@ebrindley/build 0.0.0-stage → 1.42.1-rc28

package/dist/chunk-ES6NWJ36.js

@@ -0,0 +1,4057 @@
+import {
+  getWorktreeManager
+} from "./chunk-57WRCJJW.js";
+import {
+  isPathSafeIdentifier,
+  parseArtifactRef
+} from "./chunk-SK3ZFONO.js";
+import {
+  decideDistRebuild,
+  resolveDistOwnership,
+  writeDistBuildStamp
+} from "./chunk-WKFOJ5ZG.js";
+import {
+  normalizeProviderForEstimator
+} from "./chunk-VJER3FUS.js";
+import {
+  findInstalledDependencyDrift
+} from "./chunk-BIUV23HH.js";
+import {
+  isProviderFailureKeptRecord
+} from "./chunk-UJYDH2MW.js";
+import {
+  validateCompetitionJudgeConfig
+} from "./chunk-EJVCDTAN.js";
+import {
+  extractCreateAnnotatedFilePaths,
+  parseFileDirectiveLines
+} from "./chunk-ETA2K4KI.js";
+import {
+  getProviderHealth
+} from "./chunk-CRPRVNQ4.js";
+import {
+  isValidCheckPath,
+  validateCompletionContracts
+} from "./chunk-MCBNWZNO.js";
+import {
+  getBucketPathByKind
+} from "./chunk-V3KLVK7B.js";
+import {
+  applyFlywheelModelDefaults
+} from "./chunk-DSRLVYBS.js";
+import {
+  WORKTREE_RECORD_RECOVERY_REASON,
+  getProjectRoot,
+  getWorktreeRecordsByStatus,
+  listManifests,
+  reconcileAndSaveManifest,
+  updateWorktreeRecordStatus
+} from "./chunk-6TRD7TEE.js";
+import {
+  signalCoordinator
+} from "./chunk-GC4CRMTS.js";
+import {
+  resolveDefaultProvider
+} from "./chunk-C3DH3NCY.js";
+import {
+  getProviderReadiness
+} from "./chunk-XTXYIISX.js";
+import {
+  pruneGitWorktreeEntries
+} from "./chunk-33IGPPUI.js";
+import {
+  WorktreeCleanupManager
+} from "./chunk-UPHU64NB.js";
+import {
+  filterWorktreeRunSentinelStatusOutput,
+  isActiveRun,
+  withCleanupLock
+} from "./chunk-2NMNFUQA.js";
+import {
+  tryRemoveWorktreeNestedAware
+} from "./chunk-UJP3XM54.js";
+import {
+  ModelMetadataResolver,
+  findOpencodeFallbackContextWindow,
+  getOpencodeCatalogEntry,
+  isExactCompatibilityMatch,
+  resolveOpencodeContextWindow
+} from "./chunk-YVCMDVBB.js";
+import {
+  assertSafePathComponent
+} from "./chunk-S2VQCZO4.js";
+import {
+  stripBuildContextBlocks
+} from "./chunk-KUEWV2JH.js";
+import {
+  classifyBranchRole,
+  isProtectedPipelineBranch
+} from "./chunk-XGU6PBO5.js";
+import {
+  buildBranchKindPrefix,
+  buildVariantBranchPrefixes,
+  isBuildOwnedBranch,
+  runChildBranchTargets,
+  sanitizeRefPart
+} from "./chunk-F55YABKV.js";
+import {
+  summarizeRepoPaths
+} from "./chunk-RBBTBCHX.js";
+import {
+  checkVerifyCommandSafety
+} from "./chunk-AHU3FKPA.js";
+import {
+  isDualContainedInManagedRoots,
+  safeRmDir
+} from "./chunk-ALDTFNZ3.js";
+import {
+  parsePorcelainLinePaths
+} from "./chunk-5KQETTNS.js";
+import {
+  splitClaudeModelContextSuffix
+} from "./chunk-H3HGMISG.js";
+import {
+  execGit
+} from "./chunk-MHLEZQQI.js";
+import {
+  ProviderRegistry
+} from "./chunk-QJ6OEH4K.js";
+import {
+  isJsonOutputRequested,
+  isQuietOutputRequested,
+  isVerboseOutputRequested
+} from "./chunk-XWIZ6B5S.js";
+import {
+  GIT_COMMAND_TIMEOUT_MS
+} from "./chunk-I56TH7VM.js";
+import {
+  WORKTREE_HYGIENE_MAX_MANIFESTS_PER_PASS,
+  WORKTREE_HYGIENE_MAX_RECOVERY_RECORDS_PER_PASS,
+  WORKTREE_HYGIENE_MAX_RETAINED_TOTAL_BYTES,
+  WORKTREE_HYGIENE_MAX_RETENTION_COLLATION,
+  WORKTREE_HYGIENE_MAX_RETENTION_PRUNE_OPS,
+  getBuildFlywheelManifestsRoot,
+  getBuildRepoWorktreePoolRoot,
+  getWorktreeBaseDir
+} from "./chunk-Z5WGNULV.js";
+
+// src/automation/flywheel-preflight.ts
+import { appendFileSync, existsSync as existsSync2, readFileSync } from "fs";
+import * as fs3 from "fs/promises";
+import os2 from "os";
+import * as path4 from "path";
+import { fileURLToPath } from "url";
+import chalk from "chalk";
+import { execa as execa2 } from "execa";
+
+// src/orchestrator/token-estimator.ts
+var UTILIZATION_WARN_PERCENT = 80;
+var UTILIZATION_SPLIT_PERCENT = 85;
+var CONTEXT_WINDOWS = {
+  // Provider marker for normalization; Claude context windows return early
+  // through ProviderRegistry so model metadata stays in providers.yaml.
+  claude: {},
+  // Provider marker for normalization; Codex context windows return early
+  // through ProviderRegistry so model metadata stays in providers.yaml.
+  codex: {},
+  // Compatibility-only estimator bucket for OpenAI-family model names.
+  // This is not a runnable Build provider; Codex owns OpenAI-backed CLI execution.
+  openai: {},
+  // Provider marker for normalization; Gemini context windows return early
+  // through ProviderRegistry so model metadata stays in providers.yaml.
+  gemini: {},
+  // Provider marker for normalization; Cursor context windows resolve through
+  // ProviderRegistry first and keep conservative fallbacks for legacy aliases.
+  cursor: {},
+  // Provider marker for normalization; OpenCode context windows return early
+  // through the provider catalog so runtime and estimator share one fallback table.
+  opencode: {},
+  // Provider marker for normalization; Copilot context windows return early
+  // through ProviderRegistry, with legacy fallbacks for removed aliases.
+  copilot: {},
+  // Provider marker for normalization; Grok context windows resolve through
+  // ModelMetadataResolver (config override, harness window, model maximum).
+  // Grok is not an OpenAI-tokenizer provider, so it uses the generic heuristic.
+  grok: {}
+};
+function lookupProviderEntry(table, provider) {
+  return Object.hasOwn(table, provider) ? table[provider] : void 0;
+}
+function isKnownEstimatorProviderInput(provider) {
+  const normalizedProvider = (provider || "").toLowerCase().trim();
+  if (!normalizedProvider) return false;
+  if (normalizedProvider in CONTEXT_WINDOWS) return true;
+  return ESTIMATOR_PROVIDER_ALIASES.has(normalizedProvider);
+}
+var DEFAULT_CONTEXT_WINDOW = 128e3;
+var GPT_FAMILY = "gpt";
+var CLAUDE_FAMILY = "claude";
+var ESTIMATOR_PROVIDER_ALIASES = /* @__PURE__ */ new Set(["anthropic", "google", "github", "opencode"]);
+var OPENAI_TOKENIZER_PROVIDERS = /* @__PURE__ */ new Set([
+  "codex",
+  "openai",
+  "copilot"
+]);
+var CLAUDE_TOKENIZER_PROVIDERS = /* @__PURE__ */ new Set(["claude"]);
+var GPT_4_TIKTOKEN_MODEL = [GPT_FAMILY, "4"].join("-");
+var GPT_4_TURBO_MODEL = [GPT_FAMILY, "4", "turbo"].join("-");
+var GPT_4_TURBO_PREVIEW_TIKTOKEN_MODEL = [GPT_FAMILY, "4", "turbo", "preview"].join("-");
+var GPT_4O_TIKTOKEN_MODEL = `${GPT_FAMILY}-4o`;
+var GPT_4O_MINI_TIKTOKEN_MODEL = `${GPT_FAMILY}-4o-mini`;
+var GPT_3_5_TURBO_TIKTOKEN_MODEL = `${GPT_FAMILY}-3.5-turbo`;
+var GPT_3_5_TIKTOKEN_ALIAS = `${GPT_FAMILY}-3.5`;
+var GPT_5_TIKTOKEN_ALIAS = [GPT_FAMILY, "5"].join("-");
+var GPT_5_CODEX_MINI_TIKTOKEN_ALIAS = [GPT_FAMILY, "5", "codex", "mini"].join("-");
+var CLAUDE_OPUS_4_1_COMPAT_MODEL = [CLAUDE_FAMILY, "opus", "4", "1"].join("-");
+var CLAUDE_3_OPUS_COMPAT_MODEL = [CLAUDE_FAMILY, "3", "opus"].join("-");
+var CLAUDE_3_SONNET_COMPAT_MODEL = [CLAUDE_FAMILY, "3", "sonnet"].join("-");
+var CLAUDE_3_HAIKU_COMPAT_MODEL = [CLAUDE_FAMILY, "3", "haiku"].join("-");
+var CLAUDE_LEGACY_CONTEXT_WINDOWS = {
+  [CLAUDE_OPUS_4_1_COMPAT_MODEL]: 2e5,
+  "sonnet-4": 2e5,
+  "sonnet-3-5": 2e5,
+  "sonnet-3": 2e5,
+  [CLAUDE_3_OPUS_COMPAT_MODEL]: 2e5,
+  [CLAUDE_3_SONNET_COMPAT_MODEL]: 2e5,
+  [CLAUDE_3_HAIKU_COMPAT_MODEL]: 2e5
+};
+var CODEX_LEGACY_CONTEXT_WINDOWS = {
+  codex: 8e3
+};
+var COPILOT_LEGACY_CONTEXT_WINDOWS = {
+  [GPT_4_TIKTOKEN_MODEL]: 128e3,
+  [GPT_3_5_TURBO_TIKTOKEN_MODEL]: 16e3
+};
+function normalizeModelKey(model) {
+  return model.trim().toLowerCase();
+}
+function findFallbackContextWindowMatch(model, windows) {
+  const normalizedModel = normalizeModelKey(model);
+  if (normalizedModel === "") {
+    return void 0;
+  }
+  const exactMatch = windows[normalizedModel];
+  if (exactMatch !== void 0) {
+    return { contextWindow: exactMatch, exact: true };
+  }
+  for (const [knownModel, contextWindow] of Object.entries(windows)) {
+    if (normalizedModel.includes(knownModel) || knownModel.includes(normalizedModel)) {
+      return { contextWindow, exact: false };
+    }
+  }
+  return void 0;
+}
+var DEFAULT_CHARS_PER_TOKEN = 4;
+var HEURISTIC_CHARS_PER_TOKEN = {
+  // Gemini uses similar tokenization to GPT-4 (~4 chars per token)
+  gemini: 4
+};
+var MODEL_CONFIDENCE_RESOLVERS = {
+  openai: (_provider, model) => getOpenAiCompatibilityConfidence(model) ?? 0.3,
+  opencode: (_provider, model) => getOpencodeCatalogConfidence(model) ?? 0.3,
+  cursor: (_provider, model) => normalizeModelKey(model) === "auto" ? 0.8 : void 0,
+  claude: (provider, model) => {
+    const legacyConfidence = getLegacyContextConfidence(model, CLAUDE_LEGACY_CONTEXT_WINDOWS);
+    if (legacyConfidence === 1) {
+      return legacyConfidence;
+    }
+    const registryConfidence = getProviderRegistryModelConfidence(provider, model);
+    if (registryConfidence !== void 0) {
+      return registryConfidence;
+    }
+    return legacyConfidence;
+  },
+  codex: (_provider, model) => CODEX_LEGACY_CONTEXT_WINDOWS[normalizeModelKey(model)] !== void 0 ? 0.9 : void 0,
+  copilot: (provider, model) => {
+    const exactLegacyConfidence = COPILOT_LEGACY_CONTEXT_WINDOWS[normalizeModelKey(model)] !== void 0 ? 0.9 : void 0;
+    if (exactLegacyConfidence !== void 0) {
+      return exactLegacyConfidence;
+    }
+    const registryConfidence = getProviderRegistryModelConfidence(provider, model);
+    if (registryConfidence !== void 0) {
+      return registryConfidence;
+    }
+    return getLegacyContextConfidence(model, COPILOT_LEGACY_CONTEXT_WINDOWS, 0.9) ?? 0.3;
+  }
+};
+var CONTEXT_WINDOW_RESOLVERS = {
+  opencode: (model) => resolveOpencodeContextWindow(model, DEFAULT_CONTEXT_WINDOW),
+  claude: (model) => {
+    const baseModel = splitClaudeModelContextSuffix(model).base;
+    return CLAUDE_LEGACY_CONTEXT_WINDOWS[normalizeModelKey(baseModel)];
+  },
+  codex: (model) => CODEX_LEGACY_CONTEXT_WINDOWS[normalizeModelKey(model)],
+  copilot: (model) => COPILOT_LEGACY_CONTEXT_WINDOWS[normalizeModelKey(model)]
+};
+var PROVIDER_OVERHEAD_PROFILES = {
+  claude: {
+    systemPromptTokens: 1500,
+    outputReservePercent: 0.3
+    // 30% for Claude's verbose outputs
+  },
+  codex: {
+    systemPromptTokens: 800,
+    outputReservePercent: 0.25
+  },
+  openai: {
+    systemPromptTokens: 800,
+    outputReservePercent: 0.25
+  },
+  gemini: {
+    systemPromptTokens: 1e3,
+    outputReservePercent: 0.25
+  },
+  cursor: {
+    systemPromptTokens: 1e3,
+    outputReservePercent: 0.25
+  },
+  opencode: {
+    systemPromptTokens: 1e3,
+    outputReservePercent: 0.25
+  },
+  copilot: {
+    systemPromptTokens: 800,
+    outputReservePercent: 0.25
+  },
+  grok: {
+    systemPromptTokens: 1e3,
+    outputReservePercent: 0.25
+  }
+};
+var GUESSED_MODEL_MATCH_CONFIDENCE = 0.4;
+function isGuessedModelMatch(resolved, substringMatched) {
+  if (!resolved) return false;
+  if (resolved.matchType === "fuzzy") return true;
+  return resolved.matchType === "fallback" && substringMatched;
+}
+function getProviderRegistryModelConfidence(provider, model) {
+  const resolved = ModelMetadataResolver.resolveModel(provider, model, { allowFuzzy: true });
+  if (!resolved) return void 0;
+  return resolved.matchType === "fuzzy" ? GUESSED_MODEL_MATCH_CONFIDENCE : 1;
+}
+function getLegacyContextConfidence(model, windows, exactConfidence = 1) {
+  const match = findFallbackContextWindowMatch(model, windows);
+  if (!match) {
+    return void 0;
+  }
+  return match.exact ? exactConfidence : GUESSED_MODEL_MATCH_CONFIDENCE;
+}
+function getOpenAiCompatibilityConfidence(model) {
+  const resolved = ModelMetadataResolver.resolveModel("openai", model, {
+    allowFallback: true,
+    allowFuzzy: true
+  });
+  if (!resolved) return void 0;
+  return isGuessedModelMatch(resolved, isExactCompatibilityMatch("openai", model) === false) ? GUESSED_MODEL_MATCH_CONFIDENCE : 1;
+}
+function getOpencodeCatalogConfidence(model) {
+  const catalogEntry = getOpencodeCatalogEntry(model);
+  if (catalogEntry.source === "registry") {
+    return 1;
+  }
+  const fallbackMatch = findOpencodeFallbackContextWindow(model);
+  if (fallbackMatch) {
+    return fallbackMatch.exact ? 0.9 : GUESSED_MODEL_MATCH_CONFIDENCE;
+  }
+  return void 0;
+}
+var DEFAULT_THRESHOLD_PERCENT = 0.65;
+var TokenEstimator = class {
+  // tiktoken is a declared dependency; assume available at runtime.
+  // estimateOpenAITokens / estimateClaudeTokens each contain their own try/catch
+  // that falls back to chars/4 or chars/3.5 if the dynamic import fails.
+  tiketokenAvailable = true;
+  encodingCache = /* @__PURE__ */ new Map();
+  /**
+   * Analyze task to determine if splitting is needed
+   *
+   * @param prompt - Task description
+   * @param provider - Target provider ID (e.g., 'claude', 'openai', or a config-defined provider)
+   * @param model - Target model (e.g., 'claude-sonnet-4-5', 'gpt-4')
+   * @returns Decomposition decision with token analysis
+   */
+  async analyzeTask(prompt, provider, model) {
+    const normalizedProvider = normalizeProviderForEstimator(provider, model);
+    const inputProviderKnown = isKnownEstimatorProviderInput(provider);
+    const promptForEstimation = stripBuildInjectedContext(prompt);
+    const estimatedTokens = await this.estimateTokens(
+      promptForEstimation,
+      normalizedProvider,
+      model
+    );
+    const contextWindow = this.getContextWindow(normalizedProvider, model);
+    const thresholdTokens = this.getRecommendedThreshold(normalizedProvider, model);
+    const overhead = this.getContextOverhead(normalizedProvider, model);
+    const utilizationPercent = estimatedTokens / contextWindow * 100;
+    const adjustedUtilizationPercent = (estimatedTokens + overhead.total) / contextWindow * 100;
+    const estimationConfidence = inputProviderKnown ? this.getModelConfidence(normalizedProvider, model) : 0.5;
+    const validationMetadata = this.computeValidationMetadata(
+      promptForEstimation,
+      utilizationPercent
+    );
+    if (utilizationPercent < 60) {
+      return {
+        shouldSplit: false,
+        reason: "within-threshold",
+        estimatedTokens,
+        contextWindow,
+        utilizationPercent,
+        thresholdTokens,
+        adjustedUtilizationPercent,
+        overhead,
+        estimationConfidence,
+        validationMetadata
+      };
+    }
+    const strategy = this.selectSplitStrategy(
+      promptForEstimation,
+      estimatedTokens,
+      thresholdTokens
+    );
+    return {
+      shouldSplit: true,
+      reason: "exceeds-threshold",
+      estimatedTokens,
+      contextWindow,
+      utilizationPercent,
+      thresholdTokens,
+      strategy,
+      adjustedUtilizationPercent,
+      overhead,
+      estimationConfidence,
+      validationMetadata
+    };
+  }
+  /**
+   * Compute validation metadata for autoloop gate selection
+   *
+   * Provides hints about quality gate policy based on task characteristics:
+   * - Simple tasks with low token utilization → deterministic gates only (fast CI)
+   * - Complex tasks or high utilization → all gates (comprehensive verification)
+   *
+   * @param prompt - Task description
+   * @param utilizationPercent - Context window utilization percentage
+   * @returns Validation metadata with policy recommendation
+   */
+  computeValidationMetadata(prompt, utilizationPercent) {
+    const rationale = [];
+    if (utilizationPercent < 40) {
+      rationale.push("Low complexity task (< 40% context usage)");
+      rationale.push("Recommend deterministic gates only for fast CI velocity");
+      return {
+        recommendedGatePolicy: "deterministic",
+        rationale
+      };
+    }
+    const complexitySignals = [
+      "refactor",
+      "architecture",
+      "breaking change",
+      "migration",
+      "security"
+    ];
+    const isComplex = complexitySignals.some(
+      (signal) => prompt.toLowerCase().includes(signal.toLowerCase())
+    );
+    if (isComplex || utilizationPercent >= 40) {
+      rationale.push(
+        isComplex ? "Complex task detected (refactor/architecture/migration)" : "High complexity task (\u2265 40% context usage)"
+      );
+      rationale.push("Recommend all gates for comprehensive verification");
+      return {
+        recommendedGatePolicy: "all",
+        rationale
+      };
+    }
+    rationale.push("Default to deterministic gates for CI velocity");
+    return {
+      recommendedGatePolicy: "deterministic",
+      rationale
+    };
+  }
+  /**
+   * Estimate token count for text
+   *
+   * @param text - Text to analyze
+   * @param provider - Target provider
+   * @param model - Target model
+   * @returns Estimated token count
+   */
+  async estimateTokens(text, provider, model) {
+    if (OPENAI_TOKENIZER_PROVIDERS.has(provider)) {
+      return this.estimateOpenAITokens(text, model);
+    }
+    if (CLAUDE_TOKENIZER_PROVIDERS.has(provider)) {
+      return this.estimateClaudeTokens(text, model);
+    }
+    const charsPerToken = lookupProviderEntry(HEURISTIC_CHARS_PER_TOKEN, provider) ?? DEFAULT_CHARS_PER_TOKEN;
+    return Math.ceil(text.length / charsPerToken);
+  }
+  /**
+   * Estimate tokens using OpenAI's tiktoken
+   * Falls back to character-based approximation if tiktoken unavailable
+   */
+  async estimateOpenAITokens(text, model) {
+    if (!this.tiketokenAvailable) {
+      return Math.ceil(text.length / 4);
+    }
+    try {
+      const { encoding_for_model } = await import("tiktoken");
+      const modelMap = {
+        [GPT_4_TIKTOKEN_MODEL]: GPT_4_TIKTOKEN_MODEL,
+        [GPT_4_TURBO_MODEL]: GPT_4_TURBO_PREVIEW_TIKTOKEN_MODEL,
+        [GPT_4O_TIKTOKEN_MODEL]: GPT_4O_TIKTOKEN_MODEL,
+        [GPT_4O_MINI_TIKTOKEN_MODEL]: GPT_4O_MINI_TIKTOKEN_MODEL,
+        [GPT_3_5_TURBO_TIKTOKEN_MODEL]: GPT_3_5_TURBO_TIKTOKEN_MODEL,
+        [GPT_3_5_TIKTOKEN_ALIAS]: GPT_3_5_TURBO_TIKTOKEN_MODEL,
+        [GPT_5_CODEX_MINI_TIKTOKEN_ALIAS]: GPT_4_TIKTOKEN_MODEL,
+        // Use GPT-4 tokenizer for Codex
+        [GPT_5_TIKTOKEN_ALIAS]: GPT_4_TIKTOKEN_MODEL,
+        codex: GPT_4_TIKTOKEN_MODEL
+      };
+      const tiketokenModel = modelMap[model] || GPT_4_TIKTOKEN_MODEL;
+      const cacheKey = tiketokenModel;
+      let encoding = this.encodingCache.get(cacheKey);
+      if (!encoding) {
+        encoding = encoding_for_model(
+          tiketokenModel
+        );
+        this.encodingCache.set(cacheKey, encoding);
+      }
+      const tokens = encoding.encode(text);
+      return tokens.length;
+    } catch {
+      return Math.ceil(text.length / 4);
+    }
+  }
+  /**
+   * Estimate tokens for Claude models using tiktoken cl100k_base.
