@kody-ade/kody-engine-lite 0.1.136 → 0.1.137

package/dist/bin/cli.js

@@ -618,6 +618,12 @@ function setLabel(issueNumber, label) {
     logger.warn(`  Failed to set label ${label}: ${err}`);
   }
 }
+function removeLabel(issueNumber, label) {
+  try {
+    gh(["issue", "edit", String(issueNumber), "--remove-label", label]);
+  } catch {
+  }
+}
 function postComment(issueNumber, body) {
   try {
     gh(
@@ -713,12 +719,10 @@ function setLifecycleLabel(issueNumber, phase) {
     logger.warn(`  Invalid lifecycle phase: ${phase}`);
     return;
   }
-  const othersToRemove = LIFECYCLE_LABELS.filter((l) => l !== phase).map((l) => `kody:${l}`).join(",");
-  if (othersToRemove) {
-    try {
-      gh(["issue", "edit", String(issueNumber), "--remove-label", othersToRemove]);
-    } catch {
-    }
+  const currentLabels = getIssueLabels(issueNumber);
+  const toRemove = LIFECYCLE_LABELS.filter((l) => l !== phase).map((l) => `kody:${l}`).filter((l) => currentLabels.includes(l));
+  for (const label of toRemove) {
+    removeLabel(issueNumber, label);
   }
   setLabel(issueNumber, `kody:${phase}`);
 }
@@ -2966,6 +2970,1191 @@ var init_parse_inputs = __esm({
   }
 });
 
+// src/watch/core/state.ts
+import * as fs15 from "fs";
+import * as path13 from "path";
+import { execFileSync as execFileSync10 } from "child_process";
+function createStateStore(repo, localFilePath) {
+  if (process.env.GITHUB_ACTIONS === "true") {
+    return new GhVariableStateStore(repo);
+  }
+  return new JsonStateStore(localFilePath);
+}
+var JsonStateStore, GH_VARIABLE_NAME, GhVariableStateStore;
+var init_state = __esm({
+  "src/watch/core/state.ts"() {
+    "use strict";
+    JsonStateStore = class {
+      data = {};
+      filePath;
+      dirty = false;
+      constructor(filePath) {
+        this.filePath = filePath;
+        this.load();
+      }
+      load() {
+        try {
+          if (fs15.existsSync(this.filePath)) {
+            const content = fs15.readFileSync(this.filePath, "utf-8");
+            const parsed = JSON.parse(content);
+            if (parsed && typeof parsed === "object") {
+              this.data = parsed;
+            }
+          }
+        } catch {
+          this.data = {};
+        }
+      }
+      get(key) {
+        return this.data[key];
+      }
+      set(key, value) {
+        this.data[key] = value;
+        this.dirty = true;
+      }
+      save() {
+        if (!this.dirty) return;
+        const dir = path13.dirname(this.filePath);
+        if (!fs15.existsSync(dir)) {
+          fs15.mkdirSync(dir, { recursive: true });
+        }
+        const tempPath = `${this.filePath}.tmp`;
+        const json = JSON.stringify(this.data, null, 2);
+        try {
+          fs15.writeFileSync(tempPath, json, "utf-8");
+          fs15.renameSync(tempPath, this.filePath);
+          this.dirty = false;
+        } catch (error) {
+          if (fs15.existsSync(tempPath)) {
+            fs15.unlinkSync(tempPath);
+          }
+          throw error;
+        }
+      }
+    };
+    GH_VARIABLE_NAME = "KODY_WATCH_STATE";
+    GhVariableStateStore = class {
+      data = {};
+      dirty = false;
+      repo;
+      constructor(repo) {
+        this.repo = repo;
+        this.loadFromGh();
+      }
+      loadFromGh() {
+        try {
+          const output = execFileSync10(
+            "gh",
+            ["variable", "get", GH_VARIABLE_NAME, "--repo", this.repo],
+            {
+              encoding: "utf-8",
+              stdio: ["pipe", "pipe", "pipe"],
+              env: { ...process.env, GH_TOKEN: process.env.GH_PAT || process.env.GH_TOKEN || "" }
+            }
+          ).trim();
+          if (output) {
+            const parsed = JSON.parse(output);
+            if (parsed && typeof parsed === "object") {
+              this.data = parsed;
+              return;
+            }
+          }
+        } catch (error) {
+          const msg = error instanceof Error ? error.message : String(error);
+          if (!msg.includes("HTTP 404") && !msg.includes("variable not found")) {
+            console.warn(`[KodyWatch] Failed to load state: ${msg} \u2014 starting fresh`);
+          }
+        }
+        this.data = {};
+      }
+      get(key) {
+        return this.data[key];
+      }
+      set(key, value) {
+        this.data[key] = value;
+        this.dirty = true;
+      }
+      save() {
+        if (!this.dirty) return;
+        const json = JSON.stringify(this.data);
+        try {
+          execFileSync10(
+            "gh",
+            ["variable", "set", GH_VARIABLE_NAME, "--repo", this.repo, "--body", json],
+            {
+              encoding: "utf-8",
+              stdio: ["pipe", "pipe", "pipe"],
+              env: { ...process.env, GH_TOKEN: process.env.GH_PAT || process.env.GH_TOKEN || "" }
+            }
+          );
+          this.dirty = false;
+        } catch (error) {
+          const msg = error instanceof Error ? error.message : String(error);
+          console.error(`[KodyWatch] Failed to save state: ${msg}`);
+        }
+      }
+    };
+  }
+});
+
+// src/watch/core/dedup.ts
+function shouldDedup(action, ctx) {
+  if (!action.dedupKey) return false;
+  const windowMs = (action.dedupWindowMinutes ?? 60) * 60 * 1e3;
+  const dedupKey = `dedup:${action.plugin}:${action.dedupKey}`;
+  const dedupEntries = ctx.state.get("watch:dedupEntries") || {};
+  const lastExecuted = dedupEntries[dedupKey];
+  if (!lastExecuted) return false;
+  const lastTime = parseInt(lastExecuted, 10);
+  if (Number.isNaN(lastTime)) return false;
+  return Date.now() - lastTime < windowMs;
+}
+function markExecuted(action, ctx) {
+  if (!action.dedupKey) return;
+  const dedupKey = `dedup:${action.plugin}:${action.dedupKey}`;
+  const dedupEntries = ctx.state.get("watch:dedupEntries") || {};
+  dedupEntries[dedupKey] = String(Date.now());
+  ctx.state.set("watch:dedupEntries", dedupEntries);
+}
+function cleanupExpiredDedup(ctx, maxAgeMs = 24 * 60 * 60 * 1e3) {
+  const dedupEntries = ctx.state.get("watch:dedupEntries") || {};
+  const now = Date.now();
+  let cleaned = 0;
+  const updated = {};
+  for (const [key, timestamp2] of Object.entries(dedupEntries)) {
+    const time = parseInt(timestamp2, 10);
+    if (Number.isNaN(time) || now - time > maxAgeMs) {
+      cleaned++;
+      continue;
+    }
+    updated[key] = timestamp2;
+  }
+  ctx.state.set("watch:dedupEntries", updated);
+  return cleaned;
+}
+var init_dedup = __esm({
+  "src/watch/core/dedup.ts"() {
+    "use strict";
+  }
+});
+
+// src/watch/clients/github.ts
+import { execFileSync as execFileSync11 } from "child_process";
+function createGitHubClient(repo, token) {
