generation: input.generation,
-	directory: input.directory,
-	url: url(hostPath.resolve(input.directory, marker.entrypoint))
-});
-/** The newest generation that carries a marker. Unmarked ones are invisible: they never happened. */
-const active = Effect.fn("PluginStore.active")(function* (directory, key) {
-	for (const generation of (yield* generations(directory)).reverse()) {
-		const where = hostPath.join(directory, String(generation));
-		const marker = yield* readMarker(where);
-		if (Option.isSome(marker)) return entryOf(marker.value, {
-			digest: key,
-			generation,
-			directory: where
-		});
-	}
-});
-/** What the index files about an entry, all of it derivable from the spec and the marker. */
-const record = (target, entry, installedAt) => ({
-	spec: target.spec,
-	source: target.kind,
-	name: entry.name,
-	slug: slugOf(target),
-	mutable: target.mutable,
-	generation: entry.generation,
-	...entry.version === void 0 ? {} : { version: entry.version },
-	...entry.revision === void 0 ? {} : { revision: entry.revision },
-	entrypoint: entry.entrypoint,
-	installedAt
-});
 /**
-* Disk-only lookup. No network, no install -- this is what boot uses, and the reason booting
-* offline works.
+* Packages a plugin must share with the harness instead of using the copy installed beside it.
 *
-* The index is consulted first and is only ever a hint: a hit is proved by the marker still
-* existing, and anything else falls through to a scan that repairs the index on the way past.
+* A plugin is installed into the store as its own npm tree, so `effect` and the plugin SDK land
+* there a second time. Two copies of the *same version* are still two module instances, and
+* Effect Schema's checks do not survive the crossing: a schema built by one copy and evaluated by
+* the other reports every check as failed, so a tool whose success type is `Schema.Finite` dies
+* on "Expected a finite number" for `22800`. Nothing about that is visible at registration --
+* `Schema.isSchema` passes, the JSON Schema is derived correctly, and the tool reaches the model
+* -- so it surfaces on the first call rather than at boot.
+*
+* Resolution is the right place to fix it. A symlink into the store cannot be: a generation is
+* immutable and shared by every project on the machine, while the harness doing the loading is
+* whichever one is running now, and two applications embedding the harness need not agree on
+* where their `effect` lives.
 */
-const resolve$2 = Effect.fn("PluginStore.resolve")(function* (target, cache, from) {
-	const { key, directory } = yield* entryDir(target, cache, from);
-	const base = root(cache);
-	const hinted = (yield* read(base)).get(key);
-	if (hinted !== void 0) {
-		const where = hostPath.join(directory, String(hinted.generation));
-		const marker = yield* readMarker(where);
-		if (Option.isSome(marker)) return entryOf(marker.value, {
-			digest: key,
-			generation: hinted.generation,
-			directory: where
+const sharedPackages = /* @__PURE__ */ new Set(["effect", "@codeworksh/plugin"]);
+/** The package a bare specifier names: `effect/Schema` -> `effect`, `@a/b/c` -> `@a/b`. */
+function packageOf(specifier) {
+	if (specifier.startsWith(".") || specifier.startsWith("/") || specifier.includes(":")) return "";
+	const segments = specifier.split("/");
+	return specifier.startsWith("@") ? segments.slice(0, 2).join("/") : segments[0] ?? "";
+}
+/**
+* Resolve the shared packages as though this module had imported them, for as long as `run`
+* takes. Anything else resolves exactly as it would have.
+*/
+function withSharedModules(run) {
+	const hook = registerHooks({ resolve(specifier, context, nextResolve) {
+		return sharedPackages.has(packageOf(specifier)) ? nextResolve(specifier, {
+			...context,
+			parentURL: import.meta.url
+		}) : nextResolve(specifier, context);
+	} });
+	return run().finally(() => hook.deregister());
+}
+/** Use Node's main loader even when the caller runs inside a bundler or test VM. */
+async function importModule(specifier) {
+	const imported = await withSharedModules(() => new Script(`import(${JSON.stringify(specifier)})`, { importModuleDynamically: constants.USE_MAIN_CONTEXT_DEFAULT_LOADER }).runInThisContext());
+	if (typeof imported !== "object" || imported === null) return imported;
+	const module = imported;
+	const exports = module["module.exports"];
+	if (exports !== module.default || typeof exports !== "object" && typeof exports !== "function" || exports === null) return imported;
+	return Object.assign({}, module, exports);
+}
+/** Node resolution scoped synchronously to the caller. */
+function resolveModule(specifier, directory, conditions) {
+	const hook = registerHooks({ resolve(target, context, nextResolve) {
+		return nextResolve(target, {
+			...context,
+			parentURL: pathToFileURL(path.join(directory, "package.json")).href,
+			...conditions === void 0 ? {} : { conditions: [.../* @__PURE__ */ new Set([...context.conditions, ...conditions])] }
 		});
+	} });
+	try {
+		const resolve = (target) => {
+			const resolved = import.meta.resolve(path.isAbsolute(target) ? pathToFileURL(target).href : target);
+			if (resolved.startsWith("file:")) statSync(new URL(resolved));
+			return resolved;
+		};
+		try {
+			return resolve(specifier);
+		} catch (error) {
+			if (path.extname(specifier) || !missing(error)) throw error;
+			for (const extension of [
+				".ts",
+				".tsx",
+				".js",
+				".jsx",
+				".mts",
+				".mjs",
+				".cts",
+				".cjs"
+			]) try {
+				return resolve(specifier + extension);
+			} catch (cause) {
+				if (!missing(cause)) throw cause;
+			}
+			throw error;
+		}
+	} finally {
+		hook.deregister();
 	}
-	const scanned = yield* active(directory, key);
-	if (scanned === void 0) return void 0;
-	yield* put(base, key, record(target, scanned, scanned.createdAt));
-	return scanned;
-}, Effect.mapError((cause) => Schema.is(StoreError)(cause) || Schema.is(InstallError)(cause) ? cause : new StoreError({
-	reason: "plugin-marker-invalid",
-	reference: "",
-	message: "cannot read the plugin store",
-	cause
-})));
+}
+function missing(error) {
+	return error instanceof Error && "code" in error && [
+		"ENOENT",
+		"ENOTDIR",
+		"ERR_MODULE_NOT_FOUND"
+	].includes(String(error.code));
+}
+//#endregion
+//#region src/plugin/error.ts
 /**
-* `resolve`, for a caller that needs the entry rather than an answer about it.
-*
-* `plugin remove` uses this as its installer: it has to identify what an entry names without
-* fetching anything, and a spec with nothing filed is a real answer there -- the command reports
-* it and moves on.
+* The reference as the person wrote it -- the string they will recognise in their settings file,
+* never the resolved path or the canonical spec. Every plugin failure carries one.
 */
-const required = Effect.fn("PluginStore.required")(function* (target, cache, from) {
-	const found = yield* resolve$2(target, cache, from);
-	if (found === void 0) return yield* failure$1(target, "plugin-not-installed", `${target.spec} is not installed`);
-	return found;
-});
+const Reference = Schema.String;
 /**
-* Install if absent; hand back what is filed if present.
+* The settings file that declared the entry, when one did.
 *
-* `refresh` forces past both the fast path and the double-check, which is what `update` needs and
-* nothing else should use.
+* Absent for an embedder's own list and for anything the CLI was handed directly -- in both cases
+* the caller already knows where the string came from. It is the settings path that needs saying,
+* because several layers accumulate entries and "which file says this" is the question.
 */
-const add = Effect.fn("PluginStore.add")(function* (target, cache, options) {
-	return yield* Effect.gen(function* () {
-		const { key, directory } = yield* entryDir(target, cache, options.from);
-		if (options.refresh !== true) {
-			const found = yield* resolve$2(target, cache, options.from);
-			if (found !== void 0) return { entry: found };
-		}
-		yield* fileSystem.makeDirectory(directory, { recursive: true });
-		yield* lock(hostPath.join(directory, ".lock"), () => failure$1(target, "plugin-lock-timeout", `timed out waiting for another installation of ${target.spec}`));
-		const current = yield* active(directory, key);
-		if (current !== void 0 && options.refresh !== true) return { entry: current };
-		const real = yield* fileSystem.realPath(directory).pipe(Effect.orElseSucceed(() => directory));
-		const staging = yield* Effect.acquireRelease(fileSystem.makeTempDirectory({
-			directory: real,
-			prefix: STAGING
-		}), (staged) => fileSystem.remove(staged, {
-			recursive: true,
-			force: true
-		}).pipe(Effect.orDie));
-		yield* fileSystem.writeFileString(hostPath.join(staging, "package.json"), "{\"private\":true,\"type\":\"module\"}");
-		const fetched = yield* download({
-			target,
-			into: staging,
-			cache,
-			from: options.from,
-			...options.runner === void 0 ? {} : { runner: options.runner }
-		});
-		if (current !== void 0 && current.revision === fetched.revision) return { entry: current };
-		const validated = yield* options.validate(fetched);
-		const entrypoint = hostPath.relative(yield* fileSystem.realPath(staging), fetched.entrypoint);
-		if (entrypoint.startsWith("..") || hostPath.isAbsolute(entrypoint)) return yield* new InstallError({
-			reason: "plugin-no-entrypoint",
-			reference: target.spec,
-			message: `entrypoint escapes its installation: ${entrypoint}`
-		});
-		const now = yield* Effect.clockWith((clock) => clock.currentTimeMillis);
-		const marker = {
-			spec: target.spec,
-			name: fetched.name,
-			...fetched.version === void 0 ? {} : { version: fetched.version },
-			...fetched.revision === void 0 ? {} : { revision: fetched.revision },
-			entrypoint,
-			createdAt: now
-		};
-		yield* fileSystem.writeFileString(hostPath.join(staging, MARKER), yield* Schema.encodeEffect(Schema.fromJsonString(Marker))(marker));
-		const previous = (yield* generations(directory)).at(-1) ?? 0;
-		const generation = Math.max(now, previous + 1);
-		const published = hostPath.join(directory, String(generation));
-		yield* fileSystem.rename(staging, published);
-		const entry = entryOf(marker, {
-			digest: key,
-			generation,
-			directory: published
-		});
-		yield* put(root(cache), key, record(target, entry, now));
-		yield* collect$1(directory);
-		return {
-			entry,
-			validated
-		};
-	}).pipe(Effect.scoped, Effect.mapError((cause) => Schema.is(InstallError)(cause) || Schema.is(StoreError)(cause) || Schema.is(LoadError)(cause) ? cause : failure$1(target, "plugin-marker-invalid", `cannot write the store entry for ${target.spec}`, cause)));
-});
+const File$1 = Schema.optional(Schema.String);
 /**
-* Expire what is superseded.
+* A spec that cannot be installed at all.
 *
-* The two newest generations are kept regardless of age: the newest is live, and the one before it
-* may still be imported by an exchange in flight. Runs at the end of an `add` that published
-* something -- no timer and no sweeper, because installs are the only thing that creates garbage.
+* `plugin-not-found` is a local path with nothing at it; `plugin-not-installed` (the store's) is a
+* package spec with no entry. The first is a mistake in a settings file, the second is fixed by
+* `plugin install`, and keeping them apart is most of the value of having slugs.
 */
-const collect$1 = Effect.fn("PluginStore.collect")(function* (directory) {
-	const now = yield* Effect.clockWith((clock) => clock.currentTimeMillis);
-	const keep = new Set((yield* generations(directory)).slice(-2).map(String));
-	const names = yield* fileSystem.readDirectory(directory).pipe(Effect.orElseSucceed(() => []));
-	for (const name of names) {
-		if (keep.has(name) || name === ".lock") continue;
-		if (name.startsWith(STAGING)) {
-			const started = yield* fileSystem.stat(hostPath.join(directory, name)).pipe(Effect.option);
-			if ((Option.isNone(started) ? 0 : Option.match(started.value.mtime, {
-				onNone: () => 0,
-				onSome: (at) => now - at.getTime()
-			})) > HOUR) yield* fileSystem.remove(hostPath.join(directory, name), {
-				recursive: true,
-				force: true
-			}).pipe(Effect.ignore);
-			continue;
-		}
-		if (!/^\d+$/.test(name)) continue;
-		if (now - Number(name) > WEEK) yield* fileSystem.remove(hostPath.join(directory, name), {
-			recursive: true,
-			force: true
-		}).pipe(Effect.ignore);
-	}
-});
-const HOUR = 36e5;
-const WEEK = 168 * HOUR;
+var SourceError = class extends Schema.TaggedError()("PluginSourceError", {
+	reason: Schema.Literals([
+		"plugin-unsupported-source",
+		"plugin-not-found",
+		"plugin-escapes-root"
+	]),
+	reference: Reference,
+	file: File$1,
+	message: Schema.String
+}) {};
+/** A spec that is installable, and whose install did not produce a usable package. */
+var InstallError = class extends Schema.TaggedError()("PluginInstallError", {
+	reason: Schema.Literals([
+		"plugin-resolve-failed",
+		"plugin-fetch-failed",
+		"plugin-no-commit",
+		"plugin-no-entrypoint"
+	]),
+	reference: Reference,
+	file: File$1,
+	message: Schema.String,
+	cause: Schema.optional(Schema.Defect())
+}) {};
 /**
-* How long a network answer is reused before `check` asks again.
+* A module that reached the import and did not come back as a plugin.
 *
-* Persisted in the index rather than held in memory, because the thing that benefits is a command
-* that exits: an in-memory staleness cache is worthless to `codework plugin check`.
+* Distinct from {@link InstallError}: the bytes are here and are fine as *bytes*. What failed is
+* evaluating them, or what they turned out to export -- which is the distinction a caller acts on,
+* because one is fixed by installing and the other by editing code.
 */
-const CHECK_TTL = 36e5;
+var LoadError = class extends Schema.TaggedError()("PluginLoadError", {
+	reason: Schema.Literals([
+		"plugin-import-failed",
+		"plugin-missing-dependency",
+		"plugin-not-compiled",
+		"plugin-invalid-definition"
+	]),
+	reference: Reference,
+	file: File$1,
+	message: Schema.String,
+	/** The ID the module declared, when it got far enough to declare one. */
+	id: Schema.optional(Schema.String),
+	cause: Schema.optional(Schema.Defect())
+}) {};
+/** The store's own failures: what is filed, what is not, and what could not be claimed. */
+var StoreError = class extends Schema.TaggedError()("PluginStoreError", {
+	reason: Schema.Literals([
+		"plugin-not-installed",
+		"plugin-lock-timeout",
+		"plugin-marker-invalid",
+		"plugin-index-invalid",
+		"plugin-collect-failed"
+	]),
+	reference: Reference,
+	file: File$1,
+	message: Schema.String,
+	cause: Schema.optional(Schema.Defect())
+}) {};
 /**
-* Is a newer revision available?
+* Note which settings file declared the entry a failure came from.
 *
-* The only network call in the store's vocabulary, and it is the caller's to make. A `probe` that
-* fails -- offline, registry down, a remote that refuses -- propagates rather than answering
-* `current`: an outage must not read as "you are up to date".
+* The store and the installer raise their own failures without knowing that, because neither is
+* told: they are handed a spec, not a settings layer. The loader knows, and this is where it says
+* so -- leaving an existing answer alone, since a more specific one is already better.
 */
-const check = Effect.fn("PluginStore.check")(function* (target, cache, options) {
-	if (!target.mutable) return { _tag: "immutable" };
-	const entry = yield* resolve$2(target, cache, options.from);
-	if (entry === void 0) return { _tag: "not-installed" };
-	const key = yield* digest(target, cache, options.from).pipe(Effect.mapError((cause) => failure$1(target, "plugin-marker-invalid", `cannot address ${target.spec}`, cause)));
-	const base = root(cache);
-	const record = (yield* read(base)).get(key);
-	const now = yield* Effect.clockWith((clock) => clock.currentTimeMillis);
-	if (options.refresh !== true && record?.checkedAt !== void 0 && now - record.checkedAt < CHECK_TTL && (record.outdated !== true || record.available !== void 0)) return record.outdated === true ? {
-		_tag: "outdated",
-		available: record.available,
-		...entry.revision === void 0 ? {} : { filed: entry.revision }
-	} : {
-		_tag: "current",
-		...entry.revision === void 0 ? {} : { revision: entry.revision }
-	};
-	const available = yield* options.probe(target);
-	if (available === void 0) return {
-		_tag: "current",
-		...entry.revision === void 0 ? {} : { revision: entry.revision }
+const declaredIn = (error, file) => {
+	if (error.file !== void 0) return error;
+	const shared = {
+		reference: error.reference,
+		message: error.message,
+		file
 	};
-	const outdated = available !== entry.revision;
-	yield* patch(base, key, {
-		checkedAt: now,
-		outdated,
-		available
+	if (Schema.is(SourceError)(error)) return new SourceError({
+		...shared,
+		reason: error.reason
 	});
-	return outdated ? {
-		_tag: "outdated",
-		available,
-		...entry.revision === void 0 ? {} : { filed: entry.revision }
-	} : {
-		_tag: "current",
-		...entry.revision === void 0 ? {} : { revision: entry.revision }
-	};
-});
+	if (Schema.is(InstallError)(error)) return new InstallError({
+		...shared,
+		reason: error.reason,
+		cause: error.cause
+	});
+	if (Schema.is(LoadError)(error)) return new LoadError({
+		...shared,
+		reason: error.reason,
+		id: error.id,
+		cause: error.cause
+	});
+	if (Schema.is(StoreError)(error)) return new StoreError({
+		...shared,
+		reason: error.reason,
+		cause: error.cause
+	});
+	return error;
+};
+//#endregion
+//#region src/util/path.ts
 /**
-* Refresh a mutable target, if the network says there is anything to refresh.