+   * Falls back to chars/3.5 if tiktoken is unavailable.
+   */
+  async estimateClaudeTokens(text, _model) {
+    if (!this.tiketokenAvailable) {
+      return Math.ceil(text.length / 3.5);
+    }
+    try {
+      const { get_encoding } = await import("tiktoken");
+      const cacheKey = "cl100k_base";
+      let encoding = this.encodingCache.get(cacheKey);
+      if (!encoding) {
+        encoding = get_encoding("cl100k_base");
+        this.encodingCache.set(cacheKey, encoding);
+      }
+      const tokens = encoding.encode(text);
+      return tokens.length;
+    } catch {
+      return Math.ceil(text.length / 3.5);
+    }
+  }
+  /**
+   * Get confidence score for a provider and model
+   *
+   * @param provider - Provider ID
+   * @param model - Model identifier
+   * @returns Confidence score (0.0-1.0)
+   */
+  getModelConfidence(provider, model) {
+    const resolverConfidence = lookupProviderEntry(MODEL_CONFIDENCE_RESOLVERS, provider)?.(
+      provider,
+      model
+    );
+    if (resolverConfidence !== void 0) {
+      return resolverConfidence;
+    }
+    return getProviderRegistryModelConfidence(provider, model) ?? 0.3;
+  }
+  /**
+   * Get context window size for provider and model
+   *
+   * @param provider - Provider ID
+   * @param model - Model identifier
+   * @returns Context window in tokens
+   */
+  getContextWindow(provider, model) {
+    const resolvedWindow = lookupProviderEntry(CONTEXT_WINDOW_RESOLVERS, provider)?.(model);
+    if (resolvedWindow !== void 0) {
+      return resolvedWindow;
+    }
+    try {
+      return ModelMetadataResolver.getContextWindow(provider, model, {
+        allowFallback: true,
+        allowFuzzy: true
+      }) ?? DEFAULT_CONTEXT_WINDOW;
+    } catch {
+      return DEFAULT_CONTEXT_WINDOW;
+    }
+  }
+  /**
+   * Get recommended threshold in tokens (65% of context window)
+   *
+   * @param provider - Provider ID
+   * @param model - Model identifier
+   * @returns Recommended threshold in tokens
+   */
+  getRecommendedThreshold(provider, model) {
+    const contextWindow = this.getContextWindow(provider, model);
+    return Math.floor(contextWindow * DEFAULT_THRESHOLD_PERCENT);
+  }
+  /**
+   * Calculate context overhead for a provider and model
+   *
+   * Conservative overhead estimates:
+   * - Claude: 1500 tokens system, 30% output reserve
+   * - Codex/OpenAI: 800 tokens system, 25% output reserve
+   * - Gemini: 1000 tokens system, 25% output reserve
+   * - Other providers: 1000 tokens system, 25% output reserve
+   * - Always add 5% safety margin
+   *
+   * @param provider - Provider ID
+   * @param model - Model identifier
+   * @returns Token overhead breakdown
+   */
+  getContextOverhead(provider, model) {
+    const contextWindow = this.getContextWindow(provider, model);
+    const profile = lookupProviderEntry(PROVIDER_OVERHEAD_PROFILES, provider) || {
+      systemPromptTokens: 1e3,
+      outputReservePercent: 0.25
+    };
+    const systemPrompt = profile.systemPromptTokens;
+    const outputReservePercent = profile.outputReservePercent;
+    const outputReserve = Math.floor(contextWindow * outputReservePercent);
+    const safetyMargin = Math.floor(contextWindow * 0.05);
+    const total = systemPrompt + outputReserve + safetyMargin;
+    return {
+      systemPrompt,
+      outputReserve,
+      safetyMargin,
+      total
+    };
+  }
+  /**
+   * Select best split strategy based on task content and token count
+   *
+   * @param prompt - Task description
+   * @param estimatedTokens - Estimated token count
+   * @param threshold - Recommended threshold
+   * @returns Recommended split strategy
+   */
+  selectSplitStrategy(prompt, estimatedTokens, threshold) {
+    const sampleText = prompt.length > 5e3 ? prompt.slice(0, 5e3) : prompt;
+    const fileMatches = sampleText.match(
+      /([a-zA-Z0-9_\-/]+\.(?:ts|js|tsx|jsx|py|java|go|rs|cpp|c|h))\b/g
+    );
+    if (fileMatches && fileMatches.length > 1) {
+      return "file-based";
+    }
+    const firstLine = sampleText.split("\n")[0] || "";
+    const colonPattern = /^(.+?):\s*(.+)$/;
+    const colonMatch = firstLine.match(colonPattern);
+    if (colonMatch) {
+      const featureList = colonMatch[2] || "";
+      const features = featureList.split(/\s*,\s*|\s+and\s+/i);
+      if (features.length > 1) {
+        return "feature-based";
+      }
+    }
+    if (estimatedTokens > threshold * 2) {
+      return "sequential";
+    }
+    return "semantic";
+  }
+  /**
+   * Free cached encodings
+   */
+  cleanup() {
+    for (const encoding of this.encodingCache.values()) {
+      try {
+        encoding.free?.();
+      } catch {
+      }
+    }
+    this.encodingCache.clear();
+  }
+};
+function stripBuildInjectedContext(prompt) {
+  if (!prompt) return "";
+  let text = stripBuildContextBlocks(String(prompt));
+  const toolPolicySplit = text.split(/\n---\n\n/);
+  if (toolPolicySplit.length > 1 && /##\s*Tool Usage Policy/i.test(toolPolicySplit[0] ?? "")) {
+    text = toolPolicySplit.slice(1).join("\n---\n\n");
+  }
+  text = text.replace(/(^|\n)\s*FILE TARGETS:\s*\n(?:\s*[-•]\s+[^\n]+\n?)+/gi, "\n");
+  return text;
+}
+
+// src/utils/sync-stdout-io.ts
+import { execFileSync } from "child_process";
+import { accessSync, constants as fsConstants, fstatSync, statSync, writeSync } from "fs";
+var MAX_CONSECUTIVE_ZERO_BYTE_WRITES = 1e3;
+var TRUSTED_LSOF_PATHS = ["/usr/sbin/lsof", "/usr/bin/lsof"];
+function recordSyncWriteNoProgress(functionName, attempts) {
+  const nextAttempts = attempts + 1;
+  if (nextAttempts > MAX_CONSECUTIVE_ZERO_BYTE_WRITES) {
+    throw new Error(`${functionName} made no progress (repeated 0-byte writes or EAGAIN)`);
+  }
+  return nextAttempts;
+}
+function writeAllSyncToFd(fd, text, functionName = "writeAllSyncToFd") {
+  const buffer = Buffer.from(text, "utf8");
+  let offset = 0;
+  let noProgressAttempts = 0;
+  while (offset < buffer.length) {
+    try {
+      const written = writeSync(fd, buffer, offset, buffer.length - offset);
+      offset += written;
+      if (written === 0) {
+        noProgressAttempts = recordSyncWriteNoProgress(functionName, noProgressAttempts);
+      } else {
+        noProgressAttempts = 0;
+      }
+    } catch (error) {
+      if (error.code === "EAGAIN") {
+        noProgressAttempts = recordSyncWriteNoProgress(functionName, noProgressAttempts);
+        continue;
+      }
+      throw error;
+    }
+  }
+}
+function resolveTrustedLsofPath() {
+  for (const candidate of TRUSTED_LSOF_PATHS) {
+    try {
+      if (!statSync(candidate).isFile()) continue;
+      accessSync(candidate, fsConstants.X_OK);
+      return candidate;
+    } catch {
+    }
+  }
+  return void 0;
+}
+function resolveStdoutRegularFilePath() {
+  try {
+    const stat4 = fstatSync(1);
+    if (!stat4.isFile()) return void 0;
+  } catch {
+    return void 0;
+  }
+  const lsofPath = resolveTrustedLsofPath();
+  if (!lsofPath) return void 0;
+  try {
+    const output = execFileSync(lsofPath, ["-p", String(process.pid), "-a", "-d", "1", "-Fn"], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 1e3
+    });
+    const rawPath = output.split("\n").find((line) => line.startsWith("n/"))?.slice(1).replace(/ \(deleted\)$/, "");
+    if (!rawPath) return void 0;
+    const pathStat = statSync(rawPath);
+    return pathStat.isFile() ? rawPath : void 0;
+  } catch {
+    return void 0;
+  }
+}
+
+// src/automation/dist-entry-integrity.ts
+import * as fs from "fs/promises";
+import * as path from "path";
+function collectReferencedDistChunks(entrySource) {
+  const matches = entrySource.matchAll(
+    /(?:from\s+|import\()\s*['"]\.\/([^'"]+\.js(?:\.map)?)['"]/g
+  );
+  const chunks = /* @__PURE__ */ new Set();
+  for (const match of matches) {
+    const chunk = match[1];
+    if (!chunk || chunk === "entry.js") continue;
+    chunks.add(chunk);
+  }
+  return [...chunks];
+}
+async function readDistEntryIntegrity(projectRoot) {
+  let entrySource;
+  try {
+    entrySource = await fs.readFile(path.join(projectRoot, "dist", "entry.js"), "utf8");
+  } catch (error) {
+    return { readable: false, reason: error instanceof Error ? error.message : String(error) };
+  }
+  const missingChunks = [];
+  for (const relativeChunk of collectReferencedDistChunks(entrySource)) {
+    try {
+      await fs.stat(path.join(projectRoot, "dist", relativeChunk));
+    } catch {
+      missingChunks.push(relativeChunk);
+    }
+  }
+  return { readable: true, missingChunks };
+}
+
+// src/automation/flywheel-run-cleanup.ts
+import * as fs2 from "fs";
+import { stat as stat2 } from "fs/promises";
+import * as path3 from "path";
+import { execa } from "execa";
+
+// src/core/extensions/paths.ts
+import { mkdirSync } from "fs";
+import os from "os";
+import * as path2 from "path";
+function getDefaultExtensionsRootDir() {
+  return path2.join(os.homedir(), ".build", "extensions");
+}
+function getExtensionsRootDir() {
+  return process.env.BUILD_EXTENSIONS_DIR?.trim() || getDefaultExtensionsRootDir();
+}
+function getExtensionDirs(extensionId) {
+  const safeId = assertSafePathComponent(extensionId, "extensionId");
+  const rootDir = path2.join(getExtensionsRootDir(), safeId);
+  return {
+    id: safeId,
+    rootDir,
+    packageDir: path2.join(rootDir, "package"),
+    configDir: path2.join(rootDir, "config"),
+    dataDir: path2.join(rootDir, "data"),
+    cacheDir: path2.join(rootDir, "cache"),
+    logsDir: path2.join(rootDir, "logs"),
+    stateDir: path2.join(rootDir, "state")
+  };
+}
+function getBuildRepoWorktreePoolRoot2() {
+  return getBuildRepoWorktreePoolRoot();
+}
+function getBuildFlywheelWorkflowsRoot(projectRoot) {
+  return getBuildFlywheelManifestsRoot(projectRoot);
+}
+
+// src/automation/flywheel-run-cleanup.ts
+async function runAsyncWithOptionalTimeout(fn, timeoutMs, label) {
+  if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) {
+    return fn();
+  }
+  let timeoutId;
+  const timeoutPromise = new Promise((_, reject) => {
+    timeoutId = setTimeout(() => {
+      reject(new Error(`${label} timed out after ${timeoutMs}ms`));
+    }, timeoutMs);
+  });
+  try {
+    return await Promise.race([fn(), timeoutPromise]);
+  } finally {
+    if (timeoutId !== void 0) {
+      clearTimeout(timeoutId);
+    }
+  }
+}
+function resolvePrimaryWorktreePoolRoot() {
+  return path3.resolve(getBuildRepoWorktreePoolRoot2());
+}
+function resolveWorktreePoolRootViaFlywheelLayout() {
+  return path3.resolve(path3.join(getBuildFlywheelWorkflowsRoot(), "..", "worktrees"));
+}
+function getWorktreePoolPathRootsForHygiene() {
+  const primary = resolvePrimaryWorktreePoolRoot();
+  const viaFlywheel = resolveWorktreePoolRootViaFlywheelLayout();
+  return primary === viaFlywheel ? [primary] : [primary, viaFlywheel];
+}
+function isPathUnderWorktreePoolRoots(candidatePath, roots) {
+  const abs = path3.resolve(candidatePath.trim());
+  return roots.some((root) => abs === root || abs.startsWith(`${root}${path3.sep}`));
+}
+function getWorktreeCleanupProtectedPaths(extraPaths = []) {
+  return Array.from(
+    new Set(
+      [
+        getProjectRoot(),
+        getWorktreeBaseDir(),
+        ...getWorktreePoolPathRootsForHygiene(),
+        ...extraPaths
+      ].map((protectedPath) => path3.resolve(protectedPath))
+    )
+  );
+}
+function getWorktreeCleanupManagedRoots(extraRoots = []) {
+  return Array.from(
+    new Set(
+      [getWorktreeBaseDir(), ...getWorktreePoolPathRootsForHygiene(), ...extraRoots].map(
+        (managedRoot) => path3.resolve(managedRoot)
+      )
+    )
+  );
+}
+async function removeWorktreeDirectoryWithGuard(worktreePath, protectedPaths, managedRoots) {
+  const result = await safeRmDir(worktreePath, {
+    protectedPaths: Array.from(protectedPaths),
+    managedRoots: Array.from(managedRoots)
+  });
+  if (!result.deleted) {
+    throw new Error(result.reason ?? `Refusing to delete unsafe worktree path ${worktreePath}`);
+  }
+}
+async function roughDirectoryFootprintBytes(worktreePath) {
+  try {
+    const st = await stat2(worktreePath);
+    const blocks = typeof st.blocks === "number" && st.blocks > 0 ? st.blocks * 512 : 0;
+    return st.size + blocks;
+  } catch {
+    return 0;
+  }
+}
+function normalizeGitErrorText(error) {
+  const message = error instanceof Error ? error.message : String(error);
+  const stderr = error?.stderr ?? "";
+  return `${message}
+${stderr}`;
+}
+function isWorktreeMetadataGone(error, worktreePath) {
+  const text = normalizeGitErrorText(error);
+  return !fs2.existsSync(worktreePath) || /cwd option is invalid/i.test(text) || /no such file or directory/i.test(text) || /not a git repository/i.test(text) || /this operation must be run in a work tree/i.test(text) || /not a working tree/i.test(text) || /bad default revision/i.test(text) || /unknown revision or path/i.test(text) || /ambiguous argument.*HEAD/i.test(text);
+}
+function isNotAGitRepositoryError(error) {
+  const text = normalizeGitErrorText(error);
+  return /not a git repository/i.test(text) || /not a git repo/i.test(text) || /this operation must be run in a work tree/i.test(text);
+}
+function isBenignGitBranchDeleteError(error) {
+  const text = normalizeGitErrorText(error);
+  return /error: branch ['"][^'"]+['"] not found/i.test(text) || /couldn't find local branch/i.test(text) || /has already been deleted/i.test(text);
+}
+function getCleanupWorktreeManager(gitCwd) {
+  return getWorktreeManager({
+    baseDir: getWorktreeBaseDir(),
+    gitCwd,
+    enablePooling: false
+  });
+}
+function isManagedCleanupWorktreePath(worktreePath, gitCwd) {
+  const repoPools = [
+    path3.resolve(getWorktreeBaseDir(gitCwd)),
+    path3.resolve(gitCwd, ".build-project", "tmp", "worktrees")
+  ];
+  return isDualContainedInManagedRoots(
+    worktreePath.trim(),
+    getWorktreeCleanupManagedRoots(repoPools)
+  );
+}
+async function safeUpdateWorktreeRecordStatus(workflowId, worktreePath, status, retentionReason, errors) {
+  try {
+    await updateWorktreeRecordStatus(workflowId, worktreePath, status, retentionReason);
+    return true;
+  } catch (error) {
+    errors.push({
+      path: worktreePath,
+      error: error instanceof Error ? error.message : String(error)
+    });
+    return false;
+  }
+}
+async function listGitWorktrees(repoCwd = getProjectRoot()) {
+  let stdout;
+  try {
+    ({ stdout } = await execa("git", ["worktree", "list", "--porcelain"], {
+      cwd: repoCwd,
+      stdio: "pipe",
+      timeout: 1e4
+    }));
+  } catch (error) {
+    if (isNotAGitRepositoryError(error)) {
+      return [];
+    }
+    throw error;
+  }
+  const entries = [];
+  let current;
+  for (const rawLine of stdout.split("\n")) {
+    const line = rawLine.trimEnd();
+    if (line.startsWith("worktree ")) {
+      if (current) entries.push(current);
+      current = { path: line.slice("worktree ".length).trim() };
+      continue;
+    }
+    if (line.startsWith("branch ") && current) {
+      const ref = line.slice("branch ".length).trim();
+      const prefix = "refs/heads/";
+      if (ref.startsWith(prefix)) {
+        current.branch = ref.slice(prefix.length);
+      }
+    }
+  }
+  if (current) entries.push(current);
+  return entries;
+}
+async function listLocalBranches(repoCwd = getProjectRoot()) {
+  let stdout;
+  try {
+    ({ stdout } = await execa("git", ["branch", "--format=%(refname:short)"], {
+      cwd: repoCwd,
+      stdio: "pipe",
+      timeout: 1e4
+    }));
+  } catch (error) {
+    if (isNotAGitRepositoryError(error)) {
+      return [];
+    }
+    throw error;
+  }
+  return stdout.split("\n").map((b) => b.trim()).filter(Boolean);
+}
+function buildRelatedBranchPrefixes(taskId) {
+  const safeTaskId = sanitizeRefPart(taskId, { fallback: "task", maxLen: 80 });
+  return [
+    ...buildVariantBranchPrefixes(taskId),
+    `${buildBranchKindPrefix("lab")}${safeTaskId}-`,
+    `${buildBranchKindPrefix("stage")}${safeTaskId}-`,
+    `build/substage/${safeTaskId}-`,
+    `build/wt-${safeTaskId}-`
+  ];
+}
+function matchesCleanupBranchPrefix(branch, prefix) {
+  if (!branch.startsWith(prefix)) {
+    return false;
+  }
+  if (prefix.endsWith("/") || prefix.endsWith("-")) {
+    return true;
+  }
+  const next = branch.charAt(prefix.length);
+  return next === "/" || next === "-";
+}
+async function cleanupWorkflowRelatedBranchesAndWorktrees(options) {
+  const relatedTaskIds = (options.relatedTaskIds ?? []).map((t) => t.trim()).filter(Boolean);
+  const relatedSafeTaskIds = relatedTaskIds.map(
+    (taskId) => sanitizeRefPart(taskId, { fallback: "task", maxLen: 80 })
+  );
+  const trackedBranches = (options.trackedBranches ?? []).map((b) => b.trim()).filter(Boolean);
+  const trackedWorktrees = (options.trackedWorktrees ?? []).map((w) => w.trim()).filter(Boolean);
+  const enablePooledWorktreePathRecovery = options.enablePooledWorktreePathRecovery ?? true;
+  const childTargets = runChildBranchTargets(options.integrationBranch);
+  const repoCwd = getProjectRoot();
+  const [branches, worktrees] = await Promise.all([
+    listLocalBranches(repoCwd),
+    listGitWorktrees(repoCwd)
+  ]);
+  const prefixes = [
+    ...childTargets.prefixes,
+    ...relatedTaskIds.flatMap((taskId) => buildRelatedBranchPrefixes(taskId))
+  ];
+  const branchesToDelete = Array.from(
+    new Set(
+      branches.filter(
+        (branch) => trackedBranches.includes(branch) || childTargets.exact.includes(branch) || prefixes.some((prefix) => matchesCleanupBranchPrefix(branch, prefix))
+      )
+    )
+  );
+  const worktreesToRemove = Array.from(
+    new Set(
+      [
+        ...trackedWorktrees,
+        ...worktrees.filter((w) => {
+          if (trackedWorktrees.includes(w.path)) return true;
+          if (w.branch && branchesToDelete.includes(w.branch)) return true;
+          if (!enablePooledWorktreePathRecovery) return false;
+          const base = path3.basename(w.path);
+          return relatedSafeTaskIds.some((taskId) => base.startsWith(`${taskId}-`));
+        }).map((w) => w.path)
+      ].filter(Boolean)
+    )
+  );
+  if (options.dryRun) {
+    return {
+      branchesToDelete,
+      worktreesToRemove,
+      skippedWorktreesMissingOnDisk: [],
+      skippedBranchesAlreadyAbsent: [],
+      cleanupWarnings: [],
+      cleanupErrors: []
+    };
+  }
+  const skippedWorktreesMissingOnDisk = worktreesToRemove.filter((p) => !fs2.existsSync(p));
+  const skippedWorktreesMissing = new Set(skippedWorktreesMissingOnDisk);
+  const skippedBranchesAlreadyAbsent = [];
+  const cleanupWarnings = [];
+  const cleanupErrors = [];
+  const activeWorktreeBranches = /* @__PURE__ */ new Set();
+  const branchByWorktreePath = new Map(
+    worktrees.filter(
+      (worktree) => Boolean(worktree.branch)
+    ).map((worktree) => [path3.resolve(worktree.path), worktree.branch])
+  );
+  for (const worktreePath of worktreesToRemove) {
+    if (!fs2.existsSync(worktreePath)) {
+      skippedWorktreesMissing.add(worktreePath);
+      continue;
+    }
+    if (await isActiveRun(worktreePath)) {
+      const resolvedWorktreePath = path3.resolve(worktreePath);
+      const attachedBranch = branchByWorktreePath.get(resolvedWorktreePath);
+      if (attachedBranch) {
+        activeWorktreeBranches.add(attachedBranch);
+      }
+      cleanupWarnings.push({
+        path: worktreePath,
+        message: "Preserved active worktree; its owning run is still active"
+      });
+      continue;
+    }
+    if (!isManagedCleanupWorktreePath(worktreePath, repoCwd)) {
+      cleanupWarnings.push({
+        path: worktreePath,
+        message: "Refusing to clean worktree path outside canonical Build worktree pools"
+      });
+      continue;
+    }
+    try {
+      const worktreeManager = getCleanupWorktreeManager(repoCwd);
+      await worktreeManager.cleanup(worktreePath, { preserve: false, gitCwd: repoCwd });
+    } catch (error) {
+      if (!fs2.existsSync(worktreePath)) {
