@jmanuelcorral/openteam 0.20.0 → 0.22.0

package/dist/index.js

@@ -2,8 +2,8 @@ import { createRequire } from "node:module";
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // src/index.ts
-import { readFile as readFile3 } from "node:fs/promises";
-import { basename as basename3, dirname as dirname5 } from "node:path";
+import { readFile as readFile4 } from "node:fs/promises";
+import { basename as basename4, dirname as dirname6 } from "node:path";
 
 // src/capabilities/curated.ts
 var CURATED_FRONTIER_PROFILES = [
@@ -782,6 +782,72 @@ function migrateConfig(raw) {
   };
 }
 
+// src/messages/consoleDetail.ts
+var consoleDetailMessages = {
+  follow: "Follow new activity",
+  metadataOnly: "Lifecycle and telemetry stay metadata-only.",
+  filter: "Filter sessions",
+  incoming: "New activity available — show updates",
+  refreshError: "Live updates unavailable; retrying.",
+  inspectConversation: "Show messages and tool calls",
+  refresh: "Refresh conversation",
+  close: "Hide messages and tool calls",
+  title: "Recorded messages and tool calls",
+  orchestrator: "Orchestrator",
+  worker: "Worker",
+  session: "Session",
+  runStarted: "Run started",
+  sessionCreated: "Session created",
+  firstObserved: "First observed",
+  timeUnknown: "Time unknown",
+  utc: "UTC",
+  technicalID: "Technical ID",
+  currentMetadata: "Current opencode title; not historical metadata",
+  partialMetadata: "Some current session titles are unavailable or outside the bounded batch; fallback labels remain.",
+  rootCurrent: "Current whole orchestrator session; may contain multiple batches. Not a historical or batch-only transcript.",
+  recovered: "Read-only association verified from current opencode history; not an immutable lifecycle event.",
+  rootUnlinked: "Orchestrator session not recorded. Reveal to try a bounded, read-only relationship search.",
+  rootUnavailable: "Orchestrator session unavailable: no unique, verifiable relationship was found in local history.",
+  rootAmbiguous: "Orchestrator session unavailable: conflicting or copied relationships are ambiguous.",
+  searchIncomplete: "Orchestrator association search incomplete or exceeded its bounded budget. No session was guessed.",
+  prompt: "Received prompts",
+  assistant: "Visible agent responses",
+  tools: "Tool calls ({count})",
+  noPrompts: "No received prompt text retained.",
+  noOutput: "No visible agent response text retained.",
+  noTools: "No tool calls retained.",
+  arguments: "Arguments",
+  result: "Result",
+  loading: "Loading local conversation…",
+  current: "Present-day session, not a timeline reconstruction. May include later messages and tools. Refresh explicitly for updates.",
+  historical: "Historical cursor: conversation content is hidden to avoid showing future mutable text. Return to live before revealing this operation.",
+  disabled: "Content is disabled. Set console.sessionHistory.contentEnabled to true in .opencode/openteam.json and restart the Console. Then reveal content here.",
+  unavailable: "Conversation unavailable. Start an operator-owned local opencode serve against the same workspace and user history, configure console.sessionHistory.endpoint, then retry. No inference was requested.",
+  empty: "No readable user messages, assistant output or tool calls remain in this session.",
+  invalid: "This attempt has no recorded session in the selected run, or its history is incomplete.",
+  unauthorized: "Conversation access denied.",
+  pending: "Still streaming or unavailable.",
+  compacted: "Tool result was compacted by opencode.",
+  invalidEndpoint: "Expected a loopback HTTP origin without credentials, path, query or fragment.",
+  readFailed: "Local session history could not be read.",
+  oversized: "Conversation exceeds the local size limit (4 MiB). No content was loaded.",
+  truncated: "Conversation display is truncated by local safety limits; omitted content is not empty history.",
+  truncatedMarker: `
+[truncated]`,
+  terminalGap: "Live collection was interrupted; events during the gap are unavailable. This is not complete session history.",
+  terminalTrimmed: "Older live output was discarded by the local display limit."
+};
+
+// src/config/historyEndpoint.ts
+function isLocalHistoryEndpoint(value) {
+  try {
+    const url = new URL(value);
+    return url.protocol === "http:" && ["127.0.0.1", "[::1]"].includes(url.hostname) && !url.username && !url.password && url.pathname === "/" && !url.search && !url.hash;
+  } catch {
+    return false;
+  }
+}
+
 // src/config/schema.ts
 var ModelRefSchema = z3.object({
   providerID: z3.string().min(1),
@@ -841,6 +907,10 @@ var ConsoleConfigSchema = z3.object({
   recentRoutes: z3.number().int().positive().default(50),
   openBrowser: z3.boolean().default(false),
   remoteStorage: z3.boolean().default(false),
+  sessionHistory: z3.object({
+    contentEnabled: z3.boolean().default(false),
+    endpoint: z3.string().refine(isLocalHistoryEndpoint, consoleDetailMessages.invalidEndpoint).optional()
+  }).strict().optional(),
   terminal: z3.object({
     enabled: z3.boolean().default(true),
     pty: z3.boolean().optional()
@@ -3841,11 +3911,13 @@ var KNOWN_CONFIG_KEYS_BY_PATH = new Map([
       "openBrowser",
       "remoteStorage",
       "terminal",
-      "graphView"
+      "graphView",
+      "sessionHistory"
     ]
   ],
   ["console.terminal", ["enabled", "pty"]],
   ["console.graphView", ["enabled"]],
+  ["console.sessionHistory", ["contentEnabled", "endpoint"]],
   ["storage", ["sqliteIndex"]],
   ["storage.sqliteIndex", ["enabled", "path"]],
   ["memory", ["semantic"]],
@@ -5317,153 +5389,2032 @@ function createPurgeAdapter(root) {
   };
 }
 
-// src/config/graphFeatureGate.ts
-function checkCertificate(status, name) {
-  if (status.status === "absent") {
-    return {
-      code: `${name}-certificate-absent`,
-      detail: `${name} certificate not found — run the ${name} certification suite to produce it`
-    };
-  }
-  if (status.status === "invalid") {
-    return {
-      code: `${name}-certificate-invalid`,
-      detail: `${name} certificate rejected by recomputing parser: ${status.code} — ${status.detail}`
-    };
+// src/commands/upgrade.ts
+import { execFile as execFile2 } from "node:child_process";
+import { createHash as createHash2, randomUUID } from "node:crypto";
+import {
+  chmod,
+  lstat,
+  mkdir as mkdir2,
+  open,
+  readFile as readFile2,
+  rename,
+  rm as rm2
+} from "node:fs/promises";
+import { basename as basename2, dirname as dirname4, join as join9, relative, resolve as resolve3, win32 } from "node:path";
+import { fileURLToPath } from "node:url";
+import { promisify as promisify2 } from "node:util";
+import { z as z15 } from "zod";
+// package.json
+var package_default = {
+  name: "@jmanuelcorral/openteam",
+  version: "0.22.0",
+  packageManager: "bun@1.3.14",
+  description: "Cost-aware, local-first routing plugin for opencode with cheapest-capable frontier fallback and multi-agent orchestration.",
+  license: "MIT",
+  author: "Jose Manuel Corral",
+  repository: {
+    type: "git",
+    url: "git+https://github.com/jmanuelcorral/openteam.git"
+  },
+  homepage: "https://github.com/jmanuelcorral/openteam#readme",
+  bugs: {
+    url: "https://github.com/jmanuelcorral/openteam/issues"
+  },
+  keywords: [
+    "opencode",
+    "opencode-plugin",
+    "llm",
+    "routing",
+    "local-llm",
+    "ollama",
+    "lm-studio",
+    "foundry-local",
+    "cost-optimization",
+    "multi-agent"
+  ],
+  engines: {
+    bun: ">=1.3",
+    node: "^22.22.2 || ^24.15.0 || >=26.0.0"
+  },
+  type: "module",
+  main: "./dist/index.js",
+  module: "./dist/index.js",
+  types: "./dist/index.d.ts",
+  bin: {
+    openteam: "./dist/cli.js"
+  },
+  exports: {
+    ".": {
+      types: "./dist/index.d.ts",
+      import: "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  files: [
+    "dist",
+    "README.md",
+    "LICENSE",
+    "AGENTS.md",
+    ".opencode/openteam.example.json",
+    ".opencode/command/openteam.md"
+  ],
+  publishConfig: {
+    access: "public",
+    registry: "https://registry.npmjs.org/"
+  },
+  trustedDependencies: [],
+  sideEffects: false,
+  scripts: {
+    prebuild: "bun run clean",
+    build: "bun run build:js && bun run build:cli && bun run build:types && bun run build:certificates",
+    "build:js": "bun build ./src/index.ts --target=node --format=esm --outfile=dist/index.js --external @opencode-ai/plugin --external @opencode-ai/sdk --external zod --external @opentelemetry/api --external @opentelemetry/sdk-trace-base --external @opentelemetry/exporter-trace-otlp-http --external @opentelemetry/resources --external @langchain/langgraph",
+    "build:cli": 'bun build ./src/cli.ts --target=node --format=esm --outfile=dist/cli.js --banner "#!/usr/bin/env node" --external @opencode-ai/plugin --external @opencode-ai/sdk --external zod --external @clack/prompts --external @opentelemetry/api --external @opentelemetry/sdk-trace-base --external @opentelemetry/exporter-trace-otlp-http --external @opentelemetry/resources --external @langchain/langgraph',
+    "build:types": "tsc -p tsconfig.build.json",
+    clean: `node -e "require('node:fs').rmSync('dist', { recursive: true, force: true })"`,
+    test: "bun test",
+    "test:cov": "bun test --coverage",
+    "certify:shadow": "bun run scripts/certify-artifact.ts shadow",
+    "certify:release": "bun run scripts/certify-artifact.ts release",
+    "build:certificates": "bun run certify:shadow && bun run certify:release && bun run scripts/bundle-certificates.ts",
+    "coverage:check": "node scripts/check-coverage.mjs",
+    typecheck: "tsc --noEmit",
+    lint: "biome check .",
+    "format:check": "biome format .",
+    "docs:install": "cd docs && bun install --frozen-lockfile --ignore-scripts",
+    "docs:dev": "cd docs && bun run docs:dev",
+    "docs:build": "cd docs && bun run docs:build",
+    "docs:preview": "cd docs && bun run docs:preview",
+    prepublishOnly: "bun run build",
+    "link:local": "bun run build && npm link",
+    "hooks:install": "git config core.hooksPath .githooks"
+  },
+  dependencies: {
+    "@clack/prompts": "1.7.0",
+    "@langchain/core": "1.2.9",
+    "@langchain/langgraph": "1.4.12",
+    "@opencode-ai/plugin": "1.18.19",
+    "@opencode-ai/sdk": "1.18.19",
+    "@opentelemetry/api": "1.9.1",
+    "@opentelemetry/exporter-trace-otlp-http": "0.221.0",
+    "@opentelemetry/resources": "2.10.0",
+    "@opentelemetry/sdk-trace-base": "2.10.0",
+    zod: "4.4.3"
+  },
+  devDependencies: {
+    "@biomejs/biome": "2.5.9",
+    "@types/bun": "1.3.14",
+    typescript: "7.0.2"
   }
-  return;
-}
-function evaluateGraphGate(input) {
-  const violations = [];
-  const advisories = [];
-  const shadowV = checkCertificate(input.shadow, "shadow");
-  if (shadowV !== undefined)
-    violations.push(shadowV);
-  const releaseV = checkCertificate(input.release, "release");
-  if (releaseV !== undefined)
-    violations.push(releaseV);
-  const soakV = checkCertificate(input.soak, "soak");
-  if (soakV !== undefined)
-    advisories.push(soakV);
-  if (input.migration === "pending") {
-    violations.push({
-      code: "migration-pending",
-      detail: "legacy migration has pending work — run the migration tool to completion before enabling active mode"
-    });
-  } else if (input.migration === "unknown") {
-    violations.push({
-      code: "migration-unknown",
-      detail: "could not determine migration status — check ledger readability and storage access"
-    });
+};
+
+// src/version.ts
+var PACKAGE_VERSION = package_default.version;
+
+// src/config/pluginSpec.ts
+var OPENTEAM_PACKAGE_NAME = "@jmanuelcorral/openteam";
+function pinnedPluginSpec(version) {
+  const v = version ?? PACKAGE_VERSION;
+  return `${OPENTEAM_PACKAGE_NAME}@${v}`;
+}
+var STRICT_SEMVER_RE = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/;
+function parseStrictSemverParts(version) {
+  const match = STRICT_SEMVER_RE.exec(version);
+  if (match === null) {
+    return;
   }
-  if (!input.operatorApproval) {
-    violations.push({
-      code: "operator-approval-missing",
-      detail: "set graph.operatorApproval to true in .opencode/openteam.json after reviewing all certificates and completing migration — this is a declaration of intent, not a proof"
-    });
+  const major = Number(match[1]);
+  const minor = Number(match[2]);
+  const patch = Number(match[3]);
+  if (!Number.isSafeInteger(major) || !Number.isSafeInteger(minor) || !Number.isSafeInteger(patch)) {
+    return;
   }
-  return {
-    allowed: violations.length === 0,
-    violations,
-    advisories
-  };
-}
-function isGateApplicable(mode) {
-  return mode === "active";
+  return [major, minor, patch];
 }
-
-// src/config/opencode.ts
-function stripJsoncComments(src) {
-  const out = [];
-  let i = 0;
-  while (i < src.length) {
-    const ch = src[i];
-    if (ch === undefined)
-      break;
-    if (ch === '"') {
-      out.push(ch);
-      i++;
-      while (i < src.length) {
-        const c = src[i];
-        if (c === undefined)
-          break;
-        out.push(c);
-        i++;
-        if (c === "\\") {
-          const escaped = src[i];
-          if (escaped !== undefined) {
-            out.push(escaped);
-            i++;
-          }
-        } else if (c === '"') {
-          break;
-        }
-      }
-    } else if (ch === "/" && i + 1 < src.length) {
-      if (src[i + 1] === "/") {
-        i += 2;
-        while (i < src.length && src[i] !== `
-`) {
-          i++;
-        }
-      } else if (src[i + 1] === "*") {
-        i += 2;
-        while (i < src.length && !(src[i] === "*" && src[i + 1] === "/")) {
-          i++;
-        }
-        if (i < src.length) {
-          i += 2;
-        }
-      } else {
-        out.push(ch);
-        i++;
-      }
-    } else {
-      out.push(ch);
-      i++;
-    }
+function readStrictSemverParts(version) {
+  const parsed = parseStrictSemverParts(version);
+  if (parsed === undefined) {
+    throw new Error(`invalid-strict-semver:${version}`);
   }
-  return out.join("");
+  return parsed;
 }
-function isRecord3(v) {
-  return typeof v === "object" && v !== null && !Array.isArray(v);
+function isStrictSemver(v) {
+  return parseStrictSemverParts(v) !== undefined;
 }
-var OPENCODE_CONFIG_CANDIDATES = [
-  ".opencode/opencode.json",
-  "opencode.json"
-];
-function mergeOpencodeConfigs(base, override) {
-  const result = { ...base };
-  for (const [key, value] of Object.entries(override)) {
-    const baseVal = result[key];
-    if (isRecord3(baseVal) && isRecord3(value)) {
-      result[key] = mergeOpencodeConfigs(baseVal, value);
-    } else {
-      result[key] = value;
-    }
-  }
-  return result;
+function compareSemver(a, b) {
+  const [aM, am, ap] = readStrictSemverParts(a);
+  const [bM, bm, bp] = readStrictSemverParts(b);
+  if (aM !== bM)
+    return aM - bM;
+  if (am !== bm)
+    return am - bm;
+  return ap - bp;
 }
 