+* A directory that crosses into the harness is absolute, and a relative one is a **defect** rather
+* than an error.
 *
-* `add` with `refresh` is what does the work; this is the guard in front of it, so an `update`
-* that finds nothing new neither stages nor publishes.
+* A relative path is a disguised `process.cwd()` call: and every consumer
+* resolves it silently. `path.resolve("x")` anchors to the process directory, npm answers a
+* relative `cwd` with a `localPrefix` of whatever repository the process is inside (measured, not
+* assumed), and `Session.link` would write the *server's* directory into a field whose whole
+* purpose is to be a host path the client declared.
+*
+* For a long-running server the process directory is nobody's project, so the result is a
+* plausible answer to a question no one asked.
+* An absolute path is the one spelling none of them can quietly reinterpret.
+*
+* A defect rather than a typed error because nothing a user types reaches here. Every reference
+* goes through `parse`, and every directory comes from `Global.resolve`, a resolved `cwd` or a
+* session's `hostDir`, all of them already absolute. A relative one means a new call site got it
+* wrong, and a stack trace names that call site; a typed error would ask every caller to handle a
+* case none of them can cause.
 */
-const update = Effect.fn("PluginStore.update")(function* (target, cache, options) {
-	const current = yield* resolve$2(target, cache, options.from);
-	if (current === void 0) return { _tag: "not-installed" };
-	if ((yield* check(target, cache, {
-		refresh: true,
-		probe: options.probe,
-		from: options.from
-	}))._tag !== "outdated") return {
-		_tag: "unchanged",
-		entry: current
-	};
-	const added = yield* add(target, cache, {
-		refresh: true,
-		validate: options.validate,
-		from: options.from,
-		...options.runner === void 0 ? {} : { runner: options.runner }
-	});
-	return added.entry.generation === current.generation ? {
-		_tag: "unchanged",
-		entry: current
-	} : {
-		_tag: "updated",
-		entry: added.entry,
-		...added.validated === void 0 ? {} : { validated: added.validated }
-	};
-});
-Effect.fn("PluginStore.remove")(function* (target, cache, from) {
-	const { key, directory } = yield* entryDir(target, cache, from);
-	const existed = yield* fileSystem.exists(directory).pipe(Effect.orElseSucceed(() => false));
-	yield* fileSystem.remove(directory, {
-		recursive: true,
-		force: true
-	}).pipe(Effect.ignore);
-	yield* drop(root(cache), key);
-	return existed;
+const rooted = (directory, role) => {
+	if (hostPath.isAbsolute(directory)) return directory;
+	throw new Error(`${role} must be an absolute path, got ${JSON.stringify(directory)}`);
+};
+//#endregion
+//#region src/plugin/npm.ts
+const Manifest$1 = Schema.Struct({ version: Schema.optional(Schema.String) });
+const Lockfile = Schema.Struct({ packages: Schema.optional(Schema.Record(Schema.String, Schema.Struct({ resolved: Schema.optional(Schema.String) }))) });
+/**
+* npm's flattened config: registry, scopes, auth, and cache paths.
+*
+* Built in one place, because two call sites deriving it separately is how the cache location
+* drifts between an install and the staleness check that is supposed to describe it.
+*
+* `dir` is where the `.npmrc` chain is read from, and it is the **host directory the caller
+* belongs to** -- never the staging directory and never the cache. A company repo keeps its
+* private registry and its scoped token in its own `.npmrc`, so a chain read anywhere else
+* resolves the plugin against the public registry and fails 404, or worse, installs a public
+* package of the same name. This is the registry half of auth; the git half is below.
+*
+* No `--prefix`. npm pins its local prefix to a `--prefix` on `argv` and stops walking, so
+* passing one would look up exactly `<dir>/.npmrc` and nothing above it -- wrong for a person
+* standing in `packages/x` whose token lives at the repository root. Without it npm walks up from
+* `cwd` to the nearest `package.json` or `node_modules` exactly as `npm` itself would if it were
+* run there, which is the only rule a user can predict.
+*
+* `--cache` is ours and is passed on `argv`, which outranks every `.npmrc`. npm's `flatten`
+* derives `_cacache`, `_npx` and `_tuf` from that one value, so naming the parent is enough --
+* and overriding `flat.cache` afterwards would redirect one of the three and leave `_tuf` pointing
+* at the user's home. `--home` exists to make a run self-contained; anything reached by an ambient
+* default is a test reading the developer's real machine.
+*
+* **Nothing here names an `env`.** npm hands git `opts.env` when one is present and falls back to
+* `{ ...gitDefaults, ...process.env }` when it is not, so leaving it out is what lets a git source
+* reach a private remote at all: `SSH_AUTH_SOCK` finds the agent, `HOME` finds the `~/.gitconfig`
+* that names the credential helper, and `PATH` finds `git`. Setting `env` to anything -- even to
+* a copy of `process.env` -- would be a standing invitation to prune it later and break private
+* git silently, months from the change. §15 Q2.
+*/
+const options = (dir, cache) => Effect.suspend(() => {
+	const root = rooted(dir, "the directory a plugin install reads its .npmrc chain from");
+	const store = rooted(cache, "the npm cache");
+	return npmOptions(root, store);
 });
-Effect.fn("PluginStore.all")(function* (cache) {
-	const base = root(cache);
-	const slugs = yield* fileSystem.readDirectory(base).pipe(Effect.orElseSucceed(() => []));
-	const found = [];
-	for (const slug of slugs) {
-		const digests = yield* fileSystem.readDirectory(hostPath.join(base, slug)).pipe(Effect.orElseSucceed(() => []));
-		for (const key of digests) {
-			const entry = yield* active(hostPath.join(base, slug, key), key);
-			if (entry !== void 0) found.push(entry);
-		}
+const npmOptions = (dir, cache) => Effect.gen(function* () {
+	const config = yield* Effect.tryPromise(async () => {
+		const { default: Config } = await import("@npmcli/config");
+		const { definitions, flatten, nerfDarts, shorthands } = (await import("@npmcli/config/lib/definitions/index.js")).default;
+		const created = new Config({
+			npmPath: fileURLToPath(new URL("..", import.meta.url)),
+			cwd: dir,
+			env: { ...process.env },
+			argv: [
+				process.execPath,
+				process.execPath,
+				"--cache",
+				hostPath.join(cache, "npm")
+			],
+			execPath: process.execPath,
+			platform: process.platform,
+			definitions,
+			flatten,
+			nerfDarts,
+			shorthands,
+			warn: false
+		});
+		await created.load();
+		return created;
+	}).pipe(Effect.catch((cause) => Effect.logWarning(`cannot load npm configuration from ${dir}; npm defaults apply`, cause).pipe(Effect.as(void 0))));
+	if (config === void 0) return { allowGit: "root" };
+	for (const kind of [
+		"project",
+		"user",
+		"global"
+	]) {
+		const loaded = config.data.get(kind);
+		if (loaded?.loadError !== void 0 && loaded.loadError.code !== "ENOENT") yield* Effect.logWarning(`cannot read npm configuration ${loaded.source ?? `for ${kind}`}; npm defaults apply`, loaded.loadError);
 	}
-	return found;
-});
-const Id = Schema.String.check(Schema.isPattern(/^[a-z0-9][a-z0-9-]*(\.[a-z0-9][a-z0-9-]*){2}$/));
-const Definition = Schema.Struct({
-	id: Id,
-	kind: Schema.Literals(Object.keys(plugin_exports$1.domains)),
-	events: Schema.optional(Schema.Array(Schema.declare((value) => Predicate.hasProperty(value, "type") && Predicate.isString(value.type)))),
-	setup: Schema.declare((value) => Predicate.isFunction(value))
+	return {
+		...config.flat,
+		allowGit: "root"
+	};
 });
-/** Every plugin failure says which file to go and edit, when there is one. */
-const where = (origin) => origin.file === void 0 ? {} : { file: origin.file };
-const detail = (cause) => cause instanceof Error ? cause.message : typeof cause === "string" ? cause : String(cause);
-/** A reference that does not name anything loadable. */
-const sourceFailure = (origin, cause) => Schema.is(SourceError)(cause) ? cause : new SourceError({
-	reason: "plugin-not-found",
-	reference: origin.reference,
-	...where(origin),
-	message: detail(cause)
+const PUBLIC_REGISTRY = "https://registry.npmjs.org/";
+/** Stable, credential-free registry identity used to address registry artifacts in the store. */
+const registry = Effect.fn("PluginNpm.registry")(function* (target, cache, from) {
+	const flat = yield* options(from, cache);
+	const scope = target.name.startsWith("@") ? target.name.slice(0, target.name.indexOf("/")) : void 0;
+	const configured = (scope === void 0 ? void 0 : flat[`${scope}:registry`]) ?? flat.registry ?? PUBLIC_REGISTRY;
+	if (typeof configured !== "string") return yield* new InstallError({
+		reason: "plugin-resolve-failed",
+		reference: target.spec,
+		message: `npm registry for ${target.name} is not a URL`
+	});
+	return yield* Effect.try({
+		try: () => {
+			const value = new URL(configured);
+			value.username = "";
+			value.password = "";
+			value.hash = "";
+			return value.href;
+		},
+		catch: (cause) => new InstallError({
+			reason: "plugin-resolve-failed",
+			reference: target.spec,
+			message: `npm registry for ${target.name} is not a valid URL: ${configured}`,
+			cause
+		})
+	});
 });
-/** Node's own code for a failure, when it set one. */
-const codeOf = (cause) => Predicate.hasProperty(cause, "code") && Predicate.isString(cause.code) ? cause.code : void 0;
+/** A 40- or 64-hex commit out of the `resolved` URL arborist writes into the lockfile. */
+const commitIn = (resolved) => resolved?.match(/#([a-f0-9]{40}|[a-f0-9]{64})(?=::|$)/i)?.[1];
 /**
-* A module that would not import.
-*
-* Two of these get their own reason, because the remedy differs and that is the whole value of a
-* slug. A missing dependency means the plugin is fine and its `node_modules` is not, which a
-* person fixes in the package rather than in their settings. An uncompiled one means the plugin
-* shipped its sources: Node refuses to strip types under `node_modules`, and installing a plugin
-* runs no lifecycle scripts, so a `prepare` build never happens either -- the author has to ship
-* the build output, and nothing the user can do to their settings will help.
+* The commit a git install actually landed on, read back from the lockfile arborist wrote.
 *
-* `ERR_UNSUPPORTED_NODE_MODULES_TYPE_STRIPPING` is matched by code rather than by message: it is
-* Node's documented identifier and exact, where the wording is free to change under us. Only an
-* installed plugin can reach it -- a local path lives outside `node_modules`, where Node strips
-* types happily, which is what keeps the single-file dev workflow working.
+* Both spellings are tried because which one exists depends on whether the tree was saved.
 */
-const importFailure = (origin, cause) => new LoadError({
-	reason: codeOf(cause) === "ERR_UNSUPPORTED_NODE_MODULES_TYPE_STRIPPING" ? "plugin-not-compiled" : /cannot find (package|module)/i.test(detail(cause)) ? "plugin-missing-dependency" : "plugin-import-failed",
-	reference: origin.reference,
-	...where(origin),
-	message: detail(cause),
-	cause
-});
-/** A module that imported and is not a plugin. */
-const definitionFailure = (origin, cause, id) => new LoadError({
-	reason: "plugin-invalid-definition",
-	reference: origin.reference,
-	...where(origin),
-	message: detail(cause),
-	...id === void 0 ? {} : { id },
-	cause
-});
-const validate = Effect.fn("PluginLoader.validate")(function* (input, origin, builtin = false) {
-	yield* Schema.decodeUnknownEffect(Definition)(input).pipe(Effect.mapError((cause) => definitionFailure(origin, cause)));
-	const plugin = input;
-	if (!builtin && plugin.id.startsWith("codework.")) return yield* definitionFailure(origin, /* @__PURE__ */ new Error("codework namespace is reserved for builtins"), plugin.id);
-	return plugin;
-});
-const Manifest = Schema.Struct({
-	name: Schema.optional(Schema.String),
-	exports: Schema.optional(Schema.Unknown)
-});
-const localUrl = Effect.fn("PluginLoader.localUrl")(function* (location, origin) {
-	const escapes = (message) => new SourceError({
-		reason: "plugin-escapes-root",
-		reference: origin.reference,
-		...where(origin),
-		message
-	});
-	if ((yield* fileSystem.stat(location)).type !== "Directory") return { url: yield* Effect.try(() => resolveModule(location, hostPath.dirname(location))) };
-	const manifestPath = hostPath.join(location, "package.json");
-	if (!(yield* fileSystem.exists(manifestPath))) return { url: yield* Effect.try(() => resolveModule("./index", location)) };
-	const manifest = yield* fileSystem.readFileString(manifestPath).pipe(Effect.flatMap(Schema.decodeUnknownEffect(Schema.fromJsonString(Manifest))));
-	if (manifest.exports !== void 0) {
-		const name = manifest.name;
-		if (!name) return yield* escapes("a local package with exports must declare its name");
-		const url = yield* Effect.try(() => resolveModule(name, location));
-		const resolved = yield* fileSystem.realPath(fileURLToPath(url));
-		if (hostPath.relative(yield* fileSystem.realPath(location), resolved).startsWith("..")) return yield* escapes("package export escapes its root");
-		return {
-			url: pathToFileURL(resolved).href,
-			name
-		};
+const commit = Effect.fn("PluginNpm.commit")(function* (root, name) {
+	for (const file of [hostPath.join(root, "package-lock.json"), hostPath.join(root, "node_modules", ".package-lock.json")]) {
+		const parsed = yield* fileSystem.readFileString(file).pipe(Effect.flatMap(Schema.decodeUnknownEffect(Schema.fromJsonString(Lockfile))), Effect.option);
+		if (Option.isNone(parsed)) continue;
+		const found = commitIn(parsed.value.packages?.[`node_modules/${name}`]?.resolved);
+		if (found !== void 0) return found;
 	}
-	const url = yield* Effect.try(() => resolveModule(createRequire(pathToFileURL(manifestPath)).resolve(location), location));
-	return manifest.name === void 0 ? { url } : {
-		url,
-		name: manifest.name
-	};
 });
+/** Node error codes that mean "nothing here", as opposed to "this package is broken". */
+const notFound = /* @__PURE__ */ new Set([
+	"ENOENT",
+	"ENOTDIR",
+	"MODULE_NOT_FOUND",
+	"ERR_MODULE_NOT_FOUND",
+	"ERR_PACKAGE_PATH_NOT_EXPORTED",
+	"ERR_UNSUPPORTED_DIR_IMPORT"
+]);
 /**
-* Install a package into the store, importing and validating it **while it is still staged**.
+* The module to import out of an installed package.
 *
-* The validation is passed down rather than done afterwards for one reason: the store publishes by
-* rename, so a package that turns out not to be a plugin must be rejected before it is published.
-* Publishing first would make the broken generation the newest marked one, which `resolve` returns
-* forever after -- and re-running `add` would hit the fast path and return it again.
+* Ordered subpaths through the package's own `exports`, so a package that publishes a dedicated
+* `./plugin` entry is honoured and one that does not falls back to its main.
+*
+* Only "not found" is tolerated. Swallowing every error would turn a package that is broken --
+* a syntax error in its manifest, a permission problem -- into "no entrypoint", which is the
+* wrong diagnosis in the one place a person needs the right one.
 */
-const install = Effect.fn("PluginLoader.install")(function* (target, cache, origin, options) {
-	const added = yield* add(target, cache, {
-		from: anchor$1(origin.file, options.hostDir),
-		validate: (fetched) => imported(url(fetched.entrypoint), origin, options.import)
+const entrypoint = (directory, name) => Effect.gen(function* () {
+	for (const subpath of ["", "plugin"]) {
+		const specifier = name === void 0 ? hostPath.join(directory, subpath === "" ? "index" : subpath) : hostPath.join(name, subpath);
+		const resolved = yield* Effect.try(() => resolveModule(specifier, directory)).pipe(Effect.asSome, Effect.catchIf((error) => notFound.has(String(error.cause?.code)), () => Effect.succeed(Option.none())), Effect.mapError((error) => new InstallError({
+			reason: "plugin-no-entrypoint",
+			reference: name ?? directory,
+			message: `cannot resolve an entrypoint in ${directory}`,
+			cause: error
+		})));
+		if (Option.isSome(resolved)) return fileURLToPath(resolved.value);
+	}
+	return yield* new InstallError({
+		reason: "plugin-no-entrypoint",
+		reference: name ?? directory,
+		message: `no plugin entrypoint in ${directory}`
 	});
-	return {
-		url: added.entry.url,
-		...added.entry.version === void 0 ? {} : { version: added.entry.version },
-		generation: added.entry.generation,
-		...added.validated === void 0 ? {} : { plugin: added.validated }
-	};
 });
-/**
-* The directory whose `.npmrc` chain names the artifact a reference resolves to: the project that
-* declared it. A settings file sits in `<root>/.codework/`, but npm reads a project `.npmrc` at the
-* package boundary discovered upward from the chain's start -- the root itself -- so anchoring at
-* the file's own directory would miss it. Absent a declaring file the host context stands in.