+        skippedWorktreesMissing.add(worktreePath);
+        continue;
+      }
+      cleanupWarnings.push({
+        path: worktreePath,
+        message: normalizeGitErrorText(error)
+      });
+    }
+  }
+  const branchesLive = await listLocalBranches(repoCwd);
+  const liveBranchSet = new Set(branchesLive);
+  for (const branch of branchesToDelete) {
+    if (activeWorktreeBranches.has(branch)) {
+      cleanupWarnings.push({
+        path: branch,
+        message: "Preserved branch attached to an active worktree"
+      });
+      continue;
+    }
+    if (!liveBranchSet.has(branch)) {
+      skippedBranchesAlreadyAbsent.push(branch);
+      continue;
+    }
+    const branchRole = classifyBranchRole(branch);
+    if (!isBuildOwnedBranch(branch) || isProtectedPipelineBranch(branch) || branchRole !== "generated-artifact") {
+      cleanupWarnings.push({
+        path: branch,
+        message: `Refusing to delete non-generated or protected branch ${branch}`
+      });
+      continue;
+    }
+    try {
+      await execa("git", ["branch", "-D", branch], {
+        cwd: repoCwd,
+        stdio: "pipe",
+        timeout: 1e4
+      });
+    } catch (error) {
+      if (isBenignGitBranchDeleteError(error)) {
+        skippedBranchesAlreadyAbsent.push(branch);
+      } else {
+        cleanupErrors.push({
+          path: branch,
+          error: normalizeGitErrorText(error)
+        });
+      }
+    }
+  }
+  if (worktreesToRemove.length > 0) {
+    await pruneGitWorktreeEntries({ cwd: repoCwd, timeoutMs: 1e4, paths: worktreesToRemove });
+  }
+  return {
+    branchesToDelete,
+    worktreesToRemove,
+    skippedWorktreesMissingOnDisk: Array.from(skippedWorktreesMissing),
+    skippedBranchesAlreadyAbsent,
+    cleanupWarnings,
+    cleanupErrors
+  };
+}
+async function recoverPendingWorktrees(options = {}) {
+  const {
+    dryRun = false,
+    verbose = false,
+    includeCleanupFailed = true,
+    maxManifests = WORKTREE_HYGIENE_MAX_MANIFESTS_PER_PASS,
+    maxRecords = WORKTREE_HYGIENE_MAX_RECOVERY_RECORDS_PER_PASS,
+    restrictToBuildWorktreePool = false
+  } = options;
+  const manifestCap = Math.max(1, maxManifests);
+  const recordCap = Math.max(1, maxRecords);
+  const result = {
+    recovered: [],
+    skippedActive: [],
+    skippedDirty: [],
+    alreadyGone: [],
+    errors: []
+  };
+  const protectedPaths = getWorktreeCleanupProtectedPaths();
+  const managedRoots = getWorktreeCleanupManagedRoots();
+  const runRecovery = async () => {
+    let manifests;
+    try {
+      manifests = await listManifests();
+    } catch (error) {
+      result.errors.push({
+        path: "<manifests>",
+        error: error instanceof Error ? error.message : String(error)
+      });
+      return result;
+    }
+    const manifestsSlice = manifests.slice(0, manifestCap);
+    if (manifestsSlice.length < manifests.length) {
+      result.hygieneCapReached = true;
+    }
+    const poolRoots = getWorktreePoolPathRootsForHygiene();
+    let recordsExamined = 0;
+    const seenRecoveryKeys = /* @__PURE__ */ new Set();
+    for (let mi = 0; mi < manifestsSlice.length; mi++) {
+      const manifest = manifestsSlice[mi];
+      const reconciledManifest = dryRun ? manifest : await reconcileAndSaveManifest(manifest.workflowId).catch(() => manifest);
+      const statuses = ["pending"];
+      if (includeCleanupFailed) {
+        statuses.push("cleanup_failed");
+      }
+      const pending = statuses.flatMap(
+        (status) => getWorktreeRecordsByStatus(reconciledManifest, status)
+      );
+      for (const record of pending) {
+        const recoveryKey = `${reconciledManifest.workflowId}::${record.worktreePath}`;
+        if (seenRecoveryKeys.has(recoveryKey)) {
+          continue;
+        }
+        seenRecoveryKeys.add(recoveryKey);
+        if (recordsExamined >= recordCap) {
+          result.hygieneCapReached = true;
+          break;
+        }
+        recordsExamined += 1;
+        const worktreePath = record.worktreePath;
+        try {
+          if (restrictToBuildWorktreePool && !isPathUnderWorktreePoolRoots(worktreePath, poolRoots)) {
+            if (verbose) {
+              console.log(`[recover] Skipping worktree outside pool roots: ${worktreePath}`);
+            }
+            continue;
+          }
+          const exists = fs2.existsSync(worktreePath);
+          if (!exists) {
+            if (verbose) {
+              console.log(`[recover] Worktree already gone: ${worktreePath}`);
+            }
+            if (!dryRun) {
+              const ok = await safeUpdateWorktreeRecordStatus(
+                reconciledManifest.workflowId,
+                worktreePath,
+                "cleaned",
+                WORKTREE_RECORD_RECOVERY_REASON.PATH_ALREADY_ABSENT,
+                result.errors
+              );
+              if (!ok) {
+                continue;
+              }
+            }
+            result.alreadyGone.push(worktreePath);
+            continue;
+          }
+          if (await isActiveRun(worktreePath)) {
+            if (verbose) {
+              console.log(`[recover] Preserving active worktree: ${worktreePath}`);
+            }
+            result.skippedActive.push(worktreePath);
+            continue;
+          }
+          let dirty = false;
+          try {
+            const { stdout } = await execa("git", ["status", "--porcelain"], {
+              cwd: worktreePath,
+              stdio: "pipe",
+              timeout: GIT_COMMAND_TIMEOUT_MS
+            });
+            dirty = filterWorktreeRunSentinelStatusOutput(stdout).trim().length > 0;
+          } catch (error) {
+            const text = normalizeGitErrorText(error);
+            const disappearedDuringStatus = isWorktreeMetadataGone(error, worktreePath);
+            if (disappearedDuringStatus) {
+              if (verbose) {
+                console.log(
+                  `[recover] Worktree path missing or not a git repository, marking cleaned: ${worktreePath}`
+                );
+              }
+              if (!dryRun) {
+                const ok = await safeUpdateWorktreeRecordStatus(
+                  reconciledManifest.workflowId,
+                  worktreePath,
+                  "cleaned",
+                  WORKTREE_RECORD_RECOVERY_REASON.PATH_INVALID_DURING_STATUS_PROBE,
+                  result.errors
+                );
+                if (!ok) {
+                  continue;
+                }
+              }
+              result.alreadyGone.push(worktreePath);
+            } else {
+              result.errors.push({
+                path: worktreePath,
+                error: text
+              });
+            }
+            continue;
+          }
+          if (dirty) {
+            if (verbose) {
+              console.log(`[recover] Skipping dirty worktree: ${worktreePath}`);
+            }
+            result.skippedDirty.push(worktreePath);
+            continue;
+          }
+          if (verbose) {
+            console.log(`[recover] Recovering clean worktree: ${worktreePath}`);
+          }
+          if (!dryRun) {
+            const gitRemoval = await tryRemoveWorktreeNestedAware(worktreePath, {
+              force: true,
+              repoCwd: getProjectRoot()
+            });
+            if (gitRemoval.refusal) {
+              result.errors.push({ path: worktreePath, error: gitRemoval.refusal });
+              continue;
+            }
+            if (fs2.existsSync(worktreePath)) {
+              try {
+                await removeWorktreeDirectoryWithGuard(worktreePath, protectedPaths, managedRoots);
+              } catch (rmErr) {
+                result.errors.push({
+                  path: worktreePath,
+                  error: normalizeGitErrorText(rmErr)
+                });
+                continue;
+              }
+            }
+            if (fs2.existsSync(worktreePath)) {
+              result.errors.push({
+                path: worktreePath,
+                error: "Recovery could not remove worktree directory; leaving manifest unchanged"
+              });
+              continue;
+            }
+            const updated = await safeUpdateWorktreeRecordStatus(
+              reconciledManifest.workflowId,
+              worktreePath,
+              "cleaned",
+              null,
+              result.errors
+            );
+            if (!updated) {
+              continue;
+            }
+          }
+          result.recovered.push(worktreePath);
+        } catch (error) {
+          result.errors.push({
+            path: worktreePath,
+            error: error instanceof Error ? error.message : String(error)
+          });
+        }
+      }
+      if (recordsExamined >= recordCap) {
+        if (mi < manifestsSlice.length - 1) {
+          result.hygieneCapReached = true;
+        }
+        break;
+      }
+    }
+    if (!dryRun && (result.recovered.length > 0 || result.alreadyGone.length > 0)) {
+      await pruneGitWorktreeEntries({
+        cwd: getProjectRoot(),
+        paths: [...result.recovered, ...result.alreadyGone]
+      });
+    }
+    return result;
+  };
+  if (dryRun) {
+    return runRecovery();
+  }
+  return withCleanupLock(getWorktreeBaseDir(), runRecovery);
+}
+async function enforceRetentionBounds(options = {}) {
+  const {
+    maxAgeMs = 7 * 24 * 60 * 60 * 1e3,
+    maxCount = 20,
+    maxManifests = WORKTREE_HYGIENE_MAX_MANIFESTS_PER_PASS,
+    maxGitStatusProbes = WORKTREE_HYGIENE_MAX_RETENTION_PRUNE_OPS,
+    dryRun = false,
+    verbose = false
+  } = options;
+  const diskCapResolved = options.maxRetainedTotalDiskBytes !== void 0 ? options.maxRetainedTotalDiskBytes : WORKTREE_HYGIENE_MAX_RETAINED_TOTAL_BYTES;
+  const manifestCap = Math.max(1, maxManifests);
+  const probeCap = Math.max(1, maxGitStatusProbes);
+  const result = {
+    pruned: [],
+    preserved: [],
+    errors: []
+  };
+  const protectedPaths = getWorktreeCleanupProtectedPaths();
+  const managedRoots = getWorktreeCleanupManagedRoots();
+  const runRetention = async () => {
+    let manifests;
+    try {
+      manifests = await listManifests();
+    } catch (error) {
+      result.errors.push({
+        path: "<manifests>",
+        error: error instanceof Error ? error.message : String(error)
+      });
+      return result;
+    }
+    const manifestsSlice = manifests.slice(0, manifestCap);
+    if (manifestsSlice.length < manifests.length) {
+      result.hygieneCapReached = true;
+    }
+    const retainedEntries = [];
+    const retainedByWorkflowPath = /* @__PURE__ */ new Map();
+    for (const manifest of manifestsSlice) {
+      const retained = getWorktreeRecordsByStatus(manifest, "retained");
+      for (const record of retained) {
+        if (isProviderFailureKeptRecord(record)) continue;
+        const key = `${manifest.workflowId}::${record.worktreePath}`;
+        const next = {
+          workflowId: manifest.workflowId,
+          worktreePath: record.worktreePath,
+          updatedAt: record.updatedAt
+        };
+        const existing = retainedByWorkflowPath.get(key);
+        if (!existing || new Date(next.updatedAt).getTime() > new Date(existing.updatedAt).getTime()) {
+          retainedByWorkflowPath.set(key, next);
+        }
+      }
+    }
+    retainedEntries.push(...retainedByWorkflowPath.values());
+    retainedEntries.sort(
+      (a, b) => new Date(a.updatedAt).getTime() - new Date(b.updatedAt).getTime()
+    );
+    const diskCap = diskCapResolved > 0 ? diskCapResolved : 0;
+    const footprintByPath = /* @__PURE__ */ new Map();
+    let aggregateRetainedBytes = 0;
+    let diskFootprintTruncated = false;
+    if (diskCap > 0) {
+      const maxStat = WORKTREE_HYGIENE_MAX_RETENTION_COLLATION;
+      for (const [si, entry] of retainedEntries.entries()) {
+        if (si >= maxStat) {
+          diskFootprintTruncated = true;
+          result.hygieneCapReached = true;
+          break;
+        }
+        const p = entry.worktreePath;
+        if (!fs2.existsSync(p)) {
+          continue;
+        }
+        const bytes = await roughDirectoryFootprintBytes(p);
+        footprintByPath.set(p, bytes);
+        aggregateRetainedBytes += bytes;
+      }
+    }
+    const now = Date.now();
+    let remainingCountExcess = Math.max(0, retainedEntries.length - maxCount);
+    let gitStatusProbes = 0;
+    const consumeFootprintForPath = (wp) => {
+      if (diskCap <= 0 || diskFootprintTruncated) {
+        return;
+      }
+      const used = footprintByPath.get(wp);
+      if (used !== void 0) {
+        aggregateRetainedBytes -= used;
+        footprintByPath.delete(wp);
+      }
+    };
+    for (let i = 0; i < retainedEntries.length; i++) {
+      const entry = retainedEntries[i];
+      if (!entry) continue;
+      const worktreePath = entry.worktreePath;
+      const ageMs = now - new Date(entry.updatedAt).getTime();
+      const isOverAge = ageMs > maxAgeMs;
+      const isOverCount = remainingCountExcess > 0;
+      const isOverDisk = diskCap > 0 && !diskFootprintTruncated && aggregateRetainedBytes > diskCap;
+      if (!isOverAge && !isOverCount && !isOverDisk) {
+        result.preserved.push(worktreePath);
+        continue;
+      }
+      if (await isActiveRun(worktreePath)) {
+        if (verbose) {
+          console.log(`[retention] Preserving active retained worktree: ${worktreePath}`);
+        }
+        result.preserved.push(worktreePath);
+        continue;
+      }
+      let dirty = false;
+      if (fs2.existsSync(worktreePath)) {
+        if (gitStatusProbes >= probeCap) {
+          result.hygieneCapReached = true;
+          for (const retainedEntry of retainedEntries.slice(i)) {
+            result.preserved.push(retainedEntry.worktreePath);
+          }
+          break;
+        }
+        gitStatusProbes += 1;
+        try {
+          const { stdout } = await execa("git", ["status", "--porcelain"], {
+            cwd: worktreePath,
+            stdio: "pipe",
+            timeout: GIT_COMMAND_TIMEOUT_MS
+          });
+          dirty = filterWorktreeRunSentinelStatusOutput(stdout).trim().length > 0;
+        } catch (error) {
+          const disappearedDuringStatus = isWorktreeMetadataGone(error, worktreePath);
+          if (disappearedDuringStatus) {
+            if (verbose) {
+              console.log(
+                `[retention] Worktree path missing or not a git repository, marking cleaned: ${worktreePath}`
+              );
+            }
+            if (!dryRun) {
+              try {
+                await updateWorktreeRecordStatus(entry.workflowId, worktreePath, "cleaned", null);
+              } catch (updateError) {
+                result.errors.push({
+                  path: worktreePath,
+                  error: updateError instanceof Error ? updateError.message : String(updateError)
+                });
+                continue;
+              }
+            }
+            if (remainingCountExcess > 0) {
+              remainingCountExcess--;
+            }
+            consumeFootprintForPath(worktreePath);
+            result.pruned.push(worktreePath);
+            continue;
+          }
+          dirty = true;
+        }
+      }
+      if (dirty) {
+        if (verbose) {
+          console.log(`[retention] Preserving dirty retained worktree: ${worktreePath}`);
+        }
+        result.preserved.push(worktreePath);
+        continue;
+      }
+      if (verbose) {
+        console.log(`[retention] Pruning retained worktree: ${worktreePath}`);
+      }
+      if (!dryRun) {
+        try {
+          if (fs2.existsSync(worktreePath)) {
+            const gitRemoval = await tryRemoveWorktreeNestedAware(worktreePath, {
+              force: true,
+              repoCwd: getProjectRoot()
+            });
+            if (gitRemoval.refusal) {
+              result.errors.push({ path: worktreePath, error: gitRemoval.refusal });
+              continue;
+            }
+            if (!gitRemoval.removed) {
+              await removeWorktreeDirectoryWithGuard(worktreePath, protectedPaths, managedRoots);
+            }
+          }
+          await updateWorktreeRecordStatus(entry.workflowId, worktreePath, "cleaned", null);
+        } catch (error) {
+          result.errors.push({
+            path: worktreePath,
+            error: error instanceof Error ? error.message : String(error)
+          });
+          continue;
+        }
+      }
+      if (remainingCountExcess > 0) {
+        remainingCountExcess--;
+      }
+      consumeFootprintForPath(worktreePath);
+      result.pruned.push(worktreePath);
+    }
+    if (!dryRun && result.pruned.length > 0) {
+      try {
+        await pruneGitWorktreeEntries({ cwd: getProjectRoot(), paths: result.pruned });
+      } catch {
+      }
+    }
+    return result;
+  };
+  if (dryRun) {
+    return runRetention();
+  }
+  return withCleanupLock(getWorktreeBaseDir(), runRetention);
+}
+async function runFlywheelWorktreeHygiene(options) {
+  const recoverResult = await recoverPendingWorktrees({
+    dryRun: options.dryRun,
+    verbose: options.verbose,
+    maxManifests: options.maxManifests,
+    maxRecords: options.maxRecoveryRecords,
+    restrictToBuildWorktreePool: options.restrictRecoveryToBuildWorktreePool
+  });
+  const retentionResult = await enforceRetentionBounds({
+    dryRun: options.dryRun,
+    verbose: options.verbose,
+    maxAgeMs: options.maxAgeMs,
+    maxCount: options.maxCount,
+    maxRetainedTotalDiskBytes: options.maxRetainedTotalDiskBytes,
+    maxManifests: options.maxManifests,
+    maxGitStatusProbes: options.maxGitStatusProbes
+  });
+  return {
+    recoverPendingWorktrees: recoverResult,
+    enforceRetentionBounds: retentionResult
+  };
+}
+async function getFlywheelCleanupDryRunWorktreeSummary() {
+  const { recoverPendingWorktrees: recoverPendingWorktrees2, enforceRetentionBounds: enforceRetentionBounds2 } = await runFlywheelWorktreeHygiene({
+    dryRun: true,
+    verbose: false
+  });
+  return {
+    recoverPendingWorktrees: recoverPendingWorktrees2,
+    enforceRetentionBounds: enforceRetentionBounds2,
+    retained: enforceRetentionBounds2.preserved.length,
+    pruned: enforceRetentionBounds2.pruned.length,
+    skipped: recoverPendingWorktrees2.skippedActive.length + recoverPendingWorktrees2.skippedDirty.length
+  };
+}
+
+// src/automation/flywheel-retry-policies.ts
+var VALID_ON_FAILURE_POLICIES = [
+  "abort",
+  "retry-with-feedback",
+  "warn",
+  "skip"
+];
+function isValidOnFailurePolicy(value) {
+  return typeof value === "string" && VALID_ON_FAILURE_POLICIES.includes(value);
+}
+var DEFAULT_RETRY_CONFIG = {
+  onFailure: "abort",
+  maxRetries: 2,
+  feedbackTemplate: void 0,
+  // Use built-in template
+  backoffMultiplier: 2,
+  initialDelaySeconds: 5,
+  maxDelaySeconds: 60
+};
+var DEFAULT_FEEDBACK_TEMPLATE = `
+## Previous Attempt Failed
+
+**Feedback attempt:** {{attempt}} of {{maxAttempts}}
+**Error:** {{error}}
+{{#if validation}}
+**Validation Failure:** {{validation}}
+{{/if}}
+
+Please address the issue and try again. Focus on:
+1. Understanding why the previous attempt failed
+2. Fixing the specific issue mentioned above
+3. Ensuring your output passes all validation checks
+
+---
+
+## Original Task
+
+{{originalPrompt}}
+`;
+var FEEDBACK_RETRYABLE_TAXONOMY_OVERRIDES = [
+  "VALIDATION_FAILED",
+  "SEMANTIC_CHECK_FAILED",
+  "ALLOWLIST_VIOLATION",
+  "ARTIFACT_INVALID"
+];
+var FEEDBACK_RETRYABLE_ERRORS = new Set(
+  FEEDBACK_RETRYABLE_TAXONOMY_OVERRIDES
+);
+var NON_RETRYABLE_ERRORS = /* @__PURE__ */ new Set([
+  "CONFIG_INVALID",
+  "STAGE_NOT_FOUND",
+  "REPO_DIRTY",
+  "GIT_CONFLICT",
+  "MODEL_NOT_FOUND"
+]);
+function resolveRetryAuthority(config = {}) {
+  const fullConfig = { ...DEFAULT_RETRY_CONFIG, ...config };
+  return {
+    ...fullConfig,
+    // maxRetries is additional feedback retries after the first eligible attempt.
