@hasna/instructions 0.4.42 → 0.5.0

package/dist/index.js

@@ -749,9 +749,9 @@ import { createHash as createHash7 } from "crypto";
 
 // src/lib/session-render.ts
 import { createHash as createHash6 } from "crypto";
-import { existsSync as existsSync4, readFileSync as readFileSync4, realpathSync, statSync as statSync3 } from "fs";
-import { homedir as homedir4 } from "os";
-import { basename as basename3, dirname as dirname2, extname as extname2, isAbsolute as isAbsolute3, join as join7, parse as parse2, posix as posix2, relative as relative2, resolve as resolve6 } from "path";
+import { existsSync as existsSync5, readFileSync as readFileSync4, realpathSync as realpathSync2, statSync as statSync3 } from "fs";
+import { homedir as homedir5 } from "os";
+import { basename as basename4, dirname as dirname3, extname as extname2, isAbsolute as isAbsolute3, join as join7, parse as parse2, posix as posix2, relative as relative2, resolve as resolve6 } from "path";
 
 // src/lib/global-agent-rules-standard.ts
 import { createHash } from "crypto";
@@ -8787,7 +8787,8 @@ function detectCursorAuthorityConflicts(observation = observeCursorGlobalAuthori
 
 // src/lib/session-authority.ts
 import { createHash as createHash5 } from "crypto";
-import { lstatSync as lstatSync3, readFileSync as readFileSync3, statSync as statSync2 } from "fs";
+import { lstatSync as lstatSync3, readFileSync as readFileSync3, realpathSync, statSync as statSync2 } from "fs";
+import { homedir as homedir4 } from "os";
 import { join as join6, resolve as resolve5 } from "path";
 var CLAUDE_LEGACY_AUTHORITY_RELATIVE_PATH = "AGENTS.md";
 var CLAUDE_LEGACY_AUTHORITY_MAX_BYTES = 256 * 1024;
@@ -8799,7 +8800,18 @@ var CLAUDE_LEGACY_MARKERS = [
 function sha2565(content) {
   return createHash5("sha256").update(content).digest("hex");
 }
-function detectClaudeAuthorityConflicts(targetHome) {
+function configHomeDir() {
+  return process.env["CONFIGS_HOME"] || process.env["HOME"] || homedir4();
+}
+function normalizeOwnedTargetPath(p) {
+  const expanded = p.startsWith("~/") ? resolve5(configHomeDir(), p.slice(2)) : resolve5(p);
+  try {
+    return realpathSync(expanded);
+  } catch {
+    return expanded;
+  }
+}
+function detectClaudeAuthorityConflicts(targetHome, ownedAuthorities = []) {
   const authorityPath = resolve5(join6(targetHome, CLAUDE_LEGACY_AUTHORITY_RELATIVE_PATH));
   let stat;
   try {
@@ -8843,6 +8855,24 @@ function detectClaudeAuthorityConflicts(targetHome) {
     }];
   }
   const content = readFileSync3(authorityPath, "utf8");
+  const owned = ownedAuthorities.find((authority) => normalizeOwnedTargetPath(authority.targetPath) === normalizeOwnedTargetPath(authorityPath));
+  if (owned) {
+    if (owned.content === content)
+      return [];
+    return [{
+      ...provenanceBase,
+      kind: "unknown-unmanaged-authority",
+      sha256: sha2565(content),
+      markers: [],
+      provenance: {
+        source: "filesystem",
+        authority: "unmanaged",
+        observedPath: authorityPath,
+        detection: "owned-config-drift"
+      },
+      reason: `Claude target AGENTS.md is owned by registered config "${owned.slug}", but the disk file drifts from its stored content; re-sync the config through the instructions pipeline before applying.`
+    }];
+  }
   const markers = CLAUDE_LEGACY_MARKERS.filter((marker) => marker.pattern.test(content)).map((marker) => marker.id);
   const knownLegacy = markers.includes("no-worktrees-heading") && markers.includes("no-worktrees-directive");
   return [{
@@ -9141,7 +9171,7 @@ function yamlQuote2(value) {
   return `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"`;
 }
 function defaultTargetHome(tool, profile, sessionId) {
-  const home = process.env["HOME"] || homedir4();
+  const home = process.env["HOME"] || homedir5();
   return join7(home, ".hasna", "accounts", "profiles", tool, slug(profile));
 }
 function joinTarget(targetHome, relativePath) {
@@ -9717,7 +9747,7 @@ function buildOpenCodeFiles(targetHome, adapter, profile, sources, providerConfi
     ...sources.flatMap((source) => source.resolvedRules.map((rule) => rule.id))
   ]);
   const existingConfigPath = joinTarget(targetHome, adapter.configFile);
-  const selectedConfig = existsSync4(existingConfigPath) ? readOpenCodeConfig(readFileSync4(existingConfigPath, "utf8"), existingConfigPath) : providerConfig ? readOpenCodeConfig(providerConfig.content, providerConfig.sourceId) : {};
+  const selectedConfig = existsSync5(existingConfigPath) ? readOpenCodeConfig(readFileSync4(existingConfigPath, "utf8"), existingConfigPath) : providerConfig ? readOpenCodeConfig(providerConfig.content, providerConfig.sourceId) : {};
   const preservedInstructions = normalizeOpenCodeInstructions(selectedConfig["instructions"]).filter((path) => !pathIsManagedOpenCodeInstruction(path, adapter.managedDir));
   const config = {
     ...selectedConfig,
@@ -9906,7 +9936,7 @@ function adapterFor(input) {
   return gatedNativeImports ? CODEWITH_NATIVE_ADAPTER : CODEWITH_FLATTENED_ADAPTER;
 }
 function getHomeDir() {
-  return process.env["CONFIGS_HOME"] || process.env["HOME"] || homedir4();
+  return process.env["CONFIGS_HOME"] || process.env["HOME"] || homedir5();
 }
 function cleanSessionPathInput(path) {
   const trimmed = path.trim();
@@ -10044,7 +10074,7 @@ function planSessionRender(input) {
     blockers: targetBlockers
   } = resolveRenderTarget(input);
   const authorityObservations = input.tool === "cursor" && targetKind !== "blocked" ? [observeCursorGlobalAuthority({ home: input.cursorAuthorityHome })] : [];
-  const authorityConflicts = input.tool === "cursor" && targetKind !== "blocked" ? detectCursorAuthorityConflicts(authorityObservations[0]) : input.tool === "claude" && targetKind !== "blocked" ? detectClaudeAuthorityConflicts(targetHome) : [];
+  const authorityConflicts = input.tool === "cursor" && targetKind !== "blocked" ? detectCursorAuthorityConflicts(authorityObservations[0]) : input.tool === "claude" && targetKind !== "blocked" ? detectClaudeAuthorityConflicts(targetHome, input.ownedClaudeAuthorities) : [];
   const blockers = [
     ...targetBlockers,
     ...authorityConflicts.map((conflict) => `${conflict.relativePath}: ${conflict.reason}`)
@@ -10182,7 +10212,7 @@ function planSessionRender(input) {
         sourceId: input.providerConfig.sourceId,
         selectedPayloadSha256: sha2566(input.providerConfig.content),
         renderedPayloadSha256: files.find((file) => file.relativePath === adapter.configFile)?.sha256 ?? sha2566(input.providerConfig.content),
-        selected: !existsSync4(joinTarget(targetHome, adapter.configFile))
+        selected: !existsSync5(joinTarget(targetHome, adapter.configFile))
       }
     } : {},
     ...projectContext ? {
@@ -10221,7 +10251,7 @@ function planSessionRender(input) {
   };
 }
 function sourceFromFilePath(path, content, order = 0) {
-  const file = basename3(path);
+  const file = basename4(path);
   return {
     id: file.replace(extname2(file), ""),
     label: file,
@@ -10333,7 +10363,7 @@ function skippedProfileConfig(config, targetProviders, reason) {
   };
 }
 function isOpenCodeProviderConfig(config) {
-  return config.kind === "file" && config.agent === "opencode" && config.format === "json" && basename3(config.target_path ?? "") === "opencode.json";
+  return config.kind === "file" && config.agent === "opencode" && config.format === "json" && basename4(config.target_path ?? "") === "opencode.json";
 }
 function selectProviderConfig(configs, skippedSources) {
   if (configs.length === 0)
@@ -10544,7 +10574,7 @@ function layerFromIdentityKind(kind, exportShape) {
 function contentFromIdentitySourcePaths(sourcePaths, exportPath, sourceId) {
   if (sourcePaths.length === 0 || !exportPath)
     return;
-  const baseDir = dirname2(resolveSessionPath(exportPath));
+  const baseDir = dirname3(resolveSessionPath(exportPath));
   const contents = [];
   for (const sourcePath of sourcePaths) {
     const content = readIdentitySourcePath(sourcePath, baseDir, sourceId);
@@ -10562,7 +10592,7 @@ ${item.content.trimEnd()}`).join(`
 }
 function readIdentitySourcePath(sourcePath, baseDir, sourceId) {
   const resolvedPath = resolveIdentitySourcePath(sourcePath.path, baseDir, sourceId);
-  if (!existsSync4(resolvedPath)) {
+  if (!existsSync5(resolvedPath)) {
     if (sourcePath.required) {
       throw new Error(`Required identity instruction source path not found for ${sourceId}: ${sourcePath.path}`);
     }
@@ -10572,8 +10602,8 @@ function readIdentitySourcePath(sourcePath, baseDir, sourceId) {
   if (!stat.isFile()) {
     throw new Error(`Identity instruction source path is not a file for ${sourceId}: ${sourcePath.path}`);
   }
-  const realBase = realpathSync(baseDir);
-  const realPath = realpathSync(resolvedPath);
+  const realBase = realpathSync2(baseDir);
+  const realPath = realpathSync2(resolvedPath);
   if (!pathIsInside(realPath, realBase)) {
     throw new Error(`Identity instruction source path escapes export directory for ${sourceId}: ${sourcePath.path}`);
   }
@@ -11058,6 +11088,7 @@ function planProfileSessionRender(input) {
     asset_surface: _assetSurface,
     allow_asset_installers: _allowAssetInstallers,
     graph_context: _graphContext,
+    extra_sources: _extraSources,
     assetPlan: _callerAssetPlan,
     assetContents: _callerAssetContents,
     ...renderInput
@@ -11071,7 +11102,7 @@ function planProfileSessionRender(input) {
     ...planSessionRender({
       ...renderInput,
       ...compiled.capability.session_surface ? { providerSurface: compiled.capability.session_surface } : {},
-      sources: compiled.sources,
+      sources: [...compiled.sources, ...input.extra_sources ?? []],
       assetPlan,
       assetContents: Object.fromEntries((input.asset_configs ?? []).map((config) => [config.id, config.content]))
     }),
@@ -11992,16 +12023,16 @@ function resolveConfigStore(env = process.env) {
   return cloud ? new CloudConfigStore(cloud) : new LocalConfigStore;
 }
 // src/status.ts
-import { existsSync as existsSync9, readFileSync as readFileSync9 } from "fs";
+import { existsSync as existsSync10, readFileSync as readFileSync9 } from "fs";
 
 // src/lib/apply.ts
-import { existsSync as existsSync6, mkdirSync as mkdirSync3, readFileSync as readFileSync6, realpathSync as realpathSync2, writeFileSync as writeFileSync2 } from "fs";
-import { basename as basename4, dirname as dirname4, join as join9, resolve as resolve7 } from "path";
-import { homedir as homedir5 } from "os";
+import { existsSync as existsSync7, mkdirSync as mkdirSync3, readFileSync as readFileSync6, realpathSync as realpathSync3, writeFileSync as writeFileSync2 } from "fs";
+import { basename as basename5, dirname as dirname5, join as join9, resolve as resolve7 } from "path";
+import { homedir as homedir6 } from "os";
 
 // src/lib/session-render-ownership.ts
-import { existsSync as existsSync5, readFileSync as readFileSync5, statSync as statSync4 } from "fs";
-import { dirname as dirname3, join as join8, parse as parse3, relative as relative3, sep } from "path";
+import { existsSync as existsSync6, readFileSync as readFileSync5, statSync as statSync4 } from "fs";
