@goondocks/myco 0.20.1 → 0.21.0

package/dist/{main-E7HU4QYR.js → main-5PRQNEEE.js}

@@ -1,11 +1,14 @@
 import { createRequire as __cr } from 'node:module'; const require = __cr(import.meta.url);
+import {
+  enumerateMatrixCells
+} from "./chunk-54SXG5HF.js";
 import {
   DaemonLogger,
   LEVEL_ORDER
 } from "./chunk-3WOS4TAR.js";
 import {
   withTaskConfig
-} from "./chunk-US4LNCAT.js";
+} from "./chunk-IPPMYQ2Y.js";
 import {
   EMBEDDABLE_TABLES,
   EMBEDDABLE_TEXT_COLUMNS,
@@ -15,16 +18,20 @@ import {
   getEmbeddingQueueDepth,
   getUnembedded,
   markEmbedded
-} from "./chunk-22JALAXN.js";
+} from "./chunk-75Z7UKDY.js";
 import {
+  deleteSecrets,
   getTeamPackageVersion,
   loadSecrets,
   readJsonConfig,
   readSecrets,
   resolveVaultConfigPath,
   writeSecret
-} from "./chunk-QS5TWZBL.js";
+} from "./chunk-R2JIJBCL.js";
 import {
+  DEFAULT_OPENAI_URL,
+  DEFAULT_OPENROUTER_URL,
+  SKILL_SURVEY_TASK,
   buildTaskInstruction,
   closeOpenBatches,
   countBatchesBySession,
@@ -32,67 +39,82 @@ import {
   countNotifications,
   countRuns,
   countSkillRecords,
+  countWriteIntents,
+  countWriteIntentsByTool,
+  countWriteIntentsByToolForEvaluation,
   createBatchLineage,
+  createLocalOpenAIBackend,
   deleteCandidate,
   deleteSkillRecordCascade,
   dismissAllNotifications,
-  errorMessage,
   findBatchByPromptPrefix,
   getAllDomains,
   getCandidate,
-  getDigestExtract,
-  getEntity,
   getGraphForNode,
   getLatestBatch,
+  getLatestOpenBatch,
+  getLatestResumableRunForTask,
   getLatestRunId,
+  getLocalOpenAIBackendDefaultBaseUrl,
+  getLocalOpenAIBackendLabel,
   getNotification,
   getRun,
   getSkillRecord,
   getSkillRecordByName,
+  getSkillSurveyEligibility,
   hasConfiguredProvider,
   incrementActivityCount,
   incrementSkillUsageCount,
+  inferLocalOpenAIBackendKind,
   insertBatchStateless,
   insertResolutionEvent,
   isInstructionRequiredTask,
   listBatchesBySession,
   listCandidatesWithCount,
-  listDigestExtracts,
-  listEntities,
   listLineageForSkill,
   listNotifications,
   listReports,
   listRuns,
+  listRunsForEvaluation,
   listSkillRecords,
   listSkillRecordsWithCount,
+  listWriteIntentTools,
+  listWriteIntents,
   markAllRead,
+  markRunningRunsInterrupted,
   notify,
   populateBatchResponses,
   register,
+  runAgent,
   setResponseSummary,
+  tryParseJson,
   updateCandidate,
   updateNotificationStatus
-} from "./chunk-FGY7J6EZ.js";
+} from "./chunk-NGH7U6A3.js";
+import {
+  errorMessage,
+  parseCheckpointState,
+  runDurationMs
+} from "./chunk-6LB7XELY.js";
 import {
   fullTextSearch,
   hydrateSearchResults
-} from "./chunk-5XIVBO25.js";
+} from "./chunk-LVIY7P35.js";
 import {
   copyTaskToUser,
   deleteUserTask,
   loadAllTasks,
   validateTaskName,
   writeUserTask
-} from "./chunk-57O67XVF.js";
+} from "./chunk-ILJPRYES.js";
 import {
-  AgentTaskSchema,
   registerAgent,
   resolveDefinitionsDir,
   taskFromParsed
-} from "./chunk-4M7EWPIA.js";
+} from "./chunk-JZS6GZ6T.js";
 import {
   listTurnsByRun
-} from "./chunk-6RFZWV4R.js";
+} from "./chunk-FCJ5JV54.js";
 import {
   cleanupStagedSkill,
   listStaleStagingDirs
@@ -100,7 +122,11 @@ import {
 import {
   Anthropic,
   createEmbeddingProvider
-} from "./chunk-KHT24OWC.js";
+} from "./chunk-YDUOSRGD.js";
+import {
+  OPENAI_API_KEY_ENV,
+  OPENROUTER_API_KEY_ENV
+} from "./chunk-CISWUP5W.js";
 import {
   getMachineId
 } from "./chunk-ENWBFX7F.js";
@@ -109,26 +135,42 @@ import {
   cleanStaleBuffers,
   listBufferSessionIds
 } from "./chunk-V7XG6V6C.js";
-import "./chunk-POEPHBQK.js";
-import "./chunk-UEWMSIL3.js";
+import "./chunk-JR54LTPP.js";
 import "./chunk-SAKJMNSR.js";
 import {
   SymbiontInstaller
-} from "./chunk-LZP4IJB3.js";
+} from "./chunk-VHNRMM4O.js";
 import {
   checkLocalProvider
-} from "./chunk-BPRIYNLE.js";
+} from "./chunk-TKAJ3JVF.js";
 import {
   LmStudioBackend,
   OllamaBackend
-} from "./chunk-FMRZ26U5.js";
+} from "./chunk-X3IGT5RV.js";
+import {
+  composeSessionStartContext,
+  shouldInjectSessionStartDigest
+} from "./chunk-DJ3IHNYO.js";
 import {
+  buildCortexInstructionsInput,
   countSpores,
+  deletePlan,
+  getCortexInstructions,
+  getPlan,
+  getPlanByLogicalKey,
   getSpore,
   insertSpore,
+  listDigestExtracts,
+  listDigestRevisions,
+  listPlans,
+  listPlansBySession,
   listSpores,
-  updateSporeStatus
-} from "./chunk-4YFKBL3F.js";
+  resolveInstructionDelivery,
+  rollbackDigestExtract,
+  shouldInjectCortex,
+  updateSporeStatus,
+  upsertPlan
+} from "./chunk-F3OEQYLS.js";
 import {
   backfillUnsynced,
   closeSession,
@@ -151,20 +193,29 @@ import {
   pruneOld,
   reactivateSessionIfCompleted,
   retryDeadLettered,
-  syncRow,
   updateSession,
   upsertSession
-} from "./chunk-EVDQKYCG.js";
+} from "./chunk-RQSJLWP4.js";
 import {
   evaluateSessionCaptureRules,
   readTranscriptMeta
 } from "./chunk-XL75KZGI.js";
+import {
+  PLAN_STATUSES
+} from "./chunk-CESKJD44.js";
 import {
   EMBEDDING_DIMENSIONS,
   REST_SETTABLE_STATUSES,
   SCHEMA_VERSION,
-  createSchema
-} from "./chunk-MYOZLMB2.js";
+  TRANSCRIPT_SOURCE_PREFIX,
+  buildPathPlanLogicalKey,
+  buildPlanId,
+  buildSessionPlanLogicalKey,
+  buildSessionTagPlanLogicalKey,
+  createSchema,
+  humanizePlanToken,
+  normalizePlanSourcePath
+} from "./chunk-RL5R4CQU.js";
 import {
   CONFIG_FILENAME,
   MycoConfigSchema,
@@ -177,7 +228,11 @@ import {
   updateConfig,
   updateLocalConfig,
   updateTeamConfig
-} from "./chunk-SRXTSI25.js";
+} from "./chunk-53RPGOEN.js";
+import {
+  AgentTaskSchema
+} from "./chunk-OUJSQSKE.js";
+import "./chunk-POEPHBQK.js";
 import {
   closeDatabase,
   getDatabase,
@@ -189,10 +244,10 @@ import {
 } from "./chunk-ZXZPJJN3.js";
 import {
   resolveCliEntryPath
-} from "./chunk-3WWJOTYG.js";
+} from "./chunk-P66DLD6G.js";
 import {
   getPluginVersion
-} from "./chunk-AIYFHQRX.js";
+} from "./chunk-BUTL6IFS.js";
 import {
   loadManifests,
   resolvePackageRoot
@@ -208,6 +263,7 @@ import {
   DEFAULT_AGENT_ID,
   DEFAULT_LIST_LIMIT,
   DEFAULT_RELEASE_CHANNEL,
+  DEFAULT_SYMBIONT_NAME,
   EMBEDDING_BATCH_SIZE,
   EXCLUDED_SPORE_STATUSES,
   FEED_DEFAULT_LIMIT,
@@ -241,8 +297,10 @@ import {
   SYNC_PROTOCOL_VERSION,
   TEAM_API_KEY_SECRET,
   TEAM_HEALTH_TIMEOUT_MS,
+  TEAM_REQUEST_TIMEOUT_MS,
   TEAM_SEARCH_TIMEOUT_MS,
   TEAM_SOURCE_PREFIX,
+  TEAM_SYNC_TIMEOUT_MS,
   UPDATE_CHECK_CACHE_PATH,
   UPDATE_CHECK_INTERVAL_HOURS,
   UPDATE_CONFIG_PATH,
@@ -255,7 +313,7 @@ import {
   USER_TASK_SOURCE,
   epochSeconds,
   estimateTokens
-} from "./chunk-FLLBJLHM.js";
+} from "./chunk-6C6QZ4PM.js";
 import {
   LOG_KINDS,
   kindToComponent
@@ -426,13 +484,24 @@ var DaemonServer = class {
         uptime: process.uptime()
       }
     }));
+    this.registerRoute("GET", "/api/version", async () => ({
+      body: { version: this.version }
+    }));
   }
   async handleRequest(req, res) {
     const match = this.router.match(req.method, req.url);
     if (match) {
+      const rejection = validateLoopbackRequest(req, this.port);
+      if (rejection) {
+        res.writeHead(rejection.status, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: rejection.error }));
+        return;
+      }
       this.onRequest?.();
+      const versionHeader = { "X-Myco-Api-Version": this.version };
       try {
-        const body = req.method === "POST" || req.method === "PUT" || req.method === "PATCH" ? await readBody(req) : void 0;
+        const needsBody = req.method === "POST" || req.method === "PUT" || req.method === "PATCH" || req.method === "DELETE";
+        const body = needsBody ? await readBody(req) : void 0;
         const result = await match.handler({
           body,
           query: match.query,
@@ -441,11 +510,11 @@ var DaemonServer = class {
         });
         const status = result.status ?? DEFAULT_STATUS;
         if (Buffer.isBuffer(result.body)) {
-          res.writeHead(status, result.headers ?? {});
+          res.writeHead(status, { ...versionHeader, ...result.headers });
           res.end(result.body);
           return;
         }
-        const headers = { "Content-Type": "application/json", ...result.headers };
+        const headers = { "Content-Type": "application/json", ...versionHeader, ...result.headers };
         res.writeHead(status, headers);
         res.end(JSON.stringify(result.body));
       } catch (error) {
@@ -453,7 +522,7 @@ var DaemonServer = class {
           path: req.url,
           error: error.message
         });
-        res.writeHead(500, { "Content-Type": "application/json" });
+        res.writeHead(500, { "Content-Type": "application/json", ...versionHeader });
         res.end(JSON.stringify({ error: error.message }));
       }
       return;
@@ -576,6 +645,36 @@ function readBody(req) {
     req.on("error", reject);
   });
 }
+function validateLoopbackRequest(req, port) {
+  const host = req.headers.host;
+  if (host && !isLoopbackHost(host, port)) {
+    return { status: 403, error: "forbidden_host" };
+  }
+  const origin = req.headers.origin;
+  if (origin && !isLoopbackOrigin(origin, port)) {
+    return { status: 403, error: "forbidden_origin" };
+  }
+  const method = (req.method ?? "").toUpperCase();
+  const isMutating = method === "POST" || method === "PUT" || method === "PATCH" || method === "DELETE";
+  if (!isMutating) return null;
+  const contentLengthHeader = req.headers["content-length"];
+  const contentLength = contentLengthHeader ? Number(contentLengthHeader) : NaN;
+  const hasBody = Number.isFinite(contentLength) ? contentLength > 0 : (req.headers["transfer-encoding"] ?? "").length > 0;
+  if (!hasBody) return null;
+  const contentType = (req.headers["content-type"] ?? "").toLowerCase();
+  if (!contentType.includes("application/json")) {
+    return { status: 415, error: "unsupported_media_type" };
+  }
+  return null;
+}
+function isLoopbackHost(host, port) {
+  const portStr = String(port);
+  return host === `127.0.0.1:${portStr}` || host === `localhost:${portStr}`;
+}
+function isLoopbackOrigin(origin, port) {
+  const portStr = String(port);
+  return origin === `http://127.0.0.1:${portStr}` || origin === `http://localhost:${portStr}`;
+}
 
 // src/daemon/lifecycle.ts
 var SessionRegistry = class {
@@ -2597,7 +2696,7 @@ var TeamSyncClient = class _TeamSyncClient {
           content_hash: data.content_hash ?? null
         };
       })
-    });
+    }, { timeoutMs: TEAM_SYNC_TIMEOUT_MS });
     return res;
   }
   /**
@@ -2697,17 +2796,25 @@ var TeamSyncClient = class _TeamSyncClient {
       "Content-Type": "application/json"
     };
   }
-  async request(method, path23, body) {
-    const res = await this.fetchFn(`${this.workerUrl}${path23}`, {
-      method,
-      headers: this.headers(),
-      body: body !== void 0 ? JSON.stringify(body) : void 0
-    });
-    if (!res.ok) {
-      const text = await res.text().catch(() => "");
-      throw new Error(`Team sync request ${method} ${path23} failed: ${res.status} ${text}`);
+  async request(method, path25, body, options = {}) {
+    const timeoutMs = options.timeoutMs ?? TEAM_REQUEST_TIMEOUT_MS;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+      const res = await this.fetchFn(`${this.workerUrl}${path25}`, {
+        method,
+        headers: this.headers(),
+        body: body !== void 0 ? JSON.stringify(body) : void 0,
+        signal: controller.signal
+      });
+      if (!res.ok) {
+        const text = await res.text().catch(() => "");
+        throw new Error(`Team sync request ${method} ${path25} failed: ${res.status} ${text}`);
+      }
+      return res.json();
+    } finally {
+      clearTimeout(timer);
     }
-    return res.json();
   }
 };
 
@@ -2838,7 +2945,7 @@ function createTeamHandlers(deps) {
     return { body: { retried: count } };
   }
   async function handleUpgradeWorker(_req) {
-    const { upgradeWorker } = await import("./team-3JKF7VAD.js");
+    const { upgradeWorker } = await import("./team-JTI5CDUO.js");
     logger.info("team-sync.upgrade.start", "Starting worker upgrade");
     const result = upgradeWorker(vaultDir);
     if (!result.success) {
@@ -3230,7 +3337,7 @@ function createSkillRecordDeleteHandler(deps) {
           logger.warn(LOG_KINDS.PROCESSOR_BATCH, "Failed to remove skill directory", { name: record.name, error: String(err) });
         }
         try {
-          const { syncSkillSymlinks } = await import("./installer-I6KRGJOO.js");
+          const { syncSkillSymlinks } = await import("./installer-UMH7OJ5A.js");
           syncSkillSymlinks(projectRoot, record.name, { remove: true });
         } catch (err) {
           logger.warn(LOG_KINDS.PROCESSOR_BATCH, "Failed to remove skill symlinks", { name: record.name, error: String(err) });
@@ -3449,6 +3556,10 @@ async function handleGetProgress(tracker, token) {
 
 // src/daemon/api/models.ts
 var MODEL_LIST_TIMEOUT_MS = 5e3;
+var REMOTE_MODELS_ENDPOINT = "/models";
+var OPENAI_DEFAULT_BASE_URL = "https://api.openai.com/v1";
+var OPENROUTER_DEFAULT_BASE_URL = "https://openrouter.ai/api/v1";
+var REMOTE_PROVIDER_TIMEOUT_MS = 5e3;
 var ANTHROPIC_MODELS = [
   "claude-sonnet-4-6",
   "claude-opus-4-6",
@@ -3474,22 +3585,60 @@ function filterLlmModels(models) {
     return !EMBEDDING_PATTERNS.some((p) => name.includes(p));
   });
 }
+var REMOTE_PROVIDER_DEFAULTS = {
+  openai: OPENAI_DEFAULT_BASE_URL,
+  openrouter: OPENROUTER_DEFAULT_BASE_URL
+};
+var REMOTE_PROVIDER_ENV_VARS = {
+  openai: OPENAI_API_KEY_ENV,
+  openrouter: OPENROUTER_API_KEY_ENV
+};
+function getRemoteProviderApiKey(provider) {
+  const preferredKey = process.env[REMOTE_PROVIDER_ENV_VARS[provider]];
+  if (preferredKey) return preferredKey;
+  if (provider === "openai") {
+    return process.env.OPENAI_API_KEY;
+  }
+  return void 0;
+}
+async function fetchRemoteProviderModels(provider, _baseUrl, timeoutMs = REMOTE_PROVIDER_TIMEOUT_MS) {
+  const apiKey = getRemoteProviderApiKey(provider);
+  if (!apiKey) return [];
+  const baseUrl = REMOTE_PROVIDER_DEFAULTS[provider];
+  const response = await fetch(`${baseUrl}${REMOTE_MODELS_ENDPOINT}`, {
+    headers: {
+      Authorization: `Bearer ${apiKey}`
+    },
+    signal: AbortSignal.timeout(timeoutMs)
+  });
+  if (!response.ok) {
+    throw new Error(`${provider} models request failed with ${response.status}`);
+  }
+  const data = await response.json();
+  const modelIds = (data.data ?? []).map((entry) => entry.id).filter((id) => typeof id === "string" && id.length > 0);
+  return filterLlmModels(modelIds);
+}
 async function handleGetModels(req) {
   const provider = req.query.provider;
   const type = req.query.type;
+  const localBackend = req.query.local_backend;
   if (!provider) {
     return { status: 400, body: { error: "provider query parameter required" } };
   }
   let models = [];
   try {
-    if (provider === "ollama") {
-      const backend = new OllamaBackend({ base_url: req.query.base_url });
-      models = await backend.listModels(MODEL_LIST_TIMEOUT_MS);
-    } else if (provider === "lm-studio" || provider === "openai-compatible") {
-      const backend = new LmStudioBackend({ base_url: req.query.base_url });
+    const localBackendKind = inferLocalOpenAIBackendKind({
+      type: provider === "lm-studio" ? "lmstudio" : provider,
+      localBackend,
+      baseUrl: req.query.base_url
+    });
+    if (localBackendKind) {
+      const backend = createLocalOpenAIBackend(localBackendKind, req.query.base_url);
       models = await backend.listModels(MODEL_LIST_TIMEOUT_MS);
     } else if (provider === "anthropic") {
       models = ANTHROPIC_MODELS;
+    } else if (provider === "openai" || provider === "openrouter") {
+      models = await fetchRemoteProviderModels(provider, void 0, MODEL_LIST_TIMEOUT_MS);
     }
   } catch {
   }
@@ -3707,138 +3856,6 @@ function getAttachmentByFilePath(filePath) {
   return row ? toAttachmentRow(row) : null;
 }
 