-*/
-const anchor$1 = (file, fallback) => {
-	if (file === void 0) return fallback;
-	const directory = hostPath.dirname(file);
-	return hostPath.basename(directory) === ".codework" ? hostPath.dirname(directory) : directory;
-};
-/** The default installer, or the one the caller injected. */
-const installer = (target, origin, options) => options.install === void 0 ? install(target, options.cache, origin, options) : options.install(target, options.cache, anchor$1(origin.file, options.hostDir));
-/** Import a module and confirm it default-exports a plugin. */
-const imported = Effect.fn("PluginLoader.imported")(function* (url, origin, load) {
-	const module = yield* Effect.tryPromise({
-		try: () => (load ?? importModule)(url),
-		catch: (cause) => importFailure(origin, cause)
+const reify = Effect.fn("PluginNpm.reify")(function* ({ target, into, cache, from }) {
+	const flat = yield* options(from, cache);
+	const { Arborist } = yield* Effect.promise(() => import("@npmcli/arborist"));
+	const settings = {
+		...flat,
+		...target.mutable ? {
+			preferOnline: true,
+			noGitRevCache: true
+		} : {},
+		audit: false
+	};
+	const arborist = new Arborist({
+		...settings,
+		path: into,
+		binLinks: true,
+		progress: false,
+		savePrefix: "",
+		ignoreScripts: true
+	});
+	return yield* Effect.tryPromise({
+		try: () => arborist.reify({
+			...settings,
+			add: [target.spec],
+			update: target.mutable,
+			save: true,
+			saveType: "prod"
+		}),
+		catch: (cause) => new InstallError({
+			reason: "plugin-fetch-failed",
+			reference: target.spec,
+			message: `cannot install ${target.spec}`,
+			cause
+		})
 	});
-	return yield* validate(Predicate.isObject(module) && "default" in module ? module.default : void 0, origin);
 });
 /**
-* Import one entrypoint and confirm it is a plugin, without touching the store.
+* Fill `into` with the package `target` names, and report what landed there.
 *
-* This is what a caller hands the store as its `validate`: the artifact is checked while it is
-* still staged, so a package that turns out not to be a plugin is never published.
-*/
-const definition$1 = (entrypoint, reference) => imported(url(entrypoint), {
-	index: 0,
-	reference
-});
-/**
-* Install and import one reference, and report what it turned out to be, without selecting it.
-* `codework plugin add` uses this to prove a package really is a plugin before it writes the
-* reference into a settings file: the failure a user gets is the one they can act on — a bad
-* spec, an install that did not resolve, a module that exports no plugin — rather than a broken
-* configuration that only fails at the next run.
+* A local target downloads nothing: the files on disk are already the answer, and a local plugin
+* is never copied into the store.
 */
-const inspect = Effect.fn("PluginLoader.inspect")(function* (reference, options) {
-	const origin = {
-		index: 0,
-		reference,
-		file: options.file
+const download = Effect.fn("PluginNpm.download")(function* (input) {
+	const { target, into, cache, from, runner = reify } = input;
+	if (target.kind === "local") return {
+		directory: target.path,
+		name: hostPath.basename(target.path),
+		entrypoint: yield* entrypoint(target.path)
 	};
-	const target = yield* parse$2(reference, options.hostDir);
-	const loaded = yield* load$3(target, origin, options);
+	const root = yield* fileSystem.realPath(into).pipe(Effect.mapError((cause) => new InstallError({
+		reason: "plugin-fetch-failed",
+		reference: target.spec,
+		message: `cannot resolve the staging directory ${into}`,
+		cause
+	})));
+	const node = (yield* runner({
+		target,
+		into: root,
+		cache,
+		from
+	})).edgesOut.values().next().value?.to;
+	if (node === void 0) return yield* new InstallError({
+		reason: "plugin-fetch-failed",
+		reference: target.spec,
+		message: `${target.spec} installed nothing`
+	});
+	const manifest = yield* fileSystem.readFileString(hostPath.join(node.path, "package.json")).pipe(Effect.flatMap(Schema.decodeUnknownEffect(Schema.fromJsonString(Manifest$1))), Effect.option);
+	const version = Option.isNone(manifest) ? void 0 : manifest.value.version;
+	const revision = target.kind === "registry" ? version : (yield* commit(root, node.name)) ?? (yield* noCommit(target.spec));
 	return {
-		id: loaded.plugin.id,
-		...loaded.version === void 0 ? {} : { version: loaded.version },
-		...loaded.name === void 0 ? {} : { name: loaded.name }
+		directory: node.path,
+		name: node.name,
+		...version === void 0 ? {} : { version },
+		...revision === void 0 ? {} : { revision },
+		entrypoint: yield* entrypoint(node.path, node.name)
 	};
 });
-const load$3 = Effect.fn("PluginLoader.load")(function* (target, origin, options) {
-	const installed = yield* target.kind === "local" ? localUrl(target.path, origin).pipe(Effect.mapError((cause) => sourceFailure(origin, cause))) : installer(target, origin, options).pipe(Effect.mapError((cause) => origin.file === void 0 ? cause : declaredIn(cause, origin.file)));
-	const address = target.kind === "local" && options.reload !== void 0 && options.reload > 0 ? `${installed.url}?reload=${options.reload}` : installed.url;
-	return {
-		plugin: installed.plugin ?? (yield* imported(address, origin, options.import)),
-		source: origin.reference,
-		..."version" in installed && installed.version !== void 0 ? { version: installed.version } : {},
-		..."generation" in installed && installed.generation !== void 0 ? { generation: installed.generation } : {},
-		...installed.name === void 0 ? {} : { name: installed.name }
+const noCommit = (spec) => new InstallError({
+	reason: "plugin-no-commit",
+	reference: spec,
+	message: `cannot resolve a commit for ${spec}`
+});
+/**
+* What a mutable target points at right now, without installing it.
+*
+* `preferOnline` and `noGitRevCache` are the whole point: without them pacote answers from its own
+* metadata cache, and a staleness check that reads a cache is not a staleness check. An immutable
+* target skips the call entirely -- a version and a SHA cannot move.
+*/
+const probe = Effect.fn("PluginNpm.probe")(function* (target, cache, from) {
+	if (target.kind === "local" || !target.mutable) return void 0;
+	const opts = {
+		...yield* options(from, cache),
+		preferOnline: true,
+		noGitRevCache: true,
+		_isRoot: true
 	};
+	const { default: pacote } = yield* Effect.promise(() => import("pacote"));
+	return yield* Effect.tryPromise({
+		try: async () => target.kind === "registry" ? (await pacote.manifest(target.spec, opts)).version : commitIn(await pacote.resolve(target.spec, opts)),
+		catch: (cause) => new InstallError({
+			reason: "plugin-resolve-failed",
+			reference: target.spec,
+			message: `cannot reach ${target.spec}`,
+			cause
+		})
+	});
 });
-/**
-* The version-free, location-anchored spelling of a reference.
-*
-* Two references naming the same module compare equal through it: `@acme/x@1.2.0` and `@acme/x`
-* are one package, and `./plugins/x.ts` is the file it resolves to from the directory that
-* declared it. Pure -- nothing is installed, imported or read.
-*/
-const canonical = (reference, hostDir) => Effect.map(parse$2(reference, hostDir), canonical$1);
+/** A `file:` URL for an entrypoint, which is what the module loader takes. */
+const url = (entrypoint) => pathToFileURL(entrypoint).href;
 //#endregion
-//#region src/plugin/catalog.ts
+//#region src/plugin/source.ts
+/** A committish that names one artifact rather than a moving branch: an unabbreviated SHA. */
+const isCommit = (committish) => typeof committish === "string" && /^[a-f0-9]{40}$|^[a-f0-9]{64}$/i.test(committish);
 /**
-* A definition carries `setup`; a patch carries `plugin` or `package` and no `setup`. Checking
-* `setup` first matters because `Plugin` permits extra properties, so a definition holding its
-* own `plugin` property must not be read as configuration.
-*
-* e.g
-* "acme/tool@1.2.0"                    → module (load me)
-* define({id, kind, setup, ...})       → module (I AM the definition — embedder code only)
-* { plugin: "x", enabled: false }      → config (don't load — adjust something already loaded)
-*
-* setup present → definition, always (even with a stray plugin: key)
-* setup absent + plugin:/package: present → config patch
-* setup absent + neither key → malformed
+* A short, readable name for a git source, used to make a store path recognisable to a human
+* reading `ls`. It is never an identity: two remotes can slug alike, and the digest is what
+* separates them.
 */
-const isPatch = (reference) => Predicate.isObject(reference) && !Predicate.isFunction(reference) && !("setup" in reference) && ("plugin" in reference || "package" in reference);
+const slug = (spec) => {
+	const withoutCommittish = spec.split("#")[0] ?? spec;
+	return (() => {
+		try {
+			return decodeURIComponent(withoutCommittish);
+		} catch {
+			return withoutCommittish;
+		}
+	})().replace(/\.git$/i, "").split(/[/:\\]/).at(-1)?.replace(/[^a-zA-Z0-9._-]+/g, "-").replace(/^-+|-+$/g, "") || "repository";
+};
+/** Whether a reference names a place on disk rather than something to fetch. */
+const isPath = (reference) => reference.startsWith("file:") || reference.startsWith("./") || reference.startsWith("../") || hostPath.isAbsolute(reference);
 /**
-* The **load pass**: store lookup and ESM import, never the network.
-*
-* Runs at boot, at `reload`, and at any exchange that finds a reference it cannot satisfy. It
-* deliberately knows nothing about `enabled`, options or order -- those are data over modules that
-* are already loaded, they cost a walk of a short array, and they belong to every exchange.
+* `from` is the directory a relative spec resolves against, and the caller picks it:
 *
-* Loading is keyed by what a reference resolves to, so naming one module twice imports it once.
+* - a **plugin entry** anchors to the directory holding the file that declared it --
+*   `<root>/.codework/` for a project entry, `<home>/` for a user one, the named directory for
+*   `--user-config-dir`. The rule is about the file, not the project.
+* - a **CLI argument** anchors to the process's startup directory, because that is where the
+*   person typed it.
 */
-const load$2 = Effect.fn("PluginCatalog.load")(function* (references, options) {
-	const plugins = /* @__PURE__ */ new Map();
-	const aliases = /* @__PURE__ */ new Map();
-	const versions = /* @__PURE__ */ new Map();
-	const origins = /* @__PURE__ */ new Map();
-	const seen = /* @__PURE__ */ new Map();
-	const remember = (plugin, names, from) => {
-		plugins.set(plugin.id, plugin);
-		aliases.set(plugin.id, plugin.id);
-		for (const name of names) aliases.set(name, plugin.id);
-		if (from?.version !== void 0) versions.set(plugin.id, from.version);
-		if (from !== void 0) origins.set(plugin.id, from.origin);
-	};
-	/** Source metadata exists for diagnostics; a silent ID replacement is where it earns that. */
-	const note = (plugin, source) => plugins.has(plugin.id) ? Effect.logDebug(`plugin ${plugin.id} redefined by ${source}; the earlier definition is discarded`) : Effect.void;
-	for (const builtin of options.builtins) remember(yield* validate(builtin, {
-		index: -1,
-		reference: builtin.id
-	}, true), []);
-	for (const [index, reference] of references.entries()) {
-		if (isPatch(reference)) continue;
-		const declared = typeof reference === "string" ? reference : Predicate.hasProperty(reference, "id") ? reference.id : void 0;
-		const named = typeof declared === "string" ? declared : `<plugin object #${index}>`;
-		const origin = {
-			index,
-			reference: named,
-			file: options.declared?.get(named)
+const parse$2 = (reference, from) => Effect.gen(function* () {
+	const fail = (reason, message) => new SourceError({
+		reason,
+		reference,
+		message
+	});
+	rooted(from, "the directory a plugin reference anchors to");
+	if (reference.startsWith("file:")) {
+		if (!reference.startsWith("file:///")) return yield* fail("plugin-unsupported-source", `not an absolute file URL: ${reference}`);
+		return {
+			kind: "local",
+			path: fileURLToPath(reference)
 		};
-		if (typeof reference !== "string") {
-			if (typeof declared === "string" && plugins.get(declared) === reference) continue;
-			const plugin = yield* validate(reference, origin);
-			yield* note(plugin, "a supplied object");
-			remember(plugin, []);
-			continue;
-		}
-		const target = yield* parse$2(reference, options.hostDir);
-		const key = target.kind === "local" ? target.path : target.spec;
-		const already = seen.get(key);
-		if (already !== void 0) {
-			aliases.set(reference, already);
-			continue;
-		}
-		const definition = yield* load$3(target, origin, options);
-		yield* note(definition.plugin, definition.version === void 0 ? key : `${key}@${definition.version}`);
-		const names = target.kind === "local" ? [target.path, ...definition.name === void 0 ? [] : [definition.name]] : [canonical$1(target), target.spec];
-		remember(definition.plugin, [reference, ...names], {
-			...definition.version === void 0 ? {} : { version: definition.version },
-			origin: {
-				reference,
-				...definition.generation === void 0 ? {} : { generation: definition.generation },
-				...origin.file === void 0 ? {} : { file: origin.file }
-			}
-		});
-		seen.set(key, definition.plugin.id);
 	}
-	return {
-		plugins,
-		aliases,
-		versions,
-		origins
+	const expanded = expandTilde(reference, hostPath);
+	if (isPath(expanded)) return {
+		kind: "local",
+		path: hostPath.resolve(from, expanded)
 	};
+	const parsed = yield* Effect.try({
+		try: () => npa(reference),
+		catch: () => fail("plugin-unsupported-source", `cannot parse plugin source: ${reference}`)
+	});
+	if (parsed.type === "git") {
+		const { gitSubdir } = parsed;
+		return {
+			kind: "git",
+			slug: slug(reference),
+			spec: reference,
+			...parsed.gitCommittish == null ? {} : { committish: parsed.gitCommittish },
+			...gitSubdir == null ? {} : { subdir: gitSubdir },
+			mutable: !isCommit(parsed.gitCommittish)
+		};
+	}
+	if (parsed.name !== null && [
+		"version",
+		"range",
+		"tag"
+	].includes(parsed.type)) {
+		const omitted = parsed.raw === parsed.name || parsed.raw === `${parsed.name}@`;
+		return {
+			kind: "registry",
+			name: parsed.name,
+			spec: `${parsed.name}@${omitted ? "latest" : parsed.rawSpec}`,
+			mutable: parsed.type !== "version"
+		};
+	}
+	return yield* fail("plugin-unsupported-source", `unsupported plugin source: ${reference}`);
 });
 /**
-* The **config pass**: pure data over modules that are already loaded, run at every exchange.
-*
-* An array entry is a **module** — a definition object, a path, a `file:` URL, or a package
-* spec. It takes the position it is written at, so naming a module again moves it.
-*
-* An object entry is **configuration** for a plugin an earlier entry (or the built-in list)
-* already selected, addressed by its ID (`plugin`) or the module string (`package`) that selected
-* it. It never loads, installs or reorders anything, and a name matching nothing in the selection
-* is ignored rather than failing the boot — a typo costs a debug line, never a fetch.
+* What two references must share to be the same plugin, without installing either.
 *
-* Nothing here touches the disk, which is the whole point of the split: an `options` edit, an
-* `enabled` flip or a reordering applies at the next exchange without importing anything.
+* A local path is the file it resolves to; a package is its name, so `@acme/x@1` and `@acme/x@2`
+* are one package at two versions. Pure -- nothing is installed, imported or read.
 */
-const select = Effect.fn("PluginCatalog.select")(function* (references, pool) {
-	const operations = /* @__PURE__ */ new Map();
-	const missing = [];
-	const choose = (id, index) => operations.set(id, {
-		enabled: true,
-		index,
-		options: operations.get(id)?.options ?? {}
-	});
-	for (const [index, reference] of references.entries()) {
-		if (isPatch(reference)) {
-			const named = reference.plugin ?? reference.package;
-			const origin = {
-				index,
-				reference: typeof named === "string" ? named : `<plugin entry #${index}>`
-			};
-			const invalid = reference.plugin !== void 0 && reference.package !== void 0 ? "names both `plugin` and `package`" : typeof named !== "string" || named.length === 0 ? "names neither `plugin` nor `package`" : reference.enabled !== void 0 && typeof reference.enabled !== "boolean" ? "`enabled` is not a boolean" : reference.options !== void 0 && !isRecord$1(reference.options) ? "`options` is not a plain object" : void 0;
-			if (invalid !== void 0) return yield* definitionFailure(origin, /* @__PURE__ */ new Error(`plugin entry ${invalid}`));
-			const id = reference.plugin === void 0 ? pool.aliases.get(reference.package) : reference.plugin;
-			const operation = id === void 0 ? void 0 : operations.get(id);
-			if (id === void 0 || operation === void 0) {
-				yield* Effect.logDebug(`plugin configuration ignored: nothing selected under ${named}`);
-				continue;
-			}
-			operations.set(id, {
-				enabled: reference.enabled ?? operation.enabled,
-				index: operation.index,
-				options: reference.options ?? operation.options
-			});
-			continue;
-		}
-		if (typeof reference !== "string") {
-			const declared = Predicate.hasProperty(reference, "id") ? reference.id : void 0;
-			if (typeof declared === "string" && pool.plugins.has(declared)) choose(declared, index);
-			continue;
-		}
-		const id = pool.aliases.get(reference);
-		if (id === void 0) missing.push(reference);
-		else choose(id, index);
-	}
-	const selection = [];
-	for (const [id, operation] of operations) {
-		if (!operation.enabled) continue;
-		const plugin = pool.plugins.get(id);
-		if (plugin !== void 0) selection.push({
-			plugin,
-			options: Object.freeze(operation.options),
-			index: operation.index
-		});
+const canonical$1 = (target) => {
+	switch (target.kind) {
+		case "local": return target.path;
+		case "registry": return target.name;
+		case "git": return target.spec;
 	}
-	selection.sort((a, b) => (0, plugin_exports$1.rank)(a.plugin.kind) - (0, plugin_exports$1.rank)(b.plugin.kind) || a.index - b.index);
-	return {
-		selection: Object.freeze(selection.map(({ plugin, options }) => ({
-			plugin,
-			options
-		}))),
-		missing
-	};
+};
+//#endregion
+//#region src/plugin/index.store.ts
+const Record_ = Schema.Struct({
+	spec: Schema.String,
+	source: Schema.Literals(["registry", "git"]),
+	name: Schema.String,
+	slug: Schema.String,
+	mutable: Schema.Boolean,
+	generation: Schema.Finite,
+	version: Schema.optional(Schema.String),
+	revision: Schema.optional(Schema.String),
+	entrypoint: Schema.String,
+	installedAt: Schema.Finite,
+	checkedAt: Schema.optional(Schema.Finite),
+	outdated: Schema.optional(Schema.Boolean),
+	/** The remote revision observed at `checkedAt`; distinct from the installed `revision`. */
+	available: Schema.optional(Schema.String)
+});
+const File = Schema.Struct({
+	version: Schema.Finite,
+	entries: Schema.Record(Schema.String, Record_)
 });
+const VERSION = 1;
+const NAME = "index.json";
 /**
-* The exchange-boundary check: has the store moved under this pool?
+* Read the whole file, or start empty.
 *
-* Every exchange already re-reads every settings layer from disk, and the config pass already
-* walks those entries against the loaded set. Two things can be settled right there, and they are
-* the same question asked twice:
+* An unreadable or unparseable index is not an error: it is a cold cache. Failing here would make
+* a corrupt accelerator break installs that do not need it.
+*/
+const read = Effect.fn("PluginIndex.read")(function* (root) {
+	const parsed = yield* fileSystem.readFileString(hostPath.join(root, NAME)).pipe(Effect.flatMap(Schema.decodeUnknownEffect(Schema.fromJsonString(File))), Effect.option);
+	if (Option.isNone(parsed) || parsed.value.version !== VERSION) return /* @__PURE__ */ new Map();
+	return new Map(Object.entries(parsed.value.entries));
+});
+/** Temp file plus rename, so a reader never sees a half-written index. */
+const write = Effect.fn("PluginIndex.write")(function* (root, entries) {
+	const encoded = yield* Schema.encodeEffect(Schema.fromJsonString(File))({
+		version: VERSION,
+		entries: Object.fromEntries(entries)
+	});
+	yield* fileSystem.makeDirectory(root, { recursive: true });
+	const temporary = yield* fileSystem.makeTempFile({
+		directory: root,
+		prefix: `.${NAME}.`,
+		suffix: ".tmp"
+	});
+	yield* fileSystem.writeFileString(temporary, encoded).pipe(Effect.andThen(fileSystem.rename(temporary, hostPath.join(root, NAME))), Effect.ensuring(fileSystem.remove(temporary, { force: true }).pipe(Effect.ignore)));
+});
+/**
+* Record one entry, keeping whatever else the file holds.
 *
-* 1. a settings entry names a module that is not loaded, and the store holds it;
-* 2. a loaded module is not the newest generation the store has.
+* Ignores its own failures. A store that cannot write its accelerator still works; refusing the
+* install would be the accelerator deciding whether the install counted.
+*/
+const put = Effect.fn("PluginIndex.put")(function* (root, digest, record) {
+	const entries = yield* read(root);
+	entries.set(digest, record);
+	yield* write(root, entries).pipe(Effect.ignore);
+});
+/**
+* Merge fields into one record, if it is there.
 *
-* The second is what makes `plugin update` finish. Without it the question is "is this entry
-* loaded?", the answer after an update is still yes, and the bytes just fetched sit on disk until
-* something else forces an import.
+* Unlocked, like every write here but the one that publishes a generation. Two processes checking
+* at once both read the whole file and both rewrite it, so one update is lost and a record added
+* in between can vanish -- and neither matters, because a lost `checkedAt` costs one network call
+* and a vanished record is a miss a scan repairs.
+*/
+const patch = Effect.fn("PluginIndex.patch")(function* (root, digest, fields) {
+	const entries = yield* read(root);
+	const existing = entries.get(digest);
+	if (existing === void 0) return;
+	entries.set(digest, {
+		...existing,
+		...fields
+	});
+	yield* write(root, entries).pipe(Effect.ignore);
+});
+/** Forget one entry, for a store entry that has been removed. */
+const drop = Effect.fn("PluginIndex.drop")(function* (root, digest) {
+	const entries = yield* read(root);
+	if (!entries.delete(digest)) return;
+	yield* write(root, entries).pipe(Effect.ignore);
+});
+//#endregion
+//#region src/plugin/lock.ts
+/** How long to wait for another holder before giving up. */
+const TIMEOUT = Duration.minutes(2);
+/** The holder refreshes the lock's mtime this often; one not refreshed for the timeout is stale. */
+const HEARTBEAT = Duration.seconds(15);
+const abandoned = (directory) => Effect.gen(function* () {
+	const info = yield* fileSystem.stat(directory);
+	const now = yield* Effect.clockWith((clock) => clock.currentTimeMillis);
+	return Option.exists(info.mtime, (mtime) => now - mtime.getTime() > Duration.toMillis(TIMEOUT));
+}).pipe(Effect.orElseSucceed(() => false));
+const heartbeat = (directory) => Effect.clockWith((clock) => clock.currentTimeMillis).pipe(Effect.flatMap((now) => fileSystem.utimes(directory, now, now)), Effect.ignore, Effect.repeat(Schedule.spaced(HEARTBEAT)));
+/**
+* Claims `directory` by creating it, polling while another process holds it, and releasing it when
+* the surrounding scope closes.
 *
-* Returns the new pool, or nothing when nothing moved -- which is the common case, and costs one
-* store lookup per filed module.
+* One finalizer is registered for the whole wait rather than one per 50ms poll, and a single
+* attempt is `uninterruptible` so `mkdir` and recording ownership cannot be split -- an interrupt
+* between them would leave behind a lock the finalizer does not know to remove.
 *
-* **This is not a watcher.** Nothing polls and no fiber exists; it is the observation that we were
-* already paying for the I/O that would tell us, and discarding the answer. Three bounds keep it
-* safe: the store only and never the network, so an exchange cannot block on a registry;
-* resolve-only, so it cannot install; and once, at the top of a snapshot, so an exchange already
-* running is unaffected.
+* `onTimeout` names the failure, because what a caller is waiting for is the caller's to describe.
 */
-const follow = Effect.fn("PluginCatalog.follow")(function* (references, pool, options, filed) {
-	let moved = false;
-	for (const reference of references) {
-		if (typeof reference !== "string" || pool.aliases.has(reference)) continue;
-		if (Option.isSome(yield* filed(reference, anchor$1(options.declared?.get(reference), options.hostDir)))) {
-			moved = true;
-			break;
-		}
-	}
-	if (!moved) for (const origin of pool.origins.values()) {
-		if (origin.generation === void 0) continue;
-		const current = yield* filed(origin.reference, anchor$1(origin.file, options.hostDir));
-		if (Option.isSome(current) && current.value.generation !== void 0 && current.value.generation > origin.generation) {
-			moved = true;
-			break;
-		}
-	}
-	if (!moved) return Option.none();
-	const retained = [];
-	for (const origin of pool.origins.values()) {
-		if (references.includes(origin.reference) || Option.isSome(yield* filed(origin.reference, anchor$1(origin.file, options.hostDir)))) {
-			retained.push(origin);
-			continue;
-		}
-		yield* Effect.logWarning(`plugin ${origin.reference} no longer resolves; it is dropped from the loaded set`);
-	}
-	const accumulated = [...Array.from(retained, (origin) => origin.reference), ...references];
-	const known = /* @__PURE__ */ new Map();
-	for (const origin of retained) if (origin.file !== void 0) known.set(origin.reference, origin.file);
-	for (const [reference, file] of options.declared ?? /* @__PURE__ */ new Map()) known.set(reference, file);
-	return Option.some(yield* load$2(accumulated, {
-		...options,
-		declared: known
-	}));
-});
-Effect.fn("PluginCatalog.prepare")(function* (references, options) {
-	const pool = yield* load$2(references, options);
-	return (yield* select(references, pool)).selection;
+const lock = Effect.fn("PluginLock.acquire")(function* (directory, onTimeout) {
+	const held = yield* Ref.make(false);
+	yield* Effect.acquireRelease(Effect.void, () => Ref.get(held).pipe(Effect.flatMap((owned) => owned ? fileSystem.remove(directory, {
+		recursive: true,
+		force: true
+	}) : Effect.void), Effect.orDie));
+	if (!(yield* fileSystem.makeDirectory(directory).pipe(Effect.andThen(Ref.set(held, true)), Effect.as(true), Effect.catchIf((error) => error.reason._tag === "AlreadyExists", () => abandoned(directory).pipe(Effect.flatMap((stale) => stale ? fileSystem.remove(directory, {
+		recursive: true,
+		force: true
+	}).pipe(Effect.as(false)) : Effect.succeed(false)))), Effect.uninterruptible).pipe(Effect.repeat({
+		schedule: Schedule.spaced("50 millis"),
+		until: (owned) => owned
+	}), Effect.timeoutOrElse({
+		duration: TIMEOUT,
+		orElse: () => Effect.succeed(false)
+	})))) return yield* Effect.fail(onTimeout());
+	yield* Effect.forkScoped(heartbeat(directory));
 });
 //#endregion
-//#region src/plugin/builtin/prompt/default.ts
-/** The default coding-agent foundation, used unless `promptCustom` replaces it. */
-const foundation = `You are an expert coding assistant operating inside codework, a coding agent harness.`;
+//#region src/plugin/store.ts
+/** Facts about the *package*, and nothing about the plugin inside it. */
+const Marker = Schema.Struct({
+	spec: Schema.String,
+	name: Schema.String,
+	version: Schema.optional(Schema.String),
+	revision: Schema.optional(Schema.String),
+	/** Relative to the generation directory, so the marker survives the publishing rename. */
+	entrypoint: Schema.String,
+	createdAt: Schema.Finite
+});
+const MARKER = ".complete.json";
+const STAGING = ".staging-";
+const root = (cache) => hostPath.join(cache, "plugins", "v2");
 /**
-* Guidelines that hold regardless of which tools are registered.
+* A readable label, never an identity: two specs that slug alike share a parent directory and
+* nothing more. Worth having because a greppable path is worth real money when debugging, and a
+* bare hash throws away every clue.
+*/
+const slugOf = (target) => target.kind === "git" ? target.slug : canonical$1(target).replace(/^@/, "").replace(/[^a-zA-Z0-9._-]+/g, "-").replace(/^-+|-+$/g, "") || "package";
+/**
+* The **full** SHA-256 of the source identity: canonical spec plus effective registry for a
+* registry package, and the canonical spec alone for git.
 *
-* Kept short on purpose. Every line here is spent on every request, so a line
-* earns its place only if a model measurably behaves worse without it.
+* Not truncated. The fast path proves a hit by checking that a marker *exists* rather than by
+* decoding it, and the index is keyed by digest alone, so a truncated digest would let a collision
+* return the wrong package silently.
 */
-const standingGuidelines = [
-	"Be concise. Report what you did and what you found, not what you are about to do.",
-	"Quote exact paths and command output rather than paraphrasing them.",
-	"If a command fails, read the error before retrying."
-];
-/** Collapse whitespace so two spellings of one guideline dedupe against each other. */
-const normalize = (value) => value.trim().replace(/\s+/g, " ");
+const digest = Effect.fn("PluginStore.digest")(function* (target, cache, from) {
+	const source = target.kind === "registry" ? `${yield* registry(target, cache, from)}\0${target.spec}` : target.spec;
+	return Encoding.encodeHex(yield* crypto.digest("SHA-256", new TextEncoder().encode(source)));
+});
+const entryDir = Effect.fn("PluginStore.entryDir")(function* (target, cache, from) {
+	const key = yield* digest(target, cache, from);
+	return {
+		key,
+		directory: hostPath.join(root(cache), slugOf(target), key)
+	};
+});
+const failure$1 = (target, reason, message, cause) => new StoreError({
+	reason,
+	reference: target.spec,
+	message,
+	...cause === void 0 ? {} : { cause }
+});
+/** Generation directories, oldest first. A name that is not a number is not a generation. */
+const generations = Effect.fn("PluginStore.generations")(function* (directory) {
+	return (yield* fileSystem.readDirectory(directory).pipe(Effect.orElseSucceed(() => []))).filter((name) => /^\d+$/.test(name)).map((name) => Number(name)).sort((left, right) => left - right);
+});
+const readMarker = (directory) => fileSystem.readFileString(hostPath.join(directory, MARKER)).pipe(Effect.flatMap(Schema.decodeUnknownEffect(Schema.fromJsonString(Marker))), Effect.option);
+const entryOf = (marker, input) => ({
+	...marker,
+	digest: input.digest,
+	generation: input.generation,
+	directory: input.directory,
+	url: url(hostPath.resolve(input.directory, marker.entrypoint))
+});
+/** The newest generation that carries a marker. Unmarked ones are invisible: they never happened. */
+const active = Effect.fn("PluginStore.active")(function* (directory, key) {
+	for (const generation of (yield* generations(directory)).reverse()) {
+		const where = hostPath.join(directory, String(generation));
+		const marker = yield* readMarker(where);
+		if (Option.isSome(marker)) return entryOf(marker.value, {
+			digest: key,
+			generation,
+			directory: where
+		});
+	}
+});
+/** What the index files about an entry, all of it derivable from the spec and the marker. */
+const record = (target, entry, installedAt) => ({
+	spec: target.spec,
+	source: target.kind,
+	name: entry.name,
+	slug: slugOf(target),
+	mutable: target.mutable,
+	generation: entry.generation,
+	...entry.version === void 0 ? {} : { version: entry.version },
+	...entry.revision === void 0 ? {} : { revision: entry.revision },
+	entrypoint: entry.entrypoint,
+	installedAt
+});
 /**
-* Tool-contributed guidelines followed by the standing ones, normalized and
-* deduplicated with first occurrence winning.
+* Disk-only lookup. No network, no install -- this is what boot uses, and the reason booting
+* offline works.
 *
-* Tool order is bucket order, which is the same order the index renders in and the
-* same order the provider receives definitions in -- one ordering, not three.
+* The index is consulted first and is only ever a hint: a hit is proved by the marker still
+* existing, and anything else falls through to a scan that repairs the index on the way past.
 */
-const guidelines = (tools) => {
-	const seen = /* @__PURE__ */ new Set();
-	const collected = [];
-	for (const line of [...tools.flatMap((tool) => tool.promptGuidelines ?? []), ...standingGuidelines]) {
-		const normalized = normalize(line);
-		if (normalized.length === 0 || seen.has(normalized)) continue;
-		seen.add(normalized);
-		collected.push(normalized);
+const resolve$2 = Effect.fn("PluginStore.resolve")(function* (target, cache, from) {
+	const { key, directory } = yield* entryDir(target, cache, from);
+	const base = root(cache);
+	const hinted = (yield* read(base)).get(key);
+	if (hinted !== void 0) {
+		const where = hostPath.join(directory, String(hinted.generation));
+		const marker = yield* readMarker(where);
+		if (Option.isSome(marker)) return entryOf(marker.value, {
+			digest: key,
+			generation: hinted.generation,
+			directory: where
+		});
 	}
-	return collected;
-};
+	const scanned = yield* active(directory, key);
+	if (scanned === void 0) return void 0;
+	yield* put(base, key, record(target, scanned, scanned.createdAt));
+	return scanned;
+}, Effect.mapError((cause) => Schema.is(StoreError)(cause) || Schema.is(InstallError)(cause) ? cause : new StoreError({
+	reason: "plugin-marker-invalid",
+	reference: "",
+	message: "cannot read the plugin store",
+	cause
+})));
 /**
-* The rendered tool index.
+* `resolve`, for a caller that needs the entry rather than an answer about it.
 *
-* `(none)` rather than an omitted section: a model told it has no tools behaves
-* better than one left to infer it from silence.
-*/
-const toolIndex = (tools) => {
-	const listed = tools.filter((tool) => tool.promptSnippet !== void 0 && tool.promptSnippet.length > 0);
-	if (listed.length === 0) return "(none)";
-	return listed.map((tool) => `- ${tool.name}: ${tool.promptSnippet}`).join("\n");
-};
-const assemble = (input) => {
-	const sections = [input.promptCustom ?? foundation];
-	sections.push(`Available tools:\n${toolIndex(input.tools)}`);
-	const lines = guidelines(input.tools);
-	if (lines.length > 0) sections.push(`Guidelines:\n${lines.map((line) => `- ${line}`).join("\n")}`);
-	const append = input.promptSystemAppend?.trim();
-	if (append !== void 0 && append.length > 0) sections.push(append);
-	sections.push(`Current working directory: ${input.directory}`);
-	return sections.join("\n\n");
-};
-/**
-* A caller slot, awaited lazily. A throw or rejection fails the snapshot, which the
-* host attributes to this plugin's id.
+* `plugin remove` uses this as its installer: it has to identify what an entry names without
+* fetching anything, and a spec with nothing filed is a real answer there -- the command reports
+* it and moves on.
 */
-const slot = (ctx, resolver) => Effect.tryPromise(() => Promise.resolve(resolver?.(ctx)));
-const defaultPromptPlugin = (0, plugin_exports$1.define)({
-	id: "codework.prompt.default",
-	kind: "prompt",
-	setup: Effect.fn("DefaultPromptPlugin.setup")(function* (ctx) {
-		const custom = yield* slot(ctx, ctx.config.promptCustom);
-		const append = yield* slot(ctx, ctx.config.promptSystemAppend);
-		ctx.plugin.prompt.set(assemble({
-			tools: ctx.plugin.tools.list(),
-			directory: ctx.location.directory,
-			...custom === void 0 ? {} : { promptCustom: custom },
-			...append === void 0 ? {} : { promptSystemAppend: append }
-		}));
-	})
+const required = Effect.fn("PluginStore.required")(function* (target, cache, from) {
+	const found = yield* resolve$2(target, cache, from);
+	if (found === void 0) return yield* failure$1(target, "plugin-not-installed", `${target.spec} is not installed`);
+	return found;
 });
-//#endregion
-//#region src/tool/truncate.ts
 /**
-* Shared truncation utilities for tool outputs.
-*
-* Truncation is based on two independent limits — whichever is hit first
-* wins: a line limit and a byte limit. Lines are never split (except the bash
-* tail edge case where a single line exceeds the byte limit).
+* Install if absent; hand back what is filed if present.
 *
-* The bash tool uses {@link truncateTail} (keep the end — errors / final
-* results); file readers use {@link truncateHead} (keep the beginning).
-*/
-const DEFAULT_MAX_LINES = 2e3;
-const DEFAULT_MAX_BYTES = 51200;
-function splitLinesForCounting(content) {
-	if (content.length === 0) return [];
-	const lines = content.split("\n");
-	if (content.endsWith("\n")) lines.pop();
-	return lines;
-}
-/** Format bytes as a human-readable size. */
-function formatSize(bytes) {
-	if (bytes < 1024) return `${bytes}B`;
-	if (bytes < 1048576) return `${(bytes / 1024).toFixed(1)}KB`;
-	return `${(bytes / 1048576).toFixed(1)}MB`;
-}
-/**
-* Truncate content from the tail (keep the last N lines/bytes). Suitable for
-* bash output where the end matters (errors, final results). May return a
-* partial first line if the last line of the original content exceeds the byte
-* limit.
+* `refresh` forces past both the fast path and the double-check, which is what `update` needs and
+* nothing else should use.
 */
-function truncateTail(content, options = {}) {
-	const maxLines = options.maxLines ?? 2e3;
-	const maxBytes = options.maxBytes ?? 51200;
-	const totalBytes = Buffer.byteLength(content, "utf-8");
-	const lines = splitLinesForCounting(content);
-	const totalLines = lines.length;
-	if (totalLines <= maxLines && totalBytes <= maxBytes) return {
-		content,
-		truncated: false,
-		truncatedBy: null,
-		totalLines,
-		totalBytes,
-		outputLines: totalLines,
-		outputBytes: totalBytes,
-		lastLinePartial: false,
-		firstLineExceedsLimit: false,
-		maxLines,
-		maxBytes
-	};
-	const outputLinesArr = [];
-	let outputBytesCount = 0;
-	let truncatedBy = "lines";
-	let lastLinePartial = false;
-	for (let i = lines.length - 1; i >= 0 && outputLinesArr.length < maxLines; i--) {
-		const line = lines[i] ?? "";
-		const lineBytes = Buffer.byteLength(line, "utf-8") + (outputLinesArr.length > 0 ? 1 : 0);
-		if (outputBytesCount + lineBytes > maxBytes) {
-			truncatedBy = "bytes";
-			if (outputLinesArr.length === 0) {
-				const truncatedLine = truncateStringToBytesFromEnd(line, maxBytes);
-				outputLinesArr.unshift(truncatedLine);
-				outputBytesCount = Buffer.byteLength(truncatedLine, "utf-8");
-				lastLinePartial = true;
-			}
-			break;
+const add = Effect.fn("PluginStore.add")(function* (target, cache, options) {
+	return yield* Effect.gen(function* () {
+		const { key, directory } = yield* entryDir(target, cache, options.from);
+		if (options.refresh !== true) {
+			const found = yield* resolve$2(target, cache, options.from);
+			if (found !== void 0) return { entry: found };
 		}
-		outputLinesArr.unshift(line);
-		outputBytesCount += lineBytes;
-	}
-	if (outputLinesArr.length >= maxLines && outputBytesCount <= maxBytes) truncatedBy = "lines";
-	const outputContent = outputLinesArr.join("\n");
-	const finalOutputBytes = Buffer.byteLength(outputContent, "utf-8");
-	return {
-		content: outputContent,
-		truncated: true,
-		truncatedBy,
-		totalLines,
-		totalBytes,
-		outputLines: outputLinesArr.length,
-		outputBytes: finalOutputBytes,
-		lastLinePartial,
-		firstLineExceedsLimit: false,
-		maxLines,
-		maxBytes
-	};
-}
-/**
-* Truncate a string to fit within a byte limit (from the end). Handles
-* multi-byte UTF-8 characters correctly (never splits a codepoint).
-*/
-function truncateStringToBytesFromEnd(str, maxBytes) {
-	const buf = Buffer.from(str, "utf-8");
-	if (buf.length <= maxBytes) return str;
-	let start = buf.length - maxBytes;
-	while (start < buf.length && (buf[start] & 192) === 128) start++;
-	return buf.subarray(start).toString("utf-8");
-}
-//#endregion
-//#region src/tool/accumulator.ts
-function defaultTempFilePath(prefix, suffix) {
-	return posix.join(tmpdir(), `${prefix}-${suffix}.log`);
-}
-function byteLength(text) {
-	return Buffer.byteLength(text, "utf-8");
-}
-var Accumulator = class {
-	maxLines;
-	maxBytes;
-	maxRollingBytes;
-	tempFilePrefix;
-	decoder = new TextDecoder();
-	rawChunks = [];
-	tailText = "";
-	tailBytes = 0;
-	tailStartsAtLineBoundary = true;
-	totalRawBytes = 0;
-	totalDecodedBytes = 0;
-	completedLines = 0;
-	totalLines = 0;
-	currentLineBytes = 0;
-	hasOpenLine = false;
-	finished = false;
-	tempFilePath;
-	tempFile;
-	constructor(options = {}) {
-		this.maxLines = options.maxLines ?? 2e3;
-		this.maxBytes = options.maxBytes ?? 51200;
-		this.maxRollingBytes = Math.max(this.maxBytes * 2, 1);
-		this.tempFilePrefix = options.tempFilePrefix ?? "codework-output";
-	}
-	append(data) {
-		return Effect.suspend(() => {
-			if (this.finished) return Effect.die(/* @__PURE__ */ new Error("cannot append to a finished output accumulator"));
-			this.totalRawBytes += data.length;
-			this.appendDecodedText(this.decoder.decode(data, { stream: true }));
-			if (this.tempFile !== void 0 || this.shouldUseTempFile()) return Effect.gen({ self: this }, function* () {
-				yield* this.ensureTempFile();
-				yield* this.tempFile.writeAll(data).pipe(Effect.orDie);
-			});
-			if (data.length > 0) this.rawChunks.push(data);
-			return Effect.void;
-		});
-	}
-	finish() {
-		return Effect.suspend(() => {
-			if (this.finished) return Effect.void;
-			this.finished = true;
-			this.appendDecodedText(this.decoder.decode());
-			return Effect.gen({ self: this }, function* () {
-				if (this.shouldUseTempFile()) yield* this.ensureTempFile();
-				if (this.tempFile !== void 0) yield* this.tempFile.sync.pipe(Effect.orDie);
-			});
+		yield* fileSystem.makeDirectory(directory, { recursive: true });
+		yield* lock(hostPath.join(directory, ".lock"), () => failure$1(target, "plugin-lock-timeout", `timed out waiting for another installation of ${target.spec}`));
+		const current = yield* active(directory, key);
+		if (current !== void 0 && options.refresh !== true) return { entry: current };
+		const real = yield* fileSystem.realPath(directory).pipe(Effect.orElseSucceed(() => directory));
+		const staging = yield* Effect.acquireRelease(fileSystem.makeTempDirectory({
+			directory: real,
+			prefix: STAGING
+		}), (staged) => fileSystem.remove(staged, {
+			recursive: true,
+			force: true
+		}).pipe(Effect.orDie));
+		yield* fileSystem.writeFileString(hostPath.join(staging, "package.json"), "{\"private\":true,\"type\":\"module\"}");
+		const fetched = yield* download({
+			target,
+			into: staging,
+			cache,
+			from: options.from,
+			...options.runner === void 0 ? {} : { runner: options.runner }
 		});
-	}
-	snapshot() {
-		const tailTruncation = truncateTail(this.getSnapshotText(), {
-			maxLines: this.maxLines,
-			maxBytes: this.maxBytes
+		if (current !== void 0 && current.revision === fetched.revision) return { entry: current };
+		const validated = yield* options.validate(fetched);
+		const entrypoint = hostPath.relative(yield* fileSystem.realPath(staging), fetched.entrypoint);
+		if (entrypoint.startsWith("..") || hostPath.isAbsolute(entrypoint)) return yield* new InstallError({
+			reason: "plugin-no-entrypoint",
+			reference: target.spec,
+			message: `entrypoint escapes its installation: ${entrypoint}`
 		});
-		const truncated = this.totalLines > this.maxLines || this.totalDecodedBytes > this.maxBytes;
-		const truncatedBy = truncated ? tailTruncation.truncatedBy ?? (this.totalDecodedBytes > this.maxBytes ? "bytes" : "lines") : null;
-		const truncation = {
-			...tailTruncation,
-			truncated,
-			truncatedBy,
-			totalLines: this.totalLines,
-			totalBytes: this.totalDecodedBytes,
-			maxLines: this.maxLines,
-			maxBytes: this.maxBytes
+		const now = yield* Effect.clockWith((clock) => clock.currentTimeMillis);
+		const marker = {
+			spec: target.spec,
+			name: fetched.name,
+			...fetched.version === void 0 ? {} : { version: fetched.version },
+			...fetched.revision === void 0 ? {} : { revision: fetched.revision },
+			entrypoint,
+			createdAt: now
 		};
+		yield* fileSystem.writeFileString(hostPath.join(staging, MARKER), yield* Schema.encodeEffect(Schema.fromJsonString(Marker))(marker));
+		const previous = (yield* generations(directory)).at(-1) ?? 0;
+		const generation = Math.max(now, previous + 1);
+		const published = hostPath.join(directory, String(generation));
+		yield* fileSystem.rename(staging, published);
+		const entry = entryOf(marker, {
+			digest: key,
+			generation,
+			directory: published
+		});
+		yield* put(root(cache), key, record(target, entry, now));
+		yield* collect$1(directory);
 		return {
-			content: truncation.content,
-			truncation,
-			...this.tempFilePath === void 0 ? {} : { fullOutputPath: this.tempFilePath }
+			entry,
+			validated
 		};
-	}
-	/** Bytes in the final (possibly unterminated) line — for the partial-line footer. */
-	getLastLineBytes() {
-		return this.currentLineBytes;
-	}
-	appendDecodedText(text) {
-		if (text.length === 0) return;
-		const bytes = byteLength(text);
-		this.totalDecodedBytes += bytes;
-		this.tailText += text;
-		this.tailBytes += bytes;
-		if (this.tailBytes > this.maxRollingBytes * 2) this.trimTail();
-		let newlines = 0;
-		let lastNewline = -1;
-		for (let i = text.indexOf("\n"); i !== -1; i = text.indexOf("\n", i + 1)) {
-			newlines++;
-			lastNewline = i;
-		}
-		if (newlines === 0) {
-			this.currentLineBytes += bytes;
-			this.hasOpenLine = true;
-		} else {
-			this.completedLines += newlines;
-			const tail = text.slice(lastNewline + 1);
-			this.currentLineBytes = byteLength(tail);
-			this.hasOpenLine = tail.length > 0;
-		}
-		this.totalLines = this.completedLines + (this.hasOpenLine ? 1 : 0);
-	}
-	trimTail() {
-		const buffer = Buffer.from(this.tailText, "utf-8");
-		if (buffer.length <= this.maxRollingBytes) {
-			this.tailBytes = buffer.length;
-			return;
+	}).pipe(Effect.scoped, Effect.mapError((cause) => Schema.is(InstallError)(cause) || Schema.is(StoreError)(cause) || Schema.is(LoadError)(cause) ? cause : failure$1(target, "plugin-marker-invalid", `cannot write the store entry for ${target.spec}`, cause)));
+});
+/**
+* Expire what is superseded.
+*
+* The two newest generations are kept regardless of age: the newest is live, and the one before it
+* may still be imported by an exchange in flight. Runs at the end of an `add` that published
+* something -- no timer and no sweeper, because installs are the only thing that creates garbage.
+*/
+const collect$1 = Effect.fn("PluginStore.collect")(function* (directory) {
+	const now = yield* Effect.clockWith((clock) => clock.currentTimeMillis);
+	const keep = new Set((yield* generations(directory)).slice(-2).map(String));
+	const names = yield* fileSystem.readDirectory(directory).pipe(Effect.orElseSucceed(() => []));
+	for (const name of names) {
+		if (keep.has(name) || name === ".lock") continue;
+		if (name.startsWith(STAGING)) {
+			const started = yield* fileSystem.stat(hostPath.join(directory, name)).pipe(Effect.option);
+			if ((Option.isNone(started) ? 0 : Option.match(started.value.mtime, {
+				onNone: () => 0,
+				onSome: (at) => now - at.getTime()
+			})) > HOUR) yield* fileSystem.remove(hostPath.join(directory, name), {
+				recursive: true,
+				force: true
+			}).pipe(Effect.ignore);
+			continue;
 		}
-		let start = buffer.length - this.maxRollingBytes;
-		while (start < buffer.length && (buffer[start] & 192) === 128) start++;
-		this.tailStartsAtLineBoundary = start === 0 ? this.tailStartsAtLineBoundary : buffer[start - 1] === 10;
-		this.tailText = buffer.subarray(start).toString("utf-8");
-		this.tailBytes = byteLength(this.tailText);
-	}
-	getSnapshotText() {
-		if (this.tailStartsAtLineBoundary) return this.tailText;
-		const firstNewline = this.tailText.indexOf("\n");
-		return firstNewline === -1 ? this.tailText : this.tailText.slice(firstNewline + 1);
-	}
-	shouldUseTempFile() {
-		return this.totalRawBytes > this.maxBytes || this.totalDecodedBytes > this.maxBytes || this.totalLines > this.maxLines;
-	}
-	ensureTempFile() {
-		if (this.tempFile !== void 0) return Effect.void;
-		return Effect.gen({ self: this }, function* () {
-			const suffix = Encoding.encodeHex(yield* crypto.randomBytes(8));
-			this.tempFilePath = defaultTempFilePath(this.tempFilePrefix, suffix);
-			this.tempFile = yield* fileSystem.open(this.tempFilePath, { flag: "w" });
-			for (const chunk of this.rawChunks) yield* this.tempFile.writeAll(chunk);
-			this.rawChunks = [];
-		}).pipe(Effect.orDie);
+		if (!/^\d+$/.test(name)) continue;
+		if (now - Number(name) > WEEK) yield* fileSystem.remove(hostPath.join(directory, name), {
+			recursive: true,
+			force: true
+		}).pipe(Effect.ignore);
 	}
-};
-//#endregion
-//#region src/tool/progress.ts
-var progress_exports = /* @__PURE__ */ __exportAll({});
-import * as import__codeworksh_plugin_tool_progress from "@codeworksh/plugin/tool/progress";
-__reExport(progress_exports, import__codeworksh_plugin_tool_progress);
-//#endregion
-//#region src/tool/shell.ts
+});
+const HOUR = 36e5;
+const WEEK = 168 * HOUR;
 /**
-* `ToolShell` — the tool-owned, cancellable command-execution capability the bash tool depends on.
+* How long a network answer is reused before `check` asks again.
 *
-* It deliberately does **not** reuse `sandbox/Shell` directly: the local OS path
-* provides no `Shell` at all, and `sandbox/Shell` models neither cancellation
-* nor a timeout. `ToolShell` makes both part of the contract. Adapters honor the
-* mid-flight process kill where the SDK allows it (local, Vercel) and fall back
-* to the timeout where it does not (Daytona) — "kill where it's easy".
+* Persisted in the index rather than held in memory, because the thing that benefits is a command
+* that exits: an in-memory staleness cache is worthless to `codework plugin check`.
+*/
+const CHECK_TTL = 36e5;
+/**
+* Is a newer revision available?
 *
-* Two modes, and Local has two variants:
-*   - Local / full OS shell  → {@link local} (default)
-*   - Local / just-bash      → {@link fromSandboxShell} over `EnvBash`
-*   - Remote / provider      → {@link fromSandboxShell} over `EnvDaytona` / `EnvVercel`
+* The only network call in the store's vocabulary, and it is the caller's to make. A `probe` that
+* fails -- offline, registry down, a remote that refuses -- propagates rather than answering
+* `current`: an outage must not read as "you are up to date".
 */
-/** Infra/spawn failure — not model-actionable; handlers should treat it as a defect. */
-var ToolShellError = class extends Schema.TaggedError()("ToolShellError", {
-	command: Schema.String,
-	cause: Schema.optional(Schema.Defect())
-}) {};
-/** The command exceeded its deadline. Distinct so handlers can map it to a domain timeout. */
-var ToolShellTimeout = class extends Schema.TaggedError()("ToolShellTimeout", {
-	command: Schema.String,
-	timeoutMillis: Schema.Finite
-}) {};
-const widenExecError = (effect) => effect.pipe(Effect.mapError((error) => error));
-var ToolShell = class extends Context.Service()("@codeworksh/harness/tool/shell/ToolShell") {};
+const check = Effect.fn("PluginStore.check")(function* (target, cache, options) {
+	if (!target.mutable) return { _tag: "immutable" };
+	const entry = yield* resolve$2(target, cache, options.from);
+	if (entry === void 0) return { _tag: "not-installed" };
+	const key = yield* digest(target, cache, options.from).pipe(Effect.mapError((cause) => failure$1(target, "plugin-marker-invalid", `cannot address ${target.spec}`, cause)));
+	const base = root(cache);
+	const record = (yield* read(base)).get(key);
+	const now = yield* Effect.clockWith((clock) => clock.currentTimeMillis);
+	if (options.refresh !== true && record?.checkedAt !== void 0 && now - record.checkedAt < CHECK_TTL && (record.outdated !== true || record.available !== void 0)) return record.outdated === true ? {
+		_tag: "outdated",
+		available: record.available,
+		...entry.revision === void 0 ? {} : { filed: entry.revision }
+	} : {
+		_tag: "current",
+		...entry.revision === void 0 ? {} : { revision: entry.revision }
+	};
+	const available = yield* options.probe(target);
+	if (available === void 0) return {
+		_tag: "current",
+		...entry.revision === void 0 ? {} : { revision: entry.revision }
+	};
+	const outdated = available !== entry.revision;
+	yield* patch(base, key, {
+		checkedAt: now,
+		outdated,
+		available
+	});
+	return outdated ? {
+		_tag: "outdated",
+		available,
+		...entry.revision === void 0 ? {} : { filed: entry.revision }
+	} : {
+		_tag: "current",
+		...entry.revision === void 0 ? {} : { revision: entry.revision }
+	};
+});
 /**
-* Bridge the existing `sandbox/Shell` into a `ToolShell`. Used for just-bash
-* (in-process) and remote providers.
+* Refresh a mutable target, if the network says there is anything to refresh.
 *
-* `cwd` and `env` both pass through to the backing `sandbox/Shell`, which
-* resolves a relative `cwd` against its mount. The buffered `exec`
-* timeout is enforced here with `Effect.timeoutOption` (interruption always
-* returns control; the underlying command is only truly killed mid-flight on
-* signal-aware backends, handled in the provider layer). When the backend exposes
-* `stream` (e.g. Vercel `Command.logs`), it is bridged to {@link IToolShell.stream}
-* so the bash tool streams over it too.
+* `add` with `refresh` is what does the work; this is the guard in front of it, so an `update`
+* that finds nothing new neither stages nor publishes.
 */
-const fromSandboxShell = Layer.effect(ToolShell, Effect.gen(function* () {
-	const shell = yield* shell_exports.Shell;
-	const exec = (command, options) => {
-		const run = shell.exec(command, {
-			...options?.env ? { env: options.env } : {},
-			...options?.cwd ? { cwd: options.cwd } : {}
-		}).pipe(Effect.mapError((cause) => new ToolShellError({
-			command,
-			cause
-		})));
-		if (options?.timeout === void 0) return widenExecError(run);
-		const timeout = options.timeout;
-		return run.pipe(Effect.timeoutOption(timeout), Effect.flatMap(Option.match({
-			onNone: () => Effect.fail(new ToolShellTimeout({
-				command,
-				timeoutMillis: Duration.toMillis(timeout)
-			})),
-			onSome: Effect.succeed
-		})));
+const update = Effect.fn("PluginStore.update")(function* (target, cache, options) {
+	const current = yield* resolve$2(target, cache, options.from);
+	if (current === void 0) return { _tag: "not-installed" };
+	if ((yield* check(target, cache, {
+		refresh: true,
+		probe: options.probe,
+		from: options.from
+	}))._tag !== "outdated") return {
+		_tag: "unchanged",
+		entry: current
 	};
-	const sandboxStream = shell.stream;
-	const stream = sandboxStream ? (command, options) => sandboxStream(command, {
-		...options?.env ? { env: options.env } : {},
-		...options?.cwd ? { cwd: options.cwd } : {}
-	}).pipe(Stream.map((chunk) => chunk._tag === "exit" ? {
-		_tag: "Exit",
-		exitCode: chunk.exitCode
+	const added = yield* add(target, cache, {
+		refresh: true,
+		validate: options.validate,
+		from: options.from,
+		...options.runner === void 0 ? {} : { runner: options.runner }
+	});
+	return added.entry.generation === current.generation ? {
+		_tag: "unchanged",
+		entry: current
 	} : {
-		_tag: "Output",
-		bytes: chunk.bytes
-	}), Stream.mapError((cause) => new ToolShellError({
-		command,
-		cause
-	}))) : void 0;
-	return ToolShell.of(stream ? {
-		exec,
-		stream
-	} : { exec });
-}));
-Duration.seconds(1);
-//#endregion
-//#region src/tool/tool.ts
-var tool_exports = /* @__PURE__ */ __exportAll({});
-import * as import__codeworksh_plugin_tool from "@codeworksh/plugin/tool";
-__reExport(tool_exports, import__codeworksh_plugin_tool);
-//#endregion
-//#region src/plugin/builtin/tool/bash.ts
+		_tag: "updated",
+		entry: added.entry,
+		...added.validated === void 0 ? {} : { validated: added.validated }
+	};
+});
+Effect.fn("PluginStore.remove")(function* (target, cache, from) {
+	const { key, directory } = yield* entryDir(target, cache, from);
+	const existed = yield* fileSystem.exists(directory).pipe(Effect.orElseSucceed(() => false));
+	yield* fileSystem.remove(directory, {
+		recursive: true,
+		force: true
+	}).pipe(Effect.ignore);
+	yield* drop(root(cache), key);
+	return existed;
+});
+Effect.fn("PluginStore.all")(function* (cache) {
+	const base = root(cache);
+	const slugs = yield* fileSystem.readDirectory(base).pipe(Effect.orElseSucceed(() => []));
+	const found = [];
+	for (const slug of slugs) {
+		const digests = yield* fileSystem.readDirectory(hostPath.join(base, slug)).pipe(Effect.orElseSucceed(() => []));
+		for (const key of digests) {
+			const entry = yield* active(hostPath.join(base, slug, key), key);
+			if (entry !== void 0) found.push(entry);
+		}
+	}
+	return found;
+});
+const Id = Schema.String.check(Schema.isPattern(/^[a-z0-9][a-z0-9-]*(\.[a-z0-9][a-z0-9-]*){2}$/));
+const Definition = Schema.Struct({
+	id: Id,
+	kind: Schema.Literals(Object.keys(plugin_exports$1.domains)),
+	events: Schema.optional(Schema.Array(Schema.declare((value) => Predicate.hasProperty(value, "type") && Predicate.isString(value.type)))),
+	setup: Schema.declare((value) => Predicate.isFunction(value))
+});
+/** Every plugin failure says which file to go and edit, when there is one. */
+const where = (origin) => origin.file === void 0 ? {} : { file: origin.file };
+const detail = (cause) => cause instanceof Error ? cause.message : typeof cause === "string" ? cause : String(cause);
+/** A reference that does not name anything loadable. */
+const sourceFailure = (origin, cause) => Schema.is(SourceError)(cause) ? cause : new SourceError({
+	reason: "plugin-not-found",
+	reference: origin.reference,
+	...where(origin),
+	message: detail(cause)
+});
+/** Node's own code for a failure, when it set one. */
+const codeOf = (cause) => Predicate.hasProperty(cause, "code") && Predicate.isString(cause.code) ? cause.code : void 0;
 /**
-* The self-contained bash plugin — a worked example for tool plugins. The definition is pure data;
-* the handler depends only on {@link ToolShell} / {@link ToolProgress}, never
-* `sandbox/Shell`, so the backend (local OS / just-bash / remote provider) is
-* swapped by changing the provided Layer with no change to the tool.
+* A module that would not import.
 *
-* Two execution paths, picked by capability:
-*   - **variant A (buffered)** otherwise: `ToolShell.exec` returns the full output,
-*     truncated once after completion.
-*   - **variant B (streaming)** when the backend offers `ToolShell.stream`: output
-*     flows through an {@link Accumulator} (bounded memory + temp-file spill)
-*     and is reported live via {@link ToolProgress}; on timeout the partial output
-*     produced so far is preserved.
+* Two of these get their own reason, because the remedy differs and that is the whole value of a
+* slug. A missing dependency means the plugin is fine and its `node_modules` is not, which a
+* person fixes in the package rather than in their settings. An uncompiled one means the plugin
+* shipped its sources: Node refuses to strip types under `node_modules`, and installing a plugin
+* runs no lifecycle scripts, so a `prepare` build never happens either -- the author has to ship
+* the build output, and nothing the user can do to their settings will help.
 *
-* Success and failure carry the *same* structured shape
-* (`output`, `exitCode`, `truncated`, `fullOutputPath`)
-* — a non-zero exit is just `exitCode !== 0`, not a different kind of result.
+* `ERR_UNSUPPORTED_NODE_MODULES_TYPE_STRIPPING` is matched by code rather than by message: it is
+* Node's documented identifier and exact, where the wording is free to change under us. Only an
+* installed plugin can reach it -- a local path lives outside `node_modules`, where Node strips
+* types happily, which is what keeps the single-file dev workflow working.
 */
-const BashParams = Schema.Struct({
-	command: Schema.String.annotate({ description: "The bash command to execute." }),
-	timeout: Schema.optional(Schema.Finite.check(Schema.isGreaterThan(0)).annotate({ description: "Optional timeout in seconds (must be greater than 0)." }))
+const importFailure = (origin, cause) => new LoadError({
+	reason: codeOf(cause) === "ERR_UNSUPPORTED_NODE_MODULES_TYPE_STRIPPING" ? "plugin-not-compiled" : /cannot find (package|module)/i.test(detail(cause)) ? "plugin-missing-dependency" : "plugin-import-failed",
+	reference: origin.reference,
+	...where(origin),
+	message: detail(cause),
+	cause
 });
-const outputFields = {
-	/** Combined stdout + stderr, truncated for display (full output is on disk when `truncated`). */
-	output: Schema.String,
-	truncated: Schema.Boolean,
-	fullOutputPath: Schema.optional(Schema.String)
-};
-const BashSuccess = Schema.Struct({
-	...outputFields,
-	exitCode: Schema.Finite
+/** A module that imported and is not a plugin. */
+const definitionFailure = (origin, cause, id) => new LoadError({
+	reason: "plugin-invalid-definition",
+	reference: origin.reference,
+	...where(origin),
+	message: detail(cause),
+	...id === void 0 ? {} : { id },
+	cause
 });
-/** Non-zero exit — expected, model-visible. Carries the same shape as success. */
-var BashFailed = class extends Schema.TaggedError()("BashFailed", {
-	...outputFields,
-	exitCode: Schema.Finite
-}) {};
-/** Deadline exceeded — expected, model-visible. Carries the partial output produced so far. */
-var BashTimedOut = class extends Schema.TaggedError()("BashTimedOut", {
-	...outputFields,
-	timeoutSeconds: Schema.Finite
-}) {};
-const BashFailure = Schema.Union([BashFailed, BashTimedOut]);
-const bashDef = tool_exports.define({
-	name: "bash",
-	label: "bash",
-	promptSnippet: "Execute bash commands (ls, grep, find, etc.).",
-	description: `Execute a bash command in the working directory and return its combined stdout/stderr output. Output is truncated to the last ${DEFAULT_MAX_LINES} lines or ${DEFAULT_MAX_BYTES}KB (whichever is hit first); when truncated, the full output is saved to a temp file. A non-zero exit code is reported as an error carrying the captured output.`,
-	parameters: BashParams,
-	success: BashSuccess,
-	failure: BashFailure,
-	encodeContent: (success) => [{
-		type: "text",
-		text: success.output
-	}],
-	encodeFailureContent: (failure) => [{
-		type: "text",
-		text: failure.output
-	}]
+const validate = Effect.fn("PluginLoader.validate")(function* (input, origin, builtin = false) {
+	yield* Schema.decodeUnknownEffect(Definition)(input).pipe(Effect.mapError((cause) => definitionFailure(origin, cause)));
+	const plugin = input;
+	if (!builtin && plugin.id.startsWith("codework.")) return yield* definitionFailure(origin, /* @__PURE__ */ new Error("codework namespace is reserved for builtins"), plugin.id);
+	return plugin;
 });
-/** Combine stdout and stderr into one stream of text, stderr after stdout. */
-const combineOutput = (stdout, stderr) => {
-	if (stderr.length === 0) return stdout;
-	if (stdout.length === 0) return stderr;
-	return `${stdout}\n${stderr}`;
-};
-/** One-line footer appended to truncated, model-facing output. */
-const footer = (t, fullOutputPath, lastLineBytes) => {
-	const where = fullOutputPath ? ` Full output: ${fullOutputPath}` : "";
-	const startLine = t.totalLines - t.outputLines + 1;
-	if (t.lastLinePartial) {
-		const lineSize = lastLineBytes !== void 0 ? ` (line is ${formatSize(lastLineBytes)})` : "";
-		return `\n\n[showing last ${formatSize(t.outputBytes)} of line ${t.totalLines}${lineSize}.${where}]`;
+const Manifest = Schema.Struct({
+	name: Schema.optional(Schema.String),
+	exports: Schema.optional(Schema.Unknown)
+});
+const localUrl = Effect.fn("PluginLoader.localUrl")(function* (location, origin) {
+	const escapes = (message) => new SourceError({
+		reason: "plugin-escapes-root",
+		reference: origin.reference,
+		...where(origin),
+		message
+	});
+	if ((yield* fileSystem.stat(location)).type !== "Directory") return { url: yield* Effect.try(() => resolveModule(location, hostPath.dirname(location))) };
+	const manifestPath = hostPath.join(location, "package.json");
+	if (!(yield* fileSystem.exists(manifestPath))) return { url: yield* Effect.try(() => resolveModule("./index", location)) };
+	const manifest = yield* fileSystem.readFileString(manifestPath).pipe(Effect.flatMap(Schema.decodeUnknownEffect(Schema.fromJsonString(Manifest))));
+	if (manifest.exports !== void 0) {
+		const name = manifest.name;
+		if (!name) return yield* escapes("a local package with exports must declare its name");
+		const url = yield* Effect.try(() => resolveModule(name, location));
+		const resolved = yield* fileSystem.realPath(fileURLToPath(url));
+		if (hostPath.relative(yield* fileSystem.realPath(location), resolved).startsWith("..")) return yield* escapes("package export escapes its root");
+		return {
+			url: pathToFileURL(resolved).href,
+			name
+		};
 	}
-	if (t.truncatedBy === "lines") return `\n\n[showing lines ${startLine}-${t.totalLines} of ${t.totalLines}.${where}]`;
-	return `\n\n[showing lines ${startLine}-${t.totalLines} of ${t.totalLines} (${formatSize(t.maxBytes)} limit).${where}]`;
-};
-/** Write full output to a host temp file (best-effort; undefined on failure). */
-const spillToTempFile = (content) => Effect.gen(function* () {
-	const suffix = Encoding.encodeHex(yield* crypto.randomBytes(6));
-	const path = posix.join(tmpdir(), `codework-bash-${suffix}.log`);
-	yield* fileSystem.writeFileString(path, content);
-	return path;
-}).pipe(Effect.orElseSucceed(() => void 0));
-/** Variant A: truncate the buffered output once, spilling the full output if truncated. */
-const presentBuffered = (combined) => Effect.gen(function* () {
-	const t = truncateTail(combined);
-	if (!t.truncated) return {
-		output: t.content,
-		truncated: false
+	const url = yield* Effect.try(() => resolveModule(createRequire(pathToFileURL(manifestPath)).resolve(location), location));
+	return manifest.name === void 0 ? { url } : {
+		url,
+		name: manifest.name
+	};
+});
+/**
+* Install a package into the store, importing and validating it **while it is still staged**.
+*
+* The validation is passed down rather than done afterwards for one reason: the store publishes by
+* rename, so a package that turns out not to be a plugin must be rejected before it is published.
+* Publishing first would make the broken generation the newest marked one, which `resolve` returns
+* forever after -- and re-running `add` would hit the fast path and return it again.
+*/
+const install = Effect.fn("PluginLoader.install")(function* (target, cache, origin, options) {
+	const added = yield* add(target, cache, {
+		from: anchor$1(origin.file, options.hostDir),
+		validate: (fetched) => imported(url(fetched.entrypoint), origin, options.import)
+	});
+	return {
+		url: added.entry.url,
+		...added.entry.version === void 0 ? {} : { version: added.entry.version },
+		generation: added.entry.generation,
+		...added.validated === void 0 ? {} : { plugin: added.validated }
+	};
+});
+/**
+* The directory whose `.npmrc` chain names the artifact a reference resolves to: the project that
+* declared it. A settings file sits in `<root>/.codework/`, but npm reads a project `.npmrc` at the
+* package boundary discovered upward from the chain's start -- the root itself -- so anchoring at
+* the file's own directory would miss it. Absent a declaring file the host context stands in.
+*/
+const anchor$1 = (file, fallback) => {
+	if (file === void 0) return fallback;
+	const directory = hostPath.dirname(file);
+	return hostPath.basename(directory) === ".codework" ? hostPath.dirname(directory) : directory;
+};
+/** The default installer, or the one the caller injected. */
+const installer = (target, origin, options) => options.install === void 0 ? install(target, options.cache, origin, options) : options.install(target, options.cache, anchor$1(origin.file, options.hostDir));
+/** Import a module and confirm it default-exports a plugin. */
+const imported = Effect.fn("PluginLoader.imported")(function* (url, origin, load) {
+	const module = yield* Effect.tryPromise({
+		try: () => (load ?? importModule)(url),
+		catch: (cause) => importFailure(origin, cause)
+	});
+	return yield* validate(Predicate.isObject(module) && "default" in module ? module.default : void 0, origin);
+});
+/**
+* Import one entrypoint and confirm it is a plugin, without touching the store.
+*
+* This is what a caller hands the store as its `validate`: the artifact is checked while it is
+* still staged, so a package that turns out not to be a plugin is never published.
+*/
+const definition$1 = (entrypoint, reference) => imported(url(entrypoint), {
+	index: 0,
+	reference
+});
+/**
+* Install and import one reference, and report what it turned out to be, without selecting it.
+* `codework plugin add` uses this to prove a package really is a plugin before it writes the
+* reference into a settings file: the failure a user gets is the one they can act on — a bad
+* spec, an install that did not resolve, a module that exports no plugin — rather than a broken
+* configuration that only fails at the next run.
+*/
+const inspect = Effect.fn("PluginLoader.inspect")(function* (reference, options) {
+	const origin = {
+		index: 0,
+		reference,
+		file: options.file
 	};
-	const fullOutputPath = yield* spillToTempFile(combined);
+	const target = yield* parse$2(reference, options.hostDir);
+	const loaded = yield* load$3(target, origin, options);
 	return {
-		output: t.content + footer(t, fullOutputPath),
-		truncated: true,
-		...fullOutputPath !== void 0 ? { fullOutputPath } : {}
+		id: loaded.plugin.id,
+		...loaded.version === void 0 ? {} : { version: loaded.version },
+		...loaded.name === void 0 ? {} : { name: loaded.name }
 	};
 });
-/** Variant B: present an accumulator snapshot (the temp file is spilled incrementally). */
-const presentSnapshot = (snap, lastLineBytes) => {
-	if (!snap.truncation.truncated) return {
-		output: snap.content,
-		truncated: false
-	};
+const load$3 = Effect.fn("PluginLoader.load")(function* (target, origin, options) {
+	const installed = yield* target.kind === "local" ? localUrl(target.path, origin).pipe(Effect.mapError((cause) => sourceFailure(origin, cause))) : installer(target, origin, options).pipe(Effect.mapError((cause) => origin.file === void 0 ? cause : declaredIn(cause, origin.file)));
+	const address = target.kind === "local" && options.reload !== void 0 && options.reload > 0 ? `${installed.url}?reload=${options.reload}` : installed.url;
 	return {
-		output: snap.content + footer(snap.truncation, snap.fullOutputPath, lastLineBytes),
-		truncated: true,
-		...snap.fullOutputPath !== void 0 ? { fullOutputPath: snap.fullOutputPath } : {}
+		plugin: installed.plugin ?? (yield* imported(address, origin, options.import)),
+		source: origin.reference,
+		..."version" in installed && installed.version !== void 0 ? { version: installed.version } : {},
+		..."generation" in installed && installed.generation !== void 0 ? { generation: installed.generation } : {},
+		...installed.name === void 0 ? {} : { name: installed.name }
 	};
-};
-/** Variant A — buffered: one `exec`, truncate after completion. No live progress. */
-const runBuffered = (shell, params) => Effect.gen(function* () {
-	const result = yield* shell.exec(params.command, params.timeout !== void 0 ? { timeout: Duration.seconds(params.timeout) } : void 0).pipe(Effect.catchTags({
-		ToolShellTimeout: (timeout) => Effect.fail(new BashTimedOut({
-			timeoutSeconds: timeout.timeoutMillis / 1e3,
-			output: "",
-			truncated: false
-		})),
-		ToolShellError: (cause) => Effect.die(cause)
-	}));
-	const present = yield* presentBuffered(combineOutput(result.stdout, result.stderr));
-	if (result.exitCode !== 0) return yield* new BashFailed({
-		exitCode: result.exitCode,
-		...present
-	});
+});
+/**
+* The version-free, location-anchored spelling of a reference.
+*
+* Two references naming the same module compare equal through it: `@acme/x@1.2.0` and `@acme/x`
+* are one package, and `./plugins/x.ts` is the file it resolves to from the directory that
+* declared it. Pure -- nothing is installed, imported or read.
+*/
+const canonical = (reference, hostDir) => Effect.map(parse$2(reference, hostDir), canonical$1);
+//#endregion
+//#region src/plugin/catalog.ts
+/**
+* A definition carries `setup`; a patch carries `plugin` or `package` and no `setup`. Checking
+* `setup` first matters because `Plugin` permits extra properties, so a definition holding its
+* own `plugin` property must not be read as configuration.
+*
+* e.g
+* "acme/tool@1.2.0"                    → module (load me)
+* define({id, kind, setup, ...})       → module (I AM the definition — embedder code only)
+* { plugin: "x", enabled: false }      → config (don't load — adjust something already loaded)
+*
+* setup present → definition, always (even with a stray plugin: key)
+* setup absent + plugin:/package: present → config patch
+* setup absent + neither key → malformed
+*/
+const isPatch = (reference) => Predicate.isObject(reference) && !Predicate.isFunction(reference) && !("setup" in reference) && ("plugin" in reference || "package" in reference);
+/**
+* The **load pass**: store lookup and ESM import, never the network.
+*
+* Runs at boot, at `reload`, and at any exchange that finds a reference it cannot satisfy. It
+* deliberately knows nothing about `enabled`, options or order -- those are data over modules that
+* are already loaded, they cost a walk of a short array, and they belong to every exchange.
+*
+* Loading is keyed by what a reference resolves to, so naming one module twice imports it once.
+*/
+const load$2 = Effect.fn("PluginCatalog.load")(function* (references, options) {
+	const plugins = /* @__PURE__ */ new Map();
+	const aliases = /* @__PURE__ */ new Map();
+	const versions = /* @__PURE__ */ new Map();
+	const origins = /* @__PURE__ */ new Map();
+	const seen = /* @__PURE__ */ new Map();
+	const remember = (plugin, names, from) => {
+		plugins.set(plugin.id, plugin);
+		aliases.set(plugin.id, plugin.id);
+		for (const name of names) aliases.set(name, plugin.id);
+		if (from?.version !== void 0) versions.set(plugin.id, from.version);
+		if (from !== void 0) origins.set(plugin.id, from.origin);
+	};
+	/** Source metadata exists for diagnostics; a silent ID replacement is where it earns that. */
+	const note = (plugin, source) => plugins.has(plugin.id) ? Effect.logDebug(`plugin ${plugin.id} redefined by ${source}; the earlier definition is discarded`) : Effect.void;
+	for (const builtin of options.builtins) remember(yield* validate(builtin, {
+		index: -1,
+		reference: builtin.id
+	}, true), []);
+	for (const [index, reference] of references.entries()) {
+		if (isPatch(reference)) continue;
+		const declared = typeof reference === "string" ? reference : Predicate.hasProperty(reference, "id") ? reference.id : void 0;
+		const named = typeof declared === "string" ? declared : `<plugin object #${index}>`;
+		const origin = {
+			index,
+			reference: named,
+			file: options.declared?.get(named)
+		};
+		if (typeof reference !== "string") {
+			if (typeof declared === "string" && plugins.get(declared) === reference) continue;
+			const plugin = yield* validate(reference, origin);
+			yield* note(plugin, "a supplied object");
+			remember(plugin, []);
+			continue;
+		}
+		const target = yield* parse$2(reference, options.hostDir);
+		const key = target.kind === "local" ? target.path : target.spec;
+		const already = seen.get(key);
+		if (already !== void 0) {
+			aliases.set(reference, already);
+			continue;
+		}
+		const definition = yield* load$3(target, origin, options);
+		yield* note(definition.plugin, definition.version === void 0 ? key : `${key}@${definition.version}`);
+		const names = target.kind === "local" ? [target.path, ...definition.name === void 0 ? [] : [definition.name]] : [canonical$1(target), target.spec];
+		remember(definition.plugin, [reference, ...names], {
+			...definition.version === void 0 ? {} : { version: definition.version },
+			origin: {
+				reference,
+				...definition.generation === void 0 ? {} : { generation: definition.generation },
+				...origin.file === void 0 ? {} : { file: origin.file }
+			}
+		});
+		seen.set(key, definition.plugin.id);
+	}
 	return {
-		exitCode: result.exitCode,
-		...present
+		plugins,
+		aliases,
+		versions,
+		origins
 	};
 });
-/** Variant B — streaming: accumulate output, report progress, keep partial output on timeout. */
-const runStreaming = (stream, params) => Effect.scoped(Effect.gen(function* () {
-	const acc = new Accumulator({ tempFilePrefix: "codework-bash" });
-	const progress = yield* progress_exports.ToolProgress;
-	const exitCode = yield* Ref.make(null);
-	const consume = stream(params.command).pipe(Stream.runForEach((event) => event._tag === "Exit" ? Ref.set(exitCode, event.exitCode) : Effect.gen(function* () {
-		yield* acc.append(Buffer.from(event.bytes));
-		yield* progress.report({ content: [{
-			type: "text",
-			text: acc.snapshot().content
-		}] });
-	})), Effect.catchTag("ToolShellError", (cause) => Effect.die(cause)));
-	let timedOutAfter;
-	if (params.timeout !== void 0) {
-		const finished = yield* consume.pipe(Effect.timeoutOption(Duration.seconds(params.timeout)));
-		if (Option.isNone(finished)) timedOutAfter = params.timeout;
-	} else yield* consume;
-	yield* acc.finish();
-	const present = presentSnapshot(acc.snapshot(), acc.getLastLineBytes());
-	if (timedOutAfter !== void 0) return yield* new BashTimedOut({
-		timeoutSeconds: timedOutAfter,
-		...present
-	});
-	const code = yield* Ref.get(exitCode);
-	if (code === null || code !== 0) return yield* new BashFailed({
-		exitCode: code ?? -1,
-		...present
+/**
+* The **config pass**: pure data over modules that are already loaded, run at every exchange.
+*
+* An array entry is a **module** — a definition object, a path, a `file:` URL, or a package
+* spec. It takes the position it is written at, so naming a module again moves it.
+*
+* An object entry is **configuration** for a plugin an earlier entry (or the built-in list)
+* already selected, addressed by its ID (`plugin`) or the module string (`package`) that selected
+* it. It never loads, installs or reorders anything, and a name matching nothing in the selection
+* is ignored rather than failing the boot — a typo costs a debug line, never a fetch.
+*
+* Nothing here touches the disk, which is the whole point of the split: an `options` edit, an
+* `enabled` flip or a reordering applies at the next exchange without importing anything.
+*/
+const select = Effect.fn("PluginCatalog.select")(function* (references, pool) {
+	const operations = /* @__PURE__ */ new Map();
+	const missing = [];
+	const choose = (id, index) => operations.set(id, {
+		enabled: true,
+		index,
+		options: operations.get(id)?.options ?? {}
 	});
+	for (const [index, reference] of references.entries()) {
+		if (isPatch(reference)) {
+			const named = reference.plugin ?? reference.package;
+			const origin = {
+				index,
+				reference: typeof named === "string" ? named : `<plugin entry #${index}>`
+			};
+			const invalid = reference.plugin !== void 0 && reference.package !== void 0 ? "names both `plugin` and `package`" : typeof named !== "string" || named.length === 0 ? "names neither `plugin` nor `package`" : reference.enabled !== void 0 && typeof reference.enabled !== "boolean" ? "`enabled` is not a boolean" : reference.options !== void 0 && !isRecord$1(reference.options) ? "`options` is not a plain object" : void 0;
+			if (invalid !== void 0) return yield* definitionFailure(origin, /* @__PURE__ */ new Error(`plugin entry ${invalid}`));
+			const id = reference.plugin === void 0 ? pool.aliases.get(reference.package) : reference.plugin;
+			const operation = id === void 0 ? void 0 : operations.get(id);
+			if (id === void 0 || operation === void 0) {
+				yield* Effect.logDebug(`plugin configuration ignored: nothing selected under ${named}`);
+				continue;
+			}
+			operations.set(id, {
+				enabled: reference.enabled ?? operation.enabled,
+				index: operation.index,
+				options: reference.options ?? operation.options
+			});
+			continue;
+		}
+		if (typeof reference !== "string") {
+			const declared = Predicate.hasProperty(reference, "id") ? reference.id : void 0;
+			if (typeof declared === "string" && pool.plugins.has(declared)) choose(declared, index);
+			continue;
+		}
+		const id = pool.aliases.get(reference);
+		if (id === void 0) missing.push(reference);
+		else choose(id, index);
+	}
+	const selection = [];
+	for (const [id, operation] of operations) {
+		if (!operation.enabled) continue;
+		const plugin = pool.plugins.get(id);
+		if (plugin !== void 0) selection.push({
+			plugin,
+			options: Object.freeze(operation.options),
+			index: operation.index
+		});
+	}
+	selection.sort((a, b) => (0, plugin_exports$1.rank)(a.plugin.kind) - (0, plugin_exports$1.rank)(b.plugin.kind) || a.index - b.index);
 	return {
-		exitCode: code,
-		...present
+		selection: Object.freeze(selection.map(({ plugin, options }) => ({
+			plugin,
+			options
+		}))),
+		missing
 	};
-}));
-const bashHandler = (params) => Effect.gen(function* () {
-	const shell = yield* ToolShell;
-	return shell.stream !== void 0 ? yield* runStreaming(shell.stream, params) : yield* runBuffered(shell, params);
 });
-/** The bash tool: definition + handler, wired the testable (def/exec split) way. */
-const bashTool = tool_exports.implement(bashDef, bashHandler);
-const bashPlugin = (0, plugin_exports$1.define)({
-	id: "codework.tool.bash",
-	kind: "tool",
-	setup: Effect.fn("BashPlugin.setup")(function* (ctx) {
-		const shell = yield* io_exports.SandboxIO.Shell;
-		const mounted = fromSandboxShell.pipe(Layer.provide(Layer.succeed(io_exports.SandboxIO.Shell, shell)));
-		ctx.plugin.tools.add(tool_exports.provide(bashTool, mounted));
-	})
-});
-//#endregion
-//#region src/plugin/builtin.ts
 /**
-* Every plugin the harness ships, and the selection a caller who passes no `plugins` gets. Tool
-* contributors come first so the Prompt plugin that indexes them runs after they registered.
+* The exchange-boundary check: has the store moved under this pool?
+*
+* Every exchange already re-reads every settings layer from disk, and the config pass already
+* walks those entries against the loaded set. Two things can be settled right there, and they are
+* the same question asked twice:
+*
+* 1. a settings entry names a module that is not loaded, and the store holds it;
+* 2. a loaded module is not the newest generation the store has.
+*
+* The second is what makes `plugin update` finish. Without it the question is "is this entry
+* loaded?", the answer after an update is still yes, and the bytes just fetched sit on disk until
+* something else forces an import.
+*
+* Returns the new pool, or nothing when nothing moved -- which is the common case, and costs one
+* store lookup per filed module.
+*
+* **This is not a watcher.** Nothing polls and no fiber exists; it is the observation that we were
+* already paying for the I/O that would tell us, and discarding the answer. Three bounds keep it
+* safe: the store only and never the network, so an exchange cannot block on a registry;
+* resolve-only, so it cannot install; and once, at the top of a snapshot, so an exchange already
+* running is unaffected.
 */
-const builtins = Object.freeze([bashPlugin, defaultPromptPlugin]);
+const follow = Effect.fn("PluginCatalog.follow")(function* (references, pool, options, filed) {
+	let moved = false;
+	for (const reference of references) {
+		if (typeof reference !== "string" || pool.aliases.has(reference)) continue;
+		if (Option.isSome(yield* filed(reference, anchor$1(options.declared?.get(reference), options.hostDir)))) {
+			moved = true;
+			break;
+		}
+	}
+	if (!moved) for (const origin of pool.origins.values()) {
+		if (origin.generation === void 0) continue;
+		const current = yield* filed(origin.reference, anchor$1(origin.file, options.hostDir));
+		if (Option.isSome(current) && current.value.generation !== void 0 && current.value.generation > origin.generation) {
+			moved = true;
+			break;
+		}
+	}
+	if (!moved) return Option.none();
+	const retained = [];
+	for (const origin of pool.origins.values()) {
+		if (references.includes(origin.reference) || Option.isSome(yield* filed(origin.reference, anchor$1(origin.file, options.hostDir)))) {
+			retained.push(origin);
+			continue;
+		}
+		yield* Effect.logWarning(`plugin ${origin.reference} no longer resolves; it is dropped from the loaded set`);
+	}
+	const accumulated = [...Array.from(retained, (origin) => origin.reference), ...references];
+	const known = /* @__PURE__ */ new Map();
+	for (const origin of retained) if (origin.file !== void 0) known.set(origin.reference, origin.file);
+	for (const [reference, file] of options.declared ?? /* @__PURE__ */ new Map()) known.set(reference, file);
+	return Option.some(yield* load$2(accumulated, {
+		...options,
+		declared: known
+	}));
+});
+Effect.fn("PluginCatalog.prepare")(function* (references, options) {
+	const pool = yield* load$2(references, options);
+	return (yield* select(references, pool)).selection;
+});
 //#endregion
 //#region src/runner/coordinator.ts
 const make$7 = (options) => Effect.gen(function* () {
@@ -7104,6 +7228,82 @@ const layer$7 = Layer.effect(Service$6, Effect.gen(function* () {
 	});
 }));
 //#endregion
+//#region src/settings/schema.ts
+var schema_exports$3 = /* @__PURE__ */ __exportAll({});
+import * as import__codeworksh_plugin_settings from "@codeworksh/plugin/settings";
+__reExport(schema_exports$3, import__codeworksh_plugin_settings);
+//#endregion
+//#region src/settings/resolve.ts
+const patternMatches = (pattern, id) => new RegExp(`^${pattern.split("*").map((part) => part.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join(".*")}$`).test(id);
+function collect(settings, provider, id) {
+	const config = settings.model;
+	const blocks = config.providerOptions?.[provider] ?? {};
+	const patterns = Object.keys(blocks).filter((key) => key !== "*" && key !== id && key.includes("*") && patternMatches(key, id)).sort((a, b) => a.indexOf("*") - b.indexOf("*"));
+	return merge({
+		thinkingLevel: config.thinkingLevel,
+		toolExecution: config.toolExecution,
+		...config.thinkingBudgets === void 0 ? {} : { thinkingBudgets: config.thinkingBudgets }
+	}, config.options, blocks["*"], ...patterns.map((key) => blocks[key]), blocks[id]);
+}
+/**
+* Corrections to the catalog entry itself, applied before lookup.
+*
+* `protocol` is here rather than in the request bag because it is model shape: it decides which
+* wire protocol aikit speaks, and through `Model.optionsKey` which namespace the provider bag is
+* keyed by. A catalog cannot know it for a local OpenAI-compatible server, and the person
+* pointing at one does.
+*/
+const resolveOverrides = (block) => ({
+	...block.contextWindow === void 0 ? {} : { contextWindow: block.contextWindow },
+	...block.protocol === void 0 ? {} : { protocol: block.protocol }
+});
+/** Protocol-independent request attributes can already be captured by State. */
+function resolveOptions(block) {
+	return {
+		...Object.fromEntries(Object.entries(block).filter(([key]) => Object.hasOwn(schema_exports$3.requestFields, key))),
+		...block.extras === void 0 ? {} : { factoryOptions: merge({}, block.extras) }
+	};
+}
+/** The bag key becomes knowable only after lookup at the LLM boundary. */
+function resolveRequest(block, model) {
+	const bag = Object.fromEntries(Object.entries(block).filter(([key]) => !Object.hasOwn(schema_exports$3.requestFields, key) && ![
+		"thinkingLevel",
+		"toolExecution",
+		"contextWindow",
+		"protocol",
+		"extras"
+	].includes(key)));
+	return {
+		...resolveOptions(block),
+		...Object.keys(bag).length === 0 ? {} : { providerOptions: { [Model$1.optionsKey(model)]: bag } }
+	};
+}
+/**
+* Harness-owned controls, which never reach a provider.
+*
+* Separate from {@link resolveRequest} because these steer the loop itself -- how hard to
+* think, how to schedule tool calls -- rather than the request body. Runtime bindings
+* outrank a matched block, which outranks the file's top level.
+*/
+const resolveControls = (settings, block, runtime) => ({
+	thinkingLevel: runtime.thinkingLevel ?? block.thinkingLevel ?? settings.model.thinkingLevel,
+	toolExecution: runtime.toolExecution ?? block.toolExecution ?? settings.model.toolExecution
+});
+/** Pure configuration composition. Domain selections need not exist in the catalog. */
+function compose(settings, options = {}, session = {}) {
+	const runtime = merge(options, session);
+	const provider = runtime.provider ?? settings.model.provider;
+	const model = runtime.model ?? settings.model.id;
+	const block = collect(settings, provider, model);
+	return {
+		provider,
+		model,
+		...resolveControls(settings, block, runtime),
+		block,
+		runtime
+	};
+}
+//#endregion
 //#region src/runner/event.ts
 const make$6 = Effect.fn("LLMEventPublisher.make")(function* (input) {
 	const events = yield* Service$16;
@@ -7253,82 +7453,6 @@ const make$6 = Effect.fn("LLMEventPublisher.make")(function* (input) {
 	};
 });
 //#endregion
-//#region src/settings/schema.ts
-var schema_exports$3 = /* @__PURE__ */ __exportAll({});
-import * as import__codeworksh_plugin_settings from "@codeworksh/plugin/settings";
-__reExport(schema_exports$3, import__codeworksh_plugin_settings);
-//#endregion
-//#region src/settings/resolve.ts
-const patternMatches = (pattern, id) => new RegExp(`^${pattern.split("*").map((part) => part.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join(".*")}$`).test(id);
-function collect(settings, provider, id) {
-	const config = settings.model;
-	const blocks = config.providerOptions?.[provider] ?? {};
-	const patterns = Object.keys(blocks).filter((key) => key !== "*" && key !== id && key.includes("*") && patternMatches(key, id)).sort((a, b) => a.indexOf("*") - b.indexOf("*"));
-	return merge({
-		thinkingLevel: config.thinkingLevel,
-		toolExecution: config.toolExecution,
-		...config.thinkingBudgets === void 0 ? {} : { thinkingBudgets: config.thinkingBudgets }
-	}, config.options, blocks["*"], ...patterns.map((key) => blocks[key]), blocks[id]);
-}
-/**
-* Corrections to the catalog entry itself, applied before lookup.
-*
-* `protocol` is here rather than in the request bag because it is model shape: it decides which
-* wire protocol aikit speaks, and through `Model.optionsKey` which namespace the provider bag is
-* keyed by. A catalog cannot know it for a local OpenAI-compatible server, and the person
-* pointing at one does.
-*/
-const resolveOverrides = (block) => ({
-	...block.contextWindow === void 0 ? {} : { contextWindow: block.contextWindow },
-	...block.protocol === void 0 ? {} : { protocol: block.protocol }
-});
-/** Protocol-independent request attributes can already be captured by State. */
-function resolveOptions(block) {
-	return {
-		...Object.fromEntries(Object.entries(block).filter(([key]) => Object.hasOwn(schema_exports$3.requestFields, key))),
-		...block.extras === void 0 ? {} : { factoryOptions: merge({}, block.extras) }
-	};
-}
-/** The bag key becomes knowable only after lookup at the LLM boundary. */
-function resolveRequest(block, model) {
-	const bag = Object.fromEntries(Object.entries(block).filter(([key]) => !Object.hasOwn(schema_exports$3.requestFields, key) && ![
-		"thinkingLevel",
-		"toolExecution",
-		"contextWindow",
-		"protocol",
-		"extras"
-	].includes(key)));
-	return {
-		...resolveOptions(block),
-		...Object.keys(bag).length === 0 ? {} : { providerOptions: { [Model$1.optionsKey(model)]: bag } }
-	};
-}
-/**
-* Harness-owned controls, which never reach a provider.
-*
-* Separate from {@link resolveRequest} because these steer the loop itself -- how hard to
-* think, how to schedule tool calls -- rather than the request body. Runtime bindings
-* outrank a matched block, which outranks the file's top level.
-*/
-const resolveControls = (settings, block, runtime) => ({
-	thinkingLevel: runtime.thinkingLevel ?? block.thinkingLevel ?? settings.model.thinkingLevel,
-	toolExecution: runtime.toolExecution ?? block.toolExecution ?? settings.model.toolExecution
-});
-/** Pure configuration composition. Domain selections need not exist in the catalog. */
-function compose(settings, options = {}, session = {}) {
-	const runtime = merge(options, session);
-	const provider = runtime.provider ?? settings.model.provider;
-	const model = runtime.model ?? settings.model.id;
-	const block = collect(settings, provider, model);
-	return {
-		provider,
-		model,
-		...resolveControls(settings, block, runtime),
-		block,
-		runtime
-	};
-}
-//#endregion
 //#region src/runner/llm.ts
 const runtimeOptions = (input, model, signal) => {
 	const { activeTools, ...options } = merge(resolveRequest(input.settings ?? {}, model), input.options);
@@ -7378,17 +7502,6 @@ const providerError = (input, failure) => {
 	});
 };
 const providerErrorFromUnknown = (input, cause) => providerError(input, AikitFailure.normalize(cause));
-const modelCatalogFailure = (cause) => {
-	if (typeof cause !== "object" || cause === null || !("name" in cause) || cause.name !== "ModelCatalogLoadError") return;
-	if (!("data" in cause) || typeof cause.data !== "object" || cause.data === null) return void 0;
-	const data = cause.data;
-	if (!("path" in data) || typeof data.path !== "string" || !("message" in data) || typeof data.message !== "string" || !("reason" in data) || data.reason !== "missing" && data.reason !== "unreadable" && data.reason !== "empty" && data.reason !== "invalid") return;
-	return {
-		path: data.path,
-		reason: data.reason,
-		message: data.message
-	};
-};
 /** Read structured terminal data while remaining compatible with older Aikit messages. */
 const messageFailure = (message) => {
 	const candidate = message.failure;
@@ -7398,14 +7511,7 @@ const messageFailure = (message) => {
 const resolve$1 = Effect.fn("LLM.resolve")(function* (input) {
 	const model = yield* Effect.tryPromise({
 		try: () => llm(input.provider, input.model, resolveOverrides(input.settings ?? {})),
-		catch: (cause) => {
-			const catalog = modelCatalogFailure(cause);
-			return catalog === void 0 ? providerErrorFromUnknown(input, cause) : new ModelCatalogError({
-				path: catalog.path,
-				reason: catalog.reason,
-				detail: catalog.message
-			});
-		}
+		catch: (cause) => loadError(cause) ?? providerErrorFromUnknown(input, cause)
 	});
 	if (model === void 0) return yield* new ModelNotFoundError({
 		provider: input.provider,
@@ -8086,7 +8192,7 @@ const parse$1 = Effect.fn("Settings.parse")(function* (path, source) {
 		reason: "parse",
 		detail: `${printParseErrorCode(first.error)} at ${at(source, first.offset)}`
 	});
-	const document = normalize$1(json);
+	const document = normalize(json);
 	if (Predicate.isObject(document) && Predicate.isObject(json) && "plugins" in json) Object.assign(document, { plugins: json.plugins });
 	return yield* Schema.decodeUnknownEffect(schema_exports$3.Patch)(document).pipe(Effect.mapError((error) => new SettingsError({
 		path,
@@ -8769,7 +8875,7 @@ const layer$2 = Layer.effectDiscard(Effect.gen(function* () {
 }));
 //#endregion
 //#region src/session/live.ts
-const layer$1 = Layer.provideMerge(layer$2, layer$22);
+const layer$1 = Layer.provideMerge(layer$2, layer$23);
 //#endregion
 //#region src/effect/harness.ts
 var harness_exports = /* @__PURE__ */ __exportAll({
@@ -8834,14 +8940,17 @@ const layer = (options = {}) => Layer.unwrap(Effect.gen(function* () {
 		});
 	});
 	const definitions = yield* flatten([...(yield* Ref.get(pool)).plugins.values()]);
-	const database = layer$25(resolveDatabaseLocation(options.database ?? (yield* locationConfig), paths.data));
+	const database = layer$26(resolveDatabaseLocation(options.database ?? (yield* locationConfig), paths.data));
 	const configured = yield* loadAll(options.sandboxes ?? [], { hostCwd });
-	const drivers = layer$18(driver_exports.SandboxDriver.withSource(make$11().driver, "core"), driver_exports.SandboxDriver.withSource(make$9().driver, "core"), ...configured);
-	const sandboxes = layer$16({ hostCwd }).pipe(Layer.provideMerge(drivers), Layer.provideMerge(database));
+	const drivers = layer$19(driver_exports.SandboxDriver.withSource(make$11().driver, "core"), driver_exports.SandboxDriver.withSource(make$9().driver, "core"), ...configured);
+	const sandboxes = layer$17({ hostCwd }).pipe(Layer.provideMerge(drivers), Layer.provideMerge(database));
 	const authFile$1 = authFile(options.home === void 0 ? void 0 : paths.home);
 	const open = options.llm ?? openWith(authFile$1 === void 0 ? {} : { authFile: authFile$1 });
 	const loop = layer$3({ request: make$5(open) });
-	return layer$9.pipe(Layer.provideMerge(layer$7.pipe(Layer.provide(loop))), Layer.provideMerge(layer$4({}, pool, references, followStore, rebuild)), Layer.provideMerge(layer$5(settingsOptions)), Layer.provideMerge(layer$6), Layer.provideMerge(sandboxes), Layer.provideMerge(layer$21), Layer.provideMerge(layer$1), Layer.provideMerge(layer$24), Layer.provideMerge(layer$8(definitions)), Layer.provideMerge(database), Layer.provideMerge(global));
+	return layer$10.pipe(Layer.provideMerge(layer$7.pipe(Layer.provide(loop))), Layer.provideMerge(layer$4({}, pool, references, followStore, rebuild)), Layer.provideMerge(layer$5(settingsOptions)), Layer.provideMerge(layer$6), Layer.provideMerge(sandboxes), Layer.provideMerge(layer$22), Layer.provideMerge(layer$1), Layer.provideMerge(layer$25), Layer.provideMerge(layer$9(definitions)), Layer.provideMerge(database), Layer.provideMerge(global), Layer.provideMerge(layer$8({
+		home: paths.home,
+		watch: options.watchModels ?? false
+	})));
 }));
 //#endregion
 //#region src/effect/sandbox.ts
@@ -9149,6 +9258,6 @@ var DateTimeUtcFromMillis = schema_exports$9.DateTimeUtcFromMillis;
 var EventSchema = schema_exports$7.EventSchema;
 var SandboxError = errors_exports.SandboxError;
 var optional = schema_exports$9.optional;
-export { control_exports as Control, db_exports as Database, DateTimeUtcFromMillis, event_exports as Event, list_exports as EventList, registry_exports as EventRegistry, EventSchema, global_exports as Global, harness_exports as Harness, location_exports as Location, plugin_exports as Plugin, schema_exports as PromptSchema, run_exports as Runner, sandbox_exports as Sandbox, SandboxError, session_exports as Session, session_exports$1 as SessionStore, settings_exports as Settings, state_exports as State, tool_exports as Tool, optional };
+export { control_exports as Control, db_exports as Database, DateTimeUtcFromMillis, event_exports as Event, list_exports as EventList, registry_exports as EventRegistry, EventSchema, global_exports as Global, harness_exports as Harness, location_exports as Location, catalog_exports as ModelCatalog, plugin_exports as Plugin, schema_exports as PromptSchema, run_exports as Runner, sandbox_exports as Sandbox, SandboxError, session_exports as Session, session_exports$1 as SessionStore, settings_exports as Settings, state_exports as State, tool_exports as Tool, optional };
 
 //# sourceMappingURL=effect.mjs.map