-// src/graph/certificate.ts
-import { z as z16 } from "zod";
-
-// src/contract/opencode.ts
-var SUPPORTED_OPENCODE_VERSIONS = [
-  "1.17.13",
-  "1.18.18",
-  "1.18.19"
-];
-var SEMVER_RE = /^(\d+)\.(\d+)\.(\d+)/;
-function parseSemver(version) {
-  const normalized = version.trim().replace(/^[=^~v]+/, "");
-  const match = SEMVER_RE.exec(normalized);
-  if (match === null) {
-    throw new Error(`invalid semver: "${version}"`);
-  }
-  return {
-    major: Number(match[1]),
-    minor: Number(match[2]),
+// src/messages/commands.ts
+var clearCacheMessages = {
+  header: "openteam clear-cache — frozen plugin cache entries:",
+  columns: {
+    specDir: "spec dir",
+    pinned: "spec-pinned",
+    installed: "installed",
+    mtime: "mtime"
+  },
+  reparseSkipSuffix: "  [SKIP — reparse point]",
+  deletedLabel: "deleted.",
+  lockedLabel: (message) => `[LOCKED] ${message}`,
+  pathOutsideWarning: (specDir, absolutePath) => `  ⚠ ${specDir}: path outside cacheRoot (${absolutePath}), skipped.`,
+  processed: (count) => `${count} entry(ies) processed.`,
+  found: (count) => `${count} entry(ies) found. Use --delete to remove them.`
+};
+var baselineMessages = {
+  effectiveAuto: "cheapest-capable (auto)",
+  pinnedSuffix: (ref) => `${ref} (pinned)`,
+  summary: (params) => [
+    "openteam baseline:",
+    `  mode:      ${params.mode}`,
+    `  pinned:    ${params.pinned}`,
+    `  hardDefault: ${params.hardDefault}`,
+    `  effective: ${params.effective}`
+  ],
+  invalidModel: (input) => `Invalid model "${input}". Use the provider/model format, e.g. anthropic/claude-sonnet-4-5.`,
+  pinnedTo: (ref) => `Baseline pinned to ${ref} (pinned mode).`,
+  autoMode: "Baseline set to auto mode (cheapest-capable)."
+};
+var localMessages = {
+  help: {
+    status: "  openteam local status             Show the execution mode (local / frontier / mixed)",
+    off: "  openteam local off                Use frontier models only",
+    only: "  openteam local only               Use local models only",
+    on: "  openteam local on                 Enable mixed local/frontier execution"
+  },
+  noRuntimes: "none",
+  modeFrontier: "frontier",
+  modeLocal: "local",
+  modeMixed: "mixed",
+  summary: (params) => [
+    "openteam local:",
+    `  execution mode: ${params.mode}`,
+    `  local runtimes: ${params.runtimes}`
+  ],
+  frontierOnlyNoChange: "No change: execution mode is already frontier.",
+  frontierOnlyEnabled: "Frontier execution enabled.",
+  localOnlyNoRuntimes: "Cannot enable local execution: no enabled local runtime is configured. Run 'openteam setup' or enable a local runtime in .opencode/openteam.json first.",
+  localOnlyNoChange: "No change: execution mode is already local.",
+  localOnlyEnabled: "Local execution enabled.",
+  localFirstNoChange: "No change: execution mode is already mixed.",
+  localFirstReEnabled: "Mixed local/frontier execution enabled. Make sure each configured provider is reachable.",
+  unknownSubcommand: (subcommand, help) => `Unknown local subcommand: ${subcommand}
+
+${help}`
+};
+var localRuntimeMessages = {
+  modelListHttpError: (status) => `GET /models failed with HTTP ${status}`,
+  malformedModelsJson: (detail) => `Malformed JSON from /models: ${detail}`,
+  malformedModelsResponseExpectedDataArray: "Malformed /models response: expected data array",
+  malformedModelsResponseModelId: "Malformed /models response: model id must be a string",
+  dnsLookupFailedFor: (hostname, code) => `DNS lookup failed for ${hostname} (${code})`,
+  dnsLookupFailed: (code) => `DNS lookup failed (${code})`
+};
+var yoloMessages = {
+  updated: (path, status, agentNote) => `${path} updated. ${status}${agentNote}
+Restart opencode (or reload) so agents pick up the new permissions.`
+};
+var migrateMessages = {
+  header: "openteam migrate:",
+  nothingToMigrate: "  nothing to migrate — the P15b layout is already in place.",
+  counts: (params) => [
+    `  moved:     ${params.moved} file(s)`,
+    `  deduped:   ${params.deduped} file(s) (destination already identical)`,
+    `  conflicts: ${params.conflicts} file(s)`
+  ],
+  relocatedHeader: "  relocated:",
+  relocatedEntry: (from, to, deduped) => `    · ${from} → ${to}${deduped ? " (deduped)" : ""}`,
+  conflictsHeader: "  ⚠ left in place (destination exists with different content — no data lost):",
+  conflictEntry: (from, to) => `    · ${from} → ${to}`,
+  manualWorktreesHeader: "  ⚠ legacy git worktree(s) need a manual move (run `git worktree move`):",
+  manualWorktreeEntry: (label, from, to) => `    · ${label}: ${from} → ${to}`,
+  success: "  ✓ machine-local runtime output relocated under .opencode/openteam-local/."
+};
+var rolesInitMessages = {
+  help: "  openteam roles init               Compose per-role execution, model, and fallback policy",
+  header: "openteam roles init:",
+  title: "openteam roles init",
+  noRoster: (path) => `  ✗ no roster at ${path}.`,
+  noRosterRemedy: "    Cast the team first: run `openteam setup`, then ask the orchestrator to register the cast.",
+  unparseableRoster: (path, error) => `  ✗ ${path} is present but unparseable: ${error}`,
+  unparseableRosterRemedy: "    Run `openteam doctor` for the remedy, then re-run this command.",
+  allProfiled: (count) => `  ✓ ${count} roster role(s) checked; no unprofiled roles — every role resolves a routing profile.`,
+  skipLabel: "Skip for now",
+  skipHint: "leaves the role on its built-in or fallback policy; doctor keeps reporting the missing explicit override",
+  runtimeQuestion: (roleID) => `Preferred local runtime(s) for "${roleID}" (in failover order)`,
+  runtimeHint: "machine-local — written to the git-ignored overlay",
+  cancelled: (reason) => `  ✗ cancelled (${reason}); nothing was written.`,
+  invalidResult: (reason) => `  ✗ refusing to write: the resulting config is invalid — ${reason}`,
+  deprecation: (message) => `  ⚠ ${message}`,
+  nothingWritten: (skipped) => `  · skipped ${skipped}; nothing written.`,
+  nothingToWriteOutro: "Nothing to write.",
+  runtimeBinding: (path) => `  ✓ runtime binding: ${path} (git-ignored, machine-local)`,
+  skippedSummary: (roleIDs) => `  · skipped: ${roleIDs} — using built-in or fallback policy; re-run this command to add an explicit override.`,
+  outro: "Role policy updated."
+};
+
+// src/messages/executionSetup.ts
+var executionSetupMessages = {
+  setupIntro: "openteam setup — configure local, frontier, or mixed team execution",
+  runtimeQuestion: "Which local runtimes do you want to enable? (choose 'None' for frontier-only)",
+  runtimeNoneLabel: "None — use frontier models only",
+  runtimeNoneHint: "no local runtime (frontier execution)",
+  executionModeQuestion: "Team execution mode",
+  executionModeChoices: {
+    local: {
+      label: "local — every agent stays on configured local providers",
+      hint: "requires at least one enabled local runtime"
+    },
+    frontier: {
+      label: "frontier — every agent uses frontier providers",
+      hint: "does not require a local runtime"
+    },
+    mixed: {
+      label: "mixed — policies may select local or frontier models",
+      hint: "the global mode is an upper bound; per-agent policies may narrow it"
+    }
+  },
+  frontierOnlyNote: [
+    "No local runtime is enabled, so the team will use frontier providers.",
+    "The selected primary model is written consistently to opencode.json and",
+    ".opencode/agent/openteam.md."
+  ].join(`
+`),
+  frontierOnlyTitle: "Frontier execution",
+  localOnlyNote: (model) => [
+    "Every team agent is restricted to configured local providers.",
+    `The primary coordinator is pinned to ${model}.`,
+    "No frontier provider is required for execution while this mode is active."
+  ].join(`
+`),
+  localOnlyTitle: "Local execution",
+  localRequiredError: "local execution requires an enabled local runtime",
+  mixedPrimaryQuestion: "Primary coordinator model",
+  mixedPrimaryLocal: (model) => `Use local thinking model ${model}`,
+  mixedPrimaryFrontier: "Choose a frontier model",
+  frontierModelQuestion: "Frontier model (type to search; cheapest capable entries first)",
+  primaryPolicySummary: (params) => [
+    `Execution mode: ${params.executionMode}`,
+    `Primary model: ${params.primaryModel}`,
+    `Primary fallbacks: ${params.fallbacks}`,
+    "Worker model policy: auto within the global execution mode"
+  ],
+  noFallbacks: "none",
+  yoloQuestion: "Enable YOLO mode? (opencode auto-approves all permissions)",
+  configuredSummary: (params) => [
+    ...executionSetupMessages.primaryPolicySummary({
+      executionMode: params.executionMode,
+      primaryModel: params.primaryModel,
+      fallbacks: executionSetupMessages.noFallbacks
+    }),
+    `Frontier baseline: ${params.frontierBaseline}`,
+    `Local runtimes: ${params.localRuntimes}`,
+    `YOLO mode: ${params.yolo ? "enabled (auto-approves permissions)" : "disabled"}`,
+    "Web Console: launched separately with 'openteam console' (multi-session, loopback)",
+    `Wrote: ${params.opencodePath}, ${params.configPath}, ${params.agentPath}, ${params.agentDir}/*.md (${params.roleAgentCount} standard subagents), ${params.commandDir}/*.md (${params.commandCount} commands); ensured ${params.gitignorePath}`,
+    "",
+    "Next steps:",
+    params.executionMode === "local" ? "  1. No frontier authentication is required while local execution is active" : "  1. Authenticate the frontier provider: opencode auth login",
+    params.executionMode === "local" ? executionSetupMessages.localRuntimeNextStep : params.executionMode === "mixed" ? executionSetupMessages.mixedNextStep : executionSetupMessages.frontierNextStep,
+    "  3. Press Tab and pick the 'openteam' agent, or type / and pick an /openteam… command"
+  ],
+  configuredTitle: "openteam configured",
+  complete: (paths) => `openteam setup complete: ${paths}`,
+  error: (message) => `setup error: ${message}`,
+  localRuntimeNextStep: "  2. Make sure every configured local runtime is reachable",
+  frontierNextStep: "  2. Open opencode in this repo; openteam will use frontier models",
+  mixedNextStep: "  2. Make sure local runtimes are reachable; unavailable candidates can use configured fallbacks",
+  done: "Done. Open opencode and select the 'openteam' agent.",
+  pluginDowngradeNote: (existingVersion, binaryVersion) => [
+    `The installed opencode.json pin is @${existingVersion}, which is newer than this binary (${binaryVersion}).`,
+    "Re-running setup with an older binary would quietly downgrade the pin.",
+    "Confirm below to downgrade, or cancel to keep the existing pin."
+  ].join(`
+`),
+  pluginDowngradeTitle: "Plugin pin downgrade detected",
+  pluginDowngradeConfirm: (existingVersion, binaryVersion) => `Downgrade plugin pin from ${existingVersion} to ${binaryVersion}?`,
+  pluginDowngradePreservedNote: (existingVersion) => `Preserved existing plugin pin @${existingVersion} (not downgraded).`,
+  rerun: {
+    unsafeExistingConfig: (path, detail) => `${path} cannot be safely updated. Fix the file first, then re-run setup. Detail: ${detail}`,
+    emptyConfigObject: "the file is empty; expected a JSON object at the top level",
+    topLevelObjectRequired: "expected a JSON object at the top level",
+    configFormatKinds: {
+      comments: "JSONC comments",
+      trailingCommas: "trailing commas",
+      commentsAndTrailingCommas: "JSONC comments and trailing commas"
+    },
+    configFormatNormalizationNote: (path, kinds) => `${path} uses ${kinds}. Re-running setup rewrites it as standard JSON and removes them.`,
+    configFormatNormalizationTitle: "Config format will be normalized",
+    configFormatNormalizationConfirm: (path) => `Rewrite ${path} as standard JSON?`,
+    providerModelsObjectRequired: (providerID) => `provider.${providerID}.models must be a JSON object`,
+    duplicateTopLevelKeys: (keys) => `duplicate top-level key(s): ${keys.map((key) => JSON.stringify(key)).join(", ")}`,
+    unknownLocalPluginIdentity: (spec) => `plugin entry ${JSON.stringify(spec)} points to a local file whose package identity could not be verified; keep the existing local loader or replace it with an explicit ${JSON.stringify("@jmanuelcorral/openteam@x.y.z")} npm pin before re-running setup`,
+    providerModelObjectRequired: (providerID, modelID) => `provider.${providerID}.models.${modelID} must be a JSON object`,
+    providerModelLimitObjectRequired: (providerID, modelID) => `provider.${providerID}.models.${modelID}.limit must be a JSON object`,
+    providerModelLimitPositiveInteger: (providerID, modelID, field) => `provider.${providerID}.models.${modelID}.limit.${field} must be a positive integer`
+  },
+  rolePolicy: {
+    whyTitle: "Configure execution and model selection",
+    why: (count) => `${count} roster role(s) have no explicit execution/model override. Configure a compact policy now, or leave them on the built-in automatic policy.`,
+    modeQuestion: (roleID, agentName) => `Execution mode for "${roleID}" (${agentName})`,
+    modeInheritLabel: "Inherit the team execution mode",
+    modeLocalLabel: "Local only",
+    modeFrontierLabel: "Frontier only",
+    modelQuestion: (roleID) => `Model selection for "${roleID}"`,
+    modelAutoLabel: "Auto — choose the cheapest capable eligible model",
+    modelExactLabel: "Exact provider/model pin",
+    modelExactQuestion: (roleID) => `Exact model for "${roleID}" as provider/model`,
+    modelExactPlaceholder: "provider/model",
+    fallbacksQuestion: (roleID) => `Ordered fallbacks for "${roleID}" (comma-separated provider/model, blank for none)`,
+    fallbacksPlaceholder: "provider/model, provider/model",
+    configured: (roleIDs, path) => `  ✓ execution/model policy: ${roleIDs} → ${path}`,
+    invalidModelRef: (value) => `invalid model "${value}"; expected provider/model`
+  }
+};
+var executionPolicyMessages = {
+  doctorHelp: "  openteam doctor                   Diagnose runtimes, execution policies, and config",
+  agentsHelp: "  openteam agents                   List agents, model identity, and execution policy",
+  section: "Configured execution policies:",
+  globalMode: (mode) => `  execution mode: ${mode}`,
+  line: (policy) => `  ${policy.owner}: mode=${policy.executionMode ?? "inherit"} · model=${policy.model} · fallbacks=${policy.fallbacks.length > 0 ? policy.fallbacks.join(" → ") : "none"}`,
+  retryLimits: (maxRetries, maxModelsPerNode) => `  retry limits: ${maxRetries} retries per model · ${maxModelsPerNode} model(s) per node`,
+  inheritedDefaultUnset: "inherits the opencode.json default (not set); execution follows the configured team and agent policy",
+  inheritedDefault: (subscription) => `inherits default → ${subscription}; execution follows the configured team and agent policy`,
+  unprofiledRoleRouting: "      routing: no explicit override — the role inherits its built-in or fallback policy within the global execution-mode upper bound. Roster prose is not executable configuration.",
+  unprofiledRoleRemedy: "      remedy: run `openteam roles init`, or add executionMode, model, and ordered fallbacks under orchestrator.roles in .opencode/openteam.json.",
+  noLocalMixed: "  ⚠ No local runtime reachable: mixed execution currently has only frontier candidates.",
+  noLocalBlocked: "  ✗ No local runtime reachable: local execution is blocked until a configured runtime is available.",
+  primaryLocalMismatch: (name, providerID) => `    ✗ local execution is configured, but primary agent '${name}' points at provider '${providerID}', which opencode.json does not configure.`,
+  primaryLocalMismatchCause: "      cause: the primary agent artifact and opencode.json no longer agree on the selected provider/model identity.",
+  primaryLocalMismatchConsequence: "      consequence: opencode cannot start the coordinator, so it cannot read the roster or distribute work.",
+  primaryLocalMismatchRemedy: (sourceFile) => `      remedy: re-run \`openteam setup\` to regenerate ${sourceFile} and opencode.json from the same primary policy, then re-run \`openteam doctor\`.`
+};
+var doctorMessages = {
+  localModelLimits: {
+    section: "  local model limits:",
+    healthy: "    ✓ enabled local provider models declare valid output and context limits in opencode.json.",
+    warningSummary: (count) => `  local model limits: ${count} warning(s)`,
+    modelWarning: (providerID, modelID, problems) => `    ⚠ ${providerID}/${modelID}: ${problems}`,
+    invalidLimitBlock: "invalid limit block (expected an object)",
+    missingOutput: "no limit.output (opencode falls back to its 32 000-token default instead of openteam's 8 192-token client policy)",
+    missingContext: "no limit.context (the runtime's usable prompt window remains unknown to opencode)",
+    invalidOutput: "invalid limit.output (expected a positive integer token count)",
+    invalidContext: "invalid limit.context (expected a positive integer token count)",
+    invalidInput: "invalid limit.input (expected a positive integer token count)",
+    outputExceedsContext: "limit.output is greater than or equal to limit.context, so the configured context leaves no usable input window",
+    outputExceedsInput: "limit.input is less than or equal to the reserved output budget, so compaction would have no usable input threshold",
+    outputRemedy: "    remedy: re-run `openteam setup` to write openteam's 8 192-token local output default, then re-run `openteam doctor`.",
+    detectedContextRemedy: "    remedy: re-run `openteam setup` while the runtime is reachable to copy the detected usable context budget, then re-run `openteam doctor`.",
+    unknownContextRemedy: "    remedy: add `limit.context` manually for models whose runtime does not advertise a context window; `openteam setup` will not invent one.",
+    invalidLimitRemedy: "    remedy: fix the invalid local limit values in opencode.json before relying on this provider configuration."
+  }
+};
+var localModeChangeMessages = {
+  localProviderInFrontierDomain: (path, domainPath, providerID, modelID) => `${path}: model "${providerID}/${modelID}" uses provider "${providerID}", which is configured for local dispatch and cannot be selected when ${domainPath} is "frontier". Update this policy or use \`openteam local on\`.`,
+  frontierProviderInLocalDomain: (path, domainPath, providerID, modelID) => `${path}: model "${providerID}/${modelID}" uses provider "${providerID}", which is not a configured local provider and cannot be selected when ${domainPath} is "local". Update this policy or use \`openteam local on\`.`
+};
+
+// src/messages/upgrade.ts
+var upgradeMessages = {
+  header: "openteam upgrade:",
+  help: {
+    command: "  openteam upgrade                  Update the openteam plugin pin to the latest published version",
+    check: "  openteam upgrade --check          Show current/target versions without making changes",
+    version: "  openteam upgrade --version x.y.z Pin to a specific published version",
+    usage: "  openteam upgrade [--check] [--version x.y.z]"
+  },
+  usageLabel: "Usage:",
+  invalidArguments: (detail) => `  ✗ ${detail}`,
+  duplicateCheck: "Flag --check may be provided only once.",
+  duplicateVersion: "Flag --version may be provided only once.",
+  missingVersionValue: "Flag --version requires a plain x.y.z value.",
+  unknownFlag: (flag) => `Unknown flag ${flag}.`,
+  unexpectedArgument: (value) => `Unexpected argument ${value}.`,
+  checkNeedsUpdate: (params) => `  ${params.path}: ${params.current !== null ? params.current : "(unpinned)"}  →  ${params.target}`,
+  checkAlreadyCurrent: (params) => `  ${params.path}: already at ${params.version}`,
+  checkHint: (version) => version === undefined ? "  Run 'openteam upgrade' (without --check) to apply." : `  Run 'openteam upgrade --version ${version}' (without --check) to apply.`,
+  alreadyCurrent: (version) => `  Already at ${version}; nothing to update.`,
+  updatedHeader: (version) => `  ✓ Plugin pin updated to ${version} in:`,
+  partialHeader: (version) => `  ⚠ Plugin pin updated to ${version} in:`,
+  partialFailuresHeader: "  The following file(s) were not changed:",
+  nothingChanged: "  ✗ No files were changed.",
+  writtenEntry: (path) => `    ✓ ${path}`,
+  failedEntry: (params) => `    ✗ ${params.path}: ${params.error}`,
+  backupNote: (directory) => `  Backups of the previous file contents were saved under ${directory}.`,
+  restartHint: "  Restart opencode to load the new plugin version.",
+  cacheCleanupHint: "  Cache cleanup is optional; run 'openteam clear-cache --delete' if you want to remove stale cache entries.",
+  resolveFailuresBeforeRestart: "  Resolve the failed file(s) before restarting opencode.",
+  rerunAfterFailures: "  Resolve the failed file(s) and re-run the command; no restart is needed.",
+  noConfigFound: (paths) => `No opencode config found (searched: ${paths.join(", ")}). Run 'openteam setup' first.`,
+  noPluginEntry: "No openteam plugin entry found in opencode config. Run 'openteam setup' first.",
+  localFileSkipped: (params) => `  ⚠ Skipped local openteam file entry in ${params.path}: ${params.spec} — local development installs are not managed by upgrade.`,
+  localFileOnlyHeader: "  Local openteam file plugin entries were found:",
+  localFileOnlyEntry: (params) => `    ${params.path}: ${params.spec}`,
+  localFileOnlyRemedy: '  Upgrade manages npm pins only. Keep the local development install, or replace the entry manually with "@jmanuelcorral/openteam@x.y.z".',
+  invalidVersion: (v) => `Invalid version "${v}": must be a plain semver (e.g. 1.2.3) with no leading zeros, range operators, or dist-tags.`,
+  versionNotFound: (v) => `Version ${v} was not found in the npm registry. Verify that the version is published.`,
+  fetchError: (message) => `Failed to resolve version from the npm registry: ${message}`,
+  noDowngrade: (params) => `Automatic latest (${params.target}) is older than the current pin (${params.current}). ` + `The npm registry metadata may be stale. Use --version ${params.current} to keep the ` + `current pin, or --version ${params.target} to explicitly downgrade.`,
+  portNotConfigured: "The upgrade port is not configured in this environment.",
+  genericFetchFailed: "fetch failed",
+  networkRequestFailed: "network request failed",
+  networkRequestFailedWithDetail: (detail) => `network request failed: ${detail}`,
+  requestTimedOut: (timeoutMs) => `request timed out after ${timeoutMs} ms`,
+  responseReadFailed: "response body could not be read completely",
+  responseTooLarge: (limitBytes) => `response body exceeded the ${limitBytes}-byte limit`,
+  missingRegistryBody: "registry response body was empty",
+  invalidRegistryJson: "invalid JSON in registry response",
+  unterminatedBlockComment: "unterminated block comment",
+  invalidRegistryPayload: 'unexpected registry response: expected a JSON object with string "name" and "version" fields',
+  unexpectedVersionField: (raw) => `unexpected registry response: version field is ${raw}`,
+  wrongPackageIdentity: (name) => `registry returned wrong package identity "${name}"`,
+  unexpectedPublishedVersion: (params) => `registry returned version "${params.actual}" while verifying ${params.expected}`,
+  httpStatus: (status) => `HTTP ${status}`,
+  readConfigError: (path, message) => `Error reading ${path}: ${message}`,
+  parseConfigError: (path, message) => `Cannot parse ${path} (malformed JSONC): ${message}`,
+  configRootMustBeObject: (path, kind) => `Cannot parse ${path}: top-level value must be a JSON object (found ${kind}).`,
+  pluginFieldMustBeArray: (path) => `Cannot parse ${path}: the top-level plugin field must be an array when present.`,
+  pluginArrayEditUnavailable: (path) => `Cannot update ${path}: could not locate the top-level plugin array for a source-preserving edit.`,
+  effectivePluginUpdateMismatch: (path) => `Cannot update ${path}: the source-preserving edit did not change the effective top-level plugin entry as expected.`,
+  concurrentEdit: (path) => `${path} changed since it was read; refusing to overwrite it.`,
+  writeTargetMissing: (path) => `${path} disappeared before it could be updated.`,
+  unsafeFilesystemEntry: "expected a regular file inside the workspace; symlinks are not supported",
+  backupLocationUnavailable: (path) => `Cannot update config: backup location ${path} is unavailable or unsafe.`,
+  backupConflict: (path) => `Refusing to overwrite unexpected backup file ${path}.`,
+  backupGitignoreUnexpected: (directory) => `Cannot write upgrade backups: the .gitignore in ${directory} has unexpected content. ` + `It must contain only "*\\n" (ignore everything). Restore it or remove it so the upgrade can manage it.`,
+  windowsDaclPrepFailed: (path, message) => `Cannot update ${path}: failed to apply file ACL to staging file before write: ${message}`,
+  windowsReplaceFailed: (path, message) => `Cannot update ${path} while preserving Windows file ACLs: ${message}`
+};
+
+// src/commands/upgrade.ts
+var NPM_ORIGIN = "https://registry.npmjs.org";
+var NPM_PACKAGE_PATH = "/@jmanuelcorral%2Fopenteam";
+var NPM_LATEST_URL = `${NPM_ORIGIN}${NPM_PACKAGE_PATH}/latest`;
+var FETCH_TIMEOUT_MS = 5000;
+var MAX_RESPONSE_BYTES = 64 * 1024;
+var MAX_FETCH_ATTEMPTS = 2;
+var PLUGIN_KEY = "plugin";
+var PRIVATE_DIRECTORY_MODE = 448;
+var PRIVATE_FILE_MODE = 384;
+var UPGRADE_BACKUP_GITIGNORE_CONTENT = `*
+`;
+var WINDOWS_POWERSHELL_EXE = join9(process.env.SystemRoot ?? "C:\\Windows", "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
+var WINDOWS_PS_TIMEOUT_MS = 1e4;
+var UPGRADE_BACKUP_SUFFIX = ".openteam-upgrade.bak";
+var UPGRADE_BACKUP_DIRECTORY = ".opencode/openteam-local/upgrade-backups";
+function npmVersionUrl(version) {
+  return `${NPM_ORIGIN}${NPM_PACKAGE_PATH}/${version}`;
+}
+var RegistryPackageIdentitySchema = z15.object({
+  name: z15.string(),
+  version: z15.string()
+}).strict();
+
+class TransientFetchError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "TransientFetchError";
+  }
+}
+
+class PermanentFetchError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "PermanentFetchError";
+  }
+}
+var GENERIC_FETCH_FAILURE_MESSAGES = new Set([
+  upgradeMessages.genericFetchFailed,
+  upgradeMessages.networkRequestFailed
+]);
+var execFileAsync2 = promisify2(execFile2);
+function isMissingFile(error) {
+  return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
+}
+function isAlreadyExistsFile(error) {
+  return typeof error === "object" && error !== null && "code" in error && error.code === "EEXIST";
+}
+function isRecord3(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isTuplePluginEntry(value) {
+  return Array.isArray(value) && value.length >= 1 && typeof value[0] === "string";
+}
+function extractSpecString(entry) {
+  if (typeof entry === "string") {
+    return entry;
+  }
+  if (isTuplePluginEntry(entry)) {
+    return entry[0];
+  }
+  return;
+}
+function isLocalFileSpec(spec) {
+  const lower = spec.toLowerCase();
+  return lower.startsWith("file:") || spec.startsWith("./") || spec.startsWith(".\\") || spec.startsWith("../") || spec.startsWith("..\\") || spec.startsWith("/") || spec.startsWith("\\") || win32.isAbsolute(spec);
+}
+function isOurSpec(spec) {
+  return spec === OPENTEAM_PACKAGE_NAME || spec.startsWith(`${OPENTEAM_PACKAGE_NAME}@`);
+}
+function currentPinnedVersion(spec) {
+  if (spec === OPENTEAM_PACKAGE_NAME) {
+    return null;
+  }
+  const version = spec.slice(`${OPENTEAM_PACKAGE_NAME}@`.length);
+  return version.length > 0 ? version : null;
+}
+function describeJsonRootKind(value) {
+  if (value === null) {
+    return "null";
+  }
+  if (Array.isArray(value)) {
+    return "array";
+  }
+  switch (typeof value) {
+    case "boolean":
+      return "boolean";
+    case "number":
+      return "number";
+    default:
+      return "string";
+  }
+}
+function findBlockCommentEnd(src, start, limit = src.length) {
+  let i = start + 2;
+  while (i < limit && !(src[i] === "*" && src[i + 1] === "/")) {
+    i += 1;
+  }
+  return i < limit ? i + 2 : undefined;
+}
+function skipTrivia(src, start, limit = src.length) {
+  let i = start;
+  while (i < limit) {
+    const ch = src[i];
+    if (ch === undefined) {
+      break;
+    }
+    if (/\s/u.test(ch)) {
+      i += 1;
+      continue;
+    }
+    if (ch === "/" && src[i + 1] === "/") {
+      i += 2;
+      while (i < limit && src[i] !== `
+`) {
+        i += 1;
+      }
+      continue;
+    }
+    if (ch === "/" && src[i + 1] === "*") {
+      const blockCommentEnd = findBlockCommentEnd(src, i, limit);
+      if (blockCommentEnd === undefined) {
+        return limit;
+      }
+      i = blockCommentEnd;
+      continue;
+    }
+    break;
+  }
+  return i;
+}
+function readStringToken(src, start, limit = src.length) {
+  if (src[start] !== '"') {
+    return;
+  }
+  let i = start + 1;
+  while (i < limit) {
+    const ch = src[i];
+    if (ch === undefined) {
+      return;
+    }
+    if (ch === "\\") {
+      i += 2;
+      continue;
+    }
+    if (ch === '"') {
+      return { end: i + 1 };
+    }
+    i += 1;
+  }
+  return;
+}
+function normalizeJsoncForParse(src) {
+  const out = [];
+  let i = 0;
+  while (i < src.length) {
+    const ch = src[i];
+    if (ch === undefined) {
+      break;
+    }
+    if (ch === '"') {
+      const token = readStringToken(src, i);
+      if (token === undefined) {
+        out.push(ch);
+        i += 1;
+        continue;
+      }
+      out.push(src.slice(i, token.end));
+      i = token.end;
+      continue;
+    }
+    if (ch === "/" && src[i + 1] === "/") {
+      i = skipTrivia(src, i);
+      continue;
+    }
+    if (ch === "/" && src[i + 1] === "*") {
+      const blockCommentEnd = findBlockCommentEnd(src, i);
+      if (blockCommentEnd === undefined) {
+        throw new Error(upgradeMessages.unterminatedBlockComment);
+      }
+      i = blockCommentEnd;
+      continue;
+    }
+    if (ch === ",") {
+      const next = skipTrivia(src, i + 1);
+      const nextChar = src[next];
+      if (nextChar === "]" || nextChar === "}") {
+        i += 1;
+        continue;
+      }
+    }
+    out.push(ch);
+    i += 1;
+  }
+  return out.join("");
+}
+function parseConfigDocument(path, content) {
+  let parsed;
+  try {
+    const normalized = normalizeJsoncForParse(content);
+    parsed = JSON.parse(normalized);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return { ok: false, error: upgradeMessages.parseConfigError(path, message) };
+  }
+  if (!isRecord3(parsed)) {
+    return {
+      ok: false,
+      error: upgradeMessages.configRootMustBeObject(path, describeJsonRootKind(parsed))
+    };
+  }
+  return { ok: true, value: parsed };
+}
+function readJsoncValueEnd(src, start, limit) {
+  const ch = src[start];
+  if (ch === undefined) {
+    return;
+  }
+  if (ch === '"') {
+    return readStringToken(src, start, limit)?.end;
+  }
+  if (ch === "{" || ch === "[") {
+    const stack = [];
+    let i2 = start;
+    while (i2 < limit) {
+      const next = skipTrivia(src, i2, limit);
+      i2 = next;
+      const current = src[i2];
+      if (current === undefined) {
+        return;
+      }
+      if (current === '"') {
+        const token = readStringToken(src, i2, limit);
+        if (token === undefined) {
+          return;
+        }
+        i2 = token.end;
+        continue;
+      }
+      if (current === "{" || current === "[") {
+        stack.push(current);
+        i2 += 1;
+        continue;
+      }
+      if (current === "}" || current === "]") {
+        const open2 = stack[stack.length - 1];
+        if (current === "}" && open2 !== "{" || current === "]" && open2 !== "[") {
+          return;
+        }
+        stack.pop();
+        i2 += 1;
+        if (stack.length === 0) {
+          return i2;
+        }
+        continue;
+      }
+      i2 += 1;
+    }
+    return;
+  }
+  let i = start;
+  while (i < limit) {
+    const current = src[i];
+    if (current === undefined) {
+      break;
+    }
+    if (/\s/u.test(current) || current === "," || current === "]" || current === "}" || current === "/" && (src[i + 1] === "/" || src[i + 1] === "*")) {
+      break;
+    }
+    i += 1;
+  }
+  return i > start ? i : undefined;
+}
+function findTopLevelPluginArray(raw) {
+  let found;
+  let i = 0;
+  let depth = 0;
+  while (i < raw.length) {
+    i = skipTrivia(raw, i);
+    const ch = raw[i];
+    if (ch === undefined) {
+      break;
+    }
+    if (ch === "{") {
+      depth += 1;
+      i += 1;
+      continue;
+    }
+    if (ch === "}") {
+      if (depth > 0) {
+        depth -= 1;
+      }
+      i += 1;
+      continue;
+    }
+    if (ch === "[") {
+      depth += 1;
+      i += 1;
+      continue;
+    }
+    if (ch === "]") {
+      if (depth > 0) {
+        depth -= 1;
+      }
+      i += 1;
+      continue;
+    }
+    if (ch !== '"') {
+      i += 1;
+      continue;
+    }
+    const token = readStringToken(raw, i);
+    if (token === undefined) {
+      return;
+    }
+    const key = readJsonStringValue(raw, { start: i, end: token.end });
+    if (key === undefined) {
+      return;
+    }
+    i = token.end;
+    if (key !== PLUGIN_KEY || depth !== 1) {
+      continue;
+    }
+    i = skipTrivia(raw, i);
+    if (raw[i] !== ":") {
+      continue;
+    }
+    i += 1;
+    i = skipTrivia(raw, i);
+    if (raw[i] !== "[") {
+      continue;
+    }
+    const arrayEnd = readJsoncValueEnd(raw, i, raw.length);
+    if (arrayEnd === undefined) {
+      return;
+    }
+    found = { start: i, end: arrayEnd };
+  }
+  return found;
+}
+function scanTopLevelArrayElements(raw, arrayStart, arrayEnd) {
+  const elements = [];
+  let i = skipTrivia(raw, arrayStart + 1, arrayEnd);
+  while (i < arrayEnd) {
+    const ch = raw[i];
+    if (ch === undefined || ch === "]") {
+      break;
+    }
+    const end = readJsoncValueEnd(raw, i, arrayEnd);
+    if (end === undefined) {
+      return;
+    }
+    elements.push({ start: i, end });
+    i = skipTrivia(raw, end, arrayEnd);
+    const next = raw[i];
+    if (next === ",") {
+      i = skipTrivia(raw, i + 1, arrayEnd);
+      if (raw[i] === "]") {
+        break;
+      }
+      continue;
+    }
+    if (next === "]") {
+      break;
+    }
+    return;
+  }
+  return elements;
+}
+function readJsonStringValue(raw, span) {
+  try {
+    const parsed = JSON.parse(raw.slice(span.start, span.end));
+    return typeof parsed === "string" ? parsed : undefined;
+  } catch {
+    return;
+  }
+}
+function findEntrySpecStringSpan(raw, element, entry, expectedSpec) {
+  if (typeof entry === "string") {
+    const token2 = readStringToken(raw, element.start, element.end);
+    if (token2 === undefined) {
+      return;
+    }
+    const span2 = { start: element.start, end: token2.end };
+    return readJsonStringValue(raw, span2) === expectedSpec ? span2 : undefined;
+  }
+  if (!isTuplePluginEntry(entry)) {
+    return;
+  }
+  if (raw[element.start] !== "[") {
+    return;
+  }
+  const firstValueStart = skipTrivia(raw, element.start + 1, element.end);
+  const token = readStringToken(raw, firstValueStart, element.end);
+  if (token === undefined) {
+    return;
+  }
+  const span = { start: firstValueStart, end: token.end };
+  return readJsonStringValue(raw, span) === expectedSpec ? span : undefined;
+}
+function buildUpdatedContent(originalContent, replacements, nextSpec) {
+  const jsonSpec = JSON.stringify(nextSpec);
+  let nextContent = originalContent;
+  for (const replacement of [...replacements].sort((left, right) => right.start - left.start)) {
+    nextContent = nextContent.slice(0, replacement.start) + jsonSpec + nextContent.slice(replacement.end);
+  }
+  return nextContent;
+}
+function validateEffectivePluginUpdate(path, nextContent, expectedManagedEntries, nextSpec) {
+  const parsed = parseConfigDocument(path, nextContent);
+  if (!parsed.ok) {
+    return parsed.error;
+  }
+  const pluginValue = parsed.value[PLUGIN_KEY];
+  if (!Array.isArray(pluginValue)) {
+    return upgradeMessages.effectivePluginUpdateMismatch(path);
+  }
+  let managedEntries = 0;
+  let updatedEntries = 0;
+  for (const entry of pluginValue) {
+    const spec = extractSpecString(entry);
+    if (spec === undefined || !isOurSpec(spec)) {
+      continue;
+    }
+    managedEntries += 1;
+    if (spec === nextSpec) {
+      updatedEntries += 1;
+    }
+  }
+  return managedEntries === expectedManagedEntries && updatedEntries === expectedManagedEntries ? undefined : upgradeMessages.effectivePluginUpdateMismatch(path);
+}
+function parseUpgradePositionals(positionals) {
+  let check = false;
+  let targetVersion;
+  for (let i = 1;i < positionals.length; i += 1) {
+    const arg = positionals[i];
+    if (arg === "--check") {
+      if (check) {
+        return { ok: false, error: upgradeMessages.duplicateCheck };
+      }
+      check = true;
+      continue;
+    }
+    if (arg === "--version") {
+      if (targetVersion !== undefined) {
+        return { ok: false, error: upgradeMessages.duplicateVersion };
+      }
+      const next = positionals[i + 1];
+      if (next === undefined || next.startsWith("--")) {
+        return { ok: false, error: upgradeMessages.missingVersionValue };
+      }
+      targetVersion = next;
+      i += 1;
+      continue;
+    }
+    if (arg?.startsWith("--")) {
+      return { ok: false, error: upgradeMessages.unknownFlag(arg) };
+    }
+    if (arg !== undefined) {
+      return { ok: false, error: upgradeMessages.unexpectedArgument(arg) };
+    }
+  }
+  return { ok: true, value: { check, targetVersion } };
+}
+async function raceWithAbort(promise, signal, message) {
+  if (signal.aborted) {
+    throw new TransientFetchError(message);
+  }
+  let onAbort;
+  try {
+    return await Promise.race([
+      promise,
+      new Promise((_, reject) => {
+        onAbort = () => reject(new TransientFetchError(message));
+        signal.addEventListener("abort", onAbort, { once: true });
+      })
+    ]);
+  } finally {
+    if (onAbort !== undefined) {
+      signal.removeEventListener("abort", onAbort);
+    }
+  }
+}
+function scheduleCleanup(action) {
+  try {
+    const promise = action();
+    promise?.catch(() => {});
+  } catch {}
+}
+function scheduleResponseBodyCancel(response) {
+  scheduleCleanup(() => response.body?.cancel());
+}
+function scheduleReaderCancel(reader) {
+  scheduleCleanup(() => reader.cancel());
+}
+function extractFetchFailureDetail(error) {
+  const seen = new Set;
+  let current = error;
+  let fallback;
+  while (current instanceof Error && !seen.has(current)) {
+    seen.add(current);
+    const message = current.message.trim();
+    if (message !== "" && !GENERIC_FETCH_FAILURE_MESSAGES.has(message.toLowerCase())) {
+      return message;
+    }
+    if (message !== "" && fallback === undefined) {
+      fallback = message;
+    }
+    current = "cause" in current ? current.cause : undefined;
+  }
+  if (typeof current === "string") {
+    const message = current.trim();
+    if (message !== "") {
+      return message;
+    }
+  }
+  return fallback;
+}
+function classifyUnexpectedFetchFailure(error, timedOut) {
+  if (timedOut) {
+    return new TransientFetchError(upgradeMessages.requestTimedOut(FETCH_TIMEOUT_MS));
+  }
+  const detail = extractFetchFailureDetail(error);
+  return new TransientFetchError(detail === undefined ? upgradeMessages.networkRequestFailed : upgradeMessages.networkRequestFailedWithDetail(detail));
+}
+async function readBoundedJsonResponse(response, signal) {
+  const contentLength = Number(response.headers.get("content-length"));
+  if (Number.isFinite(contentLength) && contentLength > MAX_RESPONSE_BYTES) {
+    scheduleResponseBodyCancel(response);
+    throw new PermanentFetchError(upgradeMessages.responseTooLarge(MAX_RESPONSE_BYTES));
+  }
+  const body = response.body;
+  if (body === null) {
+    throw new PermanentFetchError(upgradeMessages.missingRegistryBody);
+  }
+  const reader = body.getReader();
+  const cancelReader = () => {
+    scheduleReaderCancel(reader);
+  };
+  signal.addEventListener("abort", cancelReader, { once: true });
+  const chunks = [];
+  let total = 0;
+  try {
+    while (true) {
+      const chunk = await raceWithAbort(reader.read(), signal, upgradeMessages.requestTimedOut(FETCH_TIMEOUT_MS));
+      if (chunk.done) {
+        break;
+      }
+      total += chunk.value.byteLength;
+      if (total > MAX_RESPONSE_BYTES) {
+        throw new PermanentFetchError(upgradeMessages.responseTooLarge(MAX_RESPONSE_BYTES));
+      }
+      chunks.push(chunk.value);
+    }
+  } catch (error) {
+    scheduleReaderCancel(reader);
+    if (error instanceof PermanentFetchError) {
+      throw error;
+    }
+    throw new TransientFetchError(signal.aborted ? upgradeMessages.requestTimedOut(FETCH_TIMEOUT_MS) : upgradeMessages.responseReadFailed);
+  } finally {
+    signal.removeEventListener("abort", cancelReader);
+    reader.releaseLock();
+  }
+  const bytes = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    bytes.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  try {
+    return JSON.parse(new TextDecoder().decode(bytes));
+  } catch {
+    throw new PermanentFetchError(upgradeMessages.invalidRegistryJson);
+  }
+}
+async function fetchFromNpm(url, fetchFn) {
+  for (let attempt = 1;attempt <= MAX_FETCH_ATTEMPTS; attempt += 1) {
+    const controller = new AbortController;
+    const timeoutId = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
+    try {
+      const response = await raceWithAbort(fetchFn(url, { signal: controller.signal }), controller.signal, upgradeMessages.requestTimedOut(FETCH_TIMEOUT_MS));
+      if (!response.ok) {
+        scheduleResponseBodyCancel(response);
+        return { ok: false, kind: "http", status: response.status };
+      }
+      const data = await readBoundedJsonResponse(response, controller.signal);
+      return { ok: true, data };
+    } catch (error) {
+      const timedOut = controller.signal.aborted;
+      controller.abort();
+      if (error instanceof PermanentFetchError) {
+        return { ok: false, kind: "error", error: error.message };
+      }
+      const transientError = error instanceof TransientFetchError ? error : classifyUnexpectedFetchFailure(error, timedOut);
+      if (attempt === MAX_FETCH_ATTEMPTS) {
+        return { ok: false, kind: "error", error: transientError.message };
+      }
+    } finally {
+      clearTimeout(timeoutId);
+    }
+  }
+  return { ok: false, kind: "error", error: upgradeMessages.networkRequestFailed };
+}
+function validateRegistryPackageResponse(data) {
+  const parsed = RegistryPackageIdentitySchema.safeParse(isRecord3(data) ? { name: data.name, version: data.version } : data);
+  if (!parsed.success) {
+    return { ok: false, error: upgradeMessages.invalidRegistryPayload };
+  }
+  if (parsed.data.name !== OPENTEAM_PACKAGE_NAME) {
+    return { ok: false, error: upgradeMessages.wrongPackageIdentity(parsed.data.name) };
+  }
+  if (!isStrictSemver(parsed.data.version)) {
+    return {
+      ok: false,
+      error: upgradeMessages.unexpectedVersionField(JSON.stringify(parsed.data.version))
+    };
+  }
+  return { ok: true, version: parsed.data.version };
+}
+async function fetchLatestVersion(fetchFn) {
+  const result = await fetchFromNpm(NPM_LATEST_URL, fetchFn);
+  if (!result.ok) {
+    if (result.kind === "http") {
+      return { ok: false, error: upgradeMessages.fetchError(upgradeMessages.httpStatus(result.status)) };
+    }
+    return { ok: false, error: upgradeMessages.fetchError(result.error) };
+  }
+  const validated = validateRegistryPackageResponse(result.data);
+  if (!validated.ok) {
+    return { ok: false, error: upgradeMessages.fetchError(validated.error) };
+  }
+  return { ok: true, version: validated.version };
+}
+async function verifyVersionExists(version, fetchFn) {
+  const result = await fetchFromNpm(npmVersionUrl(version), fetchFn);
+  if (!result.ok) {
+    if (result.kind === "http") {
+      return result.status === 404 ? { ok: false, error: upgradeMessages.versionNotFound(version) } : { ok: false, error: upgradeMessages.fetchError(upgradeMessages.httpStatus(result.status)) };
+    }
+    return { ok: false, error: upgradeMessages.fetchError(result.error) };
+  }
+  const validated = validateRegistryPackageResponse(result.data);
+  if (!validated.ok) {
+    return { ok: false, error: upgradeMessages.fetchError(validated.error) };
+  }
+  if (validated.version !== version) {
+    return {
+      ok: false,
+      error: upgradeMessages.fetchError(upgradeMessages.unexpectedPublishedVersion({
+        expected: version,
+        actual: validated.version
+      }))
+    };
+  }
+  return { ok: true };
+}
+async function analyseConfigFiles(paths, port) {
+  const files = [];
+  const localOpenteamEntries = [];
+  let foundConfigFile = false;
+  for (const path of paths) {
+    let content;
+    try {
+      content = await port.readOpencodeConfigFile(path);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      return {
+        files,
+        foundConfigFile,
+        localOpenteamEntries,
+        parseError: upgradeMessages.readConfigError(path, message)
+      };
+    }
+    if (content === undefined) {
+      continue;
+    }
+    foundConfigFile = true;
+    const parsed = parseConfigDocument(path, content);
+    if (!parsed.ok) {
+      return {
+        files,
+        foundConfigFile,
+        localOpenteamEntries,
+        parseError: parsed.error
+      };
+    }
+    const pluginValue = parsed.value[PLUGIN_KEY];
+    if (pluginValue === undefined) {
+      continue;
+    }
+    if (!Array.isArray(pluginValue)) {
+      return {
+        files,
+        foundConfigFile,
+        localOpenteamEntries,
+        parseError: upgradeMessages.pluginFieldMustBeArray(path)
+      };
+    }
+    const managedCandidates = [];
+    for (let index = 0;index < pluginValue.length; index += 1) {
+      const entry = pluginValue[index];
+      const spec = extractSpecString(entry);
+      if (spec === undefined) {
+        continue;
+      }
+      if (isLocalFileSpec(spec)) {
+        const localKind = await port.classifyLocalPluginSpec({
+          configPath: path,
+          spec
+        });
+        if (localKind === "ours") {
+          localOpenteamEntries.push({ path, spec });
+        }
+        continue;
+      }
+      if (!isOurSpec(spec)) {
+        continue;
+      }
+      managedCandidates.push({
+        currentVersion: currentPinnedVersion(spec),
+        entry,
+        index,
+        spec
+      });
+    }
+    if (managedCandidates.length === 0) {
+      continue;
+    }
+    const pluginArray = findTopLevelPluginArray(content);
+    if (pluginArray === undefined) {
+      return {
+        files,
+        foundConfigFile,
+        localOpenteamEntries,
+        parseError: upgradeMessages.pluginArrayEditUnavailable(path)
+      };
+    }
+    const elementSpans = scanTopLevelArrayElements(content, pluginArray.start, pluginArray.end);
+    if (elementSpans === undefined || elementSpans.length !== pluginValue.length) {
+      return {
+        files,
+        foundConfigFile,
+        localOpenteamEntries,
+        parseError: upgradeMessages.pluginArrayEditUnavailable(path)
+      };
+    }
+    const replacements = [];
+    for (const candidate of managedCandidates) {
+      const elementSpan = elementSpans[candidate.index];
+      if (elementSpan === undefined) {
+        return {
+          files,
+          foundConfigFile,
+          localOpenteamEntries,
+          parseError: upgradeMessages.pluginArrayEditUnavailable(path)
+        };
+      }
+      const specSpan = findEntrySpecStringSpan(content, elementSpan, candidate.entry, candidate.spec);
+      if (specSpan === undefined) {
+        return {
+          files,
+          foundConfigFile,
+          localOpenteamEntries,
+          parseError: upgradeMessages.pluginArrayEditUnavailable(path)
+        };
+      }
+      replacements.push({
+        ...specSpan,
+        currentVersion: candidate.currentVersion
+      });
+    }
+    files.push({
+      currentVersions: replacements.map((replacement) => replacement.currentVersion),
+      path,
+      originalContent: content,
+      replacements
+    });
+  }
+  return {
+    files,
+    foundConfigFile,
+    localOpenteamEntries,
+    parseError: undefined
+  };
+}
+function renderArgError(error) {
+  return {
+    exitCode: 1,
+    stdout: [
+      upgradeMessages.header,
+      upgradeMessages.invalidArguments(error),
+      "",
+      upgradeMessages.usageLabel,
+      upgradeMessages.help.usage
+    ].join(`
+`)
+  };
+}
+function renderFailedWrites(localWarnings, failed) {
+  return {
+    exitCode: 1,
+    stdout: [
+      upgradeMessages.header,
+      ...localWarnings,
+      upgradeMessages.nothingChanged,
+      ...failed.map((entry) => upgradeMessages.failedEntry(entry)),
+      "",
+      upgradeMessages.rerunAfterFailures
+    ].join(`
+`)
+  };
+}
+function renderPartialSuccess(version, localWarnings, written, failed) {
+  return {
+    exitCode: 1,
+    stdout: [
+      upgradeMessages.header,
+      ...localWarnings,
+      upgradeMessages.partialHeader(version),
+      ...written.map((path) => upgradeMessages.writtenEntry(path)),
+      upgradeMessages.partialFailuresHeader,
+      ...failed.map((entry) => upgradeMessages.failedEntry(entry)),
+      "",
+      upgradeMessages.backupNote(UPGRADE_BACKUP_DIRECTORY),
+      upgradeMessages.resolveFailuresBeforeRestart
+    ].join(`
+`)
+  };
+}
+function renderSuccess(version, localWarnings, written) {
+  return {
+    exitCode: 0,
+    stdout: [
+      upgradeMessages.header,
+      ...localWarnings,
+      upgradeMessages.updatedHeader(version),
+      ...written.map((path) => upgradeMessages.writtenEntry(path)),
+      "",
+      upgradeMessages.backupNote(UPGRADE_BACKUP_DIRECTORY),
+      upgradeMessages.restartHint,
+      upgradeMessages.cacheCleanupHint
+    ].join(`
+`)
+  };
+}
+function resolveProjectPath(workspaceRoot, configPath) {
+  const absoluteRoot = resolve3(workspaceRoot);
+  const absolutePath = resolve3(absoluteRoot, configPath);
+  const rel = relative(absoluteRoot, absolutePath);
+  if (rel === "" || rel.startsWith("..") || win32.isAbsolute(rel)) {
+    throw new Error("path-outside-root");
+  }
+  return absolutePath;
+}
+function resolveLocalSpecPath(workspaceRoot, configPath, spec) {
+  if (spec.toLowerCase().startsWith("file:")) {
+    try {
+      return fileURLToPath(new URL(spec));
+    } catch {
+      return;
+    }
+  }
+  if (win32.isAbsolute(spec)) {
+    return spec;
+  }
+  const configAbsolutePath = resolveProjectPath(workspaceRoot, configPath);
+  return resolve3(dirname4(configAbsolutePath), spec);
+}
+async function readPackageManifestName(packageJsonPath) {
+  let content;
+  try {
+    content = await readFile2(packageJsonPath, "utf8");
+  } catch (error) {
+    return isMissingFile(error) ? { kind: "missing" } : { kind: "invalid" };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(content);
+  } catch {
+    return { kind: "invalid" };
+  }
+  if (!isRecord3(parsed) || typeof parsed.name !== "string") {
+    return { kind: "invalid" };
+  }
+  return { kind: "name", name: parsed.name };
+}
+async function manifestSearchStart(targetPath, spec) {
+  try {
+    const stats = await lstat(targetPath);
+    return stats.isDirectory() ? targetPath : dirname4(targetPath);
+  } catch {
+    return spec.endsWith("/") || spec.endsWith("\\") ? targetPath : dirname4(targetPath);
+  }
+}
+function splitRelativeProjectPath(workspaceRoot, targetPath) {
+  const rel = relative(workspaceRoot, targetPath);
+  if (rel === "") {
+    return [];
+  }
+  if (rel.startsWith("..") || win32.isAbsolute(rel)) {
+    throw new Error("path-outside-root");
+  }
+  return rel.split(/[\\/]+/u).filter((segment) => segment.length > 0);
+}
+async function validateExistingAncestorDirectories(workspaceRoot, targetDirectoryPath) {
+  const absoluteRoot = resolve3(workspaceRoot);
+  const rootStats = await lstat(absoluteRoot);
+  if (!rootStats.isDirectory() || rootStats.isSymbolicLink()) {
+    throw new Error(upgradeMessages.unsafeFilesystemEntry);
+  }
+  let current = absoluteRoot;
+  for (const segment of splitRelativeProjectPath(absoluteRoot, targetDirectoryPath)) {
+    current = join9(current, segment);
+    let stats;
+    try {
+      stats = await lstat(current);
+    } catch (error) {
+      if (isMissingFile(error)) {
+        return false;
+      }
+      throw error;
+    }
+    if (!stats.isDirectory() || stats.isSymbolicLink()) {
+      throw new Error(upgradeMessages.unsafeFilesystemEntry);
+    }
+  }
+  return true;
+}
+async function ensurePrivateDirectoryChain(workspaceRoot, targetDirectoryPath) {
+  const absoluteRoot = resolve3(workspaceRoot);
+  const rootStats = await lstat(absoluteRoot);
+  if (!rootStats.isDirectory() || rootStats.isSymbolicLink()) {
+    throw new Error(upgradeMessages.backupLocationUnavailable(UPGRADE_BACKUP_DIRECTORY));
+  }
+  let current = absoluteRoot;
+  for (const segment of splitRelativeProjectPath(absoluteRoot, targetDirectoryPath)) {
+    current = join9(current, segment);
+    try {
+      const stats = await lstat(current);
+      if (!stats.isDirectory() || stats.isSymbolicLink()) {
+        throw new Error(upgradeMessages.backupLocationUnavailable(UPGRADE_BACKUP_DIRECTORY));
+      }
+      continue;
+    } catch (error) {
+      if (!isMissingFile(error)) {
+        throw error;
+      }
+    }
+    try {
+      await mkdir2(current, { mode: PRIVATE_DIRECTORY_MODE });
+    } catch (error) {
+      if (!isAlreadyExistsFile(error)) {
+        throw error;
+      }
+      const stats = await lstat(current);
+      if (!stats.isDirectory() || stats.isSymbolicLink()) {
+        throw new Error(upgradeMessages.backupLocationUnavailable(UPGRADE_BACKUP_DIRECTORY));
+      }
+    }
+  }
+}
+async function readSafeTextFileSnapshot(workspaceRoot, diskPath) {
+  const parentsExist = await validateExistingAncestorDirectories(workspaceRoot, dirname4(diskPath));
+  if (!parentsExist) {
+    return;
+  }
+  let stats;
+  try {
+    stats = await lstat(diskPath);
+  } catch (error) {
+    if (isMissingFile(error)) {
+      return;
+    }
+    throw error;
+  }
+  if (!stats.isFile() || stats.isSymbolicLink()) {
+    throw new Error(upgradeMessages.unsafeFilesystemEntry);
+  }
+  const content = await readFile2(diskPath, "utf8");
+  return {
+    content,
+    gid: stats.gid,
+    mode: stats.mode & 511,
+    uid: stats.uid
+  };
+}
+async function writePrivateTextFile(path, content, flags) {
+  const handle = await open(path, flags, PRIVATE_FILE_MODE);
+  try {
+    await handle.writeFile(content, "utf8");
+    await handle.sync();
+  } finally {
+    await handle.close();
+  }
+}
+async function writeAtomicPrivateFile(path, content, finalMode, options) {
+  const temporary = join9(dirname4(path), `.${basename2(path)}.${randomUUID()}.next`);
+  const handle = await open(temporary, "wx", PRIVATE_FILE_MODE);
+  try {
+    if (process.platform !== "win32") {
+      if (finalMode !== PRIVATE_FILE_MODE) {
+        await handle.chmod(finalMode);
+      }
+      const owner = options?.originalOwner;
+      if (owner !== undefined) {
+        await handle.chown(owner.uid, owner.gid);
+      }
+    }
+    await handle.writeFile(content, "utf8");
+    await handle.sync();
+  } catch (error) {
+    await handle.close();
+    await rm2(temporary, { force: true }).catch(() => {});
+    throw error;
+  }
+  await handle.close();
+  try {
+    await rename(temporary, path);
+    options?.onReplaced?.();
+  } finally {
+    await rm2(temporary, { force: true }).catch(() => {});
+  }
+}
+async function replaceWindowsFilePreservingAcl(sourcePath, destinationPath, backupPath, displayPath) {
+  const script = `$ErrorActionPreference = 'Stop'; $source = $env:OPENTEAM_UPGRADE_SOURCE; $destination = $env:OPENTEAM_UPGRADE_DESTINATION; $backup = $env:OPENTEAM_UPGRADE_BACKUP; if ([string]::IsNullOrEmpty($backup)) { [System.IO.File]::Replace($source, $destination, $null) } else { [System.IO.File]::Replace($source, $destination, $backup) }`;
+  try {
+    await execFileAsync2(WINDOWS_POWERSHELL_EXE, ["-NoProfile", "-NonInteractive", "-Command", script], {
+      encoding: "utf8",
+      env: {
+        ...process.env,
+        OPENTEAM_UPGRADE_BACKUP: backupPath ?? "",
+        OPENTEAM_UPGRADE_DESTINATION: destinationPath,
+        OPENTEAM_UPGRADE_SOURCE: sourcePath
+      },
+      timeout: WINDOWS_PS_TIMEOUT_MS,
+      windowsHide: true
+    });
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new Error(upgradeMessages.windowsReplaceFailed(displayPath, message));
+  }
+}
+async function applyWindowsFileDaclToTemp(sourcePath, targetPath, displayPath) {
+  const script = `$ErrorActionPreference = 'Stop'; $source = $env:OPENTEAM_UPGRADE_ACL_SOURCE; $target = $env:OPENTEAM_UPGRADE_ACL_TARGET; $acl = New-Object System.Security.AccessControl.FileSecurity($source, [System.Security.AccessControl.AccessControlSections]::Access); $acl.SetAccessRuleProtection($acl.AreAccessRulesProtected, $acl.AreAccessRulesCanonical); [System.IO.File]::SetAccessControl($target, $acl)`;
+  try {
+    await execFileAsync2(WINDOWS_POWERSHELL_EXE, ["-NoProfile", "-NonInteractive", "-Command", script], {
+      encoding: "utf8",
+      env: {
+        ...process.env,
+        OPENTEAM_UPGRADE_ACL_SOURCE: sourcePath,
+        OPENTEAM_UPGRADE_ACL_TARGET: targetPath
+      },
+      timeout: WINDOWS_PS_TIMEOUT_MS,
+      windowsHide: true
+    });
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new Error(upgradeMessages.windowsDaclPrepFailed(displayPath, message));
+  }
+}
+async function writeWindowsFileReplacingPreservedAcl(destinationPath, content, backupPath, displayPath) {
+  const temporary = join9(dirname4(destinationPath), `.${basename2(destinationPath)}.${randomUUID()}.next`);
+  const handle = await open(temporary, "wx", PRIVATE_FILE_MODE);
+  try {
+    await applyWindowsFileDaclToTemp(destinationPath, temporary, displayPath);
+    await handle.writeFile(content, "utf8");
+    await handle.sync();
+  } catch (error) {
+    await handle.close();
+    await rm2(temporary, { force: true }).catch(() => {});
+    throw error;
+  }
+  await handle.close();
+  try {
+    await replaceWindowsFilePreservingAcl(temporary, destinationPath, backupPath, displayPath);
+  } finally {
+    await rm2(temporary, { force: true }).catch(() => {});
+  }
+}
+function backupFileNameForConfig(configPath, content) {
+  const safeStem = configPath.replace(/^[./\\]+/u, "").replace(/[\\/]+/gu, "__").replace(/[^A-Za-z0-9._-]/gu, "_");
+  const stem = safeStem === "" ? "opencode" : safeStem;
+  const digest = createHash2("sha256").update(content).digest("hex").slice(0, 12);
+  return `${stem}.${digest}${UPGRADE_BACKUP_SUFFIX}`;
+}
+async function ensureUpgradeBackupRoot(workspaceRoot) {
+  const backupRoot = resolveProjectPath(workspaceRoot, UPGRADE_BACKUP_DIRECTORY);
+  await ensurePrivateDirectoryChain(workspaceRoot, backupRoot);
+  if (process.platform !== "win32") {
+    const dirStats = await lstat(backupRoot);
+    if ((dirStats.mode & 511) !== PRIVATE_DIRECTORY_MODE) {
+      await chmod(backupRoot, PRIVATE_DIRECTORY_MODE);
+    }
+  }
+  const ignorePath = join9(backupRoot, ".gitignore");
+  const ignoreFile = await readSafeTextFileSnapshot(workspaceRoot, ignorePath);
+  if (ignoreFile !== undefined) {
+    if (ignoreFile.content !== UPGRADE_BACKUP_GITIGNORE_CONTENT) {
+      throw new Error(upgradeMessages.backupGitignoreUnexpected(UPGRADE_BACKUP_DIRECTORY));
+    }
+    return backupRoot;
+  }
+  try {
+    await writePrivateTextFile(ignorePath, UPGRADE_BACKUP_GITIGNORE_CONTENT, "wx");
+  } catch (error) {
+    if (!isAlreadyExistsFile(error)) {
+      throw error;
+    }
+    const concurrent = await readSafeTextFileSnapshot(workspaceRoot, ignorePath);
+    if (concurrent === undefined) {
+      throw error;
+    }
+    if (concurrent.content !== UPGRADE_BACKUP_GITIGNORE_CONTENT) {
+      throw new Error(upgradeMessages.backupGitignoreUnexpected(UPGRADE_BACKUP_DIRECTORY));
+    }
+  }
+  return backupRoot;
+}
+async function ensureUpgradeBackupFile(workspaceRoot, configPath, expectedContent) {
+  try {
+    await ensureUpgradeBackupRoot(workspaceRoot);
+  } catch {
+    throw new Error(upgradeMessages.backupLocationUnavailable(UPGRADE_BACKUP_DIRECTORY));
+  }
+  const backupRelativePath = `${UPGRADE_BACKUP_DIRECTORY}/` + backupFileNameForConfig(configPath, expectedContent);
+  const backupDiskPath = resolveProjectPath(workspaceRoot, backupRelativePath);
+  let existingBackup;
+  try {
+    existingBackup = await readSafeTextFileSnapshot(workspaceRoot, backupDiskPath);
+  } catch {
+    throw new Error(upgradeMessages.backupLocationUnavailable(UPGRADE_BACKUP_DIRECTORY));
+  }
+  if (existingBackup !== undefined) {
+    if (existingBackup.content !== expectedContent) {
+      throw new Error(upgradeMessages.backupConflict(backupRelativePath));
+    }
+    return { created: false, diskPath: backupDiskPath, reuseExisting: true };
+  }
+  if (process.platform === "win32") {
+    return { created: false, diskPath: backupDiskPath, reuseExisting: false };
+  }
+  try {
+    await writeAtomicPrivateFile(backupDiskPath, expectedContent, PRIVATE_FILE_MODE);
+  } catch {
+    throw new Error(upgradeMessages.backupLocationUnavailable(UPGRADE_BACKUP_DIRECTORY));
+  }
+  return { created: true, diskPath: backupDiskPath, reuseExisting: false };
+}
+async function readExpectedConfigSnapshot(workspaceRoot, configPath, expectedContent) {
+  const diskPath = resolveProjectPath(workspaceRoot, configPath);
+  const snapshot = await readSafeTextFileSnapshot(workspaceRoot, diskPath);
+  if (snapshot === undefined) {
+    throw new Error(upgradeMessages.writeTargetMissing(configPath));
+  }
+  if (snapshot.content !== expectedContent) {
+    throw new Error(upgradeMessages.concurrentEdit(configPath));
+  }
+  return snapshot;
+}
+function createFsUpgradePort(workspaceRoot, fetch) {
+  return {
+    async readOpencodeConfigFile(path) {
+      const diskPath = resolveProjectPath(workspaceRoot, path);
+      const snapshot = await readSafeTextFileSnapshot(workspaceRoot, diskPath);
+      return snapshot?.content;
+    },
+    async writeOpencodeConfigFile(request) {
+      const diskPath = resolveProjectPath(workspaceRoot, request.path);
+      await readExpectedConfigSnapshot(workspaceRoot, request.path, request.expectedContent);
+      const backup = await ensureUpgradeBackupFile(workspaceRoot, request.path, request.expectedContent);
+      let configWritten = false;
+      try {
+        const current = await readExpectedConfigSnapshot(workspaceRoot, request.path, request.expectedContent);
+        if (process.platform === "win32") {
+          await writeWindowsFileReplacingPreservedAcl(diskPath, request.nextContent, backup.reuseExisting ? undefined : backup.diskPath, request.path);
+          configWritten = true;
+        } else {
+          await writeAtomicPrivateFile(diskPath, request.nextContent, current.mode, {
+            originalOwner: { gid: current.gid, uid: current.uid },
+            onReplaced: () => {
+              configWritten = true;
+            }
+          });
+        }
+      } catch (error) {
+        if (backup.created && !configWritten) {
+          await rm2(backup.diskPath, { force: true }).catch(() => {});
+        }
+        throw error;
+      }
+    },
+    async classifyLocalPluginSpec({ configPath, spec }) {
+      const resolved = resolveLocalSpecPath(workspaceRoot, configPath, spec);
+      if (resolved === undefined) {
+        return "unknown";
+      }
+      let current = await manifestSearchStart(resolved, spec);
+      while (true) {
+        const manifest = await readPackageManifestName(join9(current, "package.json"));
+        if (manifest.kind === "name") {
+          return manifest.name === OPENTEAM_PACKAGE_NAME ? "ours" : "other";
+        }
+        if (manifest.kind === "invalid") {
+          return "unknown";
+        }
+        const parent = dirname4(current);
+        if (parent === current) {
+          return "unknown";
+        }
+        current = parent;
+      }
+    },
+    fetch
+  };
+}
+async function runUpgrade(positionals, port, opencodeConfigPaths) {
+  const parsedArgs = parseUpgradePositionals(positionals);
+  if (!parsedArgs.ok) {
+    return renderArgError(parsedArgs.error);
+  }
+  const explicitVersion = parsedArgs.value.targetVersion;
+  if (explicitVersion !== undefined && !isStrictSemver(explicitVersion)) {
+    return {
+      exitCode: 1,
+      stdout: [upgradeMessages.header, upgradeMessages.invalidVersion(explicitVersion)].join(`
+`)
+    };
+  }
+  const analysis = await analyseConfigFiles(opencodeConfigPaths, port);
+  if (analysis.parseError !== undefined) {
+    return {
+      exitCode: 1,
+      stdout: [upgradeMessages.header, analysis.parseError].join(`
+`)
+    };
+  }
+  if (analysis.files.length === 0) {
+    if (analysis.localOpenteamEntries.length > 0) {
+      return {
+        exitCode: 1,
+        stdout: [
+          upgradeMessages.header,
+          upgradeMessages.localFileOnlyHeader,
+          ...analysis.localOpenteamEntries.map((entry) => upgradeMessages.localFileOnlyEntry(entry)),
+          upgradeMessages.localFileOnlyRemedy
+        ].join(`
+`)
+      };
+    }
+    return {
+      exitCode: 1,
+      stdout: [
+        upgradeMessages.header,
+        analysis.foundConfigFile ? upgradeMessages.noPluginEntry : upgradeMessages.noConfigFound(opencodeConfigPaths)
+      ].join(`
+`)
+    };
+  }
+  let targetVersion;
+  if (explicitVersion !== undefined) {
+    const verified = await verifyVersionExists(explicitVersion, port.fetch);
+    if (!verified.ok) {
+      return { exitCode: 1, stdout: [upgradeMessages.header, verified.error].join(`
+`) };
+    }
+    targetVersion = explicitVersion;
+  } else {
+    const latest = await fetchLatestVersion(port.fetch);
+    if (!latest.ok) {
+      return { exitCode: 1, stdout: [upgradeMessages.header, latest.error].join(`
+`) };
+    }
+    targetVersion = latest.version;
+  }
+  const localWarnings = analysis.localOpenteamEntries.map((entry) => upgradeMessages.localFileSkipped(entry));
+  if (explicitVersion === undefined) {
+    for (const file of analysis.files) {
+      for (const currentVersion of file.currentVersions) {
+        if (currentVersion !== null && isStrictSemver(currentVersion) && compareSemver(currentVersion, targetVersion) > 0) {
+          return {
+            exitCode: 1,
+            stdout: [
+              upgradeMessages.header,
+              upgradeMessages.noDowngrade({
+                current: currentVersion,
+                target: targetVersion
+              })
+            ].join(`
+`)
+          };
+        }
+      }
+    }
+  }
+  if (parsedArgs.value.check) {
+    const lines = [upgradeMessages.header];
+    let needsUpdate = false;
+    for (const file of analysis.files) {
+      for (const currentVersion of file.currentVersions) {
+        if (currentVersion === targetVersion) {
+          lines.push(upgradeMessages.checkAlreadyCurrent({
+            path: file.path,
+            version: targetVersion
+          }));
+        } else {
+          lines.push(upgradeMessages.checkNeedsUpdate({
+            path: file.path,
+            current: currentVersion,
+            target: targetVersion
+          }));
+          needsUpdate = true;
+        }
+      }
+    }
+    lines.push(...localWarnings);
+    if (needsUpdate) {
+      lines.push(upgradeMessages.checkHint(explicitVersion));
+    }
+    return { exitCode: 0, stdout: lines.join(`
+`) };
+  }
+  const nextSpec = pinnedPluginSpec(targetVersion);
+  const plans = [];
+  for (const file of analysis.files) {
+    const nextContent = buildUpdatedContent(file.originalContent, file.replacements, nextSpec);
+    if (nextContent === file.originalContent) {
+      continue;
+    }
+    const validationError = validateEffectivePluginUpdate(file.path, nextContent, file.replacements.length, nextSpec);
+    if (validationError !== undefined) {
+      return {
+        exitCode: 1,
+        stdout: [upgradeMessages.header, validationError].join(`
+`)
+      };
+    }
+    plans.push({
+      path: file.path,
+      expectedContent: file.originalContent,
+      nextContent
+    });
+  }
+  if (plans.length === 0) {
+    return {
+      exitCode: 0,
+      stdout: [
+        upgradeMessages.header,
+        ...localWarnings,
+        upgradeMessages.alreadyCurrent(targetVersion)
+      ].join(`
+`)
+    };
+  }
+  const written = [];
+  const failed = [];
+  for (const plan2 of plans) {
+    try {
+      await port.writeOpencodeConfigFile(plan2);
+      written.push(plan2.path);
+    } catch (error) {
+      failed.push({
+        path: plan2.path,
+        error: error instanceof Error ? error.message : String(error)
+      });
+    }
+  }
+  if (failed.length === 0) {
+    return renderSuccess(targetVersion, localWarnings, written);
+  }
+  if (written.length === 0) {
+    return renderFailedWrites(localWarnings, failed);
+  }
+  return renderPartialSuccess(targetVersion, localWarnings, written, failed);
+}
+
+// src/config/graphFeatureGate.ts
+function checkCertificate(status, name) {
+  if (status.status === "absent") {
+    return {
+      code: `${name}-certificate-absent`,
+      detail: `${name} certificate not found — run the ${name} certification suite to produce it`
+    };
+  }
+  if (status.status === "invalid") {
+    return {
+      code: `${name}-certificate-invalid`,
+      detail: `${name} certificate rejected by recomputing parser: ${status.code} — ${status.detail}`
+    };
+  }
+  return;
+}
+function evaluateGraphGate(input) {
+  const violations = [];
+  const advisories = [];
+  const shadowV = checkCertificate(input.shadow, "shadow");
+  if (shadowV !== undefined)
+    violations.push(shadowV);
+  const releaseV = checkCertificate(input.release, "release");
+  if (releaseV !== undefined)
+    violations.push(releaseV);
+  const soakV = checkCertificate(input.soak, "soak");
+  if (soakV !== undefined)
+    advisories.push(soakV);
+  if (input.migration === "pending") {
+    violations.push({
+      code: "migration-pending",
+      detail: "legacy migration has pending work — run the migration tool to completion before enabling active mode"
+    });
+  } else if (input.migration === "unknown") {
+    violations.push({
+      code: "migration-unknown",
+      detail: "could not determine migration status — check ledger readability and storage access"
+    });
+  }
+  if (!input.operatorApproval) {
+    violations.push({
+      code: "operator-approval-missing",
+      detail: "set graph.operatorApproval to true in .opencode/openteam.json after reviewing all certificates and completing migration — this is a declaration of intent, not a proof"
+    });
+  }
+  return {
+    allowed: violations.length === 0,
+    violations,
+    advisories
+  };
+}
+function isGateApplicable(mode) {
+  return mode === "active";
+}
+
+// src/config/opencode.ts
+function stripJsoncComments(src) {
+  const out = [];
+  let i = 0;
+  while (i < src.length) {
+    const ch = src[i];
+    if (ch === undefined)
+      break;
+    if (ch === '"') {
+      out.push(ch);
+      i++;
+      while (i < src.length) {
+        const c = src[i];
+        if (c === undefined)
+          break;
+        out.push(c);
+        i++;
+        if (c === "\\") {
+          const escaped = src[i];
+          if (escaped !== undefined) {
+            out.push(escaped);
+            i++;
+          }
+        } else if (c === '"') {
+          break;
+        }
+      }
+    } else if (ch === "/" && i + 1 < src.length) {
+      if (src[i + 1] === "/") {
+        i += 2;
+        while (i < src.length && src[i] !== `
+`) {
+          i++;
+        }
+      } else if (src[i + 1] === "*") {
+        i += 2;
+        while (i < src.length && !(src[i] === "*" && src[i + 1] === "/")) {
+          i++;
+        }
+        if (i < src.length) {
+          i += 2;
+        }
+      } else {
+        out.push(ch);
+        i++;
+      }
+    } else {
+      out.push(ch);
+      i++;
+    }
+  }
+  return out.join("");
+}
+function isRecord4(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+var OPENCODE_CONFIG_CANDIDATES = [
+  ".opencode/opencode.json",
+  "opencode.json"
+];
+function mergeOpencodeConfigs(base, override) {
+  const result = { ...base };
+  for (const [key, value] of Object.entries(override)) {
+    const baseVal = result[key];
+    if (isRecord4(baseVal) && isRecord4(value)) {
+      result[key] = mergeOpencodeConfigs(baseVal, value);
+    } else {
+      result[key] = value;
+    }
+  }
+  return result;
+}
+
+// src/graph/certificate.ts
+import { z as z17 } from "zod";
+
+// src/contract/opencode.ts
+var SUPPORTED_OPENCODE_VERSIONS = [
+  "1.17.13",
+  "1.18.18",
+  "1.18.19"
+];
+var SEMVER_RE = /^(\d+)\.(\d+)\.(\d+)/;
+function parseSemver(version) {
+  const normalized = version.trim().replace(/^[=^~v]+/, "");
+  const match = SEMVER_RE.exec(normalized);
+  if (match === null) {
+    throw new Error(`invalid semver: "${version}"`);
+  }
+  return {
+    major: Number(match[1]),
+    minor: Number(match[2]),
     patch: Number(match[3])
   };
 }
@@ -5486,31 +7437,31 @@ function isCertificateVersionCompatible(certifiedVersion, liveVersion) {
 }
 