-// src/db/queries/plans.ts
-var DEFAULT_LIST_LIMIT2 = 100;
-var DEFAULT_STATUS2 = "active";
-var DEFAULT_PROCESSED2 = 0;
-var PLAN_COLUMNS = [
-  "id",
-  "status",
-  "author",
-  "title",
-  "content",
-  "source_path",
-  "tags",
-  "session_id",
-  "prompt_batch_id",
-  "content_hash",
-  "processed",
-  "embedded",
-  "created_at",
-  "updated_at",
-  "machine_id",
-  "synced_at"
-];
-var SELECT_COLUMNS4 = PLAN_COLUMNS.join(", ");
-function toPlanRow(row) {
-  return {
-    id: row.id,
-    status: row.status,
-    author: row.author ?? null,
-    title: row.title ?? null,
-    content: row.content ?? null,
-    source_path: row.source_path ?? null,
-    tags: row.tags ?? null,
-    session_id: row.session_id ?? null,
-    prompt_batch_id: row.prompt_batch_id ?? null,
-    content_hash: row.content_hash ?? null,
-    processed: row.processed,
-    embedded: row.embedded ?? 0,
-    created_at: row.created_at,
-    updated_at: row.updated_at ?? null,
-    machine_id: row.machine_id ?? "local",
-    synced_at: row.synced_at ?? null
-  };
-}
-function upsertPlan(data) {
-  const db = getDatabase();
-  db.prepare(
-    `INSERT INTO plans (
-       id, status, author, title, content,
-       source_path, tags, session_id, prompt_batch_id, content_hash,
-       processed, created_at, updated_at, machine_id
-     ) VALUES (
-       ?, ?, ?, ?, ?,
-       ?, ?, ?, ?, ?,
-       ?, ?, ?, ?
-     )
-     ON CONFLICT (id) DO UPDATE SET
-       status          = EXCLUDED.status,
-       author          = EXCLUDED.author,
-       title           = EXCLUDED.title,
-       content         = EXCLUDED.content,
-       source_path     = EXCLUDED.source_path,
-       tags            = EXCLUDED.tags,
-       session_id      = EXCLUDED.session_id,
-       prompt_batch_id = EXCLUDED.prompt_batch_id,
-       content_hash    = EXCLUDED.content_hash,
-       processed       = EXCLUDED.processed,
-       updated_at      = EXCLUDED.updated_at,
-       embedded        = CASE
-         WHEN EXCLUDED.content_hash != plans.content_hash THEN 0
-         ELSE plans.embedded
-       END`
-  ).run(
-    data.id,
-    data.status ?? DEFAULT_STATUS2,
-    data.author ?? null,
-    data.title ?? null,
-    data.content ?? null,
-    data.source_path ?? null,
-    data.tags ?? null,
-    data.session_id ?? null,
-    data.prompt_batch_id ?? null,
-    data.content_hash ?? null,
-    data.processed ?? DEFAULT_PROCESSED2,
-    data.created_at,
-    data.updated_at ?? null,
-    data.machine_id ?? getTeamMachineId()
-  );
-  const row = toPlanRow(
-    db.prepare(`SELECT ${SELECT_COLUMNS4} FROM plans WHERE id = ?`).get(data.id)
-  );
-  syncRow("plans", row);
-  return row;
-}
-function getPlan(id) {
-  const db = getDatabase();
-  const row = db.prepare(
-    `SELECT ${SELECT_COLUMNS4} FROM plans WHERE id = ?`
-  ).get(id);
-  if (!row) return null;
-  return toPlanRow(row);
-}
-function listPlans(options = {}) {
-  const db = getDatabase();
-  const conditions = [];
-  const params = [];
-  if (options.status !== void 0) {
-    conditions.push(`status = ?`);
-    params.push(options.status);
-  }
-  const where = conditions.length > 0 ? `WHERE ${conditions.join(" AND ")}` : "";
-  const limit = options.limit ?? DEFAULT_LIST_LIMIT2;
-  params.push(limit);
-  const rows = db.prepare(
-    `SELECT ${SELECT_COLUMNS4}
-     FROM plans
-     ${where}
-     ORDER BY created_at DESC
-     LIMIT ?`
-  ).all(...params);
-  return rows.map(toPlanRow);
-}
-function listPlansBySession(sessionId) {
-  const db = getDatabase();
-  const rows = db.prepare(
-    `SELECT ${SELECT_COLUMNS4}
-     FROM plans
-     WHERE session_id = ?
-     ORDER BY created_at DESC`
-  ).all(sessionId);
-  return rows.map(toPlanRow);
-}
-
 // src/daemon/jobs/session-cleanup.ts
 import { unlink, glob } from "fs/promises";
 async function cleanupAfterSessionCascade(sessionId, result, embeddingManager, vaultDir) {
@@ -3883,8 +3900,8 @@ async function triggerTitleSummary(sessionId, deps) {
   if (config.agent.summary_batch_interval <= 0) return;
   if (config.agent.event_tasks_enabled === false) return;
   try {
-    const { runAgent } = await import("./executor-J4IBXSBY.js");
-    runAgent(vaultDir, {
+    const { runAgent: runAgent2 } = await import("./executor-F2YU7HXJ.js");
+    runAgent2(vaultDir, {
       task: "title-summary",
       instruction: `Process session ${sessionId} only`,
       embeddingManager
@@ -3898,11 +3915,16 @@ async function triggerTitleSummary(sessionId, deps) {
   }
 }
 
+// src/daemon/api/error-envelope.ts
+function errorBody(code, message) {
+  return { error: { code, message } };
+}
+
 // src/daemon/api/sessions.ts
-var DEFAULT_LIST_LIMIT3 = 50;
+var DEFAULT_LIST_LIMIT2 = 50;
 var DEFAULT_LIST_OFFSET2 = 0;
 async function handleListSessions(req) {
-  const limit = req.query.limit ? Number(req.query.limit) : DEFAULT_LIST_LIMIT3;
+  const limit = req.query.limit ? Number(req.query.limit) : DEFAULT_LIST_LIMIT2;
   const offset = req.query.offset ? Number(req.query.offset) : DEFAULT_LIST_OFFSET2;
   const status = req.query.status || void 0;
   const agent = req.query.agent || void 0;
@@ -3945,7 +3967,7 @@ async function handleGetSessionAttachments(req) {
 }
 async function handleGetSessionPlans(req) {
   const plans = listPlansBySession(req.params.id);
-  return { body: plans };
+  return { body: { plans } };
 }
 function createSessionMutationHandlers(deps) {
   const { embeddingManager, vaultDir, logger, liveConfig } = deps;
@@ -3986,7 +4008,125 @@ function createSessionMutationHandlers(deps) {
     const impact = getSessionImpact(sessionId);
     return { body: impact };
   }
-  return { handleDeleteSession, handleCompleteSession, handleGetSessionImpact };
+  async function handleDeletePlan(req) {
+    const existing = getPlan(req.params.id);
+    if (!existing) return { status: 404, body: errorBody("plan-not-found", "Plan not found") };
+    const localMachineId = getTeamMachineId();
+    const body = req.body;
+    const forceRemote = body?.force_remote === true;
+    if (existing.machine_id !== localMachineId && !forceRemote) {
+      logger.warn(LOG_KINDS.API_SESSION_DELETE, "Cross-machine plan delete rejected", {
+        plan_id: existing.id,
+        plan_machine_id: existing.machine_id,
+        local_machine_id: localMachineId
+      });
+      return {
+        status: 403,
+        body: errorBody(
+          "cross-machine-delete",
+          'Plan belongs to another machine; pass {"force_remote": true} to delete.'
+        )
+      };
+    }
+    if (existing.machine_id !== localMachineId && forceRemote) {
+      logger.warn(LOG_KINDS.API_SESSION_DELETE, "Cross-machine plan delete allowed by force_remote", {
+        plan_id: existing.id,
+        plan_machine_id: existing.machine_id,
+        local_machine_id: localMachineId
+      });
+    }
+    const deleted = deletePlan(req.params.id);
+    if (!deleted) return { status: 404, body: errorBody("plan-not-found", "Plan not found") };
+    embeddingManager.onRemoved("plans", deleted.id);
+    logger.info(LOG_KINDS.API_SESSION_DELETE, "Plan deleted", {
+      plan_id: deleted.id,
+      session_id: deleted.session_id,
+      logical_key: deleted.logical_key
+    });
+    return {
+      body: {
+        ok: true,
+        id: deleted.id,
+        session_id: deleted.session_id
+      }
+    };
+  }
+  return { handleDeleteSession, handleCompleteSession, handleGetSessionImpact, handleDeletePlan };
+}
+
+// src/db/queries/entities.ts
+var DEFAULT_LIST_LIMIT3 = 100;
+var ENTITY_COLUMNS = [
+  "id",
+  "agent_id",
+  "type",
+  "name",
+  "properties",
+  "first_seen",
+  "last_seen",
+  "status",
+  "machine_id",
+  "synced_at"
+];
+var SELECT_COLUMNS4 = ENTITY_COLUMNS.join(", ");
+function toEntityRow(row) {
+  return {
+    id: row.id,
+    agent_id: row.agent_id,
+    type: row.type,
+    name: row.name,
+    properties: row.properties ?? null,
+    first_seen: row.first_seen,
+    last_seen: row.last_seen,
+    status: row.status ?? "active",
+    machine_id: row.machine_id ?? "local",
+    synced_at: row.synced_at ?? null
+  };
+}
+function listEntities(options = {}) {
+  const db = getDatabase();
+  const conditions = [];
+  const params = [];
+  if (options.agent_id !== void 0) {
+    conditions.push(`agent_id = ?`);
+    params.push(options.agent_id);
+  }
+  if (options.type !== void 0) {
+    conditions.push(`type = ?`);
+    params.push(options.type);
+  }
+  if (options.name !== void 0) {
+    conditions.push(`name = ?`);
+    params.push(options.name);
+  }
+  if (options.status !== void 0) {
+    conditions.push(`status = ?`);
+    params.push(options.status);
+  } else {
+    conditions.push(`status = ?`);
+    params.push("active");
+  }
+  if (options.mentioned_in !== void 0 && options.note_type !== void 0) {
+    conditions.push(
+      `id IN (SELECT entity_id FROM entity_mentions WHERE note_id = ? AND note_type = ?)`
+    );
+    params.push(options.mentioned_in);
+    params.push(options.note_type);
+  }
+  const where = conditions.length > 0 ? `WHERE ${conditions.join(" AND ")}` : "";
+  const limit = options.limit ?? DEFAULT_LIST_LIMIT3;
+  const offset = options.offset ?? 0;
+  params.push(limit);
+  params.push(offset);
+  const rows = db.prepare(
+    `SELECT ${SELECT_COLUMNS4}
+     FROM entities
+     ${where}
+     ORDER BY last_seen DESC
+     LIMIT ?
+     OFFSET ?`
+  ).all(...params);
+  return rows.map(toEntityRow);
 }
 
 // src/daemon/api/mycelium.ts
@@ -3995,7 +4135,6 @@ var DEFAULT_LIST_OFFSET3 = 0;
 var DEFAULT_GRAPH_DEPTH = 1;
 var MAX_GRAPH_DEPTH = 3;
 var SPORE_NAME_PREVIEW_CHARS = 60;
-var GRAPH_SEED_ENTITY_LIMIT = 4;
 var GRAPH_SEED_SPORE_LIMIT = 4;
 var GRAPH_SEED_SESSION_LIMIT = 4;
 var EXCLUDED_GRAPH_EDGE_TYPES = /* @__PURE__ */ new Set(["HAS_BATCH", "EXTRACTED_FROM"]);
@@ -4054,15 +4193,6 @@ async function handleGetGraphSeeds(_req) {
      ORDER BY started_at DESC
      LIMIT ?`
   ).all(GRAPH_SEED_SESSION_LIMIT);
-  const entityRows = db.prepare(
-    `SELECT e.id, e.type, e.name, e.status, e.first_seen as created_at, COUNT(em.entity_id) as mention_count
-     FROM entities e
-     LEFT JOIN entity_mentions em ON em.entity_id = e.id
-     WHERE e.agent_id = ? AND e.status = 'active'
-     GROUP BY e.id
-     ORDER BY mention_count DESC, e.last_seen DESC
-     LIMIT ?`
-  ).all(DEFAULT_AGENT_ID, GRAPH_SEED_ENTITY_LIMIT);
   const sporeSeeds = sporeRows.map((row) => ({
     id: row.id,
     name: (row.content ?? "").slice(0, SPORE_NAME_PREVIEW_CHARS),
@@ -4080,20 +4210,66 @@ async function handleGetGraphSeeds(_req) {
     created_at: row.created_at,
     content: row.summary ?? void 0
   }));
-  const entitySeeds = entityRows.map((row) => ({
-    id: row.id,
-    name: row.name,
-    type: row.type,
-    status: row.status ?? void 0,
-    created_at: row.created_at,
-    mention_count: Number(row.mention_count) || 0
-  }));
+  const topConnectedRow = db.prepare(
+    `SELECT node_id FROM (
+       SELECT source_id AS node_id, COUNT(*) AS cnt
+         FROM graph_edges
+        WHERE agent_id = ?
+          AND type NOT IN ('HAS_BATCH', 'EXTRACTED_FROM')
+          AND source_type IN ('spore', 'session')
+        GROUP BY source_id
+       UNION ALL
+       SELECT target_id, COUNT(*)
+         FROM graph_edges
+        WHERE agent_id = ?
+          AND type NOT IN ('HAS_BATCH', 'EXTRACTED_FROM')
+          AND target_type IN ('spore', 'session')
+        GROUP BY target_id
+     )
+     GROUP BY node_id
+     ORDER BY SUM(cnt) DESC
+     LIMIT 1`
+  ).get(DEFAULT_AGENT_ID, DEFAULT_AGENT_ID);
+  let topSeed = null;
+  if (topConnectedRow?.node_id) {
+    const topId = topConnectedRow.node_id;
+    const sporeHit = db.prepare(
+      `SELECT id, observation_type, status, content, created_at
+         FROM spores WHERE id = ?`
+    ).get(topId);
+    if (sporeHit) {
+      topSeed = {
+        id: sporeHit.id,
+        name: (sporeHit.content ?? "").slice(0, SPORE_NAME_PREVIEW_CHARS),
+        type: "spore",
+        status: sporeHit.status ?? void 0,
+        created_at: sporeHit.created_at,
+        content: sporeHit.content,
+        observation_type: sporeHit.observation_type
+      };
+    } else {
+      const sessionHit = db.prepare(
+        `SELECT id, title, summary, status, started_at as created_at
+           FROM sessions WHERE id = ?`
+      ).get(topId);
+      if (sessionHit) {
+        topSeed = {
+          id: sessionHit.id,
+          name: sessionHit.title ?? `Session ${sessionHit.id.slice(-6)}`,
+          type: "session",
+          status: sessionHit.status ?? void 0,
+          created_at: sessionHit.created_at,
+          content: sessionHit.summary ?? void 0
+        };
+      }
+    }
+  }
   const seeds = [
-    ...entitySeeds,
-    ...sessionSeeds,
-    ...sporeSeeds
+    ...topSeed ? [topSeed] : [],
+    ...sessionSeeds.filter((s) => s.id !== topSeed?.id),
+    ...sporeSeeds.filter((s) => s.id !== topSeed?.id)
   ];
-  const recommendedId = entitySeeds[0]?.id ?? sessionSeeds[0]?.id ?? sporeSeeds[0]?.id ?? null;
+  const recommendedId = topSeed?.id ?? sessionSeeds[0]?.id ?? sporeSeeds[0]?.id ?? null;
   return {
     body: {
       seeds,
@@ -4104,32 +4280,19 @@ async function handleGetGraphSeeds(_req) {
 async function handleGetGraph(req) {
   const depth = Math.min(Number(req.query.depth) || DEFAULT_GRAPH_DEPTH, MAX_GRAPH_DEPTH);
   const id = req.params.id;
-  let centerNode = null;
-  let centerType = "entity";
-  const entity = getEntity(id);
-  if (entity) {
-    centerNode = entity;
-    centerType = "entity";
+  let centerType;
+  if (getSpore(id)) {
+    centerType = "spore";
+  } else if (getSession(id)) {
+    centerType = "session";
   } else {
-    const spore = getSpore(id);
-    if (spore) {
-      centerNode = spore;
-      centerType = "spore";
-    } else {
-      const session = getSession(id);
-      if (session) {
-        centerNode = session;
-        centerType = "session";
-      }
-    }
+    return { status: 404, body: { error: "not_found" } };
   }
-  if (!centerNode) return { status: 404, body: { error: "not_found" } };
   const graph = getGraphForNode(id, centerType, { depth });
   const filteredEdges = graph.edges.filter(
     (e) => !EXCLUDED_GRAPH_EDGE_TYPES.has(e.type)
   );
   const graphDb = getDatabase();
-  const entityIds = /* @__PURE__ */ new Set();
   const sporeIds = /* @__PURE__ */ new Set();
   const sessionIds = /* @__PURE__ */ new Set();
   for (const edge of filteredEdges) {
@@ -4137,70 +4300,23 @@ async function handleGetGraph(req) {
       [edge.source_id, edge.source_type],
       [edge.target_id, edge.target_type]
     ]) {
-      switch (type) {
-        case "entity":
-          entityIds.add(nodeId);
-          break;
-        case "spore":
-          sporeIds.add(nodeId);
-          break;
-        case "session":
-          sessionIds.add(nodeId);
-          break;
-      }
+      if (type === "spore") sporeIds.add(nodeId);
+      else if (type === "session") sessionIds.add(nodeId);
     }
   }
-  if (centerType === "entity") entityIds.add(id);
   if (centerType === "spore") sporeIds.add(id);
-  if (centerType === "session") sessionIds.add(id);
-  const entityIdArray = Array.from(entityIds);
-  let entityNodes = [];
-  if (entityIdArray.length > 0) {
-    const placeholders = entityIdArray.map(() => "?").join(", ");
-    entityNodes = graphDb.prepare(
-      `SELECT id, type, name, properties, status, first_seen as created_at
-       FROM entities WHERE id IN (${placeholders})`
-    ).all(...entityIdArray);
-  }
+  else sessionIds.add(id);
   const sporeIdArray = Array.from(sporeIds);
-  let sporeNodes = [];
-  if (sporeIdArray.length > 0) {
-    const placeholders = sporeIdArray.map(() => "?").join(", ");
-    sporeNodes = graphDb.prepare(
-      `SELECT id, observation_type, status, content, properties, created_at
-       FROM spores WHERE id IN (${placeholders})`
-    ).all(...sporeIdArray);
-  }
+  const sporeNodes = sporeIdArray.length > 0 ? graphDb.prepare(
+    `SELECT id, observation_type, status, content, properties, created_at
+         FROM spores WHERE id IN (${sporeIdArray.map(() => "?").join(", ")})`
+  ).all(...sporeIdArray) : [];
   const sessionIdArray = Array.from(sessionIds);
-  let sessionNodes = [];
-  if (sessionIdArray.length > 0) {
-    const placeholders = sessionIdArray.map(() => "?").join(", ");
-    sessionNodes = graphDb.prepare(
-      `SELECT id, title, summary, status, started_at as created_at
-       FROM sessions WHERE id IN (${placeholders})`
-    ).all(...sessionIdArray);
-  }
-  const mentionCounts = /* @__PURE__ */ new Map();
-  if (entityIdArray.length > 0) {
-    const placeholders = entityIdArray.map(() => "?").join(", ");
-    const mentionRows = graphDb.prepare(
-      `SELECT entity_id, COUNT(*) as count FROM entity_mentions
-       WHERE entity_id IN (${placeholders}) GROUP BY entity_id`
-    ).all(...entityIdArray);
-    for (const row of mentionRows) {
-      mentionCounts.set(row.entity_id, Number(row.count));
-    }
-  }
+  const sessionNodes = sessionIdArray.length > 0 ? graphDb.prepare(
+    `SELECT id, title, summary, status, started_at as created_at
+         FROM sessions WHERE id IN (${sessionIdArray.map(() => "?").join(", ")})`
+  ).all(...sessionIdArray) : [];
   const allNodes = [
-    ...entityNodes.map((n) => ({
-      id: n.id,
-      name: n.name,
-      type: n.type,
-      status: n.status ?? void 0,
-      created_at: n.created_at,
-      properties: n.properties ?? void 0,
-      mention_count: mentionCounts.get(n.id) ?? 0
-    })),
     ...sporeNodes.map((n) => ({
       id: n.id,
       name: (n.content ?? "").slice(0, SPORE_NAME_PREVIEW_CHARS),
@@ -4239,10 +4355,6 @@ async function handleGetGraph(req) {
 var FULL_GRAPH_NODE_LIMIT = 500;
 async function handleGetFullGraph(_req) {
   const db = getDatabase();
-  const entityRows = db.prepare(
-    `SELECT id, type, name, properties, status, first_seen as created_at
-     FROM entities WHERE agent_id = ? LIMIT ?`
-  ).all(DEFAULT_AGENT_ID, FULL_GRAPH_NODE_LIMIT);
   const sporeRows = db.prepare(
     `SELECT id, observation_type, status, content, properties, created_at
      FROM spores WHERE agent_id = ? AND status = 'active' LIMIT ?`
@@ -4252,43 +4364,21 @@ async function handleGetFullGraph(_req) {
      FROM sessions ORDER BY created_at DESC LIMIT ?`
   ).all(FULL_GRAPH_NODE_LIMIT);
   const allIds = /* @__PURE__ */ new Set();
-  for (const r of [...entityRows, ...sporeRows, ...sessionRows]) {
+  for (const r of [...sporeRows, ...sessionRows]) {
     allIds.add(r.id);
   }
   const excludedTypes = Array.from(EXCLUDED_GRAPH_EDGE_TYPES).map(() => "?").join(", ");
   const allIdsList = Array.from(allIds);
   const idPlaceholders = allIdsList.map(() => "?").join(", ");
-  const edgeRows = db.prepare(
+  const edgeRows = allIdsList.length > 0 ? db.prepare(
     `SELECT source_id, source_type, target_id, target_type, type, confidence
-     FROM graph_edges
-     WHERE agent_id = ?
-       AND type NOT IN (${excludedTypes})
-       AND source_id IN (${idPlaceholders})
-       AND target_id IN (${idPlaceholders})`
-  ).all(DEFAULT_AGENT_ID, ...Array.from(EXCLUDED_GRAPH_EDGE_TYPES), ...allIdsList, ...allIdsList);
-  const filteredEdges = edgeRows;
-  const mentionCounts = /* @__PURE__ */ new Map();
-  const entityIdArray = entityRows.map((r) => r.id);
-  if (entityIdArray.length > 0) {
-    const placeholders = entityIdArray.map(() => "?").join(", ");
-    const mentionRows = db.prepare(
-      `SELECT entity_id, COUNT(*) as count FROM entity_mentions
-       WHERE entity_id IN (${placeholders}) GROUP BY entity_id`
-    ).all(...entityIdArray);
-    for (const row of mentionRows) {
-      mentionCounts.set(row.entity_id, Number(row.count));
-    }
-  }
+         FROM graph_edges
+         WHERE agent_id = ?
+           AND type NOT IN (${excludedTypes})
+           AND source_id IN (${idPlaceholders})
+           AND target_id IN (${idPlaceholders})`
+  ).all(DEFAULT_AGENT_ID, ...Array.from(EXCLUDED_GRAPH_EDGE_TYPES), ...allIdsList, ...allIdsList) : [];
   const nodes = [
-    ...entityRows.map((n) => ({
-      id: n.id,
-      name: n.name,
-      type: n.type,
-      status: n.status ?? void 0,
-      created_at: n.created_at,
-      properties: n.properties ?? void 0,
-      mention_count: mentionCounts.get(n.id) ?? 0
-    })),
     ...sporeRows.map((n) => ({
       id: n.id,
       name: (n.content ?? "").slice(0, SPORE_NAME_PREVIEW_CHARS),
@@ -4308,7 +4398,7 @@ async function handleGetFullGraph(_req) {
       content: n.summary ?? void 0
     }))
   ];
-  const edges = filteredEdges.map((e) => ({
+  const edges = edgeRows.map((e) => ({
     source_id: e.source_id,
     target_id: e.target_id,
     label: e.type,
@@ -4391,75 +4481,305 @@ function createSearchHandler(deps) {
   };
 }
 