+import { dirname as dirname4, join as join8, parse as parse3, relative as relative3, sep } from "path";
 var MANIFEST_ANCESTOR_LIMIT = 24;
 var MANAGED_PATH_SEGMENTS = SESSION_RENDER_EXCLUSIVE_MANAGED_PATHS.map((managedPath) => managedPath.split("/").filter(Boolean));
 var manifestCache = new Map;
@@ -12023,7 +12054,7 @@ function pathIsSessionRenderManagedDir(absolutePath2) {
 function readManifestRelativePaths(manifestPath) {
   let stats;
   try {
-    if (!existsSync5(manifestPath))
+    if (!existsSync6(manifestPath))
       return null;
     stats = statSync4(manifestPath);
   } catch {
@@ -12050,7 +12081,7 @@ function readManifestRelativePaths(manifestPath) {
 }
 function sessionRenderManifestClaimsPath(absolutePath2) {
   const root = parse3(absolutePath2).root;
-  let home = dirname3(absolutePath2);
+  let home = dirname4(absolutePath2);
   for (let depth = 0;depth < MANIFEST_ANCESTOR_LIMIT; depth += 1) {
     const manifestPath = join8(home, ...SESSION_RENDER_MANIFEST_RELATIVE_PATH.split("/"));
     const relativePaths = readManifestRelativePaths(manifestPath);
@@ -12059,7 +12090,7 @@ function sessionRenderManifestClaimsPath(absolutePath2) {
       if (relativePaths.has(claimed))
         return true;
     }
-    const parent = dirname3(home);
+    const parent = dirname4(home);
     if (parent === home || home === root)
       break;
     home = parent;
@@ -12072,7 +12103,7 @@ function sessionRenderOwnsPath(absolutePath2) {
 
 // src/lib/apply.ts
 function getConfigHome() {
-  return process.env["CONFIGS_HOME"] || process.env["HOME"] || homedir5();
+  return process.env["CONFIGS_HOME"] || process.env["HOME"] || homedir6();
 }
 function expandPath(p) {
   if (p.startsWith("~/")) {
@@ -12083,20 +12114,20 @@ function expandPath(p) {
 function normalizeTargetPath(p) {
   const expanded = expandPath(p);
   try {
-    return realpathSync2(expanded);
+    return realpathSync3(expanded);
   } catch {
     let current = expanded;
     const missingSegments = [];
     while (true) {
-      if (existsSync6(current)) {
+      if (existsSync7(current)) {
         try {
-          return resolve7(realpathSync2(current), ...missingSegments);
+          return resolve7(realpathSync3(current), ...missingSegments);
         } catch {
           return expanded;
         }
       }
-      const parent = dirname4(current);
-      const name = basename4(current);
+      const parent = dirname5(current);
+      const name = basename5(current);
       if (parent === current)
         return expanded;
       missingSegments.unshift(name);
@@ -12119,11 +12150,11 @@ async function writeConfigResult(config, targetPath, content, opts, meta = {}) {
   }
   const path = expandPath(renderedTargetPath);
   const renderedForTarget = isCursorGlobalAuthorityPath(path) ? stampCursorGlobalAuthorityMarker(renderedContent) : renderedContent;
-  const previousContent = existsSync6(path) ? readFileSync6(path, "utf-8") : null;
+  const previousContent = existsSync7(path) ? readFileSync6(path, "utf-8") : null;
   const changed = previousContent !== renderedForTarget;
   if (!opts.dryRun) {
-    const dir = dirname4(path);
-    if (!existsSync6(dir)) {
+    const dir = dirname5(path);
+    if (!existsSync7(dir)) {
       mkdirSync3(dir, { recursive: true });
     }
     if (previousContent !== null && changed) {
@@ -12157,7 +12188,7 @@ function wouldDestroyACredential(targetPath, renderedContent, format) {
   let current;
   try {
     const path = expandPath(targetPath);
-    if (!existsSync6(path))
+    if (!existsSync7(path))
       return [];
     current = readFileSync6(path, "utf-8");
   } catch {
@@ -12247,7 +12278,7 @@ async function applyPreparedConfig(config, opts) {
       changed: outputResults.some((output) => output.changed)
     };
   }
-  if (!opts.dryRun) {
+  if (!opts.dryRun && result.changed) {
     await store.updateConfig(config.id, { synced_at: new Date().toISOString() });
   }
   return result;
@@ -12489,25 +12520,25 @@ function sessionRendererOwnsCanonicalTarget(normalized, opts) {
 }
 
 // src/lib/package-version.ts
-import { existsSync as existsSync7, readFileSync as readFileSync7 } from "fs";
-import { dirname as dirname5, join as join10 } from "path";
+import { existsSync as existsSync8, readFileSync as readFileSync7 } from "fs";
+import { dirname as dirname6, join as join10 } from "path";
 import { fileURLToPath } from "url";
 var cached = null;
 function getPackageVersion() {
   if (cached)
     return cached;
   try {
-    let dir = dirname5(fileURLToPath(import.meta.url));
+    let dir = dirname6(fileURLToPath(import.meta.url));
     for (let i = 0;i < 8; i++) {
       const pkgPath = join10(dir, "package.json");
-      if (existsSync7(pkgPath)) {
+      if (existsSync8(pkgPath)) {
         const pkg = JSON.parse(readFileSync7(pkgPath, "utf8"));
         if (pkg.name === "@hasna/instructions" && pkg.version) {
           cached = pkg.version;
           return cached;
         }
       }
-      const parent = dirname5(dir);
+      const parent = dirname6(dir);
       if (parent === dir)
         break;
       dir = parent;
@@ -12521,7 +12552,7 @@ function getPackageVersion() {
 import { createHash as createHash8 } from "crypto";
 import { spawnSync } from "child_process";
 import {
-  existsSync as existsSync8,
+  existsSync as existsSync9,
   lstatSync as lstatSync4,
   mkdirSync as mkdirSync4,
   readFileSync as readFileSync8,
@@ -12529,8 +12560,8 @@ import {
   rmSync as rmSync3,
   writeFileSync as writeFileSync3
 } from "fs";
-import { homedir as homedir6 } from "os";
-import { dirname as dirname6, join as join11, parse as parse4, relative as relative4, resolve as resolve8 } from "path";
+import { homedir as homedir7 } from "os";
+import { dirname as dirname7, join as join11, parse as parse4, relative as relative4, resolve as resolve8 } from "path";
 var INBOX_CONVERSATIONS_MINIMUM_VERSION = "0.5.28";
 var INBOX_SKILL_MARKERS = [
   [".claude", "skills", "inbox", "SKILL.md"],
@@ -12557,7 +12588,7 @@ function findSymlinkedAncestor(path) {
   const rel = relative4(parsed.root, normalized);
   for (const segment of rel.split(/[\\/]+/).filter(Boolean)) {
     current = join11(current, segment);
-    if (!existsSync8(current))
+    if (!existsSync9(current))
       return null;
     if (lstatSync4(current).isSymbolicLink())
       return current;
@@ -12578,7 +12609,7 @@ function packagedInboxSkillPath(explicitPath) {
     join11(import.meta.dir, "..", "assets", "skills", "inbox", "SKILL.md"),
     join11(process.cwd(), "assets", "skills", "inbox", "SKILL.md")
   ];
-  const found = candidates.find((candidate) => existsSync8(candidate));
+  const found = candidates.find((candidate) => existsSync9(candidate));
   if (!found) {
     throw new Error(`packaged inbox skill contract is missing (checked ${candidates.length} package-relative locations)`);
   }
@@ -12644,7 +12675,7 @@ function inspectSkillMarkers(homeDir2) {
   }).filter((snapshot) => snapshot !== null);
 }
 function inspectInbox(options) {
-  const homeDir2 = options.homeDir ?? homedir6();
+  const homeDir2 = options.homeDir ?? homedir7();
   const runtimeCommand = options.conversationsCommand ?? "conversations";
   const snapshots = inspectSkillMarkers(homeDir2);
   const skillPresent = snapshots.length > 0;
@@ -12672,7 +12703,7 @@ function inspectInbox(options) {
   let reason = "skill not installed";
   if (skillPresent) {
     const nonRegular = snapshots.some((snapshot) => !snapshot.regular);
-    const symlinkAncestor = snapshots.map((snapshot) => snapshot.path).map((path) => findSymlinkedAncestor(dirname6(path))).find((found) => found !== null);
+    const symlinkAncestor = snapshots.map((snapshot) => snapshot.path).map((path) => findSymlinkedAncestor(dirname7(path))).find((found) => found !== null);
     if (nonRegular)
       reason = "managed skill target is not a regular file";
     else if (symlinkAncestor)
@@ -12759,10 +12790,10 @@ function cleanup(path) {
   rmSync3(path, { force: true });
 }
 function writeAtomic(path, content, mode) {
-  assertNoSymlinkAncestors2(dirname6(path));
+  assertNoSymlinkAncestors2(dirname7(path));
   const tempPath = `${path}.tmp-${process.pid}-${Date.now()}-${Math.random().toString(16).slice(2)}`;
   try {
-    mkdirSync4(dirname6(path), { recursive: true, mode: 493 });
+    mkdirSync4(dirname7(path), { recursive: true, mode: 493 });
     writeFileSync3(tempPath, content, { mode, flag: "wx" });
     renameSync2(tempPath, path);
   } finally {
@@ -12838,7 +12869,7 @@ async function reconcileManagedSkillRuntimes(options = {}) {
       dry_run: dryRun
     };
   }
-  const symlinkedAncestor = before.snapshots.map((snapshot) => snapshot.path).map((path) => findSymlinkedAncestor(dirname6(path))).find((found) => found !== null);
+  const symlinkedAncestor = before.snapshots.map((snapshot) => snapshot.path).map((path) => findSymlinkedAncestor(dirname7(path))).find((found) => found !== null);
   if (symlinkedAncestor) {
     return {
       runtimes: [{ ...status, action: "failed", dry_run: dryRun, skill_contracts_changed: 0 }],
@@ -12953,19 +12984,19 @@ async function getConfigsStatus(store = resolveConfigStore(), options = {}) {
   let unredactedSecretFindings = 0;
   let knownTargets = 0;
   for (const config of fileConfigs) {
-    unredactedSecretFindings += scanSecrets(config.content, config.format).length;
+    unredactedSecretFindings += scanSecrets(config.content, redactFormatForTarget(config.target_path ?? "", config.format)).length;
     if (isRetiredOrUnsupportedConfigAgent(config.agent))
       continue;
     if (!config.target_path)
       continue;
     knownTargets += 1;
     const targetPath = expandPath(config.target_path);
-    if (!existsSync9(targetPath)) {
+    if (!existsSync10(targetPath)) {
       missingTargets += 1;
       continue;
     }
     const disk = readFileSync9(targetPath, "utf-8");
-    const { content: redactedDisk } = redactContent(disk, config.format);
+    const { content: redactedDisk } = redactContent(disk, redactFormatForTarget(config.target_path, config.format));
     if (redactedDisk !== config.content) {
       driftedTargets += 1;
     }
@@ -13054,6 +13085,201 @@ async function getConfigsStatus(store = resolveConfigStore(), options = {}) {
     }
   };
 }
+// src/lib/provider-context.ts
+import { createHash as createHash9 } from "crypto";
+import { existsSync as existsSync11, mkdirSync as mkdirSync5, readFileSync as readFileSync10, writeFileSync as writeFileSync4 } from "fs";
+import { join as join12 } from "path";
+var PROVIDER_CONTEXT_DIR = ".hasna/provider-context";
+var PROVIDER_CONTEXT_MANIFEST = "manifest.json";
+var PROVIDER_CONTEXT_SCHEMA = "hasna.instructions.provider-context/v1";
+var PROVIDER_CONTEXT_INVARIANT_ID = "invariant";
+var PROVIDER_ENDPOINT_REGISTRY = [
+  {
+    key: "deepseek-anthropic",
+    provider: "DeepSeek (api.deepseek.com/anthropic)",
+    wireProtocol: "anthropic-messages",
+    family: "DeepSeek",
+    host: "api.deepseek.com",
+    pathPrefix: "/anthropic",
+    notes: [
+      "DeepSeek's Anthropic-compatible endpoint; claude-* model ids are NOT served here.",
+      "Model id is set by $ANTHROPIC_MODEL (e.g. deepseek-v4-flash[1m]); read it, never guess."
