@kinetica/admin-agent 0.1.1 → 0.1.3

package/dist/admin-agent.js

@@ -111,1069 +111,831 @@ function printBanner(model) {
   const version = getVersion();
   const subtitle = `admin-agent ${import_picocolors.default.dim(`v${version}`)}`;
   const header = model ? `${subtitle}
-${import_picocolors.default.dim(`model: ${model}`)}` : subtitle;
+${import_picocolors.default.dim(`Model: ${model}`)}` : subtitle;
   process.stderr.write("\n\n" + gradientize(LOGO) + "\n\n" + header + "\n");
   return subtitle;
 }
 
-// src/auth/preflight.ts
-var import_claude_agent_sdk = require("@anthropic-ai/claude-agent-sdk");
+// src/cli/select-model.ts
+var import_prompts5 = require("@inquirer/prompts");
 
-// src/auth/oauth-flow.ts
-var import_picocolors2 = __toESM(require("picocolors"));
+// src/agent/run-agent.ts
+var import_claude_agent_sdk4 = require("@anthropic-ai/claude-agent-sdk");
+var import_prompts4 = require("@inquirer/prompts");
+var import_picocolors8 = __toESM(require("picocolors"));
 
-// src/auth/open-browser.ts
-var import_child_process = require("child_process");
-function openBrowser(url) {
-  try {
-    const platform = process.platform;
-    const { command, args } = platform === "darwin" ? { command: "open", args: [url] } : platform === "win32" ? { command: "cmd", args: ["/c", "start", "", url] } : { command: "xdg-open", args: [url] };
-    const child = (0, import_child_process.spawn)(command, args, { detached: true, stdio: "ignore" });
-    child.unref();
-    return true;
-  } catch {
-    return false;
-  }
+// src/agent/diagnostic-sql.ts
+function has(columns, name) {
+  return columns.includes(name);
 }
-
-// src/auth/oauth-flow.ts
-async function resolveAuthentication(agentQuery, options) {
-  if (options.hasApiKey && !options.forceLogin) {
-    return { method: "api_key" };
-  }
-  const query3 = agentQuery;
-  try {
-    const { manualUrl, automaticUrl } = await query3.claudeAuthenticate(options.loginWithClaudeAi);
-    const opened = openBrowser(automaticUrl);
-    if (opened) {
-      process.stderr.write(import_picocolors2.default.dim("Browser opened for login. Waiting for authentication...\n"));
-    } else {
-      process.stderr.write(`
-Open this URL in your browser to log in:
-${import_picocolors2.default.bold(manualUrl)}
-
-`);
-      process.stderr.write(import_picocolors2.default.dim("Waiting for browser login to complete...\n"));
-    }
-    await query3.claudeOAuthWaitForCompletion();
-    return { method: "oauth" };
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    process.stderr.write(
-      import_picocolors2.default.yellow(`
-Warning: OAuth login failed (${message}). SDK may retry automatically.
-`)
-    );
-    return { method: "oauth" };
-  }
+var FALLBACK_QUERY_HISTORY_SQL = `-- Slow queries in the last hour
+SELECT query_id, user_name, query_text, start_time, stop_time,
+       TIMESTAMPDIFF(SECOND, start_time, stop_time) AS elapsed_sec
+FROM ki_catalog.ki_query_history
+WHERE start_time > NOW() - INTERVAL '1' HOUR
+ORDER BY elapsed_sec DESC
+LIMIT 20;`;
+var FALLBACK_ACTIVE_QUERIES_SQL = `-- Currently active queries
+SELECT query_id, user_name, query_text, start_time, execution_status
+FROM ki_catalog.ki_query_active_all
+ORDER BY start_time ASC;`;
+var FALLBACK_TIERED_OBJECTS_SQL = `-- Objects in disk tier (potential memory pressure)
+-- NOTE: id is a string (e.g. @schema@oid[col][0]), NOT a numeric OID. Filter by table: WHERE id LIKE '%table_name%'
+-- For per-table tier placement, prefer kinetica_resource_objects with table_names filter.
+SELECT id, tier, size, source_rank, owner_resource_group
+FROM ki_catalog.ki_tiered_objects
+WHERE tier != 'VRAM'
+ORDER BY size DESC
+LIMIT 20;`;
+var FALLBACK_OBJ_STAT_SQL = `-- Table sizes and row counts
+SELECT object_name, total_bytes, row_count
+FROM ki_catalog.ki_obj_stat
+ORDER BY total_bytes DESC
+LIMIT 30;`;
+var FALLBACK_COLUMNS_SQL = `-- Structural column metadata (use kinetica_show_table for Kinetica-native types)
+SELECT c.table_name, c.column_name, c.column_position
+FROM ki_catalog.ki_columns c
+WHERE c.table_name = '<TABLE_NAME>'
+ORDER BY c.column_position;`;
+var FALLBACK_DATATYPES_SQL = `-- Resolve column_type_oid to human-readable type name
+SELECT oid, name, sql_typename
+FROM ki_catalog.ki_datatypes
+ORDER BY oid;`;
+var FALLBACK_QUERY_SPAN_METRICS_SQL = `-- Query span metrics for a specific query
+SELECT query_id, span_id, parent_span_id, operator, sql_step,
+       metric_data, start_time, stop_time, source_rank
+FROM ki_catalog.ki_query_span_metrics_all
+WHERE query_id = '<QUERY_ID>'
+ORDER BY start_time;`;
+var FALLBACK_QUERY_WORKERS_SQL = `-- Active query workers (non-idle)
+SELECT job_id, worker_id, type, status, elapsed_time_ms, source_rank
+FROM ki_catalog.ki_query_workers
+WHERE status != 'IDLE'
+ORDER BY elapsed_time_ms DESC;`;
+var FALLBACK_OBJECTS_SQL = `-- Object registry and metadata
+SELECT oid, object_name, schema_name, type_id, persistence, obj_kind,
+       creation_time, last_read_time, read_count, write_count
+FROM ki_catalog.ki_objects
+ORDER BY last_read_time DESC
+LIMIT 30;`;
+var FALLBACK_PARTITIONS_SQL = `-- Partition sizes and tier distribution
+SELECT oid, object_name, schema_name, rank_num, partition_type,
+       partition_id, num_rows, actual_bytes, tier
+FROM ki_catalog.ki_partitions
+ORDER BY actual_bytes DESC
+LIMIT 30;`;
+var FALLBACK_INDEXES_SQL = `-- Index definitions
+SELECT oid, object_name, schema_name, index_type, index_columns
+FROM ki_catalog.ki_indexes
+ORDER BY object_name;`;
+var FALLBACK_PERIODIC_OBJECTS_SQL = `-- Periodic refresh schedules
+SELECT oid, object_name, schema_name, last_refresh_time,
+       next_refresh_time, additional_info
+FROM ki_catalog.ki_periodic_objects
+ORDER BY next_refresh_time;`;
+var FALLBACK_USERS_AND_ROLES_SQL = `-- Users and roles
+SELECT oid, name, can_login, is_superuser, resource_group
+FROM ki_catalog.ki_users_and_roles
+ORDER BY name;`;
+var FALLBACK_OBJECT_PERMISSIONS_SQL = `-- Object permissions
+SELECT role_name, permission_type, object_type, object_name, with_grant_option
+FROM ki_catalog.ki_object_permissions
+ORDER BY object_name, role_name;`;
+var FALLBACK_DEPEND_SQL = `-- Object dependency graph
+SELECT src_obj_oid, src_obj_kind, dep_obj_oid, dep_obj_kind, mv_oid, dep_kind
+FROM ki_catalog.ki_depend;`;
+var FALLBACK_LOAD_HISTORY_SQL = `-- Recent data load history
+SELECT table_oid, datasource_oid, user_name, load_kind,
+       start_time, end_time, rows_inserted, event_message
+FROM ki_catalog.ki_load_history
+WHERE start_time > NOW() - INTERVAL '1' HOUR
+ORDER BY start_time DESC
+LIMIT 20;`;
+var FALLBACK_BACKUP_HISTORY_SQL = `-- Backup history
+SELECT backup_name, operation, status, start_time, end_time,
+       num_files, num_bytes, num_records
+FROM ki_catalog.ki_backup_history
+ORDER BY start_time DESC
+LIMIT 20;`;
+var FALLBACK_KAFKA_LAG_INFO_SQL = `-- Kafka consumer lag
+SELECT datasource_oid, table_oid, schema_name, table_name,
+       partition_id, highest_offset, last_committed_offset
+FROM ki_catalog.ki_kafka_lag_info
+ORDER BY datasource_oid, partition_id;`;
+function buildQueryHistorySql(columns) {
+  const select2 = columns.join(", ");
+  const elapsed = has(columns, "start_time") && has(columns, "stop_time") ? ",\n       TIMESTAMPDIFF(SECOND, start_time, stop_time) AS elapsed_sec" : "";
+  const where = has(columns, "start_time") ? "\nWHERE start_time > NOW() - INTERVAL '1' HOUR" : "";
+  const orderBy = has(columns, "start_time") && has(columns, "stop_time") ? (
+    // Kinetica does not support timestamp arithmetic in ORDER BY; use the elapsed_sec alias instead
+    "\nORDER BY elapsed_sec DESC"
+  ) : "";
+  return `-- Slow queries in the last hour
+SELECT ${select2}${elapsed}
+FROM ki_catalog.ki_query_history${where}${orderBy}
+LIMIT 20;`;
 }
-
-// src/auth/preflight.ts
-var PROBE_TIMEOUT_MS = 1e4;
-async function probeCachedCredentials(authQuery) {
-  try {
-    const info = await Promise.race([
-      authQuery.accountInfo(),
-      new Promise(
-        (_, reject) => setTimeout(() => reject(new Error("Probe timed out")), PROBE_TIMEOUT_MS)
-      )
-    ]);
-    if (info.email || info.apiKeySource) {
-      return info;
-    }
-    return null;
-  } catch {
-    return null;
-  }
+function buildActiveQueriesSql(columns) {
+  const select2 = columns.join(", ");
+  const orderBy = has(columns, "start_time") ? "\nORDER BY start_time ASC" : "";
+  return `-- Currently active queries
+SELECT ${select2}
+FROM ki_catalog.ki_query_active_all${orderBy};`;
 }
-async function authenticateAnthropic(options) {
-  const hasApiKey = Boolean(process.env.ANTHROPIC_API_KEY);
-  if (hasApiKey && !options.forceLogin) {
-    return { method: "api_key" };
-  }
-  if (!process.stdin.isTTY) {
-    throw new Error(
-      "No ANTHROPIC_API_KEY set and terminal is non-interactive. Set ANTHROPIC_API_KEY or run in an interactive terminal with --login."
-    );
-  }
-  const env = options.forceLogin ? (() => {
-    const { ANTHROPIC_API_KEY: _stripped, ...rest } = process.env;
-    return { ...rest, CLAUDE_AGENT_SDK_CLIENT_APP: "admin-agent" };
-  })() : { ...process.env, CLAUDE_AGENT_SDK_CLIENT_APP: "admin-agent" };
-  const abortController = new AbortController();
-  async function* hangingPrompt() {
-    await new Promise(() => {
-    });
-  }
-  const authQuery = (0, import_claude_agent_sdk.query)({
-    prompt: hangingPrompt(),
-    options: {
-      persistSession: false,
-      abortController,
-      env,
-      ...options.loginMethod ? { forceLoginMethod: options.loginMethod } : {},
-      ...options.loginOrgUUID ? { forceLoginOrgUUID: options.loginOrgUUID } : {}
-    }
-  });
-  try {
-    if (!options.forceLogin) {
-      const cached = await probeCachedCredentials(authQuery);
-      if (cached) {
-        return { method: "oauth", email: cached.email };
-      }
-    }
-    return await resolveAuthentication(authQuery, {
-      forceLogin: options.forceLogin,
-      loginWithClaudeAi: (options.loginMethod ?? "claudeai") === "claudeai",
-      hasApiKey
-    });
-  } finally {
-    abortController.abort();
-    await authQuery.return().catch(() => {
-    });
-  }
+function buildTieredObjectsSql(columns) {
+  const select2 = columns.join(", ");
+  const where = has(columns, "tier") ? "\nWHERE tier != 'VRAM'" : "";
+  const orderBy = has(columns, "size") ? "\nORDER BY size DESC" : "";
+  const idNote = has(columns, "id") ? "\n-- NOTE: id is a string (e.g. @schema@oid[col][0]), NOT a numeric OID. Filter by table: WHERE id LIKE '%table_name%'" : "";
+  return `-- Objects in disk tier (potential memory pressure)${idNote}
+SELECT ${select2}
+FROM ki_catalog.ki_tiered_objects${where}${orderBy}
+LIMIT 20;`;
 }
-
-// src/auth/logout.ts
-var import_child_process2 = require("child_process");
-var import_node_module = require("module");
-var import_node_path = __toESM(require("path"));
-var import_util = require("util");
-var execFileAsync = (0, import_util.promisify)(import_child_process2.execFile);
-function resolveSdkCliPath() {
-  const require_ = (0, import_node_module.createRequire)(__filename);
-  return import_node_path.default.join(import_node_path.default.dirname(require_.resolve("@anthropic-ai/claude-agent-sdk")), "cli.js");
+function buildObjStatSql(columns) {
+  const select2 = columns.join(", ");
+  const orderBy = has(columns, "total_bytes") ? "\nORDER BY total_bytes DESC" : "";
+  return `-- Table sizes and row counts
+SELECT ${select2}
+FROM ki_catalog.ki_obj_stat${orderBy}
+LIMIT 30;`;
 }
-async function logout() {
-  try {
-    const sdkCliPath = resolveSdkCliPath();
-    const { stdout, stderr } = await execFileAsync(process.execPath, [
-      sdkCliPath,
-      "auth",
-      "logout"
-    ]);
-    const output = (stdout || stderr || "").trim();
-    return { success: true, message: output || "Logged out successfully." };
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    return { success: false, message: `Logout failed: ${message}` };
-  }
-}
-
-// src/session/env-file.ts
-var import_fs2 = require("fs");
-var import_promises = require("fs/promises");
-var import_path2 = require("path");
-var import_prompts = require("@inquirer/prompts");
-var import_picocolors3 = __toESM(require("picocolors"));
-function parseEnvContent(content) {
-  const entries = [];
-  for (const line of content.split("\n")) {
-    const trimmed = line.trim();
-    if (trimmed === "" || trimmed.startsWith("#")) continue;
-    const match = /^([A-Za-z_]\w*)=(.*)/.exec(trimmed);
-    if (!match) continue;
-    const key = match[1];
-    let value = match[2];
-    if (value.startsWith('"') && value.endsWith('"') && value.length >= 2) {
-      value = value.slice(1, -1).replace(/\\(["\\])/g, "$1");
-    } else if (value.startsWith("'") && value.endsWith("'") && value.length >= 2) {
-      value = value.slice(1, -1);
-    }
-    entries.push([key, value]);
-  }
-  return new Map(entries);
+var STRUCTURAL_COLUMNS = /* @__PURE__ */ new Set([
+  "table_name",
+  "column_name",
+  "column_position",
+  "is_nullable",
+  "is_shard_key",
+  "is_primary_key",
+  "is_dict_encoded",
+  "default_value",
+  "bytes_on_disk_uncompressed",
+  "bytes_on_disk_compressed"
+]);
+function buildColumnsSql(columns) {
+  const filtered = columns.filter((c) => STRUCTURAL_COLUMNS.has(c));
+  const selectCols = filtered.length > 0 ? filtered : columns;
+  const select2 = selectCols.map((c) => `c.${c}`).join(", ");
+  const where = has(selectCols, "table_name") ? "\nWHERE c.table_name = '<TABLE_NAME>'" : "";
+  const orderBy = has(selectCols, "column_position") ? "\nORDER BY c.column_position" : has(selectCols, "column_name") ? "\nORDER BY c.column_name" : "";
+  return `-- Structural column metadata (use kinetica_show_table for Kinetica-native types)
+SELECT ${select2}
+FROM ki_catalog.ki_columns c${where}${orderBy};`;
 }
-var FORBIDDEN_VALUE_CHARS = /[\n\r\0]/;
-var REQUIRES_QUOTING = /[\s"'#]/;
-function escapeEnvValue(value) {
-  if (FORBIDDEN_VALUE_CHARS.test(value)) {
-    throw new Error(
-      "Env value contains a forbidden character (newline or null byte); refusing to write"
-    );
-  }
-  if (!REQUIRES_QUOTING.test(value)) {
-    return value;
-  }
-  const escaped = value.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
-  return `"${escaped}"`;
+function buildDatatypesSql(columns) {
+  const select2 = columns.join(", ");
+  const orderBy = has(columns, "oid") ? "\nORDER BY oid" : "";
+  return `-- Resolve column_type_oid to human-readable type name
+SELECT ${select2}
+FROM ki_catalog.ki_datatypes${orderBy};`;
 }
-var ENV_TEMPLATE = `# Anthropic API key (optional \u2014 if not set, OAuth login via browser is used)
-ANTHROPIC_API_KEY=
-
-# Kinetica connection details (prompted interactively if not set)
-# If password is omitted, the agent will prompt for it at startup
-KINETICA_URL={url}
-KINETICA_USER={user}
-KINETICA_PASS=
-`;
-function buildEnvContent(url, user, existingContent) {
-  const safeUrl = escapeEnvValue(url);
-  const safeUser = escapeEnvValue(user);
-  if (!existingContent?.trim()) {
-    return ENV_TEMPLATE.replace("{url}", safeUrl).replace("{user}", safeUser);
-  }
-  const lines = existingContent.split("\n");
-  let urlReplaced = false;
-  let userReplaced = false;
-  const updated = lines.map((line) => {
-    if (/^KINETICA_URL=/.exec(line)) {
-      urlReplaced = true;
-      return `KINETICA_URL=${safeUrl}`;
-    }
-    if (/^KINETICA_USER=/.exec(line)) {
-      userReplaced = true;
-      return `KINETICA_USER=${safeUser}`;
-    }
-    return line;
-  });
-  if (!urlReplaced) updated.push(`KINETICA_URL=${safeUrl}`);
-  if (!userReplaced) updated.push(`KINETICA_USER=${safeUser}`);
-  return updated.join("\n");
+function buildQuerySpanMetricsSql(columns) {
+  const select2 = columns.join(", ");
+  const where = has(columns, "query_id") ? "\nWHERE query_id = '<QUERY_ID>'" : "";
+  const orderBy = has(columns, "start_time") ? "\nORDER BY start_time" : "";
+  return `-- Query span metrics for a specific query
+SELECT ${select2}
+FROM ki_catalog.ki_query_span_metrics_all${where}${orderBy};`;
 }
-function loadEnvFile(dir, env = process.env) {
-  try {
-    const filePath = (0, import_path2.join)(dir ?? process.cwd(), ".env");
-    const content = (0, import_fs2.readFileSync)(filePath, "utf8");
-    const parsed = parseEnvContent(content);
-    for (const [key, value] of parsed) {
-      if (env[key] === void 0 && value !== "") {
-        env[key] = value;
-      }
-    }
-  } catch {
-  }
+function buildQueryWorkersSql(columns) {
+  const select2 = columns.join(", ");
+  const where = has(columns, "status") ? "\nWHERE status != 'IDLE'" : "";
+  const orderBy = has(columns, "elapsed_time_ms") ? "\nORDER BY elapsed_time_ms DESC" : "";
+  return `-- Active query workers (non-idle)
+SELECT ${select2}
+FROM ki_catalog.ki_query_workers${where}${orderBy};`;
 }
-async function offerSaveCredentials(url, user, dir) {
-  if (!process.stdin.isTTY) return;
-  try {
-    const shouldSave = await (0, import_prompts.confirm)({
-      message: "Save KINETICA_URL and KINETICA_USER to .env? (password is never saved)",
-      default: true
-    });
-    if (!shouldSave) return;
-    const filePath = (0, import_path2.join)(dir ?? process.cwd(), ".env");
-    let existing;
-    try {
-      existing = await (0, import_promises.readFile)(filePath, "utf8");
-    } catch {
-    }
-    const content = buildEnvContent(url, user, existing);
-    await (0, import_promises.writeFile)(filePath, content, "utf8");
-    console.error(import_picocolors3.default.dim("Saved to .env"));
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    console.error(import_picocolors3.default.yellow(`Could not save .env file: ${message}`));
-  }
+function buildObjectsSql(columns) {
+  const select2 = columns.join(", ");
+  const orderBy = has(columns, "last_read_time") ? "\nORDER BY last_read_time DESC" : has(columns, "creation_time") ? "\nORDER BY creation_time DESC" : "";
+  return `-- Object registry and metadata
+SELECT ${select2}
+FROM ki_catalog.ki_objects${orderBy}
+LIMIT 30;`;
 }
-
-// src/session/verify.ts
-var import_picocolors6 = __toESM(require("picocolors"));
-var import_prompts4 = require("@inquirer/prompts");
-
-// src/session/collect.ts
-var import_prompts2 = require("@inquirer/prompts");
-var import_picocolors4 = __toESM(require("picocolors"));
-async function collectCredentials() {
-  const prompted = /* @__PURE__ */ new Set();
-  const envUrl = process.env.KINETICA_URL;
-  const envUser = process.env.KINETICA_USER;
-  if (envUrl && envUser && process.stdin.isTTY) {
-    console.error(import_picocolors4.default.dim(`Saved connection: ${envUrl} (${envUser})`));
-    const useSaved = await (0, import_prompts2.confirm)({
-      message: "Use saved connection?",
-      default: true
-    });
-    if (!useSaved) {
-      prompted.add("url");
-      prompted.add("user");
-      const url2 = await (0, import_prompts2.input)({ message: "Kinetica endpoint URL:" });
-      const user2 = await (0, import_prompts2.input)({ message: "Admin username:" });
-      const pass2 = await (0, import_prompts2.password)({ message: "Admin password:", mask: "*" });
-      return { credentials: { url: url2, user: user2, pass: pass2 }, prompted };
-    }
-  }
-  const url = envUrl ?? (prompted.add("url"), await (0, import_prompts2.input)({ message: "Kinetica endpoint URL:" }));
-  const user = envUser ?? (prompted.add("user"), await (0, import_prompts2.input)({ message: "Admin username:" }));
-  const pass = process.env.KINETICA_PASS ?? await (0, import_prompts2.password)({ message: "Admin password:", mask: "*" });
-  return { credentials: { url, user, pass }, prompted };
+function buildPartitionsSql(columns) {
+  const select2 = columns.join(", ");
+  const orderBy = has(columns, "actual_bytes") ? "\nORDER BY actual_bytes DESC" : "";
+  return `-- Partition sizes and tier distribution
+SELECT ${select2}
+FROM ki_catalog.ki_partitions${orderBy}
+LIMIT 30;`;
 }
-async function repromptCredentials() {
-  const user = await (0, import_prompts2.input)({ message: "Admin username:" });
-  const pass = await (0, import_prompts2.password)({ message: "Admin password:", mask: "*" });
-  return { user, pass };
+function buildIndexesSql(columns) {
+  const select2 = columns.join(", ");
+  const orderBy = has(columns, "object_name") ? "\nORDER BY object_name" : "";
+  return `-- Index definitions
+SELECT ${select2}
+FROM ki_catalog.ki_indexes${orderBy};`;
 }
-
-// src/session/KineticaSession.ts
-var REQUEST_TIMEOUT_MS = 3e4;
-function replacePort(baseUrl, port) {
-  const parsed = new URL(baseUrl);
-  parsed.port = String(port);
-  return parsed.origin;
+function buildPeriodicObjectsSql(columns) {
+  const select2 = columns.join(", ");
+  const orderBy = has(columns, "next_refresh_time") ? "\nORDER BY next_refresh_time" : "";
+  return `-- Periodic refresh schedules
+SELECT ${select2}
+FROM ki_catalog.ki_periodic_objects${orderBy};`;
 }
-function createSession(url, user, pass) {
-  const authHeader = "Basic " + Buffer.from(`${user}:${pass}`).toString("base64");
-  const doFetch = async (fullUrl, body) => {
-    if (process.env.DEBUG) {
-      console.error(`[DEBUG] POST ${fullUrl}`);
-    }
-    return fetch(fullUrl, {
-      method: "POST",
-      headers: {
-        Authorization: authHeader,
-        "Content-Type": "application/json"
-      },
-      body: body !== void 0 ? JSON.stringify(body) : void 0,
-      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
-    });
-  };
-  return {
-    baseUrl: url,
-    makeRequest: (endpoint, body) => doFetch(`${url}${endpoint}`, body),
-    makeRequestToPort: (port, endpoint, body) => doFetch(`${replacePort(url, port)}${endpoint}`, body)
-  };
+function buildUsersAndRolesSql(columns) {
+  const select2 = columns.join(", ");
+  const orderBy = has(columns, "name") ? "\nORDER BY name" : "";
+  return `-- Users and roles
+SELECT ${select2}
+FROM ki_catalog.ki_users_and_roles${orderBy};`;
 }
-
-// src/session/resolve-url.ts
-var import_picocolors5 = __toESM(require("picocolors"));
-var import_prompts3 = require("@inquirer/prompts");
-var PROBE_TIMEOUT_MS2 = 3e3;
-var HTTP_PROTOCOL_RE = /^https?:\/\//i;
-var ANY_PROTOCOL_RE = /^[a-z][a-z0-9+.-]*:\/\//i;
-function hasProtocol(input5) {
-  return HTTP_PROTOCOL_RE.test(input5);
+function buildObjectPermissionsSql(columns) {
+  const select2 = columns.join(", ");
+  const orderBy = has(columns, "object_name") && has(columns, "role_name") ? "\nORDER BY object_name, role_name" : has(columns, "object_name") ? "\nORDER BY object_name" : "";
+  return `-- Object permissions
+SELECT ${select2}
+FROM ki_catalog.ki_object_permissions${orderBy};`;
 }
-function stripTrailingSlashes(url) {
-  return url.replace(/\/+$/, "");
+function buildDependSql(columns) {
+  const select2 = columns.join(", ");
+  return `-- Object dependency graph
+SELECT ${select2}
+FROM ki_catalog.ki_depend;`;
 }
-async function probeProtocol(url) {
-  try {
-    await fetch(url, {
-      method: "HEAD",
-      signal: AbortSignal.timeout(PROBE_TIMEOUT_MS2)
-    });
-    return true;
-  } catch {
-    return false;
-  }
+function buildLoadHistorySql(columns) {
+  const select2 = columns.join(", ");
+  const where = has(columns, "start_time") ? "\nWHERE start_time > NOW() - INTERVAL '1' HOUR" : "";
+  const orderBy = has(columns, "start_time") ? "\nORDER BY start_time DESC" : "";
+  return `-- Recent data load history
+SELECT ${select2}
+FROM ki_catalog.ki_load_history${where}${orderBy}
+LIMIT 20;`;
 }
-function isHttpsOnly() {
-  return process.env.KINETICA_HTTPS_ONLY === "1";
+function buildBackupHistorySql(columns) {
+  const select2 = columns.join(", ");
+  const orderBy = has(columns, "start_time") ? "\nORDER BY start_time DESC" : "";
+  return `-- Backup history
+SELECT ${select2}
+FROM ki_catalog.ki_backup_history${orderBy}
+LIMIT 20;`;
 }
-function isInteractive() {
-  return Boolean(process.stdin.isTTY);
+function buildKafkaLagInfoSql(columns) {
+  const select2 = columns.join(", ");
+  const orderBy = has(columns, "datasource_oid") && has(columns, "partition_id") ? "\nORDER BY datasource_oid, partition_id" : has(columns, "datasource_oid") ? "\nORDER BY datasource_oid" : "";
+  return `-- Kafka consumer lag
+SELECT ${select2}
+FROM ki_catalog.ki_kafka_lag_info${orderBy};`;
 }
-async function confirmHttpFallback(host) {
-  process.stderr.write(
-    "\n" + import_picocolors5.default.red(
-      import_picocolors5.default.bold(
-        `  WARNING: HTTPS unavailable at ${host}.
-  Falling back to plaintext HTTP will transmit your Kinetica credentials in the clear.
-`
-      )
-    ) + import_picocolors5.default.dim(
-      `  Set KINETICA_HTTPS_ONLY=1 to refuse this fallback automatically, or pass an explicit http:// prefix to silence this prompt.
-
-`
-    )
-  );
-  try {
-    return await (0, import_prompts3.confirm)({
-      message: "Continue over plaintext HTTP?",
-      default: false
-    });
-  } catch {
-    return false;
+var BUILDER_REGISTRY = [
+  // Query History and Performance
+  {
+    table: "ki_query_history",
+    section: "Query History and Performance",
+    build: buildQueryHistorySql,
+    fallback: FALLBACK_QUERY_HISTORY_SQL
+  },
+  {
+    table: "ki_query_active_all",
+    section: "Query History and Performance",
+    build: buildActiveQueriesSql,
+    fallback: FALLBACK_ACTIVE_QUERIES_SQL
+  },
+  {
+    table: "ki_query_span_metrics_all",
+    section: "Query History and Performance",
+    build: buildQuerySpanMetricsSql,
+    fallback: FALLBACK_QUERY_SPAN_METRICS_SQL
+  },
+  {
+    table: "ki_query_workers",
+    section: "Query History and Performance",
+    build: buildQueryWorkersSql,
+    fallback: FALLBACK_QUERY_WORKERS_SQL
+  },
+  // Memory and Storage Tiers
+  {
+    table: "ki_tiered_objects",
+    section: "Memory and Storage Tiers",
+    build: buildTieredObjectsSql,
+    fallback: FALLBACK_TIERED_OBJECTS_SQL
+  },
+  {
+    table: "ki_obj_stat",
+    section: "Memory and Storage Tiers",
+    build: buildObjStatSql,
+    fallback: FALLBACK_OBJ_STAT_SQL
+  },
+  {
+    table: "ki_partitions",
+    section: "Memory and Storage Tiers",
+    build: buildPartitionsSql,
+    fallback: FALLBACK_PARTITIONS_SQL
+  },
+  // Object Registry and Metadata
+  {
+    table: "ki_objects",
+    section: "Object Registry and Metadata",
+    build: buildObjectsSql,
+    fallback: FALLBACK_OBJECTS_SQL
+  },
+  {
+    table: "ki_indexes",
+    section: "Object Registry and Metadata",
+    build: buildIndexesSql,
+    fallback: FALLBACK_INDEXES_SQL
+  },
+  {
+    table: "ki_periodic_objects",
+    section: "Object Registry and Metadata",
+    build: buildPeriodicObjectsSql,
+    fallback: FALLBACK_PERIODIC_OBJECTS_SQL
+  },
+  {
+    table: "ki_depend",
+    section: "Object Registry and Metadata",
+    build: buildDependSql,
+    fallback: FALLBACK_DEPEND_SQL
+  },
+  // Security and Access Control
+  {
+    table: "ki_users_and_roles",
+    section: "Security and Access Control",
+    build: buildUsersAndRolesSql,
+    fallback: FALLBACK_USERS_AND_ROLES_SQL
+  },
+  {
+    table: "ki_object_permissions",
+    section: "Security and Access Control",
+    build: buildObjectPermissionsSql,
+    fallback: FALLBACK_OBJECT_PERMISSIONS_SQL
+  },
+  // Data Ingestion and Operations
+  {
+    table: "ki_load_history",
+    section: "Data Ingestion and Operations",
+    build: buildLoadHistorySql,
+    fallback: FALLBACK_LOAD_HISTORY_SQL
+  },
+  {
+    table: "ki_backup_history",
+    section: "Data Ingestion and Operations",
+    build: buildBackupHistorySql,
+    fallback: FALLBACK_BACKUP_HISTORY_SQL
+  },
+  {
+    table: "ki_kafka_lag_info",
+    section: "Data Ingestion and Operations",
+    build: buildKafkaLagInfoSql,
+    fallback: FALLBACK_KAFKA_LAG_INFO_SQL
+  },
+  // Schema Inspection
+  {
+    table: "ki_columns",
+    section: "Schema Inspection",
+    build: buildColumnsSql,
+    fallback: FALLBACK_COLUMNS_SQL
+  },
+  {
+    table: "ki_datatypes",
+    section: "Schema Inspection",
+    build: buildDatatypesSql,
+    fallback: FALLBACK_DATATYPES_SQL
   }
+];
+
+// src/tools/index.ts
+var import_claude_agent_sdk2 = require("@anthropic-ai/claude-agent-sdk");
+var import_zod16 = require("zod");
+var import_picocolors4 = __toESM(require("picocolors"));
+
+// src/approval/registry.ts
+var DEFAULT_READ_ONLY_TOOLS = /* @__PURE__ */ new Set();
+function createRegistry(tools = DEFAULT_READ_ONLY_TOOLS) {
+  return {
+    isReadOnlyTool: (toolName) => tools.has(toolName),
+    // Returns a NEW registry — never mutates the current one
+    registerReadOnlyTool: (toolName) => createRegistry(/* @__PURE__ */ new Set([...tools, toolName])),
+    tools
+  };
 }
-async function resolveUrl(input5) {
-  const trimmed = input5.trim();
-  if (trimmed === "") {
-    return { ok: false, error: "URL is empty" };
-  }
-  const normalized = stripTrailingSlashes(trimmed);
-  if (hasProtocol(normalized)) {
-    return { ok: true, url: normalized };
-  }
-  if (ANY_PROTOCOL_RE.test(normalized)) {
-    const scheme = normalized.split("://")[0];
-    return {
-      ok: false,
-      error: `Unsupported protocol: ${scheme}. Use http:// or https://`
-    };
-  }
-  const httpsUrl = `https://${normalized}`;
-  const httpUrl = `http://${normalized}`;
-  console.error(import_picocolors5.default.dim("Detecting protocol..."));
-  if (await probeProtocol(httpsUrl)) {
-    return { ok: true, url: httpsUrl };
-  }
-  if (isHttpsOnly()) {
-    return {
-      ok: false,
-      error: `HTTPS probe to ${httpsUrl} failed and KINETICA_HTTPS_ONLY=1; refusing to fall back to plaintext HTTP.`
-    };
-  }
-  if (!await probeProtocol(httpUrl)) {
-    return {
-      ok: false,
-      error: `Could not connect to ${normalized} via https:// or http://`
-    };
-  }
-  if (!isInteractive()) {
-    return {
-      ok: false,
-      error: `HTTPS unavailable at ${normalized} and terminal is non-interactive. Pass an explicit http:// prefix to allow plaintext HTTP, or point the URL at an HTTPS endpoint.`
-    };
-  }
-  const approved = await confirmHttpFallback(normalized);
-  if (!approved) {
-    return {
-      ok: false,
-      error: "User declined plaintext HTTP fallback"
-    };
+var defaultRegistry = createRegistry();
+var isReadOnlyTool = defaultRegistry.isReadOnlyTool;
+var READ_ONLY_TOOLS = defaultRegistry.tools;
+
+// src/output/stringify.ts
+function stringifyValue(v) {
+  if (v === void 0 || v === null) return "";
+  if (typeof v === "string") return v;
+  if (typeof v === "number" || typeof v === "boolean" || typeof v === "bigint") {
+    return v.toString();
   }
-  return { ok: true, url: httpUrl };
+  if (typeof v === "object") return JSON.stringify(v);
+  if (typeof v === "symbol") return v.toString();
+  return "";
 }
 
-// src/session/verify.ts
-var MAX_RETRIES = 3;
-var MAX_REPROMPTS = 2;
-var DEFAULT_HM_PORT = 9300;
-function extractVersion(responseBody) {
-  try {
-    const outer = JSON.parse(responseBody);
-    if (typeof outer.data_str !== "string") return void 0;
-    const inner = JSON.parse(outer.data_str);
-    const systemStr = inner.status_map?.system;
-    if (typeof systemStr !== "string") return void 0;
-    const system = JSON.parse(systemStr);
-    return typeof system.version === "string" ? system.version : void 0;
-  } catch {
-    return void 0;
+// src/output/format.ts
+function formatOutput(json) {
+  if (json === null || json === void 0) {
+    return "(empty)";
   }
-}
-function extractVersionFromHostManager(responseBody) {
-  try {
-    const parsed = JSON.parse(responseBody);
-    return typeof parsed.version === "string" ? parsed.version : void 0;
-  } catch {
-    return void 0;
+  if (Array.isArray(json)) {
+    return formatArray(json);
+  }
+  if (typeof json === "object") {
+    return formatObject(json);
   }
+  return stringifyValue(json);
 }
-async function probeHostManager(session2) {
-  if (!session2.makeRequestToPort) {
-    return { ok: false };
+function formatArray(arr) {
+  if (arr.length === 0) {
+    return "(no results)";
   }
-  try {
-    const response = await session2.makeRequestToPort(DEFAULT_HM_PORT, "/", void 0);
-    if (!response.ok) return { ok: false };
-    const body = await response.text();
-    return { ok: true, version: extractVersionFromHostManager(body) };
-  } catch {
-    return { ok: false };
+  const first = arr[0];
+  if (typeof first === "object" && first !== null && !Array.isArray(first)) {
+    return formatTableArray(arr);
   }
+  return arr.map(stringifyValue).join("\n");
 }
-async function verifyConnectivity(session2) {
-  const response = await session2.makeRequest("/show/system/status", {});
-  if (!response.ok) {
-    const body2 = await response.text();
-    throw new Error(`HTTP ${response.status}: ${body2}`);
+function formatTableArray(rows) {
+  const headers = Object.keys(rows[0]);
+  const cells = rows.map((row) => headers.map((h) => stringifyValue(row[h])));
+  const colWidths = headers.map(
+    (h, i) => Math.max(h.length, ...cells.map((row) => row[i].length), 3)
+  );
+  const pad = (text, col) => text.padEnd(colWidths[col]);
+  const headerRow = `| ${headers.map((h, i) => pad(h, i)).join(" | ")} |`;
+  const separatorRow = `| ${colWidths.map((w) => "-".repeat(w)).join(" | ")} |`;
+  const dataRows = cells.map((row) => `| ${row.map((cell, i) => pad(cell, i)).join(" | ")} |`);
+  return [headerRow, separatorRow, ...dataRows].join("\n");
+}
+function formatObject(obj) {
+  return Object.entries(obj).map(([key, value]) => {
+    if (typeof value === "object" && value !== null) {
+      return `**${key}:**
+${formatOutput(value)}`;
+    }
+    return `**${key}:** ${stringifyValue(value)}`;
+  }).join("\n");
+}
+
+// src/output/format-tool-name.ts
+function formatToolName(toolName) {
+  const stripped = toolName.replace(/^mcp__[^_]+__/, "").replace(/^kinetica_/, "");
+  return stripped.replace(/_/g, " ");
+}
+
+// src/types/index.ts
+var DEFAULT_TRUNCATION = {
+  headLines: 150,
+  tailLines: 50
+};
+
+// src/output/truncate.ts
+function truncateOutput(text, options = DEFAULT_TRUNCATION) {
+  if (text === "") return "";
+  const lines = text.split("\n");
+  const { headLines, tailLines } = options;
+  const threshold = headLines + tailLines;
+  if (lines.length <= threshold) {
+    return text;
   }
-  const body = await response.text();
-  return extractVersion(body);
+  const truncatedCount = lines.length - headLines - tailLines;
+  const head = lines.slice(0, headLines);
+  const tail = lines.slice(lines.length - tailLines);
+  return [...head, "", `[... ${truncatedCount} lines truncated ...]`, "", ...tail].join("\n");
 }
-function isCredentialError(errorMessage) {
-  return errorMessage.startsWith("HTTP 401") || errorMessage.startsWith("HTTP 403");
+
+// src/output/reshape.ts
+function safeString(v) {
+  if (typeof v === "object" && v !== null) {
+    return JSON.stringify(v);
+  }
+  return String(v);
 }
-async function connectWithRetry() {
-  const { credentials, prompted } = await collectCredentials();
-  const resolved = await resolveUrl(credentials.url);
-  if (!resolved.ok) {
-    console.error(import_picocolors6.default.red(resolved.error));
-    process.exit(1);
+function flatObjectToRows(obj, keyLabel = "key", valueLabel = "value") {
+  return Object.entries(obj).map(([k, v]) => ({
+    [keyLabel]: k,
+    [valueLabel]: safeString(v)
+  }));
+}
+
+// src/tools/rest/parse-data-str.ts
+function parseDataStr(outerDataStr, raw) {
+  if (typeof outerDataStr !== "string") {
+    return { ok: true, data: void 0 };
   }
-  const resolvedUrl = resolved.url;
-  let currentUser = credentials.user;
-  let currentPass = credentials.pass;
-  let wasReprompted = false;
-  let repromptCount = 0;
-  let session2 = createSession(resolvedUrl, currentUser, currentPass);
-  for (let attempt = 1; attempt <= MAX_RETRIES; attempt++) {
-    try {
-      const kineticaVersion = await verifyConnectivity(session2);
-      console.error(import_picocolors6.default.green("Connected to Kinetica successfully."));
-      if (prompted.size > 0 || wasReprompted) {
-        await offerSaveCredentials(resolvedUrl, currentUser);
-      }
-      return { session: session2, kineticaVersion, degraded: false };
-    } catch (err) {
-      const msg = err instanceof Error ? err.message : String(err);
-      console.error(import_picocolors6.default.red(`Connection failed (attempt ${attempt}/${MAX_RETRIES}): ${msg}`));
-      if (isCredentialError(msg)) {
-        if (process.stdin.isTTY && repromptCount < MAX_REPROMPTS) {
-          const shouldRetry = await (0, import_prompts4.confirm)({
-            message: "Credentials may be incorrect. Re-enter?",
-            default: true
-          });
-          if (shouldRetry) {
-            const fresh = await repromptCredentials();
-            currentUser = fresh.user;
-            currentPass = fresh.pass;
-            wasReprompted = true;
-            repromptCount++;
-            session2 = createSession(resolvedUrl, currentUser, currentPass);
-            attempt = 0;
-            continue;
-          }
+  try {
+    return { ok: true, data: JSON.parse(outerDataStr) };
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return { ok: false, status: 200, error: `data_str parse error: ${message}`, raw };
+  }
+}
+
+// src/tools/rest/health.ts
+async function healthCheck(session2) {
+  let response;
+  let rawText;
+  try {
+    response = await session2.makeRequest("/show/system/status", {});
+    rawText = await response.text();
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return {
+      ok: false,
+      status: 0,
+      error: message,
+      raw: ""
+    };
+  }
+  if (!response.ok) {
+    return {
+      ok: false,
+      status: response.status,
+      error: `HTTP ${response.status}`,
+      raw: rawText
+    };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(rawText);
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return {
+      ok: false,
+      status: 200,
+      error: `JSON parse error: ${message}`,
+      raw: rawText
+    };
+  }
+  const inner = parseDataStr(parsed.data_str, rawText);
+  if (!inner.ok) return inner;
+  const statusMap = inner.data?.status_map ?? {};
+  return {
+    ok: true,
+    data: flatObjectToRows(statusMap, "component", "status")
+  };
+}
+
+// src/tools/rest/decode-nested-json.ts
+function decodeNestedJsonStrings(obj) {
+  return Object.fromEntries(
+    Object.entries(obj).map(([k, v]) => {
+      if (typeof v !== "string") return [k, v];
+      try {
+        const parsed = JSON.parse(v);
+        if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
+          return [k, decodeNestedJsonStrings(parsed)];
         }
-        console.error(import_picocolors6.default.red("Authentication failed. Exiting."));
-        process.exit(1);
+        return [k, parsed];
+      } catch {
+        return [k, v];
       }
-      if (attempt === MAX_RETRIES) {
-        console.error(import_picocolors6.default.yellow("DB engine unreachable. Probing host manager on port 9300..."));
-        const hmResult = await probeHostManager(session2);
-        if (hmResult.ok) {
-          console.error(
-            import_picocolors6.default.yellow(
-              "Connected in DEGRADED MODE (host manager only). Most diagnostic tools will be unavailable."
-            )
-          );
-          if (prompted.size > 0 || wasReprompted) {
-            await offerSaveCredentials(resolvedUrl, currentUser);
-          }
-          return { session: session2, kineticaVersion: hmResult.version, degraded: true };
-        }
-        console.error(import_picocolors6.default.red("Host manager also unreachable. Exiting."));
-        process.exit(1);
+    })
+  );
+}
+
+// src/tools/rest/flatten-rank-stats.ts
+function findTier(tiers, prefix) {
+  for (const [name, data] of Object.entries(tiers)) {
+    if (name === prefix || name.startsWith(`${prefix}.`) || name.startsWith(`${prefix}_`) || name.startsWith(prefix) && /^\d/.test(name.slice(prefix.length))) {
+      if (typeof data === "object" && data !== null && !Array.isArray(data)) {
+        return data;
       }
     }
   }
-  throw new Error("unreachable");
+  return void 0;
 }
-
-// src/agent/run-agent.ts
-var import_claude_agent_sdk5 = require("@anthropic-ai/claude-agent-sdk");
-var import_prompts8 = require("@inquirer/prompts");
-var import_picocolors13 = __toESM(require("picocolors"));
-
-// src/agent/diagnostic-sql.ts
-function has(columns, name) {
-  return columns.includes(name);
+function overallField(tier, field) {
+  if (!tier) return "";
+  const overall = tier.overall;
+  if (typeof overall !== "object" || overall === null) return "";
+  const value = overall[field];
+  return stringifyValue(value);
 }
-var FALLBACK_QUERY_HISTORY_SQL = `-- Slow queries in the last hour
-SELECT query_id, user_name, query_text, start_time, stop_time,
-       TIMESTAMPDIFF(SECOND, start_time, stop_time) AS elapsed_sec
-FROM ki_catalog.ki_query_history
-WHERE start_time > NOW() - INTERVAL '1' HOUR
-ORDER BY elapsed_sec DESC
-LIMIT 20;`;
-var FALLBACK_ACTIVE_QUERIES_SQL = `-- Currently active queries
-SELECT query_id, user_name, query_text, start_time, execution_status
-FROM ki_catalog.ki_query_active_all
-ORDER BY start_time ASC;`;
-var FALLBACK_TIERED_OBJECTS_SQL = `-- Objects in disk tier (potential memory pressure)
--- NOTE: id is a string (e.g. @schema@oid[col][0]), NOT a numeric OID. Filter by table: WHERE id LIKE '%table_name%'
--- For per-table tier placement, prefer kinetica_resource_objects with table_names filter.
-SELECT id, tier, size, source_rank, owner_resource_group
-FROM ki_catalog.ki_tiered_objects
-WHERE tier != 'VRAM'
-ORDER BY size DESC
-LIMIT 20;`;
-var FALLBACK_OBJ_STAT_SQL = `-- Table sizes and row counts
-SELECT object_name, total_bytes, row_count
-FROM ki_catalog.ki_obj_stat
-ORDER BY total_bytes DESC
-LIMIT 30;`;
-var FALLBACK_COLUMNS_SQL = `-- Structural column metadata (use kinetica_show_table for Kinetica-native types)
-SELECT c.table_name, c.column_name, c.column_position
-FROM ki_catalog.ki_columns c
-WHERE c.table_name = '<TABLE_NAME>'
-ORDER BY c.column_position;`;
-var FALLBACK_DATATYPES_SQL = `-- Resolve column_type_oid to human-readable type name
-SELECT oid, name, sql_typename
-FROM ki_catalog.ki_datatypes
-ORDER BY oid;`;
-var FALLBACK_QUERY_SPAN_METRICS_SQL = `-- Query span metrics for a specific query
-SELECT query_id, span_id, parent_span_id, operator, sql_step,
-       metric_data, start_time, stop_time, source_rank
-FROM ki_catalog.ki_query_span_metrics_all
-WHERE query_id = '<QUERY_ID>'
-ORDER BY start_time;`;
-var FALLBACK_QUERY_WORKERS_SQL = `-- Active query workers (non-idle)
-SELECT job_id, worker_id, type, status, elapsed_time_ms, source_rank
-FROM ki_catalog.ki_query_workers
-WHERE status != 'IDLE'
-ORDER BY elapsed_time_ms DESC;`;
-var FALLBACK_OBJECTS_SQL = `-- Object registry and metadata
-SELECT oid, object_name, schema_name, type_id, persistence, obj_kind,
-       creation_time, last_read_time, read_count, write_count
-FROM ki_catalog.ki_objects
-ORDER BY last_read_time DESC
-LIMIT 30;`;
-var FALLBACK_PARTITIONS_SQL = `-- Partition sizes and tier distribution
-SELECT oid, object_name, schema_name, rank_num, partition_type,
-       partition_id, num_rows, actual_bytes, tier
-FROM ki_catalog.ki_partitions
-ORDER BY actual_bytes DESC
-LIMIT 30;`;
-var FALLBACK_INDEXES_SQL = `-- Index definitions
-SELECT oid, object_name, schema_name, index_type, index_columns
-FROM ki_catalog.ki_indexes
-ORDER BY object_name;`;
-var FALLBACK_PERIODIC_OBJECTS_SQL = `-- Periodic refresh schedules
-SELECT oid, object_name, schema_name, last_refresh_time,
-       next_refresh_time, additional_info
-FROM ki_catalog.ki_periodic_objects
-ORDER BY next_refresh_time;`;
-var FALLBACK_USERS_AND_ROLES_SQL = `-- Users and roles
-SELECT oid, name, can_login, is_superuser, resource_group
-FROM ki_catalog.ki_users_and_roles
-ORDER BY name;`;
-var FALLBACK_OBJECT_PERMISSIONS_SQL = `-- Object permissions
-SELECT role_name, permission_type, object_type, object_name, with_grant_option
-FROM ki_catalog.ki_object_permissions
-ORDER BY object_name, role_name;`;
-var FALLBACK_DEPEND_SQL = `-- Object dependency graph
-SELECT src_obj_oid, src_obj_kind, dep_obj_oid, dep_obj_kind, mv_oid, dep_kind
-FROM ki_catalog.ki_depend;`;
-var FALLBACK_LOAD_HISTORY_SQL = `-- Recent data load history
-SELECT table_oid, datasource_oid, user_name, load_kind,
-       start_time, end_time, rows_inserted, event_message
-FROM ki_catalog.ki_load_history
-WHERE start_time > NOW() - INTERVAL '1' HOUR
-ORDER BY start_time DESC
-LIMIT 20;`;
-var FALLBACK_BACKUP_HISTORY_SQL = `-- Backup history
-SELECT backup_name, operation, status, start_time, end_time,
-       num_files, num_bytes, num_records
-FROM ki_catalog.ki_backup_history
-ORDER BY start_time DESC
-LIMIT 20;`;
-var FALLBACK_KAFKA_LAG_INFO_SQL = `-- Kafka consumer lag
-SELECT datasource_oid, table_oid, schema_name, table_name,
-       partition_id, highest_offset, last_committed_offset
-FROM ki_catalog.ki_kafka_lag_info
-ORDER BY datasource_oid, partition_id;`;
-function buildQueryHistorySql(columns) {
-  const select = columns.join(", ");
-  const elapsed = has(columns, "start_time") && has(columns, "stop_time") ? ",\n       TIMESTAMPDIFF(SECOND, start_time, stop_time) AS elapsed_sec" : "";
-  const where = has(columns, "start_time") ? "\nWHERE start_time > NOW() - INTERVAL '1' HOUR" : "";
-  const orderBy = has(columns, "start_time") && has(columns, "stop_time") ? (
-    // Kinetica does not support timestamp arithmetic in ORDER BY; use the elapsed_sec alias instead
-    "\nORDER BY elapsed_sec DESC"
-  ) : "";
-  return `-- Slow queries in the last hour
-SELECT ${select}${elapsed}
-FROM ki_catalog.ki_query_history${where}${orderBy}
-LIMIT 20;`;
-}
-function buildActiveQueriesSql(columns) {
-  const select = columns.join(", ");
-  const orderBy = has(columns, "start_time") ? "\nORDER BY start_time ASC" : "";
-  return `-- Currently active queries
-SELECT ${select}
-FROM ki_catalog.ki_query_active_all${orderBy};`;
-}
-function buildTieredObjectsSql(columns) {
-  const select = columns.join(", ");
-  const where = has(columns, "tier") ? "\nWHERE tier != 'VRAM'" : "";
-  const orderBy = has(columns, "size") ? "\nORDER BY size DESC" : "";
-  const idNote = has(columns, "id") ? "\n-- NOTE: id is a string (e.g. @schema@oid[col][0]), NOT a numeric OID. Filter by table: WHERE id LIKE '%table_name%'" : "";
-  return `-- Objects in disk tier (potential memory pressure)${idNote}
-SELECT ${select}
-FROM ki_catalog.ki_tiered_objects${where}${orderBy}
-LIMIT 20;`;
-}
-function buildObjStatSql(columns) {
-  const select = columns.join(", ");
-  const orderBy = has(columns, "total_bytes") ? "\nORDER BY total_bytes DESC" : "";
-  return `-- Table sizes and row counts
-SELECT ${select}
-FROM ki_catalog.ki_obj_stat${orderBy}
-LIMIT 30;`;
-}
-var STRUCTURAL_COLUMNS = /* @__PURE__ */ new Set([
-  "table_name",
-  "column_name",
-  "column_position",
-  "is_nullable",
-  "is_shard_key",
-  "is_primary_key",
-  "is_dict_encoded",
-  "default_value",
-  "bytes_on_disk_uncompressed",
-  "bytes_on_disk_compressed"
-]);
-function buildColumnsSql(columns) {
-  const filtered = columns.filter((c) => STRUCTURAL_COLUMNS.has(c));
-  const selectCols = filtered.length > 0 ? filtered : columns;
-  const select = selectCols.map((c) => `c.${c}`).join(", ");
-  const where = has(selectCols, "table_name") ? "\nWHERE c.table_name = '<TABLE_NAME>'" : "";
-  const orderBy = has(selectCols, "column_position") ? "\nORDER BY c.column_position" : has(selectCols, "column_name") ? "\nORDER BY c.column_name" : "";
-  return `-- Structural column metadata (use kinetica_show_table for Kinetica-native types)
-SELECT ${select}
-FROM ki_catalog.ki_columns c${where}${orderBy};`;
-}
-function buildDatatypesSql(columns) {
-  const select = columns.join(", ");
-  const orderBy = has(columns, "oid") ? "\nORDER BY oid" : "";
-  return `-- Resolve column_type_oid to human-readable type name
-SELECT ${select}
-FROM ki_catalog.ki_datatypes${orderBy};`;
+function computePercent(used, limit) {
+  if (!used || !limit) return "";
+  const usedN = Number(used);
+  const limitN = Number(limit);
+  if (!Number.isFinite(usedN) || !Number.isFinite(limitN) || limitN === 0) return "";
+  return `${(usedN / limitN * 100).toFixed(1)}%`;
 }
-function buildQuerySpanMetricsSql(columns) {
-  const select = columns.join(", ");
-  const where = has(columns, "query_id") ? "\nWHERE query_id = '<QUERY_ID>'" : "";
-  const orderBy = has(columns, "start_time") ? "\nORDER BY start_time" : "";
-  return `-- Query span metrics for a specific query
-SELECT ${select}
-FROM ki_catalog.ki_query_span_metrics_all${where}${orderBy};`;
+function flattenRanksSummary(decoded) {
+  const ranksRaw = typeof decoded.ranks === "object" && decoded.ranks !== null ? decoded.ranks : decoded;
+  return Object.entries(ranksRaw).filter(([, v]) => typeof v === "object" && v !== null && !Array.isArray(v)).map(([rankId, rankData]) => {
+    const rank = rankData;
+    const tiers = typeof rank.tiers === "object" && rank.tiers !== null ? rank.tiers : {};
+    const ramUsed = overallField(findTier(tiers, "RAM"), "used");
+    const ramLimit = overallField(findTier(tiers, "RAM"), "limit");
+    return {
+      rank: rankId,
+      ram_used: ramUsed,
+      ram_limit: ramLimit,
+      ram_percent: computePercent(ramUsed, ramLimit),
+      persist_used: overallField(findTier(tiers, "PERSIST"), "used"),
+      disk_used: overallField(findTier(tiers, "DISK"), "used"),
+      vram_used: overallField(findTier(tiers, "VRAM"), "used")
+    };
+  });
 }
-function buildQueryWorkersSql(columns) {
-  const select = columns.join(", ");
-  const where = has(columns, "status") ? "\nWHERE status != 'IDLE'" : "";
-  const orderBy = has(columns, "elapsed_time_ms") ? "\nORDER BY elapsed_time_ms DESC" : "";
-  return `-- Active query workers (non-idle)
-SELECT ${select}
-FROM ki_catalog.ki_query_workers${where}${orderBy};`;
+function flattenRankDetail(rankData) {
+  const tiersRaw = typeof rankData.tiers === "object" && rankData.tiers !== null ? rankData.tiers : {};
+  const tiers = Object.entries(tiersRaw).filter(([, v]) => typeof v === "object" && v !== null && !Array.isArray(v)).map(([tierName, tierData]) => {
+    const tier = tierData;
+    const overall = typeof tier.overall === "object" && tier.overall !== null ? tier.overall : {};
+    const stats = typeof tier.stats === "object" && tier.stats !== null ? tier.stats : {};
+    const row = { tier: tierName };
+    for (const [k, v] of Object.entries(overall)) {
+      row[k] = stringifyValue(v);
+    }
+    for (const [k, v] of Object.entries(stats)) {
+      row[k] = stringifyValue(v);
+    }
+    return row;
+  });
+  const rgRaw = typeof rankData.resource_groups === "object" && rankData.resource_groups !== null ? rankData.resource_groups : {};
+  const resource_groups = Object.entries(rgRaw).filter(([, v]) => typeof v === "object" && v !== null && !Array.isArray(v)).map(([rgName, rgData]) => {
+    const rg = rgData;
+    const row = { name: rgName };
+    for (const [k, v] of Object.entries(rg)) {
+      row[k] = stringifyValue(v);
+    }
+    return row;
+  });
+  return { tiers, resource_groups };
 }
-function buildObjectsSql(columns) {
-  const select = columns.join(", ");
-  const orderBy = has(columns, "last_read_time") ? "\nORDER BY last_read_time DESC" : has(columns, "creation_time") ? "\nORDER BY creation_time DESC" : "";
-  return `-- Object registry and metadata
-SELECT ${select}
-FROM ki_catalog.ki_objects${orderBy}
-LIMIT 30;`;
+
+// src/tools/rest/metrics.ts
+async function getMetrics(session2, nodeId) {
+  let response;
+  let rawText;
+  try {
+    response = await session2.makeRequest("/show/resource/statistics", {
+      options: {}
+    });
+    rawText = await response.text();
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return { ok: false, status: 0, error: message, raw: "" };
+  }
+  if (!response.ok) {
+    return {
+      ok: false,
+      status: response.status,
+      error: `HTTP ${response.status}`,
+      raw: rawText
+    };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(rawText);
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return {
+      ok: false,
+      status: 200,
+      error: `JSON parse error: ${message}`,
+      raw: rawText
+    };
+  }
+  const inner = parseDataStr(parsed.data_str, rawText);
+  if (!inner.ok) return inner;
+  const statisticsMap = inner.data?.statistics_map ?? {};
+  const decoded = decodeNestedJsonStrings(statisticsMap);
+  const rows = flattenRanksSummary(decoded);
+  if (nodeId !== void 0) {
+    return { ok: true, data: rows, note: `Filtered for node: ${nodeId}` };
+  }
+  return { ok: true, data: rows };
 }
-function buildPartitionsSql(columns) {
-  const select = columns.join(", ");
-  const orderBy = has(columns, "actual_bytes") ? "\nORDER BY actual_bytes DESC" : "";
-  return `-- Partition sizes and tier distribution
-SELECT ${select}
-FROM ki_catalog.ki_partitions${orderBy}
-LIMIT 30;`;
+
+// src/tools/rest/summarize-shards.ts
+var EMPTY_SUMMARY = {
+  shard_array_version: void 0,
+  total_shards: 0,
+  rank_count: 0,
+  distribution: [],
+  balanced: true
+};
+function summarizeShards(raw) {
+  if (raw === null || raw === void 0 || typeof raw !== "object") {
+    return EMPTY_SUMMARY;
+  }
+  const obj = raw;
+  const version = typeof obj.shard_array_version === "number" ? obj.shard_array_version : void 0;
+  const shardMap = obj.shard_map;
+  if (shardMap === null || shardMap === void 0 || typeof shardMap !== "object" || Array.isArray(shardMap)) {
+    return { ...EMPTY_SUMMARY, shard_array_version: version };
+  }
+  const entries = Object.values(shardMap);
+  if (entries.length === 0) {
+    return { ...EMPTY_SUMMARY, shard_array_version: version };
+  }
+  const counts = entries.reduce((acc, rank) => {
+    const map = new Map(acc);
+    map.set(rank, (acc.get(rank) ?? 0) + 1);
+    return map;
+  }, /* @__PURE__ */ new Map());
+  const totalShards = entries.length;
+  const distribution = [...counts.entries()].sort(([a], [b]) => a.localeCompare(b)).map(([rank, count]) => ({
+    rank,
+    shard_count: count,
+    percent: `${(count / totalShards * 100).toFixed(1)}%`
+  }));
+  const shardCounts = distribution.map((d) => d.shard_count);
+  const balanced = Math.max(...shardCounts) - Math.min(...shardCounts) <= 1;
+  return {
+    shard_array_version: version,
+    total_shards: totalShards,
+    rank_count: counts.size,
+    distribution,
+    balanced
+  };
 }
-function buildIndexesSql(columns) {
-  const select = columns.join(", ");
-  const orderBy = has(columns, "object_name") ? "\nORDER BY object_name" : "";
-  return `-- Index definitions
-SELECT ${select}
-FROM ki_catalog.ki_indexes${orderBy};`;
-}
-function buildPeriodicObjectsSql(columns) {
-  const select = columns.join(", ");
-  const orderBy = has(columns, "next_refresh_time") ? "\nORDER BY next_refresh_time" : "";
-  return `-- Periodic refresh schedules
-SELECT ${select}
-FROM ki_catalog.ki_periodic_objects${orderBy};`;
-}
-function buildUsersAndRolesSql(columns) {
-  const select = columns.join(", ");
-  const orderBy = has(columns, "name") ? "\nORDER BY name" : "";
-  return `-- Users and roles
-SELECT ${select}
-FROM ki_catalog.ki_users_and_roles${orderBy};`;
-}
-function buildObjectPermissionsSql(columns) {
-  const select = columns.join(", ");
-  const orderBy = has(columns, "object_name") && has(columns, "role_name") ? "\nORDER BY object_name, role_name" : has(columns, "object_name") ? "\nORDER BY object_name" : "";
-  return `-- Object permissions
-SELECT ${select}
-FROM ki_catalog.ki_object_permissions${orderBy};`;
-}
-function buildDependSql(columns) {
-  const select = columns.join(", ");
-  return `-- Object dependency graph
-SELECT ${select}
-FROM ki_catalog.ki_depend;`;
-}
-function buildLoadHistorySql(columns) {
-  const select = columns.join(", ");
-  const where = has(columns, "start_time") ? "\nWHERE start_time > NOW() - INTERVAL '1' HOUR" : "";
-  const orderBy = has(columns, "start_time") ? "\nORDER BY start_time DESC" : "";
-  return `-- Recent data load history
-SELECT ${select}
-FROM ki_catalog.ki_load_history${where}${orderBy}
-LIMIT 20;`;
-}
-function buildBackupHistorySql(columns) {
-  const select = columns.join(", ");
-  const orderBy = has(columns, "start_time") ? "\nORDER BY start_time DESC" : "";
-  return `-- Backup history
-SELECT ${select}
-FROM ki_catalog.ki_backup_history${orderBy}
-LIMIT 20;`;
-}
-function buildKafkaLagInfoSql(columns) {
-  const select = columns.join(", ");
-  const orderBy = has(columns, "datasource_oid") && has(columns, "partition_id") ? "\nORDER BY datasource_oid, partition_id" : has(columns, "datasource_oid") ? "\nORDER BY datasource_oid" : "";
-  return `-- Kafka consumer lag
-SELECT ${select}
-FROM ki_catalog.ki_kafka_lag_info${orderBy};`;
+
+// src/tools/rest/system-properties.ts
+var import_zod = require("zod");
+var GetSystemPropertiesSchema = import_zod.z.object({
+  category: import_zod.z.string().optional(),
+  key_pattern: import_zod.z.string().optional()
+});
+async function getSystemProperties(session2, input5) {
+  try {
+    const response = await session2.makeRequest("/show/system/properties", {
+      options: {}
+    });
+    if (!response.ok) {
+      const raw2 = await response.text();
+      return {
+        ok: false,
+        status: response.status,
+        error: `HTTP ${response.status}`,
+        raw: raw2
+      };
+    }
+    const raw = await response.text();
+    let parsed;
+    try {
+      parsed = JSON.parse(raw);
+    } catch (parseError) {
+      const message = parseError instanceof Error ? parseError.message : String(parseError);
+      return {
+        ok: false,
+        status: 200,
+        error: `JSON parse error: ${message}`,
+        raw
+      };
+    }
+    const inner = parseDataStr(parsed.data_str, raw);
+    if (!inner.ok) return inner;
+    const propertyMap = inner.data?.property_map ?? {};
+    const filteredMap = applyFilters(propertyMap, input5);
+    return {
+      ok: true,
+      data: flatObjectToRows(filteredMap, "property", "value"),
+      rowCount: Object.keys(filteredMap).length
+    };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return {
+      ok: false,
+      status: 0,
+      error: message,
+      raw: ""
+    };
+  }
 }
-var BUILDER_REGISTRY = [
-  // Query History and Performance
-  {
-    table: "ki_query_history",
-    section: "Query History and Performance",
-    build: buildQueryHistorySql,
-    fallback: FALLBACK_QUERY_HISTORY_SQL
-  },
-  {
-    table: "ki_query_active_all",
-    section: "Query History and Performance",
-    build: buildActiveQueriesSql,
-    fallback: FALLBACK_ACTIVE_QUERIES_SQL
-  },
-  {
-    table: "ki_query_span_metrics_all",
-    section: "Query History and Performance",
-    build: buildQuerySpanMetricsSql,
-    fallback: FALLBACK_QUERY_SPAN_METRICS_SQL
-  },
-  {
-    table: "ki_query_workers",
-    section: "Query History and Performance",
-    build: buildQueryWorkersSql,
-    fallback: FALLBACK_QUERY_WORKERS_SQL
-  },
-  // Memory and Storage Tiers
-  {
-    table: "ki_tiered_objects",
-    section: "Memory and Storage Tiers",
-    build: buildTieredObjectsSql,
-    fallback: FALLBACK_TIERED_OBJECTS_SQL
-  },
-  {
-    table: "ki_obj_stat",
-    section: "Memory and Storage Tiers",
-    build: buildObjStatSql,
-    fallback: FALLBACK_OBJ_STAT_SQL
-  },
-  {
-    table: "ki_partitions",
-    section: "Memory and Storage Tiers",
-    build: buildPartitionsSql,
-    fallback: FALLBACK_PARTITIONS_SQL
-  },
-  // Object Registry and Metadata
-  {
-    table: "ki_objects",
-    section: "Object Registry and Metadata",
-    build: buildObjectsSql,
-    fallback: FALLBACK_OBJECTS_SQL
-  },
-  {
-    table: "ki_indexes",
-    section: "Object Registry and Metadata",
-    build: buildIndexesSql,
-    fallback: FALLBACK_INDEXES_SQL
-  },
-  {
-    table: "ki_periodic_objects",
-    section: "Object Registry and Metadata",
-    build: buildPeriodicObjectsSql,
-    fallback: FALLBACK_PERIODIC_OBJECTS_SQL
-  },
-  {
-    table: "ki_depend",
-    section: "Object Registry and Metadata",
-    build: buildDependSql,
-    fallback: FALLBACK_DEPEND_SQL
-  },
-  // Security and Access Control
-  {
-    table: "ki_users_and_roles",
-    section: "Security and Access Control",
-    build: buildUsersAndRolesSql,
-    fallback: FALLBACK_USERS_AND_ROLES_SQL
-  },
-  {
-    table: "ki_object_permissions",
-    section: "Security and Access Control",
-    build: buildObjectPermissionsSql,
-    fallback: FALLBACK_OBJECT_PERMISSIONS_SQL
-  },
-  // Data Ingestion and Operations
-  {
-    table: "ki_load_history",
-    section: "Data Ingestion and Operations",
-    build: buildLoadHistorySql,
-    fallback: FALLBACK_LOAD_HISTORY_SQL
-  },
-  {
-    table: "ki_backup_history",
-    section: "Data Ingestion and Operations",
-    build: buildBackupHistorySql,
-    fallback: FALLBACK_BACKUP_HISTORY_SQL
-  },
-  {
-    table: "ki_kafka_lag_info",
-    section: "Data Ingestion and Operations",
-    build: buildKafkaLagInfoSql,
-    fallback: FALLBACK_KAFKA_LAG_INFO_SQL
-  },
-  // Schema Inspection
-  {
-    table: "ki_columns",
-    section: "Schema Inspection",
-    build: buildColumnsSql,
-    fallback: FALLBACK_COLUMNS_SQL
-  },
-  {
-    table: "ki_datatypes",
-    section: "Schema Inspection",
-    build: buildDatatypesSql,
-    fallback: FALLBACK_DATATYPES_SQL
+function applyFilters(propertyMap, input5) {
+  const { category, key_pattern } = input5;
+  if (category === void 0 && key_pattern === void 0) {
+    return propertyMap;
   }
-];
-
-// src/tools/index.ts
-var import_claude_agent_sdk3 = require("@anthropic-ai/claude-agent-sdk");
-var import_zod16 = require("zod");
-var import_picocolors9 = __toESM(require("picocolors"));
-
-// src/approval/registry.ts
-var DEFAULT_READ_ONLY_TOOLS = /* @__PURE__ */ new Set();
-function createRegistry(tools = DEFAULT_READ_ONLY_TOOLS) {
-  return {
-    isReadOnlyTool: (toolName) => tools.has(toolName),
-    // Returns a NEW registry — never mutates the current one
-    registerReadOnlyTool: (toolName) => createRegistry(/* @__PURE__ */ new Set([...tools, toolName])),
-    tools
-  };
+  const patternLower = key_pattern?.toLowerCase();
+  return Object.fromEntries(
+    Object.entries(propertyMap).filter(([key]) => {
+      const matchesCategory = category === void 0 || key.startsWith(category);
+      const matchesPattern = patternLower === void 0 || key.toLowerCase().includes(patternLower);
+      return matchesCategory && matchesPattern;
+    })
+  );
 }
-var defaultRegistry = createRegistry();
-var isReadOnlyTool = defaultRegistry.isReadOnlyTool;
-var READ_ONLY_TOOLS = defaultRegistry.tools;
 
-// src/output/stringify.ts
-function stringifyValue(v) {
-  if (v === void 0 || v === null) return "";
-  if (typeof v === "string") return v;
-  if (typeof v === "number" || typeof v === "boolean" || typeof v === "bigint") {
-    return v.toString();
-  }
-  if (typeof v === "object") return JSON.stringify(v);
-  if (typeof v === "symbol") return v.toString();
-  return "";
+// src/tools/rest/discover-hm-port.ts
+var DEFAULT_HM_PORT = 9300;
+async function discoverHmPort(session2) {
+  const result = await getSystemProperties(session2, { key_pattern: "hm_http_port" });
+  if (!result.ok) return DEFAULT_HM_PORT;
+  const rows = result.data;
+  const entry = rows.find((r) => r.property?.includes("hm_http_port"));
+  if (!entry?.value) return DEFAULT_HM_PORT;
+  const port = parseInt(entry.value, 10);
+  return Number.isFinite(port) ? port : DEFAULT_HM_PORT;
 }
 
-// src/output/format.ts
-function formatOutput(json) {
-  if (json === null || json === void 0) {
-    return "(empty)";
-  }
-  if (Array.isArray(json)) {
-    return formatArray(json);
-  }
-  if (typeof json === "object") {
-    return formatObject(json);
-  }
-  return stringifyValue(json);
-}
-function formatArray(arr) {
-  if (arr.length === 0) {
-    return "(no results)";
-  }
-  const first = arr[0];
-  if (typeof first === "object" && first !== null && !Array.isArray(first)) {
-    return formatTableArray(arr);
-  }
-  return arr.map(stringifyValue).join("\n");
-}
-function formatTableArray(rows) {
-  const headers = Object.keys(rows[0]);
-  const cells = rows.map((row) => headers.map((h) => stringifyValue(row[h])));
-  const colWidths = headers.map(
-    (h, i) => Math.max(h.length, ...cells.map((row) => row[i].length), 3)
-  );
-  const pad = (text, col) => text.padEnd(colWidths[col]);
-  const headerRow = `| ${headers.map((h, i) => pad(h, i)).join(" | ")} |`;
-  const separatorRow = `| ${colWidths.map((w) => "-".repeat(w)).join(" | ")} |`;
-  const dataRows = cells.map((row) => `| ${row.map((cell, i) => pad(cell, i)).join(" | ")} |`);
-  return [headerRow, separatorRow, ...dataRows].join("\n");
-}
-function formatObject(obj) {
-  return Object.entries(obj).map(([key, value]) => {
-    if (typeof value === "object" && value !== null) {
-      return `**${key}:**
-${formatOutput(value)}`;
-    }
-    return `**${key}:** ${stringifyValue(value)}`;
-  }).join("\n");
-}
-
-// src/output/format-tool-name.ts
-function formatToolName(toolName) {
-  const stripped = toolName.replace(/^mcp__[^_]+__/, "").replace(/^kinetica_/, "");
-  return stripped.replace(/_/g, " ");
-}
-
-// src/types/index.ts
-var DEFAULT_TRUNCATION = {
-  headLines: 150,
-  tailLines: 50
-};
-
-// src/output/truncate.ts
-function truncateOutput(text, options = DEFAULT_TRUNCATION) {
-  if (text === "") return "";
-  const lines = text.split("\n");
-  const { headLines, tailLines } = options;
-  const threshold = headLines + tailLines;
-  if (lines.length <= threshold) {
-    return text;
-  }
-  const truncatedCount = lines.length - headLines - tailLines;
-  const head = lines.slice(0, headLines);
-  const tail = lines.slice(lines.length - tailLines);
-  return [...head, "", `[... ${truncatedCount} lines truncated ...]`, "", ...tail].join("\n");
-}
-
-// src/output/reshape.ts
-function safeString(v) {
-  if (typeof v === "object" && v !== null) {
-    return JSON.stringify(v);
-  }
-  return String(v);
-}
-function flatObjectToRows(obj, keyLabel = "key", valueLabel = "value") {
-  return Object.entries(obj).map(([k, v]) => ({
-    [keyLabel]: k,
-    [valueLabel]: safeString(v)
-  }));
-}
-
-// src/tools/rest/parse-data-str.ts
-function parseDataStr(outerDataStr, raw) {
-  if (typeof outerDataStr !== "string") {
-    return { ok: true, data: void 0 };
-  }
-  try {
-    return { ok: true, data: JSON.parse(outerDataStr) };
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    return { ok: false, status: 200, error: `data_str parse error: ${message}`, raw };
-  }
-}
-
-// src/tools/rest/health.ts
-async function healthCheck(session2) {
+// src/tools/rest/cluster.ts
+async function fetchJson(session2, endpoint, body) {
   let response;
   let rawText;
   try {
-    response = await session2.makeRequest("/show/system/status", {});
+    response = await session2.makeRequest(endpoint, body);
     rawText = await response.text();
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    return {
-      ok: false,
-      status: 0,
-      error: message,
-      raw: ""
-    };
+    return { ok: false, status: 0, error: message, raw: "" };
   }
   if (!response.ok) {
     return {
@@ -1183,9 +945,9 @@ async function healthCheck(session2) {
       raw: rawText
     };
   }
-  let parsed;
   try {
-    parsed = JSON.parse(rawText);
+    const parsed = JSON.parse(rawText);
+    return { ok: true, data: parsed };
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
     return {
@@ -1195,111 +957,20 @@ async function healthCheck(session2) {
       raw: rawText
     };
   }
-  const inner = parseDataStr(parsed.data_str, rawText);
-  if (!inner.ok) return inner;
-  const statusMap = inner.data?.status_map ?? {};
-  return {
-    ok: true,
-    data: flatObjectToRows(statusMap, "component", "status")
-  };
-}
-
-// src/tools/rest/decode-nested-json.ts
-function decodeNestedJsonStrings(obj) {
-  return Object.fromEntries(
-    Object.entries(obj).map(([k, v]) => {
-      if (typeof v !== "string") return [k, v];
-      try {
-        const parsed = JSON.parse(v);
-        if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
-          return [k, decodeNestedJsonStrings(parsed)];
-        }
-        return [k, parsed];
-      } catch {
-        return [k, v];
-      }
-    })
-  );
-}
-
-// src/tools/rest/flatten-rank-stats.ts
-function findTier(tiers, prefix) {
-  for (const [name, data] of Object.entries(tiers)) {
-    if (name === prefix || name.startsWith(`${prefix}.`) || name.startsWith(`${prefix}_`) || name.startsWith(prefix) && /^\d/.test(name.slice(prefix.length))) {
-      if (typeof data === "object" && data !== null && !Array.isArray(data)) {
-        return data;
-      }
-    }
-  }
-  return void 0;
-}
-function overallField(tier, field) {
-  if (!tier) return "";
-  const overall = tier.overall;
-  if (typeof overall !== "object" || overall === null) return "";
-  const value = overall[field];
-  return stringifyValue(value);
-}
-function computePercent(used, limit) {
-  if (!used || !limit) return "";
-  const usedN = Number(used);
-  const limitN = Number(limit);
-  if (!Number.isFinite(usedN) || !Number.isFinite(limitN) || limitN === 0) return "";
-  return `${(usedN / limitN * 100).toFixed(1)}%`;
 }
-function flattenRanksSummary(decoded) {
-  const ranksRaw = typeof decoded.ranks === "object" && decoded.ranks !== null ? decoded.ranks : decoded;
-  return Object.entries(ranksRaw).filter(([, v]) => typeof v === "object" && v !== null && !Array.isArray(v)).map(([rankId, rankData]) => {
-    const rank = rankData;
-    const tiers = typeof rank.tiers === "object" && rank.tiers !== null ? rank.tiers : {};
-    const ramUsed = overallField(findTier(tiers, "RAM"), "used");
-    const ramLimit = overallField(findTier(tiers, "RAM"), "limit");
+async function fetchJsonOnPort(session2, port, endpoint, body) {
+  if (!session2.makeRequestToPort) {
     return {
-      rank: rankId,
-      ram_used: ramUsed,
-      ram_limit: ramLimit,
-      ram_percent: computePercent(ramUsed, ramLimit),
-      persist_used: overallField(findTier(tiers, "PERSIST"), "used"),
-      disk_used: overallField(findTier(tiers, "DISK"), "used"),
-      vram_used: overallField(findTier(tiers, "VRAM"), "used")
+      ok: false,
+      status: 0,
+      error: "makeRequestToPort not available on this session",
+      raw: ""
     };
-  });
-}
-function flattenRankDetail(rankData) {
-  const tiersRaw = typeof rankData.tiers === "object" && rankData.tiers !== null ? rankData.tiers : {};
-  const tiers = Object.entries(tiersRaw).filter(([, v]) => typeof v === "object" && v !== null && !Array.isArray(v)).map(([tierName, tierData]) => {
-    const tier = tierData;
-    const overall = typeof tier.overall === "object" && tier.overall !== null ? tier.overall : {};
-    const stats = typeof tier.stats === "object" && tier.stats !== null ? tier.stats : {};
-    const row = { tier: tierName };
-    for (const [k, v] of Object.entries(overall)) {
-      row[k] = stringifyValue(v);
-    }
-    for (const [k, v] of Object.entries(stats)) {
-      row[k] = stringifyValue(v);
-    }
-    return row;
-  });
-  const rgRaw = typeof rankData.resource_groups === "object" && rankData.resource_groups !== null ? rankData.resource_groups : {};
-  const resource_groups = Object.entries(rgRaw).filter(([, v]) => typeof v === "object" && v !== null && !Array.isArray(v)).map(([rgName, rgData]) => {
-    const rg = rgData;
-    const row = { name: rgName };
-    for (const [k, v] of Object.entries(rg)) {
-      row[k] = stringifyValue(v);
-    }
-    return row;
-  });
-  return { tiers, resource_groups };
-}
-
-// src/tools/rest/metrics.ts
-async function getMetrics(session2, nodeId) {
+  }
   let response;
   let rawText;
   try {
-    response = await session2.makeRequest("/show/resource/statistics", {
-      options: {}
-    });
+    response = await session2.makeRequestToPort(port, endpoint, body);
     rawText = await response.text();
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
@@ -1313,213 +984,9 @@ async function getMetrics(session2, nodeId) {
       raw: rawText
     };
   }
-  let parsed;
   try {
-    parsed = JSON.parse(rawText);
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    return {
-      ok: false,
-      status: 200,
-      error: `JSON parse error: ${message}`,
-      raw: rawText
-    };
-  }
-  const inner = parseDataStr(parsed.data_str, rawText);
-  if (!inner.ok) return inner;
-  const statisticsMap = inner.data?.statistics_map ?? {};
-  const decoded = decodeNestedJsonStrings(statisticsMap);
-  const rows = flattenRanksSummary(decoded);
-  if (nodeId !== void 0) {
-    return { ok: true, data: rows, note: `Filtered for node: ${nodeId}` };
-  }
-  return { ok: true, data: rows };
-}
-
-// src/tools/rest/summarize-shards.ts
-var EMPTY_SUMMARY = {
-  shard_array_version: void 0,
-  total_shards: 0,
-  rank_count: 0,
-  distribution: [],
-  balanced: true
-};
-function summarizeShards(raw) {
-  if (raw === null || raw === void 0 || typeof raw !== "object") {
-    return EMPTY_SUMMARY;
-  }
-  const obj = raw;
-  const version = typeof obj.shard_array_version === "number" ? obj.shard_array_version : void 0;
-  const shardMap = obj.shard_map;
-  if (shardMap === null || shardMap === void 0 || typeof shardMap !== "object" || Array.isArray(shardMap)) {
-    return { ...EMPTY_SUMMARY, shard_array_version: version };
-  }
-  const entries = Object.values(shardMap);
-  if (entries.length === 0) {
-    return { ...EMPTY_SUMMARY, shard_array_version: version };
-  }
-  const counts = entries.reduce((acc, rank) => {
-    const map = new Map(acc);
-    map.set(rank, (acc.get(rank) ?? 0) + 1);
-    return map;
-  }, /* @__PURE__ */ new Map());
-  const totalShards = entries.length;
-  const distribution = [...counts.entries()].sort(([a], [b]) => a.localeCompare(b)).map(([rank, count]) => ({
-    rank,
-    shard_count: count,
-    percent: `${(count / totalShards * 100).toFixed(1)}%`
-  }));
-  const shardCounts = distribution.map((d) => d.shard_count);
-  const balanced = Math.max(...shardCounts) - Math.min(...shardCounts) <= 1;
-  return {
-    shard_array_version: version,
-    total_shards: totalShards,
-    rank_count: counts.size,
-    distribution,
-    balanced
-  };
-}
-
-// src/tools/rest/system-properties.ts
-var import_zod = require("zod");
-var GetSystemPropertiesSchema = import_zod.z.object({
-  category: import_zod.z.string().optional(),
-  key_pattern: import_zod.z.string().optional()
-});
-async function getSystemProperties(session2, input5) {
-  try {
-    const response = await session2.makeRequest("/show/system/properties", {
-      options: {}
-    });
-    if (!response.ok) {
-      const raw2 = await response.text();
-      return {
-        ok: false,
-        status: response.status,
-        error: `HTTP ${response.status}`,
-        raw: raw2
-      };
-    }
-    const raw = await response.text();
-    let parsed;
-    try {
-      parsed = JSON.parse(raw);
-    } catch (parseError) {
-      const message = parseError instanceof Error ? parseError.message : String(parseError);
-      return {
-        ok: false,
-        status: 200,
-        error: `JSON parse error: ${message}`,
-        raw
-      };
-    }
-    const inner = parseDataStr(parsed.data_str, raw);
-    if (!inner.ok) return inner;
-    const propertyMap = inner.data?.property_map ?? {};
-    const filteredMap = applyFilters(propertyMap, input5);
-    return {
-      ok: true,
-      data: flatObjectToRows(filteredMap, "property", "value"),
-      rowCount: Object.keys(filteredMap).length
-    };
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    return {
-      ok: false,
-      status: 0,
-      error: message,
-      raw: ""
-    };
-  }
-}
-function applyFilters(propertyMap, input5) {
-  const { category, key_pattern } = input5;
-  if (category === void 0 && key_pattern === void 0) {
-    return propertyMap;
-  }
-  const patternLower = key_pattern?.toLowerCase();
-  return Object.fromEntries(
-    Object.entries(propertyMap).filter(([key]) => {
-      const matchesCategory = category === void 0 || key.startsWith(category);
-      const matchesPattern = patternLower === void 0 || key.toLowerCase().includes(patternLower);
-      return matchesCategory && matchesPattern;
-    })
-  );
-}
-
-// src/tools/rest/discover-hm-port.ts
-var DEFAULT_HM_PORT2 = 9300;
-async function discoverHmPort(session2) {
-  const result = await getSystemProperties(session2, { key_pattern: "hm_http_port" });
-  if (!result.ok) return DEFAULT_HM_PORT2;
-  const rows = result.data;
-  const entry = rows.find((r) => r.property?.includes("hm_http_port"));
-  if (!entry?.value) return DEFAULT_HM_PORT2;
-  const port = parseInt(entry.value, 10);
-  return Number.isFinite(port) ? port : DEFAULT_HM_PORT2;
-}
-
-// src/tools/rest/cluster.ts
-async function fetchJson(session2, endpoint, body) {
-  let response;
-  let rawText;
-  try {
-    response = await session2.makeRequest(endpoint, body);
-    rawText = await response.text();
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    return { ok: false, status: 0, error: message, raw: "" };
-  }
-  if (!response.ok) {
-    return {
-      ok: false,
-      status: response.status,
-      error: `HTTP ${response.status}`,
-      raw: rawText
-    };
-  }
-  try {
-    const parsed = JSON.parse(rawText);
-    return { ok: true, data: parsed };
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    return {
-      ok: false,
-      status: 200,
-      error: `JSON parse error: ${message}`,
-      raw: rawText
-    };
-  }
-}
-async function fetchJsonOnPort(session2, port, endpoint, body) {
-  if (!session2.makeRequestToPort) {
-    return {
-      ok: false,
-      status: 0,
-      error: "makeRequestToPort not available on this session",
-      raw: ""
-    };
-  }
-  let response;
-  let rawText;
-  try {
-    response = await session2.makeRequestToPort(port, endpoint, body);
-    rawText = await response.text();
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    return { ok: false, status: 0, error: message, raw: "" };
-  }
-  if (!response.ok) {
-    return {
-      ok: false,
-      status: response.status,
-      error: `HTTP ${response.status}`,
-      raw: rawText
-    };
-  }
-  try {
-    const parsed = JSON.parse(rawText);
-    return { ok: true, data: parsed };
+    const parsed = JSON.parse(rawText);
+    return { ok: true, data: parsed };
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
     return {
@@ -3055,28 +2522,28 @@ async function alterConfiguration(session2, input5) {
 
 // src/tools/mutation/alter-table-columns.ts
 var import_zod15 = require("zod");
-var import_prompts6 = require("@inquirer/prompts");
-var import_picocolors8 = __toESM(require("picocolors"));
-var import_claude_agent_sdk2 = require("@anthropic-ai/claude-agent-sdk");
+var import_prompts2 = require("@inquirer/prompts");
+var import_picocolors3 = __toESM(require("picocolors"));
+var import_claude_agent_sdk = require("@anthropic-ai/claude-agent-sdk");
 
 // src/approval/checklist.ts
-var import_prompts5 = require("@inquirer/prompts");
-var import_picocolors7 = __toESM(require("picocolors"));
-var DIVIDER = import_picocolors7.default.dim("\u2500".repeat(60));
+var import_prompts = require("@inquirer/prompts");
+var import_picocolors2 = __toESM(require("picocolors"));
+var DIVIDER = import_picocolors2.default.dim("\u2500".repeat(60));
 function renderChecklist(header, summary, items) {
   const lines = [
     "",
     DIVIDER,
-    `  ${import_picocolors7.default.bold(import_picocolors7.default.yellow(header))}`,
+    `  ${import_picocolors2.default.bold(import_picocolors2.default.yellow(header))}`,
     "",
-    `  ${import_picocolors7.default.dim("Summary:")} ${summary}`,
+    `  ${import_picocolors2.default.dim("Summary:")} ${summary}`,
     "",
-    `  ${import_picocolors7.default.bold(`${items.length} proposed column change(s):`)}`,
+    `  ${import_picocolors2.default.bold(`${items.length} proposed column change(s):`)}`,
     ""
   ];
   for (let i = 0; i < items.length; i++) {
     const item = items[i];
-    lines.push(`  ${import_picocolors7.default.bold(`${i + 1}.`)} ${item.label}`, `     ${import_picocolors7.default.dim(item.description)}`);
+    lines.push(`  ${import_picocolors2.default.bold(`${i + 1}.`)} ${item.label}`, `     ${import_picocolors2.default.dim(item.description)}`);
   }
   lines.push("", DIVIDER, "");
   return lines.join("\n");
@@ -3085,7 +2552,7 @@ async function showChecklist(header, summary, items) {
   const panel = renderChecklist(header, summary, items);
   process.stderr.write(panel);
   try {
-    const selected = await (0, import_prompts5.checkbox)({
+    const selected = await (0, import_prompts.checkbox)({
       message: "Select columns to alter (space to toggle, enter to confirm):",
       choices: items.map((item, i) => ({
         value: i,
@@ -3120,12 +2587,12 @@ function buildAlterTableSql(tableName, columns) {
   return `ALTER TABLE ${tableName}
 ${clauses.join(",\n")}`;
 }
-var SQL_DIVIDER = import_picocolors8.default.dim("\u2500".repeat(60));
+var SQL_DIVIDER = import_picocolors3.default.dim("\u2500".repeat(60));
 async function confirmSqlExecution(sql) {
   const panel = [
     "",
     SQL_DIVIDER,
-    `  ${import_picocolors8.default.bold(import_picocolors8.default.yellow("Generated SQL:"))}`,
+    `  ${import_picocolors3.default.bold(import_picocolors3.default.yellow("Generated SQL:"))}`,
     "",
     sql.split("\n").map((line) => `  ${line}`).join("\n"),
     "",
@@ -3134,7 +2601,7 @@ async function confirmSqlExecution(sql) {
   ].join("\n");
   process.stderr.write(panel);
   try {
-    const response = await (0, import_prompts6.input)({ message: "Execute? (y/n):" });
+    const response = await (0, import_prompts2.input)({ message: "Execute? (y/n):" });
     return response.trim().toLowerCase() === "y";
   } catch {
     return false;
@@ -3200,7 +2667,7 @@ async function alterTableColumns(session2, toolInput) {
   };
 }
 function makeAlterTableColumnsTool(session2, deps) {
-  return (0, import_claude_agent_sdk2.tool)(
+  return (0, import_claude_agent_sdk.tool)(
     "kinetica_alter_table_columns",
     "Batch multiple column type/property changes on a SINGLE table into one efficient ALTER TABLE statement. Use when recommending 2+ column changes on the same table (e.g., adding DICT encoding to multiple columns, adding TEXT_SEARCH, changing column types). Each column change requires: column_name, new_definition (full type definition with properties and nullability), and description (human-readable reason). The operator selects which columns to alter via interactive checklist, then confirms the generated SQL. For a single column change, use kinetica_execute_mutation_sql directly. Kinetica ALTER TABLE syntax requires repeating the FULL column definition \u2014 properties go INSIDE parentheses: VARCHAR(50, DICT), not VARCHAR(50) DICT.",
     AlterTableColumnsSchema.shape,
@@ -3313,19 +2780,19 @@ function applyOutputPipeline(result) {
   return truncateOutput(formatOutput(payload));
 }
 function logMutationAudit(toolName, result, input5) {
-  const statusLabel = result.ok ? import_picocolors9.default.bold(import_picocolors9.default.green("EXECUTED")) : import_picocolors9.default.bold(import_picocolors9.default.red("FAILED"));
+  const statusLabel = result.ok ? import_picocolors4.default.bold(import_picocolors4.default.green("EXECUTED")) : import_picocolors4.default.bold(import_picocolors4.default.red("FAILED"));
   const redacted = redactAuditInput(input5);
   const inputSummary = Object.entries(redacted).map(([k, v]) => `${k}=${typeof v === "string" ? v : JSON.stringify(v)}`).join(", ");
   const displayName = formatToolName(toolName);
   process.stderr.write(
-    `  ${import_picocolors9.default.dim("MUTATION")} ${statusLabel}  ${displayName}
-  ${import_picocolors9.default.dim(inputSummary)}
+    `  ${import_picocolors4.default.dim("MUTATION")} ${statusLabel}  ${displayName}
+  ${import_picocolors4.default.dim(inputSummary)}
 
 `
   );
 }
 function makeAlterSystemPropertiesTool(session2) {
-  return (0, import_claude_agent_sdk3.tool)(
+  return (0, import_claude_agent_sdk2.tool)(
     "kinetica_alter_system_properties",
     "Apply runtime configuration changes to Kinetica via /alter/system/properties. Accepts a map of property name to new value. Captures current values before applying and verifies changes after. Only the 43 documented properties are accepted \u2014 requests with unsupported property names are rejected before any API call. Blocked for safety: ai_api_key, external_files_directory. Common properties (7.2.x): subtask_concurrency_limit, request_timeout, max_get_records_size, concurrent_kernel_execution, max_concurrent_kernels, tcs_per_tom, tps_per_tom, chunk_size, enable_audit, egress_parquet_compression, background_worker_threads. All property names require 'conf.' prefix in /show/system/properties but NOT in /alter/system/properties.",
     AlterSystemPropertiesSchema.shape,
@@ -3339,7 +2806,7 @@ function makeAlterSystemPropertiesTool(session2) {
   );
 }
 function makeExecuteMutationSqlTool(session2) {
-  return (0, import_claude_agent_sdk3.tool)(
+  return (0, import_claude_agent_sdk2.tool)(
     "kinetica_execute_mutation_sql",
     "Execute a SQL mutation statement on Kinetica (CREATE INDEX, ALTER TABLE, ALTER SYSTEM SET, REFRESH MATERIALIZED VIEW, etc.). ANALYZE TABLE is NOT supported by Kinetica \u2014 do not call it. DROP, TRUNCATE, DELETE, and UPDATE are always rejected \u2014 even when wrapped in a CTE (WITH ... DELETE/UPDATE). Requires user approval before execution.",
     ExecuteMutationSqlSchema.shape,
@@ -3353,7 +2820,7 @@ function makeExecuteMutationSqlTool(session2) {
   );
 }
 function makeAdminRebalanceTool(session2) {
-  return (0, import_claude_agent_sdk3.tool)(
+  return (0, import_claude_agent_sdk2.tool)(
     "kinetica_admin_rebalance",
     "Trigger shard data rebalancing across Kinetica cluster ranks via /admin/rebalance. Options: rebalance_sharded_data, rebalance_unsharded_data, table_includes, table_excludes, aggressiveness (1-5, capped for safety), compact_after_rebalance, compact_only. Captures before/after shard distribution for verification. WARNING: rebalance causes delayed query responses while running \u2014 use low aggressiveness (1-3) during production hours. NOTE: On single-worker-rank clusters, /admin/rebalance returns 'Database must be offline' because there is only one data rank \u2014 rebalance is only meaningful with 2+ worker ranks.",
     AdminRebalanceSchema.shape,
@@ -3367,7 +2834,7 @@ function makeAdminRebalanceTool(session2) {
   );
 }
 function makeAlterConfigurationTool(session2) {
-  return (0, import_claude_agent_sdk3.tool)(
+  return (0, import_claude_agent_sdk2.tool)(
     "kinetica_alter_configuration",
     "Replace the full gpudb.conf configuration on the Kinetica host manager via /admin/alter/configuration (port 9300). Requires the complete config_string content \u2014 the entire file is replaced. Captures before/after config summaries for verification. WARNING: This replaces the ENTIRE configuration file. Always read the current config via kinetica_show_configuration first, make targeted changes to specific lines, and submit the full modified content. Never compose a config from scratch. Requires host manager connectivity and user approval.",
     AlterConfigurationSchema.shape,
@@ -3381,7 +2848,7 @@ function makeAlterConfigurationTool(session2) {
   );
 }
 function makeHealthCheckTool(session2) {
-  return (0, import_claude_agent_sdk3.tool)(
+  return (0, import_claude_agent_sdk2.tool)(
     "kinetica_health_check",
     "Query Kinetica system health status via /show/system/status. Returns 11 components as rows (component, status): system (cluster status, leader, offline), ranks (per-rank status/mode/accepting_jobs/read_only), hosts (hostname, memory, GPU IDs, sub-service statuses), http_server (connections current/refused, thread capacity), ha_cluster_info/ha_status, graph, text, migrations, triggers, symbols. NOTE: Each status value is a JSON-encoded string \u2014 parse mentally to extract nested fields. Healthy baseline: system.status='running', all ranks rank_status='running' + rank_mode='run', hosts.status='running', http_server.connections.refused=0.",
     {},
@@ -3393,7 +2860,7 @@ function makeHealthCheckTool(session2) {
   );
 }
 function makeGetMetricsTool(session2) {
-  return (0, import_claude_agent_sdk3.tool)(
+  return (0, import_claude_agent_sdk2.tool)(
     "kinetica_get_metrics",
     "Retrieve per-rank storage tier metrics from /show/resource/statistics. Returns rows with: rank, ram_used, ram_limit, ram_percent (computed as 'X.Y%' e.g. '9.6%'), persist_used, disk_used, vram_used (all string values). Rank 0 is the head/coordinator node with minimal RAM (~794MB limit) and empty persist/disk/vram fields. Worker ranks (1+) hold the actual data with ~5.6GB RAM limit. Empty string means tier not configured; '0' means configured but unused. Healthy baseline: ram_percent under 80%. Optional node_id to annotate which node was requested.",
     { node_id: import_zod16.z.string().optional() },
@@ -3405,7 +2872,7 @@ function makeGetMetricsTool(session2) {
   );
 }
 function makeClusterStatusTool(session2) {
-  return (0, import_claude_agent_sdk3.tool)(
+  return (0, import_claude_agent_sdk2.tool)(
     "kinetica_cluster_status",
     "Get full cluster overview via 4 sub-calls: (1) /admin/show/cluster/operations \u2014 in_progress flag, percent_complete, rebalance/add/remove status; (2) /admin/show/shards \u2014 summarized as shard distribution per rank (total_shards, rank_count, per-rank shard_count/percent, balanced flag, shard_array_version); (3) /admin/show/alerts on host manager port \u2014 recent alerts (gracefully degrades if unavailable); (4) /admin/show/jobs \u2014 active async jobs as {job_id, status, endpoint} objects. Healthy baseline: operations.in_progress=false, shards.balanced=true, empty alerts/jobs arrays.",
     {},
@@ -3417,7 +2884,7 @@ function makeClusterStatusTool(session2) {
   );
 }
 function makeNodeDetailsTool(session2) {
-  return (0, import_claude_agent_sdk3.tool)(
+  return (0, import_claude_agent_sdk2.tool)(
     "kinetica_node_details",
     "Get per-rank resource statistics from /show/resource/statistics (same endpoint as kinetica_get_metrics). Without node_id: returns summary rows for all ranks. With node_id: returns detailed tier + resource-group breakdown for that rank. Per-tier fields: limit, used, free, percent_used, num_evictable_objs, num_unevictable_objs, plus stats: evictions, pins, unpins, watermark_cycles, allocs, reallocs, deallocs (RAM/VRAM tiers) or reads, writes, deletes (PERSIST/DISK tiers). Per-resource-group fields: name, thread_running_count, data (bytes). Rank 0 is the head node \u2014 only RAM tier (no PERSIST/DISK/VRAM), no resource groups.",
     { node_id: import_zod16.z.string().optional() },
@@ -3429,7 +2896,7 @@ function makeNodeDetailsTool(session2) {
   );
 }
 function makeGetLogsTool(session2) {
-  return (0, import_claude_agent_sdk3.tool)(
+  return (0, import_claude_agent_sdk2.tool)(
     "kinetica_get_logs",
     "Retrieve application logs via /admin/show/logs. Sources: kinetica, rank, syslog, gadmin, reveal, workbench. Severity: DEBUG|INFO|WARN|ERROR|FATAL. Time: duration (1h, 30m) or start_time+end_time. WARNING: This endpoint is NOT available on Kinetica 7.2.x \u2014 it always returns a stub response. Use kinetica_execute_sql to query ki_catalog.ki_query_history (for query errors) or ki_catalog.ki_query_span_metrics_all (for operation-level events) instead.",
     GetLogsSchema.shape,
@@ -3442,7 +2909,7 @@ function makeGetLogsTool(session2) {
   );
 }
 function makeShowConfigurationTool(session2) {
-  return (0, import_claude_agent_sdk3.tool)(
+  return (0, import_claude_agent_sdk2.tool)(
     "kinetica_show_configuration",
     "Retrieve the full gpudb.conf configuration file from the Kinetica host manager via /admin/show/configuration (port 9300). Returns the raw config_string in INI format with all sections and comments. Use this to inspect the complete server configuration for drift detection, misconfiguration diagnosis, or before proposing config changes via kinetica_alter_configuration. Requires host manager connectivity.",
     ShowConfigurationSchema.shape,
@@ -3455,7 +2922,7 @@ function makeShowConfigurationTool(session2) {
   );
 }
 function makeGetSystemPropertiesTool(session2) {
-  return (0, import_claude_agent_sdk3.tool)(
+  return (0, import_claude_agent_sdk2.tool)(
     "kinetica_get_system_properties",
     "Read Kinetica system configuration properties from /show/system/properties. Returns 260+ property rows as {property, value} pairs (all values are strings). Filter by category prefix (e.g., 'conf.tier', 'conf.sql', 'version') or key_pattern substring. Key property groups: conf.tier.* (RAM limits, watermarks, tier strategy), conf.sql.* (parallel_execution, planner timeout), conf.enable_* (authorization, HA, ML, text_search), version.* (gpudb_core_version, compute_engine). Omit both filters to get the full property_map.",
     GetSystemPropertiesSchema.shape,
@@ -3468,7 +2935,7 @@ function makeGetSystemPropertiesTool(session2) {
   );
 }
 function makeExecuteSqlTool(session2, catalogSchemas) {
-  return (0, import_claude_agent_sdk3.tool)(
+  return (0, import_claude_agent_sdk2.tool)(
     "kinetica_execute_sql",
     "Execute a read-only SQL query (SELECT, WITH, or EXPLAIN) against Kinetica. Key system tables: ki_catalog.ki_query_history (slow queries \u2014 columns: job_id, query_id, user_name, endpoint, execution_status, error_message, query_text, start_time, stop_time, sql_step_count, refresh_id, resource_group, source_ip), ki_catalog.ki_query_active_all (running queries \u2014 columns: job_id, query_id, user_name, resource_group, source_ip, endpoint, execution_status, error_message, start_time, query_text, sql_step_count, refresh_id, is_mh, is_perpetual, is_cancellable, is_using_timeout, source_rank), ki_catalog.ki_tiered_objects (per-object tier placement \u2014 size, id (string like @schema@oid[col][0] \u2014 NOT a numeric OID, do not join with ki_objects.oid), priority, tier, evictable, locked, pin_count, ram_evictions, persist_evictions, owner_resource_group, source_rank, outer_object; for per-table tier data prefer kinetica_resource_objects with table_names filter), ki_catalog.ki_obj_stat (table sizes \u2014 oid, schema_name, object_name, row_count, bytes_per_row, total_bytes), ki_catalog.ki_columns (column metadata), ki_catalog.ki_objects (object registry with obj_kind R=table/V=view). WARNING: ki_catalog.ki_tables and ki_catalog.ki_version do NOT exist in Kinetica 7.2.x \u2014 use ki_objects and /show/system/status instead.",
     ExecuteSqlSchema.shape,
@@ -3485,7 +2952,7 @@ function makeExecuteSqlTool(session2, catalogSchemas) {
   );
 }
 function makeExplainQueryTool(session2) {
-  return (0, import_claude_agent_sdk3.tool)(
+  return (0, import_claude_agent_sdk2.tool)(
     "kinetica_explain_query",
     "Get the execution plan for a SQL statement. Pass the SELECT statement without the EXPLAIN keyword \u2014 it will be added automatically. Returns rows with columns: ID (step number), ENDPOINT (internal REST endpoint used, e.g., /get/records/bycolumn), INPUT_TABLES, OUTPUT_TABLE, DEPENDENCIES (step IDs this depends on; -1 means none). Use to understand which internal operations a query triggers and verify index usage.",
     ExplainQuerySchema.shape,
@@ -3497,7 +2964,7 @@ function makeExplainQueryTool(session2) {
   );
 }
 function makeSystemTimingTool(session2) {
-  return (0, import_claude_agent_sdk3.tool)(
+  return (0, import_claude_agent_sdk2.tool)(
     "kinetica_system_timing",
     "Show endpoint response timing statistics from /show/system/timing. Returns the last ~100 API calls as {endpoint, time_in_ms, job_id} rows with sub-millisecond precision. job_id='0' means synchronous execution at head node; non-zero means async. Typical baselines: /show/system/properties <4ms, /show/security <1ms, /execute/sql 14-1300ms, /admin/verifydb 500-4500ms. Use to identify slow API endpoints or confirm whether a specific call was abnormally slow.",
     {},
@@ -3509,7 +2976,7 @@ function makeSystemTimingTool(session2) {
   );
 }
 function makeResourceGroupsTool(session2) {
-  return (0, import_claude_agent_sdk3.tool)(
+  return (0, import_claude_agent_sdk2.tool)(
     "kinetica_resource_groups",
     "List resource groups and their configuration from /show/resourcegroups. Returns {groups, rank_usage, info}. Groups include: name, RAM.max_memory, VRAM.GPU0.max_memory, max_cpu_concurrency, max_data, max_scheduling_priority (100=system, 50=default), max_tier_priority. Value '9223372036854775807' (Long.MAX_VALUE) means unlimited. Default groups are kinetica_system_resource_group (priority 100) and kinetica_default_resource_group (priority 50). rank_usage maps rank IDs to JSON-encoded per-group usage (thread_running_count, data bytes, RAM.used, VRAM.GPU0.used). Only worker ranks appear in rank_usage \u2014 rank 0 (head) has no entry. Set show_tier_usage=true for rank-level breakdown.",
     ResourceGroupsSchema.shape,
@@ -3522,7 +2989,7 @@ function makeResourceGroupsTool(session2) {
   );
 }
 function makeVerifyDbTool(session2) {
-  return (0, import_claude_agent_sdk3.tool)(
+  return (0, import_claude_agent_sdk2.tool)(
     "kinetica_verify_db",
     "Run a read-only database integrity verification via /admin/verifydb. Checks for null values, persistence issues, and rank0 consistency. Always runs in concurrent_safe mode. Returns {verified_ok: boolean, error_list: [], orphaned_tables_total_size: number}. Healthy: verified_ok=true, empty error_list, orphaned_tables_total_size of -1 (not checked) or 0. WARNING: This is the slowest diagnostic tool \u2014 typically takes 500ms-4500ms. Use sparingly and only when data integrity issues are suspected.",
     VerifyDbSchema.shape,
@@ -3535,7 +3002,7 @@ function makeVerifyDbTool(session2) {
   );
 }
 function makeShowSecurityTool(session2) {
-  return (0, import_claude_agent_sdk3.tool)(
+  return (0, import_claude_agent_sdk2.tool)(
     "kinetica_show_security",
     "Show security configuration from /show/security. Returns {types, roles, permissions, resource_groups, info}. When enable_authorization=false (check permissions[''].enable_authorization), types/roles/resource_groups are empty objects \u2014 the tool provides minimal data. When authorization is enabled: types maps usernames to 'internal_user'/'external_user', roles maps role names to member arrays, permissions maps users to permission arrays, resource_groups maps users to group names. Use to audit access control or diagnose authorization failures.",
     ShowSecuritySchema.shape,
@@ -3548,7 +3015,7 @@ function makeShowSecurityTool(session2) {
   );
 }
 function makeShowTableTool(session2) {
-  return (0, import_claude_agent_sdk3.tool)(
+  return (0, import_claude_agent_sdk2.tool)(
     "kinetica_show_table",
     "Show table metadata from /show/table. When a specific table_name is provided: returns table metadata with Kinetica-native column types, per-column properties (DICT, TEXT_SEARCH, COMPRESS, etc.), and index definitions from ki_catalog.ki_indexes (index_type, index_columns) \u2014 this is the preferred method for full table inspection. When table_name is omitted or empty: returns schema-level (collection) entries with sizes, but the processed output may be empty \u2014 use kinetica_execute_sql with 'SELECT * FROM ki_catalog.ki_objects WHERE obj_kind = ''R'' ORDER BY schema_name' for reliable table listing instead.",
     ShowTableSchema.shape,
@@ -3561,7 +3028,7 @@ function makeShowTableTool(session2) {
   );
 }
 function makeResourceObjectsTool(session2) {
-  return (0, import_claude_agent_sdk3.tool)(
+  return (0, import_claude_agent_sdk2.tool)(
     "kinetica_resource_objects",
     `Show per-rank resource tier usage from /show/resource/objects. Returns {rank_objects: {rank_id: JSON_string_with_objects_array}, info}. Each object has: id (naming convention: @table@oid[column][chunk] for data, AttrIndex[...] for indexes, PKIndex_... for PK hashes), size (bytes), priority (1=system, 5=user, 9=temp), tier ('RAM' or 'PERSIST'), evictable (boolean), locked (boolean), pin_count, ram_evictions, persist_evictions, owner_resource_group. The rank_objects JSON is {"objects": [...]} \u2014 an array nested under an 'objects' key. Only worker ranks have data \u2014 rank 0 (head) has no resource objects. Healthy: zero evictions, zero pin_count at rest.`,
     ResourceObjectsSchema.shape,
@@ -3574,7 +3041,7 @@ function makeResourceObjectsTool(session2) {
   );
 }
 function makeHostManagerStatusTool(session2) {
-  return (0, import_claude_agent_sdk3.tool)(
+  return (0, import_claude_agent_sdk2.tool)(
     "kinetica_host_manager_status",
     "Query the Kinetica host manager root endpoint (port 9300) for cluster-wide status. Returns a flat key-value map including: version, hostname, system_mode ('run'/'stop'), system_status ('running'/'stopped'), system_idle_time (seconds), cluster_leader (IP), cluster_operation ('none'/'rebalance'/etc.), license_type/status/expiration, per-host and per-rank mode/status/pid, and service statuses (ml, httpd, query_planner, reveal, stats, graph, text). Healthy baseline: system_mode='run', system_status='running', all rankN_status='running', license_status='ok'. Does NOT require Kinetica DB authentication \u2014 queries the host manager service directly.",
     {},
@@ -3726,17 +3193,17 @@ function buildEvidenceChecklist() {
 
 // src/agent/report-template.ts
 var import_node_fs2 = require("fs");
-var import_node_path3 = require("path");
+var import_node_path2 = require("path");
 
 // src/agent/load-playbooks.ts
-var import_promises2 = require("fs/promises");
-var import_node_path2 = require("path");
+var import_promises = require("fs/promises");
+var import_node_path = require("path");
 var import_node_fs = require("fs");
 function findPackageRoot(startDir) {
   let dir = startDir;
-  while (dir !== (0, import_node_path2.dirname)(dir)) {
-    if ((0, import_node_fs.existsSync)((0, import_node_path2.join)(dir, "package.json"))) return dir;
-    dir = (0, import_node_path2.dirname)(dir);
+  while (dir !== (0, import_node_path.dirname)(dir)) {
+    if ((0, import_node_fs.existsSync)((0, import_node_path.join)(dir, "package.json"))) return dir;
+    dir = (0, import_node_path.dirname)(dir);
   }
   return startDir;
 }
@@ -3769,13 +3236,13 @@ function extractBody(raw) {
 }
 async function loadPlaybooks(playbooksDir) {
   try {
-    const dir = playbooksDir ?? (0, import_node_path2.join)(findPackageRoot(__dirname), "knowledge", "playbooks");
+    const dir = playbooksDir ?? (0, import_node_path.join)(findPackageRoot(__dirname), "knowledge", "playbooks");
     if (!(0, import_node_fs.existsSync)(dir)) return [];
-    const files = await (0, import_promises2.readdir)(dir);
+    const files = await (0, import_promises.readdir)(dir);
     const mdFiles = files.filter((f) => f.endsWith(".md")).sort();
     const playbooks = [];
     for (const file of mdFiles) {
-      const raw = await (0, import_promises2.readFile)((0, import_node_path2.join)(dir, file), "utf-8");
+      const raw = await (0, import_promises.readFile)((0, import_node_path.join)(dir, file), "utf-8");
       const frontmatter = parseFrontmatter(raw);
       if (!frontmatter) continue;
       playbooks.push({
@@ -3794,7 +3261,7 @@ async function loadPlaybooks(playbooksDir) {
 function loadReportTemplateSync() {
   try {
     const root = findPackageRoot(__dirname);
-    const path2 = (0, import_node_path3.join)(root, "knowledge", "templates", "report.md");
+    const path2 = (0, import_node_path2.join)(root, "knowledge", "templates", "report.md");
     return (0, import_node_fs2.readFileSync)(path2, "utf-8");
   } catch (err) {
     console.warn(`[report-template] failed to load knowledge/templates/report.md: ${String(err)}`);
@@ -4083,6 +3550,13 @@ Monitor your context window usage during long investigations:
 - If you detect that context is getting full (many rounds, many large tool responses), warn the operator: "The session context is getting long. Consider starting a fresh session after this report to maintain investigation quality. Your reports are saved to disk."
 - Do NOT continue investigating when context is too full \u2014 write the report with evidence gathered so far.
 
+## Budget & Length Awareness
+
+The session has a per-session budget guard that can end the run before you finish \u2014 and the operator may see a warning that you are "approaching the budget guard". To make sure a diagnostic always survives an early cutoff:
+- During a long or expensive investigation (many rounds or many large tool responses), proactively call \`save_report\` with \`partial: true\` to checkpoint your findings so far. A partial report is far better than none.
+- If the operator warns you that the budget guard is approaching, STOP gathering new evidence: immediately save a \`partial: true\` report with the evidence you have, state your best current hypothesis, and wind down the turn.
+- Treat the guard as a normal limit, not an error \u2014 never apologize for it; just preserve the work.
+
 ---
 
 ## Output Formatting
@@ -4165,18 +3639,18 @@ async function discoverCatalogSchemas(session2) {
 }
 
 // src/agent/load-references.ts
-var import_promises3 = require("fs/promises");
-var import_node_path4 = require("path");
+var import_promises2 = require("fs/promises");
+var import_node_path3 = require("path");
 var import_node_fs3 = require("fs");
 async function loadReferences(refsDir) {
   try {
-    const dir = refsDir ?? (0, import_node_path4.join)(findPackageRoot(__dirname), "knowledge", "references");
+    const dir = refsDir ?? (0, import_node_path3.join)(findPackageRoot(__dirname), "knowledge", "references");
     if (!(0, import_node_fs3.existsSync)(dir)) return [];
-    const files = await (0, import_promises3.readdir)(dir);
+    const files = await (0, import_promises2.readdir)(dir);
     const mdFiles = files.filter((f) => f.endsWith(".md")).sort();
     const references = [];
     for (const file of mdFiles) {
-      const raw = await (0, import_promises3.readFile)((0, import_node_path4.join)(dir, file), "utf-8");
+      const raw = await (0, import_promises2.readFile)((0, import_node_path3.join)(dir, file), "utf-8");
       const frontmatter = parseFrontmatter(raw);
       if (!frontmatter) continue;
       references.push({
@@ -4187,669 +3661,1367 @@ async function loadReferences(refsDir) {
         filename: file
       });
     }
-    return references;
-  } catch {
-    return [];
+    return references;
+  } catch {
+    return [];
+  }
+}
+
+// src/agent/prompt-budget.ts
+var CHARS_PER_TOKEN = 4;
+var DEFAULT_PROMPT_BUDGET_TOKENS = 2e4;
+function estimateTokens(text) {
+  if (!text) return 0;
+  return Math.ceil(text.length / CHARS_PER_TOKEN);
+}
+function checkPromptBudget(prompt, opts) {
+  const threshold = opts?.warnAtTokens ?? DEFAULT_PROMPT_BUDGET_TOKENS;
+  const tokens = estimateTokens(prompt);
+  return {
+    tokens,
+    chars: prompt ? prompt.length : 0,
+    threshold,
+    overBudget: tokens > threshold
+  };
+}
+
+// src/agent/session-budget.ts
+var DEFAULT_MAX_BUDGET_USD = 5;
+var DEFAULT_WARN_FRACTION = 0.8;
+var BUDGET_ENV_VAR = "ADMIN_AGENT_MAX_BUDGET";
+var MODEL_PRICING = {
+  sonnet: { inputPerMTok: 3, outputPerMTok: 15, cacheReadPerMTok: 0.3, cacheCreationPerMTok: 3.75 },
+  haiku: { inputPerMTok: 1, outputPerMTok: 5, cacheReadPerMTok: 0.1, cacheCreationPerMTok: 1.25 },
+  opus: { inputPerMTok: 15, outputPerMTok: 75, cacheReadPerMTok: 1.5, cacheCreationPerMTok: 18.75 }
+};
+function fromSdkUsage(raw) {
+  const u = raw ?? {};
+  return {
+    inputTokens: u.input_tokens,
+    outputTokens: u.output_tokens,
+    cacheReadInputTokens: u.cache_read_input_tokens,
+    cacheCreationInputTokens: u.cache_creation_input_tokens
+  };
+}
+function safeCount(value) {
+  return typeof value === "number" && Number.isFinite(value) && value > 0 ? value : 0;
+}
+function isValidBudget(value) {
+  return typeof value === "number" && Number.isFinite(value) && value > 0;
+}
+function estimateTurnCostUsd(usage, model) {
+  if (!usage) return 0;
+  const price = MODEL_PRICING[model];
+  const input5 = safeCount(usage.inputTokens);
+  const output = safeCount(usage.outputTokens);
+  const cacheRead = safeCount(usage.cacheReadInputTokens);
+  const cacheCreation = safeCount(usage.cacheCreationInputTokens);
+  return (input5 * price.inputPerMTok + output * price.outputPerMTok + cacheRead * price.cacheReadPerMTok + cacheCreation * price.cacheCreationPerMTok) / 1e6;
+}
+function resolveMaxBudgetUsd(flagValue, env = process.env) {
+  if (isValidBudget(flagValue)) return flagValue;
+  const raw = env[BUDGET_ENV_VAR];
+  if (raw !== void 0 && raw !== "") {
+    const parsed = Number(raw);
+    if (isValidBudget(parsed)) return parsed;
+  }
+  return DEFAULT_MAX_BUDGET_USD;
+}
+function createBudgetTracker(opts) {
+  const warnFraction = opts.warnFraction ?? DEFAULT_WARN_FRACTION;
+  const warnAt = opts.maxUsd * warnFraction;
+  let spent = 0;
+  let warned = false;
+  return {
+    add(usage, model) {
+      spent += estimateTurnCostUsd(usage, model);
+    },
+    spentUsd() {
+      return spent;
+    },
+    shouldWarn() {
+      return !warned && spent > warnAt;
+    },
+    markWarned() {
+      warned = true;
+    }
+  };
+}
+
+// src/report/save-report.ts
+var import_promises3 = require("fs/promises");
+var import_node_path4 = require("path");
+var import_claude_agent_sdk3 = require("@anthropic-ai/claude-agent-sdk");
+var import_zod17 = require("zod");
+var PARTIAL_MARKER = "(PARTIAL -- investigation interrupted)\n\n";
+function formatTimestamp(date) {
+  const year = date.getUTCFullYear();
+  const month = String(date.getUTCMonth() + 1).padStart(2, "0");
+  const day = String(date.getUTCDate()).padStart(2, "0");
+  const hours = String(date.getUTCHours()).padStart(2, "0");
+  const minutes = String(date.getUTCMinutes()).padStart(2, "0");
+  const seconds = String(date.getUTCSeconds()).padStart(2, "0");
+  return `${year}-${month}-${day}-${hours}${minutes}${seconds}`;
+}
+function makeSaveReportTool() {
+  return (0, import_claude_agent_sdk3.tool)(
+    "save_report",
+    "Save a diagnostic report to disk. Automatically scrubs credentials, creates a timestamped filename in reports/, and auto-creates the directory. Use at the end of each investigation or when interrupted.",
+    {
+      content: import_zod17.z.string().describe("The full markdown diagnostic report content"),
+      partial: import_zod17.z.boolean().optional().describe(
+        "Set to true if the investigation was interrupted (e.g., Ctrl+C). Prepends a PARTIAL marker to the report."
+      )
+    },
+    async (args) => {
+      const rawContent = args.partial ? `${PARTIAL_MARKER}${args.content}` : args.content;
+      const scrubbed = scrubCredentials(rawContent);
+      const timestamp = formatTimestamp(/* @__PURE__ */ new Date());
+      const filename = `kinetica-diag-${timestamp}.md`;
+      const dir = (0, import_node_path4.resolve)(process.cwd(), "reports");
+      await (0, import_promises3.mkdir)(dir, { recursive: true });
+      const filepath = (0, import_node_path4.join)(dir, filename);
+      await (0, import_promises3.writeFile)(filepath, scrubbed, "utf-8");
+      return {
+        content: [{ type: "text", text: `Report saved: ${filepath}` }]
+      };
+    },
+    { annotations: { readOnly: true } }
+  );
+}
+
+// src/approval/gate.ts
+var import_prompts3 = require("@inquirer/prompts");
+
+// src/approval/display.ts
+var import_picocolors5 = __toESM(require("picocolors"));
+var IMPACT_FALLBACK = "Impact unknown \u2014 review parameters carefully";
+var DIVIDER2 = import_picocolors5.default.dim("\u2500".repeat(50));
+var LABEL_WIDTH = 8;
+function formatLabel(label) {
+  return `  ${label.padEnd(LABEL_WIDTH)}: `;
+}
+function renderApprovalPanel(toolName, toolInput, impact, beforeAfter, reasoningSummary) {
+  const header = import_picocolors5.default.bold(import_picocolors5.default.yellow("  Mutation Approval Required"));
+  const action = `${formatLabel("Action")}${import_picocolors5.default.bold(formatToolName(toolName))}`;
+  const paramEntries = Object.entries(toolInput);
+  const paramSection = paramEntries.length === 0 ? "  (no parameters)" : paramEntries.map(([key, value]) => {
+    const formatted = typeof value === "string" ? value : JSON.stringify(value, null, 2);
+    return `  ${import_picocolors5.default.dim(key)}: ${formatted}`;
+  }).join("\n");
+  const impactLine = `${formatLabel("Impact")}${impact ?? IMPACT_FALLBACK}`;
+  const prompt = import_picocolors5.default.dim(
+    `${formatLabel("Respond")}y (proceed) | n (abort) | explain (show reasoning)`
+  );
+  const hasBeforeAfter = beforeAfter !== void 0 && beforeAfter.length > 0;
+  const beforeAfterSection = hasBeforeAfter ? beforeAfter.map(
+    (entry) => `  ${import_picocolors5.default.dim(entry.key)}: ${entry.current} ${import_picocolors5.default.yellow("->")} ${entry.proposed}`
+  ).join("\n") : null;
+  const hasReasoning = reasoningSummary !== void 0 && reasoningSummary.length > 0;
+  const reasoningSection = hasReasoning ? `${formatLabel("Reason")}${reasoningSummary}` : null;
+  const sections = ["", DIVIDER2, header, "", action, paramSection, ""];
+  if (beforeAfterSection !== null) {
+    sections.push(beforeAfterSection, "");
+  }
+  if (reasoningSection !== null) {
+    sections.push(reasoningSection, "");
+  }
+  sections.push(impactLine, "", prompt, DIVIDER2, "");
+  return sections.join("\n");
+}
+
+// src/approval/gate.ts
+var DENY_MESSAGE = "User denied this mutation. Skip and continue with the investigation.";
+var REASONING_FALLBACK = "Reasoning not available. Review the action details above before proceeding.";
+function createApprovalGate(isReadOnly) {
+  return async (toolName, toolInput, options) => {
+    if (isReadOnly(toolName)) {
+      return {
+        behavior: "allow",
+        updatedInput: toolInput,
+        toolUseID: options.toolUseID
+      };
+    }
+    const impact = options.decisionReason;
+    const panel = renderApprovalPanel(toolName, toolInput, impact);
+    console.error(panel);
+    while (true) {
+      try {
+        const raw = await (0, import_prompts3.input)({ message: "Proceed? (y/n/explain):" }, { signal: options.signal });
+        const normalized = raw.trim().toLowerCase();
+        if (normalized === "y") {
+          process.stderr.write("\n");
+          return {
+            behavior: "allow",
+            updatedInput: toolInput,
+            toolUseID: options.toolUseID
+          };
+        }
+        if (normalized === "n") {
+          process.stderr.write("\n");
+          return {
+            behavior: "deny",
+            message: DENY_MESSAGE,
+            toolUseID: options.toolUseID
+          };
+        }
+        if (normalized === "explain") {
+          const reasoning = options.decisionReason;
+          if (reasoning) {
+            console.error(`
+Agent reasoning: ${reasoning}
+`);
+          } else {
+            console.error(`
+${REASONING_FALLBACK}
+`);
+          }
+        }
+      } catch {
+        return {
+          behavior: "deny",
+          message: DENY_MESSAGE,
+          toolUseID: options.toolUseID
+        };
+      }
+    }
+  };
+}
+
+// src/agent/turn-gate.ts
+function createTurnGate() {
+  let resolve2 = () => {
+  };
+  let promise = new Promise((r) => {
+    resolve2 = r;
+  });
+  return Object.freeze({
+    wait: () => promise,
+    open: () => {
+      resolve2();
+    },
+    close: () => {
+      promise = new Promise((r) => {
+        resolve2 = r;
+      });
+    }
+  });
+}
+
+// src/output/render-markdown.ts
+var import_picocolors6 = __toESM(require("picocolors"));
+var BOLD_RE = /\*\*(.+?)\*\*/g;
+var HEADING_RE = /^(#{1,6})\s+(.+)$/;
+function renderMarkdownLine(line) {
+  const headingMatch = HEADING_RE.exec(line);
+  if (headingMatch) {
+    return import_picocolors6.default.bold(headingMatch[2]);
+  }
+  if (line.includes("**")) {
+    return line.replace(BOLD_RE, (_, text) => import_picocolors6.default.bold(text));
+  }
+  return line;
+}
+
+// src/output/reformat-tables.ts
+var SEPARATOR_CELL_RE = /^:?-+:?$/;
+var BOLD_MARKERS_RE = /\*\*(.+?)\*\*/g;
+function visualWidth(text) {
+  return text.replace(BOLD_MARKERS_RE, "$1").length;
+}
+function isSeparatorCell(cell) {
+  return SEPARATOR_CELL_RE.test(cell);
+}
+function isSeparatorRow(cells) {
+  return cells.length > 0 && cells.every(isSeparatorCell);
+}
+function parseCells(line) {
+  return line.split("|").slice(1, -1).map((c) => c.trim());
+}
+function reformatTableBlock(lines) {
+  const parsed = lines.map(parseCells);
+  const colCount = Math.max(...parsed.map((row) => row.length));
+  const normalised = parsed.map((row) => {
+    const padded = [...row];
+    while (padded.length < colCount) {
+      padded.push("");
+    }
+    return padded;
+  });
+  const colWidths = Array.from(
+    { length: colCount },
+    (_, col) => Math.max(
+      3,
+      ...normalised.filter((row) => !isSeparatorRow(row)).map((row) => visualWidth(row[col]))
+    )
+  );
+  const borderRow = `+${colWidths.map((w) => "-".repeat(w + 2)).join("+")}+`;
+  const bodyRows = normalised.map((row) => {
+    if (isSeparatorRow(row)) {
+      return borderRow;
+    }
+    const cells = row.map((cell, col) => {
+      const rendered = renderMarkdownLine(cell);
+      const pad = colWidths[col] - visualWidth(cell);
+      return rendered + " ".repeat(Math.max(0, pad));
+    });
+    return `| ${cells.join(" | ")} |`;
+  });
+  return [borderRow, ...bodyRows, borderRow];
+}
+
+// src/output/streaming-table-aligner.ts
+var TABLE_LINE_RE = /^\|.*\|$/;
+function createStreamingTableAligner() {
+  let lineBuffer = "";
+  let tableLines = [];
+  function flushTable() {
+    if (tableLines.length === 0) return "";
+    const aligned = reformatTableBlock(tableLines);
+    tableLines = [];
+    return aligned.join("\n") + "\n";
+  }
+  function push(text) {
+    if (!text) return "";
+    const combined = lineBuffer + text;
+    const segments = combined.split("\n");
+    lineBuffer = segments[segments.length - 1];
+    const completeLines = segments.slice(0, -1);
+    let output = "";
+    for (const line of completeLines) {
+      const trimmed = line.trim();
+      if (TABLE_LINE_RE.test(trimmed)) {
+        tableLines.push(trimmed);
+      } else {
+        output += flushTable();
+        output += renderMarkdownLine(line) + "\n";
+      }
+    }
+    return output;
+  }
+  function flush() {
+    let output = flushTable();
+    if (lineBuffer) {
+      output += renderMarkdownLine(lineBuffer);
+      lineBuffer = "";
+    }
+    return output;
+  }
+  return Object.freeze({ push, flush });
+}
+
+// src/output/spinner.ts
+var import_picocolors7 = __toESM(require("picocolors"));
+var FRAMES = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
+var FRAME_INTERVAL_MS = 80;
+var DEFAULT_LABEL = "Thinking";
+function createSpinner() {
+  let timer = null;
+  let frameIndex = 0;
+  const start = (label = DEFAULT_LABEL) => {
+    if (timer !== null) return;
+    frameIndex = 0;
+    timer = setInterval(() => {
+      const frame = FRAMES[frameIndex % FRAMES.length];
+      process.stderr.write(`\r${import_picocolors7.default.dim(`${frame} ${label}...`)}`);
+      frameIndex += 1;
+    }, FRAME_INTERVAL_MS);
+    timer.unref();
+  };
+  const stop = () => {
+    if (timer === null) return;
+    clearInterval(timer);
+    timer = null;
+    process.stderr.write("\r\x1B[K");
+  };
+  const isRunning = () => timer !== null;
+  return Object.freeze({ start, stop, isRunning });
+}
+
+// src/agent/run-agent.ts
+var MCP_SERVER_NAME = "kinetica-diagnostics";
+var SAVE_REPORT_TOOL_NAME = `mcp__${MCP_SERVER_NAME}__save_report`;
+function contentCallsSaveReport(content) {
+  if (!Array.isArray(content)) return false;
+  return content.some((block) => {
+    if (typeof block !== "object" || block === null) return false;
+    const { type, name } = block;
+    return type === "tool_use" && name === SAVE_REPORT_TOOL_NAME;
+  });
+}
+function formatCostSuffix(costUsd) {
+  return costUsd !== void 0 && costUsd > 0 ? ` Cost: $${costUsd.toFixed(4)}.` : "";
+}
+function formatMetricsLine(turns, durationMs, durationApiMs, costUsd) {
+  const durationSec = Math.round(durationMs / 1e3);
+  const apiPct = durationMs > 0 ? Math.round(durationApiMs / durationMs * 100) : 0;
+  return `Turns: ${turns}. Duration: ${durationSec}s (${apiPct}% API).${formatCostSuffix(costUsd)}`;
+}
+var EXIT_COMMANDS = /* @__PURE__ */ new Set(["exit", "quit", "end", "q"]);
+var SUPPORTED_MODELS = ["sonnet", "haiku", "opus"];
+var DEFAULT_AGENT_MODEL = "sonnet";
+var ALLOWED_TOOL_NAMES = [
+  ...DIAGNOSTIC_TOOL_NAMES.map((name) => `mcp__${MCP_SERVER_NAME}__${name}`),
+  SAVE_REPORT_TOOL_NAME,
+  `mcp__${MCP_SERVER_NAME}__${ALTER_TABLE_COLUMNS_TOOL_NAME}`
+];
+var DISALLOWED_TOOLS = ["Bash", "Edit", "Write", "MultiEdit"];
+var ERROR_LABELS = {
+  authentication_failed: "Authentication failed \u2014 check your API key or re-run with --login",
+  billing_error: "Billing error \u2014 check your Anthropic account",
+  rate_limit: "Rate limit exceeded",
+  server_error: "Anthropic API server error",
+  invalid_request: "Invalid API request",
+  max_output_tokens: "Response exceeded maximum output length",
+  unknown: "Unknown API error"
+};
+function isExitCommand(text) {
+  return EXIT_COMMANDS.has(text.trim().toLowerCase());
+}
+function makeUserMessage(content) {
+  return {
+    type: "user",
+    message: { role: "user", content },
+    parent_tool_use_id: null,
+    session_id: ""
+  };
+}
+async function* makeInteractivePrompt(abortController, turnGate, spinner) {
+  while (!abortController.signal.aborted) {
+    try {
+      process.stderr.write("\n");
+      const issue = await (0, import_prompts4.input)({ message: "Describe the issue to investigate:" });
+      process.stderr.write("\n");
+      const trimmed = issue.trim();
+      if (!trimmed) continue;
+      if (isExitCommand(trimmed)) return;
+      spinner.start();
+      yield makeUserMessage(trimmed);
+      break;
+    } catch {
+      return;
+    }
+  }
+  while (!abortController.signal.aborted) {
+    try {
+      await turnGate.wait();
+      if (abortController.signal.aborted) break;
+      process.stderr.write("\n");
+      const response = await (0, import_prompts4.input)({ message: "You:" });
+      process.stderr.write("\n");
+      const trimmed = response.trim();
+      if (!trimmed) continue;
+      if (isExitCommand(trimmed)) return;
+      turnGate.close();
+      spinner.start();
+      yield makeUserMessage(trimmed);
+    } catch {
+      return;
+    }
+  }
+}
+async function displayDegradedStatus(session2) {
+  const [statusResult, alertsResult] = await Promise.all([
+    hostManagerStatus(session2),
+    hostManagerAlerts(session2)
+  ]);
+  process.stderr.write(import_picocolors8.default.bold("\u2500\u2500 Host Manager Status \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n"));
+  if (statusResult.ok) {
+    const rows = statusResult.data;
+    const maxKeyLen = rows.reduce((max, r) => Math.max(max, r.key.length), 0);
+    for (const row of rows) {
+      process.stderr.write(`  ${import_picocolors8.default.dim(row.key.padEnd(maxKeyLen))}  ${row.value}
+`);
+    }
+  } else {
+    process.stderr.write(`  ${import_picocolors8.default.red(`Error: ${statusResult.error}`)}
+`);
+  }
+  process.stderr.write("\n");
+  process.stderr.write(import_picocolors8.default.bold("\u2500\u2500 Recent Alerts \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n"));
+  if (alertsResult.ok) {
+    const alerts = alertsResult.data;
+    if (alerts.length === 0) {
+      process.stderr.write(`  ${import_picocolors8.default.dim("No recent alerts.")}
+`);
+    } else {
+      for (const alert of alerts) {
+        process.stderr.write(`  ${import_picocolors8.default.dim(alert.timestamp)}  ${alert.type}  ${alert.params}
+`);
+      }
+    }
+  } else {
+    process.stderr.write(`  ${import_picocolors8.default.dim(`Unavailable: ${alertsResult.error}`)}
+`);
+  }
+  process.stderr.write("\n");
+}
+async function runAgent(session2, kineticaVersion, degraded, model, runOptions) {
+  const authMethod = runOptions?.authMethod ?? "api_key";
+  const dollarCapped = authMethod === "api_key";
+  const resolvedBudgetUsd = runOptions?.maxBudgetUsd ?? DEFAULT_MAX_BUDGET_USD;
+  const [catalogSchemas, playbooks, references] = await Promise.all([
+    degraded ? Promise.resolve(void 0) : discoverCatalogSchemas(session2),
+    loadPlaybooks(),
+    loadReferences()
+  ]);
+  const systemPrompt = buildSystemPrompt(
+    kineticaVersion,
+    catalogSchemas,
+    playbooks,
+    references,
+    degraded
+  );
+  const budget = checkPromptBudget(systemPrompt);
+  if (process.env.DEBUG) {
+    process.stderr.write(
+      import_picocolors8.default.dim(`System prompt: ~${budget.tokens} tokens (${budget.chars} chars)
+`)
+    );
+  }
+  if (budget.overBudget) {
+    process.stderr.write(
+      import_picocolors8.default.yellow(
+        `\u26A0 system prompt is ~${budget.tokens} tokens (threshold ${budget.threshold}) \u2014 knowledge corpus is getting expensive; consider keyword-based playbook selection.
+`
+      )
+    );
+  }
+  const diagnosticTools = makeDiagnosticTools(session2, catalogSchemas);
+  const mutationTools = makeMutationTools(session2);
+  const saveReportTool = makeSaveReportTool();
+  const alterTableColumnsTool = makeAlterTableColumnsToolWithDeps(session2);
+  const server = (0, import_claude_agent_sdk4.createSdkMcpServer)({
+    name: MCP_SERVER_NAME,
+    version: "1.0.0",
+    tools: [...diagnosticTools, ...mutationTools, saveReportTool, alterTableColumnsTool]
+  });
+  const spinner = createSpinner();
+  const registry = createDiagnosticRegistry();
+  const approvalGate = createApprovalGate(registry.isReadOnlyTool);
+  const canUseTool = async (toolName, toolInput, options2) => {
+    spinner.stop();
+    return approvalGate(toolName, toolInput, options2);
+  };
+  const abortController = new AbortController();
+  const effectiveModel = model ?? DEFAULT_AGENT_MODEL;
+  const options = {
+    mcpServers: { [MCP_SERVER_NAME]: server },
+    allowedTools: ALLOWED_TOOL_NAMES,
+    disallowedTools: [...DISALLOWED_TOOLS],
+    canUseTool,
+    systemPrompt,
+    model: effectiveModel,
+    fallbackModel: "haiku",
+    thinking: { type: "adaptive" },
+    maxTurns: 100,
+    // Only impose a dollar cap for per-token billing. For OAuth subscription users
+    // the SDK would otherwise cut them off at a notional dollar figure they never pay;
+    // omitting it leaves the turn limit (maxTurns) as their guard.
+    ...dollarCapped ? { maxBudgetUsd: resolvedBudgetUsd } : {},
+    persistSession: false,
+    includePartialMessages: true,
+    abortController,
+    env: { ...process.env, CLAUDE_AGENT_SDK_CLIENT_APP: "admin-agent" }
+  };
+  const guardLine = dollarCapped ? import_picocolors8.default.dim(`Budget guard: $${resolvedBudgetUsd.toFixed(2)} (raise with --max-budget)
+`) : import_picocolors8.default.dim("Budget guard: subscription (Pro/Max) \u2014 turn-limited\n");
+  if (degraded) {
+    process.stderr.write("\nKinetica Diagnostic Session Ready (DEGRADED MODE)\n");
+    process.stderr.write(
+      "DB engine (port 9191) is unreachable. Only host manager tools are available.\n\n"
+    );
+    await displayDegradedStatus(session2);
+  } else {
+    process.stderr.write("\nKinetica Diagnostic Session Ready\n");
+  }
+  process.stderr.write(guardLine);
+  process.stderr.write("Type 'exit' to end the session.\n\n");
+  const turnGate = createTurnGate();
+  const agentQuery = (0, import_claude_agent_sdk4.query)({
+    prompt: makeInteractivePrompt(abortController, turnGate, spinner),
+    options
+  });
+  process.once("SIGINT", () => {
+    spinner.stop();
+    process.stderr.write("\nInterrupted \u2014 aborting investigation...\n");
+    abortController.abort();
+    agentQuery.close();
+  });
+  let numTurns = 0;
+  let totalCostUsd = 0;
+  let durationMs = 0;
+  let durationApiMs = 0;
+  let cacheReadTokens = 0;
+  let cacheCreationTokens = 0;
+  let lastStreamCharWasNewline = true;
+  const tableAligner = createStreamingTableAligner();
+  let hadNonAbortError = false;
+  let reportSavedThisRun = false;
+  let invBase = { turns: 0, duration: 0, api: 0, cost: 0 };
+  const budgetTracker = dollarCapped ? createBudgetTracker({ maxUsd: resolvedBudgetUsd }) : void 0;
+  try {
+    for await (const message of agentQuery) {
+      if (message.type === "stream_event") {
+        const { event: evt } = message;
+        if (evt.type === "content_block_delta" && evt.delta.type === "text_delta") {
+          const text = evt.delta.text ?? "";
+          if (text) {
+            spinner.stop();
+            const output = tableAligner.push(text);
+            if (output) {
+              process.stderr.write(output);
+              lastStreamCharWasNewline = output.endsWith("\n");
+            }
+          }
+        }
+      } else if (message.type === "assistant") {
+        const assistantMsg = message;
+        const remaining = tableAligner.flush();
+        if (remaining) {
+          process.stderr.write(remaining);
+          lastStreamCharWasNewline = remaining.endsWith("\n");
+        }
+        if (!lastStreamCharWasNewline) {
+          process.stderr.write("\n");
+          lastStreamCharWasNewline = true;
+        }
+        if (budgetTracker) {
+          budgetTracker.add(fromSdkUsage(assistantMsg.message.usage), effectiveModel);
+          if (budgetTracker.shouldWarn()) {
+            spinner.stop();
+            process.stderr.write(
+              import_picocolors8.default.yellow(
+                `
+\u26A0 Approaching budget guard (~$${budgetTracker.spentUsd().toFixed(2)} / $${resolvedBudgetUsd.toFixed(2)}) \u2014 wrapping up soon. Save a partial report now if you want to preserve findings.
+`
+              )
+            );
+            budgetTracker.markWarned();
+          }
+        }
+        if (contentCallsSaveReport(assistantMsg.message.content)) {
+          reportSavedThisRun = true;
+        }
+        if (assistantMsg.message.stop_reason === "end_turn") {
+          spinner.stop();
+          turnGate.open();
+        } else if (assistantMsg.message.stop_reason === "tool_use") {
+          spinner.start("Investigating");
+        } else {
+          spinner.stop();
+        }
+        if (assistantMsg.error) {
+          spinner.stop();
+          const label = ERROR_LABELS[assistantMsg.error] ?? assistantMsg.error;
+          process.stderr.write(import_picocolors8.default.yellow(`
+API error: ${label}
+`));
+          turnGate.open();
+        }
+      } else if (message.type === "result") {
+        spinner.stop();
+        const resultMsg = message;
+        numTurns = resultMsg.num_turns;
+        totalCostUsd = resultMsg.total_cost_usd;
+        durationMs = resultMsg.duration_ms;
+        durationApiMs = resultMsg.duration_api_ms;
+        const usages = Object.values(resultMsg.modelUsage ?? {});
+        cacheReadTokens = usages.reduce((sum, u) => sum + (u.cacheReadInputTokens ?? 0), 0);
+        cacheCreationTokens = usages.reduce((sum, u) => sum + (u.cacheCreationInputTokens ?? 0), 0);
+        if (resultMsg.subtype === "error_max_turns") {
+          process.stderr.write(
+            import_picocolors8.default.yellow(
+              `
+Reached the turn limit (${numTurns} turns) \u2014 a safety guard, not an error. Any report the agent saved is in reports/. Start a fresh session to continue.
+`
+            )
+          );
+        } else if (resultMsg.subtype === "error_max_budget_usd") {
+          const spentStr = totalCostUsd > 0 ? ` ($${totalCostUsd.toFixed(2)} spent)` : "";
+          process.stderr.write(
+            import_picocolors8.default.yellow(
+              `
+Reached the $${resolvedBudgetUsd.toFixed(2)} budget guard${spentStr} \u2014 a safety limit, not an error. Re-run with --max-budget=<amount> (or set ADMIN_AGENT_MAX_BUDGET) for more headroom. Any report the agent saved is in reports/.
+`
+            )
+          );
+        } else if (resultMsg.subtype === "error_during_execution") {
+          process.stderr.write(
+            "\nExecution error \u2014 the agent encountered an unrecoverable failure.\n"
+          );
+        } else if (resultMsg.subtype !== "success") {
+          process.stderr.write(`
+Agent session ended with error: ${resultMsg.subtype}
+`);
+        }
+        if (resultMsg.permission_denials.length > 0) {
+          const denied = resultMsg.permission_denials.map((d) => d.tool_name).join(", ");
+          process.stderr.write(`
+Permission denials: ${denied}
+`);
+        }
+        if (reportSavedThisRun) {
+          const line = formatMetricsLine(
+            numTurns - invBase.turns,
+            durationMs - invBase.duration,
+            durationApiMs - invBase.api,
+            dollarCapped ? totalCostUsd - invBase.cost : void 0
+          );
+          process.stderr.write(`
+Investigation complete \u2014 ${line}
+`);
+          invBase = {
+            turns: numTurns,
+            duration: durationMs,
+            api: durationApiMs,
+            cost: totalCostUsd
+          };
+          reportSavedThisRun = false;
+        }
+        turnGate.open();
+      } else if (message.type === "system") {
+        const sysMsg = message;
+        if (sysMsg.subtype === "init") {
+          const initMsg = message;
+          const failed = (initMsg.mcp_servers ?? []).filter(
+            (s) => s.name === MCP_SERVER_NAME && s.status !== "connected"
+          );
+          for (const s of failed) {
+            process.stderr.write(
+              `
+Warning: MCP server "${s.name}" failed to connect (${s.status})
+`
+            );
+          }
+        } else if (sysMsg.subtype === "api_retry") {
+          const retryMsg = message;
+          const statusStr = retryMsg.error_status !== null ? ` (HTTP ${retryMsg.error_status})` : "";
+          const delaySec = Math.round(retryMsg.retry_delay_ms / 1e3);
+          process.stderr.write(
+            import_picocolors8.default.yellow(
+              `
+API error${statusStr}. Retrying (attempt ${retryMsg.attempt}/${retryMsg.max_retries}) in ${delaySec}s...
+`
+            )
+          );
+        } else if (sysMsg.subtype === "compact_boundary") {
+          const compactMsg = message;
+          const preTokens = compactMsg.compact_metadata.pre_tokens;
+          process.stderr.write(
+            `
+[Context compressed (${preTokens} tokens before compaction) \u2014 investigation continues]
+`
+          );
+        }
+      } else if (message.type === "rate_limit_event") {
+        const rateMsg = message;
+        const { status, resetsAt } = rateMsg.rate_limit_info;
+        if (status === "rejected") {
+          const resetStr = resetsAt ? ` Resets at ${new Date(resetsAt * 1e3).toISOString()}.` : "";
+          process.stderr.write(`
+Rate limited \u2014 requests rejected.${resetStr}
+`);
+        } else if (status === "allowed_warning") {
+          process.stderr.write("\nApproaching rate limit \u2014 investigation may slow.\n");
+        }
+      } else if (message.type === "control_request") {
+        const controlMsg = message;
+        if (controlMsg.request.subtype === "claude_authenticate") {
+          process.stderr.write(import_picocolors8.default.yellow("\nRe-authentication requested by SDK...\n"));
+        }
+      }
+    }
+  } catch (error) {
+    spinner.stop();
+    if (error instanceof import_claude_agent_sdk4.AbortError) {
+      hadNonAbortError = false;
+    } else {
+      hadNonAbortError = true;
+      const message = error instanceof Error ? error.message : String(error);
+      process.stderr.write(import_picocolors8.default.red(`
+Agent error: ${message}
+`));
+    }
+  } finally {
+    spinner.stop();
+    const remaining = tableAligner.flush();
+    if (remaining) {
+      process.stderr.write(remaining);
+    }
+    turnGate.open();
+    const sessionCost = dollarCapped ? totalCostUsd : void 0;
+    if (process.env.DEBUG && (cacheReadTokens > 0 || cacheCreationTokens > 0)) {
+      process.stderr.write(
+        import_picocolors8.default.dim(
+          `Cache: ${cacheReadTokens} read / ${cacheCreationTokens} created input tokens (read > 0 confirms the system prompt is served from cache)
+`
+        )
+      );
+    }
+    if (hadNonAbortError) {
+      process.stderr.write(
+        `
+Session ended due to error. Turns: ${numTurns}.${formatCostSuffix(sessionCost)}
+`
+      );
+    } else {
+      const line = formatMetricsLine(numTurns, durationMs, durationApiMs, sessionCost);
+      process.stderr.write(`
+Session ended. ${line}
+`);
+    }
   }
 }
 
-// src/agent/prompt-budget.ts
-var CHARS_PER_TOKEN = 4;
-var DEFAULT_PROMPT_BUDGET_TOKENS = 15e3;
-function estimateTokens(text) {
-  if (!text) return 0;
-  return Math.ceil(text.length / CHARS_PER_TOKEN);
-}
-function checkPromptBudget(prompt, opts) {
-  const threshold = opts?.warnAtTokens ?? DEFAULT_PROMPT_BUDGET_TOKENS;
-  const tokens = estimateTokens(prompt);
-  return {
-    tokens,
-    chars: prompt ? prompt.length : 0,
-    threshold,
-    overBudget: tokens > threshold
-  };
+// src/cli/select-model.ts
+var MODEL_LABELS = {
+  sonnet: "Sonnet \u2014 balanced, best general coding (default)",
+  haiku: "Haiku \u2014 fastest & cheapest, lighter reasoning",
+  opus: "Opus \u2014 deepest reasoning, slower & pricier"
+};
+async function selectModel() {
+  return (0, import_prompts5.select)({
+    message: "Select model for this session:",
+    default: DEFAULT_AGENT_MODEL,
+    choices: SUPPORTED_MODELS.map((value) => ({ value, name: MODEL_LABELS[value] }))
+  });
 }
 
-// src/report/save-report.ts
-var import_promises4 = require("fs/promises");
-var import_node_path5 = require("path");
-var import_claude_agent_sdk4 = require("@anthropic-ai/claude-agent-sdk");
-var import_zod17 = require("zod");
-var PARTIAL_MARKER = "(PARTIAL -- investigation interrupted)\n\n";
-function formatTimestamp(date) {
-  const year = date.getUTCFullYear();
-  const month = String(date.getUTCMonth() + 1).padStart(2, "0");
-  const day = String(date.getUTCDate()).padStart(2, "0");
-  const hours = String(date.getUTCHours()).padStart(2, "0");
-  const minutes = String(date.getUTCMinutes()).padStart(2, "0");
-  const seconds = String(date.getUTCSeconds()).padStart(2, "0");
-  return `${year}-${month}-${day}-${hours}${minutes}${seconds}`;
-}
-function makeSaveReportTool() {
-  return (0, import_claude_agent_sdk4.tool)(
-    "save_report",
-    "Save a diagnostic report to disk. Automatically scrubs credentials, creates a timestamped filename in reports/, and auto-creates the directory. Use at the end of each investigation or when interrupted.",
-    {
-      content: import_zod17.z.string().describe("The full markdown diagnostic report content"),
-      partial: import_zod17.z.boolean().optional().describe(
-        "Set to true if the investigation was interrupted (e.g., Ctrl+C). Prepends a PARTIAL marker to the report."
-      )
-    },
-    async (args) => {
-      const rawContent = args.partial ? `${PARTIAL_MARKER}${args.content}` : args.content;
-      const scrubbed = scrubCredentials(rawContent);
-      const timestamp = formatTimestamp(/* @__PURE__ */ new Date());
-      const filename = `kinetica-diag-${timestamp}.md`;
-      const dir = (0, import_node_path5.resolve)(process.cwd(), "reports");
-      await (0, import_promises4.mkdir)(dir, { recursive: true });
-      const filepath = (0, import_node_path5.join)(dir, filename);
-      await (0, import_promises4.writeFile)(filepath, scrubbed, "utf-8");
-      return {
-        content: [{ type: "text", text: `Report saved: ${filepath}` }]
-      };
-    },
-    { annotations: { readOnly: true } }
-  );
-}
+// src/auth/preflight.ts
+var import_claude_agent_sdk5 = require("@anthropic-ai/claude-agent-sdk");
 
-// src/approval/gate.ts
-var import_prompts7 = require("@inquirer/prompts");
+// src/auth/oauth-flow.ts
+var import_picocolors9 = __toESM(require("picocolors"));
 
-// src/approval/display.ts
-var import_picocolors10 = __toESM(require("picocolors"));
-var IMPACT_FALLBACK = "Impact unknown \u2014 review parameters carefully";
-var DIVIDER2 = import_picocolors10.default.dim("\u2500".repeat(50));
-var LABEL_WIDTH = 8;
-function formatLabel(label) {
-  return `  ${label.padEnd(LABEL_WIDTH)}: `;
+// src/auth/open-browser.ts
+var import_child_process = require("child_process");
+function openBrowser(url) {
+  try {
+    const platform = process.platform;
+    const { command, args } = platform === "darwin" ? { command: "open", args: [url] } : platform === "win32" ? { command: "cmd", args: ["/c", "start", "", url] } : { command: "xdg-open", args: [url] };
+    const child = (0, import_child_process.spawn)(command, args, { detached: true, stdio: "ignore" });
+    child.unref();
+    return true;
+  } catch {
+    return false;
+  }
 }
-function renderApprovalPanel(toolName, toolInput, impact, beforeAfter, reasoningSummary) {
-  const header = import_picocolors10.default.bold(import_picocolors10.default.yellow("  Mutation Approval Required"));
-  const action = `${formatLabel("Action")}${import_picocolors10.default.bold(formatToolName(toolName))}`;
-  const paramEntries = Object.entries(toolInput);
-  const paramSection = paramEntries.length === 0 ? "  (no parameters)" : paramEntries.map(([key, value]) => {
-    const formatted = typeof value === "string" ? value : JSON.stringify(value, null, 2);
-    return `  ${import_picocolors10.default.dim(key)}: ${formatted}`;
-  }).join("\n");
-  const impactLine = `${formatLabel("Impact")}${impact ?? IMPACT_FALLBACK}`;
-  const prompt = import_picocolors10.default.dim(
-    `${formatLabel("Respond")}y (proceed) | n (abort) | explain (show reasoning)`
-  );
-  const hasBeforeAfter = beforeAfter !== void 0 && beforeAfter.length > 0;
-  const beforeAfterSection = hasBeforeAfter ? beforeAfter.map(
-    (entry) => `  ${import_picocolors10.default.dim(entry.key)}: ${entry.current} ${import_picocolors10.default.yellow("->")} ${entry.proposed}`
-  ).join("\n") : null;
-  const hasReasoning = reasoningSummary !== void 0 && reasoningSummary.length > 0;
-  const reasoningSection = hasReasoning ? `${formatLabel("Reason")}${reasoningSummary}` : null;
-  const sections = ["", DIVIDER2, header, "", action, paramSection, ""];
-  if (beforeAfterSection !== null) {
-    sections.push(beforeAfterSection, "");
+
+// src/auth/oauth-flow.ts
+async function resolveAuthentication(agentQuery, options) {
+  if (options.hasApiKey && !options.forceLogin) {
+    return { method: "api_key" };
   }
-  if (reasoningSection !== null) {
-    sections.push(reasoningSection, "");
+  const query3 = agentQuery;
+  try {
+    const { manualUrl, automaticUrl } = await query3.claudeAuthenticate(options.loginWithClaudeAi);
+    const opened = openBrowser(automaticUrl);
+    if (opened) {
+      process.stderr.write(import_picocolors9.default.dim("Browser opened for login. Waiting for authentication...\n"));
+    } else {
+      process.stderr.write(`
+Open this URL in your browser to log in:
+${import_picocolors9.default.bold(manualUrl)}
+
+`);
+      process.stderr.write(import_picocolors9.default.dim("Waiting for browser login to complete...\n"));
+    }
+    await query3.claudeOAuthWaitForCompletion();
+    return { method: "oauth" };
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    process.stderr.write(
+      import_picocolors9.default.yellow(`
+Warning: OAuth login failed (${message}). SDK may retry automatically.
+`)
+    );
+    return { method: "oauth" };
   }
-  sections.push(impactLine, "", prompt, DIVIDER2, "");
-  return sections.join("\n");
 }
 
-// src/approval/gate.ts
-var DENY_MESSAGE = "User denied this mutation. Skip and continue with the investigation.";
-var REASONING_FALLBACK = "Reasoning not available. Review the action details above before proceeding.";
-function createApprovalGate(isReadOnly) {
-  return async (toolName, toolInput, options) => {
-    if (isReadOnly(toolName)) {
-      return {
-        behavior: "allow",
-        updatedInput: toolInput,
-        toolUseID: options.toolUseID
-      };
+// src/auth/preflight.ts
+var PROBE_TIMEOUT_MS = 1e4;
+async function probeCachedCredentials(authQuery) {
+  try {
+    const info = await Promise.race([
+      authQuery.accountInfo(),
+      new Promise(
+        (_, reject) => setTimeout(() => reject(new Error("Probe timed out")), PROBE_TIMEOUT_MS)
+      )
+    ]);
+    if (info.email || info.apiKeySource) {
+      return info;
     }
-    const impact = options.decisionReason;
-    const panel = renderApprovalPanel(toolName, toolInput, impact);
-    console.error(panel);
-    while (true) {
-      try {
-        const raw = await (0, import_prompts7.input)({ message: "Proceed? (y/n/explain):" }, { signal: options.signal });
-        const normalized = raw.trim().toLowerCase();
-        if (normalized === "y") {
-          process.stderr.write("\n");
-          return {
-            behavior: "allow",
-            updatedInput: toolInput,
-            toolUseID: options.toolUseID
-          };
-        }
-        if (normalized === "n") {
-          process.stderr.write("\n");
-          return {
-            behavior: "deny",
-            message: DENY_MESSAGE,
-            toolUseID: options.toolUseID
-          };
-        }
-        if (normalized === "explain") {
-          const reasoning = options.decisionReason;
-          if (reasoning) {
-            console.error(`
-Agent reasoning: ${reasoning}
-`);
-          } else {
-            console.error(`
-${REASONING_FALLBACK}
-`);
-          }
-        }
-      } catch {
-        return {
-          behavior: "deny",
-          message: DENY_MESSAGE,
-          toolUseID: options.toolUseID
-        };
+    return null;
+  } catch {
+    return null;
+  }
+}
+async function authenticateAnthropic(options) {
+  const hasApiKey = Boolean(process.env.ANTHROPIC_API_KEY);
+  if (hasApiKey && !options.forceLogin) {
+    return { method: "api_key" };
+  }
+  if (!process.stdin.isTTY) {
+    throw new Error(
+      "No ANTHROPIC_API_KEY set and terminal is non-interactive. Set ANTHROPIC_API_KEY or run in an interactive terminal with --login."
+    );
+  }
+  const env = options.forceLogin ? (() => {
+    const { ANTHROPIC_API_KEY: _stripped, ...rest } = process.env;
+    return { ...rest, CLAUDE_AGENT_SDK_CLIENT_APP: "admin-agent" };
+  })() : { ...process.env, CLAUDE_AGENT_SDK_CLIENT_APP: "admin-agent" };
+  const abortController = new AbortController();
+  async function* hangingPrompt() {
+    await new Promise(() => {
+    });
+  }
+  const authQuery = (0, import_claude_agent_sdk5.query)({
+    prompt: hangingPrompt(),
+    options: {
+      persistSession: false,
+      abortController,
+      env,
+      ...options.loginMethod ? { forceLoginMethod: options.loginMethod } : {},
+      ...options.loginOrgUUID ? { forceLoginOrgUUID: options.loginOrgUUID } : {}
+    }
+  });
+  try {
+    if (!options.forceLogin) {
+      const cached = await probeCachedCredentials(authQuery);
+      if (cached) {
+        return { method: "oauth", email: cached.email };
       }
     }
-  };
+    return await resolveAuthentication(authQuery, {
+      forceLogin: options.forceLogin,
+      loginWithClaudeAi: (options.loginMethod ?? "claudeai") === "claudeai",
+      hasApiKey
+    });
+  } finally {
+    abortController.abort();
+    await authQuery.return().catch(() => {
+    });
+  }
+}
+
+// src/auth/logout.ts
+var import_child_process2 = require("child_process");
+var import_node_module = require("module");
+var import_node_path5 = __toESM(require("path"));
+var import_util = require("util");
+var execFileAsync = (0, import_util.promisify)(import_child_process2.execFile);
+function resolveSdkCliPath() {
+  const require_ = (0, import_node_module.createRequire)(__filename);
+  return import_node_path5.default.join(import_node_path5.default.dirname(require_.resolve("@anthropic-ai/claude-agent-sdk")), "cli.js");
+}
+async function logout() {
+  try {
+    const sdkCliPath = resolveSdkCliPath();
+    const { stdout, stderr } = await execFileAsync(process.execPath, [
+      sdkCliPath,
+      "auth",
+      "logout"
+    ]);
+    const output = (stdout || stderr || "").trim();
+    return { success: true, message: output || "Logged out successfully." };
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return { success: false, message: `Logout failed: ${message}` };
+  }
 }
 
-// src/agent/turn-gate.ts
-function createTurnGate() {
-  let resolve2 = () => {
-  };
-  let promise = new Promise((r) => {
-    resolve2 = r;
-  });
-  return Object.freeze({
-    wait: () => promise,
-    open: () => {
-      resolve2();
-    },
-    close: () => {
-      promise = new Promise((r) => {
-        resolve2 = r;
-      });
+// src/session/env-file.ts
+var import_fs2 = require("fs");
+var import_promises4 = require("fs/promises");
+var import_path2 = require("path");
+var import_prompts6 = require("@inquirer/prompts");
+var import_picocolors10 = __toESM(require("picocolors"));
+function parseEnvContent(content) {
+  const entries = [];
+  for (const line of content.split("\n")) {
+    const trimmed = line.trim();
+    if (trimmed === "" || trimmed.startsWith("#")) continue;
+    const match = /^([A-Za-z_]\w*)=(.*)/.exec(trimmed);
+    if (!match) continue;
+    const key = match[1];
+    let value = match[2];
+    if (value.startsWith('"') && value.endsWith('"') && value.length >= 2) {
+      value = value.slice(1, -1).replace(/\\(["\\])/g, "$1");
+    } else if (value.startsWith("'") && value.endsWith("'") && value.length >= 2) {
+      value = value.slice(1, -1);
     }
-  });
+    entries.push([key, value]);
+  }
+  return new Map(entries);
 }
-
-// src/output/render-markdown.ts
-var import_picocolors11 = __toESM(require("picocolors"));
-var BOLD_RE = /\*\*(.+?)\*\*/g;
-var HEADING_RE = /^(#{1,6})\s+(.+)$/;
-function renderMarkdownLine(line) {
-  const headingMatch = HEADING_RE.exec(line);
-  if (headingMatch) {
-    return import_picocolors11.default.bold(headingMatch[2]);
+var FORBIDDEN_VALUE_CHARS = /[\n\r\0]/;
+var REQUIRES_QUOTING = /[\s"'#]/;
+function escapeEnvValue(value) {
+  if (FORBIDDEN_VALUE_CHARS.test(value)) {
+    throw new Error(
+      "Env value contains a forbidden character (newline or null byte); refusing to write"
+    );
   }
-  if (line.includes("**")) {
-    return line.replace(BOLD_RE, (_, text) => import_picocolors11.default.bold(text));
+  if (!REQUIRES_QUOTING.test(value)) {
+    return value;
   }
-  return line;
+  const escaped = value.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+  return `"${escaped}"`;
 }
+var ENV_TEMPLATE = `# Anthropic API key (optional \u2014 if not set, OAuth login via browser is used)
+ANTHROPIC_API_KEY=
 
-// src/output/reformat-tables.ts
-var SEPARATOR_CELL_RE = /^:?-+:?$/;
-var BOLD_MARKERS_RE = /\*\*(.+?)\*\*/g;
-function visualWidth(text) {
-  return text.replace(BOLD_MARKERS_RE, "$1").length;
-}
-function isSeparatorCell(cell) {
-  return SEPARATOR_CELL_RE.test(cell);
-}
-function isSeparatorRow(cells) {
-  return cells.length > 0 && cells.every(isSeparatorCell);
-}
-function parseCells(line) {
-  return line.split("|").slice(1, -1).map((c) => c.trim());
-}
-function reformatTableBlock(lines) {
-  const parsed = lines.map(parseCells);
-  const colCount = Math.max(...parsed.map((row) => row.length));
-  const normalised = parsed.map((row) => {
-    const padded = [...row];
-    while (padded.length < colCount) {
-      padded.push("");
+# Kinetica connection details (prompted interactively if not set)
+# If password is omitted, the agent will prompt for it at startup
+KINETICA_URL={url}
+KINETICA_USER={user}
+KINETICA_PASS=
+`;
+function buildEnvContent(url, user, existingContent) {
+  const safeUrl = escapeEnvValue(url);
+  const safeUser = escapeEnvValue(user);
+  if (!existingContent?.trim()) {
+    return ENV_TEMPLATE.replace("{url}", safeUrl).replace("{user}", safeUser);
+  }
+  const lines = existingContent.split("\n");
+  let urlReplaced = false;
+  let userReplaced = false;
+  const updated = lines.map((line) => {
+    if (/^KINETICA_URL=/.exec(line)) {
+      urlReplaced = true;
+      return `KINETICA_URL=${safeUrl}`;
     }
-    return padded;
-  });
-  const colWidths = Array.from(
-    { length: colCount },
-    (_, col) => Math.max(
-      3,
-      ...normalised.filter((row) => !isSeparatorRow(row)).map((row) => visualWidth(row[col]))
-    )
-  );
-  const borderRow = `+${colWidths.map((w) => "-".repeat(w + 2)).join("+")}+`;
-  const bodyRows = normalised.map((row) => {
-    if (isSeparatorRow(row)) {
-      return borderRow;
+    if (/^KINETICA_USER=/.exec(line)) {
+      userReplaced = true;
+      return `KINETICA_USER=${safeUser}`;
     }
-    const cells = row.map((cell, col) => {
-      const rendered = renderMarkdownLine(cell);
-      const pad = colWidths[col] - visualWidth(cell);
-      return rendered + " ".repeat(Math.max(0, pad));
-    });
-    return `| ${cells.join(" | ")} |`;
+    return line;
   });
-  return [borderRow, ...bodyRows, borderRow];
+  if (!urlReplaced) updated.push(`KINETICA_URL=${safeUrl}`);
+  if (!userReplaced) updated.push(`KINETICA_USER=${safeUser}`);
+  return updated.join("\n");
 }
-
-// src/output/streaming-table-aligner.ts
-var TABLE_LINE_RE = /^\|.*\|$/;
-function createStreamingTableAligner() {
-  let lineBuffer = "";
-  let tableLines = [];
-  function flushTable() {
-    if (tableLines.length === 0) return "";
-    const aligned = reformatTableBlock(tableLines);
-    tableLines = [];
-    return aligned.join("\n") + "\n";
-  }
-  function push(text) {
-    if (!text) return "";
-    const combined = lineBuffer + text;
-    const segments = combined.split("\n");
-    lineBuffer = segments[segments.length - 1];
-    const completeLines = segments.slice(0, -1);
-    let output = "";
-    for (const line of completeLines) {
-      const trimmed = line.trim();
-      if (TABLE_LINE_RE.test(trimmed)) {
-        tableLines.push(trimmed);
-      } else {
-        output += flushTable();
-        output += renderMarkdownLine(line) + "\n";
+function loadEnvFile(dir, env = process.env) {
+  try {
+    const filePath = (0, import_path2.join)(dir ?? process.cwd(), ".env");
+    const content = (0, import_fs2.readFileSync)(filePath, "utf8");
+    const parsed = parseEnvContent(content);
+    for (const [key, value] of parsed) {
+      if (env[key] === void 0 && value !== "") {
+        env[key] = value;
       }
     }
-    return output;
-  }
-  function flush() {
-    let output = flushTable();
-    if (lineBuffer) {
-      output += renderMarkdownLine(lineBuffer);
-      lineBuffer = "";
-    }
-    return output;
+  } catch {
   }
-  return Object.freeze({ push, flush });
-}
-
-// src/output/spinner.ts
-var import_picocolors12 = __toESM(require("picocolors"));
-var FRAMES = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
-var FRAME_INTERVAL_MS = 80;
-var DEFAULT_LABEL = "Thinking";
-function createSpinner() {
-  let timer = null;
-  let frameIndex = 0;
-  const start = (label = DEFAULT_LABEL) => {
-    if (timer !== null) return;
-    frameIndex = 0;
-    timer = setInterval(() => {
-      const frame = FRAMES[frameIndex % FRAMES.length];
-      process.stderr.write(`\r${import_picocolors12.default.dim(`${frame} ${label}...`)}`);
-      frameIndex += 1;
-    }, FRAME_INTERVAL_MS);
-    timer.unref();
-  };
-  const stop = () => {
-    if (timer === null) return;
-    clearInterval(timer);
-    timer = null;
-    process.stderr.write("\r\x1B[K");
-  };
-  const isRunning = () => timer !== null;
-  return Object.freeze({ start, stop, isRunning });
-}
-
-// src/agent/run-agent.ts
-var MCP_SERVER_NAME = "kinetica-diagnostics";
-var EXIT_COMMANDS = /* @__PURE__ */ new Set(["exit", "quit", "end", "q"]);
-var SUPPORTED_MODELS = ["sonnet", "haiku", "opus"];
-var DEFAULT_AGENT_MODEL = "sonnet";
-var DEFAULT_MAX_BUDGET_USD = 5;
-var ALLOWED_TOOL_NAMES = [
-  ...DIAGNOSTIC_TOOL_NAMES.map((name) => `mcp__${MCP_SERVER_NAME}__${name}`),
-  `mcp__${MCP_SERVER_NAME}__save_report`,
-  `mcp__${MCP_SERVER_NAME}__${ALTER_TABLE_COLUMNS_TOOL_NAME}`
-];
-var DISALLOWED_TOOLS = ["Bash", "Edit", "Write", "MultiEdit"];
-var ERROR_LABELS = {
-  authentication_failed: "Authentication failed \u2014 check your API key or re-run with --login",
-  billing_error: "Billing error \u2014 check your Anthropic account",
-  rate_limit: "Rate limit exceeded",
-  server_error: "Anthropic API server error",
-  invalid_request: "Invalid API request",
-  max_output_tokens: "Response exceeded maximum output length",
-  unknown: "Unknown API error"
-};
-function isExitCommand(text) {
-  return EXIT_COMMANDS.has(text.trim().toLowerCase());
-}
-function makeUserMessage(content) {
-  return {
-    type: "user",
-    message: { role: "user", content },
-    parent_tool_use_id: null,
-    session_id: ""
-  };
 }
-async function* makeInteractivePrompt(abortController, turnGate, spinner) {
-  while (!abortController.signal.aborted) {
-    try {
-      process.stderr.write("\n");
-      const issue = await (0, import_prompts8.input)({ message: "Describe the issue to investigate:" });
-      process.stderr.write("\n");
-      const trimmed = issue.trim();
-      if (!trimmed) continue;
-      if (isExitCommand(trimmed)) return;
-      spinner.start();
-      yield makeUserMessage(trimmed);
-      break;
-    } catch {
-      return;
-    }
-  }
-  while (!abortController.signal.aborted) {
+async function offerSaveCredentials(url, user, dir) {
+  if (!process.stdin.isTTY) return;
+  try {
+    const shouldSave = await (0, import_prompts6.confirm)({
+      message: "Save KINETICA_URL and KINETICA_USER to .env? (password is never saved)",
+      default: true
+    });
+    if (!shouldSave) return;
+    const filePath = (0, import_path2.join)(dir ?? process.cwd(), ".env");
+    let existing;
     try {
-      await turnGate.wait();
-      if (abortController.signal.aborted) break;
-      process.stderr.write("\n");
-      const response = await (0, import_prompts8.input)({ message: "You:" });
-      process.stderr.write("\n");
-      const trimmed = response.trim();
-      if (!trimmed) continue;
-      if (isExitCommand(trimmed)) return;
-      turnGate.close();
-      spinner.start();
-      yield makeUserMessage(trimmed);
+      existing = await (0, import_promises4.readFile)(filePath, "utf8");
     } catch {
-      return;
     }
+    const content = buildEnvContent(url, user, existing);
+    await (0, import_promises4.writeFile)(filePath, content, "utf8");
+    console.error(import_picocolors10.default.dim("Saved to .env"));
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    console.error(import_picocolors10.default.yellow(`Could not save .env file: ${message}`));
   }
 }
-async function displayDegradedStatus(session2) {
-  const [statusResult, alertsResult] = await Promise.all([
-    hostManagerStatus(session2),
-    hostManagerAlerts(session2)
-  ]);
-  process.stderr.write(import_picocolors13.default.bold("\u2500\u2500 Host Manager Status \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n"));
-  if (statusResult.ok) {
-    const rows = statusResult.data;
-    const maxKeyLen = rows.reduce((max, r) => Math.max(max, r.key.length), 0);
-    for (const row of rows) {
-      process.stderr.write(`  ${import_picocolors13.default.dim(row.key.padEnd(maxKeyLen))}  ${row.value}
-`);
+
+// src/session/verify.ts
+var import_picocolors13 = __toESM(require("picocolors"));
+var import_prompts9 = require("@inquirer/prompts");
+
+// src/session/collect.ts
+var import_prompts7 = require("@inquirer/prompts");
+var import_picocolors11 = __toESM(require("picocolors"));
+async function collectCredentials() {
+  const prompted = /* @__PURE__ */ new Set();
+  const envUrl = process.env.KINETICA_URL;
+  const envUser = process.env.KINETICA_USER;
+  if (envUrl && envUser && process.stdin.isTTY) {
+    console.error(import_picocolors11.default.dim(`Saved connection: ${envUrl} (${envUser})`));
+    const useSaved = await (0, import_prompts7.confirm)({
+      message: "Use saved connection?",
+      default: true
+    });
+    if (!useSaved) {
+      prompted.add("url");
+      prompted.add("user");
+      const url2 = await (0, import_prompts7.input)({ message: "Kinetica endpoint URL:" });
+      const user2 = await (0, import_prompts7.input)({ message: "Admin username:" });
+      const pass2 = await (0, import_prompts7.password)({ message: "Admin password:", mask: "*" });
+      return { credentials: { url: url2, user: user2, pass: pass2 }, prompted };
     }
-  } else {
-    process.stderr.write(`  ${import_picocolors13.default.red(`Error: ${statusResult.error}`)}
-`);
   }
-  process.stderr.write("\n");
-  process.stderr.write(import_picocolors13.default.bold("\u2500\u2500 Recent Alerts \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n"));
-  if (alertsResult.ok) {
-    const alerts = alertsResult.data;
-    if (alerts.length === 0) {
-      process.stderr.write(`  ${import_picocolors13.default.dim("No recent alerts.")}
-`);
-    } else {
-      for (const alert of alerts) {
-        process.stderr.write(`  ${import_picocolors13.default.dim(alert.timestamp)}  ${alert.type}  ${alert.params}
-`);
-      }
+  const url = envUrl ?? (prompted.add("url"), await (0, import_prompts7.input)({ message: "Kinetica endpoint URL:" }));
+  const user = envUser ?? (prompted.add("user"), await (0, import_prompts7.input)({ message: "Admin username:" }));
+  const pass = process.env.KINETICA_PASS ?? await (0, import_prompts7.password)({ message: "Admin password:", mask: "*" });
+  return { credentials: { url, user, pass }, prompted };
+}
+async function repromptCredentials() {
+  const user = await (0, import_prompts7.input)({ message: "Admin username:" });
+  const pass = await (0, import_prompts7.password)({ message: "Admin password:", mask: "*" });
+  return { user, pass };
+}
+
+// src/session/KineticaSession.ts
+var REQUEST_TIMEOUT_MS = 3e4;
+function replacePort(baseUrl, port) {
+  const parsed = new URL(baseUrl);
+  parsed.port = String(port);
+  return parsed.origin;
+}
+function createSession(url, user, pass) {
+  const authHeader = "Basic " + Buffer.from(`${user}:${pass}`).toString("base64");
+  const doFetch = async (fullUrl, body) => {
+    if (process.env.DEBUG) {
+      console.error(`[DEBUG] POST ${fullUrl}`);
     }
-  } else {
-    process.stderr.write(`  ${import_picocolors13.default.dim(`Unavailable: ${alertsResult.error}`)}
-`);
-  }
-  process.stderr.write("\n");
+    return fetch(fullUrl, {
+      method: "POST",
+      headers: {
+        Authorization: authHeader,
+        "Content-Type": "application/json"
+      },
+      body: body !== void 0 ? JSON.stringify(body) : void 0,
+      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
+    });
+  };
+  return {
+    baseUrl: url,
+    makeRequest: (endpoint, body) => doFetch(`${url}${endpoint}`, body),
+    makeRequestToPort: (port, endpoint, body) => doFetch(`${replacePort(url, port)}${endpoint}`, body)
+  };
 }
-async function runAgent(session2, kineticaVersion, degraded, model) {
-  const [catalogSchemas, playbooks, references] = await Promise.all([
-    degraded ? Promise.resolve(void 0) : discoverCatalogSchemas(session2),
-    loadPlaybooks(),
-    loadReferences()
-  ]);
-  const systemPrompt = buildSystemPrompt(
-    kineticaVersion,
-    catalogSchemas,
-    playbooks,
-    references,
-    degraded
-  );
-  const budget = checkPromptBudget(systemPrompt);
-  if (process.env.DEBUG) {
-    process.stderr.write(
-      import_picocolors13.default.dim(`system prompt: ~${budget.tokens} tokens (${budget.chars} chars)
-`)
-    );
+
+// src/session/resolve-url.ts
+var import_picocolors12 = __toESM(require("picocolors"));
+var import_prompts8 = require("@inquirer/prompts");
+var PROBE_TIMEOUT_MS2 = 3e3;
+var HTTP_PROTOCOL_RE = /^https?:\/\//i;
+var ANY_PROTOCOL_RE = /^[a-z][a-z0-9+.-]*:\/\//i;
+function hasProtocol(input5) {
+  return HTTP_PROTOCOL_RE.test(input5);
+}
+function stripTrailingSlashes(url) {
+  return url.replace(/\/+$/, "");
+}
+async function probeProtocol(url) {
+  try {
+    await fetch(url, {
+      method: "HEAD",
+      signal: AbortSignal.timeout(PROBE_TIMEOUT_MS2)
+    });
+    return true;
+  } catch {
+    return false;
   }
-  if (budget.overBudget) {
-    process.stderr.write(
-      import_picocolors13.default.yellow(
-        `\u26A0 system prompt is ~${budget.tokens} tokens (threshold ${budget.threshold}) \u2014 knowledge corpus is getting expensive; consider keyword-based playbook selection.
+}
+function isHttpsOnly() {
+  return process.env.KINETICA_HTTPS_ONLY === "1";
+}
+function isInteractive() {
+  return Boolean(process.stdin.isTTY);
+}
+async function confirmHttpFallback(host) {
+  process.stderr.write(
+    "\n" + import_picocolors12.default.red(
+      import_picocolors12.default.bold(
+        `  WARNING: HTTPS unavailable at ${host}.
+  Falling back to plaintext HTTP will transmit your Kinetica credentials in the clear.
 `
       )
-    );
+    ) + import_picocolors12.default.dim(
+      `  Set KINETICA_HTTPS_ONLY=1 to refuse this fallback automatically, or pass an explicit http:// prefix to silence this prompt.
+
+`
+    )
+  );
+  try {
+    return await (0, import_prompts8.confirm)({
+      message: "Continue over plaintext HTTP?",
+      default: false
+    });
+  } catch {
+    return false;
   }
-  const diagnosticTools = makeDiagnosticTools(session2, catalogSchemas);
-  const mutationTools = makeMutationTools(session2);
-  const saveReportTool = makeSaveReportTool();
-  const alterTableColumnsTool = makeAlterTableColumnsToolWithDeps(session2);
-  const server = (0, import_claude_agent_sdk5.createSdkMcpServer)({
-    name: MCP_SERVER_NAME,
-    version: "1.0.0",
-    tools: [...diagnosticTools, ...mutationTools, saveReportTool, alterTableColumnsTool]
-  });
-  const spinner = createSpinner();
-  const registry = createDiagnosticRegistry();
-  const approvalGate = createApprovalGate(registry.isReadOnlyTool);
-  const canUseTool = async (toolName, toolInput, options2) => {
-    spinner.stop();
-    return approvalGate(toolName, toolInput, options2);
-  };
-  const abortController = new AbortController();
-  const effectiveModel = model ?? DEFAULT_AGENT_MODEL;
-  const options = {
-    mcpServers: { [MCP_SERVER_NAME]: server },
-    allowedTools: ALLOWED_TOOL_NAMES,
-    disallowedTools: [...DISALLOWED_TOOLS],
-    canUseTool,
-    systemPrompt,
-    model: effectiveModel,
-    fallbackModel: "haiku",
-    thinking: { type: "adaptive" },
-    maxTurns: 100,
-    maxBudgetUsd: DEFAULT_MAX_BUDGET_USD,
-    persistSession: false,
-    includePartialMessages: true,
-    abortController,
-    env: { ...process.env, CLAUDE_AGENT_SDK_CLIENT_APP: "admin-agent" }
-  };
-  if (degraded) {
-    process.stderr.write("\nKinetica Diagnostic Session Ready (DEGRADED MODE)\n");
-    process.stderr.write(
-      "DB engine (port 9191) is unreachable. Only host manager tools are available.\n\n"
-    );
-    await displayDegradedStatus(session2);
-    process.stderr.write("Type 'exit' to end the session.\n\n");
-  } else {
-    process.stderr.write("\nKinetica Diagnostic Session Ready\n");
-    process.stderr.write("Type 'exit' to end the session.\n\n");
+}
+async function resolveUrl(input5) {
+  const trimmed = input5.trim();
+  if (trimmed === "") {
+    return { ok: false, error: "URL is empty" };
+  }
+  const normalized = stripTrailingSlashes(trimmed);
+  if (hasProtocol(normalized)) {
+    return { ok: true, url: normalized };
+  }
+  if (ANY_PROTOCOL_RE.test(normalized)) {
+    const scheme = normalized.split("://")[0];
+    return {
+      ok: false,
+      error: `Unsupported protocol: ${scheme}. Use http:// or https://`
+    };
+  }
+  const httpsUrl = `https://${normalized}`;
+  const httpUrl = `http://${normalized}`;
+  console.error(import_picocolors12.default.dim("Detecting protocol..."));
+  if (await probeProtocol(httpsUrl)) {
+    return { ok: true, url: httpsUrl };
+  }
+  if (isHttpsOnly()) {
+    return {
+      ok: false,
+      error: `HTTPS probe to ${httpsUrl} failed and KINETICA_HTTPS_ONLY=1; refusing to fall back to plaintext HTTP.`
+    };
+  }
+  if (!await probeProtocol(httpUrl)) {
+    return {
+      ok: false,
+      error: `Could not connect to ${normalized} via https:// or http://`
+    };
+  }
+  if (!isInteractive()) {
+    return {
+      ok: false,
+      error: `HTTPS unavailable at ${normalized} and terminal is non-interactive. Pass an explicit http:// prefix to allow plaintext HTTP, or point the URL at an HTTPS endpoint.`
+    };
+  }
+  const approved = await confirmHttpFallback(normalized);
+  if (!approved) {
+    return {
+      ok: false,
+      error: "User declined plaintext HTTP fallback"
+    };
+  }
+  return { ok: true, url: httpUrl };
+}
+
+// src/session/verify.ts
+var MAX_RETRIES = 3;
+var MAX_REPROMPTS = 2;
+var DEFAULT_HM_PORT2 = 9300;
+function extractVersion(responseBody) {
+  try {
+    const outer = JSON.parse(responseBody);
+    if (typeof outer.data_str !== "string") return void 0;
+    const inner = JSON.parse(outer.data_str);
+    const systemStr = inner.status_map?.system;
+    if (typeof systemStr !== "string") return void 0;
+    const system = JSON.parse(systemStr);
+    return typeof system.version === "string" ? system.version : void 0;
+  } catch {
+    return void 0;
   }
-  const turnGate = createTurnGate();
-  const agentQuery = (0, import_claude_agent_sdk5.query)({
-    prompt: makeInteractivePrompt(abortController, turnGate, spinner),
-    options
-  });
-  process.once("SIGINT", () => {
-    spinner.stop();
-    process.stderr.write("\nInterrupted \u2014 aborting investigation...\n");
-    abortController.abort();
-    agentQuery.close();
-  });
-  let numTurns = 0;
-  let totalCostUsd = 0;
-  let durationMs = 0;
-  let durationApiMs = 0;
-  let lastStreamCharWasNewline = true;
-  const tableAligner = createStreamingTableAligner();
-  let hadNonAbortError = false;
+}
+function extractVersionFromHostManager(responseBody) {
   try {
-    for await (const message of agentQuery) {
-      if (message.type === "stream_event") {
-        const { event: evt } = message;
-        if (evt.type === "content_block_delta" && evt.delta.type === "text_delta") {
-          const text = evt.delta.text ?? "";
-          if (text) {
-            spinner.stop();
-            const output = tableAligner.push(text);
-            if (output) {
-              process.stderr.write(output);
-              lastStreamCharWasNewline = output.endsWith("\n");
-            }
+    const parsed = JSON.parse(responseBody);
+    return typeof parsed.version === "string" ? parsed.version : void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function probeHostManager(session2) {
+  if (!session2.makeRequestToPort) {
+    return { ok: false };
+  }
+  try {
+    const response = await session2.makeRequestToPort(DEFAULT_HM_PORT2, "/", void 0);
+    if (!response.ok) return { ok: false };
+    const body = await response.text();
+    return { ok: true, version: extractVersionFromHostManager(body) };
+  } catch {
+    return { ok: false };
+  }
+}
+async function verifyConnectivity(session2) {
+  const response = await session2.makeRequest("/show/system/status", {});
+  if (!response.ok) {
+    const body2 = await response.text();
+    throw new Error(`HTTP ${response.status}: ${body2}`);
+  }
+  const body = await response.text();
+  return extractVersion(body);
+}
+function isCredentialError(errorMessage) {
+  return errorMessage.startsWith("HTTP 401") || errorMessage.startsWith("HTTP 403");
+}
+async function connectWithRetry() {
+  const { credentials, prompted } = await collectCredentials();
+  const resolved = await resolveUrl(credentials.url);
+  if (!resolved.ok) {
+    console.error(import_picocolors13.default.red(resolved.error));
+    process.exit(1);
+  }
+  const resolvedUrl = resolved.url;
+  let currentUser = credentials.user;
+  let currentPass = credentials.pass;
+  let wasReprompted = false;
+  let repromptCount = 0;
+  let session2 = createSession(resolvedUrl, currentUser, currentPass);
+  for (let attempt = 1; attempt <= MAX_RETRIES; attempt++) {
+    try {
+      const kineticaVersion = await verifyConnectivity(session2);
+      console.error(import_picocolors13.default.green("Connected to Kinetica successfully."));
+      if (prompted.size > 0 || wasReprompted) {
+        await offerSaveCredentials(resolvedUrl, currentUser);
+      }
+      return { session: session2, kineticaVersion, degraded: false };
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      console.error(import_picocolors13.default.red(`Connection failed (attempt ${attempt}/${MAX_RETRIES}): ${msg}`));
+      if (isCredentialError(msg)) {
+        if (process.stdin.isTTY && repromptCount < MAX_REPROMPTS) {
+          const shouldRetry = await (0, import_prompts9.confirm)({
+            message: "Credentials may be incorrect. Re-enter?",
+            default: true
+          });
+          if (shouldRetry) {
+            const fresh = await repromptCredentials();
+            currentUser = fresh.user;
+            currentPass = fresh.pass;
+            wasReprompted = true;
+            repromptCount++;
+            session2 = createSession(resolvedUrl, currentUser, currentPass);
+            attempt = 0;
+            continue;
           }
         }
-      } else if (message.type === "assistant") {
-        const assistantMsg = message;
-        const remaining = tableAligner.flush();
-        if (remaining) {
-          process.stderr.write(remaining);
-          lastStreamCharWasNewline = remaining.endsWith("\n");
-        }
-        if (!lastStreamCharWasNewline) {
-          process.stderr.write("\n");
-          lastStreamCharWasNewline = true;
-        }
-        if (assistantMsg.message.stop_reason === "end_turn") {
-          spinner.stop();
-          turnGate.open();
-        } else if (assistantMsg.message.stop_reason === "tool_use") {
-          spinner.start("Investigating");
-        } else {
-          spinner.stop();
-        }
-        if (assistantMsg.error) {
-          spinner.stop();
-          const label = ERROR_LABELS[assistantMsg.error] ?? assistantMsg.error;
-          process.stderr.write(import_picocolors13.default.yellow(`
-API error: ${label}
-`));
-          turnGate.open();
-        }
-      } else if (message.type === "result") {
-        spinner.stop();
-        const resultMsg = message;
-        numTurns = resultMsg.num_turns;
-        totalCostUsd = resultMsg.total_cost_usd;
-        durationMs = resultMsg.duration_ms;
-        durationApiMs = resultMsg.duration_api_ms;
-        if (resultMsg.subtype === "error_max_turns") {
-          process.stderr.write(
-            "\nInvestigation hit turn limit. Partial report may be available.\n"
-          );
-        } else if (resultMsg.subtype === "error_max_budget_usd") {
-          process.stderr.write("\nBudget limit reached.\n");
-        } else if (resultMsg.subtype === "error_during_execution") {
-          process.stderr.write(
-            "\nExecution error \u2014 the agent encountered an unrecoverable failure.\n"
-          );
-        } else if (resultMsg.subtype !== "success") {
-          process.stderr.write(`
-Agent session ended with error: ${resultMsg.subtype}
-`);
-        }
-        if (resultMsg.permission_denials.length > 0) {
-          const denied = resultMsg.permission_denials.map((d) => d.tool_name).join(", ");
-          process.stderr.write(`
-Permission denials: ${denied}
-`);
-        }
-        turnGate.open();
-      } else if (message.type === "system") {
-        const sysMsg = message;
-        if (sysMsg.subtype === "init") {
-          const initMsg = message;
-          const failed = (initMsg.mcp_servers ?? []).filter(
-            (s) => s.name === MCP_SERVER_NAME && s.status !== "connected"
-          );
-          for (const s of failed) {
-            process.stderr.write(
-              `
-Warning: MCP server "${s.name}" failed to connect (${s.status})
-`
-            );
-          }
-        } else if (sysMsg.subtype === "api_retry") {
-          const retryMsg = message;
-          const statusStr = retryMsg.error_status !== null ? ` (HTTP ${retryMsg.error_status})` : "";
-          const delaySec = Math.round(retryMsg.retry_delay_ms / 1e3);
-          process.stderr.write(
+        console.error(import_picocolors13.default.red("Authentication failed. Exiting."));
+        process.exit(1);
+      }
+      if (attempt === MAX_RETRIES) {
+        console.error(import_picocolors13.default.yellow("DB engine unreachable. Probing host manager on port 9300..."));
+        const hmResult = await probeHostManager(session2);
+        if (hmResult.ok) {
+          console.error(
             import_picocolors13.default.yellow(
-              `
-API error${statusStr}. Retrying (attempt ${retryMsg.attempt}/${retryMsg.max_retries}) in ${delaySec}s...
-`
+              "Connected in DEGRADED MODE (host manager only). Most diagnostic tools will be unavailable."
             )
           );
-        } else if (sysMsg.subtype === "compact_boundary") {
-          const compactMsg = message;
-          const preTokens = compactMsg.compact_metadata.pre_tokens;
-          process.stderr.write(
-            `
-[Context compressed (${preTokens} tokens before compaction) \u2014 investigation continues]
-`
-          );
-        }
-      } else if (message.type === "rate_limit_event") {
-        const rateMsg = message;
-        const { status, resetsAt } = rateMsg.rate_limit_info;
-        if (status === "rejected") {
-          const resetStr = resetsAt ? ` Resets at ${new Date(resetsAt * 1e3).toISOString()}.` : "";
-          process.stderr.write(`
-Rate limited \u2014 requests rejected.${resetStr}
-`);
-        } else if (status === "allowed_warning") {
-          process.stderr.write("\nApproaching rate limit \u2014 investigation may slow.\n");
-        }
-      } else if (message.type === "control_request") {
-        const controlMsg = message;
-        if (controlMsg.request.subtype === "claude_authenticate") {
-          process.stderr.write(import_picocolors13.default.yellow("\nRe-authentication requested by SDK...\n"));
+          if (prompted.size > 0 || wasReprompted) {
+            await offerSaveCredentials(resolvedUrl, currentUser);
+          }
+          return { session: session2, kineticaVersion: hmResult.version, degraded: true };
         }
+        console.error(import_picocolors13.default.red("Host manager also unreachable. Exiting."));
+        process.exit(1);
       }
     }
-  } catch (error) {
-    spinner.stop();
-    if (error instanceof import_claude_agent_sdk5.AbortError) {
-      hadNonAbortError = false;
-    } else {
-      hadNonAbortError = true;
-      const message = error instanceof Error ? error.message : String(error);
-      process.stderr.write(import_picocolors13.default.red(`
-Agent error: ${message}
-`));
-    }
-  } finally {
-    spinner.stop();
-    const remaining = tableAligner.flush();
-    if (remaining) {
-      process.stderr.write(remaining);
-    }
-    turnGate.open();
-    const durationSec = Math.round(durationMs / 1e3);
-    const apiPct = durationMs > 0 ? Math.round(durationApiMs / durationMs * 100) : 0;
-    const costStr = totalCostUsd > 0 ? ` Cost: $${totalCostUsd.toFixed(4)}.` : "";
-    if (hadNonAbortError) {
-      process.stderr.write(`
-Session ended due to error. Turns: ${numTurns}.${costStr}
-`);
-    } else {
-      process.stderr.write(
-        `
-Session ended. Turns: ${numTurns}. Duration: ${durationSec}s (${apiPct}% API).${costStr}
-`
-      );
-    }
   }
+  throw new Error("unreachable");
 }
 
 // src/cli/index.ts
@@ -4874,12 +5046,14 @@ function printHelp() {
     "    --login-org=UUID      Target organization UUID for OAuth",
     "    --logout              Log out from Anthropic account and exit",
     `    --model=NAME          Override agent model (${SUPPORTED_MODELS.join(" | ")}); default: sonnet`,
+    "    --max-budget=USD      Per-session budget cap in USD (API-key billing only); default: 5.00",
     "",
     "  Environment variables:",
-    "    ANTHROPIC_API_KEY  Anthropic API key (if not set, OAuth login via browser is used)",
-    "    KINETICA_URL       Kinetica endpoint URL",
-    "    KINETICA_USER      Admin username",
-    "    KINETICA_PASS      Admin password",
+    "    ANTHROPIC_API_KEY      Anthropic API key (if not set, OAuth login via browser is used)",
+    "    ADMIN_AGENT_MAX_BUDGET Per-session budget cap in USD (overridden by --max-budget)",
+    "    KINETICA_URL           Kinetica endpoint URL",
+    "    KINETICA_USER          Admin username",
+    "    KINETICA_PASS          Admin password",
     ""
   ];
   process.stdout.write(lines.join("\n") + "\n");
@@ -4924,9 +5098,31 @@ async function main() {
       return;
     }
   }
+  const budgetArg = args.find((a) => a.startsWith("--max-budget="));
+  const budgetValue = budgetArg?.split("=")[1];
+  let maxBudgetFlag;
+  if (budgetValue !== void 0) {
+    const parsed = Number(budgetValue);
+    if (!isValidBudget(parsed)) {
+      process.stderr.write(
+        import_picocolors14.default.red(
+          `Error: invalid --max-budget value "${budgetValue}". Use a positive number, e.g. --max-budget=10
+`
+        )
+      );
+      process.exitCode = 1;
+      return;
+    }
+    maxBudgetFlag = parsed;
+  }
   loadEnvFile();
+  printBanner();
+  if (model === void 0 && process.stdin.isTTY) {
+    model = await selectModel();
+  }
   const effectiveModel = model ?? DEFAULT_AGENT_MODEL;
-  printBanner(effectiveModel);
+  process.stderr.write(import_picocolors14.default.dim(`Model: ${effectiveModel}
+`));
   const authResult = await authenticateAnthropic({ forceLogin, loginMethod, loginOrgUUID });
   if (authResult.method === "oauth") {
     const acctInfo = authResult.email ? ` (${authResult.email})` : "";
@@ -4935,9 +5131,13 @@ async function main() {
   } else {
     process.stderr.write(import_picocolors14.default.dim("Authenticated via API key\n"));
   }
+  const maxBudgetUsd = resolveMaxBudgetUsd(maxBudgetFlag);
   const { session: connectedSession, kineticaVersion, degraded } = await connectWithRetry();
   session = connectedSession;
-  await runAgent(session, kineticaVersion, degraded, model);
+  await runAgent(session, kineticaVersion, degraded, model, {
+    authMethod: authResult.method,
+    maxBudgetUsd
+  });
 }
 function getSession() {
   return session;