-// src/daemon/api/context.ts
-var SessionContextBody = external_exports.object({
-  session_id: external_exports.string().optional(),
-  branch: external_exports.string().optional()
-});
-var ResumeContextBody = external_exports.object({
-  session_id: external_exports.string(),
-  parent_session_id: external_exports.string().optional(),
-  branch: external_exports.string().optional()
-});
-var PromptContextBody = external_exports.object({
-  prompt: external_exports.string(),
-  session_id: external_exports.string().optional()
-});
-function createSessionContextHandler(deps) {
-  return async function handleSessionContext(req) {
-    const { session_id, branch } = SessionContextBody.parse(req.body);
-    const { logger, liveConfig } = deps;
-    const config = liveConfig.current;
-    logger.debug(LOG_KINDS.CONTEXT_QUERY, "Session context query", { session_id });
-    try {
-      const parts = [];
-      const tier = config.context.digest_tier;
-      const extract = getDigestExtract(DEFAULT_AGENT_ID, tier);
-      if (extract) {
-        parts.push(extract.content);
-        logger.info(LOG_KINDS.CONTEXT_DIGEST, "Digest extract found", {
-          session_id,
-          tier,
-          content_length: extract.content.length,
-          generated_at: extract.generated_at
-        });
-      } else {
-        logger.debug(LOG_KINDS.CONTEXT_DIGEST, "No digest extract available", { session_id, tier });
-      }
-      if (branch) {
-        parts.push(`Branch:: \`${branch}\``);
-      }
-      parts.push(`Session:: \`${session_id}\``);
-      const source = extract ? "digest" : "basic";
-      const contextText = parts.join("\n\n");
-      const estimatedTokens = estimateTokens(contextText);
-      logger.info(
-        LOG_KINDS.CONTEXT_SESSION,
-        `Session context: ${estimatedTokens} est. tokens, source=${source}${extract ? `, tier=${tier}` : ""}`,
-        {
-          session_id,
-          source,
-          tier: extract ? tier : void 0,
-          text_length: contextText.length,
-          estimated_tokens: estimatedTokens,
-          generated_at: extract?.generated_at,
-          injected_text: contextText
-        }
-      );
-      return {
-        body: {
-          text: contextText,
-          source,
-          ...extract ? { tier } : {}
-        }
-      };
-    } catch (error) {
-      logger.error(LOG_KINDS.CONTEXT_SESSION, "Session context failed", { error: error.message });
-      return { body: { text: "" } };
+// src/symbionts/injection-support.ts
+import fs16 from "fs";
+import path17 from "path";
+var SESSION_START_SIGNALS = ["hook session-start", '"/context"', '"/context/resume"'];
+var PROMPT_SUBMIT_SIGNALS = ["hook user-prompt-submit", '"/context/prompt"'];
+function resolveTemplateCandidates(manifest) {
+  const packageRoot = resolvePackageRoot();
+  const templateFile = manifest.registration?.hooksFormat === "plugin-file" ? "plugin.ts" : "hooks.json";
+  return [
+    path17.join(packageRoot, "src", "symbionts", "templates", manifest.name, templateFile),
+    path17.join(packageRoot, "dist", "src", "symbionts", "templates", manifest.name, templateFile)
+  ];
+}
+function readHooksTemplate(manifest) {
+  for (const candidate of resolveTemplateCandidates(manifest)) {
+    if (fs16.existsSync(candidate)) {
+      return fs16.readFileSync(candidate, "utf-8");
     }
+  }
+  return "";
+}
+function hasAnySignal(template, signals) {
+  return signals.some((signal) => template.includes(signal));
+}
+function detectSymbiontInjectionSupport(manifest) {
+  const template = readHooksTemplate(manifest);
+  return {
+    supportsSessionStartInjection: hasAnySignal(template, SESSION_START_SIGNALS),
+    supportsPromptSubmitInjection: hasAnySignal(template, PROMPT_SUBMIT_SIGNALS)
   };
 }
-function createResumeContextHandler(deps) {
+
+// src/daemon/api/symbionts.ts
+function listSymbiontInfos(vaultDir) {
+  const manifests = loadManifests();
+  let enabledNames = null;
+  try {
+    enabledNames = getEnabledSymbiontNames(loadMergedConfig(vaultDir));
+  } catch {
+  }
+  return manifests.map((manifest) => ({
+    name: manifest.name,
+    displayName: manifest.displayName,
+    binary: manifest.binary,
+    enabled: enabledNames ? enabledNames.has(manifest.name) : true,
+    ...manifest.resumeCommand ? { resumeCommand: manifest.resumeCommand } : {},
+    ...detectSymbiontInjectionSupport(manifest)
+  }));
+}
+async function handleListSymbionts(vaultDir) {
+  return { body: { symbionts: listSymbiontInfos(vaultDir) } };
+}
+
+// src/daemon/cortex.ts
+var CORTEX_PROMPT_BUILDER_TASK = "cortex-prompt-builder";
+var CORTEX_INSTRUCTIONS_TASK = "cortex-instructions";
+var JSON_INDENT = 2;
+function isCortexPromptBuilderDetails(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function getLatestReportForAction(runId, action) {
+  const reports = listReports(runId);
+  for (let i = reports.length - 1; i >= 0; i -= 1) {
+    if (reports[i]?.action === action) return reports[i];
+  }
+  return void 0;
+}
+function getCortexInstructionsSnapshot(config) {
+  const row = getCortexInstructions(DEFAULT_AGENT_ID);
+  return {
+    content: row?.content ?? "",
+    generatedAt: row?.generated_at ?? null,
+    sourceRunId: row?.source_run_id ?? null,
+    enabled: config.context.cortex_enabled,
+    stored: Boolean(row)
+  };
+}
+function resolvePromptBuilderSymbiont(vaultDir, requestedName) {
+  const enabledSymbionts = listSymbiontInfos(vaultDir).filter((symbiont) => symbiont.enabled);
+  if (enabledSymbionts.length === 0) return null;
+  if (!requestedName) return enabledSymbionts[0] ?? null;
+  return enabledSymbionts.find((symbiont) => symbiont.name === requestedName) ?? null;
+}
+async function buildCortexPrompt(vaultDir, deps, goal, requestedSymbiont) {
+  const targetSymbiont = resolvePromptBuilderSymbiont(vaultDir, requestedSymbiont);
+  const delivery = resolveInstructionDelivery(deps.config.context, targetSymbiont);
+  const instructions = delivery.inlineInstructions ? getCortexInstructions(DEFAULT_AGENT_ID) : null;
+  const builderInstruction = [
+    `Goal:
+${goal.trim()}`,
+    "",
+    "## Target symbiont",
+    JSON.stringify(
+      targetSymbiont ? {
+        name: targetSymbiont.name,
+        displayName: targetSymbiont.displayName,
+        supportsSessionStartInjection: targetSymbiont.supportsSessionStartInjection,
+        supportsPromptSubmitInjection: targetSymbiont.supportsPromptSubmitInjection
+      } : null,
+      null,
+      JSON_INDENT
+    ),
+    "",
+    "## Delivery contract",
+    JSON.stringify(
+      {
+        inline_instructions: delivery.inlineInstructions,
+        reason: delivery.reason
+      },
+      null,
+      JSON_INDENT
+    ),
+    "",
+    delivery.inlineInstructions ? [
+      "## Current Cortex session-start instructions",
+      instructions?.content || "No current Cortex instructions are available.",
+      ""
+    ].join("\n") : "## Current Cortex session-start instructions\nOmit them from the prompt because this symbiont receives session-start injection.\n"
+  ].join("\n");
+  const resultPromise = runAgent(vaultDir, {
+    task: CORTEX_PROMPT_BUILDER_TASK,
+    agentId: DEFAULT_AGENT_ID,
+    instruction: builderInstruction,
+    embeddingManager: deps.embeddingManager
+  });
+  const runId = getLatestRunId(DEFAULT_AGENT_ID, CORTEX_PROMPT_BUILDER_TASK);
+  const tracked = resultPromise.catch((err) => {
+    deps.logger.warn(LOG_KINDS.AGENT_ERROR, "cortex-prompt-builder task failed", {
+      run_id: runId ?? void 0,
+      error: String(err)
+    });
+  });
+  deps.registerInflightRun?.(tracked);
+  return {
+    started: true,
+    runId,
+    inlineInstructions: delivery.inlineInstructions,
+    targetSymbiont
+  };
+}
+function getCortexPromptResult(runId) {
+  const run = getRun(runId);
+  if (!run) return null;
+  const reports = listReports(runId);
+  const promptReport = getLatestReportForAction(runId, "cortex_prompt_builder");
+  const details = tryParseJson(promptReport?.details, isCortexPromptBuilderDetails);
+  return {
+    runId,
+    status: run.status,
+    prompt: details?.prompt ?? "",
+    reports: reports.map((report) => ({
+      id: report.id,
+      action: report.action,
+      summary: report.summary,
+      created_at: report.created_at
+    })),
+    error: run.error
+  };
+}
+async function triggerCortexInstructions(deps) {
+  const { vaultDir, embeddingManager, liveConfig, logger, getTeamClient } = deps;
+  const loadExecutor = deps.loadExecutor ?? (() => import("./executor-F2YU7HXJ.js"));
+  const config = liveConfig.current;
+  if (config.agent.event_tasks_enabled === false) {
+    return { started: false, reason: "event-tasks-disabled" };
+  }
+  if (!hasConfiguredProvider(config, CORTEX_INSTRUCTIONS_TASK)) {
+    return { started: false, reason: "provider-not-configured" };
+  }
+  let runAgentFn;
+  try {
+    ({ runAgent: runAgentFn } = await loadExecutor());
+  } catch (err) {
+    logger.warn(LOG_KINDS.AGENT_ERROR, "cortex-instructions: agent module unavailable", {
+      error: String(err)
+    });
+    return {
+      started: false,
+      reason: "agent-module-unavailable",
+      error: String(err)
+    };
+  }
+  try {
+    const built = await buildCortexInstructionsInput(config, getTeamClient);
+    const resultPromise = runAgentFn(vaultDir, {
+      task: CORTEX_INSTRUCTIONS_TASK,
+      agentId: DEFAULT_AGENT_ID,
+      instruction: built.instruction,
+      runContext: { cortex_instruction_input_hash: built.inputHash },
+      embeddingManager
+    });
+    const runId = getLatestRunId(DEFAULT_AGENT_ID, CORTEX_INSTRUCTIONS_TASK);
+    const tracked = resultPromise.catch((err) => {
+      logger.warn(LOG_KINDS.AGENT_ERROR, "Cortex instructions task failed", {
+        error: String(err),
+        run_id: runId ?? void 0
+      });
+    });
+    deps.registerInflightRun?.(tracked);
+    return { started: true, runId };
+  } catch (err) {
+    logger.warn(LOG_KINDS.AGENT_ERROR, "Failed to start cortex-instructions task", {
+      error: String(err)
+    });
+    return {
+      started: false,
+      reason: "startup-failed",
+      error: String(err)
+    };
+  }
+}
+
+// src/daemon/api/context.ts
+var SessionContextBody = external_exports.object({
+  session_id: external_exports.string().optional(),
+  branch: external_exports.string().optional()
+});
+var ResumeContextBody = external_exports.object({
+  session_id: external_exports.string(),
+  parent_session_id: external_exports.string().optional(),
+  branch: external_exports.string().optional()
+});
+var PromptContextBody = external_exports.object({
+  prompt: external_exports.string(),
+  session_id: external_exports.string().optional()
+});
+function createSessionContextHandler(deps) {
+  return async function handleSessionContext(req) {
+    const { session_id, branch } = SessionContextBody.parse(req.body);
+    const { logger, liveConfig } = deps;
+    const config = liveConfig.current;
+    logger.debug(LOG_KINDS.CONTEXT_QUERY, "Session context query", { session_id });
+    try {
+      const cortexEnabled = shouldInjectCortex(config.context);
+      const digestEnabled = shouldInjectSessionStartDigest(config.context);
+      if (!cortexEnabled && !digestEnabled) {
+        logger.debug(LOG_KINDS.CONTEXT_SESSION, "Session-start context disabled", { session_id });
+        return { body: { text: "" } };
+      }
+      let sourceRunId = null;
+      let cortexContent = "";
+      if (cortexEnabled) {
+        const snapshot = getCortexInstructionsSnapshot(config);
+        if (snapshot.content) {
+          cortexContent = snapshot.content;
+          sourceRunId = snapshot.sourceRunId;
+        } else {
+          logger.debug(LOG_KINDS.CONTEXT_SESSION, "No stored Cortex instructions available for session start", {
+            session_id
+          });
+        }
+      }
+      const composed = composeSessionStartContext(config, cortexContent);
+      const textParts = composed.parts.map((p) => p.text);
+      const sourceParts = composed.parts.map(
+        (p) => p.kind === "cortex" ? "cortex" : `digest:${p.tier ?? config.context.digest_tier}`
+      );
+      if (digestEnabled && !composed.parts.some((p) => p.kind === "digest")) {
+        logger.debug(LOG_KINDS.CONTEXT_SESSION, "No preferred digest extract available for session start", {
+          session_id,
+          preferred_tier: config.context.digest_tier
+        });
+      }
+      if (textParts.length === 0) {
+        return { body: { text: "" } };
+      }
+      if (branch) {
+        textParts.push(`Branch:: \`${branch}\``);
+      }
+      textParts.push(`Session:: \`${session_id}\``);
+      const source = sourceParts.join("+");
+      const contextText = textParts.join("\n\n");
+      const estimatedTokens = estimateTokens(contextText);
+      logger.info(
+        LOG_KINDS.CONTEXT_SESSION,
+        `Session context: ${estimatedTokens} est. tokens, source=${source}`,
+        {
+          session_id,
+          source,
+          branch,
+          source_run_id: sourceRunId,
+          text_length: contextText.length,
+          estimated_tokens: estimatedTokens,
+          injected_text: contextText
+        }
+      );
+      return {
+        body: {
+          text: contextText,
+          source
+        }
+      };
+    } catch (error) {
+      logger.error(LOG_KINDS.CONTEXT_SESSION, "Session context failed", { error: error.message });
+      return { body: { text: "" } };
+    }
+  };
+}
+function createResumeContextHandler(deps) {
   return async function handleResumeContext(req) {
     const { session_id, parent_session_id, branch } = ResumeContextBody.parse(req.body);
     const { logger } = deps;
@@ -4555,9 +4875,7 @@ function createPromptContextHandler(deps) {
       raw_results: vectorResults.length,
       top_similarity: vectorResults[0]?.similarity
     });
-    if (vectorResults.length === 0) {
-      return { body: { text: "" } };
-    }
+    if (vectorResults.length === 0) return { body: { text: "" } };
     const eligible = vectorResults.filter(
       (r) => !EXCLUDED_SPORE_STATUSES.has(r.metadata.status)
     );
@@ -4568,20 +4886,22 @@ function createPromptContextHandler(deps) {
     const topResults = eligible.slice(0, maxSpores);
     const hydrated = hydrateSearchResults(topResults);
     const spores = hydrated.filter((r) => r.type === "spore");
-    if (spores.length === 0) {
-      return { body: { text: "" } };
-    }
+    if (spores.length === 0) return { body: { text: "" } };
     const text = formatSporeContext(spores);
     const promptTokens = estimateTokens(text);
     const titles = spores.map((s) => s.title);
-    logger.info(LOG_KINDS.CONTEXT_PROMPT, `Prompt context: ${spores.length} spores [${titles.join(", ")}] (~${promptTokens} tokens)`, {
-      session_id,
-      spore_count: spores.length,
-      spore_titles: titles,
-      scores: spores.map((s) => s.score.toFixed(3)),
-      estimated_tokens: promptTokens,
-      injected_text: text
-    });
+    logger.info(
+      LOG_KINDS.CONTEXT_PROMPT,
+      `Prompt context: ${spores.length} spores [${titles.join(", ")}] (~${promptTokens} tokens)`,
+      {
+        session_id,
+        spore_count: spores.length,
+        spore_titles: titles,
+        scores: spores.map((s) => s.score.toFixed(3)),
+        estimated_tokens: promptTokens,
+        injected_text: text
+      }
+    );
     return { body: { text } };
   };
 }
@@ -4600,6 +4920,75 @@ function formatSporeContext(spores) {
   return text === header ? "" : text;
 }
 
+// src/daemon/api/cortex.ts
+var PromptBuilderBody = external_exports.object({
+  goal: external_exports.string().trim().min(1),
+  symbiont: external_exports.string().trim().optional()
+});
+var PromptBuilderStatusParams = external_exports.object({
+  runId: external_exports.string().trim().min(1)
+});
+function createCortexHandlers(vaultDir, deps) {
+  async function handleGetInstructions() {
+    const snapshot = getCortexInstructionsSnapshot(deps.liveConfig.current);
+    return { body: snapshot };
+  }
+  async function handleRefreshInstructions() {
+    const result = await triggerCortexInstructions({
+      vaultDir,
+      embeddingManager: deps.embeddingManager,
+      liveConfig: deps.liveConfig,
+      logger: deps.logger,
+      getTeamClient: deps.getTeamClient,
+      registerInflightRun: deps.registerInflightRun
+    });
+    if (!result.started && (result.reason === "provider-not-configured" || result.reason === "event-tasks-disabled")) {
+      return {
+        status: 400,
+        body: {
+          ...errorBody(
+            result.reason,
+            result.reason === "provider-not-configured" ? "No agent provider configured. Configure one in Settings." : "Event-driven tasks are disabled. Enable them in Settings."
+          ),
+          started: false,
+          reason: result.reason
+        }
+      };
+    }
+    return { body: result };
+  }
+  async function handleBuildPrompt(req) {
+    const { goal, symbiont } = PromptBuilderBody.parse(req.body);
+    const result = await buildCortexPrompt(
+      vaultDir,
+      {
+        config: deps.liveConfig.current,
+        embeddingManager: deps.embeddingManager,
+        getTeamClient: deps.getTeamClient,
+        logger: deps.logger,
+        registerInflightRun: deps.registerInflightRun
+      },
+      goal,
+      symbiont
+    );
+    return { body: result };
+  }
+  async function handleGetPromptResult(req) {
+    const { runId } = PromptBuilderStatusParams.parse(req.params);
+    const result = getCortexPromptResult(runId);
+    if (!result) {
+      return { status: 404, body: errorBody("run-not-found", "Run not found") };
+    }
+    return { body: result };
+  }
+  return {
+    handleGetInstructions,
+    handleRefreshInstructions,
+    handleBuildPrompt,
+    handleGetPromptResult
+  };
+}
+
 // src/db/queries/feed.ts
 function getActivityFeed(limit = FEED_DEFAULT_LIMIT) {
   const db = getDatabase();
@@ -4638,24 +5027,6 @@ async function handleGetFeed(req) {
   return { body: feed };
 }
 
-// src/daemon/api/symbionts.ts
-async function handleListSymbionts(vaultDir) {
-  const manifests = loadManifests();
-  let enabledNames = null;
-  try {
-    enabledNames = getEnabledSymbiontNames(loadMergedConfig(vaultDir));
-  } catch {
-  }
-  const symbionts = manifests.map((m) => ({
-    name: m.name,
-    displayName: m.displayName,
-    binary: m.binary,
-    enabled: enabledNames ? enabledNames.has(m.name) : true,
-    ...m.resumeCommand ? { resumeCommand: m.resumeCommand } : {}
-  }));
-  return { body: { symbionts } };
-}
-
 // src/daemon/api/embedding.ts
 var EMBEDDING_STATUS_IDLE = "idle";
 var EMBEDDING_STATUS_PENDING = "pending";
@@ -5659,17 +6030,17 @@ var SqliteRecordSource = class {
 };
 
 // src/daemon/database/manager.ts
-import fs17 from "fs";
+import fs18 from "fs";
 
 // src/db/queries/database.ts
-import fs16 from "fs";
+import fs17 from "fs";
 function pragmaScalar(name) {
   const db = getDatabase();
   return db.pragma(name, { simple: true });
 }
 function safeFileSize(filePath) {
   try {
-    return fs16.statSync(filePath).size;
+    return fs17.statSync(filePath).size;
   } catch (err) {
     if (err.code === "ENOENT") return 0;
     throw err;
@@ -5941,7 +6312,7 @@ var DatabaseMaintenanceManager = class {
   }
   async vacuum() {
     const size_before = this.fileSize();
-    const stats = await fs17.promises.statfs(this.vaultDir);
+    const stats = await fs18.promises.statfs(this.vaultDir);
     const free_bytes = Number(stats.bavail) * Number(stats.bsize);
     const required_bytes = size_before * VACUUM_FREE_SPACE_MULTIPLIER;
     if (free_bytes < required_bytes) {
@@ -5989,7 +6360,7 @@ var DatabaseMaintenanceManager = class {
   }
   fileSize() {
     try {
-      return fs17.statSync(this.dbPath).size;
+      return fs18.statSync(this.dbPath).size;
     } catch {
       return 0;
     }
@@ -6306,6 +6677,16 @@ async function handleUpdateTaskConfig(req, vaultDir) {
   };
 }
 