+    maxAttempts: fullConfig.maxRetries + 1
+  };
+}
+function getFeedbackRetryEligibility(error) {
+  if (NON_RETRYABLE_ERRORS.has(error.code)) {
+    return {
+      retryable: false,
+      reason: `Error code ${error.code} is blocked from feedback retry`,
+      overridesTaxonomy: false
+    };
+  }
+  if (error.retryable) {
+    return {
+      retryable: true,
+      reason: `Error code ${error.code} is retryable by taxonomy`,
+      overridesTaxonomy: false
+    };
+  }
+  if (FEEDBACK_RETRYABLE_ERRORS.has(error.code)) {
+    return {
+      retryable: true,
+      reason: `Error code ${error.code} is eligible for corrective retry under retry-with-feedback despite taxonomy retryable:false`,
+      overridesTaxonomy: true
+    };
+  }
+  return {
+    retryable: false,
+    reason: `Error code ${error.code} is not retryable by taxonomy or feedback policy`,
+    overridesTaxonomy: false
+  };
+}
+function isResolvedRetryAuthority(value) {
+  return typeof value === "object";
+}
+function shouldRetry(authorityOrPolicy, error, attempt, maxAttempts) {
+  const authority = isResolvedRetryAuthority(authorityOrPolicy) ? authorityOrPolicy : {
+    ...DEFAULT_RETRY_CONFIG,
+    onFailure: authorityOrPolicy,
+    maxRetries: typeof maxAttempts === "number" ? maxAttempts - 1 : DEFAULT_RETRY_CONFIG.maxRetries,
+    maxAttempts: typeof maxAttempts === "number" ? maxAttempts : DEFAULT_RETRY_CONFIG.maxRetries + 1
+  };
+  if (authority.onFailure !== "retry-with-feedback") {
+    return false;
+  }
+  if (attempt >= authority.maxAttempts) {
+    return false;
+  }
+  return getFeedbackRetryEligibility(error).retryable;
+}
+function buildRetryPrompt(context, template) {
+  const feedbackTemplate = template || DEFAULT_FEEDBACK_TEMPLATE;
+  let validationMessage = "";
+  if (context.lastValidationResult) {
+    validationMessage = `[${context.lastValidationResult.type}] ${context.lastValidationResult.message}`;
+  } else if (context.allValidationResults && context.allValidationResults.length > 0) {
+    const failed = context.allValidationResults.filter((r) => !r.passed);
+    if (failed.length > 0) {
+      validationMessage = failed.map((r) => `[${r.type}] ${r.message}`).join("\n");
+    }
+  }
+  let feedback = feedbackTemplate.replace(/\{\{error\}\}/g, context.lastError.message).replace(/\{\{errorCode\}\}/g, context.lastError.code).replace(/\{\{attempt\}\}/g, String(context.attempt)).replace(/\{\{maxAttempts\}\}/g, String(context.maxAttempts)).replace(/\{\{originalPrompt\}\}/g, context.originalPrompt);
+  if (validationMessage) {
+    feedback = feedback.replace(/\{\{#if validation\}\}([\s\S]*?)\{\{\/if\}\}/g, "$1");
+    feedback = feedback.replace(/\{\{validation\}\}/g, validationMessage);
+  } else {
+    feedback = feedback.replace(/\{\{#if validation\}\}[\s\S]*?\{\{\/if\}\}/g, "");
+  }
+  return feedback.trim();
+}
+function calculateRetryDelay(attempt, config) {
+  const initial = config?.initialDelaySeconds ?? DEFAULT_RETRY_CONFIG.initialDelaySeconds;
+  const multiplier = config?.backoffMultiplier ?? DEFAULT_RETRY_CONFIG.backoffMultiplier;
+  const max = config?.maxDelaySeconds ?? DEFAULT_RETRY_CONFIG.maxDelaySeconds;
+  const delay = initial * multiplier ** (attempt - 1);
+  const jitter = delay * 0.2 * (Math.random() * 2 - 1);
+  return Math.min(delay + jitter, max);
+}
+function makeRetryDecision(context, config = {}) {
+  const authority = resolveRetryAuthority(config);
+  const authoritativeContext = { ...context, maxAttempts: authority.maxAttempts };
+  const feedbackEligibility = getFeedbackRetryEligibility(context.lastError);
+  const policy = isValidOnFailurePolicy(authority.onFailure) ? authority.onFailure : "abort";
+  const willRetry = policy === "retry-with-feedback" && shouldRetry(authority, context.lastError, context.attempt);
+  if (!willRetry) {
+    let action;
+    let reason;
+    if (policy === "warn") {
+      action = "warn-continue";
+      reason = "Policy is 'warn': record warning and continue workflow (validation remains failed)";
+    } else if (policy === "skip") {
+      action = "skip-continue";
+      reason = "Policy is 'skip': skip remaining stage work and continue workflow";
+    } else if (policy === "retry-with-feedback") {
+      action = "abort";
+      if (context.attempt >= authority.maxAttempts) {
+        reason = `Exceeded maximum retries (${authority.maxRetries})`;
+      } else {
+        reason = feedbackEligibility.reason;
+      }
+    } else if (!isValidOnFailurePolicy(authority.onFailure)) {
+      action = "abort";
+      reason = `Policy '${String(authority.onFailure)}' is not a valid onFailure value; treating as abort`;
+    } else {
+      action = "abort";
+      reason = "Policy is 'abort': stop workflow on failure";
+    }
+    return {
+      shouldRetry: false,
+      action,
+      reason,
+      retryEligibility: feedbackEligibility,
+      delaySeconds: 0
+    };
+  }
+  const feedbackInjected = buildRetryPrompt(authoritativeContext, authority.feedbackTemplate);
+  const modifiedPrompt = feedbackInjected;
+  const delaySeconds = calculateRetryDelay(context.attempt, authority);
+  return {
+    shouldRetry: true,
+    action: "retry",
+    reason: `Retrying after ${context.lastError.code} (feedback attempt ${context.attempt + 1} of ${authority.maxAttempts}): ${feedbackEligibility.reason}`,
+    retryEligibility: feedbackEligibility,
+    delaySeconds,
+    modifiedPrompt,
+    feedbackInjected
+  };
+}
+
+// src/automation/flywheel-validation.ts
+function getValidProviderIds() {
+  try {
+    return { ids: ProviderRegistry.getAllProviderIds() };
+  } catch (error) {
+    return {
+      error: error instanceof Error ? error.message : String(error)
+    };
+  }
+}
+var VALID_OUTPUT_TYPES = ["diff", "files", "text", "testResults", "json"];
+var VALIDATION_NO_SIGNALS_WARNING_DETAILS = "has validation enabled but no outputs or checks defined";
+var VALID_CHECK_TYPES = ["file-exists", "file-contains", "file-extension"];
+var VALID_PROVIDER_EXECUTION_TRANSPORTS = [
+  "auto",
+  "headless",
+  "tmux-exec",
+  "interactive"
+];
+function isValidProviderExecutionTransport(value) {
+  return VALID_PROVIDER_EXECUTION_TRANSPORTS.includes(
+    value
+  );
+}
+function appendSeededPlanCompletionContractErrors(parentStageId, plan, errors, pathPrefix = "") {
+  const subStages = plan?.subStages;
+  if (!subStages || subStages.length === 0) {
+    return;
+  }
+  for (const sub of subStages) {
+    const subId = typeof sub.id === "string" && sub.id.length > 0 ? sub.id : "(anonymous)";
+    const nestedPath = pathPrefix ? `${pathPrefix}/${subId}` : subId;
+    if (sub.validation?.completionContract !== void 0) {
+      const contractValidation = validateCompletionContracts(sub.validation.completionContract);
+      for (const contractError of contractValidation.errors) {
+        errors.push(
+          `Stage '${parentStageId}' seeded substage '${nestedPath}' ${contractError.field}: ${contractError.message}`
+        );
+      }
+    }
+    const nestedPlan = sub.seededPlan;
+    appendSeededPlanCompletionContractErrors(parentStageId, nestedPlan, errors, nestedPath);
+  }
+}
+function validateVerifyCommandStrings(commands, label, errors, options) {
+  if (!Array.isArray(commands) || options.requireNonEmpty && commands.length === 0) {
+    errors.push(`${label} must be a non-empty string[]`);
+    return false;
+  }
+  for (const [idx, cmd] of commands.entries()) {
+    if (typeof cmd !== "string" || cmd.trim().length === 0) {
+      errors.push(`${label}[${idx}] must be a non-empty string`);
+      continue;
+    }
+    const safety = checkVerifyCommandSafety(cmd);
+    if (!safety.safe) {
+      errors.push(`${label}[${idx}] is unsafe: ${safety.error}`);
+    }
+  }
+  return true;
+}
+function validateGeneratedSubStageVerifyCommands(subStages) {
+  const errors = [];
+  for (const subStage of subStages) {
+    const label = `Sub-stage '${subStage.id}' verify.commands`;
+    if (subStage.type === "verify") {
+      validateVerifyCommandStrings(subStage.verify?.commands, label, errors, {
+        requireNonEmpty: true
+      });
+    } else if (subStage.verify?.commands !== void 0) {
+      validateVerifyCommandStrings(subStage.verify.commands, label, errors, {
+        requireNonEmpty: false
+      });
+    }
+  }
+  return errors;
+}
+function validateExplicitCheck(check, stageId) {
+  const errors = [];
+  if (!VALID_CHECK_TYPES.includes(check.type)) {
+    errors.push(`Stage '${stageId}' has unknown check type: ${check.type}`);
+  }
+  if ("path" in check && check.path) {
+    const pathResult = isValidCheckPath(check.path);
+    if (!pathResult.valid) {
+      errors.push(`Stage '${stageId}' check path invalid: ${pathResult.error}`);
+    }
+  } else if ("path" in check && !check.path) {
+    errors.push(`Stage '${stageId}' check of type '${check.type}' missing required 'path' field`);
+  }
+  if (check.type === "file-contains") {
+    const containsCheck = check;
+    if (!containsCheck.content || containsCheck.content.length === 0) {
+      errors.push(`Stage '${stageId}' file-contains check missing 'content' field`);
+    }
+  }
+  if (errors.length > 0) {
+    return { valid: false, error: errors.join("; ") };
+  }
+  return { valid: true };
+}
+function validateStageConfig(stage) {
+  const errors = [];
+  const warnings = [];
+  if (!stage.id || typeof stage.id !== "string") {
+    errors.push("Stage must have a valid id");
+  } else if (!isPathSafeIdentifier(stage.id)) {
+    errors.push(
+      `Stage id '${stage.id}' contains invalid characters. Use only alphanumeric, underscore, and hyphen.`
+    );
+  }
+  if (stage.type !== void 0 && stage.type !== "standard" && stage.type !== "competition" && stage.type !== "verify" && stage.type !== "refinement" && stage.type !== "autoloop" && stage.type !== "orchestrator") {
+    errors.push(
+      `Stage '${stage.id}' has invalid type '${String(stage.type)}'. Valid types: standard, competition, verify, refinement, autoloop, orchestrator`
+    );
+  }
+  if (stage.type === "verify") {
+    const cmds = stage.verify?.commands;
+    validateVerifyCommandStrings(cmds, `Stage '${stage.id}' verify.commands`, errors, {
+      requireNonEmpty: true
+    });
+    if (stage.provider) {
+      warnings.push(
+        `Stage '${stage.id}' is type 'verify' but specifies provider '${stage.provider}'. Provider will be ignored (verification stages run locally).`
+      );
+    }
+    if (stage.cacheable === true) {
+      warnings.push(
+        `Stage '${stage.id}' sets deprecated cacheable: true; verify stage caching is disabled and commands will run`
+      );
+    }
+  } else if (stage.cacheable === true) {
+    errors.push(
+      `Stage '${stage.id}' sets cacheable: true, but deterministic stage caching is only supported for type 'verify' stages`
+    );
+  } else if (stage.verify?.commands !== void 0) {
+    validateVerifyCommandStrings(
+      stage.verify.commands,
+      `Stage '${stage.id}' verify.commands`,
+      errors,
+      {
+        requireNonEmpty: false
+      }
+    );
+  }
+  if (stage.competition?.candidateGate) {
+    const gate = stage.competition.candidateGate;
+    const stageId = stage.id || "unknown";
+    if (!Array.isArray(gate.commands) || gate.commands.length === 0) {
+      errors.push(
+        `Stage '${stageId}' competition.candidateGate.commands must be a non-empty string[]`
+      );
+    } else {
+      for (const [idx, cmd] of gate.commands.entries()) {
+        if (typeof cmd !== "string" || cmd.trim().length === 0) {
+          errors.push(
+            `Stage '${stageId}' competition.candidateGate.commands[${idx}] must be a non-empty string`
+          );
+          continue;
+        }
+        const safety = checkVerifyCommandSafety(cmd);
+        if (!safety.safe) {
+          errors.push(
+            `Stage '${stageId}' competition.candidateGate.commands[${idx}] is unsafe: ${safety.error}`
+          );
+        }
+      }
+    }
+    if (gate.coverage) {
+      const coverage = gate.coverage;
+      if (!Array.isArray(coverage.targets) || coverage.targets.length === 0) {
+        errors.push(
+          `Stage '${stageId}' competition.candidateGate.coverage.targets must be string[]`
+        );
+      } else {
+        for (const [idx, target] of coverage.targets.entries()) {
+          if (typeof target !== "string" || target.trim().length === 0) {
+            errors.push(
+              `Stage '${stageId}' competition.candidateGate.coverage.targets[${idx}] must be a non-empty string`
+            );
+            continue;
+          }
+          const pathResult = isValidCheckPath(target);
+          if (!pathResult.valid) {
+            errors.push(
+              `Stage '${stageId}' competition.candidateGate.coverage.targets[${idx}] invalid: ${pathResult.error}`
+            );
+          }
+        }
+      }
+      if (coverage.summaryPath !== void 0) {
+        if (typeof coverage.summaryPath !== "string" || coverage.summaryPath.trim().length === 0) {
+          errors.push(
+            `Stage '${stageId}' competition.candidateGate.coverage.summaryPath must be a non-empty string when provided`
+          );
+        } else {
+          const pathResult = isValidCheckPath(coverage.summaryPath);
+          if (!pathResult.valid) {
+            errors.push(
+              `Stage '${stageId}' competition.candidateGate.coverage.summaryPath invalid: ${pathResult.error}`
+            );
+          }
+        }
+      }
+      if (coverage.threshold !== void 0) {
+        if (typeof coverage.threshold !== "number" || !Number.isFinite(coverage.threshold)) {
+          errors.push(
+            `Stage '${stageId}' competition.candidateGate.coverage.threshold must be a finite number when provided`
+          );
+        } else if (coverage.threshold < 0 || coverage.threshold > 100) {
+          errors.push(
+            `Stage '${stageId}' competition.candidateGate.coverage.threshold must be between 0 and 100`
+          );
+        }
+      }
+    }
+  }
+  if (stage.competition?.judgeConfig) {
+    const judgeValidation = validateCompetitionJudgeConfig(
+      stage.id || "unknown",
+      stage.competition.judgeConfig
+    );
+    if (!judgeValidation.valid && judgeValidation.error) {
+      errors.push(judgeValidation.error);
+    }
+  }
+  if (stage.type === "refinement") {
+    if (!stage.refinement) {
+      warnings.push(
+        `Stage '${stage.id}' is type 'refinement' but has no refinement config; it will run as a normal stage without post-competition inputs/routing.`
+      );
+    }
+    if (stage.competition) {
+      warnings.push(
+        `Stage '${stage.id}' is type 'refinement' but also specifies competition config; competition config will be ignored.`
+      );
+    }
+    if (stage.verify?.commands?.length) {
+      warnings.push(
+        `Stage '${stage.id}' is type 'refinement' but also specifies verify.commands; verify commands will be ignored.`
+      );
+    }
+  }
+  if (stage.type === "orchestrator") {
+    if (!stage.orchestrator) {
+      warnings.push(
+        `Stage '${stage.id}' is type 'orchestrator' but has no orchestrator config; using defaults.`
+      );
+    } else {
+      const cfg = stage.orchestrator;
+      if (cfg.orchestrationProvider !== void 0) {
+        try {
+          ProviderRegistry.getProviderConfig(cfg.orchestrationProvider);
+        } catch (error) {
+          errors.push(
+            `Stage '${stage.id}' orchestrator.orchestrationProvider is invalid: ${error instanceof Error ? error.message : String(error)}`
+          );
+        }
+      }
+      if (cfg.orchestrationProvider !== void 0 && cfg.orchestrationModel !== void 0) {
+        try {
+          ProviderRegistry.resolveModel(cfg.orchestrationProvider, cfg.orchestrationModel);
+        } catch (error) {
+          errors.push(
+            `Stage '${stage.id}' orchestrator.orchestrationModel is invalid for provider '${cfg.orchestrationProvider}': ${error instanceof Error ? error.message : String(error)}`
+          );
+        }
+      }
+      if (cfg.maxSubStages !== void 0) {
+        if (!Number.isInteger(cfg.maxSubStages) || cfg.maxSubStages < 1) {
+          errors.push(
+            `Stage '${stage.id}' orchestrator.maxSubStages must be a positive integer (got ${cfg.maxSubStages})`
+          );
+        } else if (cfg.maxSubStages > 20) {
+          warnings.push(
+            `Stage '${stage.id}' orchestrator.maxSubStages is very high (${cfg.maxSubStages}). Consider limiting to \u226410 for cost control.`
+          );
+        }
+      }
+      if (cfg.budgetPerSubStage !== void 0) {
+        if (!Number.isFinite(cfg.budgetPerSubStage) || cfg.budgetPerSubStage < 0) {
+          errors.push(
+            `Stage '${stage.id}' orchestrator.budgetPerSubStage must be non-negative (got ${cfg.budgetPerSubStage})`
+          );
+        }
+      }
+      if (cfg.totalBudget !== void 0) {
+        if (!Number.isFinite(cfg.totalBudget) || cfg.totalBudget < 0) {
+          errors.push(
+            `Stage '${stage.id}' orchestrator.totalBudget must be non-negative (got ${cfg.totalBudget})`
+          );
+        }
+      }
+      if (cfg.maxReplanningAttempts !== void 0) {
+        if (!Number.isInteger(cfg.maxReplanningAttempts) || cfg.maxReplanningAttempts < 0) {
+          errors.push(
+            `Stage '${stage.id}' orchestrator.maxReplanningAttempts must be non-negative integer (got ${cfg.maxReplanningAttempts})`
+          );
+        } else if (cfg.maxReplanningAttempts > 1) {
+          errors.push(
+            `Stage '${stage.id}' orchestrator.maxReplanningAttempts cannot exceed 1 until multi-pass replanning is supported (got ${cfg.maxReplanningAttempts})`
+          );
+        }
+      }
+      if (cfg.retryBudgetPerSubStage !== void 0) {