+  const gh2 = (args2, input) => {
+    try {
+      return execFileSync11("gh", args2, {
+        input,
+        encoding: "utf-8",
+        stdio: ["pipe", "pipe", "ignore"],
+        env: { ...process.env, GH_TOKEN: token }
+      }).trim();
+    } catch {
+      return "";
+    }
+  };
+  return {
+    postComment(issueNumber, body) {
+      gh2(["issue", "comment", String(issueNumber), "--repo", repo, "--body-file", "-"], body);
+    },
+    getIssue(issueNumber) {
+      const output = gh2([
+        "api",
+        `repos/${repo}/issues/${issueNumber}`,
+        "--jq",
+        "{body: .body, title: .title}"
+      ]);
+      if (!output) return { body: null, title: null };
+      try {
+        return JSON.parse(output);
+      } catch {
+        return { body: null, title: null };
+      }
+    },
+    getOpenIssues(labels) {
+      let query = `repos/${repo}/issues`;
+      if (labels && labels.length > 0) {
+        query += `?labels=${labels.join(",")}`;
+      }
+      const output = gh2([
+        "api",
+        query,
+        "--paginate",
+        "--jq",
+        '[.[] | select(.state == "open") | select(.pull_request == null) | {number: .number, title: .title, labels: [.labels[].name], updatedAt: .updated_at}]'
+      ]);
+      if (!output) return [];
+      return output.split("\n").filter(Boolean).flatMap((line) => {
+        try {
+          return JSON.parse(line);
+        } catch {
+          return [];
+        }
+      });
+    },
+    createIssue(title, body, labels) {
+      const args2 = ["issue", "create", "--repo", repo, "--title", title, "--body-file", "-"];
+      const output = gh2(args2, body);
+      if (!output) return null;
+      const match = output.match(/\/issues\/(\d+)/);
+      const issueNumber = match ? parseInt(match[1], 10) : null;
+      if (issueNumber && labels.length > 0) {
+        gh2(["issue", "edit", String(issueNumber), "--repo", repo, "--add-label", labels.join(",")]);
+      }
+      return issueNumber;
+    },
+    searchIssues(query) {
+      const output = gh2([
+        "api",
+        `search/issues?q=${encodeURIComponent(query + ` repo:${repo}`)}&per_page=30`,
+        "--jq",
+        "[.items[] | {number: .number, title: .title, labels: [.labels[].name], updatedAt: .updated_at}]"
+      ]);
+      if (!output) return [];
+      try {
+        return JSON.parse(output);
+      } catch {
+        return [];
+      }
+    }
+  };
+}
+var init_github = __esm({
+  "src/watch/clients/github.ts"() {
+    "use strict";
+  }
+});
+
+// src/watch/clients/logger.ts
+function createConsoleLogger() {
+  const format = (level, first, second) => {
+    const timestamp2 = (/* @__PURE__ */ new Date()).toISOString().slice(11, 19);
+    if (typeof first === "string") {
+      return `[${timestamp2}] ${level}: ${first}`;
+    }
+    const ctx = JSON.stringify(first);
+    return `[${timestamp2}] ${level}: ${second} ${ctx}`;
+  };
+  return {
+    debug(first, second) {
+      if (process.env.LOG_LEVEL === "debug") {
+        console.debug(format("DEBUG", first, second));
+      }
+    },
+    info(first, second) {
+      console.info(format("INFO", first, second));
+    },
+    warn(first, second) {
+      console.warn(format("WARN", first, second));
+    },
+    error(first, second) {
+      console.error(format("ERROR", first, second));
+    }
+  };
+}
+var init_logger2 = __esm({
+  "src/watch/clients/logger.ts"() {
+    "use strict";
+  }
+});
+
+// src/watch/core/watch.ts
+async function runWatch(config) {
+  const { repo, dryRun, stateFile, plugins } = config;
+  const state = createStateStore(repo, stateFile);
+  const cycleNumber = (state.get("system:cycleNumber") || 0) + 1;
+  state.set("system:cycleNumber", cycleNumber);
+  const token = process.env.GH_TOKEN || "";
+  const github = createGitHubClient(repo, token);
+  const log2 = createConsoleLogger();
+  const timestamp2 = (/* @__PURE__ */ new Date()).toISOString();
+  const ctx = {
+    repo,
+    dryRun,
+    state,
+    github,
+    log: log2,
+    runTimestamp: timestamp2,
+    cycleNumber,
+    digestIssue: config.digestIssue
+  };
+  const cleaned = cleanupExpiredDedup(ctx);
+  if (cleaned > 0) {
+    log2.debug({ cleaned }, "Cleaned up expired dedup entries");
+  }
+  const errors = [];
+  const allActions = [];
+  const scheduledPlugins = plugins.filter((plugin) => {
+    if (!plugin.schedule || !plugin.schedule.every) return true;
+    return cycleNumber % plugin.schedule.every === 0;
+  });
+  log2.info(
+    { cycle: cycleNumber, pluginsTotal: plugins.length, pluginsScheduled: scheduledPlugins.length },
+    "Watch cycle started"
+  );
+  for (const plugin of scheduledPlugins) {
+    try {
+      log2.debug({ plugin: plugin.name }, "Running plugin");
+      const actions = await plugin.run(ctx);
+      allActions.push(...actions);
+      log2.debug({ plugin: plugin.name, actionCount: actions.length }, "Plugin completed");
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      errors.push(`Plugin ${plugin.name}: ${message}`);
+      log2.error({ plugin: plugin.name, error: message }, "Plugin failed");
+    }
+  }
+  const dedupedActions = [];
+  let actionsDeduplicated = 0;
+  for (const action of allActions) {
+    if (shouldDedup(action, ctx)) {
+      actionsDeduplicated++;
+      log2.debug(
+        { plugin: action.plugin, type: action.type, dedupKey: action.dedupKey },
+        "Action deduplicated"
+      );
+      continue;
+    }
+    dedupedActions.push(action);
+  }
+  let actionsExecuted = 0;
+  if (!dryRun) {
+    for (const action of dedupedActions) {
+      try {
+        log2.info(
+          { plugin: action.plugin, type: action.type, target: action.target, urgency: action.urgency },
+          "Executing action"
+        );
+        const result3 = await action.execute(ctx);
+        if (result3.success) {
+          actionsExecuted++;
+          markExecuted(action, ctx);
+        } else {
+          log2.warn({ plugin: action.plugin, type: action.type, message: result3.message }, "Action failed");
+        }
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        errors.push(`Action ${action.plugin}/${action.type}: ${message}`);
+        log2.error({ plugin: action.plugin, type: action.type, error: message }, "Action error");
+      }
+    }
+  } else {
+    log2.info({ actionCount: dedupedActions.length }, "Dry run \u2014 skipping action execution");
+  }
+  state.save();
+  const result2 = {
+    cycleNumber,
+    pluginsRun: scheduledPlugins.length,
+    actionsProduced: allActions.length,
+    actionsExecuted,
+    actionsDeduplicated,
+    errors
+  };
+  log2.info(
+    {
+      cycle: cycleNumber,