 // src/graph/soakLedger.ts
-import { z as z15 } from "zod";
-var Sha256Schema2 = z15.string().regex(/^[0-9a-f]{64}$/);
-var SoakPlatformSchema = z15.enum(["linux", "win32", "darwin"]);
-var PrivacyPairSchema = z15.object({
-  surfacesScanned: z15.number().int().nonnegative(),
-  rawFindings: z15.number().int().nonnegative()
+import { z as z16 } from "zod";
+var Sha256Schema2 = z16.string().regex(/^[0-9a-f]{64}$/);
+var SoakPlatformSchema = z16.enum(["linux", "win32", "darwin"]);
+var PrivacyPairSchema = z16.object({
+  surfacesScanned: z16.number().int().nonnegative(),
+  rawFindings: z16.number().int().nonnegative()
 }).strict();
-var DuplicateEffectPairSchema = z15.object({
-  effectsExamined: z15.number().int().nonnegative(),
-  duplicatesFound: z15.number().int().nonnegative()
+var DuplicateEffectPairSchema = z16.object({
+  effectsExamined: z16.number().int().nonnegative(),
+  duplicatesFound: z16.number().int().nonnegative()
 }).strict();
-var ModelVerificationPairSchema = z15.object({
-  nodesChecked: z15.number().int().nonnegative(),
-  unverified: z15.number().int().nonnegative(),
-  mismatched: z15.number().int().nonnegative()
+var ModelVerificationPairSchema = z16.object({
+  nodesChecked: z16.number().int().nonnegative(),
+  unverified: z16.number().int().nonnegative(),
+  mismatched: z16.number().int().nonnegative()
 }).strict();
-var SoakObservationSchema = z15.object({
-  version: z15.literal(1),
-  seq: z15.number().int().nonnegative(),
-  timestamp: z15.string().datetime(),
+var SoakObservationSchema = z16.object({
+  version: z16.literal(1),
+  seq: z16.number().int().nonnegative(),
+  timestamp: z16.string().datetime(),
   platform: SoakPlatformSchema,
-  opencodeVersion: z15.string().min(1),
-  provenance: z15.enum(["genuine-usage", "ci-synthetic"]),
+  opencodeVersion: z16.string().min(1),
+  provenance: z16.enum(["genuine-usage", "ci-synthetic"]),
   traceDigest: Sha256Schema2,
-  criticalDivergences: z15.number().int().nonnegative().nullable(),
+  criticalDivergences: z16.number().int().nonnegative().nullable(),
   privacy: PrivacyPairSchema.nullable(),
   duplicateEffects: DuplicateEffectPairSchema.nullable(),
   modelVerification: ModelVerificationPairSchema.nullable(),
@@ -5581,7 +7532,7 @@ function canonicalLedger(chains) {
 
 // src/graph/certificate.ts
 var SHADOW_CERTIFICATE_MIN_RUNS = 1000;
-var DivergenceCodeSchema = z16.enum([
+var DivergenceCodeSchema = z17.enum([
   "status",
   "order",
   "roles",
@@ -5589,50 +7540,50 @@ var DivergenceCodeSchema = z16.enum([
   "fixes",
   "outcome"
 ]);
-var ProvenanceSchema = z16.enum([
+var ProvenanceSchema = z17.enum([
   "recomputed",
   "compiled",
   "validated",
   "carried"
 ]);
-var EvidenceSchema = z16.object({
-  opencodeVersion: z16.string().min(1),
-  parity: z16.object({
-    runs: z16.number().int().nonnegative(),
-    match: z16.number().int().nonnegative(),
-    divergent: z16.number().int().nonnegative(),
-    inconclusive: z16.number().int().nonnegative(),
-    divergences: z16.array(DivergenceCodeSchema)
+var EvidenceSchema = z17.object({
+  opencodeVersion: z17.string().min(1),
+  parity: z17.object({
+    runs: z17.number().int().nonnegative(),
+    match: z17.number().int().nonnegative(),
+    divergent: z17.number().int().nonnegative(),
+    inconclusive: z17.number().int().nonnegative(),
+    divergences: z17.array(DivergenceCodeSchema)
   }).strict(),
-  legacy: z16.object({
-    observed: z16.number().int().nonnegative(),
-    duplicated: z16.number().int().nonnegative()
+  legacy: z17.object({
+    observed: z17.number().int().nonnegative(),
+    duplicated: z17.number().int().nonnegative()
   }).strict(),
-  privacy: z16.object({
-    surfacesScanned: z16.number().int().nonnegative(),
-    rawFindings: z16.number().int().nonnegative()
+  privacy: z17.object({
+    surfacesScanned: z17.number().int().nonnegative(),
+    rawFindings: z17.number().int().nonnegative()
   }).strict(),
-  overhead: z16.object({
-    p95Millis: z16.number().nonnegative(),
-    budgetMillis: z16.number().positive(),
-    samples: z16.number().int().nonnegative()
+  overhead: z17.object({
+    p95Millis: z17.number().nonnegative(),
+    budgetMillis: z17.number().positive(),
+    samples: z17.number().int().nonnegative()
   }).strict(),
-  provenance: z16.record(DivergenceCodeSchema, ProvenanceSchema)
+  provenance: z17.record(DivergenceCodeSchema, ProvenanceSchema)
 }).strict();
-var CertificateSchema = z16.object({
-  version: z16.literal(1),
-  certificate: z16.literal("graph-shadow"),
-  opencodeVersion: z16.string().min(1),
+var CertificateSchema = z17.object({
+  version: z17.literal(1),
+  certificate: z17.literal("graph-shadow"),
+  opencodeVersion: z17.string().min(1),
   evidence: EvidenceSchema,
-  verdict: z16.enum(["pass", "fail"]),
-  failedGates: z16.array(z16.enum([
+  verdict: z17.enum(["pass", "fail"]),
+  failedGates: z17.array(z17.enum([
     "sample",
     "parity",
     "one-legacy-execution",
     "privacy",
     "overhead"
   ])),
-  digest: z16.string().regex(/^[0-9a-f]{64}$/)
+  digest: z17.string().regex(/^[0-9a-f]{64}$/)
 }).strict();
 
 class ShadowCertificateError extends Error {
@@ -5747,37 +7698,37 @@ function parseShadowCertificate(value, opencodeVersion) {
   }
   return certificate;
 }
-var ReleaseDeterminismSchema = z16.object({ runs: z16.number().int().nonnegative(), allMatch: z16.boolean() }).strict();
-var ReleaseCrashRecoverySchema = z16.object({
-  scenarios: z16.number().int().nonnegative(),
-  allConverge: z16.boolean()
+var ReleaseDeterminismSchema = z17.object({ runs: z17.number().int().nonnegative(), allMatch: z17.boolean() }).strict();
+var ReleaseCrashRecoverySchema = z17.object({
+  scenarios: z17.number().int().nonnegative(),
+  allConverge: z17.boolean()
 }).strict();
-var ReleaseReplayEquivalenceSchema = z16.object({
-  checks: z16.number().int().nonnegative(),
-  allEquivalent: z16.boolean()
+var ReleaseReplayEquivalenceSchema = z17.object({
+  checks: z17.number().int().nonnegative(),
+  allEquivalent: z17.boolean()
 }).strict();
-var ReleasePrivacySchema = z16.object({
-  surfacesScanned: z16.number().int().nonnegative(),
-  rawFindings: z16.number().int().nonnegative()
+var ReleasePrivacySchema = z17.object({
+  surfacesScanned: z17.number().int().nonnegative(),
+  rawFindings: z17.number().int().nonnegative()
 }).strict();
-var ReleaseContractSchema = z16.object({
-  roundTrips: z16.number().int().nonnegative(),
-  allSettled: z16.boolean()
+var ReleaseContractSchema = z17.object({
+  roundTrips: z17.number().int().nonnegative(),
+  allSettled: z17.boolean()
 }).strict();
-var ReleaseHealthSchema = z16.object({
-  samples: z16.number().int().nonnegative(),
-  bounded: z16.boolean(),
-  idempotent: z16.boolean()
+var ReleaseHealthSchema = z17.object({
+  samples: z17.number().int().nonnegative(),
+  bounded: z17.boolean(),
+  idempotent: z17.boolean()
 }).strict();
-var ReleasePerformanceSchema = z16.object({
-  p95Millis: z16.number().nonnegative(),
-  budgetMillis: z16.number().positive(),
-  samples: z16.number().int().nonnegative()
+var ReleasePerformanceSchema = z17.object({
+  p95Millis: z17.number().nonnegative(),
+  budgetMillis: z17.number().positive(),
+  samples: z17.number().int().nonnegative()
 }).strict();
-var ReleaseEvidenceSchema = z16.object({
-  opencodeVersion: z16.string().min(1),
-  platform: z16.enum(["linux", "win32"]),
-  shadowCertificateDigest: z16.string().regex(/^[0-9a-f]{64}$/),
+var ReleaseEvidenceSchema = z17.object({
+  opencodeVersion: z17.string().min(1),
+  platform: z17.enum(["linux", "win32"]),
+  shadowCertificateDigest: z17.string().regex(/^[0-9a-f]{64}$/),
   determinism: ReleaseDeterminismSchema,
   crashRecovery: ReleaseCrashRecoverySchema,
   replayEquivalence: ReleaseReplayEquivalenceSchema,
@@ -5786,15 +7737,15 @@ var ReleaseEvidenceSchema = z16.object({
   health: ReleaseHealthSchema,
   performance: ReleasePerformanceSchema
 }).strict();
-var ReleaseCertificateSchema = z16.object({
-  version: z16.literal(2),
-  certificate: z16.literal("graph-release"),
-  platform: z16.enum(["linux", "win32"]),
-  opencodeVersion: z16.string().min(1),
-  shadowCertificateDigest: z16.string().regex(/^[0-9a-f]{64}$/),
+var ReleaseCertificateSchema = z17.object({
+  version: z17.literal(2),
+  certificate: z17.literal("graph-release"),
+  platform: z17.enum(["linux", "win32"]),
+  opencodeVersion: z17.string().min(1),
+  shadowCertificateDigest: z17.string().regex(/^[0-9a-f]{64}$/),
   evidence: ReleaseEvidenceSchema,
-  verdict: z16.enum(["pass", "fail"]),
-  failedGates: z16.array(z16.enum([
+  verdict: z17.enum(["pass", "fail"]),
+  failedGates: z17.array(z17.enum([
     "shadow-valid",
     "determinism",
     "crash-recovery",
@@ -5804,7 +7755,7 @@ var ReleaseCertificateSchema = z16.object({
     "health",
     "performance"
   ])),
-  digest: z16.string().regex(/^[0-9a-f]{64}$/)
+  digest: z17.string().regex(/^[0-9a-f]{64}$/)
 }).strict();
 
 class ReleaseCertificateError extends Error {
@@ -5932,7 +7883,7 @@ function parseReleaseCertificate(value, opencodeVersion, expectedShadowDigest) {
   }
   return certificate;
 }
-var ShadowDivergenceCodeSchema = z16.enum([
+var ShadowDivergenceCodeSchema = z17.enum([
   "status",
   "order",
   "roles",
@@ -5941,13 +7892,13 @@ var ShadowDivergenceCodeSchema = z16.enum([
   "outcome"
 ]);
 var RECOMPUTED_DIVERGENCE_CODES = ["fixes"];
-var RecomputedDivergenceCodeSchema = z16.enum(RECOMPUTED_DIVERGENCE_CODES);
-var SoakPolicySchema = z16.object({
-  minimumGenuineObservations: z16.number().int().positive(),
-  minimumDistinctDays: z16.number().int().positive(),
-  requireGenuineUsageOnAllPlatforms: z16.boolean(),
-  supportedOpencodeVersions: z16.array(z16.string().min(1)).min(1),
-  criticalDivergenceCodes: z16.array(RecomputedDivergenceCodeSchema).min(1)
+var RecomputedDivergenceCodeSchema = z17.enum(RECOMPUTED_DIVERGENCE_CODES);
+var SoakPolicySchema = z17.object({
+  minimumGenuineObservations: z17.number().int().positive(),
+  minimumDistinctDays: z17.number().int().positive(),
+  requireGenuineUsageOnAllPlatforms: z17.boolean(),
+  supportedOpencodeVersions: z17.array(z17.string().min(1)).min(1),
+  criticalDivergenceCodes: z17.array(RecomputedDivergenceCodeSchema).min(1)
 }).strict();
 var DEFAULT_SOAK_POLICY = {
   minimumGenuineObservations: 100,
@@ -5956,46 +7907,46 @@ var DEFAULT_SOAK_POLICY = {
   supportedOpencodeVersions: [...SUPPORTED_OPENCODE_VERSIONS],
   criticalDivergenceCodes: ["fixes"]
 };
-var SoakPlatformEnumSchema = z16.enum(["linux", "win32", "darwin"]);
-var SoakPrivacyPairEvidenceSchema = z16.object({
-  surfacesScanned: z16.number().int().nonnegative(),
-  rawFindings: z16.number().int().nonnegative()
+var SoakPlatformEnumSchema = z17.enum(["linux", "win32", "darwin"]);
+var SoakPrivacyPairEvidenceSchema = z17.object({
+  surfacesScanned: z17.number().int().nonnegative(),
+  rawFindings: z17.number().int().nonnegative()
 }).strict();
-var SoakDuplicateEffectPairEvidenceSchema = z16.object({
-  effectsExamined: z16.number().int().nonnegative(),
-  duplicatesFound: z16.number().int().nonnegative()
+var SoakDuplicateEffectPairEvidenceSchema = z17.object({
+  effectsExamined: z17.number().int().nonnegative(),
+  duplicatesFound: z17.number().int().nonnegative()
 }).strict();
-var SoakModelVerificationPairEvidenceSchema = z16.object({
-  nodesChecked: z16.number().int().nonnegative(),
-  unverified: z16.number().int().nonnegative(),
-  mismatched: z16.number().int().nonnegative()
+var SoakModelVerificationPairEvidenceSchema = z17.object({
+  nodesChecked: z17.number().int().nonnegative(),
+  unverified: z17.number().int().nonnegative(),
+  mismatched: z17.number().int().nonnegative()
 }).strict();
-var SoakEvidenceSchema = z16.object({
-  totalObservations: z16.number().int().nonnegative(),
-  genuineUsageObservations: z16.number().int().nonnegative(),
-  ciSyntheticObservations: z16.number().int().nonnegative(),
-  recorderCount: z16.number().int().nonnegative(),
-  ineligibleObservations: z16.number().int().nonnegative(),
-  firstTimestamp: z16.string().datetime().nullable(),
-  lastTimestamp: z16.string().datetime().nullable(),
-  distinctDays: z16.number().int().nonnegative(),
-  criticalDivergences: z16.number().int().nonnegative().nullable(),
+var SoakEvidenceSchema = z17.object({
+  totalObservations: z17.number().int().nonnegative(),
+  genuineUsageObservations: z17.number().int().nonnegative(),
+  ciSyntheticObservations: z17.number().int().nonnegative(),
+  recorderCount: z17.number().int().nonnegative(),
+  ineligibleObservations: z17.number().int().nonnegative(),
+  firstTimestamp: z17.string().datetime().nullable(),
+  lastTimestamp: z17.string().datetime().nullable(),
+  distinctDays: z17.number().int().nonnegative(),
+  criticalDivergences: z17.number().int().nonnegative().nullable(),
   privacy: SoakPrivacyPairEvidenceSchema.nullable(),
   duplicateEffects: SoakDuplicateEffectPairEvidenceSchema.nullable(),
   modelVerification: SoakModelVerificationPairEvidenceSchema.nullable(),
-  platformsGenuine: z16.array(SoakPlatformEnumSchema),
-  platformsSynthetic: z16.array(SoakPlatformEnumSchema),
-  opencodeVersionsObserved: z16.array(z16.string().min(1)),
-  invalidChains: z16.number().int().nonnegative()
+  platformsGenuine: z17.array(SoakPlatformEnumSchema),
+  platformsSynthetic: z17.array(SoakPlatformEnumSchema),
+  opencodeVersionsObserved: z17.array(z17.string().min(1)),
+  invalidChains: z17.number().int().nonnegative()
 }).strict();
-var SoakCertificateSchema = z16.object({
-  version: z16.literal(1),
-  certificate: z16.literal("graph-soak"),
-  trustBoundary: z16.literal("contributors"),
+var SoakCertificateSchema = z17.object({
+  version: z17.literal(1),
+  certificate: z17.literal("graph-soak"),
+  trustBoundary: z17.literal("contributors"),
   policy: SoakPolicySchema,
   evidence: SoakEvidenceSchema,
-  verdict: z16.enum(["pass", "fail"]),
-  failedGates: z16.array(z16.enum([
+  verdict: z17.enum(["pass", "fail"]),
+  failedGates: z17.array(z17.enum([
     "minimum-observations",
     "minimum-duration",
     "chain-integrity",
@@ -6006,8 +7957,8 @@ var SoakCertificateSchema = z16.object({
     "os-diversity",
     "opencode-pin"
   ])),
-  ledgerDigest: z16.string().regex(/^[0-9a-f]{64}$/),
-  digest: z16.string().regex(/^[0-9a-f]{64}$/)
+  ledgerDigest: z17.string().regex(/^[0-9a-f]{64}$/),
+  digest: z17.string().regex(/^[0-9a-f]{64}$/)
 }).strict();
 
 class SoakCertificateError extends Error {
@@ -6133,7 +8084,7 @@ function parseSoakCertificate(value, expectedPolicy, expectedLedgerDigest) {
 }
 
 // src/lifecycle/root.ts
-import { isAbsolute, normalize, relative, resolve as resolve3 } from "node:path";
+import { isAbsolute, normalize, relative as relative2, resolve as resolve4 } from "node:path";
 
 // src/messages/lifecycleStorage.ts
 var lifecycleStorageMessages = {
@@ -6142,12 +8093,12 @@ var lifecycleStorageMessages = {
 
 // src/lifecycle/root.ts
 var resolveLifecycleRoot = (options) => {
-  const workspaceRoot = resolve3(options.workspaceRoot);
+  const workspaceRoot = resolve4(options.workspaceRoot);
   if (isAbsolute(options.configuredRoot)) {
-    return normalize(resolve3(options.configuredRoot));
+    return normalize(resolve4(options.configuredRoot));
   }
-  const resolved = resolve3(workspaceRoot, options.configuredRoot);
-  const workspaceRelative = relative(workspaceRoot, resolved);
+  const resolved = resolve4(workspaceRoot, options.configuredRoot);
+  const workspaceRelative = relative2(workspaceRoot, resolved);
   if (workspaceRelative === ".." || workspaceRelative.startsWith(`..\\`) || workspaceRelative.startsWith("../") || isAbsolute(workspaceRelative)) {
     throw new Error(lifecycleStorageMessages.configuredRootEscapesWorkspace);
   }
@@ -6155,16 +8106,16 @@ var resolveLifecycleRoot = (options) => {
 };
 
 // src/lifecycle/schema.ts
-import { z as z17 } from "zod";
-var nonEmptyString = z17.string().min(1);
-var nonNegativeInteger = z17.number().int().nonnegative();
-var positiveInteger = z17.number().int().positive();
-var modelSelectionSchema2 = z17.object({
+import { z as z18 } from "zod";
+var nonEmptyString = z18.string().min(1);
+var nonNegativeInteger = z18.number().int().nonnegative();
+var positiveInteger = z18.number().int().positive();
+var modelSelectionSchema2 = z18.object({
   providerID: nonEmptyString,
   modelID: nonEmptyString
 }).strict();
-var lifecycleFailureSchema = z17.object({
-  class: z17.enum([
+var lifecycleFailureSchema = z18.object({
+  class: z18.enum([
     "routing-blocked",
     "create-rejected",
     "create-no-id",
@@ -6186,25 +8137,25 @@ var lifecycleFailureSchema = z17.object({
     "interrupted",
     "unknown"
   ]),
-  statusCode: z17.number().int().min(100).max(599).optional(),
-  retryable: z17.boolean().optional()
+  statusCode: z18.number().int().min(100).max(599).optional(),
+  retryable: z18.boolean().optional()
 }).strict();
-var lifecycleRootOperationSchema = z17.object({
+var lifecycleRootOperationSchema = z18.object({
   operationID: nonEmptyString,
   taskID: nonEmptyString,
-  kind: z17.enum(["coordinator", "graph-node"]),
+  kind: z18.enum(["coordinator", "graph-node"]),
   roleID: nonEmptyString,
   agentID: nonEmptyString.optional(),
   sessionID: nonEmptyString.optional()
 }).strict();
-var lifecycleRunStartInputSchema = z17.object({
+var lifecycleRunStartInputSchema = z18.object({
   runID: nonEmptyString,
-  source: z17.enum(["plugin", "cli"]),
-  executionAuthority: z17.enum(["coordinator", "graph"]),
+  source: z18.enum(["plugin", "cli"]),
+  executionAuthority: z18.enum(["coordinator", "graph"]),
   root: lifecycleRootOperationSchema
 }).strict();
 var LifecycleRunMetadataSchema = lifecycleRunStartInputSchema.extend({
-  version: z17.literal(1),
+  version: z18.literal(1),
   createdAt: nonNegativeInteger
 }).strict();
 var attemptRefShape = {
@@ -6216,34 +8167,34 @@ var attemptRefShape = {
   retryIndex: nonNegativeInteger
 };
 var eventEnvelopeShape = {
-  v: z17.literal(1),
+  v: z18.literal(1),
   seq: nonNegativeInteger,
   runID: nonEmptyString,
   at: nonNegativeInteger
 };
 var runStartedBodyShape = {
-  type: z17.literal("run.started"),
-  source: z17.enum(["plugin", "cli"]),
-  executionAuthority: z17.enum(["coordinator", "graph"]),
+  type: z18.literal("run.started"),
+  source: z18.enum(["plugin", "cli"]),
+  executionAuthority: z18.enum(["coordinator", "graph"]),
   root: lifecycleRootOperationSchema
 };
 var operationQueuedBodyShape = {
-  type: z17.literal("operation.queued"),
+  type: z18.literal("operation.queued"),
   operationID: nonEmptyString,
   taskID: nonEmptyString,
-  kind: z17.enum(["role", "graph-node"]),
+  kind: z18.enum(["role", "graph-node"]),
   roleID: nonEmptyString,
   agentID: nonEmptyString.optional(),
   parentOperationID: nonEmptyString,
-  dependsOnOperationIDs: z17.array(nonEmptyString).readonly()
+  dependsOnOperationIDs: z18.array(nonEmptyString).readonly()
 };
 var modelSelectedBodyShape = {
-  type: z17.literal("attempt.model-selected"),
+  type: z18.literal("attempt.model-selected"),
   ...attemptRefShape,
   decisionID: nonEmptyString,
   model: modelSelectionSchema2,
-  routeKind: z17.enum(["local", "frontier"]),
-  selectionCause: z17.enum([
+  routeKind: z18.enum(["local", "frontier"]),
+  selectionCause: z18.enum([
     "initial",
     "retry-incomplete",
     "retry-transport",
@@ -6253,31 +8204,31 @@ var modelSelectedBodyShape = {
   runtimeID: nonEmptyString.optional()
 };
 var attemptQueuedBodyShape = {
-  type: z17.literal("attempt.queued"),
+  type: z18.literal("attempt.queued"),
   ...attemptRefShape,
   runtimeID: nonEmptyString.optional()
 };
 var attemptStartedBodyShape = {
-  type: z17.literal("attempt.started"),
+  type: z18.literal("attempt.started"),
   ...attemptRefShape
 };
 var sessionCreatedBodyShape = {
-  type: z17.literal("session.created"),
+  type: z18.literal("session.created"),
   ...attemptRefShape,
   sessionID: nonEmptyString,
   parentSessionID: nonEmptyString.optional()
 };
 var attemptTerminalBodyShape = {
-  type: z17.literal("attempt.terminal"),
+  type: z18.literal("attempt.terminal"),
   ...attemptRefShape,
-  outcome: z17.enum([
+  outcome: z18.enum([
     "succeeded",
     "failed",
     "cancelled",
     "interrupted",
     "unknown"
   ]),
-  continuation: z17.enum([
+  continuation: z18.enum([
     "none",
     "retry-same-model",
     "fallback-next-model",
@@ -6287,10 +8238,10 @@ var attemptTerminalBodyShape = {
   failure: lifecycleFailureSchema.optional()
 };
 var operationTerminalBodyShape = {
-  type: z17.literal("operation.terminal"),
+  type: z18.literal("operation.terminal"),
   operationID: nonEmptyString,
   taskID: nonEmptyString,
-  outcome: z17.enum([
+  outcome: z18.enum([
     "succeeded",
     "failed",
     "cancelled",
@@ -6303,8 +8254,8 @@ var operationTerminalBodyShape = {
   failure: lifecycleFailureSchema.optional()
 };
 var runTerminalBodyShape = {
-  type: z17.literal("run.terminal"),
-  outcome: z17.enum([
+  type: z18.literal("run.terminal"),
+  outcome: z18.enum([
     "succeeded",
     "failed",
     "cancelled",
@@ -6315,39 +8266,39 @@ var runTerminalBodyShape = {
   failure: lifecycleFailureSchema.optional()
 };
 var bodySchemas = [
-  z17.object(runStartedBodyShape).strict(),
-  z17.object(operationQueuedBodyShape).strict(),
-  z17.object(modelSelectedBodyShape).strict(),
-  z17.object(attemptQueuedBodyShape).strict(),
-  z17.object(attemptStartedBodyShape).strict(),
-  z17.object(sessionCreatedBodyShape).strict(),
-  z17.object(attemptTerminalBodyShape).strict(),
-  z17.object(operationTerminalBodyShape).strict(),
-  z17.object(runTerminalBodyShape).strict()
+  z18.object(runStartedBodyShape).strict(),
+  z18.object(operationQueuedBodyShape).strict(),
+  z18.object(modelSelectedBodyShape).strict(),
+  z18.object(attemptQueuedBodyShape).strict(),
+  z18.object(attemptStartedBodyShape).strict(),
+  z18.object(sessionCreatedBodyShape).strict(),
+  z18.object(attemptTerminalBodyShape).strict(),
+  z18.object(operationTerminalBodyShape).strict(),
+  z18.object(runTerminalBodyShape).strict()
 ];
 var appendBodySchemas = bodySchemas.slice(1);
-var LifecycleAppendEventSchema = z17.discriminatedUnion("type", appendBodySchemas);
-var LifecycleEventSchema = z17.discriminatedUnion("type", [
-  z17.object({ ...eventEnvelopeShape, ...runStartedBodyShape }).strict(),
-  z17.object({ ...eventEnvelopeShape, ...operationQueuedBodyShape }).strict(),
-  z17.object({ ...eventEnvelopeShape, ...modelSelectedBodyShape }).strict(),
-  z17.object({ ...eventEnvelopeShape, ...attemptQueuedBodyShape }).strict(),
-  z17.object({ ...eventEnvelopeShape, ...attemptStartedBodyShape }).strict(),
-  z17.object({ ...eventEnvelopeShape, ...sessionCreatedBodyShape }).strict(),
-  z17.object({ ...eventEnvelopeShape, ...attemptTerminalBodyShape }).strict(),
-  z17.object({ ...eventEnvelopeShape, ...operationTerminalBodyShape }).strict(),
-  z17.object({ ...eventEnvelopeShape, ...runTerminalBodyShape }).strict()
+var LifecycleAppendEventSchema = z18.discriminatedUnion("type", appendBodySchemas);
+var LifecycleEventSchema = z18.discriminatedUnion("type", [
+  z18.object({ ...eventEnvelopeShape, ...runStartedBodyShape }).strict(),
+  z18.object({ ...eventEnvelopeShape, ...operationQueuedBodyShape }).strict(),
+  z18.object({ ...eventEnvelopeShape, ...modelSelectedBodyShape }).strict(),
+  z18.object({ ...eventEnvelopeShape, ...attemptQueuedBodyShape }).strict(),
+  z18.object({ ...eventEnvelopeShape, ...attemptStartedBodyShape }).strict(),
+  z18.object({ ...eventEnvelopeShape, ...sessionCreatedBodyShape }).strict(),
+  z18.object({ ...eventEnvelopeShape, ...attemptTerminalBodyShape }).strict(),
+  z18.object({ ...eventEnvelopeShape, ...operationTerminalBodyShape }).strict(),
+  z18.object({ ...eventEnvelopeShape, ...runTerminalBodyShape }).strict()
 ]);
-var LifecycleWriterLeaseInputSchema = z17.object({
-  writer: z17.object({
+var LifecycleWriterLeaseInputSchema = z18.object({
+  writer: z18.object({
     processID: positiveInteger,
     processInstanceID: nonEmptyString
   }).strict(),
   now: nonNegativeInteger,
   leaseDurationMs: positiveInteger
 }).strict();
-var LifecycleWriterLeaseSchema = z17.object({
-  version: z17.literal(1),
+var LifecycleWriterLeaseSchema = z18.object({
+  version: z18.literal(1),
   runID: nonEmptyString,
   writerToken: nonEmptyString,
   processID: positiveInteger,
@@ -7232,9 +9183,9 @@ function createRuntimeConcurrencyLimiter(options) {
       }
       const state = stateFor(runtimeId);
       const queuedAt = options.now();
-      return new Promise((resolve4) => {
+      return new Promise((resolve5) => {
         state.queues[priority].push((release) => {
-          resolve4({ release, waitedMs: options.now() - queuedAt });
+          resolve5({ release, waitedMs: options.now() - queuedAt });
         });
       });
     },
@@ -7269,30 +9220,82 @@ function embeddingsEndpoint(baseURL) {
   return `${normalizeBaseURL(baseURL)}/embeddings`;
 }
 function errorMessage(error) {
+  const chain = errorChain(error);
+  const dnsDetail = dnsErrorMessage(chain);
+  if (dnsDetail !== undefined) {
+    return dnsDetail;
+  }
+  for (const entry of chain) {
+    if (!(entry instanceof Error)) {
+      continue;
+    }
+    if (!isGenericTransportMessage(entry.message)) {
+      return entry.message;
+    }
+  }
   if (error instanceof Error) {
     return error.message;
   }
   return String(error);
 }
+function errorChain(error) {
+  const chain = [];
+  const seen = new Set;
+  let current = error;
+  while (current !== undefined && !seen.has(current)) {
+    chain.push(current);
+    seen.add(current);
+    if (typeof current === "object" && current !== null && "cause" in current) {
+      current = current.cause;
+      continue;
+    }
+    break;
+  }
+  return chain;
+}
+function errorCode(error) {
+  return typeof error === "object" && error !== null && "code" in error && typeof error.code === "string" ? error.code : undefined;
+}
+function errorHostname(error) {
+  return typeof error === "object" && error !== null && "hostname" in error && typeof error.hostname === "string" ? error.hostname : undefined;
+}
+function isGenericTransportMessage(message) {
+  const normalized = message.trim().toLowerCase();
+  return normalized.length === 0 || normalized === "fetch failed" || normalized === "network error" || normalized === "network request failed";
+}
+function dnsErrorMessage(chain) {
+  for (const entry of chain) {
+    const code = errorCode(entry);
+    if (code !== "ENOTFOUND" && code !== "EAI_AGAIN") {
+      continue;
+    }
+    if (entry instanceof Error && !isGenericTransportMessage(entry.message)) {
+      return entry.message;
+    }
+    const hostname = errorHostname(entry);
+    return hostname !== undefined && hostname.length > 0 ? localRuntimeMessages.dnsLookupFailedFor(hostname, code) : localRuntimeMessages.dnsLookupFailed(code);
+  }
+  return;
+}
 async function listOpenAICompatibleModels(baseURL, fetch) {
   const response = await fetch(modelsEndpoint(baseURL), {
     method: "GET",
     headers: { accept: "application/json" }
   });
   if (!response.ok) {
-    throw new Error(`GET /models failed with HTTP ${response.status}`);
+    throw new Error(localRuntimeMessages.modelListHttpError(response.status));
   }
   let payload;
   try {
     payload = await response.json();
   } catch (error) {
-    throw new Error(`Malformed JSON from /models: ${errorMessage(error)}`);
+    throw new Error(localRuntimeMessages.malformedModelsJson(errorMessage(error)));
   }
   return parseOpenAIModels(payload);
 }
 function parseOpenAIModels(payload) {
   if (!isObject(payload) || !Array.isArray(payload.data)) {
-    throw new Error("Malformed /models response: expected data array");
+    throw new Error(localRuntimeMessages.malformedModelsResponseExpectedDataArray);
   }
   return payload.data.map(parseOpenAIModel);
 }
@@ -7327,7 +9330,7 @@ async function probeOpenAICompatibleRuntime(input) {
 }
 function parseOpenAIModel(value) {
   if (!isObject(value) || typeof value.id !== "string" || value.id.length === 0) {
-    throw new Error("Malformed /models response: model id must be a string");
+    throw new Error(localRuntimeMessages.malformedModelsResponseModelId);
   }
   const contextWindow = readContextWindow(value);
   const model = {
@@ -7525,9 +9528,12 @@ var NON_TEXT_LABELS = new Set([
   "embedding",
   "reranking"
 ]);
-var PARALLEL_ARG = /(?:^|\s)(?:--parallel|-np)[\s=]+(\d+)(?!\d)/;
+var PARALLEL_ARG = /(?:^|\s)(?:--parallel|-np)[\s=]+(\d+)(?=\s|$)/;
 var PARALLEL_FLAGS = new Set(["--parallel", "-np"]);
 var PARALLEL_FUSED = /^(?:--parallel|-np)=(\d+)$/;
+var CTX_SIZE_FUSED = /^--ctx-size=(\d+)$/;
+var CTX_SIZE_FLAGS = new Set(["--ctx-size"]);
+var CTX_SIZE_ARG = /(?:^|\s)--ctx-size[\s=]+(\d+)(?=\s|$)/;
 function createLemonadeAdapter() {
   const listModels = async (options) => {
     const baseURL = normalizeBaseURL(options.baseURL ?? LEMONADE_DEFAULT_BASE_URL);
@@ -7566,13 +9572,13 @@ async function listLemonadeModels(baseURL, fetch) {
     headers: { accept: "application/json" }
   });
   if (!response.ok) {
-    throw new Error(`GET /models failed with HTTP ${response.status}`);
+    throw new Error(localRuntimeMessages.modelListHttpError(response.status));
   }
   let payload;
   try {
     payload = await response.json();
   } catch (error) {
-    throw new Error(`Malformed JSON from /models: ${errorMessage(error)}`);
+    throw new Error(localRuntimeMessages.malformedModelsJson(errorMessage(error)));
   }
   const nonText = readNonTextModelIDs(payload);
   return parseOpenAIModels(payload).filter((model) => !nonText.has(model.modelID));
@@ -7623,13 +9629,19 @@ async function readLoadedModels(baseURL, fetch) {
     if (entry.loaded === false) {
       continue;
     }
-    loaded.set(entry.model_name, { slots: readSlotCount(entry) });
+    loaded.set(entry.model_name, {
+      slots: readSlotCount(entry),
+      totalContextWindow: readLoadedContextWindow(entry)
+    });
   }
   return loaded;
 }
 function readSlotCount(entry) {
   return slotsFromLlamacppArgs(entry) ?? slotsFromLaunchCommand(entry);
 }
+function readLoadedContextWindow(entry) {
+  return contextWindowFromRecipeOptions(entry) ?? contextWindowFromLaunchCommand(entry);
+}
 function slotsFromLlamacppArgs(entry) {
   const options = entry.recipe_options;
   if (!isObject2(options) || typeof options.llamacpp_args !== "string") {
@@ -7640,7 +9652,7 @@ function slotsFromLlamacppArgs(entry) {
 }
 function slotsFromLaunchCommand(entry) {
   const argv = entry.launch_command;
-  if (!Array.isArray(argv)) {
+  if (!Array.isArray(argv) || !launchCommandLooksLikeLlamacpp(argv)) {
     return;
   }
   for (let index = 0;index < argv.length; index += 1) {
@@ -7666,23 +9678,119 @@ function slotsFromLaunchCommand(entry) {
   }
   return;
 }
-function positiveSlotCount(raw) {
-  if (raw === undefined || !/^\d+$/.test(raw)) {
+function contextWindowFromRecipeOptions(entry) {
+  const options = entry.recipe_options;
+  if (!isObject2(options) || !hasLlamacppEvidence(entry)) {
+    return;
+  }
+  const direct = positiveIntegerValue(options.ctx_size);
+  if (direct !== undefined) {
+    return direct;
+  }
+  if (typeof options.llamacpp_args !== "string") {
+    return;
+  }
+  const match = CTX_SIZE_ARG.exec(options.llamacpp_args);
+  return match === null ? undefined : positiveSlotCount(match[1]);
+}
+function contextWindowFromLaunchCommand(entry) {
+  const argv = entry.launch_command;
+  if (!Array.isArray(argv) || !launchCommandLooksLikeLlamacpp(argv)) {
+    return;
+  }
+  for (let index = 0;index < argv.length; index += 1) {
+    const token = argv[index];
+    if (typeof token !== "string") {
+      continue;
+    }
+    const fused = CTX_SIZE_FUSED.exec(token);
+    if (fused !== null) {
+      const contextWindow = positiveSlotCount(fused[1]);
+      if (contextWindow !== undefined) {
+        return contextWindow;
+      }
+      continue;
+    }
+    if (CTX_SIZE_FLAGS.has(token)) {
+      const next = argv[index + 1];
+      const contextWindow = typeof next === "string" ? positiveSlotCount(next) : undefined;
+      if (contextWindow !== undefined) {
+        return contextWindow;
+      }
+    }
+  }
+  return;
+}
+function positiveSlotCount(raw) {
+  if (raw === undefined || !/^\d+$/.test(raw)) {
+    return;
+  }
+  const parsed = Number.parseInt(raw, 10);
+  return Number.isSafeInteger(parsed) && parsed > 0 ? parsed : undefined;
+}
+function positiveIntegerValue(value) {
+  if (typeof value === "number") {
+    return Number.isSafeInteger(value) && value > 0 ? value : undefined;
+  }
+  return typeof value === "string" ? positiveSlotCount(value) : undefined;
+}
+function hasLlamacppEvidence(entry) {
+  const recipe = entry.recipe;
+  if (typeof recipe === "string" && recipe.toLowerCase().includes("llamacpp")) {
+    return true;
+  }
+  const options = entry.recipe_options;
+  if (isObject2(options) && typeof options.llamacpp_args === "string") {
+    return true;
+  }
+  return Array.isArray(entry.launch_command) && launchCommandLooksLikeLlamacpp(entry.launch_command);
+}
+function launchCommandLooksLikeLlamacpp(argv) {
+  const firstToken = argv.find((token) => typeof token === "string" && token.length > 0);
+  if (firstToken === undefined) {
+    return false;
+  }
+  const normalized = firstToken.replace(/\\/g, "/").toLowerCase();
+  return normalized === "llama-server" || normalized.endsWith("/llama-server") || normalized === "llama-server.exe" || normalized.endsWith("/llama-server.exe");
+}
+function derivedConservativeContextWindow(reportedContextWindow, loaded) {
+  if (loaded.totalContextWindow === undefined || loaded.slots === undefined || loaded.slots <= 0) {
     return;
   }
-  const parsed = Number.parseInt(raw, 10);
-  return Number.isInteger(parsed) && parsed > 0 ? parsed : undefined;
+  const derived = Math.floor(loaded.totalContextWindow / loaded.slots);
+  if (derived <= 0) {
+    return;
+  }
+  return reportedContextWindow === undefined ? derived : Math.min(reportedContextWindow, derived);
+}
+function withoutUnverifiedContextWindow(model) {
+  const {
+    contextWindow: _contextWindow,
+    contextWindowProvenance: _contextWindowProvenance,
+    ...withoutContext
+  } = model;
+  return withoutContext;
 }
 function enrichWithLoadState(models, loaded) {
   if (loaded === undefined) {
-    return [...models];
+    return models.map((model) => withoutUnverifiedContextWindow(model));
   }
   return models.map((model) => {
+    const base = withoutUnverifiedContextWindow(model);
     const hit = loaded.get(model.modelID);
     if (hit === undefined) {
-      return { ...model, loaded: false };
+      return { ...base, loaded: false };
     }
-    return hit.slots === undefined ? { ...model, loaded: true } : { ...model, loaded: true, slots: hit.slots };
+    const contextWindow = derivedConservativeContextWindow(model.contextWindow, hit);
+    return {
+      ...base,
+      loaded: true,
+      ...hit.slots !== undefined ? { slots: hit.slots } : {},
+      ...contextWindow !== undefined ? {
+        contextWindow,
+        contextWindowProvenance: "derived-conservative"
+      } : {}
+    };
   });
 }
 function isObject2(value) {
@@ -7856,6 +9964,9 @@ function withReportedModelSlots(runtime, reported) {
 }
 