+        if (!Number.isInteger(cfg.retryBudgetPerSubStage) || cfg.retryBudgetPerSubStage < 0) {
+          errors.push(
+            `Stage '${stage.id}' orchestrator.retryBudgetPerSubStage must be non-negative integer (got ${cfg.retryBudgetPerSubStage})`
+          );
+        }
+      }
+      if (cfg.maxRecursionDepth !== void 0) {
+        if (!Number.isInteger(cfg.maxRecursionDepth) || cfg.maxRecursionDepth < 0) {
+          errors.push(
+            `Stage '${stage.id}' orchestrator.maxRecursionDepth must be non-negative integer (got ${cfg.maxRecursionDepth})`
+          );
+        } else if (cfg.maxRecursionDepth > 3) {
+          warnings.push(
+            `Stage '${stage.id}' orchestrator.maxRecursionDepth is high (${cfg.maxRecursionDepth}). Deep recursion may be expensive.`
+          );
+        }
+      }
+    }
+    if (stage.competition) {
+      warnings.push(
+        `Stage '${stage.id}' is type 'orchestrator' but also specifies competition config; competition config will be ignored.`
+      );
+    }
+    if (stage.autoloop) {
+      warnings.push(
+        `Stage '${stage.id}' is type 'orchestrator' but also specifies autoloop config; autoloop config will be ignored.`
+      );
+    }
+    if (stage.verify?.commands?.length) {
+      warnings.push(
+        `Stage '${stage.id}' is type 'orchestrator' but also specifies verify.commands; verify commands will be ignored.`
+      );
+    }
+    if (stage.refinement) {
+      warnings.push(
+        `Stage '${stage.id}' is type 'orchestrator' but also specifies refinement config; refinement config will be ignored.`
+      );
+    }
+  }
+  if (stage.type === "autoloop") {
+    if (!stage.autoloop) {
+      warnings.push(
+        `Stage '${stage.id}' is type 'autoloop' but has no autoloop config; using defaults (maxIterations: 3, timeboxMs: 1800000).`
+      );
+    } else {
+      const cfg = stage.autoloop;
+      if (cfg.maxIterations !== void 0) {
+        if (!Number.isInteger(cfg.maxIterations) || cfg.maxIterations < 1) {
+          errors.push(
+            `Stage '${stage.id}' autoloop.maxIterations must be a positive integer (got ${cfg.maxIterations})`
+          );
+        } else if (cfg.maxIterations > 20) {
+          warnings.push(
+            `Stage '${stage.id}' autoloop.maxIterations is very high (${cfg.maxIterations}). Consider limiting to \u226410 for cost control.`
+          );
+        }
+      }
+      if (cfg.timeboxMs !== void 0) {
+        if (!Number.isFinite(cfg.timeboxMs) || cfg.timeboxMs < 1e3) {
+          errors.push(
+            `Stage '${stage.id}' autoloop.timeboxMs must be at least 1000ms (got ${cfg.timeboxMs})`
+          );
+        } else if (cfg.timeboxMs > 36e5) {
+          warnings.push(
+            `Stage '${stage.id}' autoloop.timeboxMs is very high (${cfg.timeboxMs}ms = ${(cfg.timeboxMs / 6e4).toFixed(1)} minutes). Consider limiting to \u226430 minutes.`
+          );
+        }
+      }
+      if (cfg.minProgress !== void 0) {
+        if (!Number.isFinite(cfg.minProgress) || cfg.minProgress < 0 || cfg.minProgress > 1) {
+          errors.push(
+            `Stage '${stage.id}' autoloop.minProgress must be between 0 and 1 (got ${cfg.minProgress})`
+          );
+        }
+      }
+    }
+    if (stage.competition) {
+      warnings.push(
+        `Stage '${stage.id}' is type 'autoloop' but also specifies competition config; competition config will be ignored.`
+      );
+    }
+    if (stage.verify?.commands?.length) {
+      const gatesEnabled = stage.autoloop?.stopOnQualityGate === true || Array.isArray(stage.autoloop?.qualityGateCommands) && stage.autoloop?.qualityGateCommands.length > 0;
+      if (!gatesEnabled) {
+        warnings.push(
+          `Stage '${stage.id}' is type 'autoloop' but also specifies verify.commands; verify commands will be ignored unless autoloop.stopOnQualityGate=true (or autoloop.qualityGateCommands is set).`
+        );
+      }
+    }
+    if (stage.refinement) {
+      warnings.push(
+        `Stage '${stage.id}' is type 'autoloop' but also specifies refinement config; refinement config will be ignored.`
+      );
+    }
+  }
+  if (stage.outputs) {
+    for (const [outputName, outputType] of Object.entries(stage.outputs)) {
+      if (!isPathSafeIdentifier(outputName)) {
+        errors.push(
+          `Stage '${stage.id}' output name '${outputName}' contains invalid characters. Use only alphanumeric, underscore, and hyphen.`
+        );
+      }
+      if (!VALID_OUTPUT_TYPES.includes(outputType)) {
+        errors.push(
+          `Stage '${stage.id}' output '${outputName}' has invalid type '${outputType}'. Valid types: ${VALID_OUTPUT_TYPES.join(", ")}`
+        );
+      }
+    }
+  }
+  if (stage.provider !== void 0) {
+    const providerIds = getValidProviderIds();
+    if (!providerIds.ids) {
+      errors.push(
+        `Stage '${stage.id}' provider '${stage.provider}' could not be validated because the provider registry is unavailable: ${providerIds.error}`
+      );
+    } else if (!providerIds.ids.includes(stage.provider)) {
+      errors.push(
+        `Stage '${stage.id}' has invalid provider '${stage.provider}'. Valid providers: ${providerIds.ids.join(", ")}`
+      );
+    }
+  }
+  if (stage.model !== void 0 && stage.provider === void 0) {
+    warnings.push(
+      `Stage '${stage.id}' specifies model '${stage.model}' without provider. Model may be ignored during routing. Consider setting provider explicitly.`
+    );
+  }
+  if (stage.providerExecutionTransport !== void 0 && !isValidProviderExecutionTransport(stage.providerExecutionTransport)) {
+    errors.push(
+      `Stage '${stage.id}' has invalid providerExecutionTransport '${String(
+        stage.providerExecutionTransport
+      )}'. Valid values: ${VALID_PROVIDER_EXECUTION_TRANSPORTS.join(", ")}`
+    );
+  }
+  if (stage.competition?.variants) {
+    for (const [variantIdx, variant] of stage.competition.variants.entries()) {
+      if (variant.providerExecutionTransport !== void 0 && !isValidProviderExecutionTransport(variant.providerExecutionTransport)) {
+        errors.push(
+          `Stage '${stage.id}' competition.variants[${variantIdx}] has invalid providerExecutionTransport '${String(
+            variant.providerExecutionTransport
+          )}'. Valid values: ${VALID_PROVIDER_EXECUTION_TRANSPORTS.join(", ")}`
+        );
+      }
+    }
+  }
+  if (stage.modelRole !== void 0 && stage.provider === void 0) {
+    warnings.push(
+      `Stage '${stage.id}' specifies modelRole '${stage.modelRole}' without provider. modelRole requires provider to be set for registry role lookup.`
+    );
+  }
+  if (stage.validation?.enabled && stage.outputs) {
+    const outputCount = Object.keys(stage.outputs).length;
+    if (outputCount > 1 && !stage.validation.target) {
+      errors.push(
+        `Stage '${stage.id}' has ${outputCount} outputs but validation.target not specified. Must specify which output to validate: [${Object.keys(stage.outputs).join(", ")}]`
+      );
+    }
+    if (stage.validation.target) {
+      if (!Object.hasOwn(stage.outputs, stage.validation.target)) {
+        errors.push(
+          `Stage '${stage.id}' validation target '${stage.validation.target}' not found in outputs: [${Object.keys(stage.outputs).join(", ")}]`
+        );
+      }
+    }
+  }
+  if (stage.validation?.threshold !== void 0) {
+    if (stage.validation.threshold < 0 || stage.validation.threshold > 100) {
+      errors.push(
+        `Stage '${stage.id}' validation threshold ${stage.validation.threshold} must be between 0 and 100`
+      );
+    }
+  }
+  if (stage.validation?.maxRetries !== void 0) {
+    if (stage.validation.maxRetries < 0 || stage.validation.maxRetries > 10) {
+      errors.push(
+        `Stage '${stage.id}' validation maxRetries ${stage.validation.maxRetries} must be between 0 and 10`
+      );
+    }
+  }
+  if (stage.validation?.onFailure !== void 0) {
+    if (!isValidOnFailurePolicy(stage.validation.onFailure)) {
+      errors.push(
+        `Stage '${stage.id}' validation.onFailure '${String(stage.validation.onFailure)}' is invalid. Valid values: ${VALID_ON_FAILURE_POLICIES.join(", ")}`
+      );
+    }
+    if (stage.validation.onFailure === "retry-with-feedback" && stage.type !== void 0 && stage.type !== "standard" && stage.type !== "refinement") {
+      errors.push(
+        `Stage '${stage.id}' validation.onFailure 'retry-with-feedback' is only supported for standard and refinement stages`
+      );
+    }
+  }
+  if (stage.validation?.checks && stage.validation.checks.length > 0) {
+    for (const check of stage.validation.checks) {
+      const checkResult = validateExplicitCheck(check, stage.id);
+      if (!checkResult.valid && checkResult.error) {
+        errors.push(checkResult.error);
+      }
+    }
+  }
+  if (stage.validation?.requiredFiles && stage.validation.requiredFiles.length > 0) {
+    for (const requiredFile of stage.validation.requiredFiles) {
+      const pathResult = isValidCheckPath(requiredFile);
+      if (!pathResult.valid) {
+        errors.push(`Stage '${stage.id}' requiredFiles path invalid: ${pathResult.error}`);
+        continue;
+      }
+      if (requiredFile.endsWith("/")) {
+        errors.push(
+          `Stage '${stage.id}' requiredFiles must use exact file paths, not directories: ${requiredFile}`
+        );
+      }
+    }
+  }
+  if (stage.validation?.completionContract !== void 0) {
+    const contractValidation = validateCompletionContracts(stage.validation.completionContract);
+    for (const contractError of contractValidation.errors) {
+      errors.push(`Stage '${stage.id}' ${contractError.field}: ${contractError.message}`);
+    }
+  }
+  appendSeededPlanCompletionContractErrors(stage.id, stage.seededPlan, errors);
+  if (stage.allowlist && stage.allowlist.length > 0) {
+    for (const allowlistPath of stage.allowlist) {
+      const pathResult = isValidCheckPath(allowlistPath);
+      if (!pathResult.valid) {
+        errors.push(`Stage '${stage.id}' allowlist path invalid: ${pathResult.error}`);
+      }
+    }
+  }
+  if (stage.type !== "verify" && stage.capabilities?.executionIntent === "analysis" && (!stage.outputs || Object.keys(stage.outputs).length === 0)) {
+    errors.push(
+      `Stage '${stage.id}' is analysis-intent but has no outputs configured. Add outputs (recommended: outputs: { report: 'text' }).`
+    );
+  }
+  if (stage.allowlist && stage.allowlist.length > 0 && stage.outputs) {
+    const outputTypes = Object.values(stage.outputs);
+    const hasCodeOutput = outputTypes.some((t) => t === "diff" || t === "files");
+    const hasTextOutput = outputTypes.some(
+      (t) => t === "text" || t === "json" || t === "testResults"
+    );
+    if (hasTextOutput && !hasCodeOutput) {
+      if (stage.capabilities?.executionIntent === "analysis") {
+        warnings.push(
+          `Stage '${stage.id}' sets executionIntent: analysis with a non-empty allowlist. Providers run read-only; allowlisted edits will be denied unless intent or outputs change.`
+        );
+      } else if (stage.capabilities?.executionIntent !== "edit") {
+        warnings.push(
+          `Stage '${stage.id}' declares an allowlist but only text-type outputs. Execution runs with edit intent because the allowlist signals file modifications. Add a code-type output (e.g. outputs: { patch: diff }) or set capabilities.executionIntent: edit.`
+        );
+      }
+    }
+  }
+  if (stage.allowlistMode === "strict") {
+    if (!stage.allowlist || stage.allowlist.length === 0) {
+      warnings.push(
+        `Stage '${stage.id}' uses allowlistMode: strict with no allowlist entries. Any file changes will fail the stage.`
+      );
+    } else if (!stage.allowlist.some((p) => p.endsWith("/"))) {
+      warnings.push(
+        `Stage '${stage.id}' uses allowlistMode: strict with file-level allowlist entries only. This commonly fails on ripple edits (e.g. async propagation). Consider directory prefixes or allowlistMode: warn.`
+      );
+    }
+  }
+  if (stage.validation?.enabled && stage.type !== "verify" && !stage.outputs && !stage.validation?.checks?.length && !stage.validation?.semanticChecks?.length && !stage.verify?.commands?.length) {
+    warnings.push(
+      `Stage '${stage.id}' ${VALIDATION_NO_SIGNALS_WARNING_DETAILS}. This is informational only and does not cause stage failure. Consider adding validation.checks or outputs for meaningful validation signals.`
+    );
+  }
+  if (stage.gates && stage.gates.length > 0) {
+    for (const [idx, gate] of stage.gates.entries()) {
+      const validGateTypes = ["biome", "test", "build", "custom"];
+      if (!validGateTypes.includes(gate.type)) {
+        errors.push(
+          `Stage '${stage.id}' gates[${idx}].type is invalid: '${gate.type}'. Valid types: ${validGateTypes.join(", ")}`
+        );
+      }
+      const validGateModes = ["block", "warn"];
+      if (!validGateModes.includes(gate.mode)) {
+        errors.push(
+          `Stage '${stage.id}' gates[${idx}].mode is invalid: '${gate.mode}'. Valid modes: ${validGateModes.join(", ")}`
+        );
+      }
+      if (gate.files && gate.files.length > 0) {
+        for (const [fileIdx, filePath] of gate.files.entries()) {
+          const pathResult = isValidCheckPath(filePath);
+          if (!pathResult.valid) {
+            errors.push(
+              `Stage '${stage.id}' gates[${idx}].files[${fileIdx}] invalid: ${pathResult.error}`
+            );
+          }
+        }
+      }
+      if (gate.type === "custom" && (!gate.command || gate.command.trim().length === 0)) {
+        errors.push(
+          `Stage '${stage.id}' gates[${idx}] type 'custom' requires non-empty 'command' field`
+        );
+      }
+      if (gate.maxDiagnostics !== void 0) {
+        if (gate.type !== "biome") {
+          warnings.push(
+            `Stage '${stage.id}' gates[${idx}].maxDiagnostics is set but gate type is '${gate.type}' (only applies to 'biome')`
+          );
+        } else if (!Number.isInteger(gate.maxDiagnostics) || gate.maxDiagnostics < 1 || gate.maxDiagnostics > 1e3) {
+          errors.push(
+            `Stage '${stage.id}' gates[${idx}].maxDiagnostics must be an integer between 1 and 1000 (got ${gate.maxDiagnostics})`
+          );
+        }
+      }
+    }
+  }
+  if (errors.length > 0) {
+    return {
+      valid: false,
+      error: errors.join("; "),
+      warnings: warnings.length > 0 ? warnings : void 0
+    };
+  }
+  return {
+    valid: true,
+    warnings: warnings.length > 0 ? warnings : void 0
+  };
+}
+function isValidationNoSignalsWarning(warning, stageId) {
+  return warning.startsWith(`Stage '${stageId}' ${VALIDATION_NO_SIGNALS_WARNING_DETAILS}.`);
+}
+function validateWorkflowConfig(workflow) {
+  const errors = [];
+  const warnings = [];
+  const validationNoSignalsStageIds = [];
+  if (!workflow.stages || workflow.stages.length === 0) {
+    return {
+      valid: false,
+      error: "Workflow must have at least one stage"
+    };
+  }
+  const stageIds = new Set(workflow.stages.map((s) => s.id));
+  const seenIds = /* @__PURE__ */ new Set();
+  for (const stage of workflow.stages) {
+    if (seenIds.has(stage.id)) {
+      errors.push(`Duplicate stage id: '${stage.id}'`);
+    }
+    seenIds.add(stage.id);
+  }
+  for (const stage of workflow.stages) {
+    const stageResult = validateStageConfig(stage);
+    if (!stageResult.valid && stageResult.error) {
+      errors.push(stageResult.error);
+    }
+    if (stageResult.warnings) {
+      for (const warning of stageResult.warnings) {
+        if (isValidationNoSignalsWarning(warning, stage.id)) {
+          validationNoSignalsStageIds.push(stage.id);
+        } else {
+          warnings.push(warning);
+        }
+      }
+    }
+    if (stage.deps) {
+      for (const dep of stage.deps) {
+        if (!stageIds.has(dep)) {
+          errors.push(
+            `Stage '${stage.id}' has dependency '${dep}' which does not exist. Available stages: [${Array.from(stageIds).join(", ")}]`
+          );
+        }
+      }
+    }
+  }
+  const cycleError = detectCircularDependencies(workflow.stages);
+  if (cycleError) {
+    errors.push(cycleError);
+  }
+  errors.push(...validateArtifactReferences(workflow));
+  if (workflow.strict?.denylist && workflow.strict.denylist.length > 0) {
+    for (const denylistPath of workflow.strict.denylist) {
+      const pathResult = isValidCheckPath(denylistPath);
+      if (!pathResult.valid) {
+        errors.push(`Workflow strict.denylist path invalid: ${pathResult.error}`);
+      }
+    }
+  }
+  if (workflow.strict?.denylistMode) {
+    const mode = workflow.strict.denylistMode;
+    if (mode !== "off" && mode !== "warn" && mode !== "strict") {
+      errors.push(
+        `Workflow strict.denylistMode invalid: '${String(mode)}' (expected off|warn|strict)`
+      );
+    }
+  }
+  if (validationNoSignalsStageIds.length > 0) {
+    warnings.push(
+      `Workflow has validation enabled but no outputs or checks defined for stages: ${validationNoSignalsStageIds.join(
+        ", "
+      )}. This is informational only; add validation.checks or outputs for meaningful validation signals.`
+    );
+  }
+  if (errors.length > 0) {
+    return {
+      valid: false,
+      error: errors.join("; "),
+      warnings: warnings.length > 0 ? warnings : void 0
+    };
+  }
+  return {
+    valid: true,
+    warnings: warnings.length > 0 ? warnings : void 0
+  };
+}
+function validateArtifactReferences(workflow) {
+  const errors = [];
+  const stageOutputs = /* @__PURE__ */ new Map();
+  const stageMap = /* @__PURE__ */ new Map();
+  for (const stage of workflow.stages ?? []) {
+    stageMap.set(stage.id, stage);
+    stageOutputs.set(stage.id, new Set(Object.keys(stage.outputs ?? {})));
+  }
+  const dependencyClosureCache = /* @__PURE__ */ new Map();
+  const getDependencyClosure = (stageId) => {
+    const cached = dependencyClosureCache.get(stageId);
+    if (cached) return cached;
+    const closure = /* @__PURE__ */ new Set();
+    const visit = (depId) => {
+      if (closure.has(depId)) return;
+      closure.add(depId);
+      const depStage = stageMap.get(depId);
+      for (const transitiveDep of depStage?.deps ?? []) {
+        visit(transitiveDep);
+      }
+    };
+    const stage = stageMap.get(stageId);
+    for (const dep of stage?.deps ?? []) {
+      visit(dep);
+    }
+    dependencyClosureCache.set(stageId, closure);
+    return closure;
+  };
+  for (const stage of workflow.stages ?? []) {
+    for (const ref of stage.inputs ?? []) {
+      try {
+        const { stageId, outputName } = parseArtifactRef(ref);
+        const outputs = stageOutputs.get(stageId);
+        if (!outputs) {
+          errors.push(
+            `Stage '${stage.id}' references artifact '${ref}' from non-existent stage '${stageId}'`
+          );
+          continue;
+        }
+        if (!outputs.has(outputName)) {
+          const available = outputs.size > 0 ? Array.from(outputs).join(", ") : "none";
+          errors.push(
+            `Stage '${stage.id}' references output '${outputName}' which doesn't exist in stage '${stageId}'. Available: [${available}]`
+          );
+          continue;
+        }
+        if (!getDependencyClosure(stage.id).has(stageId)) {
+          errors.push(
+            `Stage '${stage.id}' references artifact '${ref}' but does not depend on producer stage '${stageId}'`
+          );
+        }
+      } catch (err) {
+        errors.push(
+          `Stage '${stage.id}' has invalid artifact reference '${ref}': ${err instanceof Error ? err.message : String(err)}`
+        );
+      }
+    }
+  }
+  return errors;
+}
+function detectCircularDependencies(stages) {
+  const stageMap = new Map(stages.map((s) => [s.id, s]));
+  const visiting = /* @__PURE__ */ new Set();
+  const visited = /* @__PURE__ */ new Set();
+  function dfs(stageId, path5) {
+    if (visited.has(stageId)) {
+      return null;
+    }
+    if (visiting.has(stageId)) {
+      const cycleStart = path5.indexOf(stageId);
+      const cycle = [...path5.slice(cycleStart), stageId].join(" \u2192 ");
+      return `Circular dependency detected: ${cycle}`;
+    }
+    visiting.add(stageId);
+    path5.push(stageId);
+    const stage = stageMap.get(stageId);
+    if (stage?.deps) {
+      for (const dep of stage.deps) {
+        const result = dfs(dep, [...path5]);
+        if (result) {
+          return result;
+        }
+      }
+    }
+    visiting.delete(stageId);
+    visited.add(stageId);
+    return null;
+  }
+  for (const stage of stages) {
+    const result = dfs(stage.id, []);
+    if (result) {
+      return result;
+    }
+  }
+  return null;
+}
+
+// src/automation/installed-dependency-drift.ts
+function formatInstalledDependencyDriftWarning(drift, projectRoot) {
+  const [first] = drift;
+  if (!first) return null;
+  const more = drift.length > 1 ? ` and ${drift.length - 1} more` : "";
+  return `Warning: installed packages do not match package-lock.json (${first.name} ${first.installed}, locked ${first.locked}${more}). Run \`npm ci\` in ${projectRoot} to install them.`;
+}
+
+// src/automation/flywheel-preflight.ts
+var PACKAGE_ROOT_ENV = "BUILD_PACKAGE_ROOT";
+function isCodexProviderInsideCodexSandbox(providerId) {
+  return providerId === "codex" && process.env.CODEX_SANDBOX !== void 0;
+}
+async function checkRepoClean(cwd, mode, suppressExpectedSetupWarning = false) {
+  const start = Date.now();
+  const check = "repo-clean";
+  const description = "Repository working directory is clean";
+  try {
+    const { stdout } = await execa2("git", ["status", "--porcelain", "--untracked-files=all"], {
+      cwd,
+      stdio: "pipe",
+      timeout: 1e4
+    });
+    const lines = filterWorktreeRunSentinelStatusOutput(stdout).trimEnd().split("\n").filter((line) => line.length > 0);
+    if (lines.length === 0) {
+      return {
+        check,
+        description,
+        passed: true,
+        durationMs: Date.now() - start
+      };
+    }
+    const changedPaths = lines.flatMap(parsePorcelainLinePaths);
+    const pathSummary = summarizeRepoPaths(changedPaths);
+    const conflictStatuses = /* @__PURE__ */ new Set(["DD", "AU", "UD", "UA", "DU", "AA", "UU"]);
+    const hasConflictStatuses = lines.some((line) => conflictStatuses.has(line.slice(0, 2)));
+    const runtimeArtifactOnly = pathSummary.categories.length > 0 && pathSummary.categories.every(
+      (category) => category === "runtime-artifact" || category === "generated-artifact"
+    );
+    const expectedSetupDirt = pathSummary.systemWriteOnly;
+    const unstaged = lines.filter((l) => l.startsWith(" M") || l.startsWith("??"));
+    const staged = lines.filter((l) => l.startsWith("M ") || l.startsWith("A "));
+    let message = `Repository has ${lines.length} uncommitted change(s):
+`;
+    if (staged.length > 0) {
+      message += `  Staged: ${staged.length} file(s)
+`;
+    }
+    if (unstaged.length > 0) {
+      message += `  Unstaged/Untracked: ${unstaged.length} file(s)
+`;
+    }
+    if (hasConflictStatuses) {
+      message += "  Scope: merge/conflict state detected\n";
+    } else if (pathSummary.systemWriteOnly) {
+      message += "  Scope: managed/runtime metadata only (task/, sprint/, backlog/, .build-project/codex-home/, .build-project/plans/, .build-project/planning/)\n";
+    } else if (pathSummary.harmlessOnly) {
+      message += "  Scope: generated/runtime artifacts only\n";
+    } else {
+      message += "  Scope: includes repository content changes\n";
+    }
+    message += `Run 'git status' to see details.`;
+    const managedSetupOnly = pathSummary.systemWriteOnly || pathSummary.harmlessOnly;
+    const metadata = {
+      changedPaths,
+      systemWriteOnly: pathSummary.systemWriteOnly,
+      harmlessOnly: pathSummary.harmlessOnly,
+      categories: pathSummary.categories,
+      hasConflictStatuses,
+      runtimeArtifactOnly,
+      expectedSetupDirt
+    };
+    if (hasConflictStatuses || mode === "fail" && !runtimeArtifactOnly && !managedSetupOnly) {
+      message += hasConflictStatuses ? " Resolve conflicts before running Flywheel." : " Commit or stash changes before running Flywheel (or run without strict cleanliness).";
+      return {
+        check,
+        description,
+        passed: false,
+        error: message,
+        metadata,
+        durationMs: Date.now() - start
+      };
+    }
+    if (suppressExpectedSetupWarning && managedSetupOnly) {
+      return {
+        check,
+        description,
+        passed: true,
+        metadata,
+        durationMs: Date.now() - start
+      };
+    }
+    return {
+      check,
+      description,
+      passed: true,
+      warning: message,
+      metadata,
+      durationMs: Date.now() - start
+    };
+  } catch (err) {
+    return {
+      check,
+      description,
+      passed: false,
+      error: `Failed to check git status: ${err instanceof Error ? err.message : String(err)}`,
+      durationMs: Date.now() - start
+    };
+  }
+}
+async function checkWorktreeSanity(baseDir) {
+  const start = Date.now();
+  const check = "worktree-sanity";
+  const description = "Worktree base directory is accessible and writable";
+  try {
+    await fs3.mkdir(baseDir, { recursive: true });
+    const testFile = path4.join(baseDir, ".preflight-test");
+    await fs3.writeFile(testFile, "test");
+    await fs3.unlink(testFile);
+    return {
+      check,
+      description,
+      passed: true,
+      durationMs: Date.now() - start
+    };
+  } catch (err) {
+    return {
+      check,
+      description,
+      passed: false,
+      error: `Worktree base directory ${baseDir} is not writable: ${err instanceof Error ? err.message : String(err)}`,
+      durationMs: Date.now() - start
+    };
+  }
+}
+async function registeredWorktreeCount(repoRoot) {
+  try {
+    const result = await execGit(["worktree", "list", "--porcelain"], { cwd: repoRoot });
+    if (result.exitCode !== 0) return void 0;
+    return result.stdout.split("\n").filter((line) => line.startsWith("worktree ")).length;
+  } catch {
+    return void 0;
+  }
+}
+async function checkWorktreeHygiene(baseDir, repoRoot, hygieneConfig) {
+  const start = Date.now();
+  const check = "worktree-hygiene";
+  const description = "Worktree count and age are within acceptable limits";
+  const warnThreshold = hygieneConfig?.warnThreshold ?? 50;
+  const blockThreshold = hygieneConfig?.blockThreshold ?? 100;
+  const registeredWarnThreshold = hygieneConfig?.registeredWarnThreshold ?? warnThreshold;
+  const staleAgeDays = hygieneConfig?.staleAgeDays ?? 7;
+  const autoCleanup = hygieneConfig?.autoCleanup ?? false;
+  const autoCleanupDryRun = hygieneConfig?.autoCleanupDryRun ?? false;
+  try {
+    const entries = await fs3.readdir(baseDir, { withFileTypes: true });
+    const worktrees = entries.filter((e) => e.isDirectory());
+    const totalCount = worktrees.length;
+    const registeredCount = await registeredWorktreeCount(repoRoot);
+    const staleAgeMs = staleAgeDays * 24 * 60 * 60 * 1e3;
+    const now = Date.now();
+    let staleCount = 0;
+    for (const entry of worktrees) {
+      try {
+        const wtPath = path4.join(baseDir, entry.name);
+        const stats = await fs3.stat(wtPath);
+        const age = now - stats.mtimeMs;
+        if (age > staleAgeMs) {
+          staleCount++;
+        }
+      } catch {
+      }
+    }
+    let currentCount = totalCount;
+    if (autoCleanup && staleCount > 0) {
+      try {
+        const cleanupManager = new WorktreeCleanupManager(baseDir);
+        const report = await cleanupManager.cleanup({
+          maxAgeMs: staleAgeMs,
+          dryRun: autoCleanupDryRun
+        });
+        if (!autoCleanupDryRun && report.deleted > 0) {
+          console.log(`Cleaned ${report.deleted} stale worktree(s) (older than ${staleAgeDays}d)`);
+          const updatedEntries = await fs3.readdir(baseDir, { withFileTypes: true });
+          const updatedWorktrees = updatedEntries.filter((e) => e.isDirectory());
+          currentCount = updatedWorktrees.length;
+          staleCount = 0;
+        } else if (autoCleanupDryRun && report.deleted > 0) {
+          console.log(
+            `Would clean ${report.deleted} stale worktree(s) (older than ${staleAgeDays}d)`
+          );
+        }
+      } catch (cleanupErr) {
+        console.warn(
+          `Auto-cleanup failed: ${cleanupErr instanceof Error ? cleanupErr.message : String(cleanupErr)}`
+        );
+      }
+    }
+    const metadata = {
+      baseDirectoryCount: currentCount,
+      ...registeredCount === void 0 ? {} : { registeredWorktreeCount: registeredCount }
+    };
+    if (currentCount >= blockThreshold) {
+      return {
+        check,
+        description,
+        passed: false,
+        error: `Worktree count (${currentCount}) exceeds block threshold (${blockThreshold}). Run build cleanup doctor or build cleanup worktrees --show-preserved to review preserved categories (dirty, uninspectable, active-run, lab/manual-only, nested-child, external, missing path, too-recent, branch-attached/protected/current) before any cleanup.`,
+        metadata,
+        durationMs: Date.now() - start
+      };
+    }
+    const warnings = [];
+    if (currentCount >= warnThreshold) {
+      warnings.push(
+        `Worktree count (${currentCount}) exceeds warning threshold (${warnThreshold}). Consider cleaning up old worktrees.`
+      );
+    }
+    if (registeredCount !== void 0 && registeredCount >= registeredWarnThreshold) {
+      warnings.push(
+        `Worktrees registered to this repository (${registeredCount}, across all linked roots) exceed advisory threshold (${registeredWarnThreshold}). Review with build cleanup worktrees --show-preserved --verbose.`
+      );
+    }
+    if (!autoCleanup && staleCount > 0) {
+      warnings.push(
+        `Found ${staleCount} stale worktree(s) (older than ${staleAgeDays}d). Consider enabling --auto-cleanup.`
+      );
+    }
+    if (warnings.length > 0) {
+      return {
+        check,
+        description,
+        passed: true,
+        warning: warnings.join(" "),
+        metadata,
+        durationMs: Date.now() - start
+      };
+    }
+    return {
+      check,
+      description,
+      passed: true,
+      metadata,
+      durationMs: Date.now() - start
+    };
+  } catch (err) {
+    return {
+      check,
+      description,
+      passed: false,
+      error: `Worktree hygiene check failed: ${err instanceof Error ? err.message : String(err)}`,
+      durationMs: Date.now() - start
+    };
+  }
+}
+async function checkWorktreeRecovery(hygieneConfig) {
+  const start = Date.now();
+  const check = "worktree-recovery";
+  const description = "Recover orphaned worktrees from prior runs";
+  try {
+    const maxAgeMs = (hygieneConfig?.staleAgeDays ?? 7) * 24 * 60 * 60 * 1e3;
+    const { recoverPendingWorktrees: recovery, enforceRetentionBounds: retention } = await runFlywheelWorktreeHygiene({
+      dryRun: hygieneConfig?.recoveryDryRun ?? true,
+      verbose: false,
+      maxAgeMs,
+      maxCount: 20
+    });
+    const totalRecovered = recovery.recovered.length + recovery.alreadyGone.length;
+    const totalPruned = retention.pruned.length;
+    const totalErrors = recovery.errors.length + retention.errors.length;
+    const metadata = {
+      dryRun: hygieneConfig?.recoveryDryRun ?? true,
+      recovered: recovery.recovered,
+      recoveredCount: recovery.recovered.length,
+      alreadyGone: recovery.alreadyGone,
+      alreadyGoneCount: recovery.alreadyGone.length,
+      skippedActive: recovery.skippedActive,
+      skippedActiveCount: recovery.skippedActive.length,
+      skippedDirty: recovery.skippedDirty,
+      skippedDirtyCount: recovery.skippedDirty.length,
+      pruned: retention.pruned,
+      prunedCount: retention.pruned.length,
+      errors: [...recovery.errors, ...retention.errors],
+      errorCount: totalErrors,
+      totalRecovered,
+      totalPruned
+    };
+    let warning;
+    if (totalRecovered > 0 || totalPruned > 0 || totalErrors > 0 || recovery.skippedActive.length > 0 || recovery.skippedDirty.length > 0) {
+      const parts = [];
+      if (recovery.recovered.length > 0) {
+        parts.push(`recovered ${recovery.recovered.length} orphaned worktree(s)`);
+      }
+      if (recovery.alreadyGone.length > 0) {
+        parts.push(`reconciled ${recovery.alreadyGone.length} already-removed record(s)`);
+      }
+      if (totalPruned > 0) {
+        parts.push(`pruned ${totalPruned} over-retained worktree(s)`);
+      }
+      if (recovery.skippedActive.length > 0) {
+        parts.push(`preserved ${recovery.skippedActive.length} active worktree(s)`);
+      }
+      if (recovery.skippedDirty.length > 0) {
+        parts.push(`skipped ${recovery.skippedDirty.length} dirty worktree(s)`);
+      }
+      if (totalErrors > 0) {
+        const sampleError = recovery.errors[0]?.error ?? retention.errors[0]?.error ?? "see logs for details";
+        const trimmedSample = sampleError.length > 200 ? `${sampleError.slice(0, 197)}...` : sampleError;
+        parts.push(`encountered ${totalErrors} error(s) during cleanup (first: ${trimmedSample})`);
+      }
+      warning = `Worktree recovery: ${parts.join("; ")}`;
+    }
+    return {
+      check,
+      description,
+      passed: true,
+      warning,
+      metadata,
+      durationMs: Date.now() - start
+    };
+  } catch (err) {
+    return {
+      check,
+      description,
+      passed: true,
+      // Don't block execution on recovery failure
+      warning: `Worktree recovery failed: ${err instanceof Error ? err.message : String(err)}`,
+      durationMs: Date.now() - start
+    };
+  }
+}
+async function checkProviderAuth(workflow, cwd, authProbeEnv) {
+  const start = Date.now();
+  const check = "provider-auth";
+  const description = "All providers are authenticated and available";
+  try {
+    const providers = /* @__PURE__ */ new Set();
+    const implicitDefaultProviderStages = [];
+    const defaultProvider = resolveDefaultProvider(void 0, cwd).value;
+    for (const stage of workflow.stages) {
+      const hasCompetitionVariants = Array.isArray(stage.competition?.variants) && stage.competition.variants.length > 0;
+      if (stage.provider) {
+        providers.add(stage.provider);
+      } else if (stage.type !== "verify" && !hasCompetitionVariants) {
+        providers.add(defaultProvider);
+        implicitDefaultProviderStages.push(stage.id);
+      }
+      if (stage.orchestrator?.orchestrationProvider) {
+        providers.add(stage.orchestrator.orchestrationProvider);
+      }
+      if (stage.competition?.variants) {
+        for (const variant of stage.competition.variants) {
+          providers.add(variant.provider);
+        }
+      }
+    }
+    if (providers.size === 0) {
+      return {
+        check,
+        description,
+        passed: true,
+        metadata: {
+          info: "No provider-backed stages found"
+        },
+        durationMs: Date.now() - start
+      };
+    }
+    const errors = [];
+    const warnings = [];
+    for (const providerId of providers) {
+      try {
+        const isEnabled = ProviderRegistry.isProviderEnabled(providerId);
+        if (!isEnabled) {
+          errors.push(`Provider '${providerId}' is not enabled`);
+          continue;
+        }
+        if (isCodexProviderInsideCodexSandbox(providerId)) {
+          errors.push(
+            "Provider 'codex' cannot run from inside Codex's outer sandbox; run Codex-provider stages from a normal terminal or choose a different provider."
+          );
+          continue;
+        }
+        const providerConfig = ProviderRegistry.getProviderConfig(providerId);
+        if (providerConfig?.experimental) {
+          warnings.push(
+            `Provider '${providerId}' is experimental; startup behavior may be less stable.`
+          );
+        }
+        const health = getProviderHealth(providerId);
+        if (health.lastFailurePhase && health.consecutiveFailures > 0) {
+          warnings.push(
+            `Provider '${providerId}' has recorded ${health.lastFailurePhase} failure history (health ${health.score.toFixed(2)}); watch for recurrence.`
+          );
+        }
+        for (const stage of workflow.stages) {
+          const pinnedModels = [];
+          if (stage.provider === providerId) {
+            pinnedModels.push({ provider: providerId, model: stage.model, stageId: stage.id });
+          }
+          if (stage.orchestrator?.orchestrationProvider === providerId) {
+            pinnedModels.push({
+              provider: providerId,
+              model: stage.orchestrator.orchestrationModel,
+              stageId: stage.id
+            });
+          }
+          if (stage.competition?.variants) {
+            for (const variant of stage.competition.variants) {
+              if (variant.provider === providerId) {
+                pinnedModels.push({
+                  provider: providerId,
+                  model: variant.model,
+                  stageId: stage.id
+                });
+              }
+            }
+          }
+          for (const pinned of pinnedModels) {
+            try {
+              ProviderRegistry.resolveModel(pinned.provider, pinned.model);
+            } catch (err) {
+              errors.push(
+                `Stage '${pinned.stageId}' pins invalid model for provider '${pinned.provider}': ` + (err instanceof Error ? err.message : String(err))
+              );
+            }
+          }
+        }
+        const readiness = await getProviderReadiness(providerId, {
+          mode: "execute",
+          authProbeMode: "passive",
+          ...authProbeEnv ? { authProbeEnv } : {}
+        });
+        if (readiness.known === false || readiness.configured === false) {
+          errors.push(
+            `Provider '${providerId}' is unavailable: ${readiness.reason ?? "provider is not configured for CLI execution"}`
+          );
+        } else if (!readiness.installed) {
+          errors.push(
+            `Provider '${providerId}' is unavailable: ${readiness.reason ?? "CLI is not installed"}`
+          );
+        } else if (!readiness.cliHealthy) {
+          errors.push(
+            `Provider '${providerId}' is unavailable: ${readiness.reason ?? "CLI health check failed"}`
+          );
+        } else if (readiness.sandboxCapable === false) {
+          errors.push(
+            `Provider '${providerId}' is unavailable: ${readiness.sandboxReason ?? readiness.reason ?? "sandbox capability check failed"}`
+          );
+        } else if (readiness.authenticated === "no") {
+          errors.push(
+            `Provider '${providerId}' has its CLI but authentication is missing.` + (readiness.authCommand ? ` ${readiness.authCommand}` : "")
+          );
+        } else if (readiness.authenticated === "unknown") {
+          warnings.push(
+            `Provider '${providerId}' auth status is unreported by passive preflight; runtime will defer to the provider CLI.`
+          );
+        }
+      } catch (err) {
+        warnings.push(
+          `Could not verify provider '${providerId}': ${err instanceof Error ? err.message : String(err)}`
+        );
+      }
+    }
+    if (errors.length > 0) {
+      return {
+        check,
+        description,
+        passed: false,
+        error: errors.join("\n"),
+        durationMs: Date.now() - start
+      };
+    }
+    return {
+      check,
+      description,
+      passed: true,
+      warning: warnings.length > 0 ? warnings.join("\n") : void 0,
+      metadata: implicitDefaultProviderStages.length > 0 ? { implicitDefaultProvider: defaultProvider, implicitDefaultProviderStages } : void 0,
+      durationMs: Date.now() - start
+    };
+  } catch (err) {
+    return {
+      check,
+      description,
+      passed: false,
+      error: `Provider auth check failed: ${err instanceof Error ? err.message : String(err)}`,
+      durationMs: Date.now() - start
+    };
+  }
+}
+async function checkArtifactRefs(workflow) {
+  const start = Date.now();
+  const check = "artifact-refs";
+  const description = "All artifact references are valid (DAG validation)";
+  try {
+    const errors = [];
+    const stageOutputs = /* @__PURE__ */ new Map();
+    for (const stage of workflow.stages) {
+      const outputs = /* @__PURE__ */ new Set();
+      if (stage.outputs) {
+        for (const outputName of Object.keys(stage.outputs)) {
+          outputs.add(outputName);
+        }
+      }
+      stageOutputs.set(stage.id, outputs);
+    }
+    const stageOrder = /* @__PURE__ */ new Map();
+    for (let i = 0; i < workflow.stages.length; i++) {
+      const stage = workflow.stages[i];
+      if (stage) {
+        stageOrder.set(stage.id, i);
+      }
+    }
+    const stageMap = new Map(workflow.stages.map((stage) => [stage.id, stage]));
+    const closureCache = /* @__PURE__ */ new Map();
+    const getDependencyClosure = (stageId) => {
+      const cached = closureCache.get(stageId);
+      if (cached) return cached;
+      const closure = /* @__PURE__ */ new Set();
+      const visit = (depId) => {
+        if (closure.has(depId)) return;
+        closure.add(depId);
+        for (const transitiveDep of stageMap.get(depId)?.deps ?? []) {
+          visit(transitiveDep);
+        }
+      };
+      for (const dep of stageMap.get(stageId)?.deps ?? []) {
+        visit(dep);
+      }
+      closureCache.set(stageId, closure);
+      return closure;
+    };
+    for (const stage of workflow.stages) {
+      if (!stage.inputs || stage.inputs.length === 0) continue;
+      const stageIndex = stageOrder.get(stage.id) ?? 0;
+      for (const ref of stage.inputs) {
+        try {
+          const { stageId, outputName } = parseArtifactRef(ref);
+          if (!stageOutputs.has(stageId)) {
+            errors.push(
+              `Stage '${stage.id}' references artifact '${ref}' from non-existent stage '${stageId}'`
+            );
+            continue;
+          }
+          const outputs = stageOutputs.get(stageId);
+          if (!outputs) {
+            errors.push(
+              `Stage '${stage.id}' references artifact '${ref}' from stage '${stageId}', but that stage has no recorded outputs`
+            );
+            continue;
+          }
+          if (!outputs.has(outputName)) {
+            const available = outputs.size > 0 ? Array.from(outputs).join(", ") : "none";
+            errors.push(
+              `Stage '${stage.id}' references output '${outputName}' which doesn't exist in stage '${stageId}'. Available: [${available}]`
+            );
+            continue;
+          }
+          const sourceIndex = stageOrder.get(stageId) ?? 0;
+          if (sourceIndex >= stageIndex) {
+            errors.push(
+              `Stage '${stage.id}' has forward reference to '${ref}' (source stage '${stageId}' must come before this stage)`
+            );
+            continue;
+          }
+          if (!getDependencyClosure(stage.id).has(stageId)) {
+            errors.push(
+              `Stage '${stage.id}' references artifact '${ref}' but does not depend on producer stage '${stageId}'`
+            );
+          }
+        } catch (err) {
+          errors.push(
+            `Stage '${stage.id}' has invalid artifact reference '${ref}': ${err instanceof Error ? err.message : String(err)}`
+          );
+        }
+      }
+    }
+    if (errors.length > 0) {
+      return {
+        check,
+        description,
+        passed: false,
+        error: errors.join("\n"),
+        durationMs: Date.now() - start
+      };
+    }
+    return {
+      check,
+      description,
+      passed: true,
+      durationMs: Date.now() - start
+    };
+  } catch (err) {
+    return {
+      check,
+      description,
+      passed: false,
+      error: `Artifact reference validation failed: ${err instanceof Error ? err.message : String(err)}`,
+      durationMs: Date.now() - start
+    };
+  }
+}
+async function checkConfig(workflow) {
+  const start = Date.now();
+  const check = "config-validation";
+  const description = "Workflow configuration is valid";
+  try {
+    const result = validateWorkflowConfig(workflow);
+    if (!result.valid) {
+      return {
+        check,
+        description,
+        passed: false,
+        error: result.error || "Configuration validation failed",
+        durationMs: Date.now() - start
+      };
+    }
+    return {
+      check,
+      description,
+      passed: true,
+      warning: result.warnings?.join("\n"),
+      durationMs: Date.now() - start
+    };
+  } catch (err) {
+    return {
+      check,
+      description,
+      passed: false,
+      error: `Configuration validation error: ${err instanceof Error ? err.message : String(err)}`,
+      durationMs: Date.now() - start
+    };
+  }
+}
+async function checkContextUtilization(workflow, cwd) {
+  const start = Date.now();
+  const check = "context-utilization";
+  const description = "Prompt context fits within context window limits";
+  try {
+    const estimator = new TokenEstimator();
+    const warnings = [];
+    const WARN_THRESHOLD = 0.65;
+    const defaultProvider = resolveDefaultProvider(void 0, cwd).value;
+    for (const stage of workflow.stages) {
+      if (!stage.prompt) continue;
+      const provider = stage.provider || defaultProvider;
+      const model = stage.model || applyFlywheelModelDefaults(stage, provider);
+      if (!model) continue;
+      const decision = await estimator.analyzeTask(stage.prompt, provider, model);
+      if (decision.utilizationPercent / 100 >= WARN_THRESHOLD) {
+        const utilizationPct = decision.utilizationPercent.toFixed(1);
+        const adjustedPct = decision.adjustedUtilizationPercent.toFixed(1);
+        warnings.push(
+          `Stage '${stage.id}': Prompt context utilization is ${utilizationPct}% (${adjustedPct}% with overhead) of ${decision.contextWindow.toLocaleString()} token context window. Estimated: ${decision.estimatedTokens.toLocaleString()} tokens. Consider splitting task or reducing context to improve reliability.`
+        );
+      }
+      if (stage.competition?.variants && stage.prompt) {
+        for (const variant of stage.competition.variants) {
+          const variantProvider = variant.provider || provider;
+          const variantModel = variant.model || applyFlywheelModelDefaults(stage, variantProvider);
+          if (!variantModel) continue;
+          if (variantProvider === provider && variantModel === model) continue;
+          const variantDecision = await estimator.analyzeTask(
+            stage.prompt,
+            variantProvider,
+            variantModel
+          );
+          if (variantDecision.utilizationPercent / 100 >= WARN_THRESHOLD) {
+            const utilizationPct = variantDecision.utilizationPercent.toFixed(1);
+            const adjustedPct = variantDecision.adjustedUtilizationPercent.toFixed(1);
+            warnings.push(
+              `Stage '${stage.id}' variant '${[variant.provider, variant.model].filter(Boolean).join(":")}': Prompt context utilization is ${utilizationPct}% (${adjustedPct}% with overhead) of ${variantDecision.contextWindow.toLocaleString()} token context window. Estimated: ${variantDecision.estimatedTokens.toLocaleString()} tokens. Consider splitting task or reducing context to improve reliability.`
+            );
+          }
+        }
+      }
+    }
+    estimator.cleanup();
+    return {
+      check,
+      description,
+      passed: true,
+      warning: warnings.length > 0 ? warnings.join("\n") : void 0,
+      durationMs: Date.now() - start
+    };
+  } catch (err) {
+    return {
+      check,
+      description,
+      passed: true,
+      warning: `Context utilization check failed: ${err instanceof Error ? err.message : String(err)}`,
+      durationMs: Date.now() - start
+    };
+  }
+}
+function getStringProp(obj, key) {
+  if (typeof obj === "object" && obj !== null) {
+    const val = obj[key];
+    return typeof val === "string" ? val : void 0;
+  }
+  return void 0;
+}
+function extractFileRefs(prompt) {
+  return parseFileDirectiveLines(prompt).map((line) => line.path);
+}
+function extractCreateAnnotatedFileRefs(prompt) {
+  return new Set(extractCreateAnnotatedFilePaths(prompt));
+}
+async function checkTaskSpecFreshness(workflow, cwd) {
+  const start = Date.now();
+  const check = "task-spec-freshness";
+  const description = "Task spec files exist and git refs are valid";
+  const errors = [];
+  const warnings = [];
+  try {
+    const displayPath = (filePath) => path4.relative(cwd, filePath).replace(/\\/g, "/");
+    for (const stage of workflow.stages) {
+      const stageUnknown = stage;
+      const taskId = getStringProp(stageUnknown, "taskId");
+      if (taskId) {
+        const taskBucketPath = getBucketPathByKind("task", cwd);
+        const taskFilePath = path4.join(taskBucketPath, `${taskId}.md`);
+        try {
+          await fs3.access(taskFilePath);
+        } catch {
+          errors.push(`Stage '${stage.id}': task file not found: ${displayPath(taskFilePath)}`);
+        }
+      }
+      const backlogItemId = getStringProp(stageUnknown, "backlogItemId");
+      if (backlogItemId) {
+        const backlogBucketPath = getBucketPathByKind("backlog", cwd);
+        const backlogFilePath = path4.join(backlogBucketPath, `${backlogItemId}.md`);
+        try {
+          await fs3.access(backlogFilePath);
+        } catch {
+          errors.push(
+            `Stage '${stage.id}': backlog file not found: ${displayPath(backlogFilePath)}`
+          );
+        }
+      }
+      if (stage.prompt) {
+        const fileRefs = extractFileRefs(stage.prompt);
+        const createAnnotatedRefs = extractCreateAnnotatedFileRefs(stage.prompt);
+        for (const fileRef of fileRefs) {
+          const filePath = path4.isAbsolute(fileRef) ? fileRef : path4.join(cwd, fileRef);
+          try {
+            await fs3.access(filePath);
+          } catch {
+            if (!createAnnotatedRefs.has(fileRef)) {
+              errors.push(`Stage '${stage.id}': FILE reference not found on disk: ${fileRef}`);
+            }
+          }
+        }
+      }
+      const baseRef = getStringProp(stageUnknown, "baseRef");
+      if (baseRef) {
+        try {
+          await execa2("git", ["rev-parse", "--verify", baseRef], {
+            cwd,
+            stdio: "pipe",
+            timeout: 1e4
+          });
+        } catch {
+          errors.push(`Stage '${stage.id}': baseRef '${baseRef}' does not exist in git repository`);
+        }
+      }
+      const baseSha = getStringProp(stageUnknown, "baseSha");
+      if (baseSha) {
+        try {
+          await execa2("git", ["rev-parse", "--verify", baseSha], {
+            cwd,
+            stdio: "pipe",
+            timeout: 1e4
+          });
+          try {
+            await execa2("git", ["merge-base", "--is-ancestor", baseSha, "HEAD"], {
+              cwd,
+              stdio: "pipe",
+              timeout: 1e4
+            });
+          } catch {
+            warnings.push(
+              `Stage '${stage.id}': baseSha '${baseSha}' exists but is not an ancestor of HEAD \u2014 may reference a rebased or force-pushed commit`
+            );
+          }
+        } catch {
+          errors.push(
+            `Stage '${stage.id}': baseSha '${baseSha}' does not exist in git repository (SHA unreachable \u2014 commit may have been pruned or the ref was never pushed)`
+          );
+        }
+      }
+    }
+    if (errors.length > 0) {
+      return {
+        check,
+        description,
+        passed: false,
+        error: errors.join("\n"),
+        warning: warnings.length > 0 ? warnings.join("\n") : void 0,
+        durationMs: Date.now() - start
+      };
+    }
+    return {
+      check,
+      description,
+      passed: true,
+      warning: warnings.length > 0 ? warnings.join("\n") : void 0,
+      durationMs: Date.now() - start
+    };
+  } catch (err) {
+    return {
+      check,
+      description,
+      passed: false,
+      error: `Task spec freshness check failed: ${err instanceof Error ? err.message : String(err)}`,
+      durationMs: Date.now() - start
+    };
+  }
+}
+async function collectBuildInputFiles(dir) {
+  let entries;
+  try {
+    entries = await fs3.readdir(dir, { withFileTypes: true });
+  } catch (error) {
+    if (error && typeof error === "object" && "code" in error && error.code === "ENOENT") {
+      return [];
+    }
+    throw error;
+  }
+  const files = [];
+  for (const entry of entries) {
+    const fullPath = path4.join(dir, entry.name);
+    if (entry.isDirectory()) {
+      if (entry.name === "node_modules" || entry.name === "dist" || entry.name === ".git") {
+        continue;
+      }
+      files.push(...await collectBuildInputFiles(fullPath));
+      continue;
+    }
+    if (!entry.isFile()) continue;
+    if (!entry.name.endsWith(".ts") && !entry.name.endsWith(".tsx")) continue;
+    if (entry.name.endsWith(".test.ts") || entry.name.endsWith(".spec.ts")) continue;
+    files.push(fullPath);
+  }
+  return files;
+}
+async function collectGeneratedProviderFiles(dir) {
+  let entries;
+  try {
+    entries = await fs3.readdir(dir, { withFileTypes: true });
+  } catch (error) {
+    if (error && typeof error === "object" && "code" in error && error.code === "ENOENT") {
+      return [];
+    }
+    throw error;
+  }
+  const files = [];
+  for (const entry of entries) {
+    const fullPath = path4.join(dir, entry.name);
+    if (entry.isDirectory()) {
+      files.push(...await collectGeneratedProviderFiles(fullPath));
+      continue;
+    }
+    if (!entry.isFile()) continue;
+    if (entry.name.endsWith(".lock")) continue;
+    if (!entry.name.endsWith(".json")) continue;
+    files.push(fullPath);
+  }
+  return files;
+}
+var BUILD_INPUT_PATHS = [
+  "src",
+  "package.json",
+  "tsconfig.json",
+  "tsup.config.ts",
+  ".build-project/config/providers.yaml",
+  "providers"
+];
+function parseLineOutput(stdout) {
+  return stdout.split("\n").map((line) => line.trim()).filter(Boolean);
+}
+async function getDirtyBuildInputPaths(projectRoot) {
+  try {
+    const tracked = await execa2(
+      "git",
+      ["diff", "--name-only", "HEAD", "--", ...BUILD_INPUT_PATHS],
+      {
+        cwd: projectRoot,
+        stdio: "pipe",
+        reject: false
+      }
+    );
+    const untracked = await execa2(
+      "git",
+      ["ls-files", "--others", "--exclude-standard", "--", ...BUILD_INPUT_PATHS],
+      {
+        cwd: projectRoot,
+        stdio: "pipe",
+        reject: false
+      }
+    );
+    if (tracked.exitCode !== 0 || untracked.exitCode !== 0) {
+      return null;
+    }
+    return new Set(
+      [...parseLineOutput(tracked.stdout), ...parseLineOutput(untracked.stdout)].map(
+        (relativePath) => path4.join(projectRoot, relativePath)
+      )
+    );
+  } catch {
+    return null;
+  }
+}
+async function hasSourceBuildInputs(projectRoot) {
+  try {
+    await fs3.stat(path4.join(projectRoot, "src"));
+    await fs3.stat(path4.join(projectRoot, "tsup.config.ts"));
+    return true;
+  } catch (error) {
+    if (error && typeof error === "object" && "code" in error && error.code === "ENOENT") {
+      return false;
+    }
+    throw error;
+  }
+}
+async function getLatestCommittedBuildInput(projectRoot) {
+  try {
+    const latestCommit = await execa2(
+      "git",
+      ["log", "-1", "--format=%ct%x00%H", "--", ...BUILD_INPUT_PATHS],
+      {
+        cwd: projectRoot,
+        stdio: "pipe",
+        reject: false
+      }
+    );
+    if (latestCommit.exitCode !== 0 || !latestCommit.stdout) {
+      return null;
+    }
+    const [timestampRaw, commitSha] = latestCommit.stdout.split("\0");
+    const committedAtMs = Number.parseInt(timestampRaw ?? "", 10) * 1e3;
+    if (!Number.isFinite(committedAtMs) || !commitSha) {
+      return null;
+    }
+    const latestPaths = await execa2(
+      "git",
+      ["diff-tree", "--no-commit-id", "--name-only", "-r", commitSha, "--", ...BUILD_INPUT_PATHS],
+      {
+        cwd: projectRoot,
+        stdio: "pipe",
+        reject: false
+      }
+    );
+    const latestPath = latestPaths.exitCode === 0 ? parseLineOutput(latestPaths.stdout)[0] : void 0;
+    return {
+      path: latestPath,
+      committedAtMs
+    };
+  } catch {
+    return null;
+  }
+}
+function resolveBuildPackageRoot() {
+  const configuredRoot = process.env[PACKAGE_ROOT_ENV]?.trim();
+  if (configuredRoot) return path4.resolve(configuredRoot);
+  let current = path4.dirname(fileURLToPath(import.meta.url));
+  let distOnlyPackageRoot;
+  while (true) {
+    if (path4.basename(current) === "dist" && existsSync2(path4.join(current, "entry.js"))) {
+      distOnlyPackageRoot ??= path4.dirname(current);
+    }
+    const packageJsonPath = path4.join(current, "package.json");
+    if (existsSync2(packageJsonPath)) {
+      try {
+        const packageJson = JSON.parse(readFileSync(packageJsonPath, "utf8"));
+        if (packageJson.name === "@ebrindley/build") {
+          return current;
+        }
+      } catch {
+      }
+    }
+    const parent = path4.dirname(current);
+    if (parent === current) {
+      return distOnlyPackageRoot ?? getProjectRoot();
+    }
+    current = parent;
+  }
+}
+async function checkBuildFreshness(projectRoot = resolveBuildPackageRoot()) {
+  const start = Date.now();
+  const check = "build-freshness";
+  const description = "Built CLI artifacts are up-to-date";
+  const distEntry = path4.join(projectRoot, "dist", "entry.js");
+  try {
+    let distStat;
+    try {
+      distStat = await fs3.stat(distEntry);
+    } catch {
+      return {
+        check,
+        description,
+        passed: false,
+        error: "dist/entry.js not found. Run `npm run build` before executing the pipeline.",
+        durationMs: Date.now() - start
+      };
+    }
+    const distMtimeMs = distStat.mtimeMs;
+    const entryIntegrity = await readDistEntryIntegrity(projectRoot);
+    if (!entryIntegrity.readable) {
+      return {
+        check,
+        description,
+        passed: false,
+        error: `Build is unusable: dist/entry.js could not be read (${entryIntegrity.reason}). Run \`npm run build\` before executing.`,
+        durationMs: Date.now() - start
+      };
+    }
+    if (entryIntegrity.missingChunks.length > 0) {
+      return {
+        check,
+        description,
+        passed: false,
+        error: `Build is inconsistent: dist/entry.js references missing dist/${entryIntegrity.missingChunks[0]}. Run \`npm run build\` before executing.`,
+        durationMs: Date.now() - start
+      };
+    }
+    const sourceBuildInputsPresent = await hasSourceBuildInputs(projectRoot);
+    if (!sourceBuildInputsPresent) {
+      return {
+        check,
+        description,
+        passed: true,
+        metadata: { packageMode: true },
+        durationMs: Date.now() - start
+      };
+    }
+    const buildInputs = [
+      ...await collectBuildInputFiles(path4.join(projectRoot, "src")),
+      ...await collectGeneratedProviderFiles(path4.join(projectRoot, "providers")),
+      ...BUILD_INPUT_PATHS.slice(1).filter((relativePath) => relativePath !== "providers").map((relativePath) => path4.join(projectRoot, relativePath))
+    ];
+    const dirtyBuildInputPaths = await getDirtyBuildInputPaths(projectRoot);
+    const latestCommittedBuildInput = dirtyBuildInputPaths ? await getLatestCommittedBuildInput(projectRoot) : null;
+    let newestInputPath;
+    let newestInputMtimeMs = Number.NEGATIVE_INFINITY;
+    for (const buildInput of buildInputs) {
+      try {
+        const inputStat = await fs3.stat(buildInput);
+        const isDirty = dirtyBuildInputPaths?.has(buildInput) ?? true;
+        if (isDirty && inputStat.mtimeMs > distMtimeMs) {
+          return {
+            check,
+            description,
+            passed: false,
+            error: `Build is stale: ${path4.relative(projectRoot, buildInput)} is newer than dist/entry.js. Run \`npm run build\` before executing.`,
+            durationMs: Date.now() - start
+          };
+        }
+        if (inputStat.mtimeMs > newestInputMtimeMs) {
+          newestInputMtimeMs = inputStat.mtimeMs;
+          newestInputPath = buildInput;
+        }
+      } catch (error) {
+        if (error && typeof error === "object" && "code" in error && error.code === "ENOENT") {
+          continue;
+        }
+        throw error;
+      }
+    }
+    if (latestCommittedBuildInput && latestCommittedBuildInput.committedAtMs > distMtimeMs) {
+      const rel = latestCommittedBuildInput.path ? latestCommittedBuildInput.path : BUILD_INPUT_PATHS.join(", ");
+      return {
+        check,
+        description,
+        passed: false,
+        error: `Build is stale: ${rel} is newer than dist/entry.js. Run \`npm run build\` before executing.`,
+        durationMs: Date.now() - start
+      };
+    }
+    if (!dirtyBuildInputPaths && newestInputPath && newestInputMtimeMs > distMtimeMs) {
+      const rel = path4.relative(projectRoot, newestInputPath);
+      return {
+        check,
+        description,
+        passed: false,
+        error: `Build is stale: ${rel} is newer than dist/entry.js. Run \`npm run build\` before executing.`,
+        durationMs: Date.now() - start
+      };
+    }
+    return {
+      check,
+      description,
+      passed: true,
+      durationMs: Date.now() - start
+    };
+  } catch (err) {
+    return {
+      check,
+      description,
+      passed: false,
+      error: `Build freshness check failed: ${err instanceof Error ? err.message : String(err)}`,
+      durationMs: Date.now() - start
+    };
+  }
+}
+async function describeInstalledDependencyDrift() {
+  const projectRoot = resolveBuildPackageRoot();
+  const drift = await findInstalledDependencyDrift(projectRoot);
+  return formatInstalledDependencyDriftWarning(drift, projectRoot);
+}
+async function ensureFreshBuild(options) {
+  if (process.env.BUILD_CLI_REEXEC_AFTER_BUILD === "1") {
+    return { fresh: true, rebuilt: false };
+  }
+  const initialResult = await checkBuildFreshness();
+  if (initialResult.passed) {
+    return { fresh: true, rebuilt: false };
+  }
+  const originalError = initialResult.error ?? "Build is stale or missing.";
+  const quiet = options?.quiet ?? isQuietOutputRequested();
+  const projectRoot = resolveBuildPackageRoot();
+  const entryExists = existsSync2(path4.join(projectRoot, "dist", "entry.js"));
+  const entryIntegrity = entryExists ? await readDistEntryIntegrity(projectRoot) : null;
+  const ownership = await resolveDistOwnership(projectRoot);
+  const decision = decideDistRebuild(ownership, {
+    artifactExists: entryExists,
+    artifactRelativePath: "dist/entry.js",
+    missingBundledFiles: entryIntegrity?.readable ? entryIntegrity.missingChunks : [],
+    unusableReason: entryIntegrity && !entryIntegrity.readable ? `it could not be read (${entryIntegrity.reason})` : void 0
+  });
+  if (decision.action === "fail") {
+    throw new Error(decision.message);
+  }
+  if (decision.action === "proceed") {
+    if (options?.requireFresh) {
+      throw new Error(originalError);
+    }
+    if (!quiet && isVerboseOutputRequested()) {
+      console.log(decision.diagnostic);
+    }
+    return { fresh: true, rebuilt: false };
+  }
+  if (!quiet) {
+    console.log(chalk.yellow("Build is stale. Auto-rebuilding..."));
+  }
+  const buildResult = await execa2("npm", ["run", "build"], {
+    cwd: projectRoot,
+    stdio: quiet ? ["ignore", "pipe", "pipe"] : "inherit",
+    reject: false
+  });
+  if (buildResult.exitCode !== 0) {
+    const output = [buildResult.stderr, buildResult.stdout].map((value) => value?.trim()).filter(Boolean).join("\n").slice(0, 4e3);
+    throw new Error(
+      `npm run build failed with exit code ${buildResult.exitCode}${output ? `:
+${output}` : ""}`
+    );
+  }
+  await writeDistBuildStamp(projectRoot, { ownership });
+  const verifyResult = await checkBuildFreshness(projectRoot);
+  if (verifyResult.passed) {
+    return { fresh: true, rebuilt: true };
+  }
+  throw new Error(`${originalError} Auto-rebuild did not resolve the issue.`);
+}
+var CLI_REEXEC_ENV = "BUILD_CLI_REEXEC_AFTER_BUILD";
+var JSONL_CAPTURE_FILE_ENV = "BUILD_JSONL_CAPTURE_FILE";
+var REEXEC_SIGNALS = ["SIGINT", "SIGTERM", "SIGHUP"];
+function signalToExitCode(signal) {
+  switch (signal) {
+    case "SIGINT":
+      return 130;
+    case "SIGTERM":
+      return 143;
+    case "SIGHUP":
+      return 129;
+    default:
+      return signal ? 1 : null;
+  }
+}
+function resolveCliReexecEntry() {
+  const packageRoot = resolveBuildPackageRoot();
+  const fallbackEntry = path4.join(packageRoot, "dist", "entry.js");
+  const invokedEntry = process.argv[1] ? path4.resolve(process.argv[1]) : fallbackEntry;
+  return invokedEntry.endsWith(".js") || invokedEntry.endsWith(".mjs") ? invokedEntry : fallbackEntry;
+}
+function writeJsonStdoutText(text, stdoutFilePath) {
+  if (!text) return;
+  if (stdoutFilePath) {
+    appendFileSync(stdoutFilePath, text, "utf8");
+    return;
+  }
+  writeAllSyncToFd(1, text);
+}
+function argvRequestsJsonOutput(argv) {
+  return argv.includes("--json") || argv.includes("-j") || argv.includes("--output=json");
+}
+async function reexecCurrentCliCommand(cwd) {
+  const entryPath = resolveCliReexecEntry();
+  const captureJsonStdout = isJsonOutputRequested() || argvRequestsJsonOutput(process.argv);
+  const jsonCaptureDir = captureJsonStdout ? await fs3.mkdtemp(path4.join(os2.tmpdir(), "build-jsonl-reexec-")) : void 0;
+  const jsonCaptureFile = jsonCaptureDir ? path4.join(jsonCaptureDir, "stdout.jsonl") : void 0;
+  const stdoutFilePath = captureJsonStdout ? resolveStdoutRegularFilePath() : void 0;
+  signalCoordinator.suspendProcessSignalHandlers();
+  let child = null;
+  let pendingSignal = null;
+  const forwardSignal = (signal) => {
+    if (!child) {
+      pendingSignal = signal;
+      return;
+    }
+    if (signal === "SIGINT" && process.stdin.isTTY) {
+      return;
+    }
+    if (process.platform !== "win32" && typeof child.pid === "number") {
+      try {
+        process.kill(child.pid, signal);
+        return;
+      } catch {
+      }
+    }
+    child.kill?.(signal);
+  };
+  const forwardSigint = () => forwardSignal("SIGINT");
+  const forwardSigterm = () => forwardSignal("SIGTERM");
+  const forwardSighup = () => forwardSignal("SIGHUP");
+  const forwarders = {
+    SIGINT: forwardSigint,
+    SIGTERM: forwardSigterm,
+    SIGHUP: forwardSighup
+  };
+  for (const signal of REEXEC_SIGNALS) {
+    process.on(signal, forwarders[signal]);
+  }
+  const exitCode = await (async () => {
+    try {
+      child = execa2(process.execPath, [entryPath, ...process.argv.slice(2)], {
+        cwd: cwd ?? getProjectRoot(),
+        stdio: captureJsonStdout ? ["inherit", "pipe", "inherit"] : "inherit",
+        reject: false,
+        env: {
+          ...process.env,
+          [CLI_REEXEC_ENV]: "1",
+          ...jsonCaptureFile ? { [JSONL_CAPTURE_FILE_ENV]: jsonCaptureFile } : {}
+        }
+      });
+      if (pendingSignal) {
+        forwardSignal(pendingSignal);
+      }
+      const result = await child;
+      if (jsonCaptureFile) {
+        const captured = await fs3.readFile(jsonCaptureFile, "utf8").catch(() => "");
+        if (captured) {
+          writeJsonStdoutText(captured, stdoutFilePath);
+        } else if (typeof result.stdout === "string" && result.stdout) {
+          writeJsonStdoutText(result.stdout, stdoutFilePath);
+        }
+      }
+      return result.exitCode ?? signalToExitCode(result.signal) ?? 1;
+    } finally {
+      if (jsonCaptureDir) {
+        await fs3.rm(jsonCaptureDir, { recursive: true, force: true }).catch(() => void 0);
+      }
+      for (const signal of REEXEC_SIGNALS) {
+        process.removeListener(signal, forwarders[signal]);
+      }
+      signalCoordinator.resumeProcessSignalHandlers();
+    }
+  })();
+  process.exit(exitCode);
+}
+async function runWorkflowPreflight(workflow, options = {}) {
+  const startTime = Date.now();
+  const cwd = options.cwd || process.cwd();
+  const worktreeRoot = options.worktreeHygiene?.baseDir ?? getWorktreeBaseDir();
+  const skip = options.skip || {};
+  const checks = [];
+  const errors = [];
+  const warnings = [];
+  const repoCleanMode = options.repoCleanMode ?? "warn";
+  const suppressExpectedSetupRepoDirtyWarning = options.suppressExpectedSetupRepoDirtyWarning ?? false;
+  const runCheck = async (name, skipFlag, fn) => {
+    if (skipFlag) {
+      if (options.verbose) {
+        console.log(`  [SKIP] ${name}`);
+      }
+      return;
+    }
+    if (options.verbose) {
+      process.stdout.write(`  [....] ${name}`);
+    }
+    const result = await fn();
+    checks.push(result);
+    if (!result.passed && result.error) {
+      errors.push(result.error);
+    }
+    if (result.warning) {
+      warnings.push(result.warning);
+    }
+    if (options.verbose) {
+      const status = result.passed ? result.warning ? "WARN" : "PASS" : "FAIL";
+      process.stdout.write(`\r  [${status}] ${name} (${result.durationMs}ms)
+`);
+    }
+  };
+  if (options.verbose) {
+    console.log("\nRunning preflight checks...\n");
+  }
+  await runCheck(
+    "Build freshness",
+    skip.buildFreshness || process.env[CLI_REEXEC_ENV] === "1",
+    () => checkBuildFreshness()
+  );
+  await runCheck("Configuration validation", skip.configValidation, () => checkConfig(workflow));
+  await runCheck(
+    "Task spec freshness",
+    skip.taskSpecFreshness,
+    () => checkTaskSpecFreshness(workflow, cwd)
+  );
+  await runCheck(
+    "Repository cleanliness",
+    skip.repoClean,
+    () => checkRepoClean(cwd, repoCleanMode, suppressExpectedSetupRepoDirtyWarning)
+  );
+  await runCheck("Worktree sanity", skip.worktreeSanity, () => checkWorktreeSanity(worktreeRoot));
+  await runCheck(
+    "Worktree hygiene",
+    skip.worktreeHygiene,
+    () => checkWorktreeHygiene(worktreeRoot, cwd, { ...options.worktreeHygiene, baseDir: worktreeRoot })
+  );
+  await runCheck(
+    "Worktree recovery",
+    skip.worktreeRecovery,
+    () => checkWorktreeRecovery({ ...options.worktreeHygiene, baseDir: worktreeRoot })
+  );
+  await runCheck(
+    "Provider authentication",
+    skip.providerAuth,
+    () => checkProviderAuth(workflow, cwd, options.authProbeEnv)
+  );
+  await runCheck("Artifact references", skip.artifactRefs, () => checkArtifactRefs(workflow));
+  await runCheck(
+    "Context window utilization",
+    skip.contextUtilization,
+    () => checkContextUtilization(workflow, cwd)
+  );
+  const totalDurationMs = Date.now() - startTime;
+  const passed = errors.length === 0;
+  const passedCount = checks.filter((c) => c.passed).length;
+  const failedCount = checks.filter((c) => !c.passed).length;
+  const warnCount = checks.filter((c) => c.warning).length;
+  let summary = `Preflight: ${passedCount}/${checks.length} checks passed`;
+  if (failedCount > 0) {
+    summary += `, ${failedCount} failed`;
+  }
+  if (warnCount > 0) {
+    summary += `, ${warnCount} warnings`;
+  }
+  summary += ` (${totalDurationMs}ms)`;
+  if (options.verbose) {
+    console.log(`
+${passed ? "Preflight PASSED" : "Preflight FAILED"}: ${summary}
+`);
+    if (errors.length > 0) {
+      console.log("Errors:");
+      for (const error of errors) {
+        console.log(`  - ${error}`);
+      }
+    }
+    if (warnings.length > 0) {
+      console.log("Warnings:");
+      for (const warning of warnings) {
+        console.log(`  - ${warning}`);
+      }
+    }
+  }
+  return {
+    passed,
+    checks,
+    errors,
+    warnings,
+    totalDurationMs,
+    summary
+  };
+}
+async function runPlanPreflight(cwd, options) {
+  let buildResult;
+  try {
+    buildResult = await ensureFreshBuild({ requireFresh: true });
+  } catch (error) {
+    return { passed: false, error: error instanceof Error ? error.message : String(error) };
+  }
+  if (options?.reexecOnRebuild === true && buildResult.rebuilt && process.env[CLI_REEXEC_ENV] !== "1") {
+    await reexecCurrentCliCommand(cwd);
+  }
+  const workingDir = cwd ?? process.cwd();
+  const repoResult = await checkRepoClean(workingDir, "warn");
+  if (!repoResult.passed) {
+    const meta = repoResult.metadata;
+    return {
+      passed: false,
+      error: meta?.hasConflictStatuses ? `${repoResult.error?.split("\n")[0] ?? "Repository has uncommitted changes"}
+Resolve conflicts before running planned build.` : repoResult.error
+    };
+  }
+  if (repoResult.warning) {
+    const meta = repoResult.metadata;
+    if (meta?.hasConflictStatuses) {
+      return {
+        passed: false,
+        error: `${repoResult.warning.split("\n")[0]}
+Resolve conflicts before running planned build.`
+      };
+    }
+    return {
+      passed: true,
+      warning: repoResult.warning
+    };
+  }
+  return { passed: true };
+}
+
+export {
+  UTILIZATION_WARN_PERCENT,
+  UTILIZATION_SPLIT_PERCENT,
+  TokenEstimator,
+  recordSyncWriteNoProgress,
+  writeAllSyncToFd,
+  resolveStdoutRegularFilePath,
+  getExtensionsRootDir,
+  getExtensionDirs,
+  runAsyncWithOptionalTimeout,
+  cleanupWorkflowRelatedBranchesAndWorktrees,
+  recoverPendingWorktrees,
+  enforceRetentionBounds,
+  getFlywheelCleanupDryRunWorktreeSummary,
+  makeRetryDecision,
+  validateGeneratedSubStageVerifyCommands,
+  validateWorkflowConfig,
+  BUILD_INPUT_PATHS,
+  checkBuildFreshness,
+  describeInstalledDependencyDrift,
+  ensureFreshBuild,
+  writeJsonStdoutText,
+  reexecCurrentCliCommand,
+  runWorkflowPreflight,
+  runPlanPreflight
+};
+//# sourceMappingURL=chunk-ES6NWJ36.js.map