+// src/agent/types.ts
+var PROVIDER_TYPES = [
+  "anthropic",
+  "ollama",
+  "lmstudio",
+  "openai",
+  "openrouter",
+  "openai-compatible"
+];
+
 // src/daemon/api/providers.ts
 var ANTHROPIC_MODELS_TIMEOUT_MS = 5e3;
 var ANTHROPIC_MODELS_CACHE_TTL_MS = 10 * 60 * 1e3;
@@ -6313,33 +6694,79 @@ var anthropicModelsCache = null;
 var HTTP_OK2 = 200;
 var HTTP_BAD_REQUEST2 = 400;
 async function handleGetProviders() {
-  const results = await Promise.allSettled([
-    detectAnthropic(),
-    detectLocalProviderInfo("ollama", OllamaBackend.DEFAULT_BASE_URL),
-    detectLocalProviderInfo("lmstudio", LmStudioBackend.DEFAULT_BASE_URL)
-  ]);
+  const detectionPlan = [
+    {
+      detect: () => detectAnthropic(),
+      fallback: { type: "anthropic", runtime: "claude-sdk", available: false, models: [] }
+    },
+    {
+      detect: () => detectLocalProviderInfo("ollama", OllamaBackend.DEFAULT_BASE_URL),
+      fallback: { type: "ollama", runtime: "claude-sdk", available: false, baseUrl: OllamaBackend.DEFAULT_BASE_URL, models: [] }
+    },
+    {
+      detect: () => detectLocalProviderInfo("lmstudio", LmStudioBackend.DEFAULT_BASE_URL),
+      fallback: { type: "lmstudio", runtime: "claude-sdk", available: false, baseUrl: LmStudioBackend.DEFAULT_BASE_URL, models: [] }
+    },
+    {
+      detect: () => detectRemoteProviderInfo("openai", DEFAULT_OPENAI_URL),
+      fallback: { type: "openai", runtime: "openai-agents", available: false, authConfigured: false, baseUrl: DEFAULT_OPENAI_URL, models: [] }
+    },
+    {
+      detect: () => detectRemoteProviderInfo("openrouter", DEFAULT_OPENROUTER_URL),
+      fallback: { type: "openrouter", runtime: "openai-agents", available: false, authConfigured: false, baseUrl: DEFAULT_OPENROUTER_URL, models: [] }
+    },
+    {
+      detect: () => detectLocalProviderInfo("openai-compatible", LmStudioBackend.DEFAULT_BASE_URL),
+      fallback: { type: "openai-compatible", runtime: "openai-agents", available: false, baseUrl: LmStudioBackend.DEFAULT_BASE_URL, models: [] }
+    }
+  ];
+  const results = await Promise.allSettled(detectionPlan.map((entry) => entry.detect()));
   const providers = results.map(
-    (r) => r.status === "fulfilled" ? r.value : { type: "unknown", available: false, models: [] }
+    (result, index) => result.status === "fulfilled" ? result.value : detectionPlan[index].fallback
   );
   return { status: HTTP_OK2, body: { providers } };
 }
+var ProviderTestBody = external_exports.object({
+  type: external_exports.enum(PROVIDER_TYPES),
+  baseUrl: external_exports.string().optional(),
+  /**
+   * Deprecated: `base_url` is the legacy snake_case key. Accepted for one
+   * release and then removed. Use `baseUrl` going forward.
+   */
+  base_url: external_exports.string().optional(),
+  local_backend: external_exports.enum(["ollama", "lmstudio"]).optional(),
+  model: external_exports.string().optional()
+});
 async function handleTestProvider(req) {
-  const body = req.body;
-  const type = body?.type;
-  if (!type || !["anthropic", "ollama", "lmstudio"].includes(type)) {
+  const parse = ProviderTestBody.safeParse(req.body);
+  if (!parse.success) {
     return {
       status: HTTP_BAD_REQUEST2,
-      body: { error: "type is required and must be one of: anthropic, ollama, lmstudio" }
+      body: { error: `type is required and must be one of: ${PROVIDER_TYPES.join(", ")}` }
     };
   }
-  const baseUrl = body?.baseUrl;
+  const parsed = parse.data;
+  if (parsed.base_url !== void 0 && parsed.baseUrl === void 0) {
+    process.stderr.write(
+      "[myco providers] POST /api/providers/test: base_url is deprecated; use baseUrl\n"
+    );
+  }
+  const type = parsed.type;
+  const baseUrl = parsed.baseUrl ?? parsed.base_url;
+  const localBackend = parsed.local_backend;
   const start = performance.now();
   let result;
   try {
     if (type === "ollama") {
-      result = await testLocalProvider(new OllamaBackend({ base_url: baseUrl }), "Ollama", OllamaBackend.DEFAULT_BASE_URL, baseUrl);
+      result = await testResolvedLocalProvider("ollama", baseUrl);
     } else if (type === "lmstudio") {
-      result = await testLocalProvider(new LmStudioBackend({ base_url: baseUrl }), "LM Studio", LmStudioBackend.DEFAULT_BASE_URL, baseUrl);
+      result = await testResolvedLocalProvider("lmstudio", baseUrl);
+    } else if (type === "openai-compatible") {
+      result = await testResolvedLocalProvider("openai-compatible", baseUrl, localBackend);
+    } else if (type === "openai") {
+      result = await testRemoteProvider("openai", "OpenAI");
+    } else if (type === "openrouter") {
+      result = await testRemoteProvider("openrouter", "OpenRouter");
     } else {
       result = testAnthropic();
     }
@@ -6352,15 +6779,21 @@ async function handleTestProvider(req) {
   return { status: HTTP_OK2, body: result };
 }
 async function detectLocalProviderInfo(type, defaultBaseUrl) {
-  const status = await checkLocalProvider(type);
+  const status = await checkLocalProvider(type === "openai-compatible" ? "lmstudio" : type);
   const variantFiltered = status.models.filter((m) => !/-ctx\d+/.test(m));
   const models = filterLlmModels(variantFiltered);
-  return { type, available: status.available, baseUrl: defaultBaseUrl, models };
+  return {
+    type,
+    runtime: type === "openai-compatible" ? "openai-agents" : "claude-sdk",
+    available: status.available,
+    baseUrl: defaultBaseUrl,
+    models
+  };
 }
 async function detectAnthropic() {
   const now = Date.now();
   if (anthropicModelsCache && now - anthropicModelsCache.ts < ANTHROPIC_MODELS_CACHE_TTL_MS) {
-    return { type: "anthropic", available: true, models: anthropicModelsCache.models };
+    return { type: "anthropic", runtime: "claude-sdk", available: true, models: anthropicModelsCache.models };
   }
   let models = ANTHROPIC_MODELS;
   try {
@@ -6376,7 +6809,28 @@ async function detectAnthropic() {
   } catch {
   }
   anthropicModelsCache = { ts: now, models };
-  return { type: "anthropic", available: true, models };
+  return { type: "anthropic", runtime: "claude-sdk", available: true, models };
+}
+async function detectRemoteProviderInfo(type, baseUrl) {
+  const authConfigured = Boolean(getRemoteProviderApiKey(type));
+  let models = [];
+  let available = false;
+  if (authConfigured) {
+    try {
+      models = await fetchRemoteProviderModels(type, void 0, ANTHROPIC_MODELS_TIMEOUT_MS);
+      available = true;
+    } catch {
+      available = false;
+    }
+  }
+  return {
+    type,
+    runtime: "openai-agents",
+    available,
+    authConfigured,
+    baseUrl,
+    models
+  };
 }
 async function testLocalProvider(backend, label, defaultBaseUrl, baseUrl) {
   const available = await backend.isAvailable();
@@ -6385,9 +6839,114 @@ async function testLocalProvider(backend, label, defaultBaseUrl, baseUrl) {
   }
   return { ok: true };
 }
+async function testResolvedLocalProvider(type, baseUrl, localBackend) {
+  const kind = inferLocalOpenAIBackendKind({ type, localBackend, baseUrl }) ?? "lmstudio";
+  const label = type === "openai-compatible" ? `OpenAI-compatible ${getLocalOpenAIBackendLabel(kind)} provider` : getLocalOpenAIBackendLabel(kind);
+  return testLocalProvider(
+    createLocalOpenAIBackend(kind, baseUrl),
+    label,
+    getLocalOpenAIBackendDefaultBaseUrl(kind),
+    baseUrl
+  );
+}
 function testAnthropic() {
   return { ok: true };
 }
+async function testRemoteProvider(provider, label) {
+  if (!getRemoteProviderApiKey(provider)) {
+    return { ok: false, error: `${label} API key not configured in daemon secrets or environment` };
+  }
+  try {
+    await fetchRemoteProviderModels(provider);
+    return { ok: true };
+  } catch (error) {
+    return { ok: false, error: error instanceof Error ? error.message : `${label} connection failed` };
+  }
+}
+
+// src/daemon/api/provider-secrets.ts
+var SECRET_PREVIEW_PREFIX_CHARS = 8;
+var SECRET_PREVIEW_SUFFIX_CHARS = 4;
+var SECRET_ENV_BY_PROVIDER = {
+  openai: OPENAI_API_KEY_ENV,
+  openrouter: OPENROUTER_API_KEY_ENV
+};
+function isSecretProvider(value) {
+  return value === "openai" || value === "openrouter";
+}
+function maskSecret(secret) {
+  if (secret.length <= SECRET_PREVIEW_PREFIX_CHARS + SECRET_PREVIEW_SUFFIX_CHARS) {
+    return "*".repeat(secret.length);
+  }
+  return `${secret.slice(0, SECRET_PREVIEW_PREFIX_CHARS)}${"*".repeat(secret.length - SECRET_PREVIEW_PREFIX_CHARS - SECRET_PREVIEW_SUFFIX_CHARS)}${secret.slice(-SECRET_PREVIEW_SUFFIX_CHARS)}`;
+}
+function buildSecretInfo(provider, storedSecrets) {
+  const envKey = SECRET_ENV_BY_PROVIDER[provider];
+  const storedValue = storedSecrets[envKey];
+  const envValue = process.env[envKey];
+  const effectiveValue = storedValue ?? envValue;
+  return {
+    configured: Boolean(effectiveValue),
+    envKey,
+    maskedValue: effectiveValue ? maskSecret(effectiveValue) : null,
+    source: storedValue ? "vault" : envValue ? "env" : "none"
+  };
+}
+function getSecretInfo(vaultDir, provider) {
+  return buildSecretInfo(provider, readSecrets(vaultDir));
+}
+async function handleGetProviderSecrets(vaultDir) {
+  const storedSecrets = readSecrets(vaultDir);
+  return {
+    body: {
+      secrets: {
+        openai: buildSecretInfo("openai", storedSecrets),
+        openrouter: buildSecretInfo("openrouter", storedSecrets)
+      }
+    }
+  };
+}
+async function handlePutProviderSecret(vaultDir, req) {
+  const provider = req.params.provider;
+  const body = req.body;
+  if (!provider || !isSecretProvider(provider)) {
+    return { status: 400, body: { error: "provider must be one of: openai, openrouter" } };
+  }
+  if (!body?.api_key?.trim()) {
+    return { status: 400, body: { error: "api_key is required" } };
+  }
+  const envKey = SECRET_ENV_BY_PROVIDER[provider];
+  const apiKey = body.api_key.trim();
+  writeSecret(vaultDir, envKey, apiKey);
+  process.env[envKey] = apiKey;
+  if (provider === "openai") {
+    process.env.OPENAI_API_KEY = apiKey;
+  }
+  return {
+    body: {
+      provider,
+      secret: getSecretInfo(vaultDir, provider)
+    }
+  };
+}
+async function handleDeleteProviderSecret(vaultDir, req) {
+  const provider = req.params.provider;
+  if (!provider || !isSecretProvider(provider)) {
+    return { status: 400, body: { error: "provider must be one of: openai, openrouter" } };
+  }
+  const envKey = SECRET_ENV_BY_PROVIDER[provider];
+  deleteSecrets(vaultDir, [envKey]);
+  delete process.env[envKey];
+  if (provider === "openai") {
+    delete process.env.OPENAI_API_KEY;
+  }
+  return {
+    body: {
+      provider,
+      secret: getSecretInfo(vaultDir, provider)
+    }
+  };
+}
 
 // src/daemon/task-scheduling.ts
 import { resolve } from "path";
@@ -6440,7 +6999,7 @@ function buildScheduledJobs(tasks, configOverrides, context, initialLastRuns) {
 // src/daemon/task-scheduling.ts
 var SCHEDULED_JOB_PREFIX = "scheduled:";
 async function registerScheduledTasks(powerManager, deps) {
-  const { definitionsDir, vaultDir, embeddingManager, logger, liveConfig } = deps;
+  const { definitionsDir, vaultDir, embeddingManager, logger, liveConfig, getTeamClient } = deps;
   const runningTasks = /* @__PURE__ */ new Set();
   if (!definitionsDir) {
     logger.warn(LOG_KINDS.AGENT_ERROR, "Skipping dynamic task scheduling \u2014 definitions directory unavailable");
@@ -6450,7 +7009,7 @@ async function registerScheduledTasks(powerManager, deps) {
   if (!lastEnabled) {
     logger.info(LOG_KINDS.AGENT_RUN, "Scheduled agent tasks disabled (agent.scheduled_tasks_enabled: false) \u2014 jobs registered but will no-op until enabled");
   }
-  const { loadAllTasks: loadAllTasks2 } = await import("./registry-MGJSJBAS.js");
+  const { loadAllTasks: loadAllTasks2 } = await import("./registry-M2Z5QBWH.js");
   const allTasks = Array.from(loadAllTasks2(definitionsDir, vaultDir).values());
   const taskAgentMap = /* @__PURE__ */ new Map();
   for (const task of allTasks) {
@@ -6486,10 +7045,33 @@ async function registerScheduledTasks(powerManager, deps) {
         lastEnabled = enabled;
       }
       if (!enabled) return;
-      const { runAgent } = await import("./executor-J4IBXSBY.js");
+      const { runAgent: runAgent2 } = await import("./executor-F2YU7HXJ.js");
+      const resumableRun = getLatestResumableRunForTask(DEFAULT_AGENT_ID, taskName);
+      if (resumableRun) {
+        const resumed = await runAgent2(vaultDir, {
+          agentId: DEFAULT_AGENT_ID,
+          task: taskName,
+          resumeRunId: resumableRun.id,
+          resumeMode: "scheduled",
+          embeddingManager
+        });
+        logger.info(LOG_KINDS.AGENT_RUN, `Scheduled task ${taskName} resumed`, {
+          status: resumed.status,
+          runId: resumed.runId
+        });
+        return;
+      }
       const taskConfig = config.agent.tasks?.[taskName];
       const projectRoot = resolve(vaultDir, "..");
-      const built = buildTaskInstruction(taskName, taskConfig?.params, taskAgentMap.get(taskName), projectRoot, embeddingManager);
+      const built = await buildTaskInstruction(
+        taskName,
+        taskConfig?.params,
+        taskAgentMap.get(taskName),
+        projectRoot,
+        embeddingManager,
+        config,
+        getTeamClient
+      );
       if (isInstructionRequiredTask(taskName) && !built) {
         logger.info(
           LOG_KINDS.AGENT_RUN,
@@ -6498,7 +7080,7 @@ async function registerScheduledTasks(powerManager, deps) {
         );
         return;
       }
-      const result = await runAgent(vaultDir, {
+      const result = await runAgent2(vaultDir, {
         task: taskName,
         instruction: built?.instruction,
         runContext: built?.context,
@@ -6525,7 +7107,7 @@ async function registerScheduledTasks(powerManager, deps) {
           link: `/agent?run=${result.runId}`,
           metadata: { taskName, runId: result.runId }
         }, config);
-        const { countToolCallsByRun } = await import("./turns-YFNI5CQC.js");
+        const { countToolCallsByRun } = await import("./turns-HU2CTZAP.js");
         const counts = countToolCallsByRun(result.runId, ["vault_create_spore", "vault_write_digest"]);
         const sporeCount = counts["vault_create_spore"] ?? 0;
         const digestCount = counts["vault_write_digest"] ?? 0;
@@ -6568,6 +7150,9 @@ async function registerScheduledTasks(powerManager, deps) {
       },
       "has-approved-candidates": () => {
         return countCandidates({ status: "approved" }) > 0;
+      },
+      "has-skill-survey-evidence": () => {
+        return getSkillSurveyEligibility(taskAgentMap.get(SKILL_SURVEY_TASK)).eligible;
       }
     },
     onTaskError: (taskName, err) => {
@@ -6597,31 +7182,170 @@ function listTeamMembers() {
   ).all();
 }
 