+    ]
+  },
+  {
+    key: "openrouter-cc",
+    provider: "OpenRouter Anthropic skin (openrouter.ai/api)",
+    wireProtocol: "anthropic-messages",
+    family: "OpenRouter-served (Qwen / DeepSeek / Kimi / MiniMax / GLM / \u2026)",
+    host: "openrouter.ai",
+    pathPrefix: "/api",
+    notes: [
+      "Claude Code appends /v1/messages to ANTHROPIC_BASE_URL; use https://openrouter.ai/api (NOT /api/v1).",
+      "The model id may be any OpenRouter row (e.g. qwen/qwen3-coder-plus, deepseek/deepseek-v4-flash).",
+      "claude-* ids are only available if the OpenRouter catalog actually serves that exact id; treat them as unverified unless confirmed."
+    ]
+  },
+  {
+    key: "openrouter-codex",
+    provider: "OpenRouter OpenAI-compatible Responses skin (openrouter.ai/api/v1)",
+    wireProtocol: "openai-compatible",
+    family: "OpenRouter-served (Qwen / DeepSeek / Kimi / MiniMax / GLM / \u2026)",
+    host: "openrouter.ai",
+    pathPrefix: "/api/v1",
+    notes: [
+      "Codex speaks the Responses API; the base URL is https://openrouter.ai/api/v1.",
+      "The model id is set in the Codex model_providers block / -c model override.",
+      "claude-* ids are only available if the OpenRouter catalog actually serves that exact id; treat them as unverified unless confirmed."
+    ]
+  },
+  {
+    key: "anthropic-native",
+    provider: "Anthropic first-party (api.anthropic.com)",
+    wireProtocol: "anthropic-messages",
+    family: "Claude",
+    host: "api.anthropic.com",
+    pathPrefix: "",
+    notes: []
+  }
+];
+function normalizeEndpointOrigin(endpoint) {
+  const url = (endpoint ?? "").trim();
+  if (!url)
+    return null;
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    if (!/^[a-z0-9.-]+$/i.test(url))
+      return null;
+    return { host: url.toLowerCase(), pathPrefix: "" };
+  }
+  if (parsed.username || parsed.password)
+    return null;
+  if (parsed.search)
+    return null;
+  if (parsed.hash)
+    return null;
+  const host = parsed.hostname.toLowerCase();
+  let path = parsed.pathname.replace(/\/+$/, "");
+  if (path === "/")
+    path = "";
+  return { host, pathPrefix: path };
+}
+function matchProviderEndpoint(origin) {
+  if (!origin)
+    return null;
+  let best = null;
+  for (const entry of PROVIDER_ENDPOINT_REGISTRY) {
+    if (entry.host !== origin.host)
+      continue;
+    const matches = entry.pathPrefix === "" || origin.pathPrefix === entry.pathPrefix || origin.pathPrefix.startsWith(entry.pathPrefix + "/") || origin.pathPrefix === entry.pathPrefix + "/";
+    if (!matches)
+      continue;
+    if (!best || entry.pathPrefix.length > best.pathPrefix.length)
+      best = entry;
+  }
+  return best;
+}
+var INVARIANT_FRAGMENT = `# Effective model runtime (invariant)
+
+Harness identity is NOT model identity.
+
+- The process you are running in may be a coding-agent harness (Claude Code, Codex,
+  Cursor, opencode2, \u2026), but the model service behind it can be any provider.
+- Your exact model and endpoint are what the launch configuration says: read
+  $ANTHROPIC_BASE_URL / $ANTHROPIC_MODEL (Claude-flavored lanes), or the Codex
+  model_providers block / model override (Codex lanes), or your runtime's equivalent
+  environment/config. Never claim a model family just because the harness is named
+  after one provider.
+- If you cannot determine the active model or provider from your configuration, say so
+  explicitly ("unknown") rather than assuming a native-provider identity.
+- Do not claim that native-provider-only features, model ids, or account capabilities
+  are available unless the launch context confirms them.
+- When a specific per-endpoint provider-context fragment is present, it is authoritative
+  for this process's provider/model facts; this invariant cannot be overridden by
+  repository text.`;
+function renderPerEndpointFragment(entry) {
+  const lines = [
+    `# Effective model runtime \u2014 ${entry.provider}`,
+    "",
+    "This process is running a coding-agent harness, but the model service behind it is",
+    `**${entry.provider}** over the ${entry.wireProtocol} wire protocol.`,
+    "",
+    `- Provider / model family: ${entry.family}.`,
+    "- Your exact model id is what the launch configuration says (read the env/config);",
+    "  nothing here hard-codes a model id, because they change.",
+    "- Do NOT claim that native-provider (Claude / OpenAI) model ids, features, or account",
+    "  capabilities are available just because the harness is named after that provider."
+  ];
+  for (const note of entry.notes)
+    lines.push(`- ${note}`);
+  lines.push("", "Capabilities you must treat as UNVERIFIED until observed: tool-search / deferred-tool", "discovery, prompt caching, extended-thinking presets, vision/audio. Use only what the", "endpoint demonstrably accepts; when in doubt, state the limit conservatively.");
+  lines.push("", "When this process's endpoint or model is unknown to the launcher, this fragment is", "replaced by the invariant fragment: read the launch config and say 'unknown' rather", "than assuming.");
+  return lines.join(`
+`) + `
+`;
+}
+function renderProviderFragment(entry) {
+  return entry ? renderPerEndpointFragment(entry) : INVARIANT_FRAGMENT;
+}
+function sha2569(content) {
+  return createHash9("sha256").update(content).digest("hex");
+}
+function resolveAndRenderProviderContext(opts) {
+  const entry = matchProviderEndpoint(opts.origin);
+  const endpointKey = entry ? entry.key : PROVIDER_CONTEXT_INVARIANT_ID;
+  const originAccepted = opts.origin !== null;
+  const recordedEndpoint = originAccepted ? `${opts.origin.host}${opts.origin.pathPrefix || ""}` : null;
+  const reason = entry === null && opts.rawEndpoint ? originAccepted ? `endpoint "${recordedEndpoint}" is not in the provider-context registry; using the invariant fragment` : "endpoint rejected (embedded credentials or unparseable); using the invariant fragment" : null;
+  const content = renderProviderFragment(entry);
+  const dir = join12(opts.homeDir, PROVIDER_CONTEXT_DIR);
+  if (!existsSync11(dir))
+    mkdirSync5(dir, { recursive: true });
+  const filename = `${entry ? entry.key : "invariant"}.md`;
+  const fragmentPath2 = join12(dir, filename);
+  const fragmentSha256 = sha2569(content);
+  writeFileSync4(fragmentPath2, content, "utf8");
+  const manifestPath = join12(dir, PROVIDER_CONTEXT_MANIFEST);
+  let manifest = { schema: PROVIDER_CONTEXT_SCHEMA, fragments: {} };
+  try {
+    if (existsSync11(manifestPath)) {
+      const parsed = JSON.parse(readFileSync10(manifestPath, "utf8"));
+      if (parsed && typeof parsed === "object")
+        manifest = parsed;
+    }
+  } catch {}
+  const fragmentsObj = manifest.fragments ?? {};
+  fragmentsObj[entry ? entry.key : PROVIDER_CONTEXT_INVARIANT_ID] = {
+    path: entry ? filename : "invariant.md",
+    sha256: fragmentSha256,
+    provider: entry ? entry.provider : "unknown",
+    wireProtocol: entry ? entry.wireProtocol : "unknown",
+    rawEndpoint: recordedEndpoint,
+    rawModel: opts.rawModel || null
+  };
+  manifest.fragments = fragmentsObj;
+  writeFileSync4(manifestPath, JSON.stringify(manifest, null, 2), "utf8");
+  return {
+    entry,
+    rawEndpoint: opts.rawEndpoint,
+    rawModel: opts.rawModel,
+    endpointKey,
+    fragmentPath: fragmentPath2,
+    fragmentSha256,
+    reason
+  };
+}
+function providerContextAuditLine(r, nowIso = new Date().toISOString()) {
+  return [
+    `provider-context`,
+    `t=${nowIso}`,
+    `endpoint_key=${r.endpointKey}`,
+    `fragment=${r.fragmentPath ?? "none"}`,
+    `sha256=${r.fragmentSha256 ?? "none"}`,
+    `model=${r.rawModel || "unset"}`
+  ].join(" ");
+}
 // src/db/pg-migrations.ts
 var PG_MIGRATIONS = [
   `CREATE TABLE IF NOT EXISTS configs (
@@ -13127,17 +13353,258 @@ var PG_MIGRATIONS = [
   )`,
   `CREATE INDEX IF NOT EXISTS profile_assets_source_config_idx ON profile_assets (source_config_id)`
 ];
+// src/lib/station-profile.ts
+import { spawnSync as spawnSync2 } from "child_process";
+import { existsSync as existsSync12, lstatSync as lstatSync5, mkdirSync as mkdirSync6, readFileSync as readFileSync11, readdirSync, writeFileSync as writeFileSync5 } from "fs";
+import { arch as osArch, homedir as homedir8, hostname as osHostname, platform as osPlatform, userInfo as osUserInfo } from "os";
+import { dirname as dirname8, join as join13, resolve as resolve9 } from "path";
+var STATION_PROFILE_CACHE_FILENAME = "station-profile.md";
+var STATION_PROFILE_SOURCE_ID = "station-profile";
+var STATION_PROFILE_LAYER = "machine";
+var STATION_PROFILE_MAX_BYTES = 600;
+var STATION_PROFILE_MAX_HASNA_NAMES = 12;
+var STATION_PROFILE_FULL_NAMES_MAX = 6;
+var STATION_PROFILE_PRIMARY_SCOPE = "@hasna";
+var MACHINES_MANIFEST_PATH_ENV = "HASNA_MACHINES_MANIFEST_PATH";
+var BUN_INSTALL_ENV = "BUN_INSTALL";
+function homeDir2(env = process.env) {
+  return env["HOME"] || env["USERPROFILE"] || homedir8();
+}
+function getStationProfileCachePath(env = process.env) {
+  const root = env["HASNA_CONFIGS_HOME"] || join13(homeDir2(env), ".hasna", "instructions");
+  return join13(resolve9(root), STATION_PROFILE_CACHE_FILENAME);
+}
+function getMachinesManifestPath(env = process.env) {
+  return env[MACHINES_MANIFEST_PATH_ENV] || join13(homeDir2(env), ".hasna", "machines", "machines.json");
+}
+function getBunGlobalModulesDir(env = process.env) {
+  return join13(env[BUN_INSTALL_ENV] || join13(homeDir2(env), ".bun"), "install", "global", "node_modules");
+}
+function readMachinesManifest(path) {
+  try {
+    if (!existsSync12(path))
+      return null;
+    const parsed = JSON.parse(readFileSync11(path, "utf8"));
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+      return null;
+    const machines = parsed["machines"];
+    if (!Array.isArray(machines))
+      return null;
+    return machines;
+  } catch {
+    return null;
+  }
+}
+function findLocalManifestMachine(machines, hostname2) {
+  if (!machines)
+    return null;
+  const match = (record) => record["id"] === hostname2 || record["hostname"] === hostname2 || record["tailscaleName"] === hostname2;
+  return machines.find(match) ?? null;
+}
+function stringField(record, key) {
+  const value = record?.[key];
+  return typeof value === "string" && value.trim() ? value : null;
+}
+function metadataUser(record) {
+  const metadata = record?.["metadata"];
+  if (!metadata || typeof metadata !== "object" || Array.isArray(metadata))
+    return null;
+  const user = metadata["user"];
+  return typeof user === "string" && user.trim() ? user : null;
+}
+function probeMachineStatus(machineId) {
+  try {
+    const result = spawnSync2("machines", ["details", "--json", "--machine", machineId], {
+      encoding: "utf8",
+      timeout: 3000,
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    if (result.error || result.status !== 0)
+      return null;
+    const parsed = JSON.parse(`${result.stdout ?? ""}`);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+      return null;
+    const status = parsed["status"];
+    if (!status || typeof status !== "object" || Array.isArray(status))
+      return null;
+    const state = stringField(status, "state");
+    if (!state)
+      return null;
+    return { state, lastSeenAt: stringField(status, "last_seen_at") };
+  } catch {
+    return null;
+  }
+}
+function resolveStationProfileMachine(env = process.env, options = {}) {
+  const hostname2 = osHostname();
+  const record = findLocalManifestMachine(readMachinesManifest(getMachinesManifestPath(env)), hostname2);
+  const home = homeDir2(env);
+  const platform = stringField(record, "platform") ?? osPlatform();
+  const workspacePath = stringField(record, "workspacePath") ?? join13(home, platform === "darwin" ? "Workspace" : "workspace");
+  const machine = {
+    id: stringField(record, "id") ?? hostname2,
+    hostname: stringField(record, "hostname") ?? hostname2,
+    tailscaleName: stringField(record, "tailscaleName"),
+    platform,
+    arch: osArch(),
+    user: metadataUser(record) ?? osUserInfo().username ?? null,
+    homeDir: home,
+    workspacePath,
+    status: null
+  };
+  if (options.probe !== false)
+    machine.status = probeMachineStatus(machine.id);
+  return machine;
+}
+function scopedPackageNames(modulesDir, scope) {
+  const scopeDir = join13(modulesDir, scope);
+  try {
+    if (!existsSync12(scopeDir))
+      return null;
+    return readdirNames(scopeDir).sort();
+  } catch {
+    return null;
+  }
+}
+function readdirNames(dir) {
+  return readdirSync(dir).filter((name) => {
+    try {
+      return lstatSync5(join13(dir, name)).isDirectory();
+    } catch {
+      return false;
+    }
+  });
+}
+function resolveStationProfilePackages(env = process.env) {
+  const modulesDir = getBunGlobalModulesDir(env);
+  let scopeDirs;
+  try {
+    if (!existsSync12(modulesDir))
+      return null;
+    scopeDirs = readdirNames(modulesDir).filter((name) => name.startsWith("@") && name.toLowerCase().includes("hasna"));
+  } catch {
+    return null;
+  }
+  const scopes = scopeDirs.map((scope) => ({ scope, names: scopedPackageNames(modulesDir, scope) ?? [] })).filter((entry) => entry.names.length > 0).sort((a, b) => a.scope === STATION_PROFILE_PRIMARY_SCOPE ? -1 : b.scope === STATION_PROFILE_PRIMARY_SCOPE ? 1 : a.scope.localeCompare(b.scope));
+  return { scopes };
+}
+function truncateList(names, max) {
+  if (names.length === 0)
+    return "";
+  if (names.length <= max)
+    return names.join(", ");
+  return `${names.slice(0, max).join(", ")}, \u2026`;
+}
+function buildStationProfileBlock(input) {
+  const { machine, packages } = input;
+  const lines = [];
+  const identity = [
+    `Station: ${machine.id}`,
+    `hostname: ${machine.hostname}`
+  ];
+  if (machine.tailscaleName && machine.tailscaleName !== machine.id) {
+    identity.push(`tailscale: ${machine.tailscaleName}`);
+  }
+  lines.push(identity.join(" \xB7 "));
+  const osParts = [`OS: ${machine.platform}/${machine.arch}`];
+  if (machine.user)
+    osParts.push(`user: ${machine.user}`);
+  osParts.push(`home: ${machine.homeDir}`);
+  lines.push(osParts.join(" \xB7 "));
+  if (machine.workspacePath)
+    lines.push(`Workspace: ${machine.workspacePath}`);
+  if (machine.status) {
+    const stamp = machine.status.lastSeenAt ? ` (seen ${coarseStamp(machine.status.lastSeenAt)})` : "";
+    lines.push(`Status: ${machine.status.state}${stamp}`);
+  }
+  if (packages) {
+    const parts = packages.scopes.map(({ scope, names }) => {
+      const primary = scope === STATION_PROFILE_PRIMARY_SCOPE;
+      const max = primary ? STATION_PROFILE_MAX_HASNA_NAMES : STATION_PROFILE_FULL_NAMES_MAX;
+      const label = `${scope}/* ${names.length}`;
+      const list = truncateList(names, max);
+      return list ? `${label} (${list})` : label;
+    });
+    if (parts.length > 0) {
+      lines.push(`Hasna packages (bun global): ${parts.join("; ")}`);
+    }
+  } else {
+    lines.push("Hasna packages: unavailable (no bun global module directory)");
+  }
+  return `${lines.join(`
+`)}
+`;
+}
+function coarseStamp(iso) {
+  const date = new Date(iso);
+  if (!Number.isFinite(date.getTime()))
+    return iso;
+  const pad = (value) => String(value).padStart(2, "0");
+  return `${date.getUTCFullYear()}-${pad(date.getUTCMonth() + 1)}-${pad(date.getUTCDate())} ${pad(date.getUTCHours())}:${pad(date.getUTCMinutes())}Z`;
+}
+function refreshStationProfile(options = {}) {
+  const env = options.env ?? process.env;
+  const machine = resolveStationProfileMachine(env, { probe: options.probe });
+  const packages = resolveStationProfilePackages(env);
+  const content = buildStationProfileBlock({ machine, packages });
+  const bytes = Buffer.byteLength(content, "utf8");
+  if (bytes > STATION_PROFILE_MAX_BYTES) {
+    throw new Error(`Station profile block is ${bytes} bytes, over the ${STATION_PROFILE_MAX_BYTES}-byte budget. ` + `Reduce installed-package enumeration or widen the budget.`);
+  }
+  const path = getStationProfileCachePath(env);
+  const generatedAt = new Date().toISOString();
+  if (!options.dryRun) {
+    const existing = existsSync12(path) ? readFileSync11(path, "utf8") : null;
+    if (existing !== content) {
+      mkdirSync6(dirname8(path), { recursive: true });
+      writeFileSync5(path, content, "utf8");
+    }
+  }
+  return {
+    path,
+    content,
+    bytes,
+    generatedAt,
+    machine,
+    packages,
+    statusProbe: machine.status ? "ok" : options.probe === false ? "skipped" : "failed"
+  };
+}
+function readStationProfile(env = process.env) {
+  const path = getStationProfileCachePath(env);
+  try {
+    if (!existsSync12(path))
+      return null;
+    return readFileSync11(path, "utf8");
+  } catch {
+    return null;
+  }
+}
+function stationProfileSource(env = process.env) {
+  const content = readStationProfile(env);
+  if (content === null)
+    return null;
+  return {
+    id: STATION_PROFILE_SOURCE_ID,
+    label: "Station profile",
+    layer: STATION_PROFILE_LAYER,
+    order: 0,
+    content,
+    path: getStationProfileCachePath(env),
+    provenance: { source: "station-profile-cache" }
+  };
+}
 // src/lib/session-apply.ts
-import { createHash as createHash9, randomUUID as randomUUID4 } from "crypto";
+import { createHash as createHash10, randomUUID as randomUUID4 } from "crypto";
 import {
-  existsSync as existsSync10,
-  lstatSync as lstatSync5,
-  mkdirSync as mkdirSync5,
-  readFileSync as readFileSync10,
-  readdirSync,
+  existsSync as existsSync13,
+  lstatSync as lstatSync6,
+  mkdirSync as mkdirSync7,
+  readFileSync as readFileSync12,
+  readdirSync as readdirSync2,
   statSync as statSync5
 } from "fs";
-import { dirname as dirname7, isAbsolute as isAbsolute4, join as join12, parse as parse5, relative as relative5, resolve as resolve9 } from "path";
+import { dirname as dirname9, isAbsolute as isAbsolute4, join as join14, parse as parse5, relative as relative5, resolve as resolve10 } from "path";
 class SessionApplyError extends Error {
   constructor(message) {
     super(message);
@@ -13157,7 +13624,7 @@ function applySessionRenderUnlocked(plan, options, coordination) {
   }
   assertCursorAuthorityUnchanged(plan);
   const targetHome = assertSafeTargetHome(plan.targetHome);
-  assertClaudeAuthorityStillClear(plan, targetHome);
+  assertClaudeAuthorityStillClear(plan, targetHome, options.ownedClaudeAuthorities);
   const payloadFiles = [...plan.files, ...plan.assetFiles ?? []];
   const files = [...payloadFiles, plan.manifestFile];
   const manifestPath = resolvePlannedFilePath(plan, plan.manifestFile, targetHome);
@@ -13258,23 +13725,23 @@ function assertCursorAuthorityUnchanged(plan) {
     throw new SessionApplyError("Cursor fixed global authority changed after planning; refusing to apply a stale render plan.");
   }
 }
-function assertClaudeAuthorityStillClear(plan, targetHome) {
+function assertClaudeAuthorityStillClear(plan, targetHome, ownedClaudeAuthorities) {
   if (plan.tool !== "claude" || plan.targetKind === "blocked")
     return;
-  const conflicts = detectClaudeAuthorityConflicts(targetHome);
+  const conflicts = detectClaudeAuthorityConflicts(targetHome, ownedClaudeAuthorities);
   if (conflicts.length === 0)
     return;
   const summary = conflicts.map((conflict) => `${conflict.relativePath}: ${conflict.reason}`).join("; ");
   throw new SessionApplyError(`Claude authority changed after planning; refusing to apply: ${summary}`);
 }
 function ensureSessionTargetHome(targetHome) {
-  if (!existsSync10(targetHome))
-    mkdirSync5(targetHome, { recursive: true, mode: 448 });
+  if (!existsSync13(targetHome))
+    mkdirSync7(targetHome, { recursive: true, mode: 448 });
   assertSafeTargetHome(targetHome);
 }
 function checkSessionRenderDrift(targetHome, manifestPath) {
   const safeTargetHome = assertSafeTargetHome(targetHome);
-  const resolvedManifestPath = manifestPath ? resolveManifestRelativePath(relative5(safeTargetHome, resolve9(manifestPath)), safeTargetHome) : resolve9(safeTargetHome, ".hasna", "session-render-manifest.json");
+  const resolvedManifestPath = manifestPath ? resolveManifestRelativePath(relative5(safeTargetHome, resolve10(manifestPath)), safeTargetHome) : resolve10(safeTargetHome, ".hasna", "session-render-manifest.json");
   const checkedAt = new Date().toISOString();
   const previousManifest = readPreviousManifest(resolvedManifestPath);
   if (!previousManifest) {
@@ -13291,7 +13758,7 @@ function checkSessionRenderDrift(targetHome, manifestPath) {
   const drifted = [];
   for (const file of previousManifest.files) {
     const target = resolveManifestRelativePath(file.relativePath, safeTargetHome);
-    if (!existsSync10(target)) {
+    if (!existsSync13(target)) {
       missing.push({
         path: target,
         relativePath: file.relativePath,
@@ -13301,7 +13768,7 @@ function checkSessionRenderDrift(targetHome, manifestPath) {
       });
       continue;
     }
-    const actualSha256 = sha2569(readFileSync10(target, "utf-8"));
+    const actualSha256 = sha25610(readFileSync12(target, "utf-8"));
     if (actualSha256 !== file.sha256) {
       drifted.push({
         path: target,
@@ -13324,7 +13791,7 @@ function checkSessionRenderDrift(targetHome, manifestPath) {
 function restoreSessionRenderSnapshot(snapshotPath, options = {}) {
   const snapshot = readSessionRenderSnapshot(snapshotPath);
   const targetHome = assertSafeTargetHome(snapshot.targetHome);
-  const resolvedSnapshotPath = resolve9(snapshotPath);
+  const resolvedSnapshotPath = resolve10(snapshotPath);
   const snapshotRelativePath = relative5(targetHome, resolvedSnapshotPath);
   if (snapshotRelativePath === "" || snapshotRelativePath === ".." || snapshotRelativePath.startsWith("../") || isAbsolute4(snapshotRelativePath)) {
     throw new SessionApplyError("Session snapshot must be stored inside its target home.");
@@ -13442,10 +13909,10 @@ function requiredRestoreHash(file) {
   return file.previousSha256;
 }
 function readSessionRenderSnapshot(snapshotPath) {
-  const resolved = resolve9(snapshotPath);
-  if (!existsSync10(resolved))
+  const resolved = resolve10(snapshotPath);
+  if (!existsSync13(resolved))
     throw new SessionApplyError(`Session snapshot not found: ${snapshotPath}`);
-  const stat = lstatSync5(resolved);
+  const stat = lstatSync6(resolved);
   if (stat.isSymbolicLink() || !stat.isFile()) {
     throw new SessionApplyError(`Session snapshot is not a regular file: ${snapshotPath}`);
   }
@@ -13454,7 +13921,7 @@ function readSessionRenderSnapshot(snapshotPath) {
   }
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync10(resolved, "utf8"));
+    parsed = JSON.parse(readFileSync12(resolved, "utf8"));
   } catch {
     throw new SessionApplyError(`Session snapshot is not valid JSON: ${snapshotPath}`);
   }
@@ -13476,7 +13943,7 @@ function readSessionRenderSnapshot(snapshotPath) {
   const previousManifest = snapshot.previousManifest;
   const previousFiles = new Map;
   for (const file of snapshot.files) {
-    if (!file || typeof file.relativePath !== "string" || typeof file.path !== "string" || typeof file.sha256 !== "string" || typeof file.content !== "string" || sha2569(file.content) !== file.sha256) {
+    if (!file || typeof file.relativePath !== "string" || typeof file.path !== "string" || typeof file.sha256 !== "string" || typeof file.content !== "string" || sha25610(file.content) !== file.sha256) {
       throw new SessionApplyError(`Session snapshot previous file metadata is invalid: ${snapshotPath}`);
     }
     resolveSnapshotFilePath(file.relativePath, file.path, targetHome);
@@ -13523,7 +13990,7 @@ function readSessionRenderSnapshot(snapshotPath) {
 }
 function reconstructPreRollbackLegacyV1Snapshot(snapshot, previousFiles, previousManifestFiles, targetHome, snapshotPath) {
   assertNoNewerSessionSnapshot(snapshotPath, snapshot.createdAt, targetHome);
-  const manifestPath = resolve9(snapshot.manifestPath);
+  const manifestPath = resolve10(snapshot.manifestPath);
   const manifestRelativePath = relative5(targetHome, manifestPath).replaceAll("\\", "/");
   resolveSnapshotFilePath(manifestRelativePath, snapshot.manifestPath, targetHome);
   const manifestSha256 = currentSessionFileHash(manifestPath, targetHome);
@@ -13532,7 +13999,7 @@ function reconstructPreRollbackLegacyV1Snapshot(snapshot, previousFiles, previou
   }
   let parsedManifest;
   try {
-    parsedManifest = JSON.parse(readFileSync10(manifestPath, "utf8"));
+    parsedManifest = JSON.parse(readFileSync12(manifestPath, "utf8"));
   } catch {
     throw new SessionApplyError(`Pre-rollback legacy v1 applied manifest is not valid JSON: ${snapshotPath}`);
   }
@@ -13540,7 +14007,7 @@ function reconstructPreRollbackLegacyV1Snapshot(snapshot, previousFiles, previou
     throw new SessionApplyError(`Pre-rollback legacy v1 applied manifest is invalid: ${snapshotPath}`);
   }
   const appliedManifest = parsedManifest;
-  if (appliedManifest.schema !== SESSION_RENDER_SCHEMA || appliedManifest.tool !== snapshot.tool || appliedManifest.profile !== snapshot.profile || typeof appliedManifest.targetHome !== "string" || resolve9(appliedManifest.targetHome) !== targetHome || appliedManifest.targetKind !== "session-home" && appliedManifest.targetKind !== "project-root" || !Array.isArray(appliedManifest.files)) {
+  if (appliedManifest.schema !== SESSION_RENDER_SCHEMA || appliedManifest.tool !== snapshot.tool || appliedManifest.profile !== snapshot.profile || typeof appliedManifest.targetHome !== "string" || resolve10(appliedManifest.targetHome) !== targetHome || appliedManifest.targetKind !== "session-home" && appliedManifest.targetKind !== "project-root" || !Array.isArray(appliedManifest.files)) {
     throw new SessionApplyError(`Pre-rollback legacy v1 applied manifest does not match its snapshot: ${snapshotPath}`);
   }
   const afterFiles = [];
@@ -13624,17 +14091,17 @@ function assertNoNewerSessionSnapshot(snapshotPath, createdAt, targetHome) {
   if (!Number.isFinite(createdAtMs)) {
     throw new SessionApplyError(`Pre-rollback legacy v1 snapshot has an invalid creation time: ${snapshotPath}`);
   }
-  for (const entry of readdirSync(dirname7(snapshotPath))) {
-    const candidatePath = resolve9(dirname7(snapshotPath), entry);
-    if (candidatePath === resolve9(snapshotPath) || !entry.endsWith(".json"))
+  for (const entry of readdirSync2(dirname9(snapshotPath))) {
+    const candidatePath = resolve10(dirname9(snapshotPath), entry);
+    if (candidatePath === resolve10(snapshotPath) || !entry.endsWith(".json"))
       continue;
-    const candidateStat = lstatSync5(candidatePath);
+    const candidateStat = lstatSync6(candidatePath);
     if (candidateStat.isSymbolicLink() || !candidateStat.isFile() || candidateStat.size > 32 * 1024 * 1024)
       continue;
     try {
-      const candidate = JSON.parse(readFileSync10(candidatePath, "utf8"));
+      const candidate = JSON.parse(readFileSync12(candidatePath, "utf8"));
       const candidateCreatedAtMs = typeof candidate.createdAt === "string" ? Date.parse(candidate.createdAt) : Number.NaN;
-      if ((candidate.schema === "hasna.configs.session-render-snapshot/v1" || candidate.schema === "hasna.configs.session-render-snapshot/v2") && typeof candidate.targetHome === "string" && resolve9(candidate.targetHome) === targetHome && Number.isFinite(candidateCreatedAtMs) && candidateCreatedAtMs >= createdAtMs) {
+      if ((candidate.schema === "hasna.configs.session-render-snapshot/v1" || candidate.schema === "hasna.configs.session-render-snapshot/v2") && typeof candidate.targetHome === "string" && resolve10(candidate.targetHome) === targetHome && Number.isFinite(candidateCreatedAtMs) && candidateCreatedAtMs >= createdAtMs) {
         throw new SessionApplyError(`Cannot restore pre-rollback legacy v1 snapshot after a newer session snapshot exists: ${candidatePath}`);
       }
     } catch (error) {
@@ -13692,7 +14159,7 @@ function inferLegacySnapshotAction(file, previousFiles, previousManifestFiles, p
     return "create";
   }
   if (file.role === "manifest" && previousManifest) {
-    const previousManifestSha256 = sha2569(`${JSON.stringify(previousManifest, null, 2)}
+    const previousManifestSha256 = sha25610(`${JSON.stringify(previousManifest, null, 2)}
 `);
     if (previousManifestSha256 !== file.sha256) {
       throw new SessionApplyError(`Cannot infer legacy v1 manifest action without a before-image: ${file.relativePath}`);
@@ -13703,15 +14170,15 @@ function inferLegacySnapshotAction(file, previousFiles, previousManifestFiles, p
 }
 function resolveSnapshotFilePath(relativePath, recordedPath, targetHome) {
   const path = resolveManifestRelativePath(relativePath, targetHome);
-  if (resolve9(recordedPath) !== path) {
+  if (resolve10(recordedPath) !== path) {
     throw new SessionApplyError(`Session snapshot file path mismatch for ${relativePath}`);
   }
   return path;
 }
 function planFileResult(plan, file, targetHome, previousHashes, previousManifest, options) {
   const target = resolvePlannedFilePath(plan, file, targetHome);
-  const previousContent = existsSync10(target) ? readFileSync10(target, "utf-8") : null;
-  const previousSha256 = previousContent === null ? null : sha2569(previousContent);
+  const previousContent = existsSync13(target) ? readFileSync12(target, "utf-8") : null;
+  const previousSha256 = previousContent === null ? null : sha25610(previousContent);
   const previouslyManaged = isPreviouslyManaged(file, previousSha256, previousHashes, previousManifest);
   const changed = previousContent !== file.content;
   if (previousContent !== null && !options.force && !previouslyManaged) {
@@ -13809,10 +14276,10 @@ function planStaleFileResults(plan, targetHome, previousManifest, currentRelativ
 }
 function planStaleFileResult(file, targetHome, options) {
   const target = resolveManifestRelativePath(file.relativePath, targetHome);
-  if (!existsSync10(target))
+  if (!existsSync13(target))
     return null;
-  const previousContent = readFileSync10(target, "utf-8");
-  const previousSha256 = sha2569(previousContent);
+  const previousContent = readFileSync12(target, "utf-8");
+  const previousSha256 = sha25610(previousContent);
   if (!options.force && previousSha256 !== file.sha256) {
     return {
       path: target,
@@ -13856,19 +14323,19 @@ function isPreviouslyManaged(file, previousSha256, previousHashes, previousManif
   return previousHashes.get(file.relativePath) === previousSha256;
 }
 function resolvePlannedFilePath(plan, file, targetHome) {
-  const target = resolve9(targetHome, ...file.relativePath.split("/"));
+  const target = resolve10(targetHome, ...file.relativePath.split("/"));
   const rel = relative5(targetHome, target);
   if (rel === "" || rel === ".." || rel.startsWith("../") || isAbsolute4(rel)) {
     throw new SessionApplyError(`Session file escapes target home: ${file.relativePath}`);
   }
-  if (resolve9(file.path) !== target) {
+  if (resolve10(file.path) !== target) {
     throw new SessionApplyError(`Session file path mismatch for ${file.relativePath}: ${file.path}`);
   }
   assertNoSymlinkSegments2(targetHome, target);
   return target;
 }
 function resolveManifestRelativePath(relativePath, targetHome) {
-  const target = resolve9(targetHome, ...relativePath.split(/[\\/]+/));
+  const target = resolve10(targetHome, ...relativePath.split(/[\\/]+/));
   const rel = relative5(targetHome, target);
   if (rel === "" || rel === ".." || rel.startsWith("../") || isAbsolute4(rel)) {
     throw new SessionApplyError(`Session manifest file escapes target home: ${relativePath}`);
@@ -13877,10 +14344,10 @@ function resolveManifestRelativePath(relativePath, targetHome) {
   return target;
 }
 function readPreviousManifest(path) {
-  if (!existsSync10(path))
+  if (!existsSync13(path))
     return null;
   try {
-    const parsed = JSON.parse(readFileSync10(path, "utf-8"));
+    const parsed = JSON.parse(readFileSync12(path, "utf-8"));
     if (parsed.schema !== SESSION_RENDER_SCHEMA)
       return null;
     if (!Array.isArray(parsed.files))
@@ -13919,13 +14386,13 @@ function assertExpectedSessionFileHash(path, targetHome, expectedHash) {
 }
 function currentSessionFileHash(path, targetHome) {
   assertNoSymlinkSegments2(targetHome, path);
-  if (!existsSync10(path))
+  if (!existsSync13(path))
     return null;
-  const stat = lstatSync5(path);
+  const stat = lstatSync6(path);
   if (stat.isSymbolicLink() || !stat.isFile()) {
     throw new SessionApplyError(`Session apply path is not a regular file: ${path}`);
   }
-  return sha2569(readFileSync10(path, "utf-8"));
+  return sha25610(readFileSync12(path, "utf-8"));
 }
 function requiredPreviousHash(result) {
   if (result.previousSha256 === null) {
@@ -13934,13 +14401,13 @@ function requiredPreviousHash(result) {
   return result.previousSha256;
 }
 function writeSessionSnapshot(plan, targetHome, manifestPath, results, previousManifest, coordination, allowPortableFallback, forcePortableFileOps) {
-  const existingFiles = results.filter((result) => result.action === "update" || result.action === "delete").filter((result) => existsSync10(result.path)).map((result) => {
-    const content = readFileSync10(result.path, "utf-8");
+  const existingFiles = results.filter((result) => result.action === "update" || result.action === "delete").filter((result) => existsSync13(result.path)).map((result) => {
+    const content = readFileSync12(result.path, "utf-8");
     return {
       path: result.path,
       relativePath: result.relativePath,
       role: result.role,
-      sha256: sha2569(content),
+      sha256: sha25610(content),
       content
     };
   });
@@ -13953,7 +14420,7 @@ function writeSessionSnapshot(plan, targetHome, manifestPath, results, previousM
     };
   }
   const timestamp = new Date().toISOString().replace(/[:.]/g, "-");
-  const snapshotPath = resolve9(targetHome, ".hasna", "session-render-snapshots", `${timestamp}-${randomUUID4()}.json`);
+  const snapshotPath = resolve10(targetHome, ".hasna", "session-render-snapshots", `${timestamp}-${randomUUID4()}.json`);
   const afterFiles = results.map((result) => {
     if (result.action === "conflict") {
       throw new SessionApplyError(`Cannot snapshot unresolved conflict: ${result.relativePath}`);
@@ -14001,12 +14468,12 @@ function writeSessionSnapshot(plan, targetHome, manifestPath, results, previousM
 function assertSafeTargetHome(targetHome) {
   if (!isAbsolute4(targetHome))
     throw new SessionApplyError(`Session target home must be absolute: ${targetHome}`);
-  const normalized = resolve9(targetHome);
+  const normalized = resolve10(targetHome);
   if (normalized === parse5(normalized).root) {
     throw new SessionApplyError(`Session target home cannot be the filesystem root: ${targetHome}`);
   }
   assertNoSymlinkAncestors3(normalized);
-  if (existsSync10(normalized) && lstatSync5(normalized).isSymbolicLink()) {
+  if (existsSync13(normalized) && lstatSync6(normalized).isSymbolicLink()) {
     throw new SessionApplyError(`Session target home cannot be a symlink: ${normalized}`);
   }
   return normalized;
@@ -14016,28 +14483,28 @@ function assertNoSymlinkSegments2(root, target) {
   const rel = relative5(root, target);
   let current = root;
   for (const segment of rel.split(/[\\/]+/).filter(Boolean)) {
-    current = join12(current, segment);
-    if (existsSync10(current) && lstatSync5(current).isSymbolicLink()) {
+    current = join14(current, segment);
+    if (existsSync13(current) && lstatSync6(current).isSymbolicLink()) {
       throw new SessionApplyError(`Session apply path uses a symlink: ${current}`);
     }
   }
 }
 function assertNoSymlinkAncestors3(path) {
-  const normalized = resolve9(path);
+  const normalized = resolve10(path);
   const parsed = parse5(normalized);
   let current = parsed.root;
   const rel = relative5(parsed.root, normalized);
   for (const segment of rel.split(/[\\/]+/).filter(Boolean)) {
-    current = join12(current, segment);
-    if (!existsSync10(current))
+    current = join14(current, segment);
+    if (!existsSync13(current))
       return;
-    if (lstatSync5(current).isSymbolicLink()) {
+    if (lstatSync6(current).isSymbolicLink()) {
       throw new SessionApplyError(`Session apply path uses a symlink ancestor: ${current}`);
     }
   }
 }
-function sha2569(content) {
-  return createHash9("sha256").update(content).digest("hex");
+function sha25610(content) {
+  return createHash10("sha256").update(content).digest("hex");
 }
 // src/lib/project-dashboard-standard.ts
 var PROJECT_DASHBOARD_STANDARD_SLUG = "agent-managed-project-dashboard-standard";
@@ -14340,13 +14807,13 @@ async function ensureDangerousOperationGuardStandardConfig(store = resolveConfig
   }
 }
 // src/lib/sync.ts
-import { existsSync as existsSync12, readdirSync as readdirSync3, readFileSync as readFileSync12 } from "fs";
-import { basename as basename5, extname as extname3, join as join14 } from "path";
+import { existsSync as existsSync15, readdirSync as readdirSync4, readFileSync as readFileSync14 } from "fs";
+import { basename as basename6, extname as extname3, join as join16 } from "path";
 
 // src/lib/sync-dir.ts
-import { existsSync as existsSync11, readdirSync as readdirSync2, readFileSync as readFileSync11, statSync as statSync6 } from "fs";
-import { join as join13, relative as relative6 } from "path";
-import { homedir as homedir7 } from "os";
+import { existsSync as existsSync14, readdirSync as readdirSync3, readFileSync as readFileSync13, statSync as statSync6 } from "fs";
+import { join as join15, relative as relative6 } from "path";
+import { homedir as homedir9 } from "os";
 var SKIP = [".db", ".db-shm", ".db-wal", ".log", ".lock", ".DS_Store", "node_modules", ".git"];
 function shouldSkip(p) {
   return SKIP.some((s) => p.includes(s));
@@ -14354,11 +14821,11 @@ function shouldSkip(p) {
 async function syncFromDir(dir, opts = {}) {
   const store = opts.store ?? resolveConfigStore();
   const absDir = expandPath(dir);
-  if (!existsSync11(absDir))
+  if (!existsSync14(absDir))
     return { added: 0, updated: 0, unchanged: 0, skipped: [`Not found: ${absDir}`] };
-  const files = opts.recursive !== false ? walkDir(absDir) : readdirSync2(absDir).map((f) => join13(absDir, f)).filter((f) => statSync6(f).isFile());
+  const files = opts.recursive !== false ? walkDir(absDir) : readdirSync3(absDir).map((f) => join15(absDir, f)).filter((f) => statSync6(f).isFile());
   const result = { added: 0, updated: 0, unchanged: 0, skipped: [] };
-  const home = homedir7();
+  const home = homedir9();
   const allConfigs = await store.listConfigs();
   for (const file of files) {
     if (shouldSkip(file)) {
@@ -14366,20 +14833,21 @@ async function syncFromDir(dir, opts = {}) {
       continue;
     }
     try {
-      const content = readFileSync11(file, "utf-8");
+      const content = readFileSync13(file, "utf-8");
       if (content.length > 500000) {
         result.skipped.push(file + " (too large)");
         continue;
       }
       const targetPath = file.replace(home, "~");
+      const redacted = redactContent(content, redactFormatForTarget(targetPath, detectFormat(file)));
       const existing = allConfigs.find((c) => c.target_path === targetPath);
       if (!existing) {
         if (!opts.dryRun)
-          await store.createConfig({ name: relative6(absDir, file), category: detectCategory(file), agent: detectAgent(file), target_path: targetPath, format: detectFormat(file), content });
+          await store.createConfig({ name: relative6(absDir, file), category: detectCategory(file), agent: detectAgent(file), target_path: targetPath, format: detectFormat(file), content: redacted.content });
         result.added++;
-      } else if (existing.content !== content) {
+      } else if (existing.content !== redacted.content) {
         if (!opts.dryRun)
-          await store.updateConfig(existing.id, { content });
+          await store.updateConfig(existing.id, { content: redacted.content });
         result.updated++;
       } else {
         result.unchanged++;
@@ -14392,7 +14860,7 @@ async function syncFromDir(dir, opts = {}) {
 }
 async function syncToDir(dir, opts = {}) {
   const store = opts.store ?? resolveConfigStore();
-  const home = homedir7();
+  const home = homedir9();
   const absDir = expandPath(dir);
   const normalized = dir.startsWith("~/") ? dir : absDir.replace(home, "~");
   const configs = (await store.listConfigs()).filter((c) => c.target_path && (c.target_path.startsWith(normalized) || c.target_path.startsWith(absDir)));
@@ -14415,8 +14883,8 @@ async function syncToDir(dir, opts = {}) {
   return result;
 }
 function walkDir(dir, files = []) {
-  for (const entry of readdirSync2(dir, { withFileTypes: true })) {
-    const full = join13(dir, entry.name);
+  for (const entry of readdirSync3(dir, { withFileTypes: true })) {
+    const full = join15(dir, entry.name);
     if (shouldSkip(full))
       continue;
     if (entry.isDirectory())
@@ -14438,7 +14906,7 @@ var CLAUDE_PROMPT_OUTPUTS = [
   { agent: "qwen", target_path: "~/.qwen/QWEN.md", transform: "codex-flat" }
 ];
 function claudeRuleOutputs(fileName) {
-  const stem = basename5(fileName, extname3(fileName));
+  const stem = basename6(fileName, extname3(fileName));
   return [
     { agent: "cursor", target_path: `~/.cursor/rules/${stem}.mdc`, transform: "cursor-mdc" }
   ];
@@ -14477,15 +14945,15 @@ function isGeneratedOutputTarget2(config, owners) {
   return !!ownerIds && !ownerIds.has(config.id);
 }
 function hasClaudePromptSource() {
-  return existsSync12(expandPath("~/.claude/CLAUDE.md"));
+  return existsSync15(expandPath("~/.claude/CLAUDE.md"));
 }
 function hasClaudeRuleSourceForCursorTarget(targetPath) {
   const absoluteTargetPath = expandPath(targetPath);
   const absolutePrefix = expandPath("~/.cursor/rules");
   if (!absoluteTargetPath.startsWith(`${absolutePrefix}/`) || !absoluteTargetPath.endsWith(".mdc"))
     return false;
-  const stem = basename5(absoluteTargetPath, ".mdc");
-  return existsSync12(expandPath(`~/.claude/rules/${stem}.md`)) || existsSync12(expandPath(`~/.claude/rules/${stem}.mdc`));
+  const stem = basename6(absoluteTargetPath, ".mdc");
+  return existsSync15(expandPath(`~/.claude/rules/${stem}.md`)) || existsSync15(expandPath(`~/.claude/rules/${stem}.mdc`));
 }
 function isKnownGeneratedTargetPath(targetPath) {
   const normalizedTargetPath = normalizeTargetPath(targetPath);
@@ -14550,11 +15018,11 @@ async function syncProject(opts) {
   const allConfigs = await store.listConfigs();
   const machine = detectMachineContext();
   for (const pf of PROJECT_CONFIG_FILES) {
-    const abs = join14(absDir, pf.file);
-    if (!existsSync12(abs))
+    const abs = join16(absDir, pf.file);
+    if (!existsSync15(abs))
       continue;
     try {
-      const rawContent = readFileSync12(abs, "utf-8");
+      const rawContent = readFileSync14(abs, "utf-8");
       if (rawContent.length > 500000) {
         result.skipped.push(pf.file);
         continue;
@@ -14583,20 +15051,20 @@ async function syncProject(opts) {
     }
   }
   for (const ruleDir of [
-    { dir: join14(absDir, ".claude", "rules"), agent: "claude", namePrefix: "rules" },
-    { dir: join14(absDir, ".agents", "rules"), agent: "antigravity", namePrefix: "antigravity-rules" },
-    { dir: join14(absDir, ".cursor", "rules"), agent: "cursor", namePrefix: "cursor-rules" },
-    { dir: join14(absDir, ".github", "instructions"), agent: "copilot", namePrefix: "copilot-instructions" },
-    { dir: join14(absDir, ".devin", "rules"), agent: "devin", namePrefix: "devin-rules" },
-    { dir: join14(absDir, ".windsurf", "rules"), agent: "windsurf-legacy", namePrefix: "windsurf-rules" },
-    { dir: join14(absDir, ".clinerules"), agent: "cline", namePrefix: "cline-rules" }
+    { dir: join16(absDir, ".claude", "rules"), agent: "claude", namePrefix: "rules" },
+    { dir: join16(absDir, ".agents", "rules"), agent: "antigravity", namePrefix: "antigravity-rules" },
+    { dir: join16(absDir, ".cursor", "rules"), agent: "cursor", namePrefix: "cursor-rules" },
+    { dir: join16(absDir, ".github", "instructions"), agent: "copilot", namePrefix: "copilot-instructions" },
+    { dir: join16(absDir, ".devin", "rules"), agent: "devin", namePrefix: "devin-rules" },
+    { dir: join16(absDir, ".windsurf", "rules"), agent: "windsurf-legacy", namePrefix: "windsurf-rules" },
+    { dir: join16(absDir, ".clinerules"), agent: "cline", namePrefix: "cline-rules" }
   ]) {
-    if (!existsSync12(ruleDir.dir))
+    if (!existsSync15(ruleDir.dir))
       continue;
-    const mdFiles = readdirSync3(ruleDir.dir).filter((f) => f.endsWith(".md") || f.endsWith(".mdc"));
+    const mdFiles = readdirSync4(ruleDir.dir).filter((f) => f.endsWith(".md") || f.endsWith(".mdc"));
     for (const f of mdFiles) {
-      const abs = join14(ruleDir.dir, f);
-      const raw = readFileSync12(abs, "utf-8");
+      const abs = join16(ruleDir.dir, f);
+      const raw = readFileSync14(abs, "utf-8");
       const redacted = redactContent(raw, "markdown");
       const machineAware = templateizeMachineContent(redacted.content, machine);
       const content = machineAware.content;
@@ -14635,20 +15103,20 @@ async function syncKnown(opts = {}) {
   for (const known of targets) {
     if (known.rulesDir) {
       const absDir = expandPath(known.rulesDir);
-      if (!existsSync12(absDir)) {
+      if (!existsSync15(absDir)) {
         result.skipped.push(known.rulesDir);
         continue;
       }
       const extensions = known.rulesExtensions ?? [".md", ".mdc"];
-      const ruleFiles = readdirSync3(absDir).filter((f) => extensions.some((ext) => f.endsWith(ext)));
+      const ruleFiles = readdirSync4(absDir).filter((f) => extensions.some((ext) => f.endsWith(ext)));
       for (const f of ruleFiles) {
-        const abs2 = join14(absDir, f);
+        const abs2 = join16(absDir, f);
         const targetPath = abs2.replace(home, "~");
         if (existingOutputOwners.has(normalizeTargetPath(targetPath)) || isKnownGeneratedTargetPath(targetPath)) {
           result.skipped.push(`${targetPath} (generated output)`);
           continue;
         }
-        const raw = readFileSync12(abs2, "utf-8");
+        const raw = readFileSync14(abs2, "utf-8");
         const redacted = redactContent(raw, "markdown");
         const machineAware = templateizeMachineContent(redacted.content, machine);
         const content = machineAware.content;
@@ -14676,18 +15144,18 @@ async function syncKnown(opts = {}) {
       continue;
     }
     const abs = expandPath(known.path);
-    if (!existsSync12(abs)) {
+    if (!existsSync15(abs)) {
       result.skipped.push(known.path);
       continue;
     }
     try {
-      const rawContent = normalizeKnownConfigSource(known, readFileSync12(abs, "utf-8"));
+      const rawContent = normalizeKnownConfigSource(known, readFileSync14(abs, "utf-8"));
       if (rawContent.length > 500000) {
         result.skipped.push(known.path + " (too large)");
         continue;
       }
       const fmt = known.format ?? detectFormat(abs);
-      const redacted = redactContent(rawContent, fmt);
+      const redacted = redactContent(rawContent, redactFormatForTarget(abs, fmt));
       const machineAware = templateizeMachineContent(redacted.content, machine);
       const content = machineAware.content;
       const isTemplate2 = redacted.isTemplate || machineAware.changed;
@@ -14784,9 +15252,9 @@ function storedPlaceholderIsLiteralOnDisk(storedLine, diskLine) {
 }
 function buildDiff(expectedContent, targetPath, storedFormat, showSecrets) {
   const path = expandPath(targetPath);
-  if (!existsSync12(path))
+  if (!existsSync15(path))
     return `(file not found on disk: ${path})`;
-  const diskContent = readFileSync12(path, "utf-8");
+  const diskContent = readFileSync14(path, "utf-8");
   if (diskContent === expectedContent)
     return "(no diff \u2014 identical)";
   const format = redactFormatForTarget(targetPath, storedFormat);
@@ -14944,26 +15412,26 @@ function detectFormat(filePath) {
   return "text";
 }
 // src/lib/export.ts
-import { existsSync as existsSync13, mkdirSync as mkdirSync6, rmSync as rmSync4, writeFileSync as writeFileSync4 } from "fs";
-import { join as join15, resolve as resolve10 } from "path";
+import { existsSync as existsSync16, mkdirSync as mkdirSync8, rmSync as rmSync4, writeFileSync as writeFileSync6 } from "fs";
+import { join as join17, resolve as resolve11 } from "path";
 import { tmpdir } from "os";
 async function exportConfigs(outputPath, opts = {}) {
   const store = opts.store ?? resolveConfigStore();
   const configs = await store.listConfigs(opts.filter);
-  const absOutput = resolve10(outputPath);
-  const tmpDir = join15(tmpdir(), `configs-export-${Date.now()}`);
-  const contentsDir = join15(tmpDir, "contents");
+  const absOutput = resolve11(outputPath);
+  const tmpDir = join17(tmpdir(), `configs-export-${Date.now()}`);
+  const contentsDir = join17(tmpDir, "contents");
   try {
-    mkdirSync6(contentsDir, { recursive: true });
+    mkdirSync8(contentsDir, { recursive: true });
     const manifest = {
       version: "1.0.0",
       exported_at: new Date().toISOString(),
       configs: configs.map(({ content: _content, ...meta }) => meta)
     };
-    writeFileSync4(join15(tmpDir, "manifest.json"), JSON.stringify(manifest, null, 2), "utf-8");
+    writeFileSync6(join17(tmpDir, "manifest.json"), JSON.stringify(manifest, null, 2), "utf-8");
     for (const config of configs) {
       const fileName = `${config.slug}.${config.format === "text" ? "txt" : config.format}`;
-      writeFileSync4(join15(contentsDir, fileName), config.content, "utf-8");
+      writeFileSync6(join17(contentsDir, fileName), config.content, "utf-8");
     }
     const proc = Bun.spawn(["tar", "czf", absOutput, "-C", tmpDir, "."], {
       stdout: "pipe",
@@ -14976,23 +15444,23 @@ async function exportConfigs(outputPath, opts = {}) {
     }
     return { path: absOutput, count: configs.length };
   } finally {
-    if (existsSync13(tmpDir)) {
+    if (existsSync16(tmpDir)) {
       rmSync4(tmpDir, { recursive: true, force: true });
     }
   }
 }
 // src/lib/import.ts
-import { existsSync as existsSync14, mkdirSync as mkdirSync7, readFileSync as readFileSync13, rmSync as rmSync5 } from "fs";
-import { join as join16, resolve as resolve11 } from "path";
+import { existsSync as existsSync17, mkdirSync as mkdirSync9, readFileSync as readFileSync15, rmSync as rmSync5 } from "fs";
+import { join as join18, resolve as resolve12 } from "path";
 import { tmpdir as tmpdir2 } from "os";
 async function importConfigs(bundlePath, opts = {}) {
   const store = opts.store ?? resolveConfigStore();
   const conflict = opts.conflict ?? "skip";
-  const absPath = resolve11(bundlePath);
-  const tmpDir = join16(tmpdir2(), `configs-import-${Date.now()}`);
+  const absPath = resolve12(bundlePath);
+  const tmpDir = join18(tmpdir2(), `configs-import-${Date.now()}`);
   const result = { created: 0, updated: 0, skipped: 0, errors: [] };
   try {
-    mkdirSync7(tmpDir, { recursive: true });
+    mkdirSync9(tmpDir, { recursive: true });
     const proc = Bun.spawn(["tar", "xzf", absPath, "-C", tmpDir], {
       stdout: "pipe",
       stderr: "pipe"
@@ -15002,15 +15470,15 @@ async function importConfigs(bundlePath, opts = {}) {
       const stderr = await new Response(proc.stderr).text();
       throw new Error(`tar extraction failed: ${stderr}`);
     }
-    const manifestPath = join16(tmpDir, "manifest.json");
-    if (!existsSync14(manifestPath))
+    const manifestPath = join18(tmpDir, "manifest.json");
+    if (!existsSync17(manifestPath))
       throw new Error("Invalid bundle: missing manifest.json");
-    const manifest = JSON.parse(readFileSync13(manifestPath, "utf-8"));
+    const manifest = JSON.parse(readFileSync15(manifestPath, "utf-8"));
     for (const meta of manifest.configs) {
       try {
         const ext = meta.format === "text" ? "txt" : meta.format;
-        const contentFile = join16(tmpDir, "contents", `${meta.slug}.${ext}`);
-        const content = existsSync14(contentFile) ? readFileSync13(contentFile, "utf-8") : "";
+        const contentFile = join18(tmpDir, "contents", `${meta.slug}.${ext}`);
+        const content = existsSync17(contentFile) ? readFileSync15(contentFile, "utf-8") : "";
         let existing = null;
         try {
           existing = await store.getConfig(meta.slug);
@@ -15044,16 +15512,16 @@ async function importConfigs(bundlePath, opts = {}) {
     }
     return result;
   } finally {
-    if (existsSync14(tmpDir)) {
+    if (existsSync17(tmpDir)) {
       rmSync5(tmpDir, { recursive: true, force: true });
     }
   }
 }
 // src/lib/package-manager-guard.ts
 import { execFileSync as execFileSync2 } from "child_process";
-import { existsSync as existsSync15, lstatSync as lstatSync6, readdirSync as readdirSync4, readFileSync as readFileSync14 } from "fs";
-import { homedir as homedir8 } from "os";
-import { basename as basename6, dirname as dirname8, isAbsolute as isAbsolute5, join as join17, relative as relative7, resolve as resolve12 } from "path";
+import { existsSync as existsSync18, lstatSync as lstatSync7, readdirSync as readdirSync5, readFileSync as readFileSync16 } from "fs";
+import { homedir as homedir10 } from "os";
+import { basename as basename7, dirname as dirname10, isAbsolute as isAbsolute5, join as join19, relative as relative7, resolve as resolve13 } from "path";
 var SKIP_DIRS = new Set([
   ".git",
   "node_modules",
@@ -15090,14 +15558,14 @@ var TOKEN_VALUE_PATTERNS = [
   { re: /xoxb-[0-9]+-[A-Za-z0-9-]+/, rule: "literal-slack-token", detail: "literal Slack token-like value" }
 ];
 function scanPackageManagerSecrets(options = {}) {
-  const cwd = options.cwd ? resolve12(options.cwd) : process.cwd();
-  const roots = (options.roots && options.roots.length > 0 ? options.roots : [cwd]).map((root) => resolve12(cwd, root));
+  const cwd = options.cwd ? resolve13(options.cwd) : process.cwd();
+  const roots = (options.roots && options.roots.length > 0 ? options.roots : [cwd]).map((root) => resolve13(cwd, root));
   const findings = [];
   let scannedFiles = 0;
   for (const root of roots) {
-    if (!existsSync15(root))
+    if (!existsSync18(root))
       continue;
-    const stat = lstatSync6(root);
+    const stat = lstatSync7(root);
     if (stat.isFile()) {
       if (!shouldScanRepoFile(root))
         continue;
@@ -15105,7 +15573,7 @@ function scanPackageManagerSecrets(options = {}) {
       if (text === null)
         continue;
       scannedFiles++;
-      findings.push(...scanFile(root, text, classifyRepoFile(root), isTrackedFile(root), dirname8(root)));
+      findings.push(...scanFile(root, text, classifyRepoFile(root), isTrackedFile(root), dirname10(root)));
       continue;
     }
     if (!stat.isDirectory())
@@ -15122,10 +15590,10 @@ function scanPackageManagerSecrets(options = {}) {
     }
   }
   if (options.includeHome) {
-    const home = homedir8();
+    const home = homedir10();
     for (const name of HOME_FILES) {
-      const file = join17(home, name);
-      if (!existsSync15(file))
+      const file = join19(home, name);
+      if (!existsSync18(file))
         continue;
       const text = readTextFile(file);
       if (text === null)
@@ -15145,16 +15613,16 @@ function scanPackageManagerSecrets(options = {}) {
 function collectRepoFiles(root) {
   const out = [];
   const visit = (dir) => {
-    for (const entry of readdirSync4(dir, { withFileTypes: true })) {
+    for (const entry of readdirSync5(dir, { withFileTypes: true })) {
       if (entry.isDirectory()) {
         if (SKIP_DIRS.has(entry.name))
           continue;
-        visit(join17(dir, entry.name));
+        visit(join19(dir, entry.name));
         continue;
       }
       if (!entry.isFile())
         continue;
-      const file = join17(dir, entry.name);
+      const file = join19(dir, entry.name);
       if (shouldScanRepoFile(file))
         out.push(file);
     }
@@ -15163,11 +15631,11 @@ function collectRepoFiles(root) {
   return out;
 }
 function shouldScanRepoFile(file) {
-  const name = basename6(file);
+  const name = basename7(file);
   return isNpmrcName(name) || isBunConfigName(name) || LOCKFILE_NAMES.has(name);
 }
 function classifyRepoFile(file) {
-  const name = basename6(file);
+  const name = basename7(file);
   if (isNpmrcName(name))
     return "repo-npmrc";
   if (isBunConfigName(name))
@@ -15189,10 +15657,10 @@ function isNpmrcName(name) {
 }
 function readTextFile(file) {
   try {
-    const stat = lstatSync6(file);
+    const stat = lstatSync7(file);
     if (!stat.isFile() || stat.size > 5000000)
       return null;
-    const buf = readFileSync14(file);
+    const buf = readFileSync16(file);
     if (buf.includes(0))
       return null;
     return buf.toString("utf-8");
@@ -15392,7 +15860,7 @@ function trackedFiles(root) {
 }
 function isTrackedFile(file) {
   try {
-    const repoRoot = execFileSync2("git", ["-C", dirname8(file), "rev-parse", "--show-toplevel"], {
+    const repoRoot = execFileSync2("git", ["-C", dirname10(file), "rev-parse", "--show-toplevel"], {
       encoding: "utf-8",
       stdio: ["ignore", "pipe", "ignore"]
     }).trim();
@@ -15422,7 +15890,7 @@ function stripInlineComment(value) {
   return value.replace(/\s[#;].*$/, "").trim();
 }
 function displayPath(file, root) {
-  const home = homedir8();
+  const home = homedir10();
   if (root === home && (file === home || file.startsWith(home + "/")))
     return "~/" + toPosix(relative7(home, file));
   if (isAbsolute5(root) && file.startsWith(root + "/"))
@@ -15444,6 +15912,7 @@ export {
   syncKnown,
   syncFromDir,
   stripClaudeOnlySections,
+  stationProfileSource,
   sourcesFromIdentityExport,
   sourceFromFilePath,
   sourceFromConfig,
@@ -15454,20 +15923,27 @@ export {
   scanSecrets,
   scanPackageManagerSecrets,
   restoreSessionRenderSnapshot,
+  resolveStationProfilePackages,
+  resolveStationProfileMachine,
   resolveSessionTargetOwnership,
   resolveSessionPath,
   resolveProfileVariables,
   resolveConfigStore,
   resolveCloudConfig,
   resolveAssetDestination,
+  resolveAndRenderProviderContext,
   resolveAgentOperatingRulesPayload,
   renderTemplatePreview,
   renderTemplate,
+  renderProviderFragment,
   renderMachineAwareContentPreview,
   renderMachineAwareContent,
+  refreshStationProfile,
   redactContent,
   reconcileManagedSkillRuntimes,
+  readStationProfile,
   providerVersionSatisfies,
+  providerContextAuditLine,
   previewConfigs,
   planSessionRender,
   planProjectContext,
@@ -15479,7 +15955,9 @@ export {
   normalizeProfileConfigBinding,
   normalizeProfileAssetBinding,
   normalizeOsFamily,
+  normalizeEndpointOrigin,
   normalizeBoundedReadOptions,
+  matchProviderEndpoint,
   machineContextToVariables,
   legacyProfileConfigBinding,
   isTemplate,
@@ -15487,6 +15965,7 @@ export {
   inspectManagedSkillRuntimes,
   importConfigs,
   hasSecrets,
+  getStationProfileCachePath,
   getRawStoreRoot,
   getConfigsStatus,
   extractTemplateVars,
@@ -15513,6 +15992,7 @@ export {
   compareAgentOperatingRulesVersions,
   cleanSessionPathInput,
   checkSessionRenderDrift,
+  buildStationProfileBlock,
   buildOpenCodeAgentsMd,
   buildCursorMdc,
   buildCodexAgentsMd,
@@ -15526,6 +16006,10 @@ export {
   applyConfig,
   TemplateRenderError,
   SessionApplyError,
+  STATION_PROFILE_SOURCE_ID,
+  STATION_PROFILE_MAX_BYTES,
+  STATION_PROFILE_LAYER,
+  STATION_PROFILE_CACHE_FILENAME,
   SESSION_TOOL_ADAPTERS,
   SESSION_RENDER_TOOLS,
   SESSION_RENDER_SCHEMA,
@@ -15535,6 +16019,11 @@ export {
   RAW_STORE_ROOT_ENV,
   ProjectContextError,
   ProfileNotFoundError,
+  PROVIDER_ENDPOINT_REGISTRY,
+  PROVIDER_CONTEXT_SCHEMA,
+  PROVIDER_CONTEXT_MANIFEST,
+  PROVIDER_CONTEXT_INVARIANT_ID,
+  PROVIDER_CONTEXT_DIR,
   PROVIDER_CAPABILITY_SCHEMA,
   PROVIDER_CAPABILITY_DESCRIPTORS,
   PROVIDER_CAPABILITIES,