+      pluginsRun: result2.pluginsRun,
+      actionsProduced: result2.actionsProduced,
+      actionsExecuted: result2.actionsExecuted,
+      actionsDeduplicated: result2.actionsDeduplicated,
+      errors: result2.errors.length
+    },
+    "Watch cycle completed"
+  );
+  return result2;
+}
+var init_watch = __esm({
+  "src/watch/core/watch.ts"() {
+    "use strict";
+    init_state();
+    init_dedup();
+    init_github();
+    init_logger2();
+  }
+});
+
+// src/watch/plugins/registry.ts
+function createPluginRegistry() {
+  return new PluginRegistry();
+}
+var PluginRegistry;
+var init_registry = __esm({
+  "src/watch/plugins/registry.ts"() {
+    "use strict";
+    PluginRegistry = class {
+      plugins = [];
+      register(plugin) {
+        const existing = this.plugins.find((p) => p.name === plugin.name);
+        if (existing) {
+          throw new Error(`Plugin already registered: ${plugin.name}`);
+        }
+        this.plugins.push(plugin);
+      }
+      getAll() {
+        return [...this.plugins];
+      }
+      clear() {
+        this.plugins = [];
+      }
+    };
+  }
+});
+
+// src/watch/plugins/pipeline-health/index.ts
+import * as fs16 from "fs";
+import * as path14 from "path";
+function discoverTasks(cwd) {
+  const tasksDir = path14.join(cwd, ".kody", "tasks");
+  if (!fs16.existsSync(tasksDir)) return [];
+  const tasks = [];
+  try {
+    for (const entry of fs16.readdirSync(tasksDir, { withFileTypes: true })) {
+      if (!entry.isDirectory()) continue;
+      const statusPath = path14.join(tasksDir, entry.name, "status.json");
+      if (!fs16.existsSync(statusPath)) continue;
+      try {
+        const content = fs16.readFileSync(statusPath, "utf-8");
+        const status = JSON.parse(content);
+        tasks.push({ taskId: entry.name, ...status });
+      } catch {
+      }
+    }
+  } catch {
+  }
+  return tasks;
+}
+function evaluateHealth(task) {
+  const now = Date.now();
+  if (task.state === "failed") {
+    const failedStage = Object.entries(task.stages || {}).find(([, s]) => s.state === "failed");
+    return {
+      taskId: task.taskId,
+      status: task.state,
+      health: "failed",
+      detail: failedStage ? `Failed at stage '${failedStage[0]}': ${failedStage[1].error || "unknown error"}` : "Pipeline failed",
+      failedStage: failedStage?.[0]
+    };
+  }
+  if (task.state === "running" || task.state === "in-progress") {
+    const startedAt = task.startedAt ? new Date(task.startedAt).getTime() : 0;
+    if (startedAt > 0) {
+      const durationMinutes = Math.round((now - startedAt) / 6e4);
+      if (durationMinutes > STALL_THRESHOLD_MINUTES) {
+        const runningStage = Object.entries(task.stages || {}).find(
+          ([, s]) => s.state === "running" || s.state === "in-progress"
+        );
+        return {
+          taskId: task.taskId,
+          status: task.state,
+          health: "stalled",
+          detail: runningStage ? `Stalled at stage '${runningStage[0]}' for ${durationMinutes} min` : `Running for ${durationMinutes} min without progress`,
+          durationMinutes
+        };
+      }
+    }
+    return {
+      taskId: task.taskId,
+      status: task.state,
+      health: "healthy",
+      detail: "Running normally"
+    };
+  }
+  return {
+    taskId: task.taskId,
+    status: task.state,
+    health: "healthy",
+    detail: task.state === "completed" ? "Completed successfully" : `Status: ${task.state}`
+  };
+}
+function formatDigestMarkdown(evaluations, cycleNumber) {
+  const unhealthy = evaluations.filter((e) => e.health !== "healthy");
+  if (unhealthy.length === 0) return "";
+  let md = `## Pipeline Health \u2014 Cycle #${cycleNumber}
+
+`;
+  md += `| Task | Status | Health | Detail |
+`;
+  md += `|------|--------|--------|--------|
+`;
+  for (const e of unhealthy) {
+    const icon = e.health === "failed" ? "\u{1F534}" : e.health === "stalled" ? "\u{1F7E1}" : "\u{1F7E0}";
+    md += `| \`${e.taskId}\` | ${e.status} | ${icon} ${e.health} | ${e.detail} |
+`;
+  }
+  md += `
+_Generated by Kody Watch on ${(/* @__PURE__ */ new Date()).toISOString()}_`;
+  return md;
+}
+var STALL_THRESHOLD_MINUTES, pipelineHealthPlugin;
+var init_pipeline_health = __esm({
+  "src/watch/plugins/pipeline-health/index.ts"() {
+    "use strict";
+    STALL_THRESHOLD_MINUTES = 30;
+    pipelineHealthPlugin = {
+      name: "pipeline-health",
+      description: "Monitor .kody/tasks/ for stalled, failed, or stuck pipeline runs",
+      domain: "pipeline",
+      schedule: { every: 1 },
+      async run(ctx) {
+        const tasks = discoverTasks(process.cwd());
+        if (tasks.length === 0) {
+          ctx.log.info("No tasks found \u2014 skipping pipeline-health");
+          return [];
+        }
+        const evaluations = tasks.map(evaluateHealth);
+        const unhealthy = evaluations.filter((e) => e.health !== "healthy");
+        ctx.log.info(
+          { total: tasks.length, unhealthy: unhealthy.length },
+          "Pipeline health scan complete"
+        );
+        if (unhealthy.length === 0) return [];
+        const actions = [];
+        if (ctx.digestIssue) {
+          actions.push({
+            plugin: "pipeline-health",
+            type: "digest",
+            urgency: "warning",
+            title: "Pipeline Health Report",
+            detail: `${unhealthy.length} unhealthy task(s)`,
+            dedupKey: "pipeline-health:digest",
+            dedupWindowMinutes: 25,
+            // Slightly less than 30 min cycle
+            async execute(execCtx) {
+              if (!execCtx.digestIssue) return { success: false, message: "No digest issue" };
+              const markdown = formatDigestMarkdown(evaluations, execCtx.cycleNumber);
+              if (!markdown) return { success: true, message: "No unhealthy tasks" };
+              execCtx.github.postComment(execCtx.digestIssue, markdown);
+              return { success: true, message: `Reported ${unhealthy.length} unhealthy task(s)` };
+            }
+          });
+        }
+        return actions;
+      }
+    };
+  }
+});
+
+// src/watch/plugins/security-scan/rules.ts
+var SECRET_PATTERNS, SECRET_SCAN_EXCLUDES, UNSAFE_PATTERNS, ENV_FILE_PATTERNS;
+var init_rules = __esm({
+  "src/watch/plugins/security-scan/rules.ts"() {
+    "use strict";
+    SECRET_PATTERNS = [
+      { label: "AWS access key", pattern: /['"]AKIA[0-9A-Z]{16}['"]/ },
+      { label: "Generic API key assignment", pattern: /(?:api[_-]?key|apikey|api_secret)\s*[:=]\s*['"][a-zA-Z0-9_\-]{20,}['"]/i },
+      { label: "Private key block", pattern: /-----BEGIN\s+(RSA\s+)?PRIVATE\s+KEY-----/ },
+      { label: "JWT token", pattern: /['"]eyJ[a-zA-Z0-9_-]{10,}\.[a-zA-Z0-9_-]{10,}\.[a-zA-Z0-9_-]{10,}['"]/ }
