@kinetica/admin-agent 0.1.2 → 0.2.0

package/dist/admin-agent.js

@@ -31,6 +31,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/cli/index.ts
 var cli_exports = {};
 __export(cli_exports, {
+  chooseBundleSessionVersion: () => chooseBundleSessionVersion,
   getSession: () => getSession,
   main: () => main,
   verbose: () => verbose
@@ -84,11 +85,11 @@ function dimRgb(color, factor) {
 }
 var SHADOW_CHARS = /* @__PURE__ */ new Set(["\u2557", "\u2554", "\u2551", "\u255D", "\u255A", "\u2550"]);
 var DIM_FACTOR = 0.4;
-function gradientize(text) {
+function gradientize(text2) {
   const PURPLE = [147, 51, 234];
   const HOT_PINK = [236, 72, 153];
   const RESET = "\x1B[0m";
-  const lines = text.split("\n");
+  const lines = text2.split("\n");
   const maxIdx = Math.max(lines.length - 1, 1);
   return lines.map((line, i) => {
     const bright = lerpRgb(PURPLE, HOT_PINK, i / maxIdx);
@@ -111,17 +112,17 @@ function printBanner(model) {
   const version = getVersion();
   const subtitle = `admin-agent ${import_picocolors.default.dim(`v${version}`)}`;
   const header = model ? `${subtitle}
-${import_picocolors.default.dim(`model: ${model}`)}` : subtitle;
+${import_picocolors.default.dim(`Model: ${model}`)}` : subtitle;
   process.stderr.write("\n\n" + gradientize(LOGO) + "\n\n" + header + "\n");
   return subtitle;
 }
 
 // src/cli/select-model.ts
-var import_prompts5 = require("@inquirer/prompts");
+var import_prompts6 = require("@inquirer/prompts");
 
 // src/agent/run-agent.ts
-var import_claude_agent_sdk4 = require("@anthropic-ai/claude-agent-sdk");
-var import_prompts4 = require("@inquirer/prompts");
+var import_claude_agent_sdk5 = require("@anthropic-ai/claude-agent-sdk");
+var import_prompts5 = require("@inquirer/prompts");
 var import_picocolors8 = __toESM(require("picocolors"));
 
 // src/agent/diagnostic-sql.ts
@@ -556,7 +557,7 @@ function formatTableArray(rows) {
   const colWidths = headers.map(
     (h, i) => Math.max(h.length, ...cells.map((row) => row[i].length), 3)
   );
-  const pad = (text, col) => text.padEnd(colWidths[col]);
+  const pad = (text2, col) => text2.padEnd(colWidths[col]);
   const headerRow = `| ${headers.map((h, i) => pad(h, i)).join(" | ")} |`;
   const separatorRow = `| ${colWidths.map((w) => "-".repeat(w)).join(" | ")} |`;
   const dataRows = cells.map((row) => `| ${row.map((cell, i) => pad(cell, i)).join(" | ")} |`);
@@ -585,13 +586,13 @@ var DEFAULT_TRUNCATION = {
 };
 
 // src/output/truncate.ts
-function truncateOutput(text, options = DEFAULT_TRUNCATION) {
-  if (text === "") return "";
-  const lines = text.split("\n");
+function truncateOutput(text2, options = DEFAULT_TRUNCATION) {
+  if (text2 === "") return "";
+  const lines = text2.split("\n");
   const { headLines, tailLines } = options;
   const threshold = headLines + tailLines;
   if (lines.length <= threshold) {
-    return text;
+    return text2;
   }
   const truncatedCount = lines.length - headLines - tailLines;
   const head = lines.slice(0, headLines);
@@ -1221,7 +1222,7 @@ var DEFAULT_SCRUB_PATTERNS = [
 ];
 function scrubCredentials(content, patterns = DEFAULT_SCRUB_PATTERNS) {
   const configRedacted = redactConfigSecrets(content);
-  return patterns.reduce((text, pattern) => text.replace(pattern, "[REDACTED]"), configRedacted);
+  return patterns.reduce((text2, pattern) => text2.replace(pattern, "[REDACTED]"), configRedacted);
 }
 
 // src/tools/rest/show-configuration.ts
@@ -2714,7 +2715,7 @@ function fingerprint(value) {
 }
 function scrubCredentialPatterns(value) {
   return CREDENTIAL_PATTERNS.reduce(
-    (text, { regex, replacement }) => text.replace(regex, replacement),
+    (text2, { regex, replacement }) => text2.replace(regex, replacement),
     value
   );
 }
@@ -2769,15 +2770,13 @@ var DIAGNOSTIC_TOOL_NAMES = [
   "kinetica_resource_objects",
   "kinetica_host_manager_status"
 ];
-function createDiagnosticRegistry() {
-  return DIAGNOSTIC_TOOL_NAMES.reduce(
-    (registry, name) => registry.registerReadOnlyTool(name),
-    createRegistry()
-  );
-}
 function applyOutputPipeline(result) {
   const payload = result.ok ? result.data : result;
-  return truncateOutput(formatOutput(payload));
+  const body = formatOutput(payload);
+  const withNote = result.ok && result.note ? `${result.note}
+
+${body}` : body;
+  return truncateOutput(withNote);
 }
 function logMutationAudit(toolName, result, input5) {
   const statusLabel = result.ok ? import_picocolors4.default.bold(import_picocolors4.default.green("EXECUTED")) : import_picocolors4.default.bold(import_picocolors4.default.red("FAILED"));
@@ -3191,6 +3190,26 @@ function buildEvidenceChecklist() {
   ].join("\n");
 }
 
+// src/agent/prompt-sections.ts
+function buildFailurePatternsSection(playbooks) {
+  if (!playbooks || playbooks.length === 0) return "";
+  const entries = playbooks.map((p) => `**${p.title}:**
+
+${p.body}`).join("\n\n");
+  return `### Common Failure Patterns
+
+${entries}`;
+}
+function buildReferenceSection(references) {
+  if (!references || references.length === 0) return "";
+  const entries = references.map((r) => `**${r.title}:**
+
+${r.body}`).join("\n\n");
+  return `### Reference Knowledge
+
+${entries}`;
+}
+
 // src/agent/report-template.ts
 var import_node_fs2 = require("fs");
 var import_node_path2 = require("path");
@@ -3301,25 +3320,7 @@ ${sqls.join("\n\n")}
   }
   return result.trimEnd();
 }
-function buildFailurePatternsSection(playbooks) {
-  if (!playbooks || playbooks.length === 0) return "";
-  const entries = playbooks.map((p) => `**${p.title}:**
-
-${p.body}`).join("\n\n");
-  return `### Common Failure Patterns
-
-${entries}`;
-}
-function buildReferenceSection(references) {
-  if (!references || references.length === 0) return "";
-  const entries = references.map((r) => `**${r.title}:**
-
-${r.body}`).join("\n\n");
-  return `### Reference Knowledge
-
-${entries}`;
-}
-function buildSystemPrompt(kineticaVersion, catalogSchemas, playbooks, references, degraded) {
+function buildSystemPrompt(kineticaVersion, catalogSchemas, playbooks, references, degraded, bundleCapability, bundleReferences) {
   const versionSection = kineticaVersion ? `**Kinetica Version:** ${kineticaVersion} (provided at session start)` : "**Kinetica Version:** Unknown \u2014 detect via kinetica_health_check as the first action of every investigation.";
   const t = "`";
   const degradedSection = degraded ? `
@@ -3352,6 +3353,21 @@ function buildSystemPrompt(kineticaVersion, catalogSchemas, playbooks, reference
 - Do NOT attempt Round 4 (mutations) or Round 5 (verification) \u2014 the DB engine must be running first
 
 ` : "";
+  const bundleSection = bundleCapability === void 0 ? "" : `
+---
+
+## Support Bundle Capability
+
+${bundleCapability === "attached" ? `A Kinetica support bundle (offline ${t}gpudb_sysinfo${t} snapshot) IS attached to this session. You now have **two complementary evidence sources**:
+- **The bundle** (${t}kinetica_bundle_*${t} tools) \u2014 frozen point-in-time history: per-rank logs (the incident narrative the live endpoints can't show), gpudb.conf at capture time, and host diagnostics. Call ${t}kinetica_bundle_list_files${t} first, then ${t}kinetica_bundle_log_timeline${t}.
+- **The live system** (the live diagnostic tools) \u2014 current state, right now.` : `The operator can attach an offline Kinetica support bundle for analysis. If they ask to "analyze a support bundle" (or you need historical logs the live endpoints don't expose \u2014 Kinetica has no log endpoint), call ${t}kinetica_load_bundle${t} **with no path** \u2014 they will be shown an interactive directory picker to choose the bundle. Do NOT ask for the path in chat. The ${t}kinetica_bundle_*${t} tools then read its logs/config/host-diagnostics.
+
+**Attaching a bundle is SETUP, not an investigation.** After ${t}kinetica_load_bundle${t} succeeds, do NOT start gathering evidence. Confirm what the operator wants to investigate first (briefly note the bundle is ready), then wait for their answer before calling any ${t}kinetica_bundle_*${t} tools. Do not waste turns investigating something they did not ask about.`}
+
+**Correlate the two:** the bundle tells you what HAPPENED (e.g. a crash, an error spike, config at capture time); the live tools tell you what is TRUE NOW (did it recover? is the config still drifted? did the issue recur?). Use the bundle for the historical narrative and the live tools to verify current state. Note in the report which findings came from the bundle (and its capture time) versus the live system.
+${bundleReferences && bundleReferences.length > 0 ? `
+${buildReferenceSection(bundleReferences)}
+` : ""}`;
   return `You are an expert Kinetica GPU database administrator and diagnostician with deep knowledge of Kinetica's internals, system tables, REST API, and common failure patterns. Your job is to autonomously investigate database issues reported by operators, gather diagnostic evidence, reason over that evidence to identify root causes, and produce a structured diagnostic report with actionable remediation steps.
 
 ${versionSection}
@@ -3479,7 +3495,7 @@ ${t}kinetica_show_table${t} (e.g., ${t}is_shard_key${t}, ${t}is_primary_key${t},
 ${buildFailurePatternsSection(playbooks)}
 
 ${buildReferenceSection(references)}
-
+${bundleSection}
 ---
 
 ## Analysis Instructions
@@ -3536,10 +3552,14 @@ Include specific, actionable remediation steps tied to your findings. Structure
 
 ## Post-Report Behavior
 
-1. Call the ${t}save_report${t} tool with the complete report markdown content to save it to disk.
-2. After the report is saved, ask: "Would you like to investigate another issue, or end the session?"
-3. If the operator wants another investigation, start fresh with the same 5-round protocol.
-4. On session end: summarize all issues investigated and list the saved report file paths, then exit.
+1. Present the finished report in your response so the operator can read it.
+2. **Ask BEFORE saving \u2014 never save unprompted.** After presenting the report, ask exactly: "Would you like me to save this report to disk? (yes/no)" and then STOP \u2014 end your turn and wait for the operator's answer. Do NOT call ${t}save_report${t} in the same turn as the question; the question must come first.
+   - If the operator answers yes \u2192 call ${t}save_report${t} with the complete report markdown content.
+   - If the operator answers no \u2192 do not save; acknowledge and continue.
+   - **Only exception:** when checkpointing under budget pressure (the operator warned the budget guard is approaching, or you are preserving work with a ${t}partial: true${t} report before an early cutoff), save immediately WITHOUT asking \u2014 preserving findings outweighs the prompt.
+3. After saving (or after the operator declines), ask: "Would you like to investigate another issue, or end the session?"
+4. If the operator wants another investigation, start fresh with the same 5-round protocol.
+5. On session end: summarize all issues investigated and list the saved report file paths, then exit.
 
 ---
 
@@ -3550,6 +3570,13 @@ Monitor your context window usage during long investigations:
 - If you detect that context is getting full (many rounds, many large tool responses), warn the operator: "The session context is getting long. Consider starting a fresh session after this report to maintain investigation quality. Your reports are saved to disk."
 - Do NOT continue investigating when context is too full \u2014 write the report with evidence gathered so far.
 
+## Budget & Length Awareness
+
+The session has a per-session budget guard that can end the run before you finish \u2014 and the operator may see a warning that you are "approaching the budget guard". To make sure a diagnostic always survives an early cutoff:
+- During a long or expensive investigation (many rounds or many large tool responses), proactively call \`save_report\` with \`partial: true\` to checkpoint your findings so far. A partial report is far better than none.
+- If the operator warns you that the budget guard is approaching, STOP gathering new evidence: immediately save a \`partial: true\` report with the evidence you have, state your best current hypothesis, and wind down the turn.
+- Treat the guard as a normal limit, not an error \u2014 never apologize for it; just preserve the work.
+
 ---
 
 ## Output Formatting
@@ -3635,9 +3662,8 @@ async function discoverCatalogSchemas(session2) {
 var import_promises2 = require("fs/promises");
 var import_node_path3 = require("path");
 var import_node_fs3 = require("fs");
-async function loadReferences(refsDir) {
+async function loadReferencesFrom(dir) {
   try {
-    const dir = refsDir ?? (0, import_node_path3.join)(findPackageRoot(__dirname), "knowledge", "references");
     if (!(0, import_node_fs3.existsSync)(dir)) return [];
     const files = await (0, import_promises2.readdir)(dir);
     const mdFiles = files.filter((f) => f.endsWith(".md")).sort();
@@ -3659,13 +3685,21 @@ async function loadReferences(refsDir) {
     return [];
   }
 }
+function loadReferences(refsDir) {
+  return loadReferencesFrom(refsDir ?? (0, import_node_path3.join)(findPackageRoot(__dirname), "knowledge", "references"));
+}
+function loadBundleReferences(refsDir) {
+  return loadReferencesFrom(
+    refsDir ?? (0, import_node_path3.join)(findPackageRoot(__dirname), "knowledge", "references", "bundle")
+  );
+}
 
 // src/agent/prompt-budget.ts
 var CHARS_PER_TOKEN = 4;
 var DEFAULT_PROMPT_BUDGET_TOKENS = 2e4;
-function estimateTokens(text) {
-  if (!text) return 0;
-  return Math.ceil(text.length / CHARS_PER_TOKEN);
+function estimateTokens(text2) {
+  if (!text2) return 0;
+  return Math.ceil(text2.length / CHARS_PER_TOKEN);
 }
 function checkPromptBudget(prompt, opts) {
   const threshold = opts?.warnAtTokens ?? DEFAULT_PROMPT_BUDGET_TOKENS;
@@ -3678,6 +3712,69 @@ function checkPromptBudget(prompt, opts) {
   };
 }
 
+// src/agent/session-budget.ts
+var DEFAULT_MAX_BUDGET_USD = 5;
+var DEFAULT_WARN_FRACTION = 0.8;
+var BUDGET_ENV_VAR = "ADMIN_AGENT_MAX_BUDGET";
+var MODEL_PRICING = {
+  sonnet: { inputPerMTok: 3, outputPerMTok: 15, cacheReadPerMTok: 0.3, cacheCreationPerMTok: 3.75 },
+  haiku: { inputPerMTok: 1, outputPerMTok: 5, cacheReadPerMTok: 0.1, cacheCreationPerMTok: 1.25 },
+  opus: { inputPerMTok: 15, outputPerMTok: 75, cacheReadPerMTok: 1.5, cacheCreationPerMTok: 18.75 }
+};
+function fromSdkUsage(raw) {
+  const u = raw ?? {};
+  return {
+    inputTokens: u.input_tokens,
+    outputTokens: u.output_tokens,
+    cacheReadInputTokens: u.cache_read_input_tokens,
+    cacheCreationInputTokens: u.cache_creation_input_tokens
+  };
+}
+function safeCount(value) {
+  return typeof value === "number" && Number.isFinite(value) && value > 0 ? value : 0;
+}
+function isValidBudget(value) {
+  return typeof value === "number" && Number.isFinite(value) && value > 0;
+}
+function estimateTurnCostUsd(usage, model) {
+  if (!usage) return 0;
+  const price = MODEL_PRICING[model];
+  const input5 = safeCount(usage.inputTokens);
+  const output = safeCount(usage.outputTokens);
+  const cacheRead = safeCount(usage.cacheReadInputTokens);
+  const cacheCreation = safeCount(usage.cacheCreationInputTokens);
+  return (input5 * price.inputPerMTok + output * price.outputPerMTok + cacheRead * price.cacheReadPerMTok + cacheCreation * price.cacheCreationPerMTok) / 1e6;
+}
+function resolveMaxBudgetUsd(flagValue2, env = process.env) {
+  if (isValidBudget(flagValue2)) return flagValue2;
+  const raw = env[BUDGET_ENV_VAR];
+  if (raw !== void 0 && raw !== "") {
+    const parsed = Number(raw);
+    if (isValidBudget(parsed)) return parsed;
+  }
+  return DEFAULT_MAX_BUDGET_USD;
+}
+function createBudgetTracker(opts) {
+  const warnFraction = opts.warnFraction ?? DEFAULT_WARN_FRACTION;
+  const warnAt = opts.maxUsd * warnFraction;
+  let spent = 0;
+  let warned = false;
+  return {
+    add(usage, model) {
+      spent += estimateTurnCostUsd(usage, model);
+    },
+    spentUsd() {
+      return spent;
+    },
+    shouldWarn() {
+      return !warned && spent > warnAt;
+    },
+    markWarned() {
+      warned = true;
+    }
+  };
+}
+
 // src/report/save-report.ts
 var import_promises3 = require("fs/promises");
 var import_node_path4 = require("path");
@@ -3696,7 +3793,7 @@ function formatTimestamp(date) {
 function makeSaveReportTool() {
   return (0, import_claude_agent_sdk3.tool)(
     "save_report",
-    "Save a diagnostic report to disk. Automatically scrubs credentials, creates a timestamped filename in reports/, and auto-creates the directory. Use at the end of each investigation or when interrupted.",
+    "Save a diagnostic report to disk. Call this ONLY after the operator has agreed to save (you must ask 'save this report? (yes/no)' and get a yes first) \u2014 or when checkpointing a partial report under budget pressure. Automatically scrubs credentials, creates a timestamped filename in reports/, and auto-creates the directory.",
     {
       content: import_zod17.z.string().describe("The full markdown diagnostic report content"),
       partial: import_zod17.z.boolean().optional().describe(
@@ -3720,170 +3817,1386 @@ function makeSaveReportTool() {
   );
 }
 
-// src/approval/gate.ts
-var import_prompts3 = require("@inquirer/prompts");
+// src/tools/bundle/index.ts
+var import_claude_agent_sdk4 = require("@anthropic-ai/claude-agent-sdk");
 
-// src/approval/display.ts
-var import_picocolors5 = __toESM(require("picocolors"));
-var IMPACT_FALLBACK = "Impact unknown \u2014 review parameters carefully";
-var DIVIDER2 = import_picocolors5.default.dim("\u2500".repeat(50));
-var LABEL_WIDTH = 8;
-function formatLabel(label) {
-  return `  ${label.padEnd(LABEL_WIDTH)}: `;
+// src/tools/bundle/list-files.ts
+var import_zod18 = require("zod");
+
+// src/bundle/known-files.ts
+var KNOWN_BUNDLE_FILES = {
+  // Host resources
+  "cpu.txt": "CPU topology, NUMA, and interrupts (lscpu, numactl, /proc/cpuinfo, /proc/interrupts)",
+  "mem.txt": "Memory usage, /proc/meminfo, and transparent-hugepage setting (free -m -t)",
+  "disk.txt": "Filesystems, mounts, block devices, and disk stats (df, mount, lsblk, fdisk, /etc/fstab, /proc/diskstats)",
+  "gpu.txt": "NVIDIA GPU inventory and state (nvidia-smi -L/-q, modinfo nvidia)",
+  "net.txt": "Network interfaces, sockets, and DNS (hostname, ifconfig, netstat, /etc/resolv.conf)",
+  // Processes
+  "ps.txt": "Full process list (ps -auxww, ps -ejHlfww)",
+  "gpudb-exe.txt": "Running gpudb processes (ps auxfwww | grep gpudb)",
+  // Hardware / firmware
+  "dmidecode.txt": "BIOS / DMI hardware inventory (dmidecode)",
+  "lshw.txt": "Hardware listing (lshw -short -numeric)",
+  "pci.txt": "PCI devices and I/O resources (lspci, /proc/ioports, /proc/iomem)",
+  // Kernel / OS
+  "dmesg.txt": "Kernel ring buffer \u2014 boot and runtime kernel messages (dmesg -T)",
+  "dmesg-timestamp.txt": "Kernel ring buffer with human-readable timestamps",
+  "sysctl.txt": "Kernel tunables (sysctl -a)",
+  "sys.txt": "OS identity, uptime, ulimits, kernel cmdline, clocksource, and loaded modules (uname, ulimit, /proc/cmdline, lsmod)",
+  "lsof.txt": "Open files and network sockets (lsof -n -P)",
+  "lslocks.txt": "Held file locks (lslocks)",
+  // Packages / linker / accounts
+  "deb.txt": "Installed Debian packages and verification (dpkg -l, dpkg -V)",
+  "rpm.txt": "Installed RPM packages (rpm -qa)",
+  "ld.so.conf.txt": "Dynamic-linker library search paths (/etc/ld.so.conf)",
+  "user.txt": "Users, groups, and the gpudb service account (whoami, id, /etc/passwd, /etc/group)",
+  "sudoers.txt": "Sudo configuration (/etc/sudoers)",
+  "etc_profile.txt": "Login shell profile (/etc/profile)",
+  "etc_bashrc.txt": "System bashrc (/etc/bashrc)",
+  "etc_host.txt": "Static hostname resolution (/etc/hosts)",
+  // Kinetica-specific
+  "gpudb.txt": "GPUdb version/build, binary md5 + ldd, and the captured gpudb.conf / gpudb_logger.conf ($GPUDB_EXE -v)",
+  "gpudb_core_etc_gpudb.conf": "The live gpudb.conf at capture time (the database's main config)",
+  "gpudb_core_etc_gpudb_logger.conf": "The logging configuration (gpudb_logger.conf)",
+  "loki-info.txt": "Loki log-index stats: labels, series, and per-class volume (logcli)",
+  "sql-queries.txt": "SQL query log extracted from Loki (logcli)",
+  "tables.txt": "Table schemas and column types (gadmin --schema), when collected",
+  "logfiles.txt": "Manifest: the log directories/files the collector enumerated",
+  "errors.txt": "Collection commands that FAILED during capture (Evidence Gaps)",
+  "proc-logs-erros.txt": "Per-process log-collection failures during capture (Evidence Gaps)"
+};
+var KIND_DESCRIPTIONS = {
+  "core-log": "Per-rank rolling Kinetica core log (the primary incident narrative)",
+  "component-log": "Component service log (sql-engine, httpd, reveal, tomcat, stats, \u2026)",
+  "loki-tail": "Last-2h Loki tail for a service (small; searched only when no core logs exist)",
+  "process-info": "Per-rank process snapshot: command line, PID, and environment (/proc/<pid>/environ)",
+  config: "Kinetica configuration file",
+  "version-info": "GPUdb version/build information",
+  "collection-errors": "Collection commands that FAILED during capture (Evidence Gaps)",
+  manifest: "Manifest of log directories/files the collector enumerated"
+};
+function basename(relPath) {
+  const parts = relPath.split("/");
+  return parts[parts.length - 1] ?? relPath;
 }
-function renderApprovalPanel(toolName, toolInput, impact, beforeAfter, reasoningSummary) {
-  const header = import_picocolors5.default.bold(import_picocolors5.default.yellow("  Mutation Approval Required"));
-  const action = `${formatLabel("Action")}${import_picocolors5.default.bold(formatToolName(toolName))}`;
-  const paramEntries = Object.entries(toolInput);
-  const paramSection = paramEntries.length === 0 ? "  (no parameters)" : paramEntries.map(([key, value]) => {
-    const formatted = typeof value === "string" ? value : JSON.stringify(value, null, 2);
-    return `  ${import_picocolors5.default.dim(key)}: ${formatted}`;
-  }).join("\n");
-  const impactLine = `${formatLabel("Impact")}${impact ?? IMPACT_FALLBACK}`;
-  const prompt = import_picocolors5.default.dim(
-    `${formatLabel("Respond")}y (proceed) | n (abort) | explain (show reasoning)`
-  );
-  const hasBeforeAfter = beforeAfter !== void 0 && beforeAfter.length > 0;
-  const beforeAfterSection = hasBeforeAfter ? beforeAfter.map(
-    (entry) => `  ${import_picocolors5.default.dim(entry.key)}: ${entry.current} ${import_picocolors5.default.yellow("->")} ${entry.proposed}`
-  ).join("\n") : null;
-  const hasReasoning = reasoningSummary !== void 0 && reasoningSummary.length > 0;
-  const reasoningSection = hasReasoning ? `${formatLabel("Reason")}${reasoningSummary}` : null;
-  const sections = ["", DIVIDER2, header, "", action, paramSection, ""];
-  if (beforeAfterSection !== null) {
-    sections.push(beforeAfterSection, "");
-  }
-  if (reasoningSection !== null) {
-    sections.push(reasoningSection, "");
-  }
-  sections.push(impactLine, "", prompt, DIVIDER2, "");
-  return sections.join("\n");
+function describeBundleFile(entry) {
+  return KNOWN_BUNDLE_FILES[basename(entry.relPath)] ?? KIND_DESCRIPTIONS[entry.kind] ?? "";
 }
 
-// src/approval/gate.ts
-var DENY_MESSAGE = "User denied this mutation. Skip and continue with the investigation.";
-var REASONING_FALLBACK = "Reasoning not available. Review the action details above before proceeding.";
-function createApprovalGate(isReadOnly) {
-  return async (toolName, toolInput, options) => {
-    if (isReadOnly(toolName)) {
-      return {
-        behavior: "allow",
-        updatedInput: toolInput,
-        toolUseID: options.toolUseID
-      };
-    }
-    const impact = options.decisionReason;
-    const panel = renderApprovalPanel(toolName, toolInput, impact);
-    console.error(panel);
-    while (true) {
-      try {
-        const raw = await (0, import_prompts3.input)({ message: "Proceed? (y/n/explain):" }, { signal: options.signal });
-        const normalized = raw.trim().toLowerCase();
-        if (normalized === "y") {
-          process.stderr.write("\n");
-          return {
-            behavior: "allow",
-            updatedInput: toolInput,
-            toolUseID: options.toolUseID
-          };
-        }
-        if (normalized === "n") {
-          process.stderr.write("\n");
-          return {
-            behavior: "deny",
-            message: DENY_MESSAGE,
-            toolUseID: options.toolUseID
-          };
-        }
-        if (normalized === "explain") {
-          const reasoning = options.decisionReason;
-          if (reasoning) {
-            console.error(`
-Agent reasoning: ${reasoning}
-`);
-          } else {
-            console.error(`
-${REASONING_FALLBACK}
-`);
-          }
-        }
-      } catch {
-        return {
-          behavior: "deny",
-          message: DENY_MESSAGE,
-          toolUseID: options.toolUseID
-        };
-      }
+// src/tools/bundle/list-files.ts
+var BundleListFilesSchema = import_zod18.z.object({
+  kind: import_zod18.z.string().optional()
+});
+async function bundleListFiles(source, args = {}) {
+  const all = source.listFiles();
+  const filtered = args.kind ? all.filter((e) => e.kind === args.kind) : all;
+  const { totalFiles, totalBytes, byKind, ranks, services } = source.inventory();
+  const version = await source.detectVersion();
+  const errors = await source.collectionErrors();
+  const files = filtered.map((e) => ({
+    file: e.relPath,
+    kind: e.kind,
+    rank: e.rank ?? "",
+    size_kb: Math.round(e.sizeBytes / 1024),
+    // What the file contains — so the agent can pick the right one without reading it.
+    description: describeBundleFile(e)
+  }));
+  return {
+    ok: true,
+    data: {
+      detected_version: version ?? "unknown",
+      ranks_present: ranks.join(", ") || "none",
+      services_present: services.join(", ") || "none",
+      total_files: totalFiles,
+      total_size_mb: Number((totalBytes / 1e6).toFixed(1)),
+      counts_by_kind: byKind,
+      failed_collections: errors.length,
+      files
     }
   };
 }
 
-// src/agent/turn-gate.ts
-function createTurnGate() {
-  let resolve2 = () => {
+// src/tools/bundle/log-timeline.ts
+var import_zod19 = require("zod");
+var BundleLogTimelineSchema = import_zod19.z.object({
+  min_severity: import_zod19.z.enum(["INFO", "WARN", "UERR", "ERROR", "FATAL"]).optional(),
+  granularity: import_zod19.z.enum(["day", "hour", "minute"]).optional(),
+  rank: import_zod19.z.string().describe('Numeric rank only, e.g. "r0"/"r1". For the host manager use host_manager.').optional(),
+  host_manager: import_zod19.z.boolean().describe("Bucket the host-manager (hm) log \u2014 a singleton service, not a rank.").optional(),
+  component: import_zod19.z.string().optional(),
+  include_components: import_zod19.z.boolean().optional()
+});
+async function bundleLogTimeline(source, args = {}) {
+  const query3 = {
+    ...args.min_severity !== void 0 ? { minSeverity: args.min_severity } : {},
+    ...args.granularity !== void 0 ? { granularity: args.granularity } : {},
+    ...args.rank !== void 0 ? { rank: args.rank } : {},
+    ...args.host_manager !== void 0 ? { hostManager: args.host_manager } : {},
+    ...args.component !== void 0 ? { component: args.component } : {},
+    ...args.include_components !== void 0 ? { includeComponents: args.include_components } : {}
   };
-  let promise = new Promise((r) => {
-    resolve2 = r;
+  const result = await source.logTimeline(query3);
+  const severities = [...new Set(result.buckets.flatMap((b) => Object.keys(b.counts)))];
+  const order = ["FATAL", "ERROR", "UERR", "WARN", "INFO"];
+  severities.sort((a, b) => order.indexOf(a) - order.indexOf(b));
+  const rows = result.buckets.map((b) => {
+    const row = { time_bucket: b.bucket };
+    for (const sev of severities) row[sev] = b.counts[sev] ?? 0;
+    row.total = b.total;
+    return row;
   });
-  return Object.freeze({
-    wait: () => promise,
-    open: () => {
-      resolve2();
-    },
-    close: () => {
-      promise = new Promise((r) => {
-        resolve2 = r;
-      });
+  return {
+    ok: true,
+    note: result.totalCounted === 0 ? "No lines at or above the severity threshold \u2014 try a lower min_severity." : `${result.totalCounted} event(s) across ${result.buckets.length} bucket(s), ${result.filesScanned.length} file(s).`,
+    data: {
+      lines_scanned: result.linesScanned,
+      files_scanned: result.filesScanned.join(", ") || "none",
+      buckets: rows
     }
-  });
+  };
 }
 
-// src/output/render-markdown.ts
-var import_picocolors6 = __toESM(require("picocolors"));
-var BOLD_RE = /\*\*(.+?)\*\*/g;
-var HEADING_RE = /^(#{1,6})\s+(.+)$/;
-function renderMarkdownLine(line) {
-  const headingMatch = HEADING_RE.exec(line);
-  if (headingMatch) {
-    return import_picocolors6.default.bold(headingMatch[2]);
+// src/tools/bundle/search-logs.ts
+var import_zod20 = require("zod");
+var BundleSearchLogsSchema = import_zod20.z.object({
+  regex: import_zod20.z.string().optional(),
+  min_severity: import_zod20.z.enum(["INFO", "WARN", "UERR", "ERROR", "FATAL"]).optional(),
+  from_ts: import_zod20.z.string().optional(),
+  to_ts: import_zod20.z.string().optional(),
+  rank: import_zod20.z.string().describe('Numeric rank only, e.g. "r0"/"r1". For the host manager use host_manager.').optional(),
+  host_manager: import_zod20.z.boolean().describe("Search the host-manager (hm) log \u2014 a singleton service, not a rank.").optional(),
+  component: import_zod20.z.string().optional(),
+  include_components: import_zod20.z.boolean().optional(),
+  max_matches: import_zod20.z.number().int().min(1).max(1e3).optional()
+});
+async function bundleSearchLogs(source, args = {}) {
+  const query3 = {
+    ...args.regex !== void 0 ? { regex: args.regex } : {},
+    ...args.min_severity !== void 0 ? { minSeverity: args.min_severity } : {},
+    ...args.from_ts !== void 0 ? { fromTs: args.from_ts } : {},
+    ...args.to_ts !== void 0 ? { toTs: args.to_ts } : {},
+    ...args.rank !== void 0 ? { rank: args.rank } : {},
+    ...args.host_manager !== void 0 ? { hostManager: args.host_manager } : {},
+    ...args.component !== void 0 ? { component: args.component } : {},
+    ...args.include_components !== void 0 ? { includeComponents: args.include_components } : {},
+    ...args.max_matches !== void 0 ? { maxMatches: args.max_matches } : {}
+  };
+  const result = await source.searchLogs(query3);
+  const note = result.capped ? `Showing ${result.matches.length} of ${result.totalMatched} matches across ${result.filesScanned.length} file(s) (display capped). Narrow with a tighter regex, severity, or time window to surface the specific lines.` : `${result.totalMatched} match(es) across ${result.filesScanned.length} file(s).`;
+  return {
+    ok: true,
+    note,
+    data: {
+      total_matched: result.totalMatched,
+      lines_scanned: result.linesScanned,
+      files_scanned: result.filesScanned.join(", ") || "none",
+      capped: result.capped,
+      matches: result.matches.map((m) => ({
+        file: m.file,
+        line: m.lineNumber,
+        timestamp: m.timestamp ?? "",
+        severity: m.severity ?? "",
+        rank: m.rank ?? "",
+        message: m.message
+      }))
+    }
+  };
+}
+
+// src/tools/bundle/read-config.ts
+var import_zod21 = require("zod");
+var BundleReadConfigSchema = import_zod21.z.object({
+  section: import_zod21.z.string().optional(),
+  key: import_zod21.z.string().optional()
+});
+async function bundleReadConfig(source, args = {}) {
+  const result = await source.readConfig({
+    ...args.section !== void 0 ? { section: args.section } : {},
+    ...args.key !== void 0 ? { key: args.key } : {}
+  });
+  if ("error" in result) {
+    return { ok: false, status: 0, error: result.error, raw: "" };
   }
-  if (line.includes("**")) {
-    return line.replace(BOLD_RE, (_, text) => import_picocolors6.default.bold(text));
+  if (result.entries.length === 0 && args.section !== void 0) {
+    const all = await source.readConfig(args.key !== void 0 ? { key: args.key } : {});
+    const sections = "error" in all ? [] : [...new Set(all.entries.map((e) => e.section))].sort();
+    const sectionList = sections.map((s) => s === "" ? "(flat/top-level)" : s).join(", ");
+    return {
+      ok: true,
+      note: `No entries in section "${args.section}" of ${result.file}. gpudb.conf is largely flat \u2014 retry filtering by key only. Sections present: ${sectionList || "(none)"}.`,
+      data: { section_not_found: args.section, available_sections: sections }
+    };
   }
-  return line;
+  return {
+    ok: true,
+    note: `${result.entries.length} entr(y/ies) from ${result.file}.`,
+    data: result.entries.map((e) => ({ section: e.section, key: e.key, value: e.value }))
+  };
 }
 
-// src/output/reformat-tables.ts
-var SEPARATOR_CELL_RE = /^:?-+:?$/;
-var BOLD_MARKERS_RE = /\*\*(.+?)\*\*/g;
-function visualWidth(text) {
-  return text.replace(BOLD_MARKERS_RE, "$1").length;
-}
-function isSeparatorCell(cell) {
-  return SEPARATOR_CELL_RE.test(cell);
-}
-function isSeparatorRow(cells) {
-  return cells.length > 0 && cells.every(isSeparatorCell);
+// src/tools/bundle/read-sysinfo.ts
+var import_zod22 = require("zod");
+var BundleReadSysinfoSchema = import_zod22.z.object({
+  name: import_zod22.z.string().min(1)
+});
+async function bundleReadSysinfo(source, args) {
+  const result = await source.readSysinfo(args.name);
+  if ("error" in result) {
+    return { ok: false, status: 0, error: result.error, raw: "" };
+  }
+  return {
+    ok: true,
+    data: {
+      ...result.header !== void 0 ? { source_file: result.header } : {},
+      blocks: result.blocks.map((b) => ({
+        command: b.command,
+        ...b.exitCode !== void 0 ? { exit_code: b.exitCode } : {},
+        output: b.output
+      }))
+    }
+  };
 }
-function parseCells(line) {
-  return line.split("|").slice(1, -1).map((c) => c.trim());
+
+// src/tools/bundle/load-bundle.ts
+var import_zod23 = require("zod");
+
+// src/bundle/verify-bundle.ts
+var import_promises6 = require("fs/promises");
+
+// src/bundle/BundleSource.ts
+var import_promises5 = require("fs/promises");
+var import_node_path6 = require("path");
+
+// src/bundle/sysinfo-block.ts
+var SEPARATOR_RE = /^-{3,}$/;
+var EXEC_CMD_RE = /^EXEC_CMD:\s?(.*)$/;
+var EXEC_END_RE = /^EXEC_END with exit code (\d+)\s*:?\s*(.*)$/;
+var SHOWING_RE = /^### Showing whole log file\s*:/;
+function trimBlankEdges(lines) {
+  let start = 0;
+  let end = lines.length;
+  while (start < end && lines[start].trim() === "") start++;
+  while (end > start && lines[end - 1].trim() === "") end--;
+  return lines.slice(start, end).join("\n");
+}
+function parseSysinfo(content) {
+  const lines = content.split("\n");
+  let header;
+  const blocks = [];
+  let current;
+  let sawCommand = false;
+  const closeBlock = (exitCode, exitMessage) => {
+    if (!current) return;
+    blocks.push({
+      command: current.command,
+      output: trimBlankEdges(current.output),
+      ...exitCode !== void 0 ? { exitCode } : {},
+      ...exitMessage !== void 0 && exitMessage !== "" ? { exitMessage } : {}
+    });
+    current = void 0;
+  };
+  for (const line of lines) {
+    if (SEPARATOR_RE.test(line)) continue;
+    const cmdMatch = EXEC_CMD_RE.exec(line);
+    if (cmdMatch) {
+      closeBlock();
+      current = { command: cmdMatch[1].trim(), output: [] };
+      sawCommand = true;
+      continue;
+    }
+    const endMatch = EXEC_END_RE.exec(line);
+    if (endMatch && current) {
+      closeBlock(Number(endMatch[1]), endMatch[2].trim());
+      continue;
+    }
+    if (current) {
+      if (SHOWING_RE.test(line)) continue;
+      current.output.push(line);
+      continue;
+    }
+    if (header === void 0 && !sawCommand && line.trim() !== "") {
+      header = line.trim();
+    }
+  }
+  closeBlock();
+  return { ...header !== void 0 ? { header } : {}, blocks };
 }
-function reformatTableBlock(lines) {
-  const parsed = lines.map(parseCells);
-  const colCount = Math.max(...parsed.map((row) => row.length));
-  const normalised = parsed.map((row) => {
-    const padded = [...row];
-    while (padded.length < colCount) {
-      padded.push("");
+
+// src/bundle/parse-ini.ts
+var SECTION_RE = /^\[(.+)\]$/;
+function parseIni(content) {
+  const entries = [];
+  let section = "";
+  for (const rawLine of content.split("\n")) {
+    const line = rawLine.trim();
+    if (line === "" || line.startsWith("#") || line.startsWith(";")) continue;
+    const sectionMatch = SECTION_RE.exec(line);
+    if (sectionMatch) {
+      section = sectionMatch[1].trim();
+      continue;
     }
-    return padded;
+    const eq = line.indexOf("=");
+    if (eq === -1) continue;
+    const key = line.slice(0, eq).trim();
+    const value = line.slice(eq + 1).trim();
+    if (key) entries.push({ section, key, value });
+  }
+  return entries;
+}
+function filterIni(entries, opts = {}) {
+  const section = opts.section?.toLowerCase();
+  const key = opts.key?.toLowerCase();
+  return entries.filter((e) => {
+    if (section !== void 0 && e.section.toLowerCase() !== section) return false;
+    if (key !== void 0 && !e.key.toLowerCase().includes(key)) return false;
+    return true;
   });
-  const colWidths = Array.from(
-    { length: colCount },
-    (_, col) => Math.max(
-      3,
-      ...normalised.filter((row) => !isSeparatorRow(row)).map((row) => visualWidth(row[col]))
-    )
+}
+
+// src/bundle/log-search.ts
+var import_node_fs4 = require("fs");
+var import_node_readline = require("readline");
+
+// src/bundle/parse-log-line.ts
+var PREFIX_RE = /^(\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}\.\d+)\s+([A-Z]+)\s+\(([^)]*)\)\s*(.*)$/;
+var CORE_TAIL_RE = /^(\S+)\s+(\S+:\d+)\s+-\s+(.*)$/;
+var RANK_RE = /^(r\d+)\b/;
+var SEVERITY_RANK = {
+  TRACE: 0,
+  DEBUG: 1,
+  INFO: 2,
+  WARN: 3,
+  UERR: 4,
+  ERROR: 5,
+  FATAL: 6
+};
+function severityRank(severity) {
+  if (severity === void 0) return -1;
+  return SEVERITY_RANK[severity] ?? -1;
+}
+function parseLogLine(line) {
+  const match = PREFIX_RE.exec(line);
+  if (!match) {
+    return { message: line, raw: line };
+  }
+  const [, timestamp, severity, paren, rest] = match;
+  const parts = paren.split(",");
+  const pid = parts[0]?.trim() || void 0;
+  const tid = parts[1]?.trim() || void 0;
+  const context = parts.slice(2).join(",").trim() || void 0;
+  const rank = context ? RANK_RE.exec(context)?.[1] ?? void 0 : void 0;
+  const coreTail = CORE_TAIL_RE.exec(rest);
+  if (coreTail) {
+    const [, host, source, message] = coreTail;
+    return { timestamp, severity, pid, tid, context, rank, host, source, message, raw: line };
+  }
+  return { timestamp, severity, pid, tid, context, rank, message: rest, raw: line };
+}
+
+// src/bundle/log-search.ts
+var DEFAULT_MAX_MATCHES = 200;
+var REGEX_SCAN_MAX = 8192;
+var GRANULARITY_LEN = {
+  day: 10,
+  // "2026-06-11"
+  hour: 13,
+  // "2026-06-11 15"
+  minute: 16
+  // "2026-06-11 15:18"
+};
+function compileRegex(query3) {
+  if (query3.regex === void 0) return void 0;
+  return new RegExp(query3.regex, query3.caseSensitive ? void 0 : "i");
+}
+var TS_FLOOR = "0000-01-01 00:00:00.000";
+var TS_CEIL = "9999-12-31 23:59:59.999";
+var SAFE_PREFIX_LENS = [4, 7, 10, 13, 16, 19];
+function alignPrefixLen(len) {
+  let aligned = 0;
+  for (const n of SAFE_PREFIX_LENS) if (n <= len) aligned = n;
+  return aligned;
+}
+function floorTimestamp(ts) {
+  if (ts.length >= TS_FLOOR.length) return ts;
+  const len = alignPrefixLen(ts.length);
+  return ts.slice(0, len) + TS_FLOOR.slice(len);
+}
+function ceilTimestamp(ts) {
+  if (ts.length >= TS_CEIL.length) return ts;
+  const len = alignPrefixLen(ts.length);
+  return ts.slice(0, len) + TS_CEIL.slice(len);
+}
+function matchesFilters(parsed, query3, regex, minRank) {
+  if (regex && !regex.test(parsed.raw.slice(0, REGEX_SCAN_MAX))) return false;
+  if (query3.minSeverity !== void 0 && severityRank(parsed.severity) < minRank) return false;
+  if (query3.rank !== void 0 && parsed.rank !== query3.rank) return false;
+  if (query3.fromTs !== void 0 && (parsed.timestamp === void 0 || parsed.timestamp < query3.fromTs))
+    return false;
+  if (query3.toTs !== void 0 && (parsed.timestamp === void 0 || parsed.timestamp > query3.toTs))
+    return false;
+  return true;
+}
+async function searchLogFile(filePath, query3) {
+  const maxMatches = query3.maxMatches ?? DEFAULT_MAX_MATCHES;
+  const minRank = query3.minSeverity !== void 0 ? severityRank(query3.minSeverity) : -Infinity;
+  let regex;
+  try {
+    regex = compileRegex(query3);
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return {
+      matches: [],
+      totalMatched: 0,
+      linesScanned: 0,
+      capped: false,
+      error: `invalid regex: ${message}`
+    };
+  }
+  const boundedQuery = {
+    ...query3,
+    ...query3.fromTs !== void 0 ? { fromTs: floorTimestamp(query3.fromTs) } : {},
+    ...query3.toTs !== void 0 ? { toTs: ceilTimestamp(query3.toTs) } : {}
+  };
+  const matches = [];
+  let totalMatched = 0;
+  let linesScanned = 0;
+  try {
+    const rl = (0, import_node_readline.createInterface)({
+      input: (0, import_node_fs4.createReadStream)(filePath, { encoding: "utf-8" }),
+      crlfDelay: Infinity
+    });
+    for await (const line of rl) {
+      linesScanned++;
+      const parsed = parseLogLine(line);
+      if (!matchesFilters(parsed, boundedQuery, regex, minRank)) continue;
+      totalMatched++;
+      if (matches.length < maxMatches) {
+        matches.push({
+          lineNumber: linesScanned,
+          ...parsed.timestamp !== void 0 ? { timestamp: parsed.timestamp } : {},
+          ...parsed.severity !== void 0 ? { severity: parsed.severity } : {},
+          ...parsed.rank !== void 0 ? { rank: parsed.rank } : {},
+          message: parsed.message,
+          raw: parsed.raw
+        });
+      }
+    }
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return {
+      matches,
+      totalMatched,
+      linesScanned,
+      capped: totalMatched > matches.length,
+      error: message
+    };
+  }
+  return { matches, totalMatched, linesScanned, capped: totalMatched > matches.length };
+}
+async function aggregateTimeline(filePath, query3 = {}) {
+  const granularity = query3.granularity ?? "hour";
+  const prefixLen = GRANULARITY_LEN[granularity];
+  const minRank = severityRank(query3.minSeverity ?? "WARN");
+  const buckets = /* @__PURE__ */ new Map();
+  let linesScanned = 0;
+  let totalCounted = 0;
+  try {
+    const rl = (0, import_node_readline.createInterface)({
+      input: (0, import_node_fs4.createReadStream)(filePath, { encoding: "utf-8" }),
+      crlfDelay: Infinity
+    });
+    for await (const line of rl) {
+      linesScanned++;
+      const parsed = parseLogLine(line);
+      if (parsed.timestamp === void 0 || parsed.severity === void 0) continue;
+      if (severityRank(parsed.severity) < minRank) continue;
+      if (query3.rank !== void 0 && parsed.rank !== query3.rank) continue;
+      const key = parsed.timestamp.slice(0, prefixLen);
+      const bucket = buckets.get(key) ?? {};
+      bucket[parsed.severity] = (bucket[parsed.severity] ?? 0) + 1;
+      buckets.set(key, bucket);
+      totalCounted++;
+    }
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return { buckets: [], linesScanned, totalCounted, error: message };
+  }
+  const result = [];
+  for (const [bucket, counts] of buckets) {
+    const total = Object.values(counts).reduce((a, b) => a + b, 0);
+    result.push({ bucket, counts, total });
+  }
+  return { buckets: result, linesScanned, totalCounted };
+}
+
+// src/bundle/bundle-index.ts
+var import_promises4 = require("fs/promises");
+var import_node_path5 = require("path");
+
+// src/bundle/classify-file.ts
+var ROLLING_ID_RE = /core-gpudb-rolling-(r\d+|hm)\.log$/;
+var EXE_ID_RE = /gpudb-exe-(r\d+|hm)-/;
+var HOST_RE = /\b(node\w+)\b/;
+function rankOrService(id) {
+  return id === "hm" ? { service: "host-manager" } : { rank: id };
+}
+function basename2(relPath) {
+  const parts = relPath.split("/");
+  return parts[parts.length - 1] ?? relPath;
+}
+function dirOf(relPath) {
+  const parts = relPath.split("/");
+  return parts.length > 1 ? parts[parts.length - 2] : "";
+}
+function inferHost(relPath) {
+  return HOST_RE.exec(relPath)?.[1] ?? void 0;
+}
+function componentName(base) {
+  return base.replace(/(\.log)+$/, "").replace(/^core-gpudb-/, "").replace(/^gpudb-/, "").replace(/-node\w+$/, "");
+}
+function classifyFile(relPath) {
+  const base = basename2(relPath);
+  const dir = dirOf(relPath);
+  const host = inferHost(relPath);
+  if (base.endsWith(".conf")) {
+    return { kind: "config", ...host ? { host } : {} };
+  }
+  if (base === "logfiles.txt") {
+    return { kind: "manifest", ...host ? { host } : {} };
+  }
+  if (base === "errors.txt" || base.endsWith("erros.txt")) {
+    return { kind: "collection-errors", ...host ? { host } : {} };
+  }
+  if (base === "gpudb.txt") {
+    return { kind: "version-info", ...host ? { host } : {} };
+  }
+  const exeId = EXE_ID_RE.exec(base);
+  if (exeId) {
+    return { kind: "process-info", ...rankOrService(exeId[1]), ...host ? { host } : {} };
+  }
+  if (base.endsWith(".log")) {
+    const rolling = ROLLING_ID_RE.exec(base);
+    if (rolling) {
+      return { kind: "core-log", ...rankOrService(rolling[1]), ...host ? { host } : {} };
+    }
+    if (dir === "logs") {
+      return { kind: "loki-tail", component: componentName(base), ...host ? { host } : {} };
+    }
+    return { kind: "component-log", component: componentName(base), ...host ? { host } : {} };
+  }
+  if (base.endsWith(".txt")) {
+    return { kind: "os-diag", ...host ? { host } : {} };
+  }
+  return { kind: "unknown", ...host ? { host } : {} };
+}
+
+// src/bundle/bundle-index.ts
+async function buildIndex(rootDir) {
+  let relPaths;
+  try {
+    relPaths = await (0, import_promises4.readdir)(rootDir, { recursive: true });
+  } catch {
+    return [];
+  }
+  const settled = await Promise.all(
+    relPaths.map(async (rel) => {
+      const relPath = rel.split("\\").join("/");
+      const absPath = (0, import_node_path5.join)(rootDir, rel);
+      try {
+        const s = await (0, import_promises4.lstat)(absPath);
+        if (s.isSymbolicLink() || !s.isFile()) return null;
+        const c = classifyFile(relPath);
+        return {
+          relPath,
+          absPath,
+          kind: c.kind,
+          ...c.rank !== void 0 ? { rank: c.rank } : {},
+          ...c.service !== void 0 ? { service: c.service } : {},
+          ...c.host !== void 0 ? { host: c.host } : {},
+          ...c.component !== void 0 ? { component: c.component } : {},
+          sizeBytes: s.size
+        };
+      } catch {
+        return null;
+      }
+    })
+  );
+  return settled.filter((e) => e !== null).sort((a, b) => a.relPath.localeCompare(b.relPath));
+}
+
+// src/bundle/BundleSource.ts
+var GPUDB_VERSION_RE = /GPUdb version\s*:\s*(\S+)/;
+function selectLogFiles(index, opts) {
+  if (opts.component !== void 0) {
+    return index.filter((e) => e.kind === "component-log" && e.component === opts.component);
+  }
+  if (opts.hostManager) {
+    return index.filter((e) => e.kind === "core-log" && e.service === "host-manager");
+  }
+  let core = index.filter(
+    (e) => e.kind === "core-log" && (opts.rank === void 0 || e.rank === opts.rank)
+  );
+  if (core.length === 0) {
+    core = index.filter((e) => e.kind === "loki-tail");
+  }
+  if (opts.includeComponents) {
+    return [...core, ...index.filter((e) => e.kind === "component-log")];
+  }
+  return core;
+}
+function toLineQuery(q) {
+  return {
+    ...q.regex !== void 0 ? { regex: q.regex } : {},
+    ...q.caseSensitive !== void 0 ? { caseSensitive: q.caseSensitive } : {},
+    ...q.minSeverity !== void 0 ? { minSeverity: q.minSeverity } : {},
+    ...q.fromTs !== void 0 ? { fromTs: q.fromTs } : {},
+    ...q.toTs !== void 0 ? { toTs: q.toTs } : {},
+    ...q.maxMatches !== void 0 ? { maxMatches: q.maxMatches } : {}
+  };
+}
+function toTimelineLineQuery(q) {
+  return {
+    ...q.minSeverity !== void 0 ? { minSeverity: q.minSeverity } : {},
+    ...q.granularity !== void 0 ? { granularity: q.granularity } : {}
+  };
+}
+async function createBundleSource(rootDir) {
+  const root = (0, import_node_path6.resolve)(rootDir);
+  const index = await buildIndex(root);
+  const resolve3 = (relPath) => {
+    const abs = (0, import_node_path6.resolve)(root, relPath);
+    if (abs !== root && !abs.startsWith(root + import_node_path6.sep)) return void 0;
+    return abs;
+  };
+  const findByKind = (kind) => index.find((e) => e.kind === kind);
+  const inventoryValue = (() => {
+    const byKind = {};
+    const rankSet = /* @__PURE__ */ new Set();
+    const serviceSet = /* @__PURE__ */ new Set();
+    let totalBytes = 0;
+    for (const e of index) {
+      byKind[e.kind] = (byKind[e.kind] ?? 0) + 1;
+      totalBytes += e.sizeBytes;
+      if (e.rank) rankSet.add(e.rank);
+      if (e.service) serviceSet.add(e.service);
+    }
+    return {
+      totalFiles: index.length,
+      totalBytes,
+      byKind,
+      ranks: [...rankSet].sort(),
+      services: [...serviceSet].sort()
+    };
+  })();
+  const detectVersion = async () => {
+    const versionFile = findByKind("version-info");
+    if (versionFile) {
+      try {
+        const parsed = parseSysinfo(await (0, import_promises5.readFile)(versionFile.absPath, "utf-8"));
+        for (const block of parsed.blocks) {
+          const m = GPUDB_VERSION_RE.exec(block.output);
+          if (m) return m[1];
+        }
+      } catch {
+      }
+    }
+    const configFile = findByKind("config");
+    if (configFile) {
+      try {
+        const entries = parseIni(await (0, import_promises5.readFile)(configFile.absPath, "utf-8"));
+        return entries.find((e) => e.key === "file_version")?.value;
+      } catch {
+        return void 0;
+      }
+    }
+    return void 0;
+  };
+  const readConfig = async (opts = {}) => {
+    const configFile = index.find((e) => e.kind === "config" && e.relPath.endsWith("gpudb.conf")) ?? findByKind("config");
+    if (!configFile) return { error: "no gpudb.conf found in bundle" };
+    try {
+      const entries = parseIni(await (0, import_promises5.readFile)(configFile.absPath, "utf-8"));
+      return { entries: filterIni(entries, opts), file: configFile.relPath };
+    } catch (err) {
+      return { error: err instanceof Error ? err.message : String(err) };
+    }
+  };
+  const readSysinfo = async (name) => {
+    const entry = index.find(
+      (e) => e.relPath === name || e.relPath.endsWith("/" + name) || e.relPath.split("/").pop() === name
+    );
+    if (!entry) return { error: `no bundle file named "${name}"` };
+    const abs = resolve3(entry.relPath);
+    if (!abs) return { error: `path "${name}" escapes the bundle root` };
+    try {
+      return parseSysinfo(await (0, import_promises5.readFile)(abs, "utf-8"));
+    } catch (err) {
+      return { error: err instanceof Error ? err.message : String(err) };
+    }
+  };
+  const searchLogs = async (query3) => {
+    const files = selectLogFiles(index, query3);
+    const lineQuery = toLineQuery(query3);
+    const matches = [];
+    const filesScanned = [];
+    let totalMatched = 0;
+    let linesScanned = 0;
+    const maxMatches = query3.maxMatches ?? DEFAULT_MAX_MATCHES;
+    for (const file of files) {
+      const remaining = Math.max(0, maxMatches - matches.length);
+      const r = await searchLogFile(file.absPath, { ...lineQuery, maxMatches: remaining });
+      filesScanned.push(file.relPath);
+      totalMatched += r.totalMatched;
+      linesScanned += r.linesScanned;
+      for (const m of r.matches) matches.push({ ...m, file: file.relPath });
+    }
+    return {
+      matches,
+      totalMatched,
+      linesScanned,
+      filesScanned,
+      capped: totalMatched > matches.length
+    };
+  };
+  const logTimeline = async (query3) => {
+    const files = selectLogFiles(index, query3);
+    const lineQuery = toTimelineLineQuery(query3);
+    const merged = /* @__PURE__ */ new Map();
+    const filesScanned = [];
+    let linesScanned = 0;
+    let totalCounted = 0;
+    for (const file of files) {
+      const r = await aggregateTimeline(file.absPath, lineQuery);
+      filesScanned.push(file.relPath);
+      linesScanned += r.linesScanned;
+      totalCounted += r.totalCounted;
+      for (const b of r.buckets) {
+        const existing = merged.get(b.bucket) ?? {};
+        for (const [sev, n] of Object.entries(b.counts)) existing[sev] = (existing[sev] ?? 0) + n;
+        merged.set(b.bucket, existing);
+      }
+    }
+    const buckets = [...merged.entries()].sort((a, b) => a[0].localeCompare(b[0])).map(([bucket, counts]) => ({
+      bucket,
+      counts,
+      total: Object.values(counts).reduce((x, y) => x + y, 0)
+    }));
+    return { buckets, linesScanned, totalCounted, filesScanned };
+  };
+  const collectionErrors = async () => {
+    const files = index.filter((e) => e.kind === "collection-errors");
+    const lines = [];
+    for (const file of files) {
+      try {
+        const content = await (0, import_promises5.readFile)(file.absPath, "utf-8");
+        for (const line of content.split("\n")) {
+          const trimmed = line.trim();
+          if (trimmed !== "" && !/^-{3,}$/.test(trimmed)) lines.push(trimmed);
+        }
+      } catch {
+      }
+    }
+    return lines;
+  };
+  return {
+    root,
+    listFiles: () => index,
+    inventory: () => inventoryValue,
+    resolve: resolve3,
+    detectVersion,
+    readConfig,
+    readSysinfo,
+    searchLogs,
+    logTimeline,
+    collectionErrors
+  };
+}
+
+// src/bundle/verify-bundle.ts
+var ARCHIVE_RE = /\.(tgz|tar\.gz|tar|gz|zip)$/i;
+var EXPECTED_KINDS = ["config", "core-log"];
+async function verifyBundle(bundlePath) {
+  let info;
+  try {
+    info = await (0, import_promises6.stat)(bundlePath);
+  } catch {
+    return { ok: false, error: `bundle path does not exist: ${bundlePath}` };
+  }
+  if (!info.isDirectory()) {
+    if (ARCHIVE_RE.test(bundlePath)) {
+      return {
+        ok: false,
+        error: `bundle mode expects an extracted directory, not an archive. Run \`tar xzf ${bundlePath}\` and pass the resulting directory.`
+      };
+    }
+    return { ok: false, error: `bundle path is not a directory: ${bundlePath}` };
+  }
+  const bundleSource = await createBundleSource(bundlePath);
+  const inventory = bundleSource.inventory();
+  if (inventory.totalFiles === 0) {
+    return { ok: false, error: `no readable files found in bundle directory: ${bundlePath}` };
+  }
+  const missingExpected = EXPECTED_KINDS.filter((k) => (inventory.byKind[k] ?? 0) === 0);
+  const kineticaVersion = await bundleSource.detectVersion();
+  return {
+    ok: true,
+    bundleSource,
+    ...kineticaVersion !== void 0 ? { kineticaVersion } : {},
+    inventory,
+    missingExpected
+  };
+}
+
+// src/tools/bundle/load-bundle.ts
+var BundleLoadSchema = import_zod23.z.object({
+  path: import_zod23.z.string().min(1).optional()
+});
+async function bundleLoad(holder, args, promptForPath, confirmPath) {
+  let path2;
+  if (args.path !== void 0) {
+    if (confirmPath && !await confirmPath(args.path)) {
+      return {
+        ok: false,
+        status: 0,
+        error: `Operator declined to load a bundle from "${args.path}".`,
+        raw: args.path
+      };
+    }
+    path2 = args.path;
+  } else {
+    path2 = promptForPath ? await promptForPath() : void 0;
+  }
+  if (!path2) {
+    return {
+      ok: false,
+      status: 0,
+      error: "No bundle path provided and no directory picker is available. Ask the operator for the extracted bundle directory path and pass it as `path`.",
+      raw: ""
+    };
+  }
+  const result = await verifyBundle(path2);
+  if (!result.ok) {
+    return { ok: false, status: 0, error: result.error, raw: path2 };
+  }
+  holder.set(result.bundleSource);
+  const missingNote = result.missingExpected.length > 0 ? ` Missing expected artifact(s): ${result.missingExpected.join(", ")} (treat as Evidence Gaps).` : "";
+  return {
+    ok: true,
+    // Loading a bundle is SETUP, not an investigation. Do not auto-proceed — the
+    // operator hasn't said what they want yet. End the turn and ask.
+    note: `Bundle attached. Do NOT start investigating yet \u2014 ask the operator what they want to investigate, then proceed.${missingNote}`,
+    data: {
+      loaded: true,
+      path: path2,
+      detected_version: result.kineticaVersion ?? "unknown",
+      total_files: result.inventory.totalFiles,
+      ranks_present: result.inventory.ranks.join(", ") || "none",
+      counts_by_kind: result.inventory.byKind,
+      missing_expected: result.missingExpected.join(", ") || "none"
+    }
+  };
+}
+
+// src/tools/bundle/index.ts
+var BUNDLE_TOOL_NAMES = [
+  "kinetica_load_bundle",
+  "kinetica_bundle_list_files",
+  "kinetica_bundle_log_timeline",
+  "kinetica_bundle_search_logs",
+  "kinetica_bundle_read_config",
+  "kinetica_bundle_read_sysinfo"
+];
+var text = (s) => ({ content: [{ type: "text", text: s }] });
+function notLoaded() {
+  return {
+    ok: false,
+    status: 0,
+    error: "No support bundle is loaded. Ask the operator for the extracted bundle directory path and call kinetica_load_bundle first.",
+    raw: ""
+  };
+}
+async function withSource(holder, fn) {
+  const source = holder.get();
+  if (!source) return applyOutputPipeline(notLoaded());
+  return applyOutputPipeline(await fn(source));
+}
+function makeLoadBundleTool(holder, deps) {
+  return (0, import_claude_agent_sdk4.tool)(
+    "kinetica_load_bundle",
+    "Attach an extracted Kinetica support bundle (gpudb_sysinfo directory) so the kinetica_bundle_* tools can read its logs/config/host-diagnostics. When the operator wants to analyze a support bundle, call this tool WITHOUT a path \u2014 they will be shown an interactive directory picker to choose it. Do NOT ask for the path in chat. (You may pass an explicit `path` if the operator already gave you one; it must be a directory, not a .tgz.)",
+    BundleLoadSchema.shape,
+    async (args) => text(
+      applyOutputPipeline(await bundleLoad(holder, args, deps?.promptForPath, deps?.confirmPath))
+    ),
+    { annotations: { readOnly: true } }
+  );
+}
+function makeListFilesTool(holder) {
+  return (0, import_claude_agent_sdk4.tool)(
+    "kinetica_bundle_list_files",
+    "Inventory the attached support bundle: detected GPUdb version, ranks present (numeric ranks only), services present (e.g. host-manager \u2014 a singleton service, NOT a rank), file counts/sizes by kind, and how many collection commands failed. Each file row includes a `description` of what it contains (e.g. mem.txt \u2192 memory/THP, gpu.txt \u2192 nvidia-smi) so you can pick the right file without reading it. Call this FIRST after a bundle is attached. Optional `kind` filters the file list (e.g. core-log, component-log, config, os-diag).",
+    BundleListFilesSchema.shape,
+    async (args) => text(await withSource(holder, (s) => bundleListFiles(s, args))),
+    { annotations: { readOnly: true } }
+  );
+}
+function makeLogTimelineTool(holder) {
+  return (0, import_claude_agent_sdk4.tool)(
+    "kinetica_bundle_log_timeline",
+    "Aggregate bundle log lines into per-time-bucket severity counts across ranks \u2014 the incident shape. Call this BEFORE search_logs to find WHEN errors spiked, then drill in with a tight time window. Defaults: min_severity=WARN, granularity=hour, core logs (all ranks AND the host manager). Narrow with rank=<r0|r1|\u2026> (numeric ranks only) or host_manager=true for the host-manager log (a service, not a rank). Set include_components=true or component=<name> to include component logs. Note severity order is WARN < UERR < ERROR < FATAL, so min_severity=ERROR EXCLUDES UERR (user-error) lines \u2014 use UERR or WARN to include them.",
+    BundleLogTimelineSchema.shape,
+    async (args) => text(await withSource(holder, (s) => bundleLogTimeline(s, args))),
+    { annotations: { readOnly: true } }
+  );
+}
+function makeSearchLogsTool(holder) {
+  return (0, import_claude_agent_sdk4.tool)(
+    "kinetica_bundle_search_logs",
+    "Search bundle logs for matching lines by regex (case-insensitive), min_severity, time window (from_ts/to_ts as 'YYYY-MM-DD HH:MM:SS.mmm'; a partial prefix like a timeline bucket label '2026-06-11 15' also works \u2014 it is widened to cover that whole period), and rank/host_manager/component. Streamed and bounded \u2014 the default 200-match cap is shared across all files; when capped, narrow the query (the total may be a lower bound). Defaults to core logs across all ranks AND the host manager; narrow with rank=<r0|r1|\u2026> (numeric ranks only) or host_manager=true for the host-manager log (a service, not a rank); set component or include_components for component logs. Severity order is WARN < UERR < ERROR < FATAL, so min_severity=ERROR EXCLUDES UERR (user-error) lines.",
+    BundleSearchLogsSchema.shape,
+    async (args) => text(await withSource(holder, (s) => bundleSearchLogs(s, args))),
+    { annotations: { readOnly: true } }
+  );
+}
+function makeReadConfigTool(holder) {
+  return (0, import_claude_agent_sdk4.tool)(
+    "kinetica_bundle_read_config",
+    "Read gpudb.conf from the attached bundle (the real on-disk config). Optionally filter by `section` (exact, case-insensitive) and/or `key` (substring, case-insensitive). Interpolation references like ${gaia.host0.address} are returned verbatim.",
+    BundleReadConfigSchema.shape,
+    async (args) => text(await withSource(holder, (s) => bundleReadConfig(s, args))),
+    { annotations: { readOnly: true } }
+  );
+}
+function makeReadSysinfoTool(holder) {
+  return (0, import_claude_agent_sdk4.tool)(
+    "kinetica_bundle_read_sysinfo",
+    "Read an OS-diagnostic / process / version file's command blocks by name (e.g. mem.txt, cpu.txt, disk.txt, gpu.txt, net.txt, ps.txt, gpudb.txt, gpudb-exe-r0-*.txt). Returns each wrapped shell command and its output \u2014 host-level facts (memory, GPU, disk, THP, process args) the live endpoints never expose.",
+    BundleReadSysinfoSchema.shape,
+    async (args) => text(await withSource(holder, (s) => bundleReadSysinfo(s, args))),
+    { annotations: { readOnly: true } }
+  );
+}
+function makeBundleTools(holder, deps) {
+  return [
+    makeLoadBundleTool(holder, deps),
+    makeListFilesTool(holder),
+    makeLogTimelineTool(holder),
+    makeSearchLogsTool(holder),
+    makeReadConfigTool(holder),
+    makeReadSysinfoTool(holder)
+  ];
+}
+function createBundleRegistry() {
+  return BUNDLE_TOOL_NAMES.reduce(
+    (registry, name) => registry.registerReadOnlyTool(name),
+    createRegistry()
+  );
+}
+
+// src/tools/bundle/catalog.ts
+var BUNDLE_TOOL_CATALOG = {
+  kinetica_load_bundle: {
+    reveals: "Attaches an extracted support bundle (directory path) for offline analysis",
+    whenToUse: "When the operator wants to analyze a support bundle \u2014 ask for the path, then load"
+  },
+  kinetica_bundle_list_files: {
+    reveals: "Bundle inventory: detected version, ranks, file kinds/sizes, failed collections",
+    whenToUse: "First action of every bundle investigation (orientation)"
+  },
+  kinetica_bundle_log_timeline: {
+    reveals: "WARN+ log lines bucketed by time + severity across ranks (incident shape)",
+    whenToUse: "Right after list_files \u2014 find WHEN errors spiked before drilling in"
+  },
+  kinetica_bundle_search_logs: {
+    reveals: "Matching log lines by regex/severity/time-window/rank (bounded, streamed)",
+    whenToUse: "Drill into a time window or error pattern surfaced by the timeline"
+  },
+  kinetica_bundle_read_config: {
+    reveals: "gpudb.conf entries (the real on-disk config), filterable by section/key",
+    whenToUse: "Config drift, misconfiguration, parameter verification"
+  },
+  kinetica_bundle_read_sysinfo: {
+    reveals: "OS-diag / process / version command blocks (mem, cpu, disk, gpu, ps, gpudb.txt)",
+    whenToUse: "Host-level facts: memory pressure, GPU presence, disk, THP, process args"
+  }
+};
+function buildBundleEvidenceChecklist() {
+  const rows = BUNDLE_TOOL_NAMES.map((name) => {
+    const entry = BUNDLE_TOOL_CATALOG[name];
+    return `| ${name} | ${entry.reveals} | ${entry.whenToUse} |`;
+  });
+  return [
+    "| Tool | What it reveals | When to use |",
+    "|------|----------------|-------------|",
+    ...rows
+  ].join("\n");
+}
+
+// src/agent/bundle-system-prompt.ts
+function buildBundleSystemPrompt(kineticaVersion, playbooks, references, bundleReferences) {
+  const t = "`";
+  const versionSection = kineticaVersion ? `**Kinetica Version:** ${kineticaVersion} (detected from the bundle's gpudb.txt / gpudb.conf)` : "**Kinetica Version:** Unknown \u2014 check gpudb.txt via kinetica_bundle_read_sysinfo, or file_version via kinetica_bundle_read_config.";
+  return `You are an expert Kinetica GPU database administrator and diagnostician. You are operating in OFFLINE BUNDLE MODE: instead of a live database, you are investigating an extracted support bundle (gpudb_sysinfo) \u2014 a snapshot of logs, configuration, and host diagnostics captured from a node at a point in time.
+
+${versionSection}
+
+---
+
+## OFFLINE BUNDLE MODE \u2014 What This Means
+
+**You are reading frozen, point-in-time evidence \u2014 not a live system.**
+
+- You CANNOT run SQL, query system tables, re-probe the cluster, or apply fixes. There are no mutation tools. Your job is to diagnose from the captured files and RECOMMEND remediation for the operator to apply against the live system later.
+- The single highest-value evidence here is the **logs** \u2014 the live system exposes no log endpoint, so this is the one place the incident's narrative (the lead-up, the error cascade, the crash) is visible. Lean on them.
+- A bundle covers **one node**. It may contain multiple ranks (e.g. r0, r1) plus the host manager. The host manager is a singleton service (port 9300), **not a rank** \u2014 to search/timeline its log, pass ${t}host_manager: true${t} (NOT ${t}rank: "hm"${t}); ${t}kinetica_bundle_list_files${t} lists it under ${t}services_present${t}. Cross-node correlation is not possible from a single bundle.
+- **Do not assume cluster-wide clock synchronization.** Correlate events by message content as well as timestamp; note when timing is ambiguous.
+- Some collection commands may have FAILED (e.g. nvidia-smi on a CPU-only host). ${t}kinetica_bundle_list_files${t} reports how many \u2014 treat absent artifacts as Evidence Gaps, not as healthy.
+
+---
+
+## Investigation Protocol (read-only)
+
+### Pre-Investigation: Announce Your Plan
+
+Before gathering evidence, announce a brief 2-3 line plan: restate the issue, list the first tools you'll use, then begin immediately.
+
+### Round 1 \u2014 Orient
+
+- ${t}kinetica_bundle_list_files${t} \u2014 **ALWAYS FIRST.** Learn the detected version, which ranks are present, what file kinds exist, and how many collections failed.
+- ${t}kinetica_bundle_log_timeline${t} (min_severity: WARN) \u2014 get the incident shape: when did WARN/ERROR/FATAL spike, and on which rank?
+
+### Round 2 \u2014 Drill Down
+
+Based on the timeline, narrow in:
+- ${t}kinetica_bundle_search_logs${t} \u2014 search the spike window by regex/severity/rank. You can pass the timeline's hot bucket label straight into from_ts/to_ts (e.g. from_ts/to_ts = ${t}2026-06-11 15${t} searches that whole hour). Look for FATAL/ERROR clusters, stack traces, OOM, segfaults, failed allocations, stale-rank/heartbeat loss, rebalance failures. Remember UERR (user errors) rank below ERROR \u2014 use min_severity=WARN or UERR to include them.
+- ${t}kinetica_bundle_read_sysinfo${t} \u2014 corroborate with host facts: mem.txt (memory pressure, swap, THP), gpu.txt (GPU presence/OOM), disk.txt (disk full), cpu.txt, ps.txt, gpudb-exe-*.txt (process args/limits).
+
+### Round 3 \u2014 Confirm
+
+- ${t}kinetica_bundle_read_config${t} \u2014 check gpudb.conf for misconfiguration / config-drift relevant to your hypothesis (tier limits, thread pools, ports, HA).
+- Re-search logs to confirm the root-cause sequence.
+
+After Round 3 you MUST write the report \u2014 even if uncertainty remains. There are no mutation or verification rounds in bundle mode: you recommend, you do not apply.
+
+### Parallel Tool Calls
+
+Issue independent reads together where possible (e.g. timeline + list_files, or a log search alongside a sysinfo read).
+
+---
+
+## Evidence Checklist \u2014 Bundle Tools
+
+${buildBundleEvidenceChecklist()}
+
+---
+
+${buildFailurePatternsSection(playbooks)}
+
+${buildReferenceSection([...bundleReferences ?? [], ...references ?? []])}
+
+---
+
+## Analysis Instructions
+
+### Commit to the Best Hypothesis
+
+After gathering evidence, name specific root causes \u2014 no generic hedging.
+
+**DO:**
+- "Root cause: rank 0 crashed with a segmentation fault (signal 11) at 15:18:52 (core-gpudb-rolling-r0.log:Job.cpp:9), preceded by 57 ERROR lines in the 15:00 hour."
+- "If uncertain, rank top 2-3 hypotheses by likelihood: Primary (70%): X; Secondary (25%): Y."
+
+**DO NOT:**
+- "There could be various reasons..." / "Further investigation may be needed..."
+
+### Tie Evidence to Conclusions
+
+Every conclusion must cite specific evidence \u2014 a file, a timestamp, a log line, a config key. Example: "GPU OOM is unlikely: gpu.txt shows nvidia-smi FAILED (exit 127) and gpudb-exe shows no --gpu rank args \u2014 this is a CPU-only host."
+
+### Evidence Gap Handling
+
+Note gaps and continue \u2014 never halt on a missing artifact:
+- "Host memory at crash: unavailable (mem.txt is a point-in-time snapshot taken during collection, not at crash time)."
+- "GPU metrics: unavailable (nvidia-smi collection FAILED \u2014 CPU-only host)."
+
+---
+
+## Fix Instructions
+
+Provide specific, actionable remediation tied to your findings, as a numbered list. Because you cannot act on the bundle, frame everything as recommendations for the operator to apply to the live system:
+
+1. Immediate manual actions the operator should take on the live system
+2. Configuration changes to prevent recurrence (cite the gpudb.conf key + value)
+3. Monitoring/alerting improvements
+4. What to capture or verify on the live system to close remaining Evidence Gaps
+
+---
+
+## Post-Report Behavior
+
+1. Present the finished report in your response so the operator can read it.
+2. **Ask BEFORE saving \u2014 never save unprompted.** After presenting the report, ask exactly: "Would you like me to save this report to disk? (yes/no)" and then STOP \u2014 end your turn and wait for the operator's answer. Do NOT call ${t}save_report${t} in the same turn as the question; the question must come first. Save only if they answer yes. (Exception: if checkpointing under budget pressure with a ${t}partial: true${t} report, save immediately without asking \u2014 preserving findings beats the prompt.)
+3. After saving (or after the operator declines), ask: "Would you like to investigate another issue in this bundle, or end the session?"
+4. On session end: summarize issues investigated and list saved report paths, then exit.
+
+---
+
+## Budget & Length Awareness
+
+The session has a per-session budget guard that can end the run early. If the operator warns that the guard is approaching, STOP gathering evidence, call ${t}save_report${t} with ${t}partial: true${t}, state your best current hypothesis, and wind down. A partial report beats none. Treat the guard as a normal limit, never an error.
+
+---
+
+## Output Formatting
+
+Synthesize findings into clean markdown tables (3-6 columns, **bold** key identifiers, consistent ${t}OK${t}/${t}WARN${t}/${t}ERROR${t} indicators). Do NOT dump raw log output \u2014 extract the most relevant lines.
+
+---
+
+## REPORT TEMPLATE
+
+At the end of each investigation, generate a structured markdown report using this EXACT template and section order:
+
+\`\`\`markdown
+` + REPORT_TEMPLATE + `\`\`\`
+
+**CRITICAL:** Use this exact section order. The metadata table comes first. Summary before Remediation. Evidence Collected before Evidence Gaps.
+
+**Bundle-mode report notes:**
+- In the metadata, make clear this diagnosis is from an offline support bundle (note the node and detected version).
+- "Mutations Applied" will always be "None (offline bundle \u2014 read-only)". "Post-Remediation Verification" should state that verification requires re-running diagnostics against the live system.
+- "Evidence Collected" \u2014 cite specific files, timestamps, and log lines (no raw dumps; the 3-10 most relevant findings).
+`;
+}
+
+// src/bundle/bundle-holder.ts
+function createBundleHolder(initial) {
+  let current = initial;
+  return {
+    get: () => current,
+    set: (source) => {
+      current = source;
+    },
+    isLoaded: () => current !== void 0
+  };
+}
+
+// src/cli/pick-bundle-path.ts
+var import_prompts3 = require("@inquirer/prompts");
+var import_promises7 = require("fs/promises");
+var import_node_path7 = require("path");
+function isPermissionError(err) {
+  if (typeof err !== "object" || err === null || !("code" in err)) return false;
+  const code = err.code;
+  return code === "EACCES" || code === "EPERM";
+}
+async function listDirectoryCandidates(term) {
+  const input5 = term.trim() === "" ? "." : term;
+  const endsWithSep = input5.endsWith("/");
+  const baseDir = endsWithSep ? input5 : (0, import_node_path7.dirname)(input5) || ".";
+  const prefix = endsWithSep ? "" : (0, import_node_path7.basename)(input5);
+  const resolved = (0, import_node_path7.resolve)(baseDir);
+  let entries;
+  try {
+    entries = await (0, import_promises7.readdir)(resolved, { withFileTypes: true });
+  } catch (err) {
+    if (isPermissionError(err)) return { kind: "denied", dir: resolved };
+    return { kind: "ok", candidates: [] };
+  }
+  const candidates = entries.filter((e) => e.isDirectory() && e.name.startsWith(prefix)).map((e) => {
+    const value = (0, import_node_path7.join)(baseDir, e.name);
+    return { name: `${value}/`, value };
+  }).sort((a, b) => a.value.localeCompare(b.value));
+  return { kind: "ok", candidates };
+}
+function listingToChoices(listing) {
+  if (listing.kind === "denied") {
+    return [
+      {
+        name: `Permission denied reading ${listing.dir} \u2014 grant your terminal access in System Settings \u203A Privacy & Security \u203A Files & Folders (or Full Disk Access), then retry`,
+        value: "",
+        disabled: true
+      }
+    ];
+  }
+  return listing.candidates.map((c) => ({ name: c.name, value: c.value }));
+}
+async function promptBundleDirectory() {
+  if (!process.stdin.isTTY) return void 0;
+  try {
+    return await (0, import_prompts3.search)({
+      message: "Select the support bundle directory (type to filter):",
+      source: async (term) => listingToChoices(await listDirectoryCandidates(term ?? ""))
+    });
+  } catch {
+    return void 0;
+  }
+}
+
+// src/approval/gate.ts
+var import_prompts4 = require("@inquirer/prompts");
+
+// src/approval/display.ts
+var import_picocolors5 = __toESM(require("picocolors"));
+var IMPACT_FALLBACK = "Impact unknown \u2014 review parameters carefully";
+var DIVIDER2 = import_picocolors5.default.dim("\u2500".repeat(50));
+var LABEL_WIDTH = 8;
+function formatLabel(label) {
+  return `  ${label.padEnd(LABEL_WIDTH)}: `;
+}
+function renderApprovalPanel(toolName, toolInput, impact, beforeAfter, reasoningSummary) {
+  const header = import_picocolors5.default.bold(import_picocolors5.default.yellow("  Mutation Approval Required"));
+  const action = `${formatLabel("Action")}${import_picocolors5.default.bold(formatToolName(toolName))}`;
+  const paramEntries = Object.entries(toolInput);
+  const paramSection = paramEntries.length === 0 ? "  (no parameters)" : paramEntries.map(([key, value]) => {
+    const formatted = typeof value === "string" ? value : JSON.stringify(value, null, 2);
+    return `  ${import_picocolors5.default.dim(key)}: ${formatted}`;
+  }).join("\n");
+  const impactLine = `${formatLabel("Impact")}${impact ?? IMPACT_FALLBACK}`;
+  const prompt = import_picocolors5.default.dim(
+    `${formatLabel("Respond")}y (proceed) | n (abort) | explain (show reasoning)`
+  );
+  const hasBeforeAfter = beforeAfter !== void 0 && beforeAfter.length > 0;
+  const beforeAfterSection = hasBeforeAfter ? beforeAfter.map(
+    (entry) => `  ${import_picocolors5.default.dim(entry.key)}: ${entry.current} ${import_picocolors5.default.yellow("->")} ${entry.proposed}`
+  ).join("\n") : null;
+  const hasReasoning = reasoningSummary !== void 0 && reasoningSummary.length > 0;
+  const reasoningSection = hasReasoning ? `${formatLabel("Reason")}${reasoningSummary}` : null;
+  const sections = ["", DIVIDER2, header, "", action, paramSection, ""];
+  if (beforeAfterSection !== null) {
+    sections.push(beforeAfterSection, "");
+  }
+  if (reasoningSection !== null) {
+    sections.push(reasoningSection, "");
+  }
+  sections.push(impactLine, "", prompt, DIVIDER2, "");
+  return sections.join("\n");
+}
+
+// src/approval/gate.ts
+var DENY_MESSAGE = "User denied this mutation. Skip and continue with the investigation.";
+var REASONING_FALLBACK = "Reasoning not available. Review the action details above before proceeding.";
+function createApprovalGate(isReadOnly) {
+  return async (toolName, toolInput, options) => {
+    if (isReadOnly(toolName)) {
+      return {
+        behavior: "allow",
+        updatedInput: toolInput,
+        toolUseID: options.toolUseID
+      };
+    }
+    const impact = options.decisionReason;
+    const panel = renderApprovalPanel(toolName, toolInput, impact);
+    console.error(panel);
+    while (true) {
+      try {
+        const raw = await (0, import_prompts4.input)({ message: "Proceed? (y/n/explain):" }, { signal: options.signal });
+        const normalized = raw.trim().toLowerCase();
+        if (normalized === "y") {
+          process.stderr.write("\n");
+          return {
+            behavior: "allow",
+            updatedInput: toolInput,
+            toolUseID: options.toolUseID
+          };
+        }
+        if (normalized === "n") {
+          process.stderr.write("\n");
+          return {
+            behavior: "deny",
+            message: DENY_MESSAGE,
+            toolUseID: options.toolUseID
+          };
+        }
+        if (normalized === "explain") {
+          const reasoning = options.decisionReason;
+          if (reasoning) {
+            console.error(`
+Agent reasoning: ${reasoning}
+`);
+          } else {
+            console.error(`
+${REASONING_FALLBACK}
+`);
+          }
+        }
+      } catch {
+        return {
+          behavior: "deny",
+          message: DENY_MESSAGE,
+          toolUseID: options.toolUseID
+        };
+      }
+    }
+  };
+}
+
+// src/agent/turn-gate.ts
+function createTurnGate() {
+  let resolve3 = () => {
+  };
+  let promise = new Promise((r) => {
+    resolve3 = r;
+  });
+  return Object.freeze({
+    wait: () => promise,
+    open: () => {
+      resolve3();
+    },
+    close: () => {
+      promise = new Promise((r) => {
+        resolve3 = r;
+      });
+    }
+  });
+}
+
+// src/output/render-markdown.ts
+var import_picocolors6 = __toESM(require("picocolors"));
+var BOLD_RE = /\*\*(.+?)\*\*/g;
+var HEADING_RE = /^(#{1,6})\s+(.+)$/;
+function renderMarkdownLine(line) {
+  const headingMatch = HEADING_RE.exec(line);
+  if (headingMatch) {
+    return import_picocolors6.default.bold(headingMatch[2]);
+  }
+  if (line.includes("**")) {
+    return line.replace(BOLD_RE, (_, text2) => import_picocolors6.default.bold(text2));
+  }
+  return line;
+}
+
+// src/output/reformat-tables.ts
+var SEPARATOR_CELL_RE = /^:?-+:?$/;
+var BOLD_MARKERS_RE = /\*\*(.+?)\*\*/g;
+function visualWidth(text2) {
+  return text2.replace(BOLD_MARKERS_RE, "$1").length;
+}
+function isSeparatorCell(cell) {
+  return SEPARATOR_CELL_RE.test(cell);
+}
+function isSeparatorRow(cells) {
+  return cells.length > 0 && cells.every(isSeparatorCell);
+}
+function parseCells(line) {
+  return line.split("|").slice(1, -1).map((c) => c.trim());
+}
+function reformatTableBlock(lines) {
+  const parsed = lines.map(parseCells);
+  const colCount = Math.max(...parsed.map((row) => row.length));
+  const normalised = parsed.map((row) => {
+    const padded = [...row];
+    while (padded.length < colCount) {
+      padded.push("");
+    }
+    return padded;
+  });
+  const colWidths = Array.from(
+    { length: colCount },
+    (_, col) => Math.max(
+      3,
+      ...normalised.filter((row) => !isSeparatorRow(row)).map((row) => visualWidth(row[col]))
+    )
   );
   const borderRow = `+${colWidths.map((w) => "-".repeat(w + 2)).join("+")}+`;
   const bodyRows = normalised.map((row) => {
@@ -3911,9 +5224,9 @@ function createStreamingTableAligner() {
     tableLines = [];
     return aligned.join("\n") + "\n";
   }
-  function push(text) {
-    if (!text) return "";
-    const combined = lineBuffer + text;
+  function push(text2) {
+    if (!text2) return "";
+    const combined = lineBuffer + text2;
     const segments = combined.split("\n");
     lineBuffer = segments[segments.length - 1];
     const completeLines = segments.slice(0, -1);
@@ -3970,15 +5283,37 @@ function createSpinner() {
 
 // src/agent/run-agent.ts
 var MCP_SERVER_NAME = "kinetica-diagnostics";
+var SAVE_REPORT_TOOL_NAME = `mcp__${MCP_SERVER_NAME}__save_report`;
+function contentCallsSaveReport(content) {
+  if (!Array.isArray(content)) return false;
+  return content.some((block) => {
+    if (typeof block !== "object" || block === null) return false;
+    const { type, name } = block;
+    return type === "tool_use" && name === SAVE_REPORT_TOOL_NAME;
+  });
+}
+function formatCostSuffix(costUsd) {
+  return costUsd !== void 0 && costUsd > 0 ? ` Cost: $${costUsd.toFixed(4)}.` : "";
+}
+function formatMetricsLine(turns, durationMs, durationApiMs, costUsd) {
+  const durationSec = Math.round(durationMs / 1e3);
+  const apiPct = durationMs > 0 ? Math.round(durationApiMs / durationMs * 100) : 0;
+  return `Turns: ${turns}. Duration: ${durationSec}s (${apiPct}% API).${formatCostSuffix(costUsd)}`;
+}
 var EXIT_COMMANDS = /* @__PURE__ */ new Set(["exit", "quit", "end", "q"]);
 var SUPPORTED_MODELS = ["sonnet", "haiku", "opus"];
 var DEFAULT_AGENT_MODEL = "sonnet";
-var DEFAULT_MAX_BUDGET_USD = 5;
+var LIVE_MAX_TURNS = 100;
+var BUNDLE_MAX_TURNS = 40;
 var ALLOWED_TOOL_NAMES = [
   ...DIAGNOSTIC_TOOL_NAMES.map((name) => `mcp__${MCP_SERVER_NAME}__${name}`),
-  `mcp__${MCP_SERVER_NAME}__save_report`,
+  SAVE_REPORT_TOOL_NAME,
   `mcp__${MCP_SERVER_NAME}__${ALTER_TABLE_COLUMNS_TOOL_NAME}`
 ];
+var BUNDLE_ALLOWED_TOOL_NAMES = [
+  ...BUNDLE_TOOL_NAMES.map((name) => `mcp__${MCP_SERVER_NAME}__${name}`),
+  SAVE_REPORT_TOOL_NAME
+];
 var DISALLOWED_TOOLS = ["Bash", "Edit", "Write", "MultiEdit"];
 var ERROR_LABELS = {
   authentication_failed: "Authentication failed \u2014 check your API key or re-run with --login",
@@ -3989,8 +5324,8 @@ var ERROR_LABELS = {
   max_output_tokens: "Response exceeded maximum output length",
   unknown: "Unknown API error"
 };
-function isExitCommand(text) {
-  return EXIT_COMMANDS.has(text.trim().toLowerCase());
+function isExitCommand(text2) {
+  return EXIT_COMMANDS.has(text2.trim().toLowerCase());
 }
 function makeUserMessage(content) {
   return {
@@ -4004,7 +5339,7 @@ async function* makeInteractivePrompt(abortController, turnGate, spinner) {
   while (!abortController.signal.aborted) {
     try {
       process.stderr.write("\n");
-      const issue = await (0, import_prompts4.input)({ message: "Describe the issue to investigate:" });
+      const issue = await (0, import_prompts5.input)({ message: "Describe the issue to investigate:" });
       process.stderr.write("\n");
       const trimmed = issue.trim();
       if (!trimmed) continue;
@@ -4021,7 +5356,7 @@ async function* makeInteractivePrompt(abortController, turnGate, spinner) {
       await turnGate.wait();
       if (abortController.signal.aborted) break;
       process.stderr.write("\n");
-      const response = await (0, import_prompts4.input)({ message: "You:" });
+      const response = await (0, import_prompts5.input)({ message: "You:" });
       process.stderr.write("\n");
       const trimmed = response.trim();
       if (!trimmed) continue;
@@ -4070,23 +5405,31 @@ async function displayDegradedStatus(session2) {
   }
   process.stderr.write("\n");
 }
-async function runAgent(session2, kineticaVersion, degraded, model) {
-  const [catalogSchemas, playbooks, references] = await Promise.all([
-    degraded ? Promise.resolve(void 0) : discoverCatalogSchemas(session2),
+async function runAgent(session2, kineticaVersion, degraded, model, runOptions) {
+  const bundleSource = runOptions?.bundleSource;
+  const authMethod = runOptions?.authMethod ?? "api_key";
+  const dollarCapped = authMethod === "api_key";
+  const resolvedBudgetUsd = runOptions?.maxBudgetUsd ?? DEFAULT_MAX_BUDGET_USD;
+  const [catalogSchemas, playbooks, references, bundleReferences] = await Promise.all([
+    degraded || !session2 ? Promise.resolve(void 0) : discoverCatalogSchemas(session2),
     loadPlaybooks(),
-    loadReferences()
+    loadReferences(),
+    loadBundleReferences()
   ]);
-  const systemPrompt = buildSystemPrompt(
+  const bundleHolder = createBundleHolder(bundleSource);
+  const systemPrompt = session2 ? buildSystemPrompt(
     kineticaVersion,
     catalogSchemas,
     playbooks,
     references,
-    degraded
-  );
+    degraded,
+    bundleHolder.isLoaded() ? "attached" : "available",
+    bundleReferences
+  ) : buildBundleSystemPrompt(kineticaVersion, playbooks, references, bundleReferences);
   const budget = checkPromptBudget(systemPrompt);
   if (process.env.DEBUG) {
     process.stderr.write(
-      import_picocolors8.default.dim(`system prompt: ~${budget.tokens} tokens (${budget.chars} chars)
+      import_picocolors8.default.dim(`System prompt: ~${budget.tokens} tokens (${budget.chars} chars)
 `)
     );
   }
@@ -4098,17 +5441,49 @@ async function runAgent(session2, kineticaVersion, degraded, model) {
       )
     );
   }
-  const diagnosticTools = makeDiagnosticTools(session2, catalogSchemas);
-  const mutationTools = makeMutationTools(session2);
   const saveReportTool = makeSaveReportTool();
-  const alterTableColumnsTool = makeAlterTableColumnsToolWithDeps(session2);
-  const server = (0, import_claude_agent_sdk4.createSdkMcpServer)({
+  if (!session2 && !bundleSource) {
+    throw new Error("runAgent requires a Kinetica session, a bundleSource, or both.");
+  }
+  const spinner = createSpinner();
+  const promptForPath = async () => {
+    spinner.stop();
+    return promptBundleDirectory();
+  };
+  const confirmPath = async (path2) => {
+    spinner.stop();
+    try {
+      const answer = await (0, import_prompts5.input)({
+        message: `Load support bundle from "${path2}"? The agent will be able to read files under that directory. (y/n):`
+      });
+      return answer.trim().toLowerCase() === "y";
+    } catch {
+      return false;
+    }
+  };
+  const bundleTools = makeBundleTools(bundleHolder, { promptForPath, confirmPath });
+  const liveTools = session2 ? [
+    ...makeDiagnosticTools(session2, catalogSchemas),
+    ...makeMutationTools(session2),
+    makeAlterTableColumnsToolWithDeps(session2)
+  ] : [];
+  const serverTools = [...liveTools, ...bundleTools, saveReportTool];
+  const allowedTools = [
+    .../* @__PURE__ */ new Set([...session2 ? ALLOWED_TOOL_NAMES : [], ...BUNDLE_ALLOWED_TOOL_NAMES])
+  ];
+  let registry = createBundleRegistry();
+  if (session2) {
+    registry = DIAGNOSTIC_TOOL_NAMES.reduce(
+      (reg, name) => reg.registerReadOnlyTool(name),
+      registry
+    );
+  }
+  const maxTurns = session2 ? LIVE_MAX_TURNS : BUNDLE_MAX_TURNS;
+  const server = (0, import_claude_agent_sdk5.createSdkMcpServer)({
     name: MCP_SERVER_NAME,
     version: "1.0.0",
-    tools: [...diagnosticTools, ...mutationTools, saveReportTool, alterTableColumnsTool]
+    tools: serverTools
   });
-  const spinner = createSpinner();
-  const registry = createDiagnosticRegistry();
   const approvalGate = createApprovalGate(registry.isReadOnlyTool);
   const canUseTool = async (toolName, toolInput, options2) => {
     spinner.stop();
@@ -4118,33 +5493,64 @@ async function runAgent(session2, kineticaVersion, degraded, model) {
   const effectiveModel = model ?? DEFAULT_AGENT_MODEL;
   const options = {
     mcpServers: { [MCP_SERVER_NAME]: server },
-    allowedTools: ALLOWED_TOOL_NAMES,
+    allowedTools,
     disallowedTools: [...DISALLOWED_TOOLS],
     canUseTool,
     systemPrompt,
     model: effectiveModel,
     fallbackModel: "haiku",
     thinking: { type: "adaptive" },
-    maxTurns: 100,
-    maxBudgetUsd: DEFAULT_MAX_BUDGET_USD,
+    maxTurns,
+    // Only impose a dollar cap for per-token billing. For OAuth subscription users
+    // the SDK would otherwise cut them off at a notional dollar figure they never pay;
+    // omitting it leaves the turn limit (maxTurns) as their guard.
+    ...dollarCapped ? { maxBudgetUsd: resolvedBudgetUsd } : {},
     persistSession: false,
     includePartialMessages: true,
     abortController,
     env: { ...process.env, CLAUDE_AGENT_SDK_CLIENT_APP: "admin-agent" }
   };
-  if (degraded) {
-    process.stderr.write("\nKinetica Diagnostic Session Ready (DEGRADED MODE)\n");
+  const guardLine = dollarCapped ? import_picocolors8.default.dim(`Budget guard: $${resolvedBudgetUsd.toFixed(2)} (raise with --max-budget)
+`) : import_picocolors8.default.dim("Budget guard: subscription (Pro/Max) \u2014 turn-limited\n");
+  const bundleSummary = () => {
+    const src = bundleHolder.get();
+    if (!src) return "";
+    const { totalFiles, ranks } = src.inventory();
+    const versionStr = kineticaVersion ? ` (version ${kineticaVersion})` : "";
+    return `${totalFiles} files, ranks: ${ranks.join(", ") || "none"}${versionStr}`;
+  };
+  if (session2) {
+    if (degraded) {
+      process.stderr.write("\nKinetica Diagnostic Session Ready (DEGRADED MODE)\n");
+      process.stderr.write(
+        "DB engine (port 9191) is unreachable. Only host manager tools are available.\n\n"
+      );
+      await displayDegradedStatus(session2);
+    } else {
+      process.stderr.write("\nKinetica Diagnostic Session Ready\n");
+    }
+    if (bundleHolder.isLoaded()) {
+      process.stderr.write(
+        `Support bundle attached: ${bundleSummary()}. Live + bundle tools available.
+`
+      );
+    } else {
+      process.stderr.write(
+        import_picocolors8.default.dim("Tip: ask me to analyze a support bundle to add offline log/config analysis.\n")
+      );
+    }
+  } else {
+    process.stderr.write("\nKinetica Diagnostic Session Ready (OFFLINE BUNDLE MODE)\n");
+    process.stderr.write(`Analyzing extracted support bundle: ${bundleSummary()}.
+`);
     process.stderr.write(
-      "DB engine (port 9191) is unreachable. Only host manager tools are available.\n\n"
+      "Read-only \u2014 diagnoses from captured logs/config; live verification unavailable (no DB connection).\n"
     );
-    await displayDegradedStatus(session2);
-    process.stderr.write("Type 'exit' to end the session.\n\n");
-  } else {
-    process.stderr.write("\nKinetica Diagnostic Session Ready\n");
-    process.stderr.write("Type 'exit' to end the session.\n\n");
   }
+  process.stderr.write(guardLine);
+  process.stderr.write("Type 'exit' to end the session.\n\n");
   const turnGate = createTurnGate();
-  const agentQuery = (0, import_claude_agent_sdk4.query)({
+  const agentQuery = (0, import_claude_agent_sdk5.query)({
     prompt: makeInteractivePrompt(abortController, turnGate, spinner),
     options
   });
@@ -4163,15 +5569,18 @@ async function runAgent(session2, kineticaVersion, degraded, model) {
   let lastStreamCharWasNewline = true;
   const tableAligner = createStreamingTableAligner();
   let hadNonAbortError = false;
+  let reportSavedThisRun = false;
+  let invBase = { turns: 0, duration: 0, api: 0, cost: 0 };
+  const budgetTracker = dollarCapped ? createBudgetTracker({ maxUsd: resolvedBudgetUsd }) : void 0;
   try {
     for await (const message of agentQuery) {
       if (message.type === "stream_event") {
         const { event: evt } = message;
         if (evt.type === "content_block_delta" && evt.delta.type === "text_delta") {
-          const text = evt.delta.text ?? "";
-          if (text) {
+          const text2 = evt.delta.text ?? "";
+          if (text2) {
             spinner.stop();
-            const output = tableAligner.push(text);
+            const output = tableAligner.push(text2);
             if (output) {
               process.stderr.write(output);
               lastStreamCharWasNewline = output.endsWith("\n");
@@ -4189,6 +5598,23 @@ async function runAgent(session2, kineticaVersion, degraded, model) {
           process.stderr.write("\n");
           lastStreamCharWasNewline = true;
         }
+        if (budgetTracker) {
+          budgetTracker.add(fromSdkUsage(assistantMsg.message.usage), effectiveModel);
+          if (budgetTracker.shouldWarn()) {
+            spinner.stop();
+            process.stderr.write(
+              import_picocolors8.default.yellow(
+                `
+\u26A0 Approaching budget guard (~$${budgetTracker.spentUsd().toFixed(2)} / $${resolvedBudgetUsd.toFixed(2)}) \u2014 wrapping up soon. Save a partial report now if you want to preserve findings.
+`
+              )
+            );
+            budgetTracker.markWarned();
+          }
+        }
+        if (contentCallsSaveReport(assistantMsg.message.content)) {
+          reportSavedThisRun = true;
+        }
         if (assistantMsg.message.stop_reason === "end_turn") {
           spinner.stop();
           turnGate.open();
@@ -4217,10 +5643,21 @@ API error: ${label}
         cacheCreationTokens = usages.reduce((sum, u) => sum + (u.cacheCreationInputTokens ?? 0), 0);
         if (resultMsg.subtype === "error_max_turns") {
           process.stderr.write(
-            "\nInvestigation hit turn limit. Partial report may be available.\n"
+            import_picocolors8.default.yellow(
+              `
+Reached the turn limit (${numTurns} turns) \u2014 a safety guard, not an error. Any report the agent saved is in reports/. Start a fresh session to continue.
+`
+            )
           );
         } else if (resultMsg.subtype === "error_max_budget_usd") {
-          process.stderr.write("\nBudget limit reached.\n");
+          const spentStr = totalCostUsd > 0 ? ` ($${totalCostUsd.toFixed(2)} spent)` : "";
+          process.stderr.write(
+            import_picocolors8.default.yellow(
+              `
+Reached the $${resolvedBudgetUsd.toFixed(2)} budget guard${spentStr} \u2014 a safety limit, not an error. Re-run with --max-budget=<amount> (or set ADMIN_AGENT_MAX_BUDGET) for more headroom. Any report the agent saved is in reports/.
+`
+            )
+          );
         } else if (resultMsg.subtype === "error_during_execution") {
           process.stderr.write(
             "\nExecution error \u2014 the agent encountered an unrecoverable failure.\n"
@@ -4236,6 +5673,24 @@ Agent session ended with error: ${resultMsg.subtype}
 Permission denials: ${denied}
 `);
         }
+        if (reportSavedThisRun) {
+          const line = formatMetricsLine(
+            numTurns - invBase.turns,
+            durationMs - invBase.duration,
+            durationApiMs - invBase.api,
+            dollarCapped ? totalCostUsd - invBase.cost : void 0
+          );
+          process.stderr.write(`
+Investigation complete \u2014 ${line}
+`);
+          invBase = {
+            turns: numTurns,
+            duration: durationMs,
+            api: durationApiMs,
+            cost: totalCostUsd
+          };
+          reportSavedThisRun = false;
+        }
         turnGate.open();
       } else if (message.type === "system") {
         const sysMsg = message;
@@ -4291,7 +5746,7 @@ Rate limited \u2014 requests rejected.${resetStr}
     }
   } catch (error) {
     spinner.stop();
-    if (error instanceof import_claude_agent_sdk4.AbortError) {
+    if (error instanceof import_claude_agent_sdk5.AbortError) {
       hadNonAbortError = false;
     } else {
       hadNonAbortError = true;
@@ -4307,27 +5762,26 @@ Agent error: ${message}
       process.stderr.write(remaining);
     }
     turnGate.open();
-    const durationSec = Math.round(durationMs / 1e3);
-    const apiPct = durationMs > 0 ? Math.round(durationApiMs / durationMs * 100) : 0;
-    const costStr = totalCostUsd > 0 ? ` Cost: $${totalCostUsd.toFixed(4)}.` : "";
+    const sessionCost = dollarCapped ? totalCostUsd : void 0;
     if (process.env.DEBUG && (cacheReadTokens > 0 || cacheCreationTokens > 0)) {
       process.stderr.write(
         import_picocolors8.default.dim(
-          `cache: ${cacheReadTokens} read / ${cacheCreationTokens} created input tokens (read > 0 confirms the system prompt is served from cache)
+          `Cache: ${cacheReadTokens} read / ${cacheCreationTokens} created input tokens (read > 0 confirms the system prompt is served from cache)
 `
         )
       );
     }
     if (hadNonAbortError) {
-      process.stderr.write(`
-Session ended due to error. Turns: ${numTurns}.${costStr}
-`);
-    } else {
       process.stderr.write(
         `
-Session ended. Turns: ${numTurns}. Duration: ${durationSec}s (${apiPct}% API).${costStr}
+Session ended due to error. Turns: ${numTurns}.${formatCostSuffix(sessionCost)}
 `
       );
+    } else {
+      const line = formatMetricsLine(numTurns, durationMs, durationApiMs, sessionCost);
+      process.stderr.write(`
+Session ended. ${line}
+`);
     }
   }
 }
@@ -4339,7 +5793,7 @@ var MODEL_LABELS = {
   opus: "Opus \u2014 deepest reasoning, slower & pricier"
 };
 async function selectModel() {
-  return (0, import_prompts5.select)({
+  return (0, import_prompts6.select)({
     message: "Select model for this session:",
     default: DEFAULT_AGENT_MODEL,
     choices: SUPPORTED_MODELS.map((value) => ({ value, name: MODEL_LABELS[value] }))
@@ -4347,7 +5801,7 @@ async function selectModel() {
 }
 
 // src/auth/preflight.ts
-var import_claude_agent_sdk5 = require("@anthropic-ai/claude-agent-sdk");
+var import_claude_agent_sdk6 = require("@anthropic-ai/claude-agent-sdk");
 
 // src/auth/oauth-flow.ts
 var import_picocolors9 = __toESM(require("picocolors"));
@@ -4435,7 +5889,7 @@ async function authenticateAnthropic(options) {
     await new Promise(() => {
     });
   }
-  const authQuery = (0, import_claude_agent_sdk5.query)({
+  const authQuery = (0, import_claude_agent_sdk6.query)({
     prompt: hangingPrompt(),
     options: {
       persistSession: false,
@@ -4467,12 +5921,12 @@ async function authenticateAnthropic(options) {
 // src/auth/logout.ts
 var import_child_process2 = require("child_process");
 var import_node_module = require("module");
-var import_node_path5 = __toESM(require("path"));
+var import_node_path8 = __toESM(require("path"));
 var import_util = require("util");
 var execFileAsync = (0, import_util.promisify)(import_child_process2.execFile);
 function resolveSdkCliPath() {
   const require_ = (0, import_node_module.createRequire)(__filename);
-  return import_node_path5.default.join(import_node_path5.default.dirname(require_.resolve("@anthropic-ai/claude-agent-sdk")), "cli.js");
+  return import_node_path8.default.join(import_node_path8.default.dirname(require_.resolve("@anthropic-ai/claude-agent-sdk")), "cli.js");
 }
 async function logout() {
   try {
@@ -4492,9 +5946,9 @@ async function logout() {
 
 // src/session/env-file.ts
 var import_fs2 = require("fs");
-var import_promises4 = require("fs/promises");
+var import_promises8 = require("fs/promises");
 var import_path2 = require("path");
-var import_prompts6 = require("@inquirer/prompts");
+var import_prompts7 = require("@inquirer/prompts");
 var import_picocolors10 = __toESM(require("picocolors"));
 function parseEnvContent(content) {
   const entries = [];
@@ -4577,7 +6031,7 @@ function loadEnvFile(dir, env = process.env) {
 async function offerSaveCredentials(url, user, dir) {
   if (!process.stdin.isTTY) return;
   try {
-    const shouldSave = await (0, import_prompts6.confirm)({
+    const shouldSave = await (0, import_prompts7.confirm)({
       message: "Save KINETICA_URL and KINETICA_USER to .env? (password is never saved)",
       default: true
     });
@@ -4585,11 +6039,11 @@ async function offerSaveCredentials(url, user, dir) {
     const filePath = (0, import_path2.join)(dir ?? process.cwd(), ".env");
     let existing;
     try {
-      existing = await (0, import_promises4.readFile)(filePath, "utf8");
+      existing = await (0, import_promises8.readFile)(filePath, "utf8");
     } catch {
     }
     const content = buildEnvContent(url, user, existing);
-    await (0, import_promises4.writeFile)(filePath, content, "utf8");
+    await (0, import_promises8.writeFile)(filePath, content, "utf8");
     console.error(import_picocolors10.default.dim("Saved to .env"));
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
@@ -4599,10 +6053,10 @@ async function offerSaveCredentials(url, user, dir) {
 
 // src/session/verify.ts
 var import_picocolors13 = __toESM(require("picocolors"));
-var import_prompts9 = require("@inquirer/prompts");
+var import_prompts10 = require("@inquirer/prompts");
 
 // src/session/collect.ts
-var import_prompts7 = require("@inquirer/prompts");
+var import_prompts8 = require("@inquirer/prompts");
 var import_picocolors11 = __toESM(require("picocolors"));
 async function collectCredentials() {
   const prompted = /* @__PURE__ */ new Set();
@@ -4610,27 +6064,27 @@ async function collectCredentials() {
   const envUser = process.env.KINETICA_USER;
   if (envUrl && envUser && process.stdin.isTTY) {
     console.error(import_picocolors11.default.dim(`Saved connection: ${envUrl} (${envUser})`));
-    const useSaved = await (0, import_prompts7.confirm)({
+    const useSaved = await (0, import_prompts8.confirm)({
       message: "Use saved connection?",
       default: true
     });
     if (!useSaved) {
       prompted.add("url");
       prompted.add("user");
-      const url2 = await (0, import_prompts7.input)({ message: "Kinetica endpoint URL:" });
-      const user2 = await (0, import_prompts7.input)({ message: "Admin username:" });
-      const pass2 = await (0, import_prompts7.password)({ message: "Admin password:", mask: "*" });
+      const url2 = await (0, import_prompts8.input)({ message: "Kinetica endpoint URL:" });
+      const user2 = await (0, import_prompts8.input)({ message: "Admin username:" });
+      const pass2 = await (0, import_prompts8.password)({ message: "Admin password:", mask: "*" });
       return { credentials: { url: url2, user: user2, pass: pass2 }, prompted };
     }
   }
-  const url = envUrl ?? (prompted.add("url"), await (0, import_prompts7.input)({ message: "Kinetica endpoint URL:" }));
-  const user = envUser ?? (prompted.add("user"), await (0, import_prompts7.input)({ message: "Admin username:" }));
-  const pass = process.env.KINETICA_PASS ?? await (0, import_prompts7.password)({ message: "Admin password:", mask: "*" });
+  const url = envUrl ?? (prompted.add("url"), await (0, import_prompts8.input)({ message: "Kinetica endpoint URL:" }));
+  const user = envUser ?? (prompted.add("user"), await (0, import_prompts8.input)({ message: "Admin username:" }));
+  const pass = process.env.KINETICA_PASS ?? await (0, import_prompts8.password)({ message: "Admin password:", mask: "*" });
   return { credentials: { url, user, pass }, prompted };
 }
 async function repromptCredentials() {
-  const user = await (0, import_prompts7.input)({ message: "Admin username:" });
-  const pass = await (0, import_prompts7.password)({ message: "Admin password:", mask: "*" });
+  const user = await (0, import_prompts8.input)({ message: "Admin username:" });
+  const pass = await (0, import_prompts8.password)({ message: "Admin password:", mask: "*" });
   return { user, pass };
 }
 
@@ -4641,8 +6095,9 @@ function replacePort(baseUrl, port) {
   parsed.port = String(port);
   return parsed.origin;
 }
-function createSession(url, user, pass) {
+function createSession(url, user, pass, options) {
   const authHeader = "Basic " + Buffer.from(`${user}:${pass}`).toString("base64");
+  const timeoutMs = options?.timeoutMs ?? REQUEST_TIMEOUT_MS;
   const doFetch = async (fullUrl, body) => {
     if (process.env.DEBUG) {
       console.error(`[DEBUG] POST ${fullUrl}`);
@@ -4654,7 +6109,7 @@ function createSession(url, user, pass) {
         "Content-Type": "application/json"
       },
       body: body !== void 0 ? JSON.stringify(body) : void 0,
-      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
+      signal: AbortSignal.timeout(timeoutMs)
     });
   };
   return {
@@ -4666,7 +6121,7 @@ function createSession(url, user, pass) {
 
 // src/session/resolve-url.ts
 var import_picocolors12 = __toESM(require("picocolors"));
-var import_prompts8 = require("@inquirer/prompts");
+var import_prompts9 = require("@inquirer/prompts");
 var PROBE_TIMEOUT_MS2 = 3e3;
 var HTTP_PROTOCOL_RE = /^https?:\/\//i;
 var ANY_PROTOCOL_RE = /^[a-z][a-z0-9+.-]*:\/\//i;
@@ -4708,7 +6163,7 @@ async function confirmHttpFallback(host) {
     )
   );
   try {
-    return await (0, import_prompts8.confirm)({
+    return await (0, import_prompts9.confirm)({
       message: "Continue over plaintext HTTP?",
       default: false
     });
@@ -4716,7 +6171,7 @@ async function confirmHttpFallback(host) {
     return false;
   }
 }
-async function resolveUrl(input5) {
+async function resolveUrl(input5, options = {}) {
   const trimmed = input5.trim();
   if (trimmed === "") {
     return { ok: false, error: "URL is empty" };
@@ -4750,7 +6205,7 @@ async function resolveUrl(input5) {
       error: `Could not connect to ${normalized} via https:// or http://`
     };
   }
-  if (!isInteractive()) {
+  if (options.nonInteractive || !isInteractive()) {
     return {
       ok: false,
       error: `HTTPS unavailable at ${normalized} and terminal is non-interactive. Pass an explicit http:// prefix to allow plaintext HTTP, or point the URL at an HTTPS endpoint.`
@@ -4770,6 +6225,7 @@ async function resolveUrl(input5) {
 var MAX_RETRIES = 3;
 var MAX_REPROMPTS = 2;
 var DEFAULT_HM_PORT2 = 9300;
+var BEST_EFFORT_PROBE_TIMEOUT_MS = 5e3;
 function extractVersion(responseBody) {
   try {
     const outer = JSON.parse(responseBody);
@@ -4816,6 +6272,24 @@ async function verifyConnectivity(session2) {
 function isCredentialError(errorMessage) {
   return errorMessage.startsWith("HTTP 401") || errorMessage.startsWith("HTTP 403");
 }
+async function connectBestEffort() {
+  const url = process.env.KINETICA_URL;
+  const user = process.env.KINETICA_USER;
+  const pass = process.env.KINETICA_PASS;
+  if (!url || !user || !pass) return void 0;
+  try {
+    const resolved = await resolveUrl(url, { nonInteractive: true });
+    if (!resolved.ok) return void 0;
+    const probe = createSession(resolved.url, user, pass, {
+      timeoutMs: BEST_EFFORT_PROBE_TIMEOUT_MS
+    });
+    const kineticaVersion = await verifyConnectivity(probe);
+    const session2 = createSession(resolved.url, user, pass);
+    return { session: session2, kineticaVersion, degraded: false };
+  } catch {
+    return void 0;
+  }
+}
 async function connectWithRetry() {
   const { credentials, prompted } = await collectCredentials();
   const resolved = await resolveUrl(credentials.url);
@@ -4842,7 +6316,7 @@ async function connectWithRetry() {
       console.error(import_picocolors13.default.red(`Connection failed (attempt ${attempt}/${MAX_RETRIES}): ${msg}`));
       if (isCredentialError(msg)) {
         if (process.stdin.isTTY && repromptCount < MAX_REPROMPTS) {
-          const shouldRetry = await (0, import_prompts9.confirm)({
+          const shouldRetry = await (0, import_prompts10.confirm)({
             message: "Credentials may be incorrect. Re-enter?",
             default: true
           });
@@ -4885,6 +6359,14 @@ async function connectWithRetry() {
 // src/cli/index.ts
 var verbose = false;
 var session;
+function flagValue(args, name) {
+  const prefix = `${name}=`;
+  const arg = args.find((a) => a.startsWith(prefix));
+  return arg === void 0 ? void 0 : arg.slice(prefix.length);
+}
+function chooseBundleSessionVersion(bundleVersion, liveVersion) {
+  return bundleVersion ?? liveVersion;
+}
 function printHelp() {
   const lines = [
     "",
@@ -4904,12 +6386,15 @@ function printHelp() {
     "    --login-org=UUID      Target organization UUID for OAuth",
     "    --logout              Log out from Anthropic account and exit",
     `    --model=NAME          Override agent model (${SUPPORTED_MODELS.join(" | ")}); default: sonnet`,
+    "    --max-budget=USD      Per-session budget cap in USD (API-key billing only); default: 5.00",
+    "    --bundle=PATH         Offline mode: diagnose from an extracted support bundle directory",
     "",
     "  Environment variables:",
-    "    ANTHROPIC_API_KEY  Anthropic API key (if not set, OAuth login via browser is used)",
-    "    KINETICA_URL       Kinetica endpoint URL",
-    "    KINETICA_USER      Admin username",
-    "    KINETICA_PASS      Admin password",
+    "    ANTHROPIC_API_KEY      Anthropic API key (if not set, OAuth login via browser is used)",
+    "    ADMIN_AGENT_MAX_BUDGET Per-session budget cap in USD (overridden by --max-budget)",
+    "    KINETICA_URL           Kinetica endpoint URL",
+    "    KINETICA_USER          Admin username",
+    "    KINETICA_PASS          Admin password",
     ""
   ];
   process.stdout.write(lines.join("\n") + "\n");
@@ -4934,12 +6419,9 @@ async function main() {
     return;
   }
   const forceLogin = args.includes("--login");
-  const loginMethodArg = args.find((a) => a.startsWith("--login-method="));
-  const loginMethod = loginMethodArg?.split("=")[1];
-  const loginOrgArg = args.find((a) => a.startsWith("--login-org="));
-  const loginOrgUUID = loginOrgArg?.split("=")[1];
-  const modelArg = args.find((a) => a.startsWith("--model="));
-  const modelValue = modelArg?.split("=")[1];
+  const loginMethod = flagValue(args, "--login-method");
+  const loginOrgUUID = flagValue(args, "--login-org");
+  const modelValue = flagValue(args, "--model");
   let model;
   if (modelValue !== void 0) {
     if (SUPPORTED_MODELS.includes(modelValue)) {
@@ -4954,13 +6436,39 @@ async function main() {
       return;
     }
   }
+  const budgetValue = flagValue(args, "--max-budget");
+  let maxBudgetFlag;
+  if (budgetValue !== void 0) {
+    const parsed = Number(budgetValue);
+    if (!isValidBudget(parsed)) {
+      process.stderr.write(
+        import_picocolors14.default.red(
+          `Error: invalid --max-budget value "${budgetValue}". Use a positive number, e.g. --max-budget=10
+`
+        )
+      );
+      process.exitCode = 1;
+      return;
+    }
+    maxBudgetFlag = parsed;
+  }
+  const bundlePath = flagValue(args, "--bundle");
+  if (bundlePath?.trim() === "") {
+    process.stderr.write(
+      import_picocolors14.default.red(
+        "Error: --bundle requires a directory path, e.g. --bundle=/path/to/extracted-bundle\n"
+      )
+    );
+    process.exitCode = 1;
+    return;
+  }
   loadEnvFile();
   printBanner();
   if (model === void 0 && process.stdin.isTTY) {
     model = await selectModel();
   }
   const effectiveModel = model ?? DEFAULT_AGENT_MODEL;
-  process.stderr.write(import_picocolors14.default.dim(`model: ${effectiveModel}
+  process.stderr.write(import_picocolors14.default.dim(`Model: ${effectiveModel}
 `));
   const authResult = await authenticateAnthropic({ forceLogin, loginMethod, loginOrgUUID });
   if (authResult.method === "oauth") {
@@ -4970,9 +6478,54 @@ async function main() {
   } else {
     process.stderr.write(import_picocolors14.default.dim("Authenticated via API key\n"));
   }
+  const maxBudgetUsd = resolveMaxBudgetUsd(maxBudgetFlag);
+  if (bundlePath !== void 0) {
+    const result = await verifyBundle(bundlePath);
+    if (!result.ok) {
+      process.stderr.write(import_picocolors14.default.red(`Error: ${result.error}
+`));
+      process.exitCode = 1;
+      return;
+    }
+    if (result.missingExpected.length > 0) {
+      process.stderr.write(
+        import_picocolors14.default.yellow(
+          `Warning: bundle is missing expected artifact(s): ${result.missingExpected.join(", ")}. Diagnosing with what is present.
+`
+        )
+      );
+    }
+    const live = await connectBestEffort();
+    process.stderr.write(
+      live ? import_picocolors14.default.dim("Live connection available \u2014 bundle + live verification enabled.\n") : import_picocolors14.default.dim("No reachable live connection \u2014 offline bundle analysis only.\n")
+    );
+    if (live?.kineticaVersion && result.kineticaVersion && live.kineticaVersion !== result.kineticaVersion) {
+      process.stderr.write(
+        import_picocolors14.default.yellow(
+          `Warning: live cluster version (${live.kineticaVersion}) differs from the bundle's captured version (${result.kineticaVersion}). Reasoning over the bundle uses the captured version; the live cluster may have been upgraded since capture.
+`
+        )
+      );
+    }
+    await runAgent(
+      live?.session,
+      chooseBundleSessionVersion(result.kineticaVersion, live?.kineticaVersion),
+      false,
+      model,
+      {
+        authMethod: authResult.method,
+        maxBudgetUsd,
+        bundleSource: result.bundleSource
+      }
+    );
+    return;
+  }
   const { session: connectedSession, kineticaVersion, degraded } = await connectWithRetry();
   session = connectedSession;
-  await runAgent(session, kineticaVersion, degraded, model);
+  await runAgent(session, kineticaVersion, degraded, model, {
+    authMethod: authResult.method,
+    maxBudgetUsd
+  });
 }
 function getSession() {
   return session;
@@ -4990,6 +6543,7 @@ if (process.env.NODE_ENV !== "test") {
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  chooseBundleSessionVersion,
   getSession,
   main,
   verbose