-// src/daemon/api/mcp-proxy.ts
-var SPORE_ID_RANDOM_BYTES = 4;
-var RESOLUTION_ID_RANDOM_BYTES = 8;
-var MIN_CONSOLIDATE_SOURCES = 2;
-var RememberBody = external_exports.object({
-  content: external_exports.string(),
-  type: external_exports.string().optional(),
-  tags: external_exports.array(external_exports.string()).optional()
-});
-var SupersedeBody = external_exports.object({
-  old_spore_id: external_exports.string(),
-  new_spore_id: external_exports.string(),
-  reason: external_exports.string().optional()
-});
-function isoToEpochSeconds(iso) {
-  const ms = Date.parse(iso);
-  return Number.isNaN(ms) ? void 0 : Math.floor(ms / 1e3);
-}
-function registerMcpUserAgent(createdAt) {
-  registerAgent({
-    id: USER_AGENT_ID,
-    name: USER_AGENT_NAME,
-    created_at: createdAt
-  });
-}
+// src/daemon/plan-capture.ts
+import { createHash as createHash4 } from "crypto";
+import os8 from "os";
+import path18 from "path";
+function extractTaggedPlans(text, tags) {
+  const results = [];
+  for (const tag of tags) {
+    const regex = new RegExp(`<${tag}>\\n?([\\s\\S]*?)\\n?</${tag}>`, "g");
+    let match;
+    while ((match = regex.exec(text)) !== null) {
+      const content = match[1].trim();
+      if (content) results.push({ tag, content });
+    }
+  }
+  return results;
+}
+var FILE_WRITE_TOOLS = /* @__PURE__ */ new Set([
+  "Write",
+  "Edit",
+  "Create",
+  "write",
+  "edit",
+  "patch",
+  "create"
+]);
+var HEADING_REGEX = /^#\s+(.+)$/m;
+var TRANSCRIPT_SOURCE_TITLE_PREFIX = `${TRANSCRIPT_SOURCE_PREFIX}`;
+function resolvePlanWatchDir(watchDir, projectRoot) {
+  const expanded = watchDir.startsWith("~/") ? path18.join(os8.homedir(), watchDir.slice(2)) : watchDir;
+  return path18.isAbsolute(expanded) ? expanded : path18.resolve(projectRoot, expanded);
+}
+function isInPlanDirectory(filePath, watchDirs, projectRoot) {
+  const abs = path18.isAbsolute(filePath) ? filePath : path18.resolve(projectRoot, filePath);
+  return watchDirs.some((dir) => {
+    const absDir = resolvePlanWatchDir(dir, projectRoot);
+    const prefix = absDir.endsWith(path18.sep) ? absDir : absDir + path18.sep;
+    return abs === absDir || abs.startsWith(prefix);
+  });
+}
+function isPlanWriteEvent(toolName, toolInput, config) {
+  if (!FILE_WRITE_TOOLS.has(toolName)) return null;
+  const filePath = toolInput?.file_path ?? toolInput?.path ?? toolInput?.filePath;
+  if (typeof filePath !== "string") return null;
+  if (!isInPlanDirectory(filePath, config.watchDirs, config.projectRoot)) return null;
+  if (config.extensions?.length) {
+    const ext = path18.extname(filePath).toLowerCase();
+    if (!config.extensions.includes(ext)) return null;
+  }
+  return filePath;
+}
+function parsePlanTitle(content, filename) {
+  const match = HEADING_REGEX.exec(content);
+  if (match) return match[1].trim();
+  return filename ?? null;
+}
+function normalizePlanTags(tags) {
+  if (tags === void 0 || tags === null) return null;
+  return Array.isArray(tags) ? tags.join(", ") : tags;
+}
+function fileTitleFromSourcePath(sourcePath) {
+  if (!sourcePath || sourcePath.startsWith(TRANSCRIPT_SOURCE_TITLE_PREFIX)) return null;
+  return path18.basename(sourcePath);
+}
+function resolvePlanTitle(input) {
+  const explicitTitle = input.title?.trim();
+  if (explicitTitle) return explicitTitle;
+  const headingTitle = parsePlanTitle(input.content);
+  if (headingTitle) return headingTitle;
+  const sourcePathTitle = fileTitleFromSourcePath(input.sourcePath);
+  if (sourcePathTitle) return sourcePathTitle;
+  return input.planKey ? humanizePlanToken(input.planKey) : null;
+}
+function persistPlan(input) {
+  const createdAt = input.createdAt ?? Math.floor(Date.now() / 1e3);
+  const updatedAt = input.updatedAt ?? createdAt;
+  const contentHash = createHash4(CONTENT_HASH_ALGORITHM).update(input.content).digest("hex");
+  const existingPlan = getPlanByLogicalKey(input.logicalKey);
+  const status = input.status ?? existingPlan?.status ?? "active";
+  const promptBatchId = input.promptBatchId === void 0 ? existingPlan?.prompt_batch_id ?? null : input.promptBatchId;
+  const resolvedTitle = resolvePlanTitle({
+    content: input.content,
+    title: input.title,
+    sourcePath: input.sourcePath,
+    planKey: input.planKey
+  });
+  if (existingPlan && existingPlan.content_hash === contentHash && existingPlan.title === resolvedTitle && existingPlan.status === status) {
+    return existingPlan;
+  }
+  if (existingPlan && existingPlan.content_hash !== contentHash) {
+    const priorSource = existingPlan.source_path ?? null;
+    const newSource = input.sourcePath ?? null;
+    if (priorSource !== newSource) {
+      input.logger?.warn(LOG_KINDS.CAPTURE_PLAN, "Plan overwritten mid-session", {
+        logical_key: input.logicalKey,
+        session_id: input.sessionId,
+        prior_source: priorSource,
+        new_source: newSource,
+        prior_updated_at: existingPlan.updated_at
+      });
+    }
+  }
+  return upsertPlan({
+    id: buildPlanId(input.logicalKey),
+    logical_key: input.logicalKey,
+    title: resolvedTitle,
+    content: input.content,
+    source_path: input.sourcePath ?? null,
+    tags: normalizePlanTags(input.tags),
+    session_id: input.sessionId,
+    prompt_batch_id: promptBatchId,
+    content_hash: contentHash,
+    status,
+    created_at: createdAt,
+    updated_at: updatedAt
+  });
+}
+function capturePlan(input) {
+  const normalizedSourcePath = normalizePlanSourcePath(input.sourcePath, input.projectRoot);
+  return persistPlan({
+    sessionId: input.sessionId,
+    content: input.content,
+    logicalKey: buildPathPlanLogicalKey(normalizedSourcePath),
+    sourcePath: normalizedSourcePath,
+    promptBatchId: input.promptBatchId,
+    logger: input.logger
+  });
+}
+function captureTaggedPlan(input) {
+  return persistPlan({
+    sessionId: input.sessionId,
+    content: input.content,
+    logicalKey: buildSessionTagPlanLogicalKey(input.sessionId, input.tag),
+    sourcePath: `${TRANSCRIPT_SOURCE_PREFIX}${input.tag}`,
+    promptBatchId: input.promptBatchId,
+    planKey: input.tag,
+    logger: input.logger
+  });
+}
+
+// src/daemon/api/mcp-proxy.ts
+var SPORE_ID_RANDOM_BYTES = 4;
+var RESOLUTION_ID_RANDOM_BYTES = 8;
+var MIN_CONSOLIDATE_SOURCES = 2;
+var RememberBody = external_exports.object({
+  content: external_exports.string(),
+  type: external_exports.string().optional(),
+  tags: external_exports.array(external_exports.string()).optional()
+});
+var SupersedeBody = external_exports.object({
+  old_spore_id: external_exports.string(),
+  new_spore_id: external_exports.string(),
+  reason: external_exports.string().optional()
+});
+function isoToEpochSeconds(iso) {
+  const ms = Date.parse(iso);
+  return Number.isNaN(ms) ? void 0 : Math.floor(ms / 1e3);
+}
+function registerMcpUserAgent(createdAt) {
+  registerAgent({
+    id: USER_AGENT_ID,
+    name: USER_AGENT_NAME,
+    created_at: createdAt
+  });
+}
 function toPlanProgress(content) {
   const planContent = content ?? "";
   const checked = (planContent.match(/- \[x\]/gi) ?? []).length;
@@ -6639,8 +7363,20 @@ var ConsolidateBody = external_exports.object({
   tags: external_exports.array(external_exports.string()).optional(),
   reason: external_exports.string().optional()
 });
+var SavePlanBody = external_exports.object({
+  session_id: external_exports.string(),
+  content: external_exports.string().min(1),
+  source_path: external_exports.string().min(1).optional(),
+  plan_key: external_exports.string().min(1).optional(),
+  title: external_exports.string().min(1).optional(),
+  status: external_exports.enum(PLAN_STATUSES).optional(),
+  tags: external_exports.array(external_exports.string()).optional()
+}).refine(
+  (value) => Boolean(value.source_path) !== Boolean(value.plan_key),
+  { message: "Provide exactly one of source_path or plan_key" }
+);
 function createMcpProxyHandlers(deps) {
-  const { machineId, embeddingManager } = deps;
+  const { machineId, embeddingManager, projectRoot, logger } = deps;
   function toPlanSummary(row) {
     return {
       id: row.id,
@@ -6764,8 +7500,46 @@ function createMcpProxyHandlers(deps) {
       }
     };
   }
+  async function handleSavePlan(req) {
+    const { session_id, content, source_path, plan_key, title, status, tags } = SavePlanBody.parse(req.body);
+    const session = getSession(session_id);
+    if (!session) return { status: 404, body: errorBody("session-not-found", "Session not found") };
+    const openBatch = getLatestOpenBatch(session_id);
+    const normalizedSourcePath = source_path ? normalizePlanSourcePath(source_path, projectRoot) : null;
+    const logicalKey = normalizedSourcePath ? buildPathPlanLogicalKey(normalizedSourcePath) : buildSessionPlanLogicalKey(session_id, plan_key);
+    const row = persistPlan({
+      sessionId: session_id,
+      content,
+      logicalKey,
+      sourcePath: normalizedSourcePath,
+      promptBatchId: openBatch?.id,
+      title,
+      status,
+      tags,
+      planKey: plan_key ?? null,
+      logger
+    });
+    return {
+      body: {
+        id: row.id,
+        logical_key: row.logical_key,
+        title: row.title,
+        status: row.status,
+        source_path: row.source_path,
+        session_id: row.session_id,
+        prompt_batch_id: row.prompt_batch_id,
+        tags: toPlanTags(row.tags),
+        created_at: row.created_at,
+        updated_at: row.updated_at
+      }
+    };
+  }
   async function handlePlans(req) {
     const id = typeof req.query.id === "string" ? req.query.id : void 0;
+    const session = typeof req.query.session === "string" ? req.query.session : void 0;
+    if (id && session) {
+      return { status: 400, body: errorBody("mutually-exclusive-query", "Pass either id or session, not both") };
+    }
     if (id) {
       const row = getPlan(id);
       if (!row) return { body: { plans: [] } };
@@ -6778,6 +7552,11 @@ function createMcpProxyHandlers(deps) {
         }
       };
     }
+    if (session) {
+      const rows2 = listPlansBySession(session);
+      const plans2 = rows2.map(toPlanSummary);
+      return { body: { plans: plans2 } };
+    }
     const statusFilter = req.query.status === "all" ? void 0 : req.query.status;
     const limit = req.query.limit ? Number(req.query.limit) : void 0;
     const rows = listPlans({ status: statusFilter, limit });
@@ -6831,6 +7610,7 @@ function createMcpProxyHandlers(deps) {
     handleSupersede,
     handleConsolidate,
     handlePlans,
+    handleSavePlan,
     handleSessions,
     handleTeam
   };
@@ -6838,16 +7618,386 @@ function createMcpProxyHandlers(deps) {
 
 // src/daemon/api/agent-runs.ts
 import { resolve as resolve2 } from "path";
+
+// src/services/phase-audit.ts
+function isStoredUsageData(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function parseUsageData(raw) {
+  return tryParseJson(raw, isStoredUsageData) ?? {};
+}
+function normalizeStatus(raw) {
+  if (raw === "completed" || raw === "failed" || raw === "skipped") return raw;
+  return "pending";
+}
+function aggregateTurnCounts(turns) {
+  const toolCalls = {};
+  for (const turn of turns) {
+    toolCalls[turn.tool_name] = (toolCalls[turn.tool_name] ?? 0) + 1;
+  }
+  const toolErrors = {};
+  return [toolCalls, toolErrors];
+}
+function aggregateWriteIntents(intents) {
+  const byPhase = {};
+  const unattributedByTool = {};
+  const totalByTool = {};
+  for (const intent of intents) {
+    const tool = intent.tool_name;
+    totalByTool[tool] = (totalByTool[tool] ?? 0) + 1;
+    if (intent.phase_id) {
+      if (!byPhase[intent.phase_id]) byPhase[intent.phase_id] = {};
+      byPhase[intent.phase_id][tool] = (byPhase[intent.phase_id][tool] ?? 0) + 1;
+    } else {
+      unattributedByTool[tool] = (unattributedByTool[tool] ?? 0) + 1;
+    }
+  }
+  return {
+    total: intents.length,
+    byPhase,
+    unattributedByTool,
+    totalByTool
+  };
+}
+function serializeReports(reports) {
+  return reports.map((r) => ({
+    action: r.action,
+    summary: r.summary ?? null,
+    details: r.details ?? null,
+    createdAt: r.created_at
+  }));
+}
+function buildPhaseAudit(runId) {
+  const run = getRun(runId);
+  if (!run) return null;
+  const dryRun = run.dry_run;
+  const usageData = parseUsageData(run.usage_data);
+  const checkpointState = parseCheckpointState(run.checkpoints);
+  const usageByName = new Map(
+    (usageData.phases ?? []).map((p) => [p.name, p])
+  );
+  const checkpointByName = new Map(
+    Object.entries(checkpointState.phases).map(([key, cp]) => [
+      cp.name ?? key,
+      cp
+    ])
+  );
+  const phaseNames = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const p of usageData.phases ?? []) {
+    if (!seen.has(p.name)) {
+      phaseNames.push(p.name);
+      seen.add(p.name);
+    }
+  }
+  for (const name of checkpointByName.keys()) {
+    if (!seen.has(name)) {
+      phaseNames.push(name);
+      seen.add(name);
+    }
+  }
+  const reports = listReports(runId);
+  const turns = listTurnsByRun(runId);
+  const [toolCalls, toolErrors] = aggregateTurnCounts(turns);
+  const serializedReports = serializeReports(reports);
+  let intentSummary = null;
+  if (dryRun) {
+    const intents = listWriteIntentTools(runId);
+    intentSummary = aggregateWriteIntents(intents);
+  }
+  if (phaseNames.length === 0 && turns.length > 0) {
+    const runStatus = normalizeStatus(run.status);
+    const durationMs = runDurationMs(run);
+    let writeIntents = null;
+    if (intentSummary) {
+      writeIntents = {
+        total: intentSummary.total,
+        byTool: intentSummary.totalByTool
+      };
+    }
+    const summary = run.status === "failed" ? run.error ?? null : null;
+    return {
+      runId,
+      taskName: run.task ?? null,
+      dryRun,
+      phases: [
+        {
+          phaseName: "run",
+          status: runStatus,
+          summary,
+          turnsUsed: turns.length,
+          maxTurns: null,
+          tokensUsed: run.tokens_used ?? 0,
+          costUsd: run.cost_usd ?? null,
+          costSource: run.cost_source ?? null,
+          durationMs,
+          startedAt: run.started_at,
+          completedAt: run.completed_at,
+          skipReason: null,
+          toolCalls,
+          toolErrors,
+          writeIntents,
+          reports: serializedReports
+        }
+      ]
+    };
+  }
+  const phases = phaseNames.map((phaseName) => {
+    const usage = usageByName.get(phaseName);
+    const cp = checkpointByName.get(phaseName);
+    const status = normalizeStatus(cp?.status ?? (usage ? "pending" : "pending"));
+    const tokensUsed = cp?.tokensUsed ?? usage?.tokensUsed ?? usage?.usage?.totalTokens ?? 0;
+    const costUsd = cp?.costUsd !== void 0 ? cp.costUsd : usage?.costUsd !== void 0 ? usage.costUsd : null;
+    const costSource = cp?.costSource ?? usage?.costSource ?? null;
+    const durationMs = usage?.usage?.durationMs ?? null;
+    const completedAt = status === "completed" || status === "failed" ? cp?.updatedAt ?? null : null;
+    const startedAt = null;
+    const skipReason = null;
+    let writeIntents = null;
+    if (intentSummary) {
+      const phaseByTool = intentSummary.byPhase[phaseName] ?? {};
+      writeIntents = {
+        // Phase total = sum of tool calls attributed to this phase
+        total: Object.values(phaseByTool).reduce((sum, n) => sum + n, 0),
+        byTool: phaseByTool
+      };
+    }
+    return {
+      phaseName,
+      status,
+      summary: cp?.summary ?? null,
+      turnsUsed: cp?.turnsUsed ?? 0,
+      maxTurns: null,
+      // Not persisted — see module JSDoc
+      tokensUsed,
+      costUsd,
+      costSource,
+      durationMs,
+      startedAt,
+      completedAt,
+      skipReason,
+      toolCalls,
+      // run-level aggregate (no per-phase turn attribution)
+      toolErrors,
+      // always empty — no error flag on turn rows
+      writeIntents,
+      reports: serializedReports
+      // all reports; no phase column exists
+    };
+  });
+  return {
+    runId,
+    taskName: run.task ?? null,
+    dryRun,
+    phases
+  };
+}
+
+// src/daemon/api/schemas/execution-overrides.ts
+var ReasoningLevelEnum = external_exports.enum(["low", "default", "high"]);
+var RuntimeIdEnum = external_exports.enum(["claude-sdk", "openai-agents"]);
+var ProviderTypeEnum = external_exports.enum([
+  "anthropic",
+  "ollama",
+  "lmstudio",
+  "openai",
+  "openrouter",
+  "openai-compatible"
+]);
+var ProviderOverrideWireSchema = external_exports.object({
+  runtime: RuntimeIdEnum.optional(),
+  type: ProviderTypeEnum,
+  localBackend: external_exports.enum(["ollama", "lmstudio"]).optional(),
+  baseUrl: external_exports.string().optional(),
+  model: external_exports.string().optional(),
+  reasoningMap: external_exports.object({
+    low: external_exports.string().optional(),
+    default: external_exports.string().optional(),
+    high: external_exports.string().optional()
+  }).optional(),
+  contextLength: external_exports.number().int().positive().optional()
+});
+var PhaseExecutionOverrideBody = external_exports.object({
+  reasoningLevel: ReasoningLevelEnum.optional(),
+  model: external_exports.string().optional(),
+  provider: ProviderOverrideWireSchema.optional(),
+  maxTurns: external_exports.number().int().positive().optional()
+});
+var ExecutionOverrideBody = external_exports.object({
+  runtime: RuntimeIdEnum.optional(),
+  reasoningLevel: ReasoningLevelEnum.optional(),
+  model: external_exports.string().optional(),
+  provider: ProviderOverrideWireSchema.optional(),
+  phases: external_exports.record(external_exports.string(), PhaseExecutionOverrideBody).optional()
+}).optional();
+
+// src/daemon/api/schemas/execution-overrides-traversal.ts
+function transformProviderOverrides(overrides, transform) {
+  if (overrides === null || overrides === void 0) {
+    return overrides ?? null;
+  }
+  if (typeof overrides !== "object") return overrides;
+  const cloned = { ...overrides };
+  if (isPlainObject(cloned.provider)) {
+    const next = transform({ ...cloned.provider });
+    if (next === null) {
+      delete cloned.provider;
+    } else {
+      cloned.provider = next;
+    }
+  }
+  if (isPlainObject(cloned.phases)) {
+    const nextPhases = {};
+    for (const [name, phase] of Object.entries(cloned.phases)) {
+      if (!isPlainObject(phase)) {
+        nextPhases[name] = phase;
+        continue;
+      }
+      const clonedPhase = { ...phase };
+      if (isPlainObject(clonedPhase.provider)) {
+        const nextProvider = transform({ ...clonedPhase.provider });
+        if (nextProvider === null) {
+          delete clonedPhase.provider;
+        } else {
+          clonedPhase.provider = nextProvider;
+        }
+      }
+      nextPhases[name] = clonedPhase;
+    }
+    cloned.phases = nextPhases;
+  }
+  return cloned;
+}
+function isPlainObject(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+
+// src/daemon/api/run-serializer.ts
+function buildPhaseCheckpointSummary(checkpointsRaw) {
+  if (!checkpointsRaw) return [];
+  try {
+    const parsed = JSON.parse(checkpointsRaw);
+    return Object.entries(parsed.phases ?? {}).map(([name, phase]) => ({
+      name: phase.name ?? name,
+      status: phase.status ?? "pending",
+      updatedAt: phase.updatedAt ?? 0,
+      ...phase.tokensUsed !== void 0 ? { tokensUsed: phase.tokensUsed } : {},
+      ...phase.costUsd !== void 0 ? { costUsd: phase.costUsd } : {},
+      ...phase.costSource !== void 0 ? { costSource: phase.costSource } : {}
+    }));
+  } catch {
+    return [];
+  }
+}
+function scrubExecutionOverrides(overrides) {
+  if (!overrides || typeof overrides !== "object") return overrides;
+  const topLevelStripped = { ...overrides };
+  if ("apiKey" in topLevelStripped) delete topLevelStripped.apiKey;
+  return transformProviderOverrides(topLevelStripped, stripApiKey);
+}
+function stripApiKey(provider) {
+  const cloned = { ...provider };
+  if ("apiKey" in cloned) delete cloned.apiKey;
+  return cloned;
+}
+function serializeRun(run, opts = {}) {
+  const {
+    includeResumeFields = true,
+    includePhaseCheckpoints = true,
+    writeIntents,
+    duration_ms
+  } = opts;
+  const base = {
+    id: run.id,
+    agent_id: run.agent_id,
+    task: run.task,
+    instruction: run.instruction,
+    status: run.status,
+    runtime: run.runtime,
+    provider: run.provider,
+    model: run.model,
+    session_ref: run.session_ref,
+    started_at: run.started_at,
+    completed_at: run.completed_at,
+    tokens_used: run.tokens_used,
+    cost_usd: run.cost_usd,
+    actual_cost_usd: run.actual_cost_usd,
+    estimated_cost_usd: run.estimated_cost_usd,
+    cost_source: run.cost_source,
+    cost_data: run.cost_data,
+    actions_taken: run.actions_taken,
+    usage_data: run.usage_data,
+    error: run.error,
+    dry_run: run.dry_run,
+    evaluation_id: run.evaluation_id,
+    reasoning_level: run.reasoning_level,
+    // Strip `apiKey` from historical rows defensively — before this PR the
+    // API accepted apiKey in executionOverrides and stored it unmasked.
+    execution_overrides: scrubExecutionOverrides(run.execution_overrides)
+  };
+  return {
+    ...base,
+    ...includeResumeFields ? {
+      resumable: run.resumable === 1,
+      resume_status: run.resume_status,
+      resume_mode: run.resume_mode,
+      resumed_at: run.resumed_at,
+      checkpoints: run.checkpoints
+    } : {},
+    ...includePhaseCheckpoints ? { phase_checkpoints: buildPhaseCheckpointSummary(run.checkpoints) } : {},
+    ...writeIntents !== void 0 && writeIntents !== null ? { write_intents: writeIntents } : {},
+    ...duration_ms !== void 0 ? { duration_ms } : {}
+  };
+}
+
+// src/daemon/api/agent-runs.ts
 var AGENT_RUNS_DEFAULT_LIMIT = 50;
+var REMOTE_PROVIDER_TYPES = /* @__PURE__ */ new Set(["openai", "openrouter"]);
+function stripBaseUrlForRemoteProviders(provider) {
+  const type = provider.type;
+  if (typeof type === "string" && REMOTE_PROVIDER_TYPES.has(type)) {
+    const { baseUrl: _dropped, ...rest } = provider;
+    return rest;
+  }
+  return provider;
+}
+function sanitizeExecutionOverrides(overrides) {
+  if (!overrides) return overrides;
+  const result = transformProviderOverrides(
+    overrides,
+    stripBaseUrlForRemoteProviders
+  );
+  return result;
+}
 var AgentRunBody = external_exports.object({
   task: external_exports.string().optional(),
   instruction: external_exports.string().optional(),
-  agentId: external_exports.string().optional()
+  agentId: external_exports.string().optional(),
+  /**
+   * Run in dry-run mode — writes intercepted by the tool surface and
+   * recorded to `agent_run_write_intents` instead of mutating the vault.
+   */
+  dryRun: external_exports.boolean().optional(),
+  /** Evaluation matrix this run belongs to, if any. */
+  evaluationId: external_exports.string().nullable().optional(),
+  /** Per-run runtime/reasoning/model overrides; also per-phase overrides. */
+  executionOverrides: ExecutionOverrideBody
+});
+var ResumeRunBody = external_exports.object({
+  mode: external_exports.enum(["manual", "scheduled"]).optional()
 });
 function createAgentRunHandlers(deps) {
-  const { vaultDir, embeddingManager, logger } = deps;
+  const { vaultDir, embeddingManager, logger, getTeamClient } = deps;
   async function handleRun(req) {
-    const { task, instruction: rawInstruction, agentId } = AgentRunBody.parse(req.body);
+    const {
+      task,
+      instruction: rawInstruction,
+      agentId,
+      dryRun,
+      evaluationId,
+      executionOverrides: rawExecutionOverrides
+    } = AgentRunBody.parse(req.body);
+    const executionOverrides = sanitizeExecutionOverrides(rawExecutionOverrides);
     const mycoConfig = loadMergedConfig(vaultDir);
     if (!hasConfiguredProvider(mycoConfig, task)) {
       return {
@@ -6865,10 +8015,10 @@ function createAgentRunHandlers(deps) {
       try {
         const taskParams = mycoConfig.agent.tasks?.[task]?.params;
         const projectRoot = resolve2(vaultDir, "..");
-        built = buildTaskInstruction(task, taskParams, agentId, projectRoot, embeddingManager);
+        built = await buildTaskInstruction(task, taskParams, agentId, projectRoot, embeddingManager, mycoConfig, getTeamClient);
       } catch {
         const projectRoot = resolve2(vaultDir, "..");
-        built = buildTaskInstruction(task, void 0, agentId, projectRoot, embeddingManager);
+        built = await buildTaskInstruction(task, void 0, agentId, projectRoot, embeddingManager, mycoConfig, getTeamClient);
       }
       instruction = built?.instruction;
       runContext = built?.context;
@@ -6883,13 +8033,16 @@ function createAgentRunHandlers(deps) {
         };
       }
     }
-    const { runAgent } = await import("./executor-J4IBXSBY.js");
-    const resultPromise = runAgent(vaultDir, {
+    const { runAgent: runAgent2 } = await import("./executor-F2YU7HXJ.js");
+    const resultPromise = runAgent2(vaultDir, {
       task,
       instruction,
       agentId,
       embeddingManager,
-      runContext
+      runContext,
+      dryRun,
+      evaluationId,
+      executionOverrides
     });
     const effectiveAgentId = agentId ?? "myco-agent";
     const runId = getLatestRunId(effectiveAgentId, task);
@@ -6941,14 +8094,57 @@ function createAgentRunHandlers(deps) {
     const filterOpts = { agent_id: agentId, status, task, search };
     const runs = listRuns({ ...filterOpts, limit, offset });
     const total = countRuns(filterOpts);
-    return { body: { runs, total, offset, limit } };
+    return { body: { runs: runs.map((run) => serializeRun(run)), total, offset, limit } };
   }
   async function handleGetRun(req) {
     const run = getRun(req.params.id);
     if (!run) {
       return { status: 404, body: { error: "Run not found" } };
     }
-    return { body: { run } };
+    const byTool = countWriteIntentsByTool(run.id);
+    const total = Object.values(byTool).reduce((acc, n) => acc + n, 0);
+    return {
+      body: {
+        run: serializeRun(run, {
+          writeIntents: { total, by_tool: byTool },
+          duration_ms: runDurationMs(run)
+        })
+      }
+    };
+  }
+  async function handleResumeRun(req) {
+    const run = getRun(req.params.id);
+    if (!run) {
+      return { status: 404, body: { error: "Run not found" } };
+    }
+    if (run.resumable !== 1 || run.status !== "failed") {
+      return { status: 400, body: { error: "Run is not resumable" } };
+    }
+    const { mode } = ResumeRunBody.parse(req.body ?? {});
+    const { runAgent: runAgent2 } = await import("./executor-F2YU7HXJ.js");
+    const resultPromise = runAgent2(vaultDir, {
+      agentId: run.agent_id,
+      task: run.task ?? void 0,
+      instruction: run.instruction ?? void 0,
+      resumeRunId: run.id,
+      resumeMode: mode ?? "manual",
+      embeddingManager
+    });
+    resultPromise.then((result) => {
+      logger.info(LOG_KINDS.AGENT_RUN, "Agent run resumed", {
+        runId: result.runId,
+        status: result.status,
+        runtime: result.runtime,
+        provider: result.provider,
+        model: result.model
+      });
+    }).catch((err) => {
+      logger.error(LOG_KINDS.AGENT_ERROR, "Agent run resume threw unhandled error", {
+        runId: run.id,
+        error: err instanceof Error ? err.message : String(err)
+      });
+    });
+    return { body: { ok: true, message: "Agent resume started", runId: run.id } };
   }
   async function handleGetRunReports(req) {
     const reports = listReports(req.params.id);
@@ -6958,18 +8154,376 @@ function createAgentRunHandlers(deps) {
     const turns = listTurnsByRun(req.params.id);
     return { body: turns };
   }
+  async function handleGetRunWriteIntents(req) {
+    const rawLimit = req.query.limit ? Number(req.query.limit) : void 0;
+    const rawOffset = req.query.offset ? Number(req.query.offset) : void 0;
+    const limit = Number.isFinite(rawLimit) && rawLimit !== void 0 && rawLimit > 0 ? Math.min(rawLimit, 5e3) : 500;
+    const offset = Number.isFinite(rawOffset) && rawOffset !== void 0 && rawOffset >= 0 ? rawOffset : 0;
+    const intents = listWriteIntents(req.params.id, { limit, offset });
+    const total = countWriteIntents(req.params.id);
+    return { body: { intents, count: intents.length, total } };
+  }
+  async function handleGetRunAudit(req) {
+    const audit = buildPhaseAudit(req.params.id);
+    if (!audit) {
+      return { status: 404, body: { error: "Run not found" } };
+    }
+    return { body: { audit } };
+  }
   return {
     handleRun,
     handleListRuns,
     handleGetRun,
+    handleResumeRun,
     handleGetRunReports,
-    handleGetRunTurns
+    handleGetRunTurns,
+    handleGetRunWriteIntents,
+    handleGetRunAudit
   };
 }
 
+// src/daemon/api/agent-evaluations.ts
+import crypto from "crypto";
+
+// src/db/queries/evaluations.ts
+var DEFAULT_LIMIT = 50;
+var EVAL_STATUS_PENDING = "pending";
+var EVAL_STATUS_RUNNING = "running";
+var EVAL_STATUS_COMPLETED = "completed";
+var EVAL_STATUS_FAILED = "failed";
+var EVAL_COLUMNS = [
+  "id",
+  "task_id",
+  "matrix_json",
+  "notes",
+  "status",
+  "created_at",
+  "completed_at"
+];
+var SELECT_COLUMNS5 = EVAL_COLUMNS.join(", ");
+function toEvaluationRow(row) {
+  const matrixJson = row.matrix_json;
+  let matrix = null;
+  if (matrixJson) {
+    try {
+      matrix = JSON.parse(matrixJson);
+    } catch {
+      matrix = null;
+    }
+  }
+  return {
+    id: row.id,
+    task_id: row.task_id,
+    matrix,
+    notes: row.notes ?? null,
+    status: row.status,
+    created_at: row.created_at,
+    completed_at: row.completed_at ?? null
+  };
+}
+function insertEvaluation(data) {
+  const db = getDatabase();
+  const createdAt = data.createdAt ?? epochSeconds();
+  db.prepare(
+    `INSERT INTO agent_run_evaluations
+       (id, task_id, matrix_json, notes, status, created_at, completed_at)
+     VALUES (?, ?, ?, ?, ?, ?, NULL)`
+  ).run(
+    data.id,
+    data.taskId,
+    JSON.stringify(data.matrix ?? null),
+    data.notes ?? null,
+    EVAL_STATUS_PENDING,
+    createdAt
+  );
+  return getEvaluation(data.id);
+}
+function getEvaluation(id) {
+  const db = getDatabase();
+  const row = db.prepare(
+    `SELECT ${SELECT_COLUMNS5} FROM agent_run_evaluations WHERE id = ?`
+  ).get(id);
+  return row ? toEvaluationRow(row) : null;
+}
+function listEvaluations(options = {}) {
+  const db = getDatabase();
+  const limit = options.limit ?? DEFAULT_LIMIT;
+  const offset = options.offset ?? 0;
+  const rows = db.prepare(
+    `SELECT ${SELECT_COLUMNS5}
+     FROM agent_run_evaluations
+     ORDER BY created_at DESC, id DESC
+     LIMIT ? OFFSET ?`
+  ).all(limit, offset);
+  return rows.map(toEvaluationRow);
+}
+function updateEvaluationStatus(id, status, completedAt) {
+  const db = getDatabase();
+  if (completedAt === void 0) {
+    db.prepare(
+      `UPDATE agent_run_evaluations SET status = ? WHERE id = ?`
+    ).run(status, id);
+  } else {
+    db.prepare(
+      `UPDATE agent_run_evaluations SET status = ?, completed_at = ? WHERE id = ?`
+    ).run(status, completedAt, id);
+  }
+  return getEvaluation(id);
+}
+
+// src/daemon/api/agent-evaluations.ts
+var DEFAULT_LIMIT2 = 50;
+var CreateEvaluationBody = external_exports.object({
+  taskId: external_exports.string(),
+  matrix: external_exports.object({
+    runtimes: external_exports.array(RuntimeIdEnum).optional(),
+    reasoningLevels: external_exports.array(ReasoningLevelEnum).optional(),
+    models: external_exports.array(external_exports.string()).optional(),
+    dryRun: external_exports.boolean().optional(),
+    notes: external_exports.string().optional(),
+    /**
+     * Phase-level overrides applied to EVERY cell in the matrix. The matrix
+     * dimensions (runtimes / reasoningLevels / models) vary the top-level
+     * execution per cell; phase overrides here let you pin specific phases
+     * to fixed reasoning/model/provider/maxTurns regardless of what the cell
+     * is varying at the top level.
+     *
+     * Merged into each cell's `executionOverrides.phases` before runAgent
+     * is invoked. Unknown phase names are ignored by the executor (a
+     * one-shot warning is logged at run startup).
+     */
+    phases: external_exports.record(external_exports.string(), PhaseExecutionOverrideBody).optional()
+  }),
+  notes: external_exports.string().optional()
+});
+function aggregateRuns(runs) {
+  let completed = 0;
+  let failed = 0;
+  let skipped = 0;
+  let totalTokens = 0;
+  let totalCostUsd = 0;
+  for (const run of runs) {
+    if (run.status === "completed") completed++;
+    else if (run.status === "failed") failed++;
+    else if (run.status === "skipped") skipped++;
+    totalTokens += run.tokens_used ?? 0;
+    totalCostUsd += run.cost_usd ?? 0;
+  }
+  return {
+    total: runs.length,
+    completed,
+    failed,
+    skipped,
+    totalTokens,
+    totalCostUsd
+  };
+}
+function summarizeFromByTool(byTool) {
+  const tools = byTool ?? {};
+  let total = 0;
+  for (const count of Object.values(tools)) total += count;
+  return { total, by_tool: tools };
+}
+function createAgentEvaluationHandlers(deps) {
+  const { vaultDir, embeddingManager, logger } = deps;
+  async function handleCreate(req) {
+    const parsed = CreateEvaluationBody.safeParse(req.body);
+    if (!parsed.success) {
+      return {
+        status: 400,
+        body: { error: "Invalid request body", details: parsed.error.flatten() }
+      };
+    }
+    const body = parsed.data;
+    const cells = enumerateMatrixCells(body.matrix);
+    if (cells.length === 0) {
+      return {
+        status: 400,
+        body: { error: "Matrix produced zero cells" }
+      };
+    }
+    const evalId = crypto.randomUUID();
+    insertEvaluation({
+      id: evalId,
+      taskId: body.taskId,
+      matrix: body.matrix,
+      notes: body.notes ?? null
+    });
+    const dryRun = body.matrix.dryRun ?? false;
+    void (async () => {
+      const { runAgent: runAgent2 } = await import("./executor-F2YU7HXJ.js");
+      let anyCompleted = false;
+      let transitionedToRunning = false;
+      const sharedPhases = body.matrix.phases;
+      for (const cell of cells) {
+        const cellOptions = {
+          task: body.taskId,
+          evaluationId: evalId,
+          dryRun,
+          embeddingManager,
+          executionOverrides: {
+            ...cell.runtime ? { runtime: cell.runtime } : {},
+            ...cell.reasoningLevel ? { reasoningLevel: cell.reasoningLevel } : {},
+            ...cell.model ? { model: cell.model } : {},
+            ...sharedPhases && Object.keys(sharedPhases).length > 0 ? { phases: sharedPhases } : {}
+          }
+        };
+        if (!transitionedToRunning) {
+          updateEvaluationStatus(evalId, EVAL_STATUS_RUNNING);
+          transitionedToRunning = true;
+        }
+        try {
+          const result = await runAgent2(vaultDir, cellOptions);
+          if (result.status === "completed") {
+            anyCompleted = true;
+          }
+          logger.info(LOG_KINDS.AGENT_RUN, "Evaluation cell finished", {
+            evaluationId: evalId,
+            runId: result.runId,
+            status: result.status,
+            runtime: cell.runtime,
+            reasoningLevel: cell.reasoningLevel,
+            model: cell.model
+          });
+        } catch (err) {
+          logger.error(LOG_KINDS.AGENT_ERROR, "Evaluation cell threw", {
+            evaluationId: evalId,
+            runtime: cell.runtime,
+            reasoningLevel: cell.reasoningLevel,
+            model: cell.model,
+            error: err instanceof Error ? err.message : String(err)
+          });
+        }
+      }
+      const status = anyCompleted ? EVAL_STATUS_COMPLETED : EVAL_STATUS_FAILED;
+      updateEvaluationStatus(evalId, status, epochSeconds());
+      logger.info(LOG_KINDS.AGENT_RUN, "Evaluation finished", {
+        evaluationId: evalId,
+        status,
+        cellCount: cells.length
+      });
+    })().catch((err) => {
+      logger.error(LOG_KINDS.AGENT_ERROR, "Evaluation fan-out failed", {
+        evaluationId: evalId,
+        error: err instanceof Error ? err.message : String(err)
+      });
+    });
+    return { body: { evaluationId: evalId, cellCount: cells.length } };
+  }
+  async function handleGet(req) {
+    const evaluation = getEvaluation(req.params.id);
+    if (!evaluation) {
+      return { status: 404, body: { error: "Evaluation not found" } };
+    }
+    const runs = listRunsForEvaluation(evaluation.id);
+    const writeIntentsByRun = countWriteIntentsByToolForEvaluation(evaluation.id);
+    return {
+      body: {
+        evaluation: {
+          id: evaluation.id,
+          taskId: evaluation.task_id,
+          matrix: evaluation.matrix,
+          notes: evaluation.notes,
+          status: evaluation.status,
+          createdAt: evaluation.created_at,
+          completedAt: evaluation.completed_at
+        },
+        runs: runs.map(
+          (run) => serializeRun(run, {
+            includeResumeFields: false,
+            includePhaseCheckpoints: false,
+            writeIntents: summarizeFromByTool(writeIntentsByRun[run.id]),
+            duration_ms: runDurationMs(run)
+          })
+        ),
+        aggregate: aggregateRuns(runs)
+      }
+    };
+  }
+  async function handleList(req) {
+    const limit = req.query.limit ? Number(req.query.limit) : DEFAULT_LIMIT2;
+    const offset = req.query.offset ? Number(req.query.offset) : 0;
+    const evaluations = listEvaluations({ limit, offset });
+    return {
+      body: {
+        evaluations: evaluations.map((e) => ({
+          id: e.id,
+          taskId: e.task_id,
+          matrix: e.matrix,
+          notes: e.notes,
+          status: e.status,
+          createdAt: e.created_at,
+          completedAt: e.completed_at
+        })),
+        total: evaluations.length
+      }
+    };
+  }
+  return { handleCreate, handleGet, handleList };
+}
+
+// src/daemon/api/digest-revisions.ts
+var DEFAULT_LIMIT3 = 50;
+var RestoreBody = external_exports.object({
+  /** If supplied, recorded on the new revision row as the run that triggered the restore. */
+  runId: external_exports.string().optional()
+});
+function createDigestRevisionHandlers(deps) {
+  const { logger } = deps;
+  async function handleList(req) {
+    const agentId = req.query.agentId || DEFAULT_AGENT_ID;
+    const tierRaw = req.query.tier;
+    if (!tierRaw) {
+      return { status: 400, body: { error: "tier is required" } };
+    }
+    const tier = Number(tierRaw);
+    if (!Number.isFinite(tier)) {
+      return { status: 400, body: { error: `tier must be numeric, got ${tierRaw}` } };
+    }
+    const limit = req.query.limit ? Number(req.query.limit) : DEFAULT_LIMIT3;
+    const revisions = listDigestRevisions({ agentId, tier, limit });
+    return { body: { revisions, count: revisions.length } };
+  }
+  async function handleRestore(req) {
+    const revisionId = Number(req.params.id);
+    if (!Number.isFinite(revisionId)) {
+      return { status: 400, body: { error: "Invalid revision id" } };
+    }
+    const parsed = RestoreBody.safeParse(req.body ?? {});
+    if (!parsed.success) {
+      return {
+        status: 400,
+        body: { error: "Invalid request body", details: parsed.error.flatten() }
+      };
+    }
+    const result = rollbackDigestExtract({
+      revisionId,
+      runId: parsed.data.runId ?? null
+    });
+    if (!result) {
+      return { status: 404, body: { error: "Revision not found" } };
+    }
+    logger.info(LOG_KINDS.AGENT_RUN, "Digest revision restored", {
+      revisionId,
+      newRevisionId: result.newRevisionId,
+      agentId: result.row.agent_id,
+      tier: result.row.tier,
+      triggeredBy: parsed.data.runId ?? "operator"
+    });
+    return {
+      body: {
+        ok: true,
+        restored: revisionId,
+        newRevisionId: result.newRevisionId
+      }
+    };
+  }
+  return { handleList, handleRestore };
+}
+
 // src/daemon/api/attachments.ts
-import fs18 from "fs";
-import path17 from "path";
+import fs19 from "fs";
+import path19 from "path";
 var ATTACHMENT_MEDIA_TYPES = {
   png: "image/png",
   jpg: "image/jpeg",
@@ -6989,14 +8543,14 @@ function createAttachmentHandler(deps) {
       const contentType2 = att.media_type ?? "application/octet-stream";
       return { status: 200, headers: { "Content-Type": contentType2 }, body: att.data };
     }
-    const filePath = path17.join(vaultDir, "attachments", filename);
+    const filePath = path19.join(vaultDir, "attachments", filename);
     let diskData;
     try {
-      diskData = fs18.readFileSync(filePath);
+      diskData = fs19.readFileSync(filePath);
     } catch {
       return { status: 404, body: { error: "not_found" } };
     }
-    const ext = path17.extname(filename).slice(1).toLowerCase();
+    const ext = path19.extname(filename).slice(1).toLowerCase();
     const contentType = ATTACHMENT_MEDIA_TYPES[ext] ?? "application/octet-stream";
     return { status: 200, headers: { "Content-Type": contentType }, body: diskData };
   }
@@ -7004,19 +8558,19 @@ function createAttachmentHandler(deps) {
 }
 
 // src/daemon/log-reconcile.ts
-import fs19 from "fs";
-import path18 from "path";
+import fs20 from "fs";
+import path20 from "path";
 function reconcileLogBuffer(logDir, sinceTimestamp) {
   let replayed = 0;
   const files = [];
   for (let i = 3; i >= 1; i--) {
-    const rotated = path18.join(logDir, `daemon.${i}.log`);
-    if (fs19.existsSync(rotated)) files.push(rotated);
+    const rotated = path20.join(logDir, `daemon.${i}.log`);
+    if (fs20.existsSync(rotated)) files.push(rotated);
   }
-  const current = path18.join(logDir, "daemon.log");
-  if (fs19.existsSync(current)) files.push(current);
+  const current = path20.join(logDir, "daemon.log");
+  if (fs20.existsSync(current)) files.push(current);
   for (const file of files) {
-    const content = fs19.readFileSync(file, "utf-8");
+    const content = fs20.readFileSync(file, "utf-8");
     for (const line of content.split("\n")) {
       if (!line.trim()) continue;
       try {
@@ -7044,11 +8598,14 @@ function reconcileLogBuffer(logDir, sinceTimestamp) {
 // src/config/focus.ts
 var CONFIG_FOCUS_SECTION_PARAM = "configSection";
 var CONFIG_FOCUS_FIELD_PARAM = "configField";
+var CONFIG_FOCUS_TAB_PARAM = "tab";
 var CONFIG_SECTION_IDS = {
   appearance: "config-section-appearance",
+  cortexInstructions: "config-section-cortex-instructions",
+  cortexBuilder: "config-section-cortex-builder",
+  cortexDigest: "config-section-cortex-digest",
   settingsAgent: "config-section-settings-agent",
   settingsEmbedding: "config-section-settings-embedding",
-  settingsContextInjection: "config-section-settings-context-injection",
   settingsNotifications: "config-section-settings-notifications",
   settingsPlanCapture: "config-section-settings-plan-capture",
   settingsProject: "config-section-settings-project",
@@ -7075,11 +8632,30 @@ var SECTION_RULES = [
     sectionId: CONFIG_SECTION_IDS.settingsEmbedding,
     sectionLabel: "Embedding"
   },
+  {
+    prefix: "context.digest_tier",
+    page: "/cortex",
+    sectionId: CONFIG_SECTION_IDS.cortexDigest,
+    sectionLabel: "Digest",
+    searchParams: { [CONFIG_FOCUS_TAB_PARAM]: "digest" }
+  },
+  {
+    prefix: "context.cortex",
+    page: "/cortex",
+    sectionId: CONFIG_SECTION_IDS.cortexInstructions,
+    sectionLabel: "Instructions"
+  },
+  {
+    prefix: "context.prompt",
+    page: "/cortex",
+    sectionId: CONFIG_SECTION_IDS.cortexInstructions,
+    sectionLabel: "Instructions"
+  },
   {
     prefix: "context",
-    page: "/settings",
-    sectionId: CONFIG_SECTION_IDS.settingsContextInjection,
-    sectionLabel: "Context Injection"
+    page: "/cortex",
+    sectionId: CONFIG_SECTION_IDS.cortexInstructions,
+    sectionLabel: "Instructions"
   },
   {
     prefix: "notifications",
@@ -7146,7 +8722,9 @@ var EXACT_FIELD_LABELS = {
   "embedding.provider": "Provider",
   "embedding.model": "Model",
   "embedding.base_url": "Base URL",
-  "context.digest_tier": "Digest Tier",
+  "context.digest_tier": "Preferred Digest Tier",
+  "context.session_start_digest_enabled": "Session-Start Digest",
+  "context.cortex_enabled": "Session-Start Instructions",
   "context.prompt_search": "Prompt Search",
   "context.prompt_max_spores": "Max Spores per Prompt",
   "notifications.enabled": "Notifications",
@@ -7167,8 +8745,8 @@ var EXACT_FIELD_LABELS = {
 var DYNAMIC_FIELD_LABEL_RULES = [
   {
     prefix: "notifications.domains.",
-    format: (path23) => {
-      const match = /^notifications\.domains\.([^.]+)\.(enabled|mode)$/.exec(path23);
+    format: (path25) => {
+      const match = /^notifications\.domains\.([^.]+)\.(enabled|mode)$/.exec(path25);
       if (!match) return null;
       const [, domain, leaf] = match;
       const domainLabel = humanizeToken(domain);
@@ -7177,13 +8755,13 @@ var DYNAMIC_FIELD_LABEL_RULES = [
   }
 ];
 var SAVE_MESSAGE_LABEL_LIMIT = 3;
-function resolveConfigFocusTarget(path23) {
-  const section = findSectionRule(path23);
+function resolveConfigFocusTarget(path25) {
+  const section = findSectionRule(path25);
   if (!section) return null;
   return {
     ...section,
-    fieldPath: path23,
-    fieldLabel: resolveFieldLabel(path23)
+    fieldPath: path25,
+    fieldLabel: resolveFieldLabel(path25)
   };
 }
 function buildConfigFocusLink(target) {
@@ -7218,25 +8796,25 @@ function buildScopedConfigSaveNotification(scope, touchedPaths) {
     }
   };
 }
-function findSectionRule(path23) {
+function findSectionRule(path25) {
   for (const rule of SECTION_RULES) {
-    if (path23 === rule.prefix || path23.startsWith(`${rule.prefix}.`)) {
+    if (path25 === rule.prefix || path25.startsWith(`${rule.prefix}.`)) {
       const { page, sectionId, sectionLabel, searchParams } = rule;
       return { page, sectionId, sectionLabel, searchParams };
     }
   }
   return null;
 }
-function resolveFieldLabel(path23) {
-  const exact = EXACT_FIELD_LABELS[path23];
+function resolveFieldLabel(path25) {
+  const exact = EXACT_FIELD_LABELS[path25];
   if (exact) return exact;
   for (const rule of DYNAMIC_FIELD_LABEL_RULES) {
-    if (path23 === rule.prefix || path23.startsWith(rule.prefix)) {
-      const label = rule.format(path23);
+    if (path25 === rule.prefix || path25.startsWith(rule.prefix)) {
+      const label = rule.format(path25);
       if (label) return label;
     }
   }
-  return humanizeToken(path23.split(".").pop() ?? "setting");
+  return humanizeToken(path25.split(".").pop() ?? "setting");
 }
 function humanizeToken(value) {
   return value.split(/[-_]/g).filter(Boolean).map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join(" ");
@@ -7356,6 +8934,48 @@ var PowerManager = class {
   }
 };
 
+// src/daemon/inflight-runs.ts
+var DEFAULT_DRAIN_TIMEOUT_MS = 3e4;
+var InflightRunRegistry = class {
+  runs = /* @__PURE__ */ new Set();
+  /**
+   * Track a fire-and-forget agent run. The promise is removed from the
+   * registry in a finally handler so a resolved/rejected run does not hold
+   * memory. Resolves immediately — callers must not await this directly.
+   */
+  register(promise) {
+    const tracked = Promise.resolve(promise).finally(() => {
+      this.runs.delete(tracked);
+    });
+    this.runs.add(tracked);
+  }
+  /** Number of runs currently being tracked. */
+  get size() {
+    return this.runs.size;
+  }
+  /**
+   * Wait for every tracked run to settle, up to `timeoutMs`. Returns when
+   * either every run completes or the deadline elapses — whichever happens
+   * first. The 30-second default mirrors a typical daemon shutdown budget;
+   * callers are free to override for tests or tighter environments.
+   */
+  async drain(timeoutMs = DEFAULT_DRAIN_TIMEOUT_MS) {
+    if (this.runs.size === 0) return { settled: true, remaining: 0 };
+    const snapshot = Array.from(this.runs);
+    let timer;
+    const timeoutPromise = new Promise((resolve3) => {
+      timer = setTimeout(() => resolve3("timeout"), timeoutMs);
+    });
+    const allSettled = Promise.allSettled(snapshot).then(() => "settled");
+    try {
+      const outcome = await Promise.race([allSettled, timeoutPromise]);
+      return { settled: outcome === "settled", remaining: this.runs.size };
+    } finally {
+      if (timer !== void 0) clearTimeout(timer);
+    }
+  }
+};
+
 // src/daemon/jobs/session-maintenance.ts
 function completeStaleActiveSessions(thresholdSeconds = STALE_SESSION_THRESHOLD_MS / MS_PER_SECOND) {
   const db = getDatabase();
@@ -7500,8 +9120,8 @@ function registerPowerJobs(powerManager, deps) {
 }
 
 // src/daemon/reconciliation.ts
-import fs20 from "fs";
-import path19 from "path";
+import fs21 from "fs";
+import path21 from "path";
 
 // src/daemon/event-handlers.ts
 var TOOL_INPUT_STORE_LIMIT = 4e3;
@@ -7670,10 +9290,10 @@ function createReconciler({ bufferDir, logger }) {
   function reconcileSession(sessionId) {
     if (reconciledSessions.has(sessionId)) return;
     reconciledSessions.add(sessionId);
-    const bufferPath = path19.join(bufferDir, `${sessionId}.jsonl`);
+    const bufferPath = path21.join(bufferDir, `${sessionId}.jsonl`);
     let content;
     try {
-      content = fs20.readFileSync(bufferPath, "utf-8").trim();
+      content = fs21.readFileSync(bufferPath, "utf-8").trim();
     } catch {
       return;
     }
@@ -7742,7 +9362,19 @@ function createReconciler({ bufferDir, logger }) {
 }
 
 // src/daemon/stop-processing.ts
-import fs21 from "fs";
+import fs22 from "fs";
+import path22 from "path";
+
+// src/daemon/capture-gating.ts
+function gateEventByCaptureRules(event, options) {
+  const transcriptMeta = event.transcriptPath ? readTranscriptMeta(event.transcriptPath) ?? void 0 : void 0;
+  const manifests = options?.manifests ?? loadManifests();
+  const decision = evaluateSessionCaptureRules(manifests, event.agent, {
+    transcriptPath: event.transcriptPath,
+    transcriptMeta
+  });
+  return { decision, hadTranscriptMeta: transcriptMeta !== void 0 };
+}
 
 // src/daemon/capture-images.ts
 var SESSION_SHORT_LEN = 6;
@@ -7779,80 +9411,8 @@ function captureBatchImages(input) {
   }
 }
 
-// src/daemon/plan-capture.ts
-import { createHash as createHash4 } from "crypto";
-import os8 from "os";
-import path20 from "path";
-function extractTaggedPlans(text, tags) {
-  const results = [];
-  for (const tag of tags) {
-    const regex = new RegExp(`<${tag}>\\n?([\\s\\S]*?)\\n?</${tag}>`, "g");
-    let match;
-    while ((match = regex.exec(text)) !== null) {
-      const content = match[1].trim();
-      if (content) results.push({ tag, content });
-    }
-  }
-  return results;
-}
-var TRANSCRIPT_SOURCE_PREFIX = "transcript:";
-var FILE_WRITE_TOOLS = /* @__PURE__ */ new Set([
-  "Write",
-  "Edit",
-  "Create",
-  "write",
-  "edit",
-  "patch",
-  "create"
-]);
-var HEADING_REGEX = /^#\s+(.+)$/m;
-var PLAN_ID_HASH_LENGTH = 16;
-function isInPlanDirectory(filePath, watchDirs, projectRoot) {
-  const abs = path20.isAbsolute(filePath) ? filePath : path20.resolve(projectRoot, filePath);
-  return watchDirs.some((dir) => {
-    const expanded = dir.startsWith("~/") ? path20.join(os8.homedir(), dir.slice(2)) : dir;
-    const absDir = path20.isAbsolute(expanded) ? expanded : path20.resolve(projectRoot, expanded);
-    const prefix = absDir.endsWith(path20.sep) ? absDir : absDir + path20.sep;
-    return abs === absDir || abs.startsWith(prefix);
-  });
-}
-function isPlanWriteEvent(toolName, toolInput, config) {
-  if (!FILE_WRITE_TOOLS.has(toolName)) return null;
-  const filePath = toolInput?.file_path ?? toolInput?.path ?? toolInput?.filePath;
-  if (typeof filePath !== "string") return null;
-  if (!isInPlanDirectory(filePath, config.watchDirs, config.projectRoot)) return null;
-  if (config.extensions?.length) {
-    const ext = path20.extname(filePath).toLowerCase();
-    if (!config.extensions.includes(ext)) return null;
-  }
-  return filePath;
-}
-function parsePlanTitle(content, filename) {
-  const match = HEADING_REGEX.exec(content);
-  if (match) return match[1].trim();
-  return filename ?? null;
-}
-function capturePlan(input) {
-  const now = Math.floor(Date.now() / 1e3);
-  const contentHash = createHash4(CONTENT_HASH_ALGORITHM).update(input.content).digest("hex");
-  const id = createHash4("md5").update(input.sourcePath).digest("hex").slice(0, PLAN_ID_HASH_LENGTH);
-  const title = parsePlanTitle(input.content, path20.basename(input.sourcePath));
-  return upsertPlan({
-    id,
-    title,
-    content: input.content,
-    source_path: input.sourcePath,
-    session_id: input.sessionId,
-    prompt_batch_id: input.promptBatchId ?? null,
-    content_hash: contentHash,
-    status: "active",
-    created_at: now,
-    updated_at: now
-  });
-}
-
 // src/daemon/skill-usage.ts
-import crypto from "crypto";
+import crypto2 from "crypto";
 var SKILL_USAGE_DETECTION_ENABLED = false;
 var MAX_ACTIVE_SKILLS_CHECK = 1e3;
 function detectSkillUsage(sessionId, transcriptContent) {
@@ -7872,7 +9432,7 @@ function detectSkillUsage(sessionId, transcriptContent) {
       if (!pattern.test(transcriptContent)) continue;
       if (hasUsageForSkillAndSession(skill.id, sessionId)) continue;
       insertSkillUsage({
-        id: crypto.randomUUID(),
+        id: crypto2.randomUUID(),
         skill_id: skill.id,
         session_id: sessionId,
         detected_at: now
@@ -7887,6 +9447,46 @@ function escapeRegex(s) {
 }
 
 // src/daemon/stop-processing.ts
+var MILLISECONDS_PER_SECOND = 1e3;
+function isEligiblePlanExtension(filePath, extensions) {
+  if (!extensions || extensions.length === 0) return true;
+  const extension = path22.extname(filePath).toLowerCase();
+  return extensions.includes(extension);
+}
+function collectPlanFiles(rootDir, extensions) {
+  const files = [];
+  const stack = [rootDir];
+  while (stack.length > 0) {
+    const currentDir = stack.pop();
+    if (!currentDir) continue;
+    let entries;
+    try {
+      entries = fs22.readdirSync(currentDir, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const entry of entries) {
+      const absolutePath = path22.join(currentDir, entry.name);
+      if (entry.isDirectory()) {
+        stack.push(absolutePath);
+        continue;
+      }
+      if (entry.isFile() && isEligiblePlanExtension(absolutePath, extensions)) {
+        files.push(absolutePath);
+      }
+    }
+  }
+  return files;
+}
+function resolvePromptBatchIdForPlanWrite(batches, modifiedAtSeconds) {
+  for (let index = batches.length - 1; index >= 0; index--) {
+    const startedAt = batches[index].started_at;
+    if (startedAt !== null && startedAt <= modifiedAtSeconds) {
+      return batches[index].id;
+    }
+  }
+  return void 0;
+}
 function enrichTurnsWithToolMetadata(turns, events) {
   if (events.length === 0 || turns.length === 0) return;
   const toolEvents = events.filter((e) => e.type === "tool_use");
@@ -7914,7 +9514,7 @@ function enrichTurnsWithToolMetadata(turns, events) {
   }
 }
 function createStopProcessor(deps) {
-  const { registry, sessionBuffers, transcriptMiner, embeddingManager, logger, liveConfig, vaultDir } = deps;
+  const { registry, sessionBuffers, transcriptMiner, embeddingManager, logger, liveConfig, vaultDir, planWatchConfig } = deps;
   let activeStopProcessing = null;
   const sessionTitleCache = /* @__PURE__ */ new Map();
   const StopBody = external_exports.object({
@@ -8016,7 +9616,7 @@ function createStopProcessor(deps) {
         let transcriptText = null;
         if (hookTranscriptPath) {
           try {
-            transcriptText = fs21.readFileSync(hookTranscriptPath, "utf-8");
+            transcriptText = fs22.readFileSync(hookTranscriptPath, "utf-8");
           } catch {
           }
         }
@@ -8048,11 +9648,12 @@ function createStopProcessor(deps) {
         const taggedPlans = extractTaggedPlans(turn.aiResponse, deps.planTags);
         for (const { tag, content } of taggedPlans) {
           try {
-            capturePlan({
-              sourcePath: `${TRANSCRIPT_SOURCE_PREFIX}${tag}`,
+            captureTaggedPlan({
+              tag,
               content,
               sessionId,
-              promptBatchId: latestBatch?.id ?? null
+              promptBatchId: latestBatch?.id ?? null,
+              logger
             });
             logger.info(LOG_KINDS.CAPTURE_PLAN, "Plan captured from transcript tag", {
               session_id: sessionId,
@@ -8069,6 +9670,50 @@ function createStopProcessor(deps) {
         }
       }
     }
+    const sessionStartedAt = currentSession?.started_at ?? (sessionMeta?.started_at ? Math.floor(new Date(sessionMeta.started_at).getTime() / MILLISECONDS_PER_SECOND) : epochSeconds());
+    const sessionStopMs = Date.now();
+    const sessionBatches = listBatchesBySession(sessionId);
+    for (const watchDir of planWatchConfig.watchDirs) {
+      const absoluteWatchDir = resolvePlanWatchDir(watchDir, planWatchConfig.projectRoot);
+      if (!fs22.existsSync(absoluteWatchDir)) continue;
+      const planFiles = collectPlanFiles(absoluteWatchDir, planWatchConfig.extensions);
+      for (const planFile of planFiles) {
+        let stats;
+        try {
+          stats = fs22.statSync(planFile);
+        } catch {
+          continue;
+        }
+        if (stats.mtimeMs < sessionStartedAt * MILLISECONDS_PER_SECOND || stats.mtimeMs > sessionStopMs) {
+          continue;
+        }
+        try {
+          const content = fs22.readFileSync(planFile, "utf-8");
+          const promptBatchId = resolvePromptBatchIdForPlanWrite(
+            sessionBatches,
+            Math.floor(stats.mtimeMs / MILLISECONDS_PER_SECOND)
+          );
+          capturePlan({
+            sourcePath: planFile,
+            projectRoot: planWatchConfig.projectRoot,
+            content,
+            sessionId,
+            promptBatchId,
+            logger
+          });
+          logger.info(LOG_KINDS.CAPTURE_PLAN, "Plan reconciled from configured plan dir", {
+            session_id: sessionId,
+            source_path: planFile
+          });
+        } catch (err) {
+          logger.warn(LOG_KINDS.CAPTURE_PLAN, "Failed to reconcile plan from configured plan dir", {
+            session_id: sessionId,
+            source_path: planFile,
+            error: err.message
+          });
+        }
+      }
+    }
     if (!hasTitle) {
       triggerTitleSummary2(sessionId);
     }
@@ -8115,12 +9760,11 @@ function createStopProcessor(deps) {
       last_assistant_message: lastAssistantMessage
     } = StopBody.parse(req.body);
     if (hookTranscriptPath) {
-      const transcriptMeta = readTranscriptMeta(hookTranscriptPath) ?? void 0;
       const detectedAgent = agent ?? getSession(sessionId)?.agent ?? "claude-code";
-      const decision = evaluateSessionCaptureRules(loadManifests(), detectedAgent, {
-        transcriptPath: hookTranscriptPath,
-        transcriptMeta
-      });
+      const { decision } = gateEventByCaptureRules(
+        { agent: detectedAgent, transcriptPath: hookTranscriptPath },
+        { manifests: loadManifests() }
+      );
       if (decision.action === "drop") {
         const deleted = cleanupInvalidCapturedSession(sessionId);
         logger.info(LOG_KINDS.HOOKS_STOP, "Stop ignored \u2014 invalid captured session", {
@@ -8175,9 +9819,10 @@ function createStopProcessor(deps) {
 }
 
 // src/daemon/event-dispatch.ts
-import fs22 from "fs";
-import path21 from "path";
+import fs23 from "fs";
+import path23 from "path";
 var EventBody = external_exports.object({ type: external_exports.string(), session_id: external_exports.string() }).passthrough();
+var DROP_DECISION_CACHE_MAX = 1024;
 function createEventDispatcher(deps) {
   const {
     registry,
@@ -8192,6 +9837,39 @@ function createEventDispatcher(deps) {
     triggerTitleSummary: triggerTitleSummary2
   } = deps;
   const projectRoot = process.cwd();
+  const manifests = loadManifests();
+  const planTagsByAgent = new Map(
+    manifests.map((manifest) => [manifest.name, manifest.capture?.planTags ?? []])
+  );
+  const droppedSessions = /* @__PURE__ */ new Map();
+  function rememberDropped(sessionId, reason, hadTranscriptMeta) {
+    if (droppedSessions.size >= DROP_DECISION_CACHE_MAX) {
+      const oldest = droppedSessions.keys().next().value;
+      if (oldest !== void 0) droppedSessions.delete(oldest);
+    }
+    droppedSessions.set(sessionId, { reason, hadTranscriptMeta });
+  }
+  function evaluateAutoRegistration(event) {
+    const transcriptPath = typeof event.transcript_path === "string" && event.transcript_path.length > 0 ? event.transcript_path : void 0;
+    const detectedAgent = typeof event.agent === "string" ? event.agent : DEFAULT_SYMBIONT_NAME;
+    try {
+      return gateEventByCaptureRules(
+        { agent: detectedAgent, transcriptPath },
+        { manifests }
+      );
+    } catch (err) {
+      logger.error(LOG_KINDS.LIFECYCLE_AUTO_REGISTER, "Capture-rules evaluator threw", {
+        error: String(err),
+        session_id: typeof event.session_id === "string" ? event.session_id : void 0,
+        agent: detectedAgent
+      });
+      return { decision: { action: "pass" }, hadTranscriptMeta: false };
+    }
+  }
+  function getPlanTagsForAgent(agent) {
+    const agentName = typeof agent === "string" && agent.length > 0 ? agent : DEFAULT_SYMBIONT_NAME;
+    return planTagsByAgent.get(agentName) ?? [];
+  }
   return async (req) => {
     const validated = EventBody.parse(req.body);
     const event = {
@@ -8200,13 +9878,38 @@ function createEventDispatcher(deps) {
     };
     logger.debug(LOG_KINDS.HOOKS_EVENT, "Event received", { type: event.type, session_id: event.session_id });
     if (!registry.getSession(event.session_id)) {
+      const cached = droppedSessions.get(event.session_id);
+      const hasTranscriptNow = typeof event.transcript_path === "string" && event.transcript_path.length > 0;
+      const shouldReevaluate = cached && !cached.hadTranscriptMeta && hasTranscriptNow;
+      if (cached && !shouldReevaluate) {
+        const reason = cached.reason ?? "rule";
+        logger.debug(LOG_KINDS.LIFECYCLE_AUTO_REGISTER, "Ignored event for previously-dropped session", {
+          session_id: event.session_id,
+          type: event.type,
+          reason
+        });
+        return { body: { ok: true, ignored: reason } };
+      }
+      if (shouldReevaluate) {
+        droppedSessions.delete(event.session_id);
+      }
+      const { decision, hadTranscriptMeta } = evaluateAutoRegistration(event);
+      if (decision.action === "drop") {
+        rememberDropped(event.session_id, decision.reason, hadTranscriptMeta);
+        logger.info(LOG_KINDS.LIFECYCLE_AUTO_REGISTER, "Ignored event that failed session capture rules", {
+          session_id: event.session_id,
+          type: event.type,
+          reason: decision.reason ?? "rule"
+        });
+        return { body: { ok: true, ignored: decision.reason ?? "rule" } };
+      }
       registry.register(event.session_id, { started_at: event.timestamp });
       logger.debug(LOG_KINDS.LIFECYCLE_AUTO_REGISTER, "Auto-registered session from event", { session_id: event.session_id });
       const now = epochSeconds();
       const startedEpoch = Math.floor(new Date(event.timestamp).getTime() / 1e3);
       upsertSession({
         id: event.session_id,
-        agent: event.agent ?? "claude-code",
+        agent: event.agent ?? DEFAULT_SYMBIONT_NAME,
         status: "active",
         started_at: startedEpoch,
         created_at: now,
@@ -8215,7 +9918,7 @@ function createEventDispatcher(deps) {
       reconcileSession(event.session_id);
     }
     if (!sessionBuffers.has(event.session_id)) {
-      const bufferDir = path21.join(vaultDir, "buffer");
+      const bufferDir = path23.join(vaultDir, "buffer");
       sessionBuffers.set(event.session_id, new EventBuffer(bufferDir, event.session_id));
     }
     sessionBuffers.get(event.session_id).append(event);
@@ -8241,6 +9944,29 @@ function createEventDispatcher(deps) {
         try {
           const { batchId, promptNumber } = handleUserPrompt(event.session_id, promptText || void 0);
           logger.debug(LOG_KINDS.CAPTURE_BATCH, "Batch opened", { session_id: event.session_id, batch_id: batchId, prompt_number: promptNumber });
+          const taggedPlans = extractTaggedPlans(promptText, getPlanTagsForAgent(event.agent));
+          for (const { tag, content } of taggedPlans) {
+            try {
+              captureTaggedPlan({
+                tag,
+                content,
+                sessionId: event.session_id,
+                promptBatchId: batchId,
+                logger
+              });
+              logger.info(LOG_KINDS.CAPTURE_PLAN, "Plan captured from prompt tag", {
+                session_id: event.session_id,
+                tag,
+                content_length: content.length
+              });
+            } catch (err) {
+              logger.warn(LOG_KINDS.CAPTURE_PLAN, "Failed to capture plan from prompt tag", {
+                session_id: event.session_id,
+                tag,
+                error: err.message
+              });
+            }
+          }
           const eventImages = event.images;
           if (Array.isArray(eventImages) && eventImages.length > 0) {
             captureBatchImages({
@@ -8274,13 +10000,15 @@ function createEventDispatcher(deps) {
       );
       if (planFilePath) {
         const captureSessionId = event.session_id;
-        fs22.promises.readFile(planFilePath, "utf-8").then((planContent) => {
+        fs23.promises.readFile(planFilePath, "utf-8").then((planContent) => {
           const latestBatch = getLatestBatch(captureSessionId);
           capturePlan({
-            sourcePath: path21.relative(projectRoot, planFilePath),
+            sourcePath: planFilePath,
+            projectRoot,
             content: planContent,
             sessionId: captureSessionId,
-            promptBatchId: latestBatch?.id ?? null
+            promptBatchId: latestBatch?.id ?? null,
+            logger
           });
           logger.info(LOG_KINDS.CAPTURE_PLAN, "Plan captured", {
             session_id: captureSessionId,
@@ -8440,8 +10168,8 @@ function createConfigReactionRegistry(logger) {
 function shouldFire(registeredPaths, touched) {
   if (registeredPaths.length === 0) return true;
   for (const prefix of registeredPaths) {
-    for (const path23 of touched) {
-      if (path23 === prefix || path23.startsWith(`${prefix}.`)) return true;
+    for (const path25 of touched) {
+      if (path25 === prefix || path25.startsWith(`${prefix}.`)) return true;
     }
   }
   return false;
@@ -8475,13 +10203,13 @@ function createPlanWatchReaction(deps) {
 }
 
 // src/daemon/main.ts
-import fs23 from "fs";
-import path22 from "path";
+import fs24 from "fs";
+import path24 from "path";
 function killStaleDaemon(vaultDir, logger) {
-  const daemonJsonPath = path22.join(vaultDir, "daemon.json");
+  const daemonJsonPath = path24.join(vaultDir, "daemon.json");
   try {
-    if (!fs23.existsSync(daemonJsonPath)) return;
-    const info = JSON.parse(fs23.readFileSync(daemonJsonPath, "utf-8"));
+    if (!fs24.existsSync(daemonJsonPath)) return;
+    const info = JSON.parse(fs24.readFileSync(daemonJsonPath, "utf-8"));
     if (!info.pid) return;
     if (info.pid === process.pid) return;
     try {
@@ -8490,7 +10218,7 @@ function killStaleDaemon(vaultDir, logger) {
       logger.info(LOG_KINDS.DAEMON_START, "Killed stale daemon", { pid: info.pid });
     } catch {
     }
-    fs23.unlinkSync(daemonJsonPath);
+    fs24.unlinkSync(daemonJsonPath);
   } catch {
   }
 }
@@ -8500,7 +10228,7 @@ async function main() {
     process.stderr.write("Usage: mycod --vault <path>\n");
     process.exit(1);
   }
-  const vaultDir = path22.resolve(vaultArg);
+  const vaultDir = path24.resolve(vaultArg);
   loadSecrets(vaultDir);
   const config = loadMergedConfig(vaultDir);
   const liveConfig = { current: config };
@@ -8513,7 +10241,7 @@ async function main() {
     projectRoot,
     extensions: config.capture.artifact_extensions
   };
-  const logger = new DaemonLogger(path22.join(vaultDir, "logs"), {
+  const logger = new DaemonLogger(path24.join(vaultDir, "logs"), {
     level: config.daemon.log_level
   });
   if (config.daemon.log_level === "debug") {
@@ -8542,7 +10270,7 @@ async function main() {
   const devCliEntry = detectDevBuild(
     globalPrefix,
     process.argv[1],
-    fs23.realpathSync
+    fs24.realpathSync
   );
   if (devCliEntry) {
     setDevBuildCliEntry(devCliEntry);
@@ -8554,13 +10282,19 @@ async function main() {
   const db = initDatabase(vaultDbPath(vaultDir));
   createSchema(db, machineId);
   registerBuiltinDomains();
+  const interruptedRuns = markRunningRunsInterrupted("Daemon restarted before the run completed");
+  if (interruptedRuns > 0) {
+    logger.warn(LOG_KINDS.AGENT_RUN, "Marked stale running runs as resumable after daemon restart", {
+      count: interruptedRuns
+    });
+  }
   logger.info(LOG_KINDS.DAEMON_START, "SQLite initialized", { vault: vaultDir });
   {
-    const reasonPath = path22.join(vaultDir, RESTART_REASON_FILENAME);
+    const reasonPath = path24.join(vaultDir, RESTART_REASON_FILENAME);
     try {
-      if (fs23.existsSync(reasonPath)) {
-        const raw = JSON.parse(fs23.readFileSync(reasonPath, "utf-8"));
-        fs23.unlinkSync(reasonPath);
+      if (fs24.existsSync(reasonPath)) {
+        const raw = JSON.parse(fs24.readFileSync(reasonPath, "utf-8"));
+        fs24.unlinkSync(reasonPath);
         if (raw.reason === "version_sync" && raw.to_version) {
           const message = raw.local_update_ran ? "Restarted and updated local project hooks." : "Restarted to pick up the latest version.";
           notify(vaultDir, {
@@ -8602,13 +10336,13 @@ async function main() {
   });
   const lastLogTimestamp = getMaxTimestamp();
   if (lastLogTimestamp) {
-    const logDir = path22.join(vaultDir, "logs");
+    const logDir = path24.join(vaultDir, "logs");
     const replayedCount = reconcileLogBuffer(logDir, lastLogTimestamp);
     if (replayedCount > 0) {
       logger.info(LOG_KINDS.DAEMON_RECONCILE, `Replayed ${replayedCount} log entries from buffer`, { replayed: replayedCount });
     }
   }
-  const vectorsDbPath = path22.join(vaultDir, "vectors.db");
+  const vectorsDbPath = path24.join(vaultDir, "vectors.db");
   const vectorStore = new SqliteVecVectorStore(vectorsDbPath);
   const llmProvider = createEmbeddingProvider(config.embedding);
   const embeddingProvider = new EmbeddingProviderAdapter(llmProvider, config.embedding);
@@ -8618,7 +10352,7 @@ async function main() {
   const databaseManager = new DatabaseMaintenanceManager(vaultDbPath(vaultDir), vaultDir, logger);
   let definitionsDir;
   try {
-    const { registerBuiltInAgentsAndTasks, resolveDefinitionsDir: resolveDefinitionsDir2 } = await import("./loader-TSB5M7FD.js");
+    const { registerBuiltInAgentsAndTasks, resolveDefinitionsDir: resolveDefinitionsDir2 } = await import("./loader-NAVVZK63.js");
     definitionsDir = resolveDefinitionsDir2();
     await registerBuiltInAgentsAndTasks(definitionsDir, vaultDir);
     logger.info(LOG_KINDS.AGENT_TASK, "Built-in agents and tasks registered");
@@ -8655,10 +10389,10 @@ async function main() {
   }
   let uiDir = null;
   {
-    const root = findPackageRoot(path22.dirname(new URL(import.meta.url).pathname));
+    const root = findPackageRoot(path24.dirname(new URL(import.meta.url).pathname));
     if (root) {
-      const candidate = path22.join(root, "dist", "ui");
-      if (fs23.existsSync(candidate)) uiDir = candidate;
+      const candidate = path24.join(root, "dist", "ui");
+      if (fs24.existsSync(candidate)) uiDir = candidate;
     }
   }
   if (uiDir) {
@@ -8672,6 +10406,7 @@ async function main() {
     sleepIntervalMs: POWER_SLEEP_INTERVAL_MS,
     logger
   });
+  const inflightRuns = new InflightRunRegistry();
   const server = new DaemonServer({
     vaultDir,
     logger,
@@ -8691,7 +10426,7 @@ async function main() {
       (p) => createPerProjectAdapter(p, claudeCodeAdapter.parseTurns)
     )
   });
-  const bufferDir = path22.join(vaultDir, "buffer");
+  const bufferDir = path24.join(vaultDir, "buffer");
   const sessionBuffers = /* @__PURE__ */ new Map();
   const reconciler = createReconciler({ bufferDir, logger });
   reconciler.runStartupReconciliation();
@@ -8703,7 +10438,8 @@ async function main() {
     logger,
     liveConfig,
     vaultDir,
-    planTags: symbiontPlanTags
+    planTags: symbiontPlanTags,
+    planWatchConfig
   });
   const sessionLifecycle = createSessionLifecycleHandlers({
     registry,
@@ -8733,14 +10469,32 @@ async function main() {
   });
   server.registerRoute("POST", "/events", eventDispatcher);
   server.registerRoute("POST", "/events/stop", stopProcessor.handleStopRoute);
-  const contextDeps = { embeddingManager, liveConfig, logger };
+  let teamSync;
+  const contextDeps = {
+    vaultDir,
+    embeddingManager,
+    liveConfig,
+    logger,
+    getTeamClient: () => teamSync.getTeamClient()
+  };
   server.registerRoute("POST", "/context", createSessionContextHandler(contextDeps));
   server.registerRoute("POST", "/context/resume", createResumeContextHandler(contextDeps));
   server.registerRoute("POST", "/context/prompt", createPromptContextHandler(contextDeps));
   const progressTracker = new ProgressTracker();
   let configHash = computeConfigHash(vaultDir);
+  const cortexHandlers = createCortexHandlers(vaultDir, {
+    liveConfig,
+    embeddingManager,
+    logger,
+    getTeamClient: () => teamSync.getTeamClient(),
+    registerInflightRun: (p) => inflightRuns.register(p)
+  });
   server.registerRoute("GET", "/api/config", async () => handleGetConfig(vaultDir));
   server.registerRoute("GET", "/api/symbionts", async () => handleListSymbionts(vaultDir));
+  server.registerRoute("GET", "/api/cortex/instructions", cortexHandlers.handleGetInstructions);
+  server.registerRoute("POST", "/api/cortex/instructions/refresh", cortexHandlers.handleRefreshInstructions);
+  server.registerRoute("POST", "/api/cortex/prompt-builder", cortexHandlers.handleBuildPrompt);
+  server.registerRoute("GET", "/api/cortex/prompt-builder/:runId", cortexHandlers.handleGetPromptResult);
   server.registerRoute("GET", "/api/config/merged", async () => handleGetMergedConfig(vaultDir));
   server.registerRoute("GET", "/api/config/local", async () => handleGetLocalConfig(vaultDir));
   const symbiontPlanDirsByAgent = {};
@@ -8756,7 +10510,7 @@ async function main() {
     liveConfig.current = ctx;
   });
   reactions.on(["capture", "symbionts"], (ctx) => {
-    reconcileConfiguredSymbionts(path22.dirname(vaultDir), vaultDir, ctx);
+    reconcileConfiguredSymbionts(path24.dirname(vaultDir), vaultDir, ctx);
   });
   reactions.on(["capture"], createPlanWatchReaction({
     symbiontPlanDirs,
@@ -8771,7 +10525,14 @@ async function main() {
     }
   });
   async function syncScheduledTasks() {
-    await registerScheduledTasks(powerManager, { definitionsDir, vaultDir, embeddingManager, logger, liveConfig });
+    await registerScheduledTasks(powerManager, {
+      definitionsDir,
+      vaultDir,
+      embeddingManager,
+      logger,
+      liveConfig,
+      getTeamClient: () => teamSync.getTeamClient()
+    });
   }
   reactions.on(["agent.tasks"], async () => {
     await syncScheduledTasks();
@@ -8825,7 +10586,7 @@ async function main() {
   server.registerRoute("POST", "/api/log", createLogIngestionHandler(logger));
   server.registerRoute("GET", "/api/models", async (req) => handleGetModels(req));
   server.registerRoute("POST", "/api/restart", async (req) => handleRestart({ vaultDir, progressTracker }, req.body));
-  const updateProjectRoot = path22.dirname(vaultDir);
+  const updateProjectRoot = path24.dirname(vaultDir);
   const updateHandlers = createUpdateHandlers({
     vaultDir,
     projectRoot: updateProjectRoot,
@@ -8848,6 +10609,7 @@ async function main() {
   server.registerRoute("GET", "/api/sessions/:id/impact", sessionMutations.handleGetSessionImpact);
   server.registerRoute("POST", "/api/sessions/:id/complete", sessionMutations.handleCompleteSession);
   server.registerRoute("DELETE", "/api/sessions/:id", sessionMutations.handleDeleteSession);
+  server.registerRoute("DELETE", "/api/plans/:id", sessionMutations.handleDeletePlan);
   server.registerRoute("GET", "/api/sessions/:id/batches", handleGetSessionBatches);
   server.registerRoute("GET", "/api/batches/:id/activities", handleGetBatchActivities);
   server.registerRoute("GET", "/api/sessions/:id/attachments", handleGetSessionAttachments);
@@ -8868,12 +10630,27 @@ async function main() {
   server.registerRoute("GET", "/api/digest", handleGetDigest);
   const attachments = createAttachmentHandler({ vaultDir });
   server.registerRoute("GET", "/api/attachments/:filename", attachments.handleGetAttachment);
-  const agentRunHandlers = createAgentRunHandlers({ vaultDir, embeddingManager, logger });
+  const agentRunHandlers = createAgentRunHandlers({
+    vaultDir,
+    embeddingManager,
+    logger,
+    getTeamClient: () => teamSync.getTeamClient()
+  });
   server.registerRoute("POST", "/api/agent/run", agentRunHandlers.handleRun);
   server.registerRoute("GET", "/api/agent/runs", agentRunHandlers.handleListRuns);
   server.registerRoute("GET", "/api/agent/runs/:id", agentRunHandlers.handleGetRun);
+  server.registerRoute("POST", "/api/agent/runs/:id/resume", agentRunHandlers.handleResumeRun);
   server.registerRoute("GET", "/api/agent/runs/:id/reports", agentRunHandlers.handleGetRunReports);
   server.registerRoute("GET", "/api/agent/runs/:id/turns", agentRunHandlers.handleGetRunTurns);
+  server.registerRoute("GET", "/api/agent/runs/:id/write-intents", agentRunHandlers.handleGetRunWriteIntents);
+  server.registerRoute("GET", "/api/agent/runs/:id/audit", agentRunHandlers.handleGetRunAudit);
+  const agentEvalHandlers = createAgentEvaluationHandlers({ vaultDir, embeddingManager, logger });
+  server.registerRoute("POST", "/api/agent/evaluations", agentEvalHandlers.handleCreate);
+  server.registerRoute("GET", "/api/agent/evaluations", agentEvalHandlers.handleList);
+  server.registerRoute("GET", "/api/agent/evaluations/:id", agentEvalHandlers.handleGet);
+  const digestRevisionHandlers = createDigestRevisionHandlers({ vaultDir, logger });
+  server.registerRoute("GET", "/api/digest/revisions", digestRevisionHandlers.handleList);
+  server.registerRoute("POST", "/api/digest/revisions/:id/restore", digestRevisionHandlers.handleRestore);
   server.registerRoute("GET", "/api/agent/tasks", async (req) => handleListTasks(req, vaultDir));
   server.registerRoute("GET", "/api/agent/tasks/:id", async (req) => handleGetTask(req, vaultDir));
   server.registerRoute("GET", "/api/agent/tasks/:id/yaml", async (req) => handleGetTaskYaml(req, vaultDir));
@@ -8915,11 +10692,15 @@ async function main() {
   });
   server.registerRoute("GET", "/api/providers", async () => handleGetProviders());
   server.registerRoute("POST", "/api/providers/test", async (req) => handleTestProvider(req));
-  const mcpProxy = createMcpProxyHandlers({ machineId, embeddingManager });
+  server.registerRoute("GET", "/api/providers/secrets", async () => handleGetProviderSecrets(vaultDir));
+  server.registerRoute("PUT", "/api/providers/secrets/:provider", async (req) => handlePutProviderSecret(vaultDir, req));
+  server.registerRoute("DELETE", "/api/providers/secrets/:provider", async (req) => handleDeleteProviderSecret(vaultDir, req));
+  const mcpProxy = createMcpProxyHandlers({ machineId, embeddingManager, projectRoot, logger });
   server.registerRoute("POST", "/api/mcp/remember", mcpProxy.handleRemember);
   server.registerRoute("POST", "/api/mcp/supersede", mcpProxy.handleSupersede);
   server.registerRoute("POST", "/api/mcp/consolidate", mcpProxy.handleConsolidate);
   server.registerRoute("GET", "/api/mcp/plans", mcpProxy.handlePlans);
+  server.registerRoute("POST", "/api/mcp/plans", mcpProxy.handleSavePlan);
   server.registerRoute("GET", "/api/mcp/sessions", mcpProxy.handleSessions);
   server.registerRoute("GET", "/api/mcp/team", mcpProxy.handleTeam);
   const backupHandlers = createBackupHandlers({ db, machineId, vaultDir, liveConfig });
@@ -8936,7 +10717,7 @@ async function main() {
     }
     return result;
   });
-  const teamSync = initTeamSync({ liveConfig, machineId, logger, vaultDir, serverVersion: server.version });
+  teamSync = initTeamSync({ liveConfig, machineId, logger, vaultDir, serverVersion: server.version });
   reactions.on(["team"], async () => {
     await teamSync.reconcileClient();
   });
@@ -8945,7 +10726,7 @@ async function main() {
     vaultDir,
     machineId,
     logger,
-    getTeamClient: teamSync.getTeamClient,
+    getTeamClient: () => teamSync.getTeamClient(),
     setTeamClient: teamSync.setTeamClient
   });
   server.registerRoute("POST", "/api/team/connect", async (req) => {
@@ -8968,14 +10749,14 @@ async function main() {
   server.registerRoute("POST", "/api/team/upgrade-worker", teamHandlers.handleUpgradeWorker);
   server.registerRoute("POST", "/api/team/rotate-mcp-token", teamHandlers.handleRotateMcpToken);
   const collectiveHandlers = createCollectiveHandlers({
-    getTeamClient: teamSync.getTeamClient
+    getTeamClient: () => teamSync.getTeamClient()
   });
   server.registerRoute("GET", "/api/collective/status", collectiveHandlers.handleStatus);
   server.registerRoute("GET", "/api/collective/search", collectiveHandlers.handleSearch);
   server.registerRoute("GET", "/api/collective/projects", collectiveHandlers.handleProjects);
   server.registerRoute("GET", "/api/collective/project", collectiveHandlers.handleProject);
   server.registerRoute("GET", "/api/collective/settings", collectiveHandlers.handleSettings);
-  server.registerRoute("GET", "/api/search", createSearchHandler({ embeddingManager, getTeamClient: teamSync.getTeamClient, machineId }));
+  server.registerRoute("GET", "/api/search", createSearchHandler({ embeddingManager, getTeamClient: () => teamSync.getTeamClient(), machineId }));
   server.registerRoute("GET", "/api/activity", handleGetFeed);
   server.registerRoute("GET", "/api/embedding/status", async () => handleGetEmbeddingStatus(vaultDir));
   server.registerRoute("GET", "/api/embedding/details", async () => handleEmbeddingDetails(embeddingManager));
@@ -9013,9 +10794,25 @@ async function main() {
       logger.warn(LOG_KINDS.DAEMON_CONFIG, "Failed to persist auto-derived port", { error: err.message });
     }
   }
-  registerPowerJobs(powerManager, { embeddingManager, registry, logger, liveConfig, db, machineId, vaultDir, databaseManager });
+  registerPowerJobs(powerManager, {
+    embeddingManager,
+    registry,
+    logger,
+    liveConfig,
+    db,
+    machineId,
+    vaultDir,
+    databaseManager
+  });
   teamSync.registerFlushJob(powerManager);
-  await registerScheduledTasks(powerManager, { definitionsDir, vaultDir, embeddingManager, logger, liveConfig });
+  await registerScheduledTasks(powerManager, {
+    definitionsDir,
+    vaultDir,
+    embeddingManager,
+    logger,
+    liveConfig,
+    getTeamClient: () => teamSync.getTeamClient()
+  });
   powerManager.start();
   const shutdown = async (signal) => {
     logger.info(LOG_KINDS.DAEMON_START, `${signal} received`);
@@ -9025,6 +10822,17 @@ async function main() {
       logger.info(LOG_KINDS.DAEMON_START, "Waiting for active stop processing to complete...");
       await activeStopProcessing;
     }
+    if (inflightRuns.size > 0) {
+      logger.info(LOG_KINDS.DAEMON_START, "Draining in-flight agent runs before shutdown...", {
+        inflight_count: inflightRuns.size
+      });
+      const outcome = await inflightRuns.drain();
+      if (!outcome.settled) {
+        logger.warn(LOG_KINDS.DAEMON_START, "Some in-flight runs did not settle before shutdown timeout", {
+          remaining: outcome.remaining
+        });
+      }
+    }
     registry.destroy();
     await server.stop();
     vectorStore.close();
@@ -9047,4 +10855,4 @@ export {
   handleUserPrompt,
   main
 };
-//# sourceMappingURL=main-E7HU4QYR.js.map
+//# sourceMappingURL=main-5PRQNEEE.js.map