+    ];
+    SECRET_SCAN_EXCLUDES = [
+      "node_modules/",
+      ".next/",
+      ".git/",
+      "dist/",
+      "build/",
+      "tests/",
+      ".env",
+      "pnpm-lock.yaml",
+      "package-lock.json",
+      "*.test.ts",
+      "*.spec.ts",
+      "*.md",
+      "*.json"
+    ];
+    UNSAFE_PATTERNS = [
+      { label: "eval() usage", pattern: /\beval\s*\(/, severity: "high" },
+      { label: "innerHTML assignment", pattern: /\.innerHTML\s*=/, severity: "medium" },
+      { label: "Unsanitized exec", pattern: /exec\s*\(\s*`/, severity: "high" },
+      { label: "Unsanitized execSync", pattern: /execSync\s*\(\s*`/, severity: "high" }
+    ];
+    ENV_FILE_PATTERNS = [
+      ".env",
+      ".env.local",
+      ".env.production",
+      ".env.staging"
+    ];
+  }
+});
+
+// src/watch/plugins/security-scan/scanner.ts
+import * as fs17 from "fs";
+import * as path15 from "path";
+import { execFileSync as execFileSync12 } from "child_process";
+function findFiles(dir, pattern, exclude = []) {
+  const results = [];
+  if (!fs17.existsSync(dir)) return results;
+  let entries;
+  try {
+    entries = fs17.readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return results;
+  }
+  if (!entries || !Array.isArray(entries)) return results;
+  for (const entry of entries) {
+    const fullPath = path15.join(dir, entry.name);
+    const shouldExclude = exclude.some((ex) => {
+      if (ex.endsWith("/")) return fullPath.includes(ex);
+      if (ex.startsWith("*")) return entry.name.endsWith(ex.slice(1));
+      return entry.name === ex || fullPath.endsWith(ex);
+    });
+    if (shouldExclude) continue;
+    if (entry.isDirectory()) {
+      results.push(...findFiles(fullPath, pattern, exclude));
+    } else if (pattern.test(entry.name)) {
+      results.push(fullPath);
+    }
+  }
+  return results;
+}
+function scanForHardcodedSecrets(rootDir) {
+  const findings = [];
+  const srcDir = path15.join(rootDir, "src");
+  if (!fs17.existsSync(srcDir)) return findings;
+  const sourceFiles = findFiles(srcDir, /\.(ts|tsx|js|jsx)$/, SECRET_SCAN_EXCLUDES);
+  for (const filePath of sourceFiles) {
+    const relativePath = path15.relative(rootDir, filePath);
+    const content = fs17.readFileSync(filePath, "utf-8");
+    const lines = content.split("\n");
+    for (let i = 0; i < lines.length; i++) {
+      const line = lines[i];
+      for (const secretDef of SECRET_PATTERNS) {
+        if (secretDef.pattern.test(line)) {
+          findings.push({
+            rule: "hardcoded-secret",
+            severity: "critical",
+            file: relativePath,
+            line: i + 1,
+            message: `Potential hardcoded secret: ${secretDef.label}`,
+            detail: `Line ${i + 1}: ${line.trim().substring(0, 80)}...`
+          });
+        }
+      }
+    }
+  }
+  return findings;
+}
+function scanForUnsafePatterns(rootDir) {
+  const findings = [];
+  const srcDir = path15.join(rootDir, "src");
+  if (!fs17.existsSync(srcDir)) return findings;
+  const sourceFiles = findFiles(srcDir, /\.(ts|tsx|js|jsx)$/, SECRET_SCAN_EXCLUDES);
+  for (const filePath of sourceFiles) {
+    const relativePath = path15.relative(rootDir, filePath);
+    const content = fs17.readFileSync(filePath, "utf-8");
+    const lines = content.split("\n");
+    for (let i = 0; i < lines.length; i++) {
+      const line = lines[i];
+      for (const unsafeDef of UNSAFE_PATTERNS) {
+        if (unsafeDef.pattern.test(line)) {
+          findings.push({
+            rule: `unsafe-pattern:${unsafeDef.label.toLowerCase().replace(/\s+/g, "-")}`,
+            severity: unsafeDef.severity,
+            file: relativePath,
+            line: i + 1,
+            message: `Unsafe pattern: ${unsafeDef.label}`,
+            detail: `Line ${i + 1}: ${line.trim().substring(0, 80)}`
+          });
+        }
+      }
+    }
+  }
+  return findings;
+}
+function scanForCommittedEnvFiles(rootDir) {
+  const findings = [];
+  for (const envFile of ENV_FILE_PATTERNS) {
+    const envPath = path15.join(rootDir, envFile);
+    if (!fs17.existsSync(envPath)) continue;
+    try {
+      execFileSync12("git", ["ls-files", "--error-unmatch", envFile], {
+        cwd: rootDir,
+        encoding: "utf-8",
+        stdio: ["pipe", "pipe", "pipe"]
+      });
+      findings.push({
+        rule: "committed-env-file",
+        severity: "critical",
+        file: envFile,
+        message: `Environment file committed to git: ${envFile}`,
+        detail: `${envFile} is tracked by git and may contain secrets`
+      });
+    } catch {
+    }
+  }
+  return findings;
+}
+function scanDependencyVulnerabilities(rootDir) {
+  const findings = [];
+  const hasYarn = fs17.existsSync(path15.join(rootDir, "yarn.lock"));
+  const hasPnpm = fs17.existsSync(path15.join(rootDir, "pnpm-lock.yaml"));
+  const hasNpm = fs17.existsSync(path15.join(rootDir, "package-lock.json"));
+  const auditCmd = hasPnpm ? "pnpm" : hasYarn ? "yarn" : hasNpm ? "npm" : null;
+  if (!auditCmd) return findings;
+  try {
+    const output = execFileSync12(auditCmd, ["audit", "--json"], {
+      cwd: rootDir,
+      encoding: "utf-8",
+      timeout: 6e4,
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    if (hasPnpm || hasNpm) {
+      try {
+        const audit = JSON.parse(output);
+        const vulnerabilities = audit.vulnerabilities || audit.advisories || {};
+        for (const [name, vuln] of Object.entries(vulnerabilities)) {
+          const v = vuln;
+          const severity = v.severity || "medium";
+          if (severity === "low" || severity === "info") continue;
+          findings.push({
+            rule: "dependency-vulnerability",
+            severity: severity === "critical" ? "critical" : severity === "high" ? "high" : "medium",
+            file: "package.json",
+            message: `Vulnerable dependency: ${name} (${severity})`,
+            detail: v.title || v.overview || `${name} has a ${severity} vulnerability`
+          });
+        }
+      } catch {
+      }
+    }
+  } catch (error) {
+    const stderr = error instanceof Error ? error.stdout || "" : "";
+    if (stderr) {
+      try {
+        const audit = JSON.parse(stderr);
+        const meta = audit.metadata || {};
+        const total = (meta.vulnerabilities?.critical || 0) + (meta.vulnerabilities?.high || 0);
+        if (total > 0) {
+          findings.push({
+            rule: "dependency-vulnerability",
+            severity: "high",
+            file: "package.json",
+            message: `${total} critical/high dependency vulnerabilities found`,
+            detail: `Run '${auditCmd} audit' for details`
+          });
+        }
+      } catch {
+      }
+    }
+  }
+  return findings;
+}
+function runAllScans(rootDir) {
+  const allFindings = [];
+  allFindings.push(...scanForHardcodedSecrets(rootDir));
+  allFindings.push(...scanForUnsafePatterns(rootDir));
+  allFindings.push(...scanForCommittedEnvFiles(rootDir));
+  allFindings.push(...scanDependencyVulnerabilities(rootDir));
+  const severityOrder = {
+    critical: 0,
+    high: 1,
+    medium: 2,
+    low: 3
+  };
+  allFindings.sort((a, b) => (severityOrder[a.severity] ?? 3) - (severityOrder[b.severity] ?? 3));
+  return allFindings;
+}
+var init_scanner = __esm({
+  "src/watch/plugins/security-scan/scanner.ts"() {
+    "use strict";
+    init_rules();
+  }
+});
+
+// src/watch/plugins/security-scan/index.ts
+function groupFindingsByRule(findings) {
+  const groups = /* @__PURE__ */ new Map();
+  for (const finding of findings) {
+    const existing = groups.get(finding.rule) || [];
+    existing.push(finding);
+    groups.set(finding.rule, existing);
+  }
+  return groups;
+}
+function buildBatchedTitle(rule, findings) {
+  if (findings.length === 1) {
+    return `[Security] ${findings[0].message}`;
+  }
+  const firstMessage = findings[0].message;
+  return `[Security] ${findings.length}x: ${firstMessage.split(":")[0]}`;
+}
+function buildBatchedBody(rule, findings) {
+  let body = `## Security Finding
+
+`;
+  body += `**Rule:** \`${rule}\`
+`;
+  body += `**Findings:** ${findings.length}
+
+`;
+  body += `### Affected Files
+
+`;
+  for (const f of findings) {
+    body += `- \`${f.file}${f.line ? `:${f.line}` : ""}\` \u2014 ${f.message}
+`;
+  }
+  body += `
+### Details
+
+`;
+  body += "```\n" + findings[0].detail + "\n```\n\n";
+  if (findings.length > 1) {
+    body += `_${findings.length - 1} additional files have the same issue._
+
+`;
+  }
+  body += `_Auto-generated by Kody Watch security-scan on ${(/* @__PURE__ */ new Date()).toISOString()}_`;
+  return body;
+}
+function formatDigestMarkdown2(findings, cycleNumber) {
+  const counts = {
+    critical: findings.filter((f) => f.severity === "critical").length,
+    high: findings.filter((f) => f.severity === "high").length,
+    medium: findings.filter((f) => f.severity === "medium").length,
+    low: findings.filter((f) => f.severity === "low").length
+  };
+  let md = `## Security Scan \u2014 Cycle #${cycleNumber}
+
+`;
+  md += `| Severity | Count |
+|----------|-------|
+`;
+  md += `| Critical | ${counts.critical} |
+`;
+  md += `| High | ${counts.high} |
+`;
+  md += `| Medium | ${counts.medium} |
+`;
+  md += `| Low | ${counts.low} |
+
+`;
+  if (findings.length > 0) {
+    md += `### Findings
+
+`;
+    md += `| Severity | File | Message |
+|----------|------|---------|
+`;
+    for (const f of findings.slice(0, 20)) {
+      md += `| ${f.severity} | \`${f.file}${f.line ? `:${f.line}` : ""}\` | ${f.message} |
+`;
+    }
+    if (findings.length > 20) {
+      md += `
+_... and ${findings.length - 20} more findings_
+`;
+    }
+  }
+  md += `
+_Generated by Kody Watch on ${(/* @__PURE__ */ new Date()).toISOString()}_`;
+  return md;
+}
+var DEDUP_WINDOW_MINUTES, SECURITY_LABEL, MAX_ISSUES_PER_CYCLE, securityScanPlugin;
+var init_security_scan = __esm({
+  "src/watch/plugins/security-scan/index.ts"() {
+    "use strict";
+    init_scanner();
+    DEDUP_WINDOW_MINUTES = 23 * 60;
+    SECURITY_LABEL = "kody:security";
+    MAX_ISSUES_PER_CYCLE = 3;
+    securityScanPlugin = {
+      name: "security-scan",
+      description: "Broad security audit: secrets, dependency CVEs, unsafe patterns, committed env files",
+      domain: "security",
+      schedule: { every: 48 },
+      async run(ctx) {
+        ctx.log.debug("Running security-scan plugin");
+        const findings = runAllScans(process.cwd());
+        if (findings.length === 0) {
+          ctx.log.info("No security findings");
+          return [];
+        }
+        ctx.log.info(
+          {
+            total: findings.length,
+            critical: findings.filter((f) => f.severity === "critical").length,
+            high: findings.filter((f) => f.severity === "high").length
+          },
+          "Security scan complete"
+        );
+        const actions = [];
+        if (ctx.digestIssue) {
+          actions.push({
+            plugin: "security-scan",
+            type: "digest",
+            urgency: "info",
+            title: "Security Scan Report",
+            detail: `${findings.length} findings`,
+            dedupKey: "security-scan:digest-daily",
+            dedupWindowMinutes: DEDUP_WINDOW_MINUTES,
+            async execute(execCtx) {
+              if (!execCtx.digestIssue) return { success: false, message: "No digest issue" };
+              const markdown = formatDigestMarkdown2(findings, execCtx.cycleNumber);
+              execCtx.github.postComment(execCtx.digestIssue, markdown);
+              return { success: true, message: "Digest posted" };
+            }
+          });
+        }
+        const criticalFindings = findings.filter((f) => f.severity === "critical");
+        const grouped = groupFindingsByRule(criticalFindings);
+        let issueCount = 0;
+        for (const [rule, ruleFindings] of grouped) {
+          if (issueCount >= MAX_ISSUES_PER_CYCLE) break;
+          const dedupKey = `security-scan:issue:${rule}`;
+          const title = buildBatchedTitle(rule, ruleFindings);
+          actions.push({
+            plugin: "security-scan",
+            type: "create-issue",
+            urgency: "critical",
+            title,
+            detail: `${ruleFindings.length} finding(s) for rule ${rule}`,
+            dedupKey,
+            dedupWindowMinutes: DEDUP_WINDOW_MINUTES,
+            async execute(execCtx) {
+              const existing = execCtx.github.searchIssues(`"[Security]" label:${SECURITY_LABEL} is:open "${rule}"`);
+              if (existing.length > 0) {
+                return { success: true, message: `Issue already exists (#${existing[0].number})` };
+              }
+              const body = buildBatchedBody(rule, ruleFindings);
+              const issueNumber = execCtx.github.createIssue(title, body, [SECURITY_LABEL]);
+              return issueNumber ? { success: true, message: `Created issue #${issueNumber}` } : { success: false, message: "Failed to create issue" };
+            }
+          });
+          issueCount++;
+        }
+        return actions;
+      }
+    };
+  }
+});
+
+// src/watch/plugins/config-health/index.ts
+import * as fs18 from "fs";
+import * as path16 from "path";
+import { execFileSync as execFileSync13 } from "child_process";
+function validateConfig(cwd, repo) {
+  const findings = [];
+  const configPath = path16.join(cwd, "kody.config.json");
+  if (!fs18.existsSync(configPath)) {
+    findings.push({
+      check: "config-exists",
+      severity: "error",
+      message: "kody.config.json not found"
+    });
+    return findings;
+  }
+  let config;
+  try {
+    config = JSON.parse(fs18.readFileSync(configPath, "utf-8"));
+  } catch {
+    findings.push({
+      check: "config-valid-json",
+      severity: "error",
+      message: "kody.config.json is not valid JSON"
+    });
+    return findings;
+  }
+  const github = config.github;
+  if (!github?.owner || !github?.repo) {
+    findings.push({
+      check: "config-github",
+      severity: "error",
+      message: "Missing github.owner or github.repo in kody.config.json"
+    });
+  }
+  const quality = config.quality;
+  if (!quality?.testUnit) {
+    findings.push({
+      check: "config-test-command",
+      severity: "warning",
+      message: "No quality.testUnit command configured \u2014 Kody won't run tests"
+    });
+  }
+  if (quality) {
+    const pkgPath = path16.join(cwd, "package.json");
+    if (fs18.existsSync(pkgPath)) {
+      try {
+        const pkg = JSON.parse(fs18.readFileSync(pkgPath, "utf-8"));
+        const scripts = pkg.scripts || {};
+        for (const [key, cmd] of Object.entries(quality)) {
+          if (typeof cmd !== "string" || !cmd) continue;
+          const parts = String(cmd).split(/\s+/);
+          const scriptName = parts.length > 1 ? parts[1] : parts[0];
+          if (scriptName && !scriptName.startsWith("-") && !(scriptName in scripts)) {
+            if (["pnpm", "npm", "yarn"].includes(parts[0]) && !(scriptName in scripts)) {
+              findings.push({
+                check: `config-quality-${key}`,
+                severity: "warning",
+                message: `quality.${key} references script '${scriptName}' which doesn't exist in package.json`
+              });
+            }
+          }
+        }
+      } catch {
+      }
+    }
+  }
+  const kodyDir = path16.join(cwd, ".kody");
+  if (!fs18.existsSync(kodyDir)) {
+    findings.push({
+      check: "kody-dir",
+      severity: "warning",
+      message: ".kody/ directory missing \u2014 run bootstrap to initialize"
+    });
+  }
+  if (repo) {
+    try {
+      const output = execFileSync13("gh", ["secret", "list", "--repo", repo], {
+        encoding: "utf-8",
+        timeout: 1e4,
+        stdio: ["pipe", "pipe", "pipe"]
+      });
+      if (!output.includes("ANTHROPIC_API_KEY")) {
+        findings.push({
+          check: "secret-anthropic",
+          severity: "error",
+          message: "ANTHROPIC_API_KEY secret not found \u2014 Kody pipeline will fail"
+        });
+      }
+    } catch {
+    }
+  }
+  return findings;
+}
+function formatDigestMarkdown3(findings, cycleNumber) {
+  let md = `## Config Health \u2014 Cycle #${cycleNumber}
+
+`;
+  md += `| Check | Severity | Message |
+|-------|----------|---------|
+`;
+  for (const f of findings) {
+    const icon = f.severity === "error" ? "\u{1F534}" : "\u{1F7E1}";
+    md += `| ${f.check} | ${icon} ${f.severity} | ${f.message} |
+`;
+  }
+  md += `
+_Generated by Kody Watch on ${(/* @__PURE__ */ new Date()).toISOString()}_`;
+  return md;
+}
+var configHealthPlugin;
+var init_config_health = __esm({
+  "src/watch/plugins/config-health/index.ts"() {
+    "use strict";
+    configHealthPlugin = {
+      name: "config-health",
+      description: "Validate kody.config.json, secrets, quality commands, and .kody/ integrity",
+      domain: "config",
+      schedule: { every: 48 },
+      async run(ctx) {
+        const findings = validateConfig(process.cwd(), ctx.repo);
+        if (findings.length === 0) {
+          ctx.log.info("Config health check passed");
+          return [];
+        }
+        ctx.log.info(
+          { total: findings.length, errors: findings.filter((f) => f.severity === "error").length },
+          "Config health issues found"
+        );
+        const actions = [];
+        if (ctx.digestIssue) {
+          actions.push({
+            plugin: "config-health",
+            type: "digest",
+            urgency: "warning",
+            title: "Config Health Report",
+            detail: `${findings.length} issue(s) found`,
+            dedupKey: "config-health:digest-daily",
+            dedupWindowMinutes: 23 * 60,
+            async execute(execCtx) {
+              if (!execCtx.digestIssue) return { success: false, message: "No digest issue" };
+              const markdown = formatDigestMarkdown3(findings, execCtx.cycleNumber);
+              execCtx.github.postComment(execCtx.digestIssue, markdown);
+              return { success: true, message: `Reported ${findings.length} config issue(s)` };
+            }
+          });
+        }
+        return actions;
+      }
+    };
+  }
+});
+
+// src/watch/index.ts
+var watch_exports = {};
+__export(watch_exports, {
+  runWatchCommand: () => runWatchCommand
+});
+import * as fs19 from "fs";
+import * as path17 from "path";
+async function runWatchCommand(opts) {
+  const cwd = process.cwd();
+  const configPath = path17.join(cwd, "kody.config.json");
+  let repo = process.env.REPO || "";
+  let digestIssue;
+  if (!repo && fs19.existsSync(configPath)) {
+    try {
+      const config2 = JSON.parse(fs19.readFileSync(configPath, "utf-8"));
+      if (config2.github?.owner && config2.github?.repo) {
+        repo = `${config2.github.owner}/${config2.github.repo}`;
+      }
+      if (config2.watch?.digestIssue) {
+        digestIssue = config2.watch.digestIssue;
+      }
+    } catch {
+    }
+  }
+  if (process.env.WATCH_DIGEST_ISSUE) {
+    digestIssue = parseInt(process.env.WATCH_DIGEST_ISSUE, 10) || void 0;
+  }
+  if (!repo) {
+    console.error("Missing repo \u2014 set REPO env var or configure github.owner/repo in kody.config.json");
+    process.exit(1);
+  }
+  if (!process.env.GH_TOKEN && !process.env.GITHUB_TOKEN) {
+    console.error("Missing GH_TOKEN or GITHUB_TOKEN");
+    process.exit(1);
+  }
+  const registry = createPluginRegistry();
+  registry.register(pipelineHealthPlugin);
+  registry.register(securityScanPlugin);
+  registry.register(configHealthPlugin);
+  const config = {
+    repo,
+    dryRun: opts.dryRun,
+    stateFile: path17.join(cwd, ".kody", "watch-state.json"),
+    plugins: registry.getAll(),
+    digestIssue
+  };
+  console.log(`
+Kody Watch \u2014 repo: ${repo}, dry-run: ${opts.dryRun}
+`);
+  try {
+    const result2 = await runWatch(config);
+    if (result2.errors.length > 0) {
+      for (const error of result2.errors) {
+        console.warn(`  Warning: ${error}`);
+      }
+    }
+    console.log(`
+Cycle #${result2.cycleNumber} complete: ${result2.pluginsRun} plugins, ${result2.actionsExecuted} actions, ${result2.actionsDeduplicated} deduplicated`);
+    process.exit(0);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    console.error(`Watch failed: ${message}`);
+    process.exit(1);
+  }
+}
+var init_watch2 = __esm({
+  "src/watch/index.ts"() {
+    "use strict";
+    init_watch();
+    init_registry();
+    init_pipeline_health();
+    init_security_scan();
+    init_config_health();
+  }
+});
+
 // src/definitions.ts
 var definitions_exports = {};
 __export(definitions_exports, {
@@ -3047,7 +4236,7 @@ var init_definitions = __esm({
 });
 
 // src/git-utils.ts
-import { execFileSync as execFileSync10 } from "child_process";
+import { execFileSync as execFileSync14 } from "child_process";
 function getHookSafeEnv() {
   if (!_hookSafeEnv) {
     _hookSafeEnv = { ...process.env, HUSKY: "0", SKIP_HOOKS: "1" };
@@ -3055,7 +4244,7 @@ function getHookSafeEnv() {
   return _hookSafeEnv;
 }
 function git(args2, options) {
-  return execFileSync10("git", args2, {
+  return execFileSync14("git", args2, {
     encoding: "utf-8",
     timeout: options?.timeout ?? 3e4,
     cwd: options?.cwd,
@@ -3241,14 +4430,14 @@ var init_git_utils = __esm({
 });
 
 // src/pipeline/state.ts
-import * as fs15 from "fs";
-import * as path13 from "path";
+import * as fs20 from "fs";
+import * as path18 from "path";
 function loadState(taskId, taskDir) {
-  const p = path13.join(taskDir, "status.json");
-  if (!fs15.existsSync(p)) return null;
+  const p = path18.join(taskDir, "status.json");
+  if (!fs20.existsSync(p)) return null;
   try {
     const result2 = parseJsonSafe(
-      fs15.readFileSync(p, "utf-8"),
+      fs20.readFileSync(p, "utf-8"),
       ["taskId", "state", "stages", "createdAt", "updatedAt"]
     );
     if (!result2.ok) {
@@ -3266,10 +4455,10 @@ function writeState(state, taskDir) {
     ...state,
     updatedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
-  const target = path13.join(taskDir, "status.json");
+  const target = path18.join(taskDir, "status.json");
   const tmp = target + ".tmp";
-  fs15.writeFileSync(tmp, JSON.stringify(updated, null, 2));
-  fs15.renameSync(tmp, target);
+  fs20.writeFileSync(tmp, JSON.stringify(updated, null, 2));
+  fs20.renameSync(tmp, target);
   return updated;
 }
 function initState(taskId) {
@@ -3280,7 +4469,7 @@ function initState(taskId) {
   const now = (/* @__PURE__ */ new Date()).toISOString();
   return { taskId, state: "running", stages, createdAt: now, updatedAt: now };
 }
-var init_state = __esm({
+var init_state2 = __esm({
   "src/pipeline/state.ts"() {
     "use strict";
     init_definitions();
@@ -3310,16 +4499,16 @@ var init_complexity = __esm({
 });
 
 // src/memory.ts
-import * as fs16 from "fs";
-import * as path14 from "path";
+import * as fs21 from "fs";
+import * as path19 from "path";
 function readProjectMemory(projectDir) {
-  const memoryDir = path14.join(projectDir, ".kody", "memory");
-  if (!fs16.existsSync(memoryDir)) return "";
-  const files = fs16.readdirSync(memoryDir).filter((f) => f.endsWith(".md")).sort();
+  const memoryDir = path19.join(projectDir, ".kody", "memory");
+  if (!fs21.existsSync(memoryDir)) return "";
+  const files = fs21.readdirSync(memoryDir).filter((f) => f.endsWith(".md")).sort();
   if (files.length === 0) return "";
   const sections = [];
   for (const file of files) {
-    const content = fs16.readFileSync(path14.join(memoryDir, file), "utf-8").trim();
+    const content = fs21.readFileSync(path19.join(memoryDir, file), "utf-8").trim();
     if (content) {
       sections.push(`## ${file.replace(".md", "")}
 ${content}`);
@@ -3338,8 +4527,8 @@ var init_memory = __esm({
 });
 
 // src/context-tiers.ts
-import * as fs17 from "fs";
-import * as path15 from "path";
+import * as fs22 from "fs";
+import * as path20 from "path";
 function estimateTokens(text) {
   return Math.ceil(text.length / 4);
 }
@@ -3430,7 +4619,7 @@ function generateL1Json(content) {
   }
 }
 function getTieredContent(filePath, content) {
-  const key = path15.basename(filePath);
+  const key = path20.basename(filePath);
   return {
     source: filePath,
     L0: generateL0(content, key),
@@ -3442,15 +4631,15 @@ function selectTier(tiered, tier) {
   return tiered[tier];
 }
 function readProjectMemoryTiered(projectDir, tier) {
-  const memoryDir = path15.join(projectDir, ".kody", "memory");
-  if (!fs17.existsSync(memoryDir)) return "";
-  const files = fs17.readdirSync(memoryDir).filter((f) => f.endsWith(".md")).sort();
+  const memoryDir = path20.join(projectDir, ".kody", "memory");
+  if (!fs22.existsSync(memoryDir)) return "";
+  const files = fs22.readdirSync(memoryDir).filter((f) => f.endsWith(".md")).sort();
   if (files.length === 0) return "";
   const tierLabel2 = tier === "L2" ? "full" : tier === "L1" ? "overview" : "abstract";
   const sections = [];
   for (const file of files) {
-    const filePath = path15.join(memoryDir, file);
-    const content = fs17.readFileSync(filePath, "utf-8").trim();
+    const filePath = path20.join(memoryDir, file);
+    const content = fs22.readFileSync(filePath, "utf-8").trim();
     if (!content) continue;
     const tiered = getTieredContent(filePath, content);
     const selected = selectTier(tiered, tier);
@@ -3473,9 +4662,9 @@ function injectTaskContextTiered(prompt, taskId, taskDir, policy, feedback) {
 `;
   context += `Task Directory: ${taskDir}
 `;
-  const taskMdPath = path15.join(taskDir, "task.md");
-  if (fs17.existsSync(taskMdPath)) {
-    const content = fs17.readFileSync(taskMdPath, "utf-8");
+  const taskMdPath = path20.join(taskDir, "task.md");
+  if (fs22.existsSync(taskMdPath)) {
+    const content = fs22.readFileSync(taskMdPath, "utf-8");
     const selected = selectContent(taskMdPath, content, policy.taskDescription);
     const label = tierLabel("Task Description", policy.taskDescription);
     context += `
@@ -3483,9 +4672,9 @@ function injectTaskContextTiered(prompt, taskId, taskDir, policy, feedback) {
 ${selected}
 `;
   }
-  const taskJsonPath = path15.join(taskDir, "task.json");
-  if (fs17.existsSync(taskJsonPath)) {
-    const content = fs17.readFileSync(taskJsonPath, "utf-8");
+  const taskJsonPath = path20.join(taskDir, "task.json");
+  if (fs22.existsSync(taskJsonPath)) {
+    const content = fs22.readFileSync(taskJsonPath, "utf-8");
     if (policy.taskClassification === "L2") {
       try {
         const taskDef = JSON.parse(content.replace(/^```json\s*\n?/m, "").replace(/\n?```\s*$/m, ""));
@@ -3511,9 +4700,9 @@ ${selected}
       }
     }
   }
-  const specPath = path15.join(taskDir, "spec.md");
-  if (fs17.existsSync(specPath)) {
-    const content = fs17.readFileSync(specPath, "utf-8");
+  const specPath = path20.join(taskDir, "spec.md");
+  if (fs22.existsSync(specPath)) {
+    const content = fs22.readFileSync(specPath, "utf-8");
     const selected = selectContent(specPath, content, policy.spec);
     const label = tierLabel("Spec", policy.spec);
     context += `
@@ -3521,9 +4710,9 @@ ${selected}
 ${selected}
 `;
   }
-  const planPath = path15.join(taskDir, "plan.md");
-  if (fs17.existsSync(planPath)) {
-    const content = fs17.readFileSync(planPath, "utf-8");
+  const planPath = path20.join(taskDir, "plan.md");
+  if (fs22.existsSync(planPath)) {
+    const content = fs22.readFileSync(planPath, "utf-8");
     const selected = selectContent(planPath, content, policy.plan);
     const label = tierLabel("Plan", policy.plan);
     context += `
@@ -3531,9 +4720,9 @@ ${selected}
 ${selected}
 `;
   }
-  const contextMdPath = path15.join(taskDir, "context.md");
-  if (fs17.existsSync(contextMdPath)) {
-    const content = fs17.readFileSync(contextMdPath, "utf-8");
+  const contextMdPath = path20.join(taskDir, "context.md");
+  if (fs22.existsSync(contextMdPath)) {
+    const content = fs22.readFileSync(contextMdPath, "utf-8");
     const selected = selectContent(contextMdPath, content, policy.accumulatedContext);
     const label = tierLabel("Previous Stage Context", policy.accumulatedContext);
     context += `
@@ -3619,24 +4808,24 @@ var init_context_tiers = __esm({
 });
 
 // src/context.ts
-import * as fs18 from "fs";
-import * as path16 from "path";
+import * as fs23 from "fs";
+import * as path21 from "path";
 function readPromptFile(stageName, projectDir) {
   if (projectDir) {
-    const stepFile = path16.join(projectDir, ".kody", "steps", `${stageName}.md`);
-    if (fs18.existsSync(stepFile)) {
-      return fs18.readFileSync(stepFile, "utf-8");
+    const stepFile = path21.join(projectDir, ".kody", "steps", `${stageName}.md`);
+    if (fs23.existsSync(stepFile)) {
+      return fs23.readFileSync(stepFile, "utf-8");
     }
     console.warn(`  \u26A0 No step file at ${stepFile}, falling back to engine defaults. Run 'kody-engine-lite init --force' to generate step files.`);
   }
   const scriptDir = new URL(".", import.meta.url).pathname;
   const candidates = [
-    path16.resolve(scriptDir, "..", "prompts", `${stageName}.md`),
-    path16.resolve(scriptDir, "..", "..", "prompts", `${stageName}.md`)
+    path21.resolve(scriptDir, "..", "prompts", `${stageName}.md`),
+    path21.resolve(scriptDir, "..", "..", "prompts", `${stageName}.md`)
   ];
   for (const candidate of candidates) {
-    if (fs18.existsSync(candidate)) {
-      return fs18.readFileSync(candidate, "utf-8");
+    if (fs23.existsSync(candidate)) {
+      return fs23.readFileSync(candidate, "utf-8");
     }
   }
   throw new Error(`Prompt file not found: tried ${candidates.join(", ")}`);
@@ -3648,18 +4837,18 @@ function injectTaskContext(prompt, taskId, taskDir, feedback) {
 `;
   context += `Task Directory: ${taskDir}
 `;
-  const taskMdPath = path16.join(taskDir, "task.md");
-  if (fs18.existsSync(taskMdPath)) {
-    const taskMd = fs18.readFileSync(taskMdPath, "utf-8");
+  const taskMdPath = path21.join(taskDir, "task.md");
+  if (fs23.existsSync(taskMdPath)) {
+    const taskMd = fs23.readFileSync(taskMdPath, "utf-8");
     context += `
 ## Task Description
 ${taskMd}
 `;
   }
-  const taskJsonPath = path16.join(taskDir, "task.json");
-  if (fs18.existsSync(taskJsonPath)) {
+  const taskJsonPath = path21.join(taskDir, "task.json");
+  if (fs23.existsSync(taskJsonPath)) {
     try {
-      const taskDef = JSON.parse(fs18.readFileSync(taskJsonPath, "utf-8"));
+      const taskDef = JSON.parse(fs23.readFileSync(taskJsonPath, "utf-8"));
       context += `
 ## Task Classification
 `;
@@ -3672,27 +4861,27 @@ ${taskMd}
     } catch {
     }
   }
-  const specPath = path16.join(taskDir, "spec.md");
-  if (fs18.existsSync(specPath)) {
-    const spec = fs18.readFileSync(specPath, "utf-8");
+  const specPath = path21.join(taskDir, "spec.md");
+  if (fs23.existsSync(specPath)) {
+    const spec = fs23.readFileSync(specPath, "utf-8");
     const truncated = spec.slice(0, MAX_TASK_CONTEXT_SPEC);
     context += `
 ## Spec Summary
 ${truncated}${spec.length > MAX_TASK_CONTEXT_SPEC ? "\n..." : ""}
 `;
   }
-  const planPath = path16.join(taskDir, "plan.md");
-  if (fs18.existsSync(planPath)) {
-    const plan = fs18.readFileSync(planPath, "utf-8");
+  const planPath = path21.join(taskDir, "plan.md");
+  if (fs23.existsSync(planPath)) {
+    const plan = fs23.readFileSync(planPath, "utf-8");
     const truncated = plan.slice(0, MAX_TASK_CONTEXT_PLAN);
     context += `
 ## Plan Summary
 ${truncated}${plan.length > MAX_TASK_CONTEXT_PLAN ? "\n..." : ""}
 `;
   }
-  const contextMdPath = path16.join(taskDir, "context.md");
-  if (fs18.existsSync(contextMdPath)) {
-    const accumulated = fs18.readFileSync(contextMdPath, "utf-8");
+  const contextMdPath = path21.join(taskDir, "context.md");
+  if (fs23.existsSync(contextMdPath)) {
+    const accumulated = fs23.readFileSync(contextMdPath, "utf-8");
     const truncated = accumulated.slice(-MAX_ACCUMULATED_CONTEXT);
     const prefix = accumulated.length > MAX_ACCUMULATED_CONTEXT ? "...(earlier context truncated)\n" : "";
     context += `
@@ -3710,17 +4899,17 @@ ${feedback}
 }
 function inferHasUIFromScope(scope) {
   return scope.some((filePath) => {
-    const ext = path16.extname(filePath).toLowerCase();
+    const ext = path21.extname(filePath).toLowerCase();
     if (UI_EXTENSIONS.has(ext)) return true;
     const normalized = filePath.replace(/\\/g, "/");
     return UI_PATH_SEGMENTS.some((seg) => normalized.includes(seg));
   });
 }
 function taskHasUI(taskDir) {
-  const taskJsonPath = path16.join(taskDir, "task.json");
-  if (!fs18.existsSync(taskJsonPath)) return true;
+  const taskJsonPath = path21.join(taskDir, "task.json");
+  if (!fs23.existsSync(taskJsonPath)) return true;
   try {
-    const taskDef = JSON.parse(fs18.readFileSync(taskJsonPath, "utf-8"));
+    const taskDef = JSON.parse(fs23.readFileSync(taskJsonPath, "utf-8"));
     const scope = Array.isArray(taskDef.scope) ? taskDef.scope : [];
     if (scope.length === 0) return true;
     return inferHasUIFromScope(scope);
@@ -3878,9 +5067,9 @@ ${prompt}` : prompt;
   }
   if (isMcpEnabledForStage(stageName, config.mcp) && taskHasUI(taskDir)) {
     assembled = assembled + "\n\n" + getBrowserToolGuidance(stageName, taskDir);
-    const qaGuidePath = path16.join(projectDir, ".kody", "qa-guide.md");
-    if (fs18.existsSync(qaGuidePath)) {
-      const qaGuide = fs18.readFileSync(qaGuidