@dadado/agent-kit-cli 5.13.3 → 5.14.0

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { defineCommand as defineCommand23, runMain, showUsage } from "citty";
+import { defineCommand as defineCommand24, runMain, showUsage } from "citty";
 
 // src/commands/add.ts
 import { defineCommand } from "citty";
@@ -355,7 +355,10 @@ var KNOWN_SHIPPED_OVERLAY_HASHES = /* @__PURE__ */ new Set([
   "ebf490086ea45a7b342b3ec7408c9a82b22031daaefddf4425b6e6e931f6d6c8",
   "3077e013297c7dd1e32eb2fa86e1ffa1de7d8740058652782bb8d391782eed71",
   "7e0fa1bb73c8b6f1358cae19477304d85edfb7d4d9a7faf37c00e0578ed79edf",
-  "c5f4ddb5dcf5f40919bedce89870af99422c6f3c9d540ca1f7554a66eaa2f2a8"
+  "c5f4ddb5dcf5f40919bedce89870af99422c6f3c9d540ca1f7554a66eaa2f2a8",
+  "62b744c1cc00f54601579b164d198838395e6ed8e4bcff67fdf55e0e1d9a7d9e",
+  "b1d129c5648014b97e7e1a8577b21b17d35d0bf84494f8be7cc142d51eb1da49",
+  "d05dfe1f6405f9d04c0f0113dbd34decf59b75840fb1d916b4c51c8961211b5f"
 ]);
 
 // src/lifecycle/paths.ts
@@ -1742,9 +1745,11 @@ var L0_ARTIFACTS = [
     source: ".cursor/commands/dogfood.md",
     target: ".cursor/commands/dogfood.md"
   },
-  // Factory-only: `.cursor/commands/public-issue-triage.md` is intentionally
-  // omitted from L0 (and excluded from public-sync). See ADR
-  // 2026-08-05_factory-only-public-issue-triage-command.md.
+  // Factory-only: `.cursor/commands/public-issue-triage.md` and
+  // `.cursor/commands/public-inbound-radar.md` are intentionally omitted from
+  // L0 (and excluded from public-sync). See ADRs
+  // 2026-08-05_factory-only-public-issue-triage-command.md and
+  // 2026-09-24_public-inbound-radar.md.
   {
     source: ".cursor/commands/cursor-update-awareness.md",
     target: ".cursor/commands/cursor-update-awareness.md"
@@ -6766,7 +6771,7 @@ var handoffCommand = defineCommand9({
 });
 
 // src/commands/hook.ts
-import path32 from "path";
+import path33 from "path";
 import { defineCommand as defineCommand10 } from "citty";
 
 // src/hooks/format-session-start.ts
@@ -6793,7 +6798,7 @@ function buildPreCompactUserMessage(payload = {}) {
 // src/hooks/session-start.ts
 import { spawn as spawn5 } from "child_process";
 import { readFile as readFile19, stat as stat4 } from "fs/promises";
-import path31 from "path";
+import path32 from "path";
 
 // src/invariants/handoff-schema.ts
 var MACHINE_LIST_CHECKS = [
@@ -6834,9 +6839,245 @@ function validateHandoffText(text) {
   return warnings;
 }
 
+// src/lifecycle/public-inbound-radar.ts
+import { execFile as execFile6 } from "child_process";
+import { access as access7 } from "fs/promises";
+import path30 from "path";
+import { promisify as promisify6 } from "util";
+var execFileAsync5 = promisify6(execFile6);
+var PUBLIC_INBOUND_REPO = "agent-kit-startup/agent-kit";
+var DEFAULT_PREFS2 = {
+  enabled: false,
+  intervalDays: 7,
+  lastCheckedAt: null
+};
+function emptySummary() {
+  return { issues: 0, humanPullRequests: 0, dependabotPullRequests: 0, total: 0 };
+}
+function summarize(items) {
+  const summary = emptySummary();
+  for (const item of items) {
+    summary.total += 1;
+    if (item.class === "issue") summary.issues += 1;
+    else if (item.class === "dependabot") summary.dependabotPullRequests += 1;
+    else summary.humanPullRequests += 1;
+  }
+  return summary;
+}
+function labelNames(labels) {
+  if (!Array.isArray(labels)) return [];
+  return labels.map((entry) => typeof entry === "string" ? entry : entry?.name).filter((name) => typeof name === "string" && name.length > 0);
+}
+function isDependabotAuthor(login) {
+  if (!login) return false;
+  const normalized = login.toLowerCase();
+  return normalized === "dependabot" || normalized === "dependabot[bot]" || normalized === "app/dependabot" || normalized.startsWith("dependabot") || normalized === "renovate" || normalized === "renovate[bot]";
+}
+function classifyInbound(kind, authorLogin) {
+  if (kind === "issue") return "issue";
+  return isDependabotAuthor(authorLogin) ? "dependabot" : "human-pr";
+}
+function readPublicInboundCheckPrefs(config) {
+  if (!config || typeof config !== "object" || Array.isArray(config)) {
+    return { ...DEFAULT_PREFS2 };
+  }
+  const raw = config.publicInboundCheck;
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+    return { ...DEFAULT_PREFS2 };
+  }
+  const uc = raw;
+  const intervalDays = typeof uc.intervalDays === "number" && Number.isInteger(uc.intervalDays) && uc.intervalDays >= 1 ? uc.intervalDays : DEFAULT_PREFS2.intervalDays;
+  return {
+    enabled: uc.enabled === true,
+    intervalDays,
+    lastCheckedAt: typeof uc.lastCheckedAt === "string" ? uc.lastCheckedAt : null
+  };
+}
+async function stampPublicInboundCheck(cwd, checkedAt) {
+  const existing = await loadContextConfig(cwd) ?? {};
+  const prev = existing.publicInboundCheck && typeof existing.publicInboundCheck === "object" ? { ...existing.publicInboundCheck } : {};
+  existing.publicInboundCheck = {
+    ...DEFAULT_PREFS2,
+    ...prev,
+    lastCheckedAt: (checkedAt ?? /* @__PURE__ */ new Date()).toISOString()
+  };
+  await writeJson(contextConfigPath(cwd), existing);
+}
+function mapRows(kind, rows) {
+  const items = [];
+  for (const row of rows) {
+    const number = typeof row.number === "number" ? row.number : Number(row.number);
+    if (!Number.isFinite(number) || number <= 0) continue;
+    const author = row.author?.login?.trim() || "unknown";
+    const title = typeof row.title === "string" && row.title.trim() ? row.title.trim() : "(no title)";
+    const updatedAt = typeof row.updatedAt === "string" && row.updatedAt.trim() ? row.updatedAt.trim() : "";
+    const url = typeof row.url === "string" && row.url.trim() ? row.url.trim() : `https://github.com/${PUBLIC_INBOUND_REPO}/${kind === "issue" ? "issues" : "pull"}/${number}`;
+    items.push({
+      kind,
+      class: classifyInbound(kind, author),
+      number,
+      title,
+      author,
+      updatedAt,
+      url,
+      labels: labelNames(row.labels),
+      cite: `${PUBLIC_INBOUND_REPO}#${number}`
+    });
+  }
+  return items;
+}
+async function defaultRunGh(args, options) {
+  const { stdout } = await execFileAsync5("gh", args, {
+    cwd: options?.cwd,
+    encoding: "utf8",
+    maxBuffer: 4 * 1024 * 1024,
+    timeout: 3e4
+  });
+  return stdout;
+}
+async function ghAvailable(runGh, cwd) {
+  try {
+    await runGh(["--version"], { cwd });
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function detectFactoryCheckout(cwd) {
+  const root = path30.resolve(cwd);
+  try {
+    const { stdout } = await execFileAsync5("git", ["remote", "get-url", "origin"], {
+      cwd: root,
+      encoding: "utf8",
+      timeout: 5e3
+    });
+    if (/agent-kit-dev/i.test(stdout)) return true;
+  } catch {
+  }
+  return fileExists(path30.join(root, "dogfood", "README.md"));
+}
+async function listJson(runGh, cwd, resource) {
+  const stdout = await runGh(
+    [
+      resource,
+      "list",
+      "--repo",
+      PUBLIC_INBOUND_REPO,
+      "--state",
+      "open",
+      "--limit",
+      "100",
+      "--json",
+      "number,title,author,updatedAt,labels,url"
+    ],
+    { cwd }
+  );
+  const trimmed = stdout.trim();
+  if (!trimmed) return [];
+  const parsed = JSON.parse(trimmed);
+  return Array.isArray(parsed) ? parsed : [];
+}
+function resultBase(status, message, factory, now2, items = []) {
+  return {
+    status,
+    repo: PUBLIC_INBOUND_REPO,
+    checkedAt: now2.toISOString(),
+    factory,
+    items,
+    summary: summarize(items),
+    message,
+    mutateRecommended: false
+  };
+}
+async function checkPublicInbound(cwd, options = {}) {
+  const now2 = options.now?.() ?? /* @__PURE__ */ new Date();
+  const runGh = options.runGh ?? defaultRunGh;
+  const isFactory = options.isFactory ?? detectFactoryCheckout;
+  const root = path30.resolve(cwd);
+  try {
+    await access7(root);
+  } catch {
+    return resultBase("error", `cwd unreadable: ${root}`, false, now2);
+  }
+  const factory = await isFactory(root);
+  if (!factory) {
+    return resultBase(
+      "skipped-non-factory",
+      "Factory-only check. Aborting outside agent-kit-dev / dogfood checkout.",
+      false,
+      now2
+    );
+  }
+  if (options.respectPrefs) {
+    const prefs = readPublicInboundCheckPrefs(await loadContextConfig(root));
+    if (!prefs.enabled) {
+      return resultBase(
+        "skipped-disabled",
+        "publicInboundCheck.enabled is false (opt-in). Set true in .cursor/context/config.json to nudge.",
+        true,
+        now2
+      );
+    }
+    if (!intervalElapsed(prefs.lastCheckedAt, prefs.intervalDays)) {
+      return resultBase(
+        "skipped-interval",
+        `Within publicInboundCheck.intervalDays (${prefs.intervalDays}); last check ${prefs.lastCheckedAt}.`,
+        true,
+        now2
+      );
+    }
+  }
+  if (options.offline) {
+    return resultBase("skipped-offline", "Offline flag set; skipped GitHub fetch.", true, now2);
+  }
+  if (!await ghAvailable(runGh, root)) {
+    return resultBase(
+      "skipped-gh-missing",
+      "gh CLI missing or not runnable; fail-open skip.",
+      true,
+      now2
+    );
+  }
+  try {
+    const [issueRows, prRows] = await Promise.all([
+      listJson(runGh, root, "issue"),
+      listJson(runGh, root, "pr")
+    ]);
+    const items = [...mapRows("issue", issueRows), ...mapRows("pull_request", prRows)].sort(
+      (a, b) => b.number - a.number
+    );
+    const summary = summarize(items);
+    const message = summary.total === 0 ? `No open issues or pull requests on ${PUBLIC_INBOUND_REPO}.` : `Open inbound on ${PUBLIC_INBOUND_REPO}: ${summary.issues} issue(s), ${summary.humanPullRequests} human PR(s), ${summary.dependabotPullRequests} Dependabot PR(s).`;
+    const result = resultBase("ok", message, true, now2, items);
+    if (options.stamp) {
+      await stampPublicInboundCheck(root, now2);
+    }
+    return result;
+  } catch (err) {
+    const detail = err instanceof Error ? err.message : String(err);
+    if (/ENOTFOUND|ECONNREFUSED|ETIMEDOUT|network|offline|Could not resolve/i.test(detail)) {
+      return resultBase(
+        "skipped-offline",
+        `GitHub unreachable; fail-open skip (${detail}).`,
+        true,
+        now2
+      );
+    }
+    return resultBase("error", `Public inbound check failed: ${detail}`, true, now2);
+  }
+}
+function shouldEmitPublicInboundNudge(result) {
+  if (!result || result.status !== "ok") return false;
+  if (result.mutateRecommended === true) return false;
+  const summary = result.summary;
+  if (!summary || typeof summary !== "object") return false;
+  const total = summary.total;
+  return typeof total === "number" && total > 0;
+}
+
 // src/plan-index/plan-index.ts
 import { readFile as readFile18, writeFile as writeFile8 } from "fs/promises";
-import path30 from "path";
+import path31 from "path";
 var PLAN_INDEX_REL = ".cursor/context/plan-index.json";
 var NONE = /^(none|n\/a|empty|nil)$/i;
 var OPEN_STATUSES = /* @__PURE__ */ new Set(["pending", "in_progress"]);
@@ -6850,7 +7091,7 @@ function defaultPlanIndexIo() {
       }
     },
     async writeFile(absPath, body) {
-      await ensureDir(path30.dirname(absPath));
+      await ensureDir(path31.dirname(absPath));
       await writeFile8(absPath, body, "utf8");
     }
   };
@@ -6876,11 +7117,11 @@ function collectNamedPlanBasenames(named) {
   return out;
 }
 function namedPlanCandidatePaths(root, basename) {
-  const safe = path30.basename(basename);
+  const safe = path31.basename(basename);
   if (!/^[A-Za-z0-9._-]+\.plan\.md$/i.test(safe)) return [];
   return [
-    path30.join(root, ".cursor", "plans", safe),
-    path30.join(root, ".cursor", "plans", "archive", safe)
+    path31.join(root, ".cursor", "plans", safe),
+    path31.join(root, ".cursor", "plans", "archive", safe)
   ];
 }
 function classifyPlanRole(file, named, openTodos) {
@@ -6912,7 +7153,7 @@ function parsePlanFrontmatter2(raw) {
   return { name, todos };
 }
 async function buildPlanIndex(root, io = defaultPlanIndexIo(), now2 = () => /* @__PURE__ */ new Date()) {
-  const handoffPath = path30.join(root, HANDOFF_REL);
+  const handoffPath = path31.join(root, HANDOFF_REL);
   const handoffText = await io.readFile(handoffPath) ?? "";
   const named = extractHandoffNamedPlans(handoffText);
   const plans = [];
@@ -6941,7 +7182,7 @@ async function buildPlanIndex(root, io = defaultPlanIndexIo(), now2 = () => /* @
 }
 async function writePlanIndex(root, io = defaultPlanIndexIo(), now2 = () => /* @__PURE__ */ new Date()) {
   const index = await buildPlanIndex(root, io, now2);
-  const dest = path30.join(root, PLAN_INDEX_REL);
+  const dest = path31.join(root, PLAN_INDEX_REL);
   const write = io.writeFile ?? defaultPlanIndexIo().writeFile;
   if (write) {
     await write(dest, `${JSON.stringify(index, null, 2)}
@@ -7200,6 +7441,11 @@ var CURSOR_AWARENESS_NUDGE = `## Cursor product-update awareness
 Advisory gaps vs \`docs/cursor-native-audit.md\` (check-only; no apply; no Field Reports).
 
 Run \`/cursor-update-awareness\` (or \`agent-kit cursor-awareness --check\`) and confirm routing via Ask \u2192 \`/backlog-add\` or \`/dogfood\`.`;
+var PUBLIC_INBOUND_NUDGE = `## Public inbound radar
+
+Open issues or pull requests on \`agent-kit-startup/agent-kit\` (inspect-only; no merge/close).
+
+Run \`/public-inbound-radar\` (or \`agent-kit public-inbound-radar --json\`) and confirm routing via Ask \u2192 \`/backlog-add\`, Memory WRITE, \`/dogfood\`, \`/public-issue-triage\`, or Dismiss. Dependabot is one batch.`;
 
 // src/hooks/session-start.ts
 var NONE_PLACEHOLDERS = /* @__PURE__ */ new Set(["none", "n/a", "empty", "nil"]);
@@ -7272,7 +7518,7 @@ function extractUnprocessedDogfoodLine(line) {
   return raw;
 }
 async function l0Present(root) {
-  return await fileExists(path31.join(root, MANIFEST_RELATIVE_PATH)) || await fileExists(path31.join(root, ".cursor", "commands", "agent-kit-onboard.md")) || await fileExists(path31.join(root, ".cursor", "commands", "start-project.md"));
+  return await fileExists(path32.join(root, MANIFEST_RELATIVE_PATH)) || await fileExists(path32.join(root, ".cursor", "commands", "agent-kit-onboard.md")) || await fileExists(path32.join(root, ".cursor", "commands", "start-project.md"));
 }
 function checkLabelAndRecommendation(check2) {
   const checkId = check2.id;
@@ -7311,7 +7557,7 @@ function unresolvedReadinessChecks(data) {
   return { essential, nonessential };
 }
 async function readinessSection(root) {
-  const snapshotPath = path31.join(root, READINESS_SNAPSHOT_RELATIVE_PATH);
+  const snapshotPath = path32.join(root, READINESS_SNAPSHOT_RELATIVE_PATH);
   let data;
   try {
     data = JSON.parse(await readFile19(snapshotPath, "utf8"));
@@ -7345,8 +7591,8 @@ Optional readiness item: \`${first.id}\`. ${first.recommendation} This does not
 }
 async function dogfoodInboxSection(root) {
   const candidateReadmes = [
-    path31.join(root, "dogfood", "README.md"),
-    path31.join(root, ".cursor", "dogfood", "README.md")
+    path32.join(root, "dogfood", "README.md"),
+    path32.join(root, ".cursor", "dogfood", "README.md")
   ];
   for (const readme of candidateReadmes) {
     if (!await fileExists(readme)) continue;
@@ -7528,6 +7774,97 @@ async function cursorAwarenessSection(root, deps = {}) {
   if (!shouldEmitCursorAwarenessNudge(result)) return null;
   return CURSOR_AWARENESS_NUDGE;
 }
+var PUBLIC_INBOUND_SPAWN_TIMEOUT_MS = 3e4;
+async function loadPublicInboundCheckPrefs(root) {
+  const data = await loadContextConfig(root);
+  if (!data) return null;
+  const uc = data.publicInboundCheck;
+  if (!uc || typeof uc !== "object" || uc.enabled !== true) {
+    return null;
+  }
+  return uc;
+}
+function runPublicInboundJson(root) {
+  return new Promise((resolve3) => {
+    const child = spawn5(
+      process.execPath,
+      [
+        process.argv[1] ?? "",
+        "public-inbound-radar",
+        "--json",
+        "--respect-prefs",
+        "--stamp",
+        "--cwd",
+        root
+      ],
+      { stdio: ["ignore", "pipe", "ignore"], timeout: PUBLIC_INBOUND_SPAWN_TIMEOUT_MS }
+    );
+    let out = "";
+    child.stdout?.on("data", (chunk) => {
+      out += chunk.toString("utf8");
+    });
+    child.on("error", () => resolve3(null));
+    child.on("close", () => {
+      try {
+        const parsed = JSON.parse(out.trim());
+        resolve3(parsed && typeof parsed === "object" ? parsed : null);
+      } catch {
+        resolve3(null);
+      }
+    });
+  });
+}
+async function publicInboundSection(root, deps = {}) {
+  if (await loadPublicInboundCheckPrefs(root) === null) return null;
+  const spawnFn = deps.spawnFn ?? spawn5;
+  const runFallback = deps.runFallback ?? runPublicInboundJson;
+  const result = await new Promise((resolve3) => {
+    let settled = false;
+    let fallbackStarted = false;
+    const finish = (value) => {
+      if (settled) return;
+      settled = true;
+      resolve3(value);
+    };
+    const startFallback = () => {
+      if (settled || fallbackStarted) return;
+      fallbackStarted = true;
+      void runFallback(root).then(finish);
+    };
+    const child = spawnFn(
+      "agent-kit",
+      ["public-inbound-radar", "--json", "--respect-prefs", "--stamp", "--cwd", root],
+      {
+        stdio: ["ignore", "pipe", "ignore"],
+        timeout: PUBLIC_INBOUND_SPAWN_TIMEOUT_MS,
+        shell: false
+      }
+    );
+    let out = "";
+    child.stdout?.on("data", (chunk) => {
+      out += chunk.toString("utf8");
+    });
+    child.on("error", () => {
+      startFallback();
+    });
+    child.on("close", (code) => {
+      if (settled || fallbackStarted) return;
+      if (code !== 0 && !out.trim()) {
+        startFallback();
+        return;
+      }
+      try {
+        finish(JSON.parse(out.trim()));
+      } catch {
+        startFallback();
+      }
+    });
+  });
+  if (!shouldEmitPublicInboundNudge(result)) {
+    return null;
+  }
+  return PUBLIC_INBOUND_NUDGE;
+}
 var AUDIT_SESSION_NS_PREFIX = "agent-kit-audit-";
 var AUDIT_SESSION_LIST_TIMEOUT_MS = 2e3;
 function runAuditSessionCommand(cmd, args) {
@@ -7573,7 +7910,7 @@ function parseScreenDetachedAuditSessions(listing) {
     const [, pid, name, marker] = m;
     if (!name || !name.startsWith(AUDIT_SESSION_NS_PREFIX)) continue;
     if (marker && /[Aa]ttached/.test(marker)) continue;
-    entries.push({ name, socketPath: sockdir ? path31.join(sockdir, `${pid}.${name}`) : null });
+    entries.push({ name, socketPath: sockdir ? path32.join(sockdir, `${pid}.${name}`) : null });
   }
   return entries;
 }
@@ -7621,8 +7958,8 @@ ${sessions.length} detached \`agent-kit-audit-*\` PTY ${noun} on this host (${ol
   }
 }
 async function buildSessionStartAdditionalContext(rootDir, _payload = {}) {
-  const root = path31.resolve(rootDir);
-  const handoffPath = path31.join(root, HANDOFF_REL);
+  const root = path32.resolve(rootDir);
+  const handoffPath = path32.join(root, HANDOFF_REL);
   const handoffFull = await readFull(handoffPath);
   const handoff = capHandoffExcerpt(handoffFull);
   const parts = [HARD_RULES];
@@ -7636,6 +7973,8 @@ async function buildSessionStartAdditionalContext(rootDir, _payload = {}) {
   if (updateNudge) parts.push(updateNudge);
   const cursorNudge = await cursorAwarenessSection(root);
   if (cursorNudge) parts.push(cursorNudge);
+  const inboundNudge = await publicInboundSection(root);
+  if (inboundNudge) parts.push(inboundNudge);
   const auditSessions = await detachedAuditSessionsSection().catch(() => null);
   if (auditSessions) parts.push(auditSessions);
   const formatWarnings = validateHandoffText(handoffFull);
@@ -7689,7 +8028,7 @@ async function runSessionStartHook(cwd, formatArg, deps = {}) {
     const readStdin = deps.readStdin ?? readStdinJson;
     const buildContext = deps.buildContext ?? buildSessionStartAdditionalContext;
     const payload = await readStdin();
-    const root = resolveSessionRoot(payload, path32.resolve(cwd));
+    const root = resolveSessionRoot(payload, path33.resolve(cwd));
     const out = await buildContext(root, payload);
     return formatSessionStartOutput(out.additional_context, format);
   } catch {
@@ -7742,12 +8081,12 @@ import { defineCommand as defineCommand12 } from "citty";
 
 // src/lifecycle/path-cli.ts
 import { spawn as spawn6 } from "child_process";
-import path34 from "path";
+import path35 from "path";
 
 // src/utils/terminal.ts
 import { readdir as readdir8 } from "fs/promises";
 import { homedir as homedir3 } from "os";
-import path33 from "path";
+import path34 from "path";
 import { confirm, isCancel } from "@clack/prompts";
 function isNonInteractive() {
   if (process.env.CI === "true" || process.env.CI === "1") return true;
@@ -7771,14 +8110,14 @@ async function findNestedRepoChildren(resolved) {
     if (!entry.isDirectory()) continue;
     if (entry.name.startsWith(".") || entry.name === "node_modules") continue;
     scanned += 1;
-    if (await fileExists(path33.join(resolved, entry.name, ".git"))) {
+    if (await fileExists(path34.join(resolved, entry.name, ".git"))) {
       nested.push(entry.name);
     }
   }
   return nested;
 }
 async function validateProjectRoot(resolved) {
-  const home = path33.resolve(homedir3());
+  const home = path34.resolve(homedir3());
   if (resolved === "/" || resolved === home) {
     return {
       ok: false,
@@ -7786,8 +8125,8 @@ async function validateProjectRoot(resolved) {
       recovery: "Change into a project directory and re-run. Agent Kit installs per project."
     };
   }
-  const hasGit = await fileExists(path33.join(resolved, ".git"));
-  const hasManifest = await fileExists(path33.join(resolved, MANIFEST_RELATIVE_PATH));
+  const hasGit = await fileExists(path34.join(resolved, ".git"));
+  const hasManifest = await fileExists(path34.join(resolved, MANIFEST_RELATIVE_PATH));
   if (!hasGit && !hasManifest) {
     return {
       ok: false,
@@ -7820,7 +8159,7 @@ async function validateProjectRoot(resolved) {
   return { ok: true };
 }
 async function confirmProjectRoot(cwd, opts) {
-  const resolved = path33.resolve(cwd);
+  const resolved = path34.resolve(cwd);
   if (opts.forceRoot) {
     return resolved;
   }
@@ -7934,9 +8273,9 @@ function npxPinned(runtimeVersion, subcommand) {
   return `npx -y ${pinnedCliSpec(runtimeVersion)} ${subcommand}`;
 }
 function isBinUnderPrefix(binPath, prefix) {
-  const bin = path34.resolve(binPath);
-  const root = path34.resolve(prefix);
-  return bin === root || bin.startsWith(`${root}${path34.sep}`);
+  const bin = path35.resolve(binPath);
+  const root = path35.resolve(prefix);
+  return bin === root || bin.startsWith(`${root}${path35.sep}`);
 }
 function pathCliStatus(env, runtimeVersion) {
   if (!env.binOnPath || !env.binPath) return "missing";
@@ -8034,17 +8373,17 @@ async function syncPathCliToRuntime(options = {}) {
 }
 
 // src/commands/install.ts
-import path40 from "path";
+import path41 from "path";
 import { defineCommand as defineCommand11 } from "citty";
 import { bold, cyan as cyan3, green as green2, options as koloristOptions2 } from "kolorist";
 
 // src/generator/personalization.ts
 import { readFile as readFile21, writeFile as writeFile12 } from "fs/promises";
-import path38 from "path";
+import path39 from "path";
 
 // src/generator/claude-command-adapters.ts
 import { readFile as readFile20, readdir as readdir9, writeFile as writeFile9 } from "fs/promises";
-import path35 from "path";
+import path36 from "path";
 var CURSOR_COMMANDS_DIR_REL = ".cursor/commands";
 var CLAUDE_COMMANDS_DIR_REL = ".claude/commands";
 var RESERVED_ADAPTER_NAMES = /* @__PURE__ */ new Set(["agent-kit"]);
@@ -8073,7 +8412,7 @@ Adapter rules (Claude Code CLI):
 `;
 }
 async function discoverInstalledCommands(rootDir) {
-  const dir = path35.join(rootDir, CURSOR_COMMANDS_DIR_REL);
+  const dir = path36.join(rootDir, CURSOR_COMMANDS_DIR_REL);
   let entries;
   try {
     entries = (await readdir9(dir)).filter((f) => f.endsWith(".md"));
@@ -8085,7 +8424,7 @@ async function discoverInstalledCommands(rootDir) {
     const name = file.slice(0, -3);
     if (RESERVED_ADAPTER_NAMES.has(name)) continue;
     try {
-      const raw = await readFile20(path35.join(dir, file), "utf8");
+      const raw = await readFile20(path36.join(dir, file), "utf8");
       const parsed = parseCommandFrontmatter(name, raw);
       if (parsed) commands.push(parsed);
     } catch {
@@ -8100,11 +8439,11 @@ async function generateClaudeCommandAdapters(rootDir) {
   const results = [];
   let ledgerDirty = false;
   for (const command of commands) {
-    const relPath = path35.posix.join(CLAUDE_COMMANDS_DIR_REL, `${command.name}.md`);
+    const relPath = path36.posix.join(CLAUDE_COMMANDS_DIR_REL, `${command.name}.md`);
     const rendered = renderClaudeCommandAdapter(command);
-    const abs = path35.join(rootDir, relPath);
+    const abs = path36.join(rootDir, relPath);
     if (!await fileExists(abs)) {
-      await ensureDir(path35.dirname(abs));
+      await ensureDir(path36.dirname(abs));
       await writeFile9(abs, rendered, "utf8");
       ledger.hashes[relPath] = contentHash(rendered);
       ledgerDirty = true;
@@ -8135,7 +8474,7 @@ async function generateClaudeCommandAdapters(rootDir) {
 
 // src/generator/claude-kit-load.ts
 import { writeFile as writeFile10 } from "fs/promises";
-import path36 from "path";
+import path37 from "path";
 var CLAUDE_MD_REL = "CLAUDE.md";
 var AGENT_KIT_COMMAND_REL = ".claude/commands/agent-kit.md";
 function renderClaudeMd() {
@@ -8191,11 +8530,11 @@ Non-goals: not audits / \`/plan-external-review\`, not a second tick dialect (\`
 `;
 }
 async function writeUnlessExists(rootDir, relativePath, content) {
-  const target = path36.join(rootDir, relativePath);
+  const target = path37.join(rootDir, relativePath);
   if (await fileExists(target)) {
     return { relativePath, status: "skipped-customized" };
   }
-  await ensureDir(path36.dirname(target));
+  await ensureDir(path37.dirname(target));
   await writeFile10(target, content, "utf8");
   return { relativePath, status: "applied" };
 }
@@ -8208,7 +8547,7 @@ async function generateClaudeKitLoadArtifacts(rootDir) {
 
 // src/generator/vscode.ts
 import { writeFile as writeFile11 } from "fs/promises";
-import path37 from "path";
+import path38 from "path";
 
 // src/generator/platform.ts
 function gitProviderLabel(profile) {
@@ -8232,10 +8571,10 @@ function prTerminology(profile) {
 // src/generator/vscode.ts
 async function generateVSCodeArtifacts(profile) {
   const results = [];
-  const vscodeDir = path37.join(profile.rootDir, ".vscode");
-  const githubDir = path37.join(profile.rootDir, ".github");
+  const vscodeDir = path38.join(profile.rootDir, ".vscode");
+  const githubDir = path38.join(profile.rootDir, ".github");
   await Promise.all([ensureDir(vscodeDir), ensureDir(githubDir)]);
-  const settingsPath = path37.join(vscodeDir, "settings.json");
+  const settingsPath = path38.join(vscodeDir, "settings.json");
   if (await fileExists(settingsPath)) {
     results.push({ relativePath: ".vscode/settings.json", status: "skipped-customized" });
   } else {
@@ -8259,7 +8598,7 @@ async function generateVSCodeArtifacts(profile) {
   }
   const provider = gitProviderLabel(profile);
   const prTerm = prTerminology(profile);
-  const copilotPath = path37.join(githubDir, "copilot-instructions.md");
+  const copilotPath = path38.join(githubDir, "copilot-instructions.md");
   if (await fileExists(copilotPath)) {
     results.push({ relativePath: ".github/copilot-instructions.md", status: "skipped-customized" });
   } else {
@@ -8277,7 +8616,7 @@ async function generateVSCodeArtifacts(profile) {
     results.push({ relativePath: ".github/copilot-instructions.md", status: "applied" });
   }
   if (profile.ide.plan === "vscode-pro") {
-    const securityPath = path37.join(vscodeDir, "security-review.agent.md");
+    const securityPath = path38.join(vscodeDir, "security-review.agent.md");
     if (await fileExists(securityPath)) {
       results.push({
         relativePath: ".vscode/security-review.agent.md",
@@ -8489,7 +8828,7 @@ function renderProjectContext(profile, skillItems = []) {
 `;
 }
 async function createOwnedFile(rootDir, relativePath, content, evidence) {
-  const target = path38.join(rootDir, relativePath);
+  const target = path39.join(rootDir, relativePath);
   if (await fileExists(target)) {
     return {
       kind: "file",
@@ -8499,7 +8838,7 @@ async function createOwnedFile(rootDir, relativePath, content, evidence) {
       evidence
     };
   }
-  await ensureDir(path38.dirname(target));
+  await ensureDir(path39.dirname(target));
   await writeFile12(target, content, "utf8");
   return {
     kind: "file",
@@ -8516,7 +8855,7 @@ async function packTargets(registryRoot, packId) {
 async function existingTargets(projectRoot, targets) {
   const checks = await Promise.all(
     targets.map(
-      async (target) => await fileExists(path38.join(projectRoot, target)) ? target : null
+      async (target) => await fileExists(path39.join(projectRoot, target)) ? target : null
     )
   );
   return checks.filter((target) => target !== null);
@@ -8538,14 +8877,14 @@ async function applyPersonalization(input) {
         componentResults.push({ ...item, status: "unavailable" });
         continue;
       }
-      const target = path38.posix.join(
+      const target = path39.posix.join(
         ".cursor",
         "skills",
         skill.path.includes("/core/") ? "core" : "community",
         skill.id,
         "SKILL.md"
       );
-      if (await fileExists(path38.join(input.rootDir, target))) {
+      if (await fileExists(path39.join(input.rootDir, target))) {
         componentResults.push({ ...item, status: "skipped-customized", path: target });
         protectedPaths.add(target);
         continue;
@@ -8690,7 +9029,7 @@ async function applyPersonalization(input) {
     protectedPaths: [...protectedPaths].sort(),
     ...claudeSessionStartInstructions ? { claudeSessionStartInstructions } : {}
   };
-  await writeJson(path38.join(input.rootDir, RESULT_PATH), result);
+  await writeJson(path39.join(input.rootDir, RESULT_PATH), result);
   return {
     result,
     manifest: {
@@ -8708,7 +9047,7 @@ async function applyPersonalization(input) {
   };
 }
 async function readRepositoryProfile(rootDir) {
-  const target = path38.join(rootDir, REPOSITORY_PROFILE_REL);
+  const target = path39.join(rootDir, REPOSITORY_PROFILE_REL);
   if (!await fileExists(target)) return null;
   return JSON.parse(await readFile21(target, "utf8"));
 }
@@ -8716,16 +9055,16 @@ async function readRepositoryProfile(rootDir) {
 // src/lifecycle/onboard-migration.ts
 import { createHash as createHash4 } from "crypto";
 import { readFile as readFile22, unlink } from "fs/promises";
-import path39 from "path";
+import path40 from "path";
 var LEGACY_ONBOARD_PATH = ".cursor/commands/onboard.md";
 var NAMESPACED_ONBOARD_PATH = ".cursor/commands/agent-kit-onboard.md";
 var MANAGED_LEGACY_HASHES = /* @__PURE__ */ new Set([
   "b274a68941813f19b185893cb7c5561dff027f53270890029992f208e24992fe"
 ]);
 async function migrateLegacyOnboardCommand(projectRoot, managedHashes = MANAGED_LEGACY_HASHES) {
-  const legacyPath = path39.join(projectRoot, LEGACY_ONBOARD_PATH);
+  const legacyPath = path40.join(projectRoot, LEGACY_ONBOARD_PATH);
   if (!await fileExists(legacyPath)) return "absent";
-  const namespacedPath = path39.join(projectRoot, NAMESPACED_ONBOARD_PATH);
+  const namespacedPath = path40.join(projectRoot, NAMESPACED_ONBOARD_PATH);
   if (!await fileExists(namespacedPath)) return "preserved-customized";
   const content = await readFile22(legacyPath);
   const hash = createHash4("sha256").update(content).digest("hex");
@@ -8876,7 +9215,7 @@ async function printPostInstallSummary(result) {
   printInstallEpilogue(sync.env, { runtimeVersion: KIT_VERSION });
 }
 async function performInstall(options) {
-  const projectRoot = path40.resolve(options.cwd);
+  const projectRoot = path41.resolve(options.cwd);
   const packs = parsePackList(options.pack);
   const existing = await loadAgentKitManifest(projectRoot);
   const registry = await resolveRegistryFromCli({
@@ -9581,9 +9920,9 @@ function renderMcLive(view, opts = {}) {
 }
 
 // src/mission-control/snapshot.ts
-import { execFile as execFile6 } from "child_process";
-import { access as access7 } from "fs/promises";
-import path41 from "path";
+import { execFile as execFile7 } from "child_process";
+import { access as access8 } from "fs/promises";
+import path42 from "path";
 
 // ../../dashboard/lib/live-refresh.mjs
 import { join, resolve as resolve2 } from "path";
@@ -9615,8 +9954,8 @@ function dataScriptTimeoutMs(env = process.env) {
 async function firstExisting2(candidates) {
   for (const candidate2 of candidates) {
     try {
-      await access7(candidate2);
-      return path41.resolve(candidate2);
+      await access8(candidate2);
+      return path42.resolve(candidate2);
     } catch {
     }
   }
@@ -9625,9 +9964,9 @@ async function firstExisting2(candidates) {
 async function findDashboardDataScript(cwd, env = process.env, options = {}) {
   const startPath = await findDashboardStart(cwd, env, options);
   if (startPath) {
-    const sibling = path41.join(path41.dirname(startPath), "dashboard-data.mjs");
+    const sibling = path42.join(path42.dirname(startPath), "dashboard-data.mjs");
     try {
-      await access7(sibling);
+      await access8(sibling);
       return sibling;
     } catch {
     }
@@ -9639,8 +9978,8 @@ async function findDashboardDataScript(cwd, env = process.env, options = {}) {
 async function loadDashboardSnapshot(opts) {
   const env = opts.env ?? process.env;
   const timeout = dataScriptTimeoutMs(env);
-  const run = opts.execFileFn ?? execFile6;
-  const snapshotRoot = path41.resolve(opts.snapshotRoot);
+  const run = opts.execFileFn ?? execFile7;
+  const snapshotRoot = path42.resolve(opts.snapshotRoot);
   return new Promise((resolve3) => {
     run(
       process.execPath,
@@ -9963,20 +10302,20 @@ var missionControlCommand = defineCommand13({
 });
 
 // src/commands/monitors.ts
-import path43 from "path";
+import path44 from "path";
 import { defineCommand as defineCommand14 } from "citty";
 
 // src/invariants/monitors-untriaged.ts
-import { execFile as execFile7 } from "child_process";
+import { execFile as execFile8 } from "child_process";
 import { readFile as readFile23, readdir as readdir10, stat as stat5 } from "fs/promises";
-import path42 from "path";
-import { promisify as promisify6 } from "util";
+import path43 from "path";
+import { promisify as promisify7 } from "util";
 
 // src/invariants/triage-heading.ts
 var TRIAGE_HEADING_RE = /^#{2,6}\s+(?:Triage note|Follow-?up plan|Residuals plan)\b/im;
 
 // src/invariants/monitors-untriaged.ts
-var execFileAsync5 = promisify6(execFile7);
+var execFileAsync6 = promisify7(execFile8);
 var CITE4 = "agent-kit monitors --untriaged (ADR 2026-07-27_plan-review-triage-untriaged-not-mtime; never newest-mtime-wins)";
 function hasOpenGaps(content) {
   if (/###\s+Still open[^\n]*\n+(?:\s*\n)*(?:None\.|none\.|\*None\*)/i.test(content)) {
@@ -10002,7 +10341,7 @@ async function listMonitorFiles(memoryDir) {
 async function gitFreshMonitorNames(rootDir) {
   const names = /* @__PURE__ */ new Set();
   try {
-    const { stdout } = await execFileAsync5(
+    const { stdout } = await execFileAsync6(
       "git",
       ["status", "--porcelain", "--", ".cursor/memory"],
       { cwd: rootDir, maxBuffer: 2 * 1024 * 1024 }
@@ -10010,7 +10349,7 @@ async function gitFreshMonitorNames(rootDir) {
     for (const line of stdout.split("\n")) {
       if (!line.trim()) continue;
       const file = line.slice(3).trim().replace(/^.* -> /, "");
-      const base = path42.basename(file);
+      const base = path43.basename(file);
       if (base.startsWith("plan-monitor-") && base.endsWith(".md")) {
         names.add(base);
       }
@@ -10033,13 +10372,13 @@ function monitorSlugFromName(fileName) {
   return fileName.replace(/^plan-monitor-/, "").replace(/\.md$/, "").toLowerCase();
 }
 async function selectUntriagedMonitors(rootDir) {
-  const root = path42.resolve(rootDir);
-  const memoryDir = path42.join(root, ".cursor", "memory");
+  const root = path43.resolve(rootDir);
+  const memoryDir = path43.join(root, ".cursor", "memory");
   const allNames = await listMonitorFiles(memoryDir);
   const selectionOrder = ["git-fresh", "handoff-aligned", "untriaged-scan"];
   const byName = /* @__PURE__ */ new Map();
   for (const name of allNames) {
-    const abs = path42.join(memoryDir, name);
+    const abs = path43.join(memoryDir, name);
     try {
       const [content, st] = await Promise.all([readFile23(abs, "utf8"), stat5(abs)]);
       byName.set(name, { content, mtimeMs: st.mtimeMs });
@@ -10054,7 +10393,7 @@ async function selectUntriagedMonitors(rootDir) {
   const gitFreshSet = [...gitFresh].filter(untriaged).sort();
   let handoff = "";
   try {
-    handoff = await readFile23(path42.join(root, ".cursor", "HANDOFF.md"), "utf8");
+    handoff = await readFile23(path43.join(root, ".cursor", "HANDOFF.md"), "utf8");
   } catch {
     handoff = "";
   }
@@ -10074,8 +10413,8 @@ async function selectUntriagedMonitors(rootDir) {
     const row = byName.get(name);
     if (!row) continue;
     entries.push({
-      path: path42.join(memoryDir, name),
-      relativePath: path42.relative(root, path42.join(memoryDir, name)).split(path42.sep).join("/"),
+      path: path43.join(memoryDir, name),
+      relativePath: path43.relative(root, path43.join(memoryDir, name)).split(path43.sep).join("/"),
       mtimeMs: row.mtimeMs,
       hasTriageHeading: false,
       hasOpenGaps: hasOpenGaps(row.content),
@@ -10121,7 +10460,7 @@ var monitorsCommand = defineCommand14({
       process.exitCode = 2;
       return;
     }
-    const result = await selectUntriagedMonitors(path43.resolve(args.cwd));
+    const result = await selectUntriagedMonitors(path44.resolve(args.cwd));
     if (args.json) {
       console.log(JSON.stringify(result, null, 2));
       return;
@@ -10137,7 +10476,7 @@ var monitorsCommand = defineCommand14({
 });
 
 // src/commands/plan-index.ts
-import path44 from "path";
+import path45 from "path";
 import { defineCommand as defineCommand15 } from "citty";
 var planIndexCommand = defineCommand15({
   meta: {
@@ -10156,7 +10495,7 @@ var planIndexCommand = defineCommand15({
     }
   },
   async run({ args }) {
-    const root = path44.resolve(args.cwd);
+    const root = path45.resolve(args.cwd);
     const index = await writePlanIndex(root);
     if (args.json) {
       console.log(JSON.stringify(index, null, 2));
@@ -10171,15 +10510,72 @@ var planIndexCommand = defineCommand15({
   }
 });
 
-// src/commands/run-plan.ts
-import path51 from "path";
+// src/commands/public-inbound-radar.ts
 import { defineCommand as defineCommand16 } from "citty";
+var publicInboundRadarCommand = defineCommand16({
+  meta: {
+    name: "public-inbound-radar",
+    description: "Factory-only: list open public issues/PRs on agent-kit-startup/agent-kit (read-only JSON)."
+  },
+  args: {
+    cwd: {
+      type: "string",
+      default: process.cwd()
+    },
+    json: {
+      type: "boolean",
+      description: "Print machine-readable JSON (default true for scripting)",
+      default: true
+    },
+    offline: {
+      type: "boolean",
+      description: "Skip GitHub fetch; fail-open skipped-offline",
+      default: false
+    },
+    "respect-prefs": {
+      type: "boolean",
+      description: "Honor publicInboundCheck.enabled and intervalDays from .cursor/context/config.json",
+      default: false
+    },
+    stamp: {
+      type: "boolean",
+      description: "Persist publicInboundCheck.lastCheckedAt after an ok check",
+      default: false
+    }
+  },
+  async run({ args }) {
+    const result = await checkPublicInbound(args.cwd, {
+      offline: Boolean(args.offline),
+      respectPrefs: Boolean(args["respect-prefs"]),
+      stamp: Boolean(args.stamp)
+    });
+    if (args.json) {
+      console.log(JSON.stringify(result, null, 2));
+    } else {
+      const line = `[${result.status}] ${result.message}`;
+      if (result.status === "error") logger.error(line);
+      else if (result.status.startsWith("skipped-")) logger.warn(line);
+      else logger.info(line);
+      for (const item of result.items.slice(0, 20)) {
+        logger.info(`- ${item.class} ${item.cite}: ${item.title} (@${item.author})`);
+      }
+      if (result.items.length > 20) {
+        logger.info(`\u2026 and ${result.items.length - 20} more (use --json)`);
+      }
+    }
+    if (result.status === "error") process.exitCode = 2;
+  }
+});
+
+// src/commands/run-plan.ts
+import path52 from "path";
+import { defineCommand as defineCommand17 } from "citty";
 
 // src/plan-loop/backends.ts
 import { execFileSync as execFileSync2, spawn as spawn7 } from "child_process";
 import { createWriteStream } from "fs";
-import { access as access8 } from "fs/promises";
-import path45 from "path";
+import { access as access9 } from "fs/promises";
+import path46 from "path";
 import { StringDecoder as StringDecoder3 } from "string_decoder";
 
 // src/plan-loop/hitl-relay.ts
@@ -11319,9 +11715,9 @@ function claudeHeadlessArgs(opts = {}) {
 async function missingClaudeAdapter(workspace, prompt) {
   const m = /^\/([A-Za-z0-9][A-Za-z0-9_-]*)/.exec(prompt.trimStart());
   if (!m?.[1]) return null;
-  const rel = path45.join(".claude", "commands", `${m[1]}.md`);
+  const rel = path46.join(".claude", "commands", `${m[1]}.md`);
   try {
-    await access8(path45.join(workspace, rel));
+    await access9(path46.join(workspace, rel));
     return null;
   } catch {
     return rel;
@@ -11444,15 +11840,15 @@ async function detectAgentBackend(requested, whichFn = whichBinary) {
 
 // src/plan-loop/run-loop.ts
 import { mkdir as mkdir6, readFile as readFile27, rm as rm2, unlink as unlink2 } from "fs/promises";
-import path50 from "path";
+import path51 from "path";
 
 // src/mission-control/live-run.ts
 import { readFile as readFile25 } from "fs/promises";
-import path47 from "path";
+import path48 from "path";
 
 // src/plan-loop/plan-state.ts
 import { readFile as readFile24, readdir as readdir11 } from "fs/promises";
-import path46 from "path";
+import path47 from "path";
 function countPendingTodos(raw) {
   const lines = raw.split(/\r?\n/);
   let inFront = 0;
@@ -11480,7 +11876,7 @@ function countPendingTodos(raw) {
 async function findActivePlanFile(plansDir) {
   if (!await fileExists(plansDir)) return null;
   const files = (await readdir11(plansDir)).filter((f) => f.endsWith(".plan.md")).sort();
-  return files[0] ? path46.join(plansDir, files[0]) : null;
+  return files[0] ? path47.join(plansDir, files[0]) : null;
 }
 async function readPlan(planPath) {
   return readFile24(planPath, "utf8");
@@ -11668,7 +12064,7 @@ function firstWord(raw) {
 }
 async function readLiveMission(root, io = defaultMissionIo()) {
   const mission = emptyLiveMission();
-  const handoff = await io.readFile(path47.join(root, ".cursor", "HANDOFF.md")) ?? "";
+  const handoff = await io.readFile(path48.join(root, ".cursor", "HANDOFF.md")) ?? "";
   const named = extractHandoffNamedPlans(handoff);
   mission.mode = firstWord(MODE_RE.exec(handoff)?.[1]);
   let cursorIndex = null;
@@ -11704,13 +12100,13 @@ async function readLiveMission(root, io = defaultMissionIo()) {
       state: finished || cursor !== null && i < cursor ? "done" : i === cursor ? "current" : "pending"
     }));
   }
-  const plansDir = path47.join(root, ".cursor", "plans");
+  const plansDir = path48.join(root, ".cursor", "plans");
   const planBase = (mission.queue && !finished ? mission.queue.current : null) ?? named.active;
-  const planPath = planBase ? path47.join(plansDir, planBase) : await io.findActivePlan(plansDir);
+  const planPath = planBase ? path48.join(plansDir, planBase) : await io.findActivePlan(plansDir);
   if (planPath) {
     const raw = await io.readFile(planPath);
     if (raw !== null) {
-      mission.planFile = path47.basename(planPath);
+      mission.planFile = path48.basename(planPath);
       const { todos } = parsePlanFrontmatter2(raw);
       const open = todos.filter((t) => t.status !== "cancelled");
       mission.todos = {
@@ -11761,7 +12157,7 @@ async function withLiveTui(opts, run) {
     columns,
     now: now2,
     backend: opts.backend,
-    logPath: path47.relative(opts.root, opts.logPath) || opts.logPath
+    logPath: path48.relative(opts.root, opts.logPath) || opts.logPath
   });
   opts.onFeed?.(feed);
   const missionLoader = opts.missionLoader ?? createLiveMissionLoader(opts.root, { now: now2 });
@@ -11898,9 +12294,9 @@ async function withLiveTui(opts, run) {
 
 // src/plan-loop/external-review.ts
 import { spawn as spawn8 } from "child_process";
-import path48 from "path";
-var CANONICAL_REL = path48.join(".cursor", "scripts", "plan-external-review.sh");
-var FALLBACK_REL = path48.join("scripts", "plan-external-review.sh");
+import path49 from "path";
+var CANONICAL_REL = path49.join(".cursor", "scripts", "plan-external-review.sh");
+var FALLBACK_REL = path49.join("scripts", "plan-external-review.sh");
 function isPlanExhaustedReason(reason) {
   const r = reason.trim().toLowerCase();
   if (!r) return false;
@@ -11922,8 +12318,8 @@ async function armExternalPlanReview(root, options = {}) {
   const existsFn = options.existsFn ?? fileExists;
   const log = options.log ?? ((line) => console.log(line));
   const force = options.force === true;
-  const canonicalPath = path48.join(root, CANONICAL_REL);
-  const fallbackPath = path48.join(root, FALLBACK_REL);
+  const canonicalPath = path49.join(root, CANONICAL_REL);
+  const fallbackPath = path49.join(root, FALLBACK_REL);
   let scriptPath = null;
   let scriptRel = CANONICAL_REL;
   if (await existsFn(canonicalPath)) {
@@ -11976,7 +12372,7 @@ async function armExternalPlanReview(root, options = {}) {
 }
 
 // src/plan-loop/persona-banners.ts
-import path49 from "path";
+import path50 from "path";
 import {
   blue,
   cyan as cyan4,
@@ -12012,7 +12408,7 @@ function resolveColor(name, fallback) {
 async function resolveCliPersonaId(root) {
   try {
     const cfg = await readJson(
-      path49.join(root, ".cursor", "context", "config.json")
+      path50.join(root, ".cursor", "context", "config.json")
     );
     const modes = cfg?.agentPersona?.modes ?? cfg?.workspaceSkin?.modes;
     const id = modes?.[CLI_RUN_PLAN_MODE];
@@ -12023,7 +12419,7 @@ async function resolveCliPersonaId(root) {
 }
 async function loadPersonaPack(root, personaId) {
   try {
-    const personaPath = path49.join(root, "registry", "personas", "core", personaId, "persona.json");
+    const personaPath = path50.join(root, "registry", "personas", "core", personaId, "persona.json");
     const pack = await readJson(personaPath);
     if (!pack || typeof pack.id !== "string") return null;
     return pack;
@@ -12202,9 +12598,9 @@ function sleep(ms) {
   return new Promise((r) => setTimeout(r, ms));
 }
 async function runPlanLoop(opts) {
-  const plansDir = path50.join(opts.root, ".cursor", "plans");
-  const stopFile = path50.join(opts.root, ".cursor", "loop.stop");
-  const logDir = path50.join(opts.root, ".cursor", "loop-logs");
+  const plansDir = path51.join(opts.root, ".cursor", "plans");
+  const stopFile = path51.join(opts.root, ".cursor", "loop.stop");
+  const logDir = path51.join(opts.root, ".cursor", "loop-logs");
   const planPath = await findActivePlanFile(plansDir);
   if (!planPath) {
     logger.error("No active plan in .cursor/plans/");
@@ -12225,7 +12621,7 @@ async function runPlanLoop(opts) {
   try {
     const persona = await loadCliRunPlanPersona(opts.root);
     const banners = createPersonaBannerPrinter(persona);
-    console.log(`Active plan: ${path50.basename(planPath)}`);
+    console.log(`Active plan: ${path51.basename(planPath)}`);
     console.log(`Pending to-dos: ${await pending()} | max ticks: ${opts.maxTicks}`);
     console.log(`Backend: ${opts.backend.id}`);
     if (persona) {
@@ -12269,8 +12665,8 @@ async function runPlanLoop(opts) {
         planExhausted = true;
         break;
       }
-      const logPath = path50.join(logDir, `tick-${stamp()}.log`);
-      const relLog = path50.relative(opts.root, logPath);
+      const logPath = path51.join(logDir, `tick-${stamp()}.log`);
+      const relLog = path51.relative(opts.root, logPath);
       console.log("");
       const tickLine = `=== tick ${tick}/${opts.maxTicks} - pending: ${before} - log: ${relLog} ===`;
       if (banners) banners.tickStart(tickLine);
@@ -12378,7 +12774,7 @@ async function runPlanLoop(opts) {
     const finishDetail = `after ${tick} tick(s); pending: ${pendingNow}`;
     if (banners) banners.phaseComplete(finishDetail);
     console.log(
-      `Loop finished after ${tick} tick(s). Pending now: ${pendingNow}. Logs in ${path50.relative(opts.root, logDir)}/`
+      `Loop finished after ${tick} tick(s). Pending now: ${pendingNow}. Logs in ${path51.relative(opts.root, logDir)}/`
     );
     if (planExhausted || shouldArmExternalPlanReview({ pending: pendingNow, stopReason })) {
       await armExternalPlanReview(opts.root);
@@ -12390,7 +12786,7 @@ async function runPlanLoop(opts) {
 }
 
 // src/commands/run-plan.ts
-var runPlanCommand = defineCommand16({
+var runPlanCommand = defineCommand17({
   meta: {
     name: "run-plan",
     description: "Headless continuous plan runner (one fresh agent per tick). Never git-prod."
@@ -12470,7 +12866,7 @@ var runPlanCommand = defineCommand16({
       return;
     }
     const code = await runPlanLoop({
-      root: path51.resolve(args.cwd),
+      root: path52.resolve(args.cwd),
       maxTicks,
       sleepSeconds,
       model: args.model ? String(args.model) : void 0,
@@ -12485,12 +12881,12 @@ var runPlanCommand = defineCommand16({
 
 // src/commands/run.ts
 import { homedir as homedir4 } from "os";
-import path53 from "path";
-import { defineCommand as defineCommand17 } from "citty";
+import path54 from "path";
+import { defineCommand as defineCommand18 } from "citty";
 
 // src/plan-loop/dispatch.ts
 import { mkdir as mkdir7, readFile as readFile28 } from "fs/promises";
-import path52 from "path";
+import path53 from "path";
 var RUN_CATALOG = [
   "run-plan",
   "run-plan-all",
@@ -12533,7 +12929,7 @@ function rewriteRootArgvToRun(argv) {
   return next;
 }
 function commandMarkdownPath(root, name) {
-  return path52.join(root, ".cursor", "commands", `${normalizeSlashName(name)}.md`);
+  return path53.join(root, ".cursor", "commands", `${normalizeSlashName(name)}.md`);
 }
 function buildDispatchPrompt(commandBody) {
   return [
@@ -12621,20 +13017,20 @@ async function runHeadlessDispatch(opts) {
   });
 }
 async function ensureDispatchLogPath(root) {
-  const logDir = path52.join(root, ".cursor", "loop-logs");
+  const logDir = path53.join(root, ".cursor", "loop-logs");
   await mkdir7(logDir, { recursive: true });
-  return path52.join(logDir, `run-${stamp2()}.log`);
+  return path53.join(logDir, `run-${stamp2()}.log`);
 }
 
 // src/commands/run.ts
 function displayPath(target, home = homedir4()) {
-  const resolvedHome = path53.resolve(home);
+  const resolvedHome = path54.resolve(home);
   if (target === resolvedHome) return "~";
-  const prefix = resolvedHome.endsWith(path53.sep) ? resolvedHome : `${resolvedHome}${path53.sep}`;
-  return target.startsWith(prefix) ? `~${path53.sep}${target.slice(prefix.length)}` : target;
+  const prefix = resolvedHome.endsWith(path54.sep) ? resolvedHome : `${resolvedHome}${path54.sep}`;
+  return target.startsWith(prefix) ? `~${path54.sep}${target.slice(prefix.length)}` : target;
 }
 async function executeRun(input) {
-  const root = path53.resolve(input.cwd);
+  const root = path54.resolve(input.cwd);
   const slash = normalizeSlashName(input.slash);
   if (!slash) {
     return { exitCode: 1, error: "Provide a slash: agent-kit run <slash>" };
@@ -12685,7 +13081,7 @@ async function executeRun(input) {
     const stdout = [
       "--dry-run: no agent will be started.",
       `Slash: ${slash}`,
-      `Command file: ${path53.relative(root, file.path)}`,
+      `Command file: ${path54.relative(root, file.path)}`,
       `Backend: ${detected.id} (${displayPath(detected.bin)})`,
       "Prompt:",
       prompt
@@ -12694,8 +13090,8 @@ async function executeRun(input) {
   }
   const logPath = await ensureDispatchLogPath(root);
   console.log(`Dispatch: ${slash} via ${detected.id}`);
-  console.log(`Command file: ${path53.relative(root, file.path)}`);
-  console.log(`Log: ${path53.relative(root, logPath)}`);
+  console.log(`Command file: ${path54.relative(root, file.path)}`);
+  console.log(`Log: ${path54.relative(root, logPath)}`);
   try {
     const dispatch = {
       backendId: detected.id,
@@ -12798,7 +13194,7 @@ async function runSlashCli(slash, args) {
   }
   process.exitCode = result.exitCode;
 }
-var runCommand = defineCommand17({
+var runCommand = defineCommand18({
   meta: {
     name: "run",
     description: "Start one headless session from an L0 slash file. Numbered-list HITL answered from the terminal (claude backend). Never git-prod."
@@ -12815,7 +13211,7 @@ var runCommand = defineCommand17({
     await runSlashCli(String(args.slash ?? ""), args);
   }
 });
-var runPlanAllCommand = defineCommand17({
+var runPlanAllCommand = defineCommand18({
   meta: {
     name: "run-plan-all",
     description: "Headless /run-plan-all queue from the L0 file. Numbered-list HITL answered from the terminal (claude backend). Never git-prod."
@@ -12827,8 +13223,8 @@ var runPlanAllCommand = defineCommand17({
 });
 
 // src/commands/scan.ts
-import { defineCommand as defineCommand18 } from "citty";
-var scanCommand = defineCommand18({
+import { defineCommand as defineCommand19 } from "citty";
+var scanCommand = defineCommand19({
   meta: {
     name: "scan",
     description: "Scan the repository and print the detected profile."
@@ -12852,18 +13248,18 @@ var scanCommand = defineCommand18({
 import { spawn as spawn9 } from "child_process";
 import { appendFile as appendFile2, mkdir as mkdir8, readFile as readFile29, writeFile as writeFile13 } from "fs/promises";
 import { homedir as homedir5 } from "os";
-import path54 from "path";
+import path55 from "path";
 import { confirm as confirm2, isCancel as isCancel2 } from "@clack/prompts";
-import { defineCommand as defineCommand19 } from "citty";
+import { defineCommand as defineCommand20 } from "citty";
 import { cyan as cyan5, green as green4, yellow as yellow3 } from "kolorist";
 var NPM_GLOBAL_DIR_NAME = ".npm-global";
 var SETUP_GLOBAL_MARKER = "# agent-kit setup-global";
 function planSetupGlobalSteps(env, options = {}) {
   const homeDir = options.homeDir ?? homedir5();
   const packageSpec = options.packageSpec ?? pinnedCliSpec();
-  const npmGlobalDir = path54.join(homeDir, NPM_GLOBAL_DIR_NAME);
-  const npmGlobalBin = path54.join(npmGlobalDir, "bin");
-  const npmrcPath = path54.join(homeDir, ".npmrc");
+  const npmGlobalDir = path55.join(homeDir, NPM_GLOBAL_DIR_NAME);
+  const npmGlobalBin = path55.join(npmGlobalDir, "bin");
+  const npmrcPath = path55.join(homeDir, ".npmrc");
   const npmrcPrefixValue = `~/${NPM_GLOBAL_DIR_NAME}`;
   const pathExportLine = `export PATH="${npmGlobalBin}:$PATH"`;
   const shellProfile = env.shellProfile;
@@ -13133,7 +13529,7 @@ ${verifyStep.title}`);
   }
   return { exitCode: 0, mutated, outcome: "completed", env, plan };
 }
-var setupGlobalCommand = defineCommand19({
+var setupGlobalCommand = defineCommand20({
   meta: {
     name: "setup-global",
     description: "Self-heal a root-owned npm prefix: relocate to ~/.npm-global, fix PATH, reinstall globally."
@@ -13162,8 +13558,8 @@ var setupGlobalCommand = defineCommand19({
 });
 
 // src/commands/status.ts
-import path55 from "path";
-import { defineCommand as defineCommand20 } from "citty";
+import path56 from "path";
+import { defineCommand as defineCommand21 } from "citty";
 function profileStatus(profile) {
   if (!profile) return { origin: "none", evidence: [], profile: null };
   if ("detection" in profile && profile.detection && typeof profile.detection === "object") {
@@ -13176,7 +13572,7 @@ function profileStatus(profile) {
   }
   return { origin: "legacy-wizard", evidence: [], profile };
 }
-var statusCommand = defineCommand20({
+var statusCommand = defineCommand21({
   meta: {
     name: "status",
     description: "Show installed kit version, manifest, and optional profile."
@@ -13193,11 +13589,11 @@ var statusCommand = defineCommand20({
     }
   },
   async run({ args }) {
-    const rootDir = path55.resolve(args.cwd);
+    const rootDir = path56.resolve(args.cwd);
     const [manifest, rawProfile, scan, env] = await Promise.all([
       loadAgentKitManifest(rootDir),
       readJson(
-        path55.join(rootDir, ".cursor", "agent-kit.config.json")
+        path56.join(rootDir, ".cursor", "agent-kit.config.json")
       ),
       runScanner(rootDir),
       assessEnvironment()
@@ -13264,8 +13660,8 @@ var statusCommand = defineCommand20({
 });
 
 // src/commands/update.ts
-import { defineCommand as defineCommand21 } from "citty";
-var updateCommand = defineCommand21({
+import { defineCommand as defineCommand22 } from "citty";
+var updateCommand = defineCommand22({
   meta: {
     name: "update",
     description: "Re-apply L0/packs/skills from the registry (never overwrites L3). --check = notify-only."
@@ -13433,8 +13829,8 @@ ${err.recovery}
 
 // src/commands/validate.ts
 import { readFile as readFile30 } from "fs/promises";
-import path56 from "path";
-import { defineCommand as defineCommand22 } from "citty";
+import path57 from "path";
+import { defineCommand as defineCommand23 } from "citty";
 
 // src/invariants/plan-schema.ts
 var CITE5 = "agent-kit validate plan (.cursor/context/templates/plan.md)";
@@ -13480,7 +13876,7 @@ function validatePlanFrontmatterText(text) {
 // src/commands/validate.ts
 async function resolveEditedPath(cwd, explicit) {
   if (explicit) {
-    const filePath2 = path56.resolve(cwd, explicit);
+    const filePath2 = path57.resolve(cwd, explicit);
     try {
       return { filePath: filePath2, content: await readFile30(filePath2, "utf8") };
     } catch {
@@ -13490,7 +13886,7 @@ async function resolveEditedPath(cwd, explicit) {
   const payload = await readStdinJson();
   const rel = typeof payload.file_path === "string" && payload.file_path || typeof payload.path === "string" && payload.path || typeof payload.file === "string" && payload.file || "";
   if (!rel) return null;
-  const filePath = path56.isAbsolute(rel) ? rel : path56.resolve(cwd, rel);
+  const filePath = path57.isAbsolute(rel) ? rel : path57.resolve(cwd, rel);
   try {
     return { filePath, content: await readFile30(filePath, "utf8") };
   } catch {
@@ -13504,13 +13900,13 @@ function isPlanPath(filePath) {
   const norm = filePath.replace(/\\/g, "/");
   return norm.includes("/.cursor/plans/") && norm.endsWith(".plan.md");
 }
-var validateCommand = defineCommand22({
+var validateCommand = defineCommand23({
   meta: {
     name: "validate",
     description: "Advisory validators for HANDOFF / plan frontmatter (hook adapter)."
   },
   subCommands: {
-    handoff: defineCommand22({
+    handoff: defineCommand23({
       meta: { name: "handoff", description: "Validate HANDOFF machine fields" },
       args: {
         cwd: { type: "string", default: process.cwd() },
@@ -13520,7 +13916,7 @@ var validateCommand = defineCommand22({
       async run({ args }) {
         const cwd = typeof args.cwd === "string" ? args.cwd : process.cwd();
         const fileArg = typeof args.file === "string" ? args.file : void 0;
-        const filePath = fileArg ? path56.resolve(cwd, fileArg) : path56.join(path56.resolve(cwd), ".cursor", "HANDOFF.md");
+        const filePath = fileArg ? path57.resolve(cwd, fileArg) : path57.join(path57.resolve(cwd), ".cursor", "HANDOFF.md");
         let content = "";
         try {
           content = await readFile30(filePath, "utf8");
@@ -13538,7 +13934,7 @@ var validateCommand = defineCommand22({
         console.log(JSON.stringify({ ok: warnings.length === 0, warnings }));
       }
     }),
-    plan: defineCommand22({
+    plan: defineCommand23({
       meta: { name: "plan", description: "Validate plan frontmatter" },
       args: {
         cwd: { type: "string", default: process.cwd() },
@@ -13553,7 +13949,7 @@ var validateCommand = defineCommand22({
           process.exitCode = 2;
           return;
         }
-        const filePath = path56.resolve(cwd, fileArg);
+        const filePath = path57.resolve(cwd, fileArg);
         let content = "";
         try {
           content = await readFile30(filePath, "utf8");
@@ -13565,7 +13961,7 @@ var validateCommand = defineCommand22({
         console.log(JSON.stringify({ ok: warnings.length === 0, warnings }));
       }
     }),
-    "after-edit": defineCommand22({
+    "after-edit": defineCommand23({
       meta: {
         name: "after-edit",
         description: "Advisory afterFileEdit: annotate HANDOFF/plan issues (never block)"
@@ -13575,7 +13971,7 @@ var validateCommand = defineCommand22({
       },
       async run({ args }) {
         const cwd = typeof args.cwd === "string" ? args.cwd : process.cwd();
-        const resolved = await resolveEditedPath(path56.resolve(cwd));
+        const resolved = await resolveEditedPath(path57.resolve(cwd));
         if (!resolved) {
           console.log(JSON.stringify({}));
           return;
@@ -13726,7 +14122,15 @@ var CLI_HELP_GROUPS = [
   {
     id: "integrity",
     title: "INTEGRITY",
-    commands: ["validate", "guard", "hook", "cursor-awareness", "diff", "contribute"]
+    commands: [
+      "validate",
+      "guard",
+      "hook",
+      "cursor-awareness",
+      "public-inbound-radar",
+      "diff",
+      "contribute"
+    ]
   }
 ];
 async function resolveCommandMeta(meta) {
@@ -13794,7 +14198,7 @@ async function renderGroupedRootHelp(cmd) {
 var rewrittenArgv = rewriteRootArgvToRun(process.argv.slice(2));
 process.argv.length = 2;
 process.argv.push(...rewrittenArgv);
-var main = defineCommand23({
+var main = defineCommand24({
   meta: {
     name: "agent-kit",
     description: "HITL framework for AI-assisted IDEs (Mission Kit family)",
@@ -13810,6 +14214,7 @@ var main = defineCommand23({
     status: statusCommand,
     update: updateCommand,
     "cursor-awareness": cursorAwarenessCommand,
+    "public-inbound-radar": publicInboundRadarCommand,
     diff: diffCommand,
     contribute: contributeCommand,
     handoff: handoffCommand,