 // src/messages/orchestration.ts
+var HOST_SESSION_REQUIRED = "Orchestration requires a nonempty host ToolContext sessionID.";
+var PARENT_OVERRIDE_IGNORED = "parentSessionID override ignored: the trusted host ToolContext session owns this orchestration and its children. Programmatic callers must supply their parent as the ToolContext sessionID.";
+var PARENT_SESSION_DESCRIPTION = "Legacy parent reference. Omit it: the trusted host ToolContext session is the parent. A differing payload value is ignored with an advisory.";
 var SESSION_CREATE_MISSING_ID = "create response did not include a session id";
 function orchestrationSummaryHeading(roleCount, completed) {
   return `orchestration ${completed ? "completed" : "incomplete"} (${roleCount} role(s)):`;
@@ -7932,24 +10043,24 @@ var reportArtifactExists = async (reportPath) => {
 };
 
 // src/orchestrator/reportArtifactReader.ts
-import { readFile as readFile2 } from "node:fs/promises";
+import { readFile as readFile3 } from "node:fs/promises";
 var readReportArtifact = async (reportPath) => {
   try {
-    return await readFile2(reportPath, "utf8");
+    return await readFile3(reportPath, "utf8");
   } catch {
     return;
   }
 };
 
 // src/orchestrator/roster.ts
-import { z as z18 } from "zod";
-var RosterEntrySchema = z18.object({
-  roleID: z18.string().min(1),
-  agentName: z18.string().min(1)
+import { z as z19 } from "zod";
+var RosterEntrySchema = z19.object({
+  roleID: z19.string().min(1),
+  agentName: z19.string().min(1)
 }).strict();
-var RosterSchema = z18.object({
-  universe: z18.string().min(1),
-  entries: z18.array(RosterEntrySchema)
+var RosterSchema = z19.object({
+  universe: z19.string().min(1),
+  entries: z19.array(RosterEntrySchema)
 }).strict();
 var ROSTER_JSON_FENCE = /```json\s*([\s\S]*?)```/;
 
@@ -8318,9 +10429,9 @@ async function withTimeout(promise, timeoutMs) {
     return { kind: "settled", value: await promise };
   }
   let timeoutID;
-  const timeout = new Promise((resolve4) => {
+  const timeout = new Promise((resolve5) => {
     timeoutID = setTimeout(() => {
-      resolve4({ kind: "timeout" });
+      resolve5({ kind: "timeout" });
     }, timeoutMs);
   });
   try {
@@ -8340,8 +10451,8 @@ async function beforeDeadline(request, deadline, deps) {
   const controller = new AbortController;
   let timeoutID;
   const observedRequest = Promise.resolve().then(() => request(controller.signal)).then((value) => ({ kind: "settled", value }), (error) => ({ kind: "rejected", error }));
-  const timeout = new Promise((resolve4) => {
-    timeoutID = setTimeout(() => resolve4({ kind: "timeout" }), remainingMs);
+  const timeout = new Promise((resolve5) => {
+    timeoutID = setTimeout(() => resolve5({ kind: "timeout" }), remainingMs);
   });
   try {
     const outcome = await Promise.race([observedRequest, timeout]);
@@ -8863,257 +10974,44 @@ function sessionEndpointEventFrom(sessionID, url, now, meta = {}) {
 }
 var ACTIVITY_SUMMARIES = {
   "session.created": "Session created",
-  "session.idle": "Session idle",
-  "session.error": "Session error"
-};
-function sessionIDFromEvent(event) {
-  const properties = event.properties;
-  if (properties === null || typeof properties !== "object") {
-    return;
-  }
-  const record = properties;
-  if (typeof record.sessionID === "string") {
-    return record.sessionID;
-  }
-  if (typeof record.info?.id === "string") {
-    return record.info.id;
-  }
-  return;
-}
-function activityEventFrom(event, now) {
-  const summary = ACTIVITY_SUMMARIES[event.type];
-  if (summary === undefined) {
-    return;
-  }
-  const sessionID = sessionIDFromEvent(event);
-  if (sessionID === undefined) {
-    return;
-  }
-  return {
-    v: EVENT_SCHEMA_VERSION,
-    type: "activity",
-    ts: now(),
-    sessionID,
-    kind: "agent",
-    summary
-  };
-}
-
-// src/plugin/commandTool.ts
-import { tool } from "@opencode-ai/plugin";
-
-// src/messages/commands.ts
-var clearCacheMessages = {
-  header: "openteam clear-cache — frozen plugin cache entries:",
-  columns: {
-    specDir: "spec dir",
-    pinned: "spec-pinned",
-    installed: "installed",
-    mtime: "mtime"
-  },
-  reparseSkipSuffix: "  [SKIP — reparse point]",
-  deletedLabel: "deleted.",
-  lockedLabel: (message) => `[LOCKED] ${message}`,
-  pathOutsideWarning: (specDir, absolutePath) => `  ⚠ ${specDir}: path outside cacheRoot (${absolutePath}), skipped.`,
-  processed: (count) => `${count} entry(ies) processed.`,
-  found: (count) => `${count} entry(ies) found. Use --delete to remove them.`
-};
-var baselineMessages = {
-  effectiveAuto: "cheapest-capable (auto)",
-  pinnedSuffix: (ref) => `${ref} (pinned)`,
-  summary: (params) => [
-    "openteam baseline:",
-    `  mode:      ${params.mode}`,
-    `  pinned:    ${params.pinned}`,
-    `  hardDefault: ${params.hardDefault}`,
-    `  effective: ${params.effective}`
-  ],
-  invalidModel: (input) => `Invalid model "${input}". Use the provider/model format, e.g. anthropic/claude-sonnet-4-5.`,
-  pinnedTo: (ref) => `Baseline pinned to ${ref} (pinned mode).`,
-  autoMode: "Baseline set to auto mode (cheapest-capable)."
-};
-var localMessages = {
-  help: {
-    status: "  openteam local status             Show the execution mode (local / frontier / mixed)",
-    off: "  openteam local off                Use frontier models only",
-    only: "  openteam local only               Use local models only",
-    on: "  openteam local on                 Enable mixed local/frontier execution"
-  },
-  noRuntimes: "none",
-  modeFrontier: "frontier",
-  modeLocal: "local",
-  modeMixed: "mixed",
-  summary: (params) => [
-    "openteam local:",
-    `  execution mode: ${params.mode}`,
-    `  local runtimes: ${params.runtimes}`
-  ],
-  frontierOnlyNoChange: "No change: execution mode is already frontier.",
-  frontierOnlyEnabled: "Frontier execution enabled.",
-  localOnlyNoRuntimes: "Cannot enable local execution: no enabled local runtime is configured. Run 'openteam setup' or enable a local runtime in .opencode/openteam.json first.",
-  localOnlyNoChange: "No change: execution mode is already local.",
-  localOnlyEnabled: "Local execution enabled.",
-  localFirstNoChange: "No change: execution mode is already mixed.",
-  localFirstReEnabled: "Mixed local/frontier execution enabled. Make sure each configured provider is reachable.",
-  unknownSubcommand: (subcommand, help) => `Unknown local subcommand: ${subcommand}
-
-${help}`
-};
-var yoloMessages = {
-  updated: (path2, status, agentNote) => `${path2} updated. ${status}${agentNote}
-Restart opencode (or reload) so agents pick up the new permissions.`
-};
-var migrateMessages = {
-  header: "openteam migrate:",
-  nothingToMigrate: "  nothing to migrate — the P15b layout is already in place.",
-  counts: (params) => [
-    `  moved:     ${params.moved} file(s)`,
-    `  deduped:   ${params.deduped} file(s) (destination already identical)`,
-    `  conflicts: ${params.conflicts} file(s)`
-  ],
-  relocatedHeader: "  relocated:",
-  relocatedEntry: (from, to, deduped) => `    · ${from} → ${to}${deduped ? " (deduped)" : ""}`,
-  conflictsHeader: "  ⚠ left in place (destination exists with different content — no data lost):",
-  conflictEntry: (from, to) => `    · ${from} → ${to}`,
-  manualWorktreesHeader: "  ⚠ legacy git worktree(s) need a manual move (run `git worktree move`):",
-  manualWorktreeEntry: (label, from, to) => `    · ${label}: ${from} → ${to}`,
-  success: "  ✓ machine-local runtime output relocated under .opencode/openteam-local/."
-};
-var rolesInitMessages = {
-  help: "  openteam roles init               Compose per-role execution, model, and fallback policy",
-  header: "openteam roles init:",
-  title: "openteam roles init",
-  noRoster: (path2) => `  ✗ no roster at ${path2}.`,
-  noRosterRemedy: "    Cast the team first: run `openteam setup`, then ask the orchestrator to register the cast.",
-  unparseableRoster: (path2, error) => `  ✗ ${path2} is present but unparseable: ${error}`,
-  unparseableRosterRemedy: "    Run `openteam doctor` for the remedy, then re-run this command.",
-  allProfiled: (count) => `  ✓ ${count} roster role(s) checked; no unprofiled roles — every role resolves a routing profile.`,
-  skipLabel: "Skip for now",
-  skipHint: "leaves the role on its built-in or fallback policy; doctor keeps reporting the missing explicit override",
-  runtimeQuestion: (roleID) => `Preferred local runtime(s) for "${roleID}" (in failover order)`,
-  runtimeHint: "machine-local — written to the git-ignored overlay",
-  cancelled: (reason) => `  ✗ cancelled (${reason}); nothing was written.`,
-  invalidResult: (reason) => `  ✗ refusing to write: the resulting config is invalid — ${reason}`,
-  deprecation: (message) => `  ⚠ ${message}`,
-  nothingWritten: (skipped) => `  · skipped ${skipped}; nothing written.`,
-  nothingToWriteOutro: "Nothing to write.",
-  runtimeBinding: (path2) => `  ✓ runtime binding: ${path2} (git-ignored, machine-local)`,
-  skippedSummary: (roleIDs) => `  · skipped: ${roleIDs} — using built-in or fallback policy; re-run this command to add an explicit override.`,
-  outro: "Role policy updated."
-};
-
-// src/messages/executionSetup.ts
-var executionSetupMessages = {
-  setupIntro: "openteam setup — configure local, frontier, or mixed team execution",
-  runtimeQuestion: "Which local runtimes do you want to enable? (choose 'None' for frontier-only)",
-  runtimeNoneLabel: "None — use frontier models only",
-  runtimeNoneHint: "no local runtime (frontier execution)",
-  executionModeQuestion: "Team execution mode",
-  executionModeChoices: {
-    local: {
-      label: "local — every agent stays on configured local providers",
-      hint: "requires at least one enabled local runtime"
-    },
-    frontier: {
-      label: "frontier — every agent uses frontier providers",
-      hint: "does not require a local runtime"
-    },
-    mixed: {
-      label: "mixed — policies may select local or frontier models",
-      hint: "the global mode is an upper bound; per-agent policies may narrow it"
-    }
-  },
-  frontierOnlyNote: [
-    "No local runtime is enabled, so the team will use frontier providers.",
-    "The selected primary model is written consistently to opencode.json and",
-    ".opencode/agent/openteam.md."
-  ].join(`
-`),
-  frontierOnlyTitle: "Frontier execution",
-  localOnlyNote: (model) => [
-    "Every team agent is restricted to configured local providers.",
-    `The primary coordinator is pinned to ${model}.`,
-    "No frontier provider is required for execution while this mode is active."
-  ].join(`
-`),
-  localOnlyTitle: "Local execution",
-  localRequiredError: "local execution requires an enabled local runtime",
-  mixedPrimaryQuestion: "Primary coordinator model",
-  mixedPrimaryLocal: (model) => `Use local thinking model ${model}`,
-  mixedPrimaryFrontier: "Choose a frontier model",
-  frontierModelQuestion: "Frontier model (type to search; cheapest capable entries first)",
-  primaryPolicySummary: (params) => [
-    `Execution mode: ${params.executionMode}`,
-    `Primary model: ${params.primaryModel}`,
-    `Primary fallbacks: ${params.fallbacks}`,
-    "Worker model policy: auto within the global execution mode"
-  ],
-  noFallbacks: "none",
-  yoloQuestion: "Enable YOLO mode? (opencode auto-approves all permissions)",
-  configuredSummary: (params) => [
-    ...executionSetupMessages.primaryPolicySummary({
-      executionMode: params.executionMode,
-      primaryModel: params.primaryModel,
-      fallbacks: executionSetupMessages.noFallbacks
-    }),
-    `Frontier baseline: ${params.frontierBaseline}`,
-    `Local runtimes: ${params.localRuntimes}`,
-    `YOLO mode: ${params.yolo ? "enabled (auto-approves permissions)" : "disabled"}`,
-    "Web Console: launched separately with 'openteam console' (multi-session, loopback)",
-    `Wrote: ${params.opencodePath}, ${params.configPath}, ${params.agentPath}, ${params.agentDir}/*.md (${params.roleAgentCount} standard subagents), ${params.commandDir}/*.md (${params.commandCount} commands); ensured ${params.gitignorePath}`,
-    "",
-    "Next steps:",
-    params.executionMode === "local" ? "  1. No frontier authentication is required while local execution is active" : "  1. Authenticate the frontier provider: opencode auth login",
-    params.executionMode === "local" ? executionSetupMessages.localRuntimeNextStep : params.executionMode === "mixed" ? executionSetupMessages.mixedNextStep : executionSetupMessages.frontierNextStep,
-    "  3. Press Tab and pick the 'openteam' agent, or type / and pick an /openteam… command"
-  ],
-  configuredTitle: "openteam configured",
-  complete: (paths) => `openteam setup complete: ${paths}`,
-  error: (message) => `setup error: ${message}`,
-  localRuntimeNextStep: "  2. Make sure every configured local runtime is reachable",
-  frontierNextStep: "  2. Open opencode in this repo; openteam will use frontier models",
-  mixedNextStep: "  2. Make sure local runtimes are reachable; unavailable candidates can use configured fallbacks",
-  done: "Done. Open opencode and select the 'openteam' agent.",
-  rolePolicy: {
-    whyTitle: "Configure execution and model selection",
-    why: (count) => `${count} roster role(s) have no explicit execution/model override. Configure a compact policy now, or leave them on the built-in automatic policy.`,
-    modeQuestion: (roleID, agentName) => `Execution mode for "${roleID}" (${agentName})`,
-    modeInheritLabel: "Inherit the team execution mode",
-    modeLocalLabel: "Local only",
-    modeFrontierLabel: "Frontier only",
-    modelQuestion: (roleID) => `Model selection for "${roleID}"`,
-    modelAutoLabel: "Auto — choose the cheapest capable eligible model",
-    modelExactLabel: "Exact provider/model pin",
-    modelExactQuestion: (roleID) => `Exact model for "${roleID}" as provider/model`,
-    modelExactPlaceholder: "provider/model",
-    fallbacksQuestion: (roleID) => `Ordered fallbacks for "${roleID}" (comma-separated provider/model, blank for none)`,
-    fallbacksPlaceholder: "provider/model, provider/model",
-    configured: (roleIDs, path2) => `  ✓ execution/model policy: ${roleIDs} → ${path2}`,
-    invalidModelRef: (value) => `invalid model "${value}"; expected provider/model`
-  }
-};
-var executionPolicyMessages = {
-  doctorHelp: "  openteam doctor                   Diagnose runtimes, execution policies, and config",
-  agentsHelp: "  openteam agents                   List agents, model identity, and execution policy",
-  section: "Configured execution policies:",
-  globalMode: (mode) => `  execution mode: ${mode}`,
-  line: (policy) => `  ${policy.owner}: mode=${policy.executionMode ?? "inherit"} · model=${policy.model} · fallbacks=${policy.fallbacks.length > 0 ? policy.fallbacks.join(" → ") : "none"}`,
-  retryLimits: (maxRetries, maxModelsPerNode) => `  retry limits: ${maxRetries} retries per model · ${maxModelsPerNode} model(s) per node`,
-  inheritedDefaultUnset: "inherits the opencode.json default (not set); execution follows the configured team and agent policy",
-  inheritedDefault: (subscription) => `inherits default → ${subscription}; execution follows the configured team and agent policy`,
-  unprofiledRoleRouting: "      routing: no explicit override — the role inherits its built-in or fallback policy within the global execution-mode upper bound. Roster prose is not executable configuration.",
-  unprofiledRoleRemedy: "      remedy: run `openteam roles init`, or add executionMode, model, and ordered fallbacks under orchestrator.roles in .opencode/openteam.json.",
-  noLocalMixed: "  ⚠ No local runtime reachable: mixed execution currently has only frontier candidates.",
-  noLocalBlocked: "  ✗ No local runtime reachable: local execution is blocked until a configured runtime is available.",
-  primaryLocalMismatch: (name, providerID) => `    ✗ local execution is configured, but primary agent '${name}' points at provider '${providerID}', which opencode.json does not configure.`,
-  primaryLocalMismatchCause: "      cause: the primary agent artifact and opencode.json no longer agree on the selected provider/model identity.",
-  primaryLocalMismatchConsequence: "      consequence: opencode cannot start the coordinator, so it cannot read the roster or distribute work.",
-  primaryLocalMismatchRemedy: (sourceFile) => `      remedy: re-run \`openteam setup\` to regenerate ${sourceFile} and opencode.json from the same primary policy, then re-run \`openteam doctor\`.`
-};
-var localModeChangeMessages = {
-  localProviderInFrontierDomain: (path2, domainPath, providerID, modelID) => `${path2}: model "${providerID}/${modelID}" uses provider "${providerID}", which is configured for local dispatch and cannot be selected when ${domainPath} is "frontier". Update this policy or use \`openteam local on\`.`,
-  frontierProviderInLocalDomain: (path2, domainPath, providerID, modelID) => `${path2}: model "${providerID}/${modelID}" uses provider "${providerID}", which is not a configured local provider and cannot be selected when ${domainPath} is "local". Update this policy or use \`openteam local on\`.`
+  "session.idle": "Session idle",
+  "session.error": "Session error"
 };
+function sessionIDFromEvent(event) {
+  const properties = event.properties;
+  if (properties === null || typeof properties !== "object") {
+    return;
+  }
+  const record = properties;
+  if (typeof record.sessionID === "string") {
+    return record.sessionID;
+  }
+  if (typeof record.info?.id === "string") {
+    return record.info.id;
+  }
+  return;
+}
+function activityEventFrom(event, now) {
+  const summary = ACTIVITY_SUMMARIES[event.type];
+  if (summary === undefined) {
+    return;
+  }
+  const sessionID = sessionIDFromEvent(event);
+  if (sessionID === undefined) {
+    return;
+  }
+  return {
+    v: EVENT_SCHEMA_VERSION,
+    type: "activity",
+    ts: now(),
+    sessionID,
+    kind: "agent",
+    summary
+  };
+}
+
+// src/plugin/commandTool.ts
+import { tool } from "@opencode-ai/plugin";
 
 // src/orchestrator/worktreeReconciler.ts
 function planOne(wt) {
@@ -9169,7 +11067,7 @@ function planWorktreeReconciliation(input) {
 }
 
 // src/telemetry/otelConfig.ts
-import { z as z19 } from "zod";
+import { z as z20 } from "zod";
 
 // src/telemetry/fanout.ts
 function createFanOutSink(deps) {
@@ -9247,10 +11145,10 @@ function createOtelSink(deps) {
 }
 
 // src/telemetry/otelConfig.ts
-var OtelBackendConfigSchema = z19.object({
-  backend: z19.literal("opentelemetry"),
-  connectionEnv: z19.string().min(1),
-  serviceName: z19.string().min(1).optional()
+var OtelBackendConfigSchema = z20.object({
+  backend: z20.literal("opentelemetry"),
+  connectionEnv: z20.string().min(1),
+  serviceName: z20.string().min(1).optional()
 }).strict();
 function parseConnectionString(raw) {
   const pairs = new Map;
@@ -9653,22 +11551,22 @@ var KNOWN_FRONTIER_PROVIDER_IDS = new Set([
   "openrouter"
 ]);
 var VIRTUAL_ROUTER_PROVIDER_ID = "openteam-router";
-function isRecord4(value) {
+function isRecord5(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function parseOpencodeProviders(opencodeConfig) {
   const result = new Map;
   const provider = opencodeConfig?.provider;
-  if (!isRecord4(provider)) {
+  if (!isRecord5(provider)) {
     return result;
   }
   for (const [id, value] of Object.entries(provider)) {
-    if (!isRecord4(value)) {
+    if (!isRecord5(value)) {
       result.set(id, {});
       continue;
     }
     const models = value.models;
-    result.set(id, isRecord4(models) ? { models: new Set(Object.keys(models)) } : {});
+    result.set(id, isRecord5(models) ? { models: new Set(Object.keys(models)) } : {});
   }
   return result;
 }
@@ -9922,6 +11820,54 @@ function renderConsoleStatus(console_) {
 }
 
 // src/commands/doctor.ts
+var DEFAULT_COMPACTION_RESERVED_MAX = 20000;
+function isRecord6(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function hasOwn(record, key) {
+  return Object.hasOwn(record, key);
+}
+function positiveInteger2(value) {
+  return typeof value === "number" && Number.isFinite(value) && Number.isInteger(value) && value > 0 ? value : undefined;
+}
+function recordAt(source, key) {
+  const value = source?.[key];
+  return isRecord6(value) ? value : undefined;
+}
+function enabledLocalProviderIDs(config) {
+  const providers = new Set;
+  for (const runtime of config.local.runtimes) {
+    if (!runtime.enabled) {
+      continue;
+    }
+    providers.add(runtime.defaultModel.providerID);
+  }
+  return providers;
+}
+function detectedContextsByProvider(config, snapshots) {
+  const reachableByRuntime = new Map(snapshots.filter((snapshot) => snapshot.reachable).map((snapshot) => [snapshot.id, snapshot]));
+  const detected = new Map;
+  for (const runtime of config.local.runtimes) {
+    if (!runtime.enabled) {
+      continue;
+    }
+    const snapshot = reachableByRuntime.get(runtime.id);
+    if (snapshot === undefined) {
+      continue;
+    }
+    const providerID = runtime.defaultModel.providerID;
+    const byModel = detected.get(providerID) ?? new Map;
+    for (const model of snapshot.models) {
+      if (model.contextWindow !== undefined) {
+        byModel.set(model.modelID, model.contextWindow);
+      }
+    }
+    if (byModel.size > 0) {
+      detected.set(providerID, byModel);
+    }
+  }
+  return detected;
+}
 function runtimeClassLine(runtime) {
   if (runtime === undefined) {
     return;
@@ -10206,6 +12152,118 @@ function agentModelsSection(diagnostics, searchedPaths, localOnly) {
   lines.push("    note: static checks are offline and deterministic; live checks need a reachable local runtime and can be inconclusive.");
   return lines;
 }
+function collectLocalModelLimitWarnings(input) {
+  if (input.opencodeConfig === undefined) {
+    return;
+  }
+  const enabledProviders = enabledLocalProviderIDs(input.config);
+  if (enabledProviders.size === 0) {
+    return { inspectedModels: 0, warnings: [] };
+  }
+  const providerConfig = recordAt(input.opencodeConfig, "provider");
+  const detectedContexts = detectedContextsByProvider(input.config, input.snapshots);
+  const compactionReserved = positiveInteger2(recordAt(input.opencodeConfig, "compaction")?.reserved);
+  const warnings = [];
+  let inspectedModels = 0;
+  for (const providerID of enabledProviders) {
+    const provider = recordAt(providerConfig, providerID);
+    const models = recordAt(provider, "models");
+    if (models === undefined) {
+      continue;
+    }
+    for (const [modelID, modelValue] of Object.entries(models)) {
+      inspectedModels += 1;
+      const problems = [];
+      const remedies = new Set;
+      if (!isRecord6(modelValue)) {
+        problems.push(doctorMessages.localModelLimits.invalidLimitBlock);
+        remedies.add(doctorMessages.localModelLimits.invalidLimitRemedy);
+        warnings.push({
+          providerID,
+          modelID,
+          problems,
+          remedies: [...remedies]
+        });
+        continue;
+      }
+      if (hasOwn(modelValue, "limit") && recordAt(modelValue, "limit") === undefined) {
+        problems.push(doctorMessages.localModelLimits.invalidLimitBlock);
+        remedies.add(doctorMessages.localModelLimits.invalidLimitRemedy);
+        warnings.push({
+          providerID,
+          modelID,
+          problems,
+          remedies: [...remedies]
+        });
+        continue;
+      }
+      const limit = recordAt(modelValue, "limit");
+      const rawOutput = limit?.output;
+      const rawContext = limit?.context;
+      const rawInput = limit?.input;
+      const output = positiveInteger2(rawOutput);
+      const context = positiveInteger2(rawContext);
+      const inputLimit = positiveInteger2(rawInput);
+      if (limit === undefined || !hasOwn(limit, "output")) {
+        problems.push(doctorMessages.localModelLimits.missingOutput);
+        remedies.add(doctorMessages.localModelLimits.outputRemedy);
+      } else if (output === undefined) {
+        problems.push(doctorMessages.localModelLimits.invalidOutput);
+        remedies.add(doctorMessages.localModelLimits.invalidLimitRemedy);
+      }
+      if (limit === undefined || !hasOwn(limit, "context")) {
+        problems.push(doctorMessages.localModelLimits.missingContext);
+        const runtimeContext = detectedContexts.get(providerID)?.get(modelID);
+        remedies.add(runtimeContext === undefined ? doctorMessages.localModelLimits.unknownContextRemedy : doctorMessages.localModelLimits.detectedContextRemedy);
+      } else if (context === undefined) {
+        problems.push(doctorMessages.localModelLimits.invalidContext);
+        remedies.add(doctorMessages.localModelLimits.invalidLimitRemedy);
+      }
+      if (limit !== undefined && hasOwn(limit, "input") && inputLimit === undefined) {
+        problems.push(doctorMessages.localModelLimits.invalidInput);
+        remedies.add(doctorMessages.localModelLimits.invalidLimitRemedy);
+      }
+      if (output !== undefined && context !== undefined && output >= context) {
+        problems.push(doctorMessages.localModelLimits.outputExceedsContext);
+        remedies.add(doctorMessages.localModelLimits.invalidLimitRemedy);
+      }
+      if (output !== undefined && inputLimit !== undefined && inputLimit <= (compactionReserved ?? Math.min(DEFAULT_COMPACTION_RESERVED_MAX, output))) {
+        problems.push(doctorMessages.localModelLimits.outputExceedsInput);
+        remedies.add(doctorMessages.localModelLimits.invalidLimitRemedy);
+      }
+      if (problems.length > 0) {
+        warnings.push({
+          providerID,
+          modelID,
+          problems,
+          remedies: [...remedies]
+        });
+      }
+    }
+  }
+  return { inspectedModels, warnings };
+}
+function localModelLimitsSection(input) {
+  const report = collectLocalModelLimitWarnings(input);
+  if (report === undefined || report.inspectedModels === 0 && report.warnings.length === 0) {
+    return [];
+  }
+  if (report.warnings.length === 0) {
+    return [doctorMessages.localModelLimits.section, doctorMessages.localModelLimits.healthy];
+  }
+  const lines = [doctorMessages.localModelLimits.warningSummary(report.warnings.length)];
+  const remedies = new Set;
+  for (const warning of report.warnings) {
+    lines.push(doctorMessages.localModelLimits.modelWarning(warning.providerID, warning.modelID, warning.problems.join("; ")));
+    for (const remedy of warning.remedies) {
+      remedies.add(remedy);
+    }
+  }
+  for (const remedy of remedies) {
+    lines.push(remedy);
+  }
+  return lines;
+}
 function renderDoctor(input) {
   const enabledRuntimes = input.config.local.runtimes.filter((r) => r.enabled);
   const reachable = input.snapshots.filter((s) => s.reachable).length;
@@ -10264,6 +12322,7 @@ function renderDoctor(input) {
   if (input.gitignore !== undefined) {
     lines.push(...gitignoreSection(input.gitignore));
   }
+  lines.push(...localModelLimitsSection(input));
   if (input.otelBackend !== undefined) {
     const otel = input.otelBackend;
     lines.push("  opentelemetry:");
@@ -10798,9 +12857,7 @@ ${line}`);
   }
   return observation;
 }
-
 // src/commands/setup.ts
-var OPENTEAM_PLUGIN_SPEC = "@jmanuelcorral/openteam";
 var OPENCODE_GITIGNORE_PATH = ".opencode/.gitignore";
 var GENERATED_OPENTEAM_STATE_PATHS = [
   DEFAULT_TELEMETRY_PATH,
@@ -10931,7 +12988,7 @@ function isInsideRepo(repoRoot, relPath) {
 function isOpenteamEntry(entry) {
   if (typeof entry !== "string")
     return false;
-  return entry === OPENTEAM_PLUGIN_SPEC || entry.startsWith(`${OPENTEAM_PLUGIN_SPEC}@`);
+  return entry === OPENTEAM_PACKAGE_NAME || entry.startsWith(`${OPENTEAM_PACKAGE_NAME}@`);
 }
 function escapeRegex(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -11106,7 +13163,7 @@ function stripOpenteamFromOpencodeConfig(raw) {
   try {
     parsed = JSON.parse(stripped);
   } catch {
-    if (raw.includes(OPENTEAM_PLUGIN_SPEC)) {
+    if (raw.includes(OPENTEAM_PACKAGE_NAME)) {
       return {
         status: "failed",
         reason: "document is not valid JSON/JSONC; remove the @jmanuelcorral/openteam plugin entry manually"
@@ -11115,7 +13172,7 @@ function stripOpenteamFromOpencodeConfig(raw) {
     return { status: "not-present" };
   }
   if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
-    if (raw.includes(OPENTEAM_PLUGIN_SPEC)) {
+    if (raw.includes(OPENTEAM_PACKAGE_NAME)) {
       return {
         status: "failed",
         reason: "top-level value is not a JSON object; remove the @jmanuelcorral/openteam plugin entry manually"
@@ -11126,7 +13183,7 @@ function stripOpenteamFromOpencodeConfig(raw) {
   const record = parsed;
   const plugins = record.plugin;
   if (!Array.isArray(plugins)) {
-    if (raw.includes(OPENTEAM_PLUGIN_SPEC)) {
+    if (raw.includes(OPENTEAM_PACKAGE_NAME)) {
       return {
         status: "failed",
         reason: "could not locate a top-level plugin array; remove the @jmanuelcorral/openteam plugin entry manually"
@@ -11149,7 +13206,7 @@ function stripOpenteamFromOpencodeConfig(raw) {
   const { keyStart, arrayStart, arrayEnd } = bounds;
   if (remaining.length === 0) {
     const contents2 = removePluginKeyFromObject(raw, keyStart, arrayEnd);
-    const residue2 = contents2.includes(OPENTEAM_PLUGIN_SPEC) ? "openteam is still referenced in a nested context — remove it manually" : undefined;
+    const residue2 = contents2.includes(OPENTEAM_PACKAGE_NAME) ? "openteam is still referenced in a nested context — remove it manually" : undefined;
     return residue2 !== undefined ? { status: "removed", contents: contents2, residue: residue2 } : { status: "removed", contents: contents2 };
   }
   let arrayText = raw.slice(arrayStart, arrayEnd + 1);
@@ -11157,7 +13214,7 @@ function stripOpenteamFromOpencodeConfig(raw) {
     arrayText = removeEntryFromArrayText(arrayText, JSON.stringify(entry));
   }
   const contents = raw.slice(0, arrayStart) + arrayText + raw.slice(arrayEnd + 1);
-  const residue = contents.includes(OPENTEAM_PLUGIN_SPEC) ? "openteam is still referenced in a nested context — remove it manually" : undefined;
+  const residue = contents.includes(OPENTEAM_PACKAGE_NAME) ? "openteam is still referenced in a nested context — remove it manually" : undefined;
   return residue !== undefined ? { status: "removed", contents, residue } : { status: "removed", contents };
 }
 function stripOpenteamFromGitignore(raw) {
@@ -11221,7 +13278,7 @@ function describeItem(item) {
     case "agent":
       return `${item.path} (${item.name})`;
     case "opencode-config":
-      return `${item.path} (remove the ${OPENTEAM_PLUGIN_SPEC} plugin entry)`;
+      return `${item.path} (remove the ${OPENTEAM_PACKAGE_NAME} plugin entry)`;
     case "gitignore":
       return `${item.path} (remove openteam's generated-state rules)`;
     case "worktree":
@@ -11633,6 +13690,9 @@ var HELP = [
   "  openteam report                   Cost/savings summary (telemetry)",
   "  openteam clear-cache              List the plugin's frozen cache entries",
   "  openteam clear-cache --delete     Delete the frozen cache entries",
+  upgradeMessages.help.command,
+  upgradeMessages.help.check,
+  upgradeMessages.help.version,
   "  openteam purge                    List openteam's footprint (dry run, removes nothing)",
   "  openteam purge --delete           Interactively remove openteam category by category",
   "  openteam purge --yes              Remove every openteam category without prompting",
@@ -12210,6 +14270,7 @@ async function runCli(argv, deps) {
           telemetryRecords: records.length,
           agentModels,
           opencodeConfigPaths,
+          ...opencodeConfig !== undefined ? { opencodeConfig } : {},
           ...queueWait !== undefined ? { queueWait } : {},
           ...rosterAudit !== undefined ? { rosterAudit } : {},
           ...rosterRoleCount !== undefined ? { rosterRoleCount } : {},
@@ -12311,6 +14372,15 @@ async function runCli(argv, deps) {
         ...configWarning !== undefined ? { configWarning } : {}
       });
     }
+    if (command === "upgrade") {
+      if (deps.upgradePort === undefined) {
+        return {
+          exitCode: 1,
+          stdout: upgradeMessages.portNotConfigured
+        };
+      }
+      return await runUpgrade(parsed.positionals, deps.upgradePort, opencodeConfigPaths);
+    }
     if (command === "--version" || command === "-v") {
       return { exitCode: 0, stdout: deps.version };
     }
@@ -12330,7 +14400,7 @@ ${HELP}`
 }
 
 // src/plugin/commandTool.ts
-function commandArgv(action, model) {
+function commandArgv(action, model, version) {
   switch (action) {
     case "show":
       return ["baseline", "show"];
@@ -12348,11 +14418,15 @@ function commandArgv(action, model) {
       return ["console"];
     case "clear-cache":
       return ["clear-cache"];
+    case "upgrade":
+      return version === undefined ? ["upgrade"] : ["upgrade", "--version", version];
+    case "upgrade-check":
+      return version === undefined ? ["upgrade", "--check"] : ["upgrade", "--check", "--version", version];
   }
 }
 function createCommandTool(deps) {
   return tool({
-    description: "openteam runtime commands: baseline (show/set/auto), doctor, report, agents (LLM per agent: local/frontier + subscription) and console (status/URL of the web Console).",
+    description: "openteam runtime commands: baseline (show/set/auto), doctor, report, agents (LLM per agent: local/frontier + subscription), console (status/URL of the web Console), upgrade (update plugin pin) and upgrade-check (show current vs target without changes).",
     args: {
       action: tool.schema.enum([
         "show",
@@ -12362,12 +14436,15 @@ function createCommandTool(deps) {
         "report",
         "agents",
         "console",
-        "clear-cache"
+        "clear-cache",
+        "upgrade",
+        "upgrade-check"
       ]).describe("Action to run"),
-      model: tool.schema.string().optional().describe("Model provider/model (only for action=set)")
+      model: tool.schema.string().optional().describe("Model provider/model (only for action=set)"),
+      version: tool.schema.string().optional()
     },
     async execute(args) {
-      const result = await runCli(commandArgv(args.action, args.model), deps);
+      const result = await runCli(commandArgv(args.action, args.model, args.version), deps);
       return result.stdout;
     }
   });
@@ -12537,36 +14614,36 @@ function formatResponse(response) {
 }
 
 // src/plugin/reportRunSchema.ts
-import { z as z21 } from "zod";
+import { z as z22 } from "zod";
 
 // src/plugin/graphShadowIngress.ts
-import { z as z20 } from "zod";
+import { z as z21 } from "zod";
 var LEGACY_EXECUTION_TRACE_VERSION = 1;
-var LegacyExecutionStatusSchema = z20.enum([
+var LegacyExecutionStatusSchema = z21.enum([
   "completed",
   "failed",
   "cancelled"
 ]);
-var LegacyReviewOutcomeSchema = z20.enum([
+var LegacyReviewOutcomeSchema = z21.enum([
   "approved",
   "rejected",
   "inconclusive"
 ]);
-var LegacyTraceNodeV1Schema = z20.object({
+var LegacyTraceNodeV1Schema = z21.object({
   id: NodeIDSchema,
   role: NodeRoleSchema,
-  model: z20.string().min(1),
-  sessionRef: z20.string().min(1).optional(),
+  model: z21.string().min(1),
+  sessionRef: z21.string().min(1).optional(),
   errorClass: ErrorClassSchema.optional()
 }).strict();
-var LegacyExecutionTraceV1Schema = z20.object({
-  version: z20.literal(LEGACY_EXECUTION_TRACE_VERSION),
+var LegacyExecutionTraceV1Schema = z21.object({
+  version: z21.literal(LEGACY_EXECUTION_TRACE_VERSION),
   runID: NodeIDSchema,
   status: LegacyExecutionStatusSchema,
   outcome: LegacyReviewOutcomeSchema,
-  fixes: z20.number().int().nonnegative(),
-  nodes: z20.array(LegacyTraceNodeV1Schema).min(1),
-  parentSessionRef: z20.string().min(1).optional()
+  fixes: z21.number().int().nonnegative(),
+  nodes: z21.array(LegacyTraceNodeV1Schema).min(1),
+  parentSessionRef: z21.string().min(1).optional()
 }).strict();
 function gateReason2(gate) {
   if (gate === undefined || gate.mode === "off") {
@@ -12637,20 +14714,20 @@ function parseLegacyExecutionTrace(input) {
 }
 
 // src/plugin/reportRunSchema.ts
-var ReportRunNodeSchema = z21.object({
+var ReportRunNodeSchema = z22.object({
   id: NodeIDSchema,
   role: NodeRoleSchema,
-  model: z21.string().min(1),
-  ok: z21.boolean(),
-  sessionRef: z21.string().min(1).optional(),
+  model: z22.string().min(1),
+  ok: z22.boolean(),
+  sessionRef: z22.string().min(1).optional(),
   errorClass: ErrorClassSchema.optional()
 }).strict();
-var ReportRunPayloadSchema = z21.object({
+var ReportRunPayloadSchema = z22.object({
   runID: NodeIDSchema,
   status: LegacyExecutionStatusSchema,
-  fixes: z21.number().int().nonnegative(),
-  nodes: z21.array(ReportRunNodeSchema).min(1),
-  parentSessionRef: z21.string().min(1).optional()
+  fixes: z22.number().int().nonnegative(),
+  nodes: z22.array(ReportRunNodeSchema).min(1),
+  parentSessionRef: z22.string().min(1).optional()
 }).strict();
 
 // src/orchestrator/graphShadow.ts
@@ -13951,62 +16028,62 @@ ${lines.join(`
 }
 
 // src/memory/types.ts
-import { z as z22 } from "zod";
+import { z as z23 } from "zod";
 var SHARED_OWNER_KEY = "*";
-var OwnerKeySchema = z22.string().min(1);
-var MemoryKindSchema = z22.enum(["fact", "preference", "entity"]);
-var MemoryBaseSchema = z22.object({
-  id: z22.string().min(1),
+var OwnerKeySchema = z23.string().min(1);
+var MemoryKindSchema = z23.enum(["fact", "preference", "entity"]);
+var MemoryBaseSchema = z23.object({
+  id: z23.string().min(1),
   ownerKey: OwnerKeySchema,
-  confidence: z22.number().min(0).max(1),
-  validFrom: z22.number().finite(),
-  validUntil: z22.number().finite().nullable().default(null),
-  createdAt: z22.number().finite(),
-  invalidatedAt: z22.number().finite().nullable().default(null),
-  sourceHash: z22.string().min(1),
-  supersededBy: z22.string().min(1).nullable().default(null)
+  confidence: z23.number().min(0).max(1),
+  validFrom: z23.number().finite(),
+  validUntil: z23.number().finite().nullable().default(null),
+  createdAt: z23.number().finite(),
+  invalidatedAt: z23.number().finite().nullable().default(null),
+  sourceHash: z23.string().min(1),
+  supersededBy: z23.string().min(1).nullable().default(null)
 }).strict();
 var FactSchema = MemoryBaseSchema.extend({
-  kind: z22.literal("fact"),
-  subject: z22.string().min(1),
-  predicate: z22.string().min(1),
-  object: z22.string().min(1),
-  category: z22.string().min(1).nullable().default(null)
+  kind: z23.literal("fact"),
+  subject: z23.string().min(1),
+  predicate: z23.string().min(1),
+  object: z23.string().min(1),
+  category: z23.string().min(1).nullable().default(null)
 });
 var PreferenceSchema = MemoryBaseSchema.extend({
-  kind: z22.literal("preference"),
-  category: z22.string().min(1),
-  preference: z22.string().min(1),
-  context: z22.string().min(1).nullable().default(null),
-  lastAccessedAt: z22.number().finite().nullable().default(null),
-  accessCount: z22.number().int().min(0).default(0)
+  kind: z23.literal("preference"),
+  category: z23.string().min(1),
+  preference: z23.string().min(1),
+  context: z23.string().min(1).nullable().default(null),
+  lastAccessedAt: z23.number().finite().nullable().default(null),
+  accessCount: z23.number().int().min(0).default(0)
 });
 var EntitySchema = MemoryBaseSchema.extend({
-  kind: z22.literal("entity"),
-  canonicalName: z22.string().min(1),
-  type: z22.string().min(1),
-  aliases: z22.array(z22.string().min(1)).default([])
+  kind: z23.literal("entity"),
+  canonicalName: z23.string().min(1),
+  type: z23.string().min(1),
+  aliases: z23.array(z23.string().min(1)).default([])
 });
 var RelationSchema = MemoryBaseSchema.extend({
-  kind: z22.literal("relation"),
-  from: z22.string().min(1),
-  to: z22.string().min(1),
-  predicate: z22.string().min(1),
-  annotation: z22.string().min(1).nullable().default(null)
+  kind: z23.literal("relation"),
+  from: z23.string().min(1),
+  to: z23.string().min(1),
+  predicate: z23.string().min(1),
+  annotation: z23.string().min(1).nullable().default(null)
 });
-var MemoryRecordSchema = z22.discriminatedUnion("kind", [
+var MemoryRecordSchema = z23.discriminatedUnion("kind", [
   FactSchema,
   PreferenceSchema,
   EntitySchema,
   RelationSchema
 ]);
-var RecallQuerySchema = z22.object({
+var RecallQuerySchema = z23.object({
   ownerKey: OwnerKeySchema,
-  kinds: z22.array(MemoryKindSchema).default(["fact", "preference", "entity"]),
-  asOf: z22.number().finite().nullable().default(null),
-  limit: z22.number().int().positive().default(8),
-  minSimilarity: z22.number().min(0).max(1).default(0.2),
-  includeShared: z22.boolean().default(true)
+  kinds: z23.array(MemoryKindSchema).default(["fact", "preference", "entity"]),
+  asOf: z23.number().finite().nullable().default(null),
+  limit: z23.number().int().positive().default(8),
+  minSimilarity: z23.number().min(0).max(1).default(0.2),
+  includeShared: z23.boolean().default(true)
 }).strict();
 
 // src/memory/rank.ts
@@ -14577,42 +16654,42 @@ function buildMemoryInjector(deps, policy) {
 
 // src/plugin/memoryTool.ts
 import { tool as tool3 } from "@opencode-ai/plugin";
-import { z as z24 } from "zod";
+import { z as z25 } from "zod";
 
 // src/memory/extract.ts
-import { z as z23 } from "zod";
+import { z as z24 } from "zod";
 var REDACTED = "[redacted]";
-var RawFactSchema = z23.object({
-  subject: z23.string().min(1),
-  predicate: z23.string().min(1),
-  object: z23.string().min(1),
-  category: z23.string().min(1).nullable().optional(),
-  confidence: z23.number().min(0).max(1).optional()
+var RawFactSchema = z24.object({
+  subject: z24.string().min(1),
+  predicate: z24.string().min(1),
+  object: z24.string().min(1),
+  category: z24.string().min(1).nullable().optional(),
+  confidence: z24.number().min(0).max(1).optional()
 });
-var RawPreferenceSchema = z23.object({
-  category: z23.string().min(1),
-  preference: z23.string().min(1),
-  context: z23.string().min(1).nullable().optional(),
-  confidence: z23.number().min(0).max(1).optional()
+var RawPreferenceSchema = z24.object({
+  category: z24.string().min(1),
+  preference: z24.string().min(1),
+  context: z24.string().min(1).nullable().optional(),
+  confidence: z24.number().min(0).max(1).optional()
 });
-var RawEntitySchema = z23.object({
-  canonicalName: z23.string().min(1),
-  type: z23.string().min(1),
-  aliases: z23.array(z23.string().min(1)).optional(),
-  confidence: z23.number().min(0).max(1).optional()
+var RawEntitySchema = z24.object({
+  canonicalName: z24.string().min(1),
+  type: z24.string().min(1),
+  aliases: z24.array(z24.string().min(1)).optional(),
+  confidence: z24.number().min(0).max(1).optional()
 });
-var RawRelationSchema = z23.object({
-  from: z23.string().min(1),
-  to: z23.string().min(1),
-  predicate: z23.string().min(1),
-  annotation: z23.string().min(1).nullable().optional(),
-  confidence: z23.number().min(0).max(1).optional()
+var RawRelationSchema = z24.object({
+  from: z24.string().min(1),
+  to: z24.string().min(1),
+  predicate: z24.string().min(1),
+  annotation: z24.string().min(1).nullable().optional(),
+  confidence: z24.number().min(0).max(1).optional()
 }).strict();
-var RawExtractionSchema = z23.object({
-  facts: z23.array(RawFactSchema).default([]),
-  preferences: z23.array(RawPreferenceSchema).default([]),
-  entities: z23.array(RawEntitySchema).default([]),
-  relations: z23.array(RawRelationSchema).default([])
+var RawExtractionSchema = z24.object({
+  facts: z24.array(RawFactSchema).default([]),
+  preferences: z24.array(RawPreferenceSchema).default([]),
+  entities: z24.array(RawEntitySchema).default([]),
+  relations: z24.array(RawRelationSchema).default([])
 });
 var DEFAULT_CONFIDENCE = 0.6;
 var SYSTEM_PROMPT = [
@@ -14866,13 +16943,13 @@ var memoryToolMessages = {
 
 // src/plugin/memoryTool.ts
 var SCRIBE_ROLE_ID = "scribe";
-var MemoryMessageSchema = z24.object({
-  role: z24.enum(["system", "user", "assistant"]).describe(memoryToolMessages.messageRoleDescription),
-  content: z24.string().min(1).describe(memoryToolMessages.messageContentDescription)
+var MemoryMessageSchema = z25.object({
+  role: z25.enum(["system", "user", "assistant"]).describe(memoryToolMessages.messageRoleDescription),
+  content: z25.string().min(1).describe(memoryToolMessages.messageContentDescription)
 }).strict();
-var MemoryWritePayloadSchema = z24.object({
-  messages: z24.array(MemoryMessageSchema).min(1).describe(memoryToolMessages.messagesDescription),
-  roleID: z24.string().min(1).default(SCRIBE_ROLE_ID).describe(memoryToolMessages.roleIDDescription)
+var MemoryWritePayloadSchema = z25.object({
+  messages: z25.array(MemoryMessageSchema).min(1).describe(memoryToolMessages.messagesDescription),
+  roleID: z25.string().min(1).default(SCRIBE_ROLE_ID).describe(memoryToolMessages.roleIDDescription)
 }).strict();
 function createMemoryTool(deps) {
   return tool3({
@@ -14997,10 +17074,10 @@ function createOrchestratedModelOwnership() {
 
 // src/plugin/orchestrateTool.ts
 import { tool as tool4 } from "@opencode-ai/plugin";
-import { z as z26 } from "zod";
+import { z as z27 } from "zod";
 
 // src/orchestrator/coordinator.ts
-import { z as z25 } from "zod";
+import { z as z26 } from "zod";
 
 // src/orchestrator/nodeIteration.ts
 var DEFAULT_MAX_RETRIES = 2;
@@ -15009,7 +17086,7 @@ function nodePassBudget(maxRetries) {
 }
 
 // src/orchestrator/outputContract.ts
-import { createHash as createHash2 } from "node:crypto";
+import { createHash as createHash3 } from "node:crypto";
 var ROLE_REPORTS_ROOT = ".opencode/openteam-local/reports";
 var REPORT_STATUS_MARKER = "openteam-status";
 var REPORT_STATUS_LINE_PATTERN = /^[ ]{0,3}openteam-status:[ \t]*(.*?)[ \t]*$/i;
@@ -15076,7 +17153,7 @@ var REPORT_SEGMENT_HASH_CHARS = 24;
 var SAFE_REPORT_SEGMENT = /^[A-Za-z0-9](?:[A-Za-z0-9._-]{0,62}[A-Za-z0-9_-])?$/;
 var WINDOWS_DEVICE_NAME = /^(?:con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\.|$)/i;
 function reportSegmentHash(value) {
-  return createHash2("sha256").update(value, "utf8").digest("hex").slice(0, REPORT_SEGMENT_HASH_CHARS);
+  return createHash3("sha256").update(value, "utf8").digest("hex").slice(0, REPORT_SEGMENT_HASH_CHARS);
 }
 function reportPathSegment(value) {
   if (value.length <= MAX_REPORT_SEGMENT_CHARS && SAFE_REPORT_SEGMENT.test(value) && value === value.toLowerCase() && !WINDOWS_DEVICE_NAME.test(value)) {
@@ -15468,7 +17545,7 @@ function buildRecord(input, decision2, subsession, deps, decisionID, batchID) {
   }
   return record;
 }
-var TelemetryFailureClassSchema = z25.enum([
+var TelemetryFailureClassSchema = z26.enum([
   "create-rejected",
   "create-no-id",
   "prompt-rejected",
@@ -16284,7 +18361,7 @@ async function runRoleTasks(inputs, deps, options = {}) {
 var _pluginWarnedRoles = new Set;
 var EMPTY_ROLE_ID_SET = new Set;
 var SAFE_ROLE_ID = /^[A-Za-z0-9][A-Za-z0-9_-]*$/;
-var RoleIDSchema = z26.string().min(1).superRefine((roleID, ctx) => {
+var RoleIDSchema = z27.string().min(1).superRefine((roleID, ctx) => {
   if (!SAFE_ROLE_ID.test(roleID)) {
     ctx.addIssue({
       code: "custom",
@@ -16292,16 +18369,16 @@ var RoleIDSchema = z26.string().min(1).superRefine((roleID, ctx) => {
     });
   }
 });
-var RoleAssignmentSchema = z26.object({
+var RoleAssignmentSchema = z27.object({
   roleID: RoleIDSchema.describe("Role identifier from the roster"),
-  prompt: z26.string().min(1).describe("Work prompt for this role"),
-  title: z26.string().min(1).optional().describe("Human-readable title"),
-  dependsOn: z26.array(RoleIDSchema).optional().describe("Role IDs this assignment depends on (DAG edges)")
+  prompt: z27.string().min(1).describe("Work prompt for this role"),
+  title: z27.string().min(1).optional().describe("Human-readable title"),
+  dependsOn: z27.array(RoleIDSchema).optional().describe("Role IDs this assignment depends on (DAG edges)")
 }).strict();
-var OrchestratePayloadSchema = z26.object({
-  assignments: z26.array(RoleAssignmentSchema).min(1).describe("Role assignments to distribute"),
-  parentSessionID: z26.string().min(1).optional().describe("Parent session for subsessions"),
-  directory: z26.string().min(1).optional().describe("Working directory override")
+var OrchestratePayloadSchema = z27.object({
+  assignments: z27.array(RoleAssignmentSchema).min(1).describe("Role assignments to distribute"),
+  parentSessionID: z27.string().min(1).optional().describe(PARENT_SESSION_DESCRIPTION),
+  directory: z27.string().min(1).optional().describe("Working directory override")
 }).strict();
 function validateAssignmentDependencies(assignments) {
   const ids = new Set;
@@ -16359,12 +18436,12 @@ function validateAssignmentDependencies(assignments) {
   }
   return;
 }
-function isRecord5(value) {
+function isRecord7(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function nestedRecord2(value, key) {
   const nested = value[key];
-  return isRecord5(nested) ? nested : undefined;
+  return isRecord7(nested) ? nested : undefined;
 }
 function numberField(records, keys) {
   for (const record of records) {
@@ -16437,7 +18514,7 @@ function retryableFailure(failureClass, statusCode, declared) {
   return failureClass === "prompt-timeout" || failureClass === "prompt-rate-limited" || failureClass === "prompt-connection" || failureClass === "prompt-server" || statusCode !== undefined && statusCode >= 500 && statusCode <= 599;
 }
 function normalizeSdkSessionFailure(error, stage) {
-  const root = isRecord5(error) ? error : {};
+  const root = isRecord7(error) ? error : {};
   const data = nestedRecord2(root, "data");
   const nestedError = nestedRecord2(root, "error");
   const records = [
@@ -16456,7 +18533,7 @@ function normalizeSdkSessionFailure(error, stage) {
   };
 }
 function nestedAssistantFailure(data) {
-  if (!isRecord5(data)) {
+  if (!isRecord7(data)) {
     return;
   }
   return nestedRecord2(data, "info")?.error;
@@ -16917,14 +18994,19 @@ function createOrchestrateTool(deps) {
         title: tool4.schema.string().optional().describe("Human-readable title"),
         dependsOn: tool4.schema.array(tool4.schema.string()).optional().describe("Role IDs this assignment depends on")
       })).describe("Role assignments to distribute"),
-      parentSessionID: tool4.schema.string().optional().describe("Parent session for subsessions"),
+      parentSessionID: tool4.schema.string().optional().describe(PARENT_SESSION_DESCRIPTION),
       directory: tool4.schema.string().optional().describe("Working directory override")
     },
-    async execute(args) {
+    async execute(args, context) {
       const parsed = OrchestratePayloadSchema.safeParse(args);
       if (!parsed.success) {
         return `validation error: ${parsed.error.message}`;
       }
+      if (typeof context.sessionID !== "string" || !context.sessionID.trim()) {
+        return HOST_SESSION_REQUIRED;
+      }
+      const parentOverrideIgnored = parsed.data.parentSessionID !== undefined && parsed.data.parentSessionID !== context.sessionID;
+      parsed.data.parentSessionID = context.sessionID;
       const depError = validateAssignmentDependencies(parsed.data.assignments);
       if (depError !== undefined) {
         return dependencyValidationError(depError.code, depError.detail);
@@ -16959,7 +19041,7 @@ function createOrchestrateTool(deps) {
               taskID: batchID,
               kind: "coordinator",
               roleID: "openteam",
-              agentID: "openteam",
+              agentID: context.agent,
               ...parsed.data.parentSessionID === undefined ? {} : { sessionID: parsed.data.parentSessionID }
             }
           });
@@ -16998,7 +19080,9 @@ function createOrchestrateTool(deps) {
         lifecycleStatus = activeLifecycleRecorder?.status() ?? lifecycleStatus;
         const projected = projectResults(batch.results, batch.cancelled);
         const shadowResult = await runShadowProducer(deps, parsed.data, batch);
-        const base = formatResult(projected);
+        const base = formatResult(projected) + (parentOverrideIgnored ? `
+
+${PARENT_OVERRIDE_IGNORED}` : "");
         const advisory = singleAssignmentAdvisory(parsed.data.assignments.length, assignableRoleIDs(deps.config).length);
         const withAdvisory = advisory === undefined ? base : `${base}
 
@@ -17030,7 +19114,7 @@ ${advisory}`;
 
 // src/plugin/registerCastTool.ts
 import { tool as tool5 } from "@opencode-ai/plugin";
-import { z as z27 } from "zod";
+import { z as z28 } from "zod";
 
 // src/orchestrator/rosterPersistence.ts
 function rosterFence(roster) {
@@ -17065,13 +19149,13 @@ async function persistRosterPreservingProse(storage, roster, path4 = OPENTEAM_RO
 }
 
 // src/plugin/registerCastTool.ts
-var CastEntrySchema = z27.object({
-  roleID: z27.string().min(1).describe("Stable role identifier, e.g. scribe or guardian"),
-  agentName: z27.string().min(1).describe("Themed character name assigned to the role")
+var CastEntrySchema = z28.object({
+  roleID: z28.string().min(1).describe("Stable role identifier, e.g. scribe or guardian"),
+  agentName: z28.string().min(1).describe("Themed character name assigned to the role")
 }).strict();
-var RegisterCastPayloadSchema = z27.object({
-  universe: z27.string().min(1).describe("Casting universe for this roster"),
-  entries: z27.array(CastEntrySchema).min(1).describe("Role-to-name mappings")
+var RegisterCastPayloadSchema = z28.object({
+  universe: z28.string().min(1).describe("Casting universe for this roster"),
+  entries: z28.array(CastEntrySchema).min(1).describe("Role-to-name mappings")
 }).strict();
 function offendingFields(error) {
   const fields = error.issues.flatMap((issue) => {
@@ -17361,7 +19445,7 @@ async function buildMemoryRuntimeFromConfig(config, deps, options = {}) {
 }
 
 // src/storage/lifecycle/fsLifecycleJournal.ts
-import { randomUUID as randomUUID2 } from "node:crypto";
+import { randomUUID as randomUUID3 } from "node:crypto";
 import {
   lstatSync as lstatSync3,
   mkdirSync as mkdirSync3,
@@ -17371,22 +19455,22 @@ import {
   statSync,
   unlinkSync as unlinkSync2
 } from "node:fs";
-import { join as join12, resolve as resolve7 } from "node:path";
+import { join as join13, resolve as resolve8 } from "node:path";
 import { ZodError } from "zod";
 
 // src/storage/lifecycle/codec.ts
-import { z as z28 } from "zod";
+import { z as z29 } from "zod";
 var LIFECYCLE_CODEC_VERSION = 1;
 var LIFECYCLE_GENESIS_DIGEST = sha256Hex("openteam/lifecycle-journal/genesis/v1");
 var NUL5 = "\x00";
 var NEWLINE2 = `
 `;
-var frameSchema = z28.object({
-  v: z28.literal(LIFECYCLE_CODEC_VERSION),
-  seq: z28.number().int().nonnegative(),
-  prev: z28.string().min(1),
-  sum: z28.string().min(1),
-  event: z28.unknown()
+var frameSchema = z29.object({
+  v: z29.literal(LIFECYCLE_CODEC_VERSION),
+  seq: z29.number().int().nonnegative(),
+  prev: z29.string().min(1),
+  sum: z29.string().min(1),
+  event: z29.unknown()
 }).strict();
 function canonical2(value) {
   if (Array.isArray(value)) {
@@ -17473,7 +19557,7 @@ function decodeLifecycleJournal(text) {
 }
 
 // src/storage/lifecycle/fsLifecycleSupport.ts
-import { randomUUID } from "node:crypto";
+import { randomUUID as randomUUID2 } from "node:crypto";
 import {
   appendFileSync,
   closeSync as closeSync2,
@@ -17490,7 +19574,7 @@ import {
   unlinkSync,
   writeSync as writeSync2
 } from "node:fs";
-import { basename as basename2, dirname as dirname4, join as join11, relative as relative2, resolve as resolve6 } from "node:path";
+import { basename as basename3, dirname as dirname5, join as join12, relative as relative3, resolve as resolve7 } from "node:path";
 var SAFE_RUN_ID = /^[A-Za-z0-9](?:[A-Za-z0-9._-]{0,126}[A-Za-z0-9])?$/u;
 
 class LifecycleFsError extends Error {
@@ -17514,7 +19598,7 @@ function validateRunID(runID) {
 }
 function resolvedLifecycleRoot(root) {
   try {
-    const absolute = resolve6(root);
+    const absolute = resolve7(root);
     mkdirSync2(absolute, { recursive: true });
     const rootStat = lstatSync2(absolute);
     if (!rootStat.isDirectory() || rootStat.isSymbolicLink()) {
@@ -17530,8 +19614,8 @@ function resolvedLifecycleRoot(root) {
 }
 function directRunPath(root, runID) {
   validateRunID(runID);
-  const path4 = join11(root, runID);
-  if (dirname4(path4) !== root || basename2(path4) !== runID) {
+  const path4 = join12(root, runID);
+  if (dirname5(path4) !== root || basename3(path4) !== runID) {
     throw new LifecycleFsError("corrupt");
   }
   return path4;
@@ -17556,8 +19640,8 @@ function assertExistingSafeRun(root, runID) {
   } catch {
     throw new LifecycleFsError("unavailable");
   }
-  const child = relative2(root, real);
-  if (child === "" || child.startsWith("..") || resolve6(root, child) !== real || dirname4(real) !== root) {
+  const child = relative3(root, real);
+  if (child === "" || child.startsWith("..") || resolve7(root, child) !== real || dirname5(real) !== root) {
     throw new LifecycleFsError("corrupt");
   }
   return real;
@@ -17606,7 +19690,7 @@ function appendDurable2(path4, content) {
   }
 }
 function writeDurableAtomically(path4, content) {
-  const temporary = join11(dirname4(path4), `.${basename2(path4)}.${randomUUID()}.next`);
+  const temporary = join12(dirname5(path4), `.${basename3(path4)}.${randomUUID2()}.next`);
   try {
     writeDurable2(temporary, content);
     renameSync(temporary, path4);
@@ -17628,8 +19712,8 @@ function readLockContents(path4) {
   }
 }
 function withRunMutationLock(runDir, mutate) {
-  const lockPath = join11(runDir, ".mutation-lock");
-  const lockToken = randomUUID();
+  const lockPath = join12(runDir, ".mutation-lock");
+  const lockToken = randomUUID2();
   let descriptor;
   try {
     descriptor = openSync2(lockPath, "wx");
@@ -17698,7 +19782,7 @@ function parseJson(text, parse2) {
   }
 }
 function issueWriterToken() {
-  return randomUUID2().replaceAll("-", "");
+  return randomUUID3().replaceAll("-", "");
 }
 function createLease(runID, writerToken, input) {
   return parseLifecycleWriterLease({
@@ -17713,12 +19797,12 @@ function createLease(runID, writerToken, input) {
   });
 }
 function readLease2(runDir) {
-  const text = readUtf8(join12(runDir, OWNER_FILE2));
+  const text = readUtf8(join13(runDir, OWNER_FILE2));
   return text === undefined ? undefined : parseJson(text, parseLifecycleWriterLease);
 }
 function readRun(runDir, runID) {
-  const metadataPath = join12(runDir, METADATA_FILE);
-  const eventsPath = join12(runDir, EVENTS_FILE);
+  const metadataPath = join13(runDir, METADATA_FILE);
+  const eventsPath = join13(runDir, EVENTS_FILE);
   assertSafeRegularFile(metadataPath);
   assertSafeRegularFile(eventsPath);
   const metadataText = readUtf8(metadataPath);
@@ -17765,7 +19849,7 @@ function summaryForRun(runDir, runID) {
 }
 function runBytes(runDir) {
   return readdirSync2(runDir).reduce((total, entry) => {
-    const path4 = join12(runDir, entry);
+    const path4 = join13(runDir, entry);
     const stats = lstatSync3(path4);
     if (!stats.isFile() || stats.isSymbolicLink()) {
       throw new LifecycleFsError("corrupt");
@@ -17797,7 +19881,7 @@ function canDeleteTerminalRun(runDir, runID, now) {
   return now >= lease.expiresAt;
 }
 var createFsLifecycleJournal = (options) => {
-  const configuredRoot = resolve7(options.root);
+  const configuredRoot = resolve8(options.root);
   const now = options.now ?? Date.now;
   const mutateRun = options.withMutationLock ?? withRunMutationLock;
   return {
@@ -17819,7 +19903,7 @@ var createFsLifecycleJournal = (options) => {
             throw error;
           }
         }
-        stagingPath = join12(root, `.start-${runID}-${randomUUID2()}`);
+        stagingPath = join13(root, `.start-${runID}-${randomUUID3()}`);
         mkdirSync3(stagingPath);
         const writerToken = issueWriterToken();
         const eventAt = now();
@@ -17839,10 +19923,10 @@ var createFsLifecycleJournal = (options) => {
           executionAuthority: parsedInput.executionAuthority,
           root: parsedInput.root
         });
-        writeDurable2(join12(stagingPath, METADATA_FILE), `${JSON.stringify(metadata)}
+        writeDurable2(join13(stagingPath, METADATA_FILE), `${JSON.stringify(metadata)}
 `);
-        writeDurable2(join12(stagingPath, EVENTS_FILE), encodeLifecycleJournal([event]));
-        writeDurable2(join12(stagingPath, OWNER_FILE2), `${JSON.stringify(lease)}
+        writeDurable2(join13(stagingPath, EVENTS_FILE), encodeLifecycleJournal([event]));
+        writeDurable2(join13(stagingPath, OWNER_FILE2), `${JSON.stringify(lease)}
 `);
         try {
           renameSync2(stagingPath, runPath);
@@ -17884,7 +19968,7 @@ var createFsLifecycleJournal = (options) => {
           }
           const writerToken = issueWriterToken();
           const lease = createLease(runID, writerToken, parsedLeaseInput);
-          writeDurableAtomically(join12(runDir, OWNER_FILE2), `${JSON.stringify(lease)}
+          writeDurableAtomically(join13(runDir, OWNER_FILE2), `${JSON.stringify(lease)}
 `);
           return ok({ runID, writerToken });
         });
@@ -17941,7 +20025,7 @@ var createFsLifecycleJournal = (options) => {
             ...parsedBody
           });
           const frame = encodeLifecycleFrame(loaded.decoded.digest, committedEvent);
-          appendDurable2(join12(runDir, EVENTS_FILE), `${frame.line}
+          appendDurable2(join13(runDir, EVENTS_FILE), `${frame.line}
 `);
           return ok({ event: committedEvent, head: actualHead + 1 });
         });
@@ -17971,7 +20055,7 @@ var createFsLifecycleJournal = (options) => {
             heartbeatAt: parsed.now,
             expiresAt: parsed.now + parsed.leaseDurationMs
           });
-          writeDurableAtomically(join12(runDir, OWNER_FILE2), `${JSON.stringify(lease)}
+          writeDurableAtomically(join13(runDir, OWNER_FILE2), `${JSON.stringify(lease)}
 `);
           return ok({ lease });
         });
@@ -17991,7 +20075,7 @@ var createFsLifecycleJournal = (options) => {
               runID: handle.runID
             }));
           }
-          unlinkSync2(join12(runDir, OWNER_FILE2));
+          unlinkSync2(join13(runDir, OWNER_FILE2));
           return ok(undefined);
         });
       } catch (error) {
@@ -18102,14 +20186,14 @@ var createFsLifecycleJournal = (options) => {
 };
 
 // src/storage/lifecycle/fsLifecycleWriterLivenessProbe.ts
-import { join as join13 } from "node:path";
+import { join as join14 } from "node:path";
 var createFsLifecycleWriterLivenessProbe = (options) => ({
   async observe(runID) {
     const observedAt = options.now();
     try {
       const root = resolvedLifecycleRoot(options.root);
       const runDir = assertExistingSafeRun(root, runID);
-      const ownerText = readUtf8(join13(runDir, "owner"));
+      const ownerText = readUtf8(join14(runDir, "owner"));
       if (ownerText === undefined) {
         return { kind: "absent", observedAt };
       }
@@ -18196,111 +20280,6 @@ var createOtlpSpanExporter = (connection, config) => {
     }
   };
 };
-// package.json
-var package_default = {
-  name: "@jmanuelcorral/openteam",
-  version: "0.20.0",
-  packageManager: "bun@1.3.14",
-  description: "Cost-aware, local-first routing plugin for opencode with cheapest-capable frontier fallback and multi-agent orchestration.",
-  license: "MIT",
-  author: "Jose Manuel Corral",
-  repository: {
-    type: "git",
-    url: "git+https://github.com/jmanuelcorral/openteam.git"
-  },
-  homepage: "https://github.com/jmanuelcorral/openteam#readme",
-  bugs: {
-    url: "https://github.com/jmanuelcorral/openteam/issues"
-  },
-  keywords: [
-    "opencode",
-    "opencode-plugin",
-    "llm",
-    "routing",
-    "local-llm",
-    "ollama",
-    "lm-studio",
-    "foundry-local",
-    "cost-optimization",
-    "multi-agent"
-  ],
-  engines: {
-    bun: ">=1.3",
-    node: "^22.22.2 || ^24.15.0 || >=26.0.0"
-  },
-  type: "module",
-  main: "./dist/index.js",
-  module: "./dist/index.js",
-  types: "./dist/index.d.ts",
-  bin: {
-    openteam: "./dist/cli.js"
-  },
-  exports: {
-    ".": {
-      types: "./dist/index.d.ts",
-      import: "./dist/index.js"
-    },
-    "./package.json": "./package.json"
-  },
-  files: [
-    "dist",
-    "README.md",
-    "LICENSE",
-    "AGENTS.md",
-    ".opencode/openteam.example.json",
-    ".opencode/command/openteam.md"
-  ],
-  publishConfig: {
-    access: "public",
-    registry: "https://registry.npmjs.org/"
-  },
-  trustedDependencies: [],
-  sideEffects: false,
-  scripts: {
-    prebuild: "bun run clean",
-    build: "bun run build:js && bun run build:cli && bun run build:types && bun run build:certificates",
-    "build:js": "bun build ./src/index.ts --target=node --format=esm --outfile=dist/index.js --external @opencode-ai/plugin --external @opencode-ai/sdk --external zod --external @opentelemetry/api --external @opentelemetry/sdk-trace-base --external @opentelemetry/exporter-trace-otlp-http --external @opentelemetry/resources --external @langchain/langgraph",
-    "build:cli": 'bun build ./src/cli.ts --target=node --format=esm --outfile=dist/cli.js --banner "#!/usr/bin/env node" --external @opencode-ai/plugin --external @opencode-ai/sdk --external zod --external @clack/prompts --external @opentelemetry/api --external @opentelemetry/sdk-trace-base --external @opentelemetry/exporter-trace-otlp-http --external @opentelemetry/resources --external @langchain/langgraph',
-    "build:types": "tsc -p tsconfig.build.json",
-    clean: `node -e "require('node:fs').rmSync('dist', { recursive: true, force: true })"`,
-    test: "bun test",
-    "test:cov": "bun test --coverage",
-    "certify:shadow": "bun run scripts/certify-artifact.ts shadow",
-    "certify:release": "bun run scripts/certify-artifact.ts release",
-    "build:certificates": "bun run certify:shadow && bun run certify:release && bun run scripts/bundle-certificates.ts",
-    "coverage:check": "node scripts/check-coverage.mjs",
-    typecheck: "tsc --noEmit",
-    lint: "biome check .",
-    "format:check": "biome format .",
-    "docs:install": "cd docs && bun install --frozen-lockfile --ignore-scripts",
-    "docs:dev": "cd docs && bun run docs:dev",
-    "docs:build": "cd docs && bun run docs:build",
-    "docs:preview": "cd docs && bun run docs:preview",
-    prepublishOnly: "bun run build",
-    "link:local": "bun run build && npm link",
-    "hooks:install": "git config core.hooksPath .githooks"
-  },
-  dependencies: {
-    "@clack/prompts": "1.7.0",
-    "@langchain/core": "1.2.9",
-    "@langchain/langgraph": "1.4.12",
-    "@opencode-ai/plugin": "1.18.19",
-    "@opencode-ai/sdk": "1.18.19",
-    "@opentelemetry/api": "1.9.1",
-    "@opentelemetry/exporter-trace-otlp-http": "0.221.0",
-    "@opentelemetry/resources": "2.10.0",
-    "@opentelemetry/sdk-trace-base": "2.10.0",
-    zod: "4.4.3"
-  },
-  devDependencies: {
-    "@biomejs/biome": "2.5.9",
-    "@types/bun": "1.3.14",
-    typescript: "7.0.2"
-  }
-};
-
-// src/version.ts
-var PACKAGE_VERSION = package_default.version;
 
 // src/index.ts
 var LIFECYCLE_WRITER_IDENTITY = {
@@ -18402,7 +20381,7 @@ var RELEASE_CERT_PATH = "artifacts/graph-release-certificate.json";
 var SOAK_CERT_PATH = "artifacts/graph-soak-certificate.json";
 async function readPackagedCertificate(path4) {
   try {
-    return await readFile3(new URL(`./certificates/${basename3(path4)}`, import.meta.url), "utf8");
+    return await readFile4(new URL(`./certificates/${basename4(path4)}`, import.meta.url), "utf8");
   } catch {
     return;
   }
@@ -18417,7 +20396,7 @@ async function readAndParseCertificate(storage, path4, parse2, digestExtractor,
     const cert = parse2(raw);
     return { status: "valid", digest: digestExtractor(cert) };
   } catch (error) {
-    if (isMissingFile(error)) {
+    if (isMissingFile2(error)) {
       return { status: "absent" };
     }
     if (error instanceof ShadowCertificateError || error instanceof ReleaseCertificateError || error instanceof SoakCertificateError) {
@@ -18534,8 +20513,8 @@ async function readOpencodeVersion(serverUrl, options = {}) {
 }
 var DEFAULT_OPENCODE_VERSION_BACKOFF_MS = [50, 250];
 function defaultSleep(ms) {
-  return new Promise((resolve8) => {
-    setTimeout(resolve8, ms);
+  return new Promise((resolve9) => {
+    setTimeout(resolve9, ms);
   });
 }
 function createLazyOpencodeVersionReader(serverUrl, options = {}) {
@@ -18663,7 +20642,7 @@ function createEventSink(rawOptions, storage = createFsStorageProvider(process.c
   });
   return sink;
 }
-function isMissingFile(error) {
+function isMissingFile2(error) {
   return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
 }
 function configReadFailure(path4) {
@@ -18703,7 +20682,7 @@ async function readRoutingRosterEntries(storage) {
   return content === undefined ? [] : parseRoster(content).entries;
 }
 var auditStoredRosterForDoctor = (roster, configuredRoles) => typeof roster === "string" ? auditRoster(roster, configuredRoles) : auditRoster(roster, configuredRoles);
-function createCliDeps(config, registry, telemetryPath, sessionsDir = DEFAULT_SESSIONS_DIR, storage = createFsStorageProvider(process.cwd()), fallbackSource = "options", rawOptions, resolveOpencodeVersion) {
+function createCliDeps(config, registry, telemetryPath, sessionsDir = DEFAULT_SESSIONS_DIR, storage = createFsStorageProvider(process.cwd()), fallbackSource = "options", rawOptions, resolveOpencodeVersion, workspaceRoot = process.cwd()) {
   return {
     loadConfig: async (path4, resolution = { explicit: false }) => {
       const content = await readCliConfigFromStorage(storage, path4, resolution);
@@ -18786,12 +20765,13 @@ function createCliDeps(config, registry, telemetryPath, sessionsDir = DEFAULT_SE
     telemetryPath,
     opencodeConfigPaths: OPENCODE_CONFIG_CANDIDATES,
     orchestratorAgentPath: ORCHESTRATOR_AGENT_PATH,
-    agentDir: dirname5(ORCHESTRATOR_AGENT_PATH),
+    agentDir: dirname6(ORCHESTRATOR_AGENT_PATH),
     cachePort: realCacheAdapter,
     purge: createPluginPurgeRuntime(sessionsDir),
     loadRosterForDoctor: () => readStoredRosterForDoctor(storage),
     auditRoster: auditStoredRosterForDoctor,
-    version: PACKAGE_VERSION
+    version: PACKAGE_VERSION,
+    upgradePort: createFsUpgradePort(workspaceRoot, globalThis.fetch)
   };
 }
 function createPluginPurgeRuntime(sessionsDir) {
@@ -18916,7 +20896,7 @@ var server = async (ctx, rawOptions) => {
   const cliDeps = createCliDeps(config, registry, telemetryPath, sessionsDir, storage, runtimeConfig.source, rawOptions, async () => {
     const version = await getOpencodeVersion();
     return version === "unknown" ? undefined : version;
-  });
+  }, workspaceRoot);
   const toolcalls = createToolcallTracker({ sink });
   const announcedSessions = new Set;
   const announceEndpoint = (sessionID) => {
@@ -19058,8 +21038,8 @@ var server = async (ctx, rawOptions) => {
     lifecycleRecorder,
     abortGraceMs: DEFAULT_ABORT_GRACE_MS,
     statusPollMs: DEFAULT_STATUS_POLL_MS,
-    delay: (ms) => new Promise((resolve8) => {
-      setTimeout(resolve8, ms);
+    delay: (ms) => new Promise((resolve9) => {
+      setTimeout(resolve9, ms);
     }),
     warn: diagnostics.warn("unknown-role")
   });
@@ -19129,7 +21109,7 @@ export {
   logTelemetryError,
   logOpencodeServerUrl,
   logAvailabilityRefreshError,
-  isMissingFile,
+  isMissingFile2 as isMissingFile,
   evaluateCutoverGateForBoundary,
   src_default as default,
   createOpencodeVersionReadFailureLogger,