@duckcodeailabs/dql-cli 1.7.0 → 1.7.2

package/dist/local-runtime.js

@@ -4,19 +4,19 @@ import { createServer } from "node:http";
 import { existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, statSync, watch, writeFileSync, } from "node:fs";
 import { createRequire } from "node:module";
 import { homedir } from "node:os";
+import { fileURLToPath } from "node:url";
 import { dirname, extname, join, normalize, relative, resolve, } from "node:path";
 import { Readable } from "node:stream";
 import { buildMixedSourceWarehouseFallbackSql, findMentionedNotebookDataset, planMixedSourceNotebookSql, planMixedSourceSql, } from "./mixed-source-sql.js";
-import Anthropic from "@anthropic-ai/sdk";
-import OpenAI from "openai";
+import { resolveNpmInvocation } from './npm-runtime.js';
 import { buildExecutionPlan, createWelcomeNotebook, deserializeNotebook, getConnectorFormSchemas, hasSemanticRefs, hasStandaloneSemanticRef, resolveSemanticRefs, } from '@duckcodeailabs/dql-notebook';
-import { loadSemanticLayerFromDir, normalizeDqlArtifactReference, serializeMetricDefinitionToYaml, resolveSemanticLayerAsync, getDialect, Parser, NodeKind, blockParameterDefinitions, buildLineageGraph, buildManifest, collectInputFiles, findAppDocuments, findDashboardsForApp, isBlockIdRef, loadAppDocument, loadDashboardDocument, analyzeImpact, buildTrustChain, detectDomainFlows, getDomainTrustOverview, queryLineage, queryBusiness360, queryCompleteLineagePaths, LineageGraph, canonicalize, canonicalizeNotebook, diffDQL, diffNotebook, domainFolderSlug, previewModelingChange, applyModelingChange, previewDbtSourcePatch, applyDbtSourcePatch, loadDomainPackageRegistry, loadDbtNodeAuthoringDetail, relationshipValidationProofFingerprint, discoverDbtDomains, renderDomainDeclaration, ProjectSnapshotService, analyzeSqlReferences, } from '@duckcodeailabs/dql-core';
+import { loadSemanticLayerFromDir, normalizeDqlArtifactReference, serializeMetricDefinitionToYaml, resolveSemanticLayerAsync, resolveRepoSource, getDialect, Parser, NodeKind, blockParameterDefinitions, buildLineageGraph, buildManifest, collectInputFiles, findAppDocuments, findDashboardsForApp, isBlockIdRef, loadAppDocument, loadDashboardDocument, analyzeImpact, buildTrustChain, detectDomainFlows, getDomainTrustOverview, queryLineage, queryBusiness360, queryCompleteLineagePaths, LineageGraph, canonicalize, canonicalizeNotebook, diffDQL, diffNotebook, domainFolderSlug, previewModelingChange, applyModelingChange, previewDbtSourcePatch, applyDbtSourcePatch, loadDomainPackageRegistry, loadDbtNodeAuthoringDetail, relationshipValidationProofFingerprint, discoverDbtDomains, renderDomainDeclaration, ProjectSnapshotService, analyzeSqlReferences, } from '@duckcodeailabs/dql-core';
 import { load as loadYaml } from 'js-yaml';
 import { listBlockTemplates } from './block-templates.js';
 import { getRunner as getLLMRunner } from './llm/index.js';
 import { createDqlAgentProviderRunner } from './llm/providers/dql-agent-provider.js';
 import { listRemoteMcpSettings, saveRemoteMcpSettings } from './llm/mcp-config.js';
-import { ClaudeProvider, ConversationStore, advanceThreadState, buildConversationSnapshot, recallRelevantTurns, GeminiProvider, MemoryStore, OllamaProvider, OpenAIProvider, buildBlockBusinessFingerprint, buildBlockSqlFingerprints, buildLocalContextPack, defaultConversationPath, defaultMemoryPath, ensureDefaultMemoryFiles, ensureMetadataCatalogFresh, propose, proposePlan, recordCorrectionTrace, emitCorrectionEvalCase, mineJoinPatterns, reviewHint, AgentRunEngine, FileAgentRunStore, defaultAgentRunGates, createLlmAgentRunPlanner, createHybridRouter, computeResultStats, synthesizeAnswer, streamOrGenerate, narrateResult, normalizeAnthropicBaseUrl, buildProposePreview, buildFromPrompt, defaultAgentRunStorePath, resolveLocalOwner, resolveProposeConfig, recordQueryRun, recordRuntimeSchemaSnapshot, latestRuntimeSchemaSnapshotForProject, loadSkills, migrateLegacySkills, draftDomainSkillBootstrap, buildDomainSkillBootstrapPrompt, mergeDomainSkillBootstrapEnrichment, writeSkill, deleteSkill, deriveGeneratedDraftSlug, reindexProject, invalidateAgentProjectState, resolveDomainContextEnvelope, defaultKgPath, planApp, planResearch, loadSemanticMetrics, cascadeTraceToEvidenceRouteSteps, createCascadeAnswerResult, createCascadeTrace, routeReasoningEffort, routeForCascadeAnswerTier, clampReasoningEffort, bumpReasoningEffort, resolveThinkingMode, coerceThinkingMode, probeLocalOllamaEmbeddings, upsertGeneratedDqlArtifactDraft, } from '@duckcodeailabs/dql-agent';
+import { ClaudeProvider, ConversationStore, advanceThreadState, buildConversationSnapshot, recallRelevantTurns, GeminiProvider, MemoryStore, OllamaProvider, OpenAIProvider, buildBlockBusinessFingerprint, buildBlockSqlFingerprints, buildLocalContextPack, defaultConversationPath, defaultMemoryPath, ensureDefaultMemoryFiles, ensureMetadataCatalogFresh, propose, proposePlan, recordCorrectionTrace, emitCorrectionEvalCase, mineJoinPatterns, reviewHint, AgentRunEngine, FileAgentRunStore, defaultAgentRunGates, createLlmAgentRunPlanner, createHybridRouter, computeResultStats, buildDeterministicDashboardStory, synthesizeAnswer, streamOrGenerate, narrateResult, buildProposePreview, buildFromPrompt, defaultAgentRunStorePath, resolveLocalOwner, resolveProposeConfig, recordQueryRun, recordRuntimeSchemaSnapshot, latestRuntimeSchemaSnapshotForProject, loadSkills, migrateLegacySkills, configuredSkillsPath, skillsDir, draftDomainSkillBootstrap, buildDomainSkillBootstrapPrompt, mergeDomainSkillBootstrapEnrichment, writeSkill, deleteSkill, deriveGeneratedDraftSlug, reindexProject, invalidateAgentProjectState, resolveDomainContextEnvelope, defaultKgPath, planAppFromPrompt, KGStore, planResearch, loadSemanticMetrics, cascadeTraceToEvidenceRouteSteps, createCascadeAnswerResult, createCascadeTrace, routeReasoningEffort, routeForCascadeAnswerTier, clampReasoningEffort, bumpReasoningEffort, resolveThinkingMode, coerceThinkingMode, probeLocalOllamaEmbeddings, upsertGeneratedDqlArtifactDraft, } from '@duckcodeailabs/dql-agent';
 import { gatherProposeEnrichment } from './propose-enrich.js';
 import { handleAppsApi, proposeAppAiBuild, recommendVisualization } from './apps-api.js';
 import { getActiveProvider, getEffectiveProviderConfig, isProviderSettingsId, listProviderSettings, saveProviderSettings, } from './settings/provider-settings.js';
@@ -351,6 +351,21 @@ function compactConversationRecord(record) {
 function apiRequestId(scope) {
     return `${scope}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
 }
+/** UI-007 / E2E-005: report the installed CLI version that owns this runtime. */
+export function readDqlRuntimeVersion(runtimeUrl = import.meta.url) {
+    const runtimeDir = dirname(fileURLToPath(runtimeUrl));
+    for (const packagePath of [join(runtimeDir, 'package.json'), join(runtimeDir, '../package.json')]) {
+        try {
+            const parsed = JSON.parse(readFileSync(packagePath, 'utf-8'));
+            if (typeof parsed.version === 'string' && parsed.version.trim())
+                return parsed.version.trim();
+        }
+        catch {
+            // Source and published layouts place package.json at different levels.
+        }
+    }
+    return 'unknown';
+}
 function apiErrorEnvelope(input) {
     return {
         requestId: input.requestId,
@@ -377,6 +392,7 @@ export async function startLocalServer(opts) {
     const bindHost = opts.host ?? process.env.DQL_HOST ?? '127.0.0.1';
     const loopback = bindHost === '127.0.0.1' || bindHost === 'localhost' || bindHost === '::1';
     const authToken = opts.authToken ?? process.env.DQL_SERVER_TOKEN;
+    const runtimeVersion = readDqlRuntimeVersion();
     const allowedOrigins = new Set((opts.allowedOrigins ?? (process.env.DQL_ALLOWED_ORIGINS ?? '').split(','))
         .map((value) => value.trim().replace(/\/$/, ''))
         .filter(Boolean));
@@ -389,13 +405,19 @@ export async function startLocalServer(opts) {
     const gitRoot = await resolveGitRoot(projectRoot);
     if (gitRoot)
         ensureLocalRuntimeGitignore(projectRoot);
-    let connection = rawConnection ? normalizeProjectConnection(rawConnection, projectRoot) : null;
     let projectConfig = loadProjectConfig(projectRoot);
+    const configuredConnection = rawConnection
+        ? normalizeProjectConnection(rawConnection, projectRoot)
+        : projectConfig.defaultConnection
+            ? normalizeProjectConnection(projectConfig.defaultConnection, projectRoot)
+            : null;
+    let connection = configuredConnection ?? resolveDbtProfileRuntimeConnection(projectRoot, projectConfig);
     const projectSnapshots = new ProjectSnapshotService();
+    const dashboardRunEvidence = new Map();
     const dbtNodeDetailCache = new Map();
     const onboardingJobs = new Map();
     const projectSnapshot = () => {
-        const dbtManifestPath = resolveDbtManifestPath(projectRoot) ?? undefined;
+        const dbtManifestPath = resolveDbtManifestPath(projectRoot, projectConfig) ?? undefined;
         const inputs = collectInputFiles({ projectRoot, dbtManifestPath });
         const signatureHash = createHash('sha256');
         for (const input of inputs.sort()) {
@@ -421,14 +443,26 @@ export async function startLocalServer(opts) {
         };
     };
     const onboardingDbtPaths = (body = {}) => {
-        const projectDirInput = typeof body.projectDir === 'string' ? body.projectDir : projectConfig.dbt?.projectDir ?? '.';
+        const repoUrl = typeof body.repoUrl === 'string' && body.repoUrl.trim() ? body.repoUrl.trim() : undefined;
+        const branch = typeof body.branch === 'string' && body.branch.trim() ? body.branch.trim() : undefined;
+        const subPath = typeof body.subPath === 'string' && body.subPath.trim() ? body.subPath.trim() : undefined;
+        const repo = repoUrl ? resolveRepoSource({
+            provider: 'dbt', source: repoUrl.includes('gitlab') ? 'gitlab' : 'github', repoUrl, branch, subPath,
+        }, projectRoot) : undefined;
+        const projectDirInput = repo?.localPath ?? (typeof body.projectDir === 'string' ? body.projectDir : projectConfig.dbt?.projectDir ?? '.');
         const dbtProjectDir = resolve(projectRoot, projectDirInput);
         const manifestInput = typeof body.manifestPath === 'string' ? body.manifestPath : projectConfig.dbt?.manifestPath ?? 'target/manifest.json';
         const manifestPath = resolve(dbtProjectDir, manifestInput);
         if (!(manifestPath === dbtProjectDir || manifestPath.startsWith(`${dbtProjectDir}/`))) {
             throw Object.assign(new Error('dbt manifestPath must stay inside dbt projectDir.'), { code: 'DBT_ARTIFACT_INVALID' });
         }
-        return { dbtProjectDir, manifestPath, projectDirInput, manifestInput };
+        const profilesDirInput = typeof body.profilesDir === 'string'
+            ? body.profilesDir
+            : projectConfig.dbt?.profilesDir;
+        const configuredProfilesDir = profilesDirInput ? resolve(projectRoot, profilesDirInput) : undefined;
+        const profilePath = findDbtProfilePaths(projectRoot, dbtProjectDir, configuredProfilesDir)[0];
+        const profilesDir = configuredProfilesDir ?? (profilePath ? dirname(profilePath) : undefined);
+        return { dbtProjectDir, manifestPath, projectDirInput, manifestInput, profilesDir, repoUrl, branch, subPath, repoWarnings: repo?.warnings ?? [] };
     };
     const previewDbtOnboarding = (body = {}) => {
         const paths = onboardingDbtPaths(body);
@@ -445,8 +479,11 @@ export async function startLocalServer(opts) {
         }
         const fingerprint = createHash('sha256').update(readFileSync(paths.manifestPath)).digest('hex');
         return {
-            projectDir: relative(projectRoot, paths.dbtProjectDir).replace(/\\/g, '/') || '.',
+            projectDir: portableProjectPath(projectRoot, paths.dbtProjectDir),
             manifestPath: relative(paths.dbtProjectDir, paths.manifestPath).replace(/\\/g, '/'),
+            ...(paths.profilesDir ? { profilesDir: portableProjectPath(projectRoot, paths.profilesDir) } : {}),
+            ...(paths.repoUrl ? { repoUrl: paths.repoUrl, branch: paths.branch, subPath: paths.subPath } : {}),
+            ...(paths.repoWarnings.length ? { warnings: paths.repoWarnings } : {}),
             fingerprint,
             projectName: typeof raw.metadata?.project_name === 'string' ? raw.metadata.project_name : undefined,
             counts: {
@@ -1900,17 +1937,19 @@ export async function startLocalServer(opts) {
             // A real app needs a certified anchor: only offer confirmation when at least
             // one certified tile is present. Otherwise fall through to the escalate path
             // (research / draft the missing blocks) so the user isn't sent to a dead end.
-            const proposed = Boolean(proposal && proposal.tiles.some((tile) => tile.certification === 'certified' && !tile.error));
+            const proposed = Boolean(proposal && proposal.tiles.some((tile) => (tile.certification === 'certified' || tile.certification === 'reviewed_semantic') && !tile.error));
             const sessionPlan = agentRunRecord(session.plan);
             const appTitle = agentRunString(sessionPlan?.name) ?? 'App proposal';
             const certifiedCount = proposal?.coverage.certifiedTiles ?? 0;
             const generatedCount = proposal?.coverage.generatedTiles ?? 0;
+            const semanticCount = proposal?.coverage.semanticTiles ?? 0;
             const gapCount = proposal?.coverage.gaps ?? 0;
             // A coverage gap is NOT terminal — leave status open so the gate can escalate to
             // drafting the missing blocks. Only genuine infra errors (the catch above) block.
             return {
                 summary: proposed
                     ? `Proposed ${certifiedCount} certified tile${certifiedCount === 1 ? '' : 's'}`
+                        + (semanticCount > 0 ? ` + ${semanticCount} reviewed semantic tile${semanticCount === 1 ? '' : 's'}` : '')
                         + (generatedCount > 0 ? ` + ${generatedCount} AI-generated (review required)` : '')
                         + (gapCount > 0 ? `; ${gapCount} question${gapCount === 1 ? '' : 's'} still uncovered` : '')
                         + '. Review the list and confirm to create the app.'
@@ -1924,6 +1963,7 @@ export async function startLocalServer(opts) {
                         dashboardId: session.dashboardId,
                         plan: session.plan,
                         proposal,
+                        proposalHash: session.proposalHash,
                         warnings: session.warnings,
                     }, session.appId)] : [],
                 evaluations: [
@@ -3385,13 +3425,44 @@ export async function startLocalServer(opts) {
         }
         if (req.method === 'GET' && path === '/api/health') {
             res.writeHead(200, { 'Content-Type': 'application/json; charset=utf-8' });
-            res.end(serializeJSON({ status: 'ok' }));
+            res.end(serializeJSON({ status: 'ok', version: runtimeVersion }));
+            return;
+        }
+        if (req.method === 'GET' && path === '/api/onboarding/launch') {
+            const requestId = apiRequestId('onboarding-launch');
+            const acknowledgedVersion = readUserPrefs(userPrefsPath).setup?.acknowledgedVersion ?? null;
+            const shouldOpen = acknowledgedVersion !== runtimeVersion;
+            res.writeHead(200, { 'Content-Type': 'application/json; charset=utf-8' });
+            res.end(serializeJSON({
+                requestId,
+                version: runtimeVersion,
+                acknowledgedVersion,
+                shouldOpen,
+                reason: shouldOpen ? (acknowledgedVersion ? 'version_upgrade' : 'first_install') : null,
+            }));
+            return;
+        }
+        if (req.method === 'POST' && path === '/api/onboarding/acknowledge') {
+            const requestId = apiRequestId('onboarding-acknowledge');
+            const prefs = readUserPrefs(userPrefsPath);
+            prefs.setup = {
+                acknowledgedVersion: runtimeVersion,
+                acknowledgedAt: new Date().toISOString(),
+            };
+            writeUserPrefs(userPrefsPath, prefs);
+            res.writeHead(200, { 'Content-Type': 'application/json; charset=utf-8' });
+            res.end(serializeJSON({ requestId, version: runtimeVersion, acknowledged: true }));
             return;
         }
         if (req.method === 'GET' && path === '/api/onboarding/status') {
             const requestId = apiRequestId('onboarding-status');
-            const dbtProjectDir = resolve(projectRoot, projectConfig.dbt?.projectDir ?? '.');
+            const dbtProjectDir = findDbtProjectPath(projectRoot, projectConfig);
             const manifestPath = resolve(dbtProjectDir, projectConfig.dbt?.manifestPath ?? 'target/manifest.json');
+            const configuredDbtSource = projectConfig.dbt?.repoUrl ?? projectConfig.dbt?.projectDir;
+            const dbtConfigured = existsSync(join(dbtProjectDir, 'dbt_project.yml'))
+                || Boolean(configuredDbtSource && !/\{\{[^}]+\}\}/.test(configuredDbtSource));
+            const configuredProfilesDir = projectConfig.dbt?.profilesDir ? resolve(projectRoot, projectConfig.dbt.profilesDir) : undefined;
+            const profilePath = findDbtProfilePaths(projectRoot, dbtProjectDir, configuredProfilesDir)[0];
             const registry = loadDomainPackageRegistry(projectRoot);
             const manifestFound = existsSync(manifestPath);
             let snapshotId;
@@ -3409,9 +3480,15 @@ export async function startLocalServer(opts) {
                 requestId,
                 snapshotId,
                 dbt: {
-                    configured: Boolean(projectConfig.dbt),
+                    configured: dbtConfigured,
                     projectDir: projectConfig.dbt?.projectDir,
                     manifestPath: projectConfig.dbt?.manifestPath,
+                    profilesDir: configuredProfilesDir
+                        ? portableProjectPath(projectRoot, configuredProfilesDir)
+                        : profilePath ? portableProjectPath(projectRoot, dirname(profilePath)) : undefined,
+                    repoUrl: projectConfig.dbt?.repoUrl,
+                    branch: projectConfig.dbt?.branch,
+                    subPath: projectConfig.dbt?.subPath,
                     projectFound: existsSync(join(dbtProjectDir, 'dbt_project.yml')),
                     manifestFound,
                 },
@@ -3457,7 +3534,9 @@ export async function startLocalServer(opts) {
                         throw error;
                     const { dbtProjectDir } = onboardingDbtPaths(body);
                     try {
-                        execFileSync('dbt', ['parse', '--project-dir', dbtProjectDir], {
+                        const { profilesDir } = onboardingDbtPaths(body);
+                        const parseArgs = buildDbtParseArgs(dbtProjectDir, profilesDir);
+                        execFileSync('dbt', parseArgs, {
                             cwd: dbtProjectDir,
                             timeout: 120_000,
                             maxBuffer: 1024 * 1024,
@@ -3483,16 +3562,24 @@ export async function startLocalServer(opts) {
                     ...projectConfig,
                     manifestVersion: 3,
                     modeling: { mode: 'dbt-first' },
-                    dbt: { projectDir: preview.projectDir, manifestPath: preview.manifestPath },
+                    dbt: {
+                        projectDir: preview.projectDir,
+                        manifestPath: preview.manifestPath,
+                        ...(preview.profilesDir ? { profilesDir: preview.profilesDir } : {}),
+                        ...(preview.repoUrl ? { repoUrl: preview.repoUrl, branch: preview.branch, subPath: preview.subPath } : {}),
+                    },
                     semanticLayer: { provider: 'dbt', projectPath: preview.projectDir },
                 };
                 const configPath = join(projectRoot, 'dql.config.json');
                 const previousConfigSource = readFileSync(configPath, 'utf8');
                 const previousProjectConfig = projectConfig;
+                const previousConnection = connection;
                 const tempPath = `${configPath}.tmp-${process.pid}`;
                 writeFileSync(tempPath, `${JSON.stringify(nextConfig, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 });
                 renameSync(tempPath, configPath);
                 projectConfig = nextConfig;
+                if (!configuredConnection)
+                    connection = resolveDbtProfileRuntimeConnection(projectRoot, nextConfig);
                 projectSnapshots.invalidate();
                 invalidateAgentProjectState(projectRoot);
                 let snapshotId;
@@ -3504,6 +3591,7 @@ export async function startLocalServer(opts) {
                     writeFileSync(rollbackPath, previousConfigSource, { encoding: 'utf8', mode: 0o600 });
                     renameSync(rollbackPath, configPath);
                     projectConfig = previousProjectConfig;
+                    connection = previousConnection;
                     projectSnapshots.invalidate();
                     invalidateAgentProjectState(projectRoot);
                     throw Object.assign(new Error(`dbt-first configuration did not compile and was rolled back: ${error instanceof Error ? error.message : String(error)}`), { code: 'SNAPSHOT_BUILD_FAILED' });
@@ -3722,11 +3810,64 @@ export async function startLocalServer(opts) {
         // provenance references and the sparse DQL overlay, never copied dbt YAML.
         if (req.method === 'GET' && path === '/api/modeling/dbt-first') {
             const requestId = apiRequestId('modeling-dbt-first');
-            const snapshot = projectSnapshot();
+            const modelingEnabled = projectConfig.manifestVersion === 3 && projectConfig.modeling?.mode === 'dbt-first';
+            if (!modelingEnabled) {
+                res.writeHead(404, { 'Content-Type': 'application/json; charset=utf-8' });
+                res.end(serializeJSON(apiErrorEnvelope({
+                    requestId,
+                    code: 'DBT_FIRST_NOT_ENABLED',
+                    message: 'dbt-first modeling is not enabled. Connect and apply a dbt project from Settings → Project & dbt.',
+                    details: {
+                        manifestVersion: projectConfig.manifestVersion ?? 2,
+                        modelingMode: projectConfig.modeling?.mode ?? null,
+                    },
+                    nextActions: ['Open Settings → Project & dbt and apply a valid dbt project.'],
+                })));
+                return;
+            }
+            const dbtProjectDir = findDbtProjectPath(projectRoot, projectConfig);
+            const configuredManifestPath = projectConfig.dbt?.manifestPath ?? 'target/manifest.json';
+            const expectedManifestPath = resolve(dbtProjectDir, configuredManifestPath);
+            if (!existsSync(expectedManifestPath)) {
+                res.writeHead(409, { 'Content-Type': 'application/json; charset=utf-8' });
+                res.end(serializeJSON(apiErrorEnvelope({
+                    requestId,
+                    code: 'DBT_MANIFEST_NOT_FOUND',
+                    message: `The configured dbt manifest was not found at ${configuredManifestPath}.`,
+                    details: {
+                        projectDir: projectConfig.dbt?.projectDir ?? portableProjectPath(projectRoot, dbtProjectDir),
+                        manifestPath: configuredManifestPath,
+                    },
+                    nextActions: ['Run dbt parse, dbt compile, or dbt build in the configured dbt project, then refresh Domain Studio.'],
+                })));
+                return;
+            }
+            let snapshot;
+            try {
+                snapshot = projectSnapshot();
+            }
+            catch (error) {
+                res.writeHead(422, { 'Content-Type': 'application/json; charset=utf-8' });
+                res.end(serializeJSON(apiErrorEnvelope({
+                    requestId,
+                    code: 'DBT_MANIFEST_COMPILE_FAILED',
+                    message: apiErrorMessage(error),
+                    details: { manifestPath: configuredManifestPath },
+                    nextActions: ['Fix or rebuild the dbt manifest, then refresh Domain Studio.'],
+                })));
+                return;
+            }
             const manifest = snapshot.manifest;
             if (manifest.manifestVersion !== 3 || !manifest.modeling || !manifest.dbtProvenance) {
-                res.writeHead(404, { 'Content-Type': 'application/json; charset=utf-8' });
-                res.end(serializeJSON(apiErrorEnvelope({ requestId, snapshotId: snapshot.snapshotId, code: 'DBT_FIRST_NOT_ENABLED', message: 'dbt-first modeling is not enabled. Set manifestVersion: 3 and modeling.mode: "dbt-first" in dql.config.json.', nextActions: ['Use Setup to connect dbt and enable dbt-first modeling.'] })));
+                res.writeHead(422, { 'Content-Type': 'application/json; charset=utf-8' });
+                res.end(serializeJSON(apiErrorEnvelope({
+                    requestId,
+                    snapshotId: snapshot.snapshotId,
+                    code: 'DBT_MANIFEST_COMPILE_FAILED',
+                    message: snapshot.error ?? 'DQL could not compile Domain Studio from the configured dbt manifest.',
+                    details: { manifestPath: configuredManifestPath },
+                    nextActions: ['Review the dbt artifact and DQL compile diagnostics, rebuild the dbt manifest, then refresh Domain Studio.'],
+                })));
                 return;
             }
             res.writeHead(200, { 'Content-Type': 'application/json; charset=utf-8' });
@@ -4446,6 +4587,52 @@ export async function startLocalServer(opts) {
         // ── Skills (spec 16) — user-authored business context. AI drafts, humans
         //    certify; skills never carry certification. PROJECT skills (user empty)
         //    are shared; PERSONAL skills (user set) are user-bound. ────────────────
+        if (req.method === 'GET' && path === '/api/skills/settings') {
+            try {
+                res.writeHead(200, { 'Content-Type': 'application/json; charset=utf-8' });
+                res.end(serializeJSON(buildSkillPathSettings(projectRoot)));
+            }
+            catch (error) {
+                res.writeHead(500, { 'Content-Type': 'application/json; charset=utf-8' });
+                res.end(serializeJSON({ error: error instanceof Error ? error.message : String(error) }));
+            }
+            return;
+        }
+        if (req.method === 'PUT' && path === '/api/skills/settings') {
+            try {
+                const body = (await readJSON(req).catch(() => ({})));
+                const requestedPath = typeof body.path === 'string' ? body.path.trim() : '';
+                if (!requestedPath || requestedPath.includes('\0')) {
+                    res.writeHead(400, { 'Content-Type': 'application/json; charset=utf-8' });
+                    res.end(serializeJSON({ error: 'Provide an existing Skills folder path.' }));
+                    return;
+                }
+                const resolvedPath = resolve(projectRoot, requestedPath);
+                if (!existsSync(resolvedPath) || !statSync(resolvedPath).isDirectory()) {
+                    res.writeHead(400, { 'Content-Type': 'application/json; charset=utf-8' });
+                    res.end(serializeJSON({ error: `Skills folder not found: ${resolvedPath}` }));
+                    return;
+                }
+                const configPath = join(projectRoot, 'dql.config.json');
+                const raw = existsSync(configPath)
+                    ? JSON.parse(readFileSync(configPath, 'utf-8'))
+                    : {};
+                const layout = raw.layout && typeof raw.layout === 'object' && !Array.isArray(raw.layout)
+                    ? raw.layout
+                    : {};
+                raw.layout = { ...layout, skillsPath: requestedPath };
+                writeFileSync(configPath, `${JSON.stringify(raw, null, 2)}\n`, 'utf-8');
+                projectConfig = loadProjectConfig(projectRoot);
+                invalidateAgentProjectState(projectRoot);
+                res.writeHead(200, { 'Content-Type': 'application/json; charset=utf-8' });
+                res.end(serializeJSON(buildSkillPathSettings(projectRoot)));
+            }
+            catch (error) {
+                res.writeHead(500, { 'Content-Type': 'application/json; charset=utf-8' });
+                res.end(serializeJSON({ error: error instanceof Error ? error.message : String(error) }));
+            }
+            return;
+        }
         if (req.method === 'GET' && path === '/api/skills') {
             try {
                 const skills = loadSkills(projectRoot).skills
@@ -5148,6 +5335,33 @@ export async function startLocalServer(opts) {
             }
             return;
         }
+        const appStoryRun = path.match(/^\/api\/apps\/([^/]+)\/dashboards\/([^/]+)\/story$/);
+        if (req.method === 'POST' && appStoryRun) {
+            const body = await readJSON(req).catch(() => ({}));
+            const runId = typeof body.runId === 'string' ? body.runId : '';
+            const evidence = dashboardRunEvidence.get(runId);
+            const appId = decodeURIComponent(appStoryRun[1]);
+            const dashboardId = decodeURIComponent(appStoryRun[2]);
+            if (!evidence || evidence.expiresAt < Date.now() || evidence.appId !== appId || evidence.dashboardId !== dashboardId) {
+                dashboardRunEvidence.delete(runId);
+                res.writeHead(404, { 'Content-Type': 'application/json; charset=utf-8' });
+                res.end(serializeJSON({ error: 'Dashboard run evidence expired or does not match this App. Run the dashboard again.' }));
+                return;
+            }
+            // The endpoint accepts runId only. Optional provider wording can be added
+            // here later; the claim-checked deterministic brief is always available.
+            res.writeHead(200, { 'Content-Type': 'application/json; charset=utf-8' });
+            res.end(serializeJSON({
+                runId,
+                snapshotId: evidence.snapshotId,
+                filterFingerprint: evidence.filterFingerprint,
+                resultFingerprint: evidence.resultFingerprint,
+                personaFingerprint: evidence.personaFingerprint,
+                facts: evidence.facts,
+                story: evidence.story,
+            }));
+            return;
+        }
         const appDashRun = path.match(/^\/api\/apps\/([^/]+)\/dashboards\/([^/]+)\/run$/);
         if (req.method === 'POST' && appDashRun) {
             try {
@@ -5160,6 +5374,12 @@ export async function startLocalServer(opts) {
                     res.end(serializeJSON({ error: `Dashboard "${dashboardId}" not found in app "${appId}"` }));
                     return;
                 }
+                const activeApp = activePersonaAppId();
+                if (activeApp && activeApp !== appId) {
+                    res.writeHead(403, { 'Content-Type': 'application/json; charset=utf-8' });
+                    res.end(serializeJSON({ error: `The active persona belongs to App "${activeApp}", not "${appId}".` }));
+                    return;
+                }
                 const manifest = buildManifest({ projectRoot });
                 const variables = body.variables && typeof body.variables === 'object'
                     ? body.variables
@@ -5258,6 +5478,70 @@ export async function startLocalServer(opts) {
                         });
                         continue;
                     }
+                    if (item.semantic) {
+                        try {
+                            if (!semanticLayer)
+                                throw new Error('Semantic layer is not available for this governed query.');
+                            const knownMetrics = new Set(semanticLayer.listMetrics().map((metric) => metric.name));
+                            const missingMetrics = item.semantic.metrics.filter((metric) => !knownMetrics.has(metric));
+                            if (missingMetrics.length)
+                                throw new Error(`Semantic definition changed; missing metric(s): ${missingMetrics.join(', ')}`);
+                            const knownModels = new Set(semanticLayer.listSemanticModels().map((model) => model.name));
+                            const missingModels = item.semantic.semanticModelRefs.filter((model) => !knownModels.has(model));
+                            if (missingModels.length)
+                                throw new Error(`Semantic definition changed; missing model(s): ${missingModels.join(', ')}`);
+                            const targetConnection = requireActiveConnection(isConnectionConfig(body.connection) ? body.connection : connection);
+                            const tableMapping = await resolveSemanticTableMapping(executor, targetConnection, semanticLayer);
+                            const activeFilters = Object.entries(dashboardVariables)
+                                .filter(([field, value]) => item.semantic.dimensions?.includes(field) && value !== undefined && value !== null && value !== '')
+                                .map(([dimension, value]) => ({ dimension, operator: 'equals', values: Array.isArray(value) ? value.map(String) : [String(value)] }));
+                            const staticFilters = (item.semantic.filters ?? []).map((filter) => ({
+                                dimension: filter.field,
+                                operator: filter.operator,
+                                values: Array.isArray(filter.value) ? filter.value.map(String) : [String(filter.value)],
+                            }));
+                            const composed = composeRuntimeSemanticQuery({
+                                metrics: item.semantic.metrics,
+                                dimensions: item.semantic.dimensions ?? [],
+                                filters: [...staticFilters, ...activeFilters],
+                                ...(item.semantic.timeDimension ? { timeDimension: { name: item.semantic.timeDimension, granularity: 'month' } } : {}),
+                                orderBy: item.semantic.orderBy?.map((order) => ({ name: order.field, direction: order.direction })),
+                                limit: item.semantic.limit,
+                                engine: item.semantic.provider,
+                            }, semanticLayer, {
+                                projectRoot,
+                                projectConfig,
+                                detectedProvider: semanticDetectedProvider,
+                                driver: targetConnection.driver,
+                                tableMapping,
+                            });
+                            if (!composed)
+                                throw new Error('The governed semantic query could not be composed.');
+                            const prepared = prepareLocalExecution(composed.sql, targetConnection, projectRoot, projectConfig);
+                            const result = await executor.executeQuery(prepared.sql, [], {}, prepared.connection);
+                            tiles.push({
+                                tileId: item.i,
+                                status: 'ok',
+                                tileType: 'semantic',
+                                title: item.title ?? item.semantic.id,
+                                viz: item.viz,
+                                result: normalizeQueryResult(result),
+                                trustState: 'review_required',
+                                citation: { kind: 'semantic_query', name: item.semantic.id },
+                            });
+                        }
+                        catch (err) {
+                            tiles.push({
+                                tileId: item.i,
+                                status: 'error',
+                                tileType: 'semantic',
+                                title: item.title ?? item.semantic.id,
+                                error: err instanceof Error ? err.message : String(err),
+                                trustState: 'review_required',
+                            });
+                        }
+                        continue;
+                    }
                     const block = resolveDashboardItemBlock(item, manifest);
                     if (!block) {
                         tiles.push({
@@ -5381,12 +5665,55 @@ export async function startLocalServer(opts) {
                     }
                 }
                 localApps?.close();
+                const snapshot = projectSnapshot();
+                const filterFingerprint = createHash('sha256').update(JSON.stringify(dashboardVariables)).digest('hex');
+                const resultFingerprint = createHash('sha256').update(JSON.stringify(tiles.map((tile) => ({ tileId: tile.tileId, status: tile.status, result: tile.result })))).digest('hex');
+                const personaFingerprint = createHash('sha256').update(activePersonaAppId() ?? 'global').digest('hex');
+                const runId = `app_run_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`;
+                const storyResult = buildDeterministicDashboardStory({
+                    goal: loaded.dashboard.story?.goal ?? loaded.dashboard.metadata.businessOutcome ?? loaded.dashboard.metadata.title,
+                    audience: loaded.dashboard.story?.audience ?? loaded.dashboard.metadata.audience,
+                    filters: dashboardVariables,
+                    tiles: tiles.map((tile) => ({
+                        tileId: tile.tileId,
+                        title: typeof tile.title === 'string' ? tile.title : tile.tileId,
+                        status: tile.status,
+                        trustState: (tile.trustState === 'certified' || tile.trustState === 'review_required' || tile.trustState === 'draft_ready'
+                            ? tile.trustState
+                            : tile.certificationStatus === 'certified' ? 'certified' : 'review_required'),
+                        result: tile.result,
+                        citation: tile.citation,
+                    })),
+                    eligibleTileIds: loaded.dashboard.story?.eligibleTileIds,
+                    driverTileIds: loaded.dashboard.story?.driverTileIds,
+                });
+                dashboardRunEvidence.set(runId, {
+                    appId,
+                    dashboardId,
+                    snapshotId: snapshot.snapshotId,
+                    filterFingerprint,
+                    resultFingerprint,
+                    personaFingerprint,
+                    facts: storyResult.facts,
+                    story: storyResult.story,
+                    expiresAt: Date.now() + 15 * 60_000,
+                });
+                for (const [id, evidence] of dashboardRunEvidence)
+                    if (evidence.expiresAt < Date.now())
+                        dashboardRunEvidence.delete(id);
                 res.writeHead(200, { 'Content-Type': 'application/json; charset=utf-8' });
                 res.end(serializeJSON({
                     appId,
                     dashboardId,
                     persona: activePersonaAppId() ? { appId: activePersonaAppId() } : null,
+                    runId,
+                    snapshotId: snapshot.snapshotId,
+                    filterFingerprint,
+                    resultFingerprint,
+                    personaFingerprint,
                     tiles,
+                    facts: storyResult.facts,
+                    story: storyResult.story,
                 }));
             }
             catch (err) {
@@ -6691,16 +7018,26 @@ export async function startLocalServer(opts) {
                     res.end(serializeJSON({ error: 'goal is required' }));
                     return;
                 }
-                const certifiedOnly = body.certifiedOnly !== false;
-                const metrics = loadSemanticMetrics(projectRoot);
-                let blocks = collectPlanBlocks(projectRoot, { certifiedOnly });
-                // If nothing is certified yet, fall back to all drafts so the plan still
-                // shows what COULD be assembled (every section then reads as a gap to certify).
-                if (blocks.length === 0 && certifiedOnly)
-                    blocks = collectPlanBlocks(projectRoot, { certifiedOnly: false });
-                const plan = await planApp({ goal, metrics, blocks });
+                const snapshot = projectSnapshot();
+                const kgPath = defaultKgPath(projectRoot);
+                await reindexProject(projectRoot, { kgPath, manifest: snapshot.manifest });
+                const kg = new KGStore(kgPath);
+                let plan;
+                try {
+                    plan = planAppFromPrompt({
+                        prompt: goal,
+                        kg,
+                        domain: typeof body.domain === 'string' ? body.domain : undefined,
+                        audience: typeof body.audience === 'string' ? body.audience : undefined,
+                        mode: body.mode === 'personal' ? 'personal' : 'stakeholder',
+                        snapshotId: snapshot.snapshotId,
+                    });
+                }
+                finally {
+                    kg.close();
+                }
                 res.writeHead(200, { 'Content-Type': 'application/json; charset=utf-8' });
-                res.end(serializeJSON({ plan, blockCount: blocks.length, metricCount: metrics.length, certifiedOnly }));
+                res.end(serializeJSON({ plan, snapshotId: snapshot.snapshotId }));
             }
             catch (error) {
                 res.writeHead(500, { 'Content-Type': 'application/json; charset=utf-8' });
@@ -7595,9 +7932,35 @@ export async function startLocalServer(opts) {
                 ?? Object.keys(connections)[0]
                 ?? 'default';
             const dbtProfiles = discoverDbtProfileConnections(projectRoot, cfg);
+            const activeDbtProfile = dbtProfiles.find((candidate) => candidate.missingFields.length === 0
+                && !candidate.warnings.some((warning) => warning.startsWith('DuckDB file not found'))
+                && !candidate.warnings.some((warning) => warning.startsWith('Not the default dbt target')));
+            const activeConnection = connection ? {
+                source: Object.keys(connections).length > 0 ? 'dql_config' : activeDbtProfile ? 'dbt_profile' : 'runtime',
+                driver: connection.driver,
+                ...(Object.keys(connections).length === 0 && activeDbtProfile ? { profileId: activeDbtProfile.id } : {}),
+            } : null;
             const connectorStatus = getConnectorInstallStatuses(projectRoot);
             res.writeHead(200, { 'Content-Type': 'application/json; charset=utf-8' });
-            res.end(serializeJSON({ default: defaultKey, connections, dbtProfiles, connectorStatus }));
+            res.end(serializeJSON({ default: defaultKey, connections, dbtProfiles, activeConnection, connectorStatus }));
+            return;
+        }
+        if (req.method === 'POST' && path === '/api/connections/dbt-profiles/preview') {
+            const body = await readJSON(req).catch(() => ({}));
+            const profilePath = typeof body.path === 'string' ? body.path.trim() : '';
+            if (!profilePath) {
+                res.writeHead(400, { 'Content-Type': 'application/json; charset=utf-8' });
+                res.end(serializeJSON({ error: 'Enter a profiles.yml file or folder path.' }));
+                return;
+            }
+            const dbtProfiles = discoverDbtProfileConnections(projectRoot, loadProjectConfig(projectRoot), profilePath);
+            if (dbtProfiles.length === 0) {
+                res.writeHead(404, { 'Content-Type': 'application/json; charset=utf-8' });
+                res.end(serializeJSON({ error: 'No supported dbt profile targets were found at that path.' }));
+                return;
+            }
+            res.writeHead(200, { 'Content-Type': 'application/json; charset=utf-8' });
+            res.end(serializeJSON({ dbtProfiles }));
             return;
         }
         if (req.method === "GET" && path === "/api/datasets") {
@@ -10080,7 +10443,7 @@ export function resolveDefaultLLMProvider(projectRoot) {
     const preferred = ['openai', 'gemini', 'anthropic', 'custom-openai', 'ollama'];
     for (const id of preferred) {
         const provider = settings.find((item) => item.id === id);
-        if (provider?.enabled && provider.hasApiKey)
+        if (provider?.enabled && provider.configured)
             return id;
     }
     return null;
@@ -10663,6 +11026,18 @@ export function loadProjectConfig(projectRoot) {
     }
     return config;
 }
+/** Current Git-backed Skills folder and what the loader can read from it. */
+export function buildSkillPathSettings(projectRoot) {
+    const resolvedPath = skillsDir(projectRoot);
+    const loaded = loadSkills(projectRoot);
+    return {
+        path: configuredSkillsPath(projectRoot),
+        resolvedPath,
+        exists: existsSync(resolvedPath) && statSync(resolvedPath).isDirectory(),
+        skillCount: loaded.skills.filter((skill) => skill.scope === 'project').length,
+        errorCount: loaded.errors.length,
+    };
+}
 function dbtFirstOwnsSemanticAuthoring(config) {
     return config.manifestVersion === 3 && config.modeling?.mode === 'dbt-first';
 }
@@ -11502,7 +11877,8 @@ function installConnectorPackage(projectRoot, driver) {
             description: 'Project-local DQL connector packages',
         }, null, 2) + '\n', 'utf-8');
     }
-    execFileSync('npm', ['install', '--prefix', installRoot, '--no-audit', '--no-fund', definition.packageSpec], {
+    const npm = resolveNpmInvocation();
+    execFileSync(npm.command, [...npm.argsPrefix, 'install', '--prefix', installRoot, '--no-audit', '--no-fund', definition.packageSpec], {
         cwd: projectRoot,
         encoding: 'utf-8',
         stdio: 'pipe',
@@ -12709,9 +13085,18 @@ function readUserPrefs(userPrefsPath) {
             return { favorites: [], recentlyUsed: [] };
         }
         const raw = JSON.parse(readFileSync(userPrefsPath, 'utf-8'));
+        const acknowledgedVersion = typeof raw.setup?.acknowledgedVersion === 'string'
+            ? raw.setup.acknowledgedVersion.trim()
+            : '';
         return {
             favorites: Array.isArray(raw.favorites) ? raw.favorites.map(String) : [],
             recentlyUsed: Array.isArray(raw.recentlyUsed) ? raw.recentlyUsed.map(String) : [],
+            ...(acknowledgedVersion ? {
+                setup: {
+                    acknowledgedVersion,
+                    ...(typeof raw.setup?.acknowledgedAt === 'string' ? { acknowledgedAt: raw.setup.acknowledgedAt } : {}),
+                },
+            } : {}),
         };
     }
     catch {
@@ -15187,7 +15572,7 @@ async function createBlockStudioAssistProvider(projectRoot, requestedProvider) {
     const activeProvider = getActiveProvider(projectRoot);
     // Subscription CLI providers (Claude Code / Codex) carry no API key — they're
     // usable when enabled; their real "installed + logged in" check runs in available().
-    const isUsable = (provider) => provider.enabled && (provider.hasApiKey || provider.authMode === 'subscription_cli');
+    const isUsable = (provider) => provider.enabled && provider.configured;
     const selected = requestedProvider
         ? settings.find((provider) => provider.id === requestedProvider && isUsable(provider))
         : settings.find((provider) => provider.id === activeProvider && provider.enabled)
@@ -16202,15 +16587,23 @@ function resolveDbtManifestPath(projectRoot, projectConfig = {}) {
     candidates.push(join(projectRoot, 'target', 'manifest.json'), join(resolve(projectRoot, '..'), 'target', 'manifest.json'), join(resolve(projectRoot, '../dbt'), 'target', 'manifest.json'), join(resolve(projectRoot, '../../dbt'), 'target', 'manifest.json'));
     return candidates.find((candidate, index, list) => list.indexOf(candidate) === index && existsSync(candidate));
 }
-export function discoverDbtProfileConnections(projectRoot, projectConfig) {
+export function discoverDbtProfileConnections(projectRoot, projectConfig, explicitPath) {
     const dbtProjectPath = findDbtProjectPath(projectRoot, projectConfig);
-    const projectProfileName = readDbtProjectProfileName(dbtProjectPath);
-    const profilePaths = findDbtProfilePaths(projectRoot, dbtProjectPath);
+    const projectProfileName = explicitPath ? null : readDbtProjectProfileName(dbtProjectPath);
+    const configuredProfilesDir = projectConfig.dbt?.profilesDir
+        ? resolve(projectRoot, projectConfig.dbt.profilesDir)
+        : undefined;
+    const profilePaths = explicitPath
+        ? findExplicitDbtProfilePaths(projectRoot, explicitPath)
+        : findDbtProfilePaths(projectRoot, dbtProjectPath, configuredProfilesDir);
     const candidates = [];
     for (const profilePath of profilePaths) {
         const profiles = readYamlFile(profilePath);
         if (!profiles)
             continue;
+        const profileRelativeBase = explicitPath && existsSync(join(dirname(profilePath), 'dbt_project.yml'))
+            ? dirname(profilePath)
+            : dbtProjectPath;
         for (const [profileName, rawProfile] of Object.entries(profiles)) {
             if (!rawProfile || typeof rawProfile !== 'object')
                 continue;
@@ -16234,7 +16627,7 @@ export function discoverDbtProfileConnections(projectRoot, projectConfig) {
                     mapped.connection.filepath &&
                     mapped.connection.filepath !== ':memory:') {
                     if (!isAbsoluteLikePath(mapped.connection.filepath)) {
-                        mapped.connection.filepath = resolve(dbtProjectPath, mapped.connection.filepath);
+                        mapped.connection.filepath = resolve(profileRelativeBase, mapped.connection.filepath);
                     }
                     if (!existsSync(mapped.connection.filepath)) {
                         mapped.warnings.push(`DuckDB file not found at ${mapped.connection.filepath} — run \`dbt build\` (or \`dbt seed\`) to create it before querying.`);
@@ -16259,6 +16652,21 @@ export function discoverDbtProfileConnections(projectRoot, projectConfig) {
     }
     return candidates.slice(0, 20);
 }
+export function buildDbtParseArgs(dbtProjectDir, profilesDir) {
+    return [
+        'parse',
+        '--project-dir', dbtProjectDir,
+        ...(profilesDir ? ['--profiles-dir', profilesDir] : []),
+    ];
+}
+/** CFG-003: use a complete default dbt target when no saved DQL connection exists. */
+export function resolveDbtProfileRuntimeConnection(projectRoot, projectConfig) {
+    const candidates = discoverDbtProfileConnections(projectRoot, projectConfig);
+    const complete = candidates.filter((candidate) => candidate.missingFields.length === 0
+        && !candidate.warnings.some((warning) => warning.startsWith('DuckDB file not found')));
+    const defaultTarget = complete.find((candidate) => !candidate.warnings.some((warning) => warning.startsWith('Not the default dbt target')));
+    return defaultTarget?.connection ?? (complete.length === 1 ? complete[0].connection : null);
+}
 function findDbtProjectPath(projectRoot, projectConfig) {
     const configuredDbtDir = projectConfig.dbt?.projectDir
         ? resolve(projectRoot, projectConfig.dbt.projectDir)
@@ -16279,8 +16687,18 @@ function findDbtProjectPath(projectRoot, projectConfig) {
         ?? semanticDbtDir
         ?? projectRoot;
 }
-function findDbtProfilePaths(projectRoot, dbtProjectPath) {
+function portableProjectPath(projectRoot, absolutePath) {
+    const normalizedAbsolute = resolve(absolutePath).replace(/\\/g, '/');
+    const relativePath = relative(projectRoot, absolutePath).replace(/\\/g, '/');
+    return !relativePath
+        ? '.'
+        : relativePath === '..' || relativePath.startsWith('../')
+            ? normalizedAbsolute
+            : relativePath;
+}
+function findDbtProfilePaths(projectRoot, dbtProjectPath, configuredProfilesDir) {
     const dirs = [
+        configuredProfilesDir,
         process.env.DBT_PROFILES_DIR,
         dbtProjectPath,
         projectRoot,
@@ -16288,7 +16706,7 @@ function findDbtProfilePaths(projectRoot, dbtProjectPath) {
     ].filter((value) => Boolean(value));
     const paths = [];
     for (const dir of dirs) {
-        for (const filename of ['profiles.yml', 'profiles.yaml']) {
+        for (const filename of ['profiles.yml', 'profiles.yaml', 'profile.yml', 'profile.yaml']) {
             const profilePath = resolve(dir, filename);
             if (existsSync(profilePath) && !paths.includes(profilePath)) {
                 paths.push(profilePath);
@@ -16297,6 +16715,24 @@ function findDbtProfilePaths(projectRoot, dbtProjectPath) {
     }
     return paths;
 }
+function findExplicitDbtProfilePaths(projectRoot, input) {
+    const trimmed = input.trim();
+    if (!trimmed)
+        return [];
+    const expanded = trimmed === '~'
+        ? homedir()
+        : trimmed.startsWith('~/')
+            ? join(homedir(), trimmed.slice(2))
+            : trimmed;
+    const absolute = resolve(projectRoot, expanded);
+    if (!existsSync(absolute))
+        return [];
+    if (!statSync(absolute).isDirectory())
+        return [absolute];
+    return ['profiles.yml', 'profiles.yaml', 'profile.yml', 'profile.yaml']
+        .map((filename) => join(absolute, filename))
+        .filter((profilePath) => existsSync(profilePath));
+}
 function readDbtProjectProfileName(dbtProjectPath) {
     const projectFile = join(dbtProjectPath, 'dbt_project.yml');
     const projectYaml = readYamlFile(projectFile);
@@ -16904,7 +17340,12 @@ async function readGitStatus(cwd) {
         behind = Number(match[0] ?? 0);
         ahead = Number(match[1] ?? 0);
     }
-    const statusRes = await execGit(gitRoot, ['status', '--porcelain=v1', '--untracked-files=normal']);
+    // UI-001, E2E-001: the Source Control surface is file-oriented. Git's
+    // "normal" untracked mode collapses a new directory into a single `?? dir/`
+    // record, which prevents the UI from showing or diffing the files inside it.
+    // Enumerate every untracked path so tracked and untracked changes share the
+    // same per-file review contract.
+    const statusRes = await execGit(gitRoot, ['status', '--porcelain=v1', '--untracked-files=all']);
     const changes = [];
     if (statusRes.code === 0) {
         for (const line of statusRes.stdout.split('\n')) {
@@ -17556,7 +17997,11 @@ async function testProviderConfig(projectRoot, id, overrides) {
     const base = getEffectiveProviderConfig(projectRoot, id);
     // When the user supplies inline values (testing what they typed before saving),
     // merge them over the saved config and test reachability regardless of enabled.
-    const inline = Boolean(overrides && (overrides.apiKey || overrides.baseUrl || overrides.model));
+    // The test route always passes an override object, even when every draft field
+    // is blank. That still means "test this candidate before save" and must allow
+    // a previously configured-but-disabled provider to be reactivated without
+    // forcing the user to paste its redacted secret again.
+    const inline = overrides !== undefined;
     const config = {
         ...base,
         ...(overrides?.apiKey ? { apiKey: overrides.apiKey } : {}),
@@ -17636,15 +18081,19 @@ async function testOpenAIProviderConfig(config, label, details) {
         return { ok: false, message: `${label} is not configured${details}. Add an API key in Settings or OPENAI_API_KEY.` };
     }
     try {
-        const client = new OpenAI({ apiKey: config.apiKey, baseURL: config.baseUrl });
-        const response = await client.responses.create({
-            model: config.model ?? 'gpt-5.5',
-            input: 'Reply with exactly: OK',
-            max_output_tokens: 16,
+        // Use the same provider adapter as governed Ask so enterprise gateways are
+        // tested against the runtime path users will actually execute.
+        const provider = new OpenAIProvider({
+            apiKey: config.apiKey,
+            baseUrl: config.baseUrl,
+            model: config.model,
         });
+        const response = await provider.generate([
+            { role: 'user', content: 'Reply with exactly: OK' },
+        ], { maxTokens: 16, temperature: 0 });
         return {
             ok: true,
-            message: `${label} SDK responded${details}: ${(response.output_text ?? 'OK').trim().slice(0, 80) || 'OK'}`,
+            message: `${label} responded through the governed runtime${details}: ${response.trim().slice(0, 80) || 'OK'}`,
         };
     }
     catch (error) {
@@ -17659,20 +18108,17 @@ async function testAnthropicProviderConfig(config, label, details) {
         return { ok: false, message: `${label} is not configured${details}. Add an API key in Settings or ANTHROPIC_API_KEY.` };
     }
     try {
-        const client = new Anthropic({
+        const provider = new ClaudeProvider({
             apiKey: config.apiKey,
-            ...(config.baseUrl ? { baseURL: normalizeAnthropicBaseUrl(config.baseUrl) } : {}),
+            baseUrl: config.baseUrl,
+            model: config.model,
         });
-        const response = await client.messages.create({
-            model: config.model ?? 'claude-opus-4-8',
-            max_tokens: 16,
-            temperature: 0,
-            messages: [{ role: 'user', content: 'Reply with exactly: OK' }],
-        });
-        const text = response.content?.filter((block) => block.type === 'text').map((block) => block.text ?? '').join('') ?? '';
+        const response = await provider.generate([
+            { role: 'user', content: 'Reply with exactly: OK' },
+        ], { maxTokens: 16, temperature: 0 });
         return {
             ok: true,
-            message: `${label} SDK responded${details}: ${text.trim().slice(0, 80) || 'OK'}`,
+            message: `${label} responded through the governed runtime${details}: ${response.trim().slice(0, 80) || 'OK'}`,
         };
     }
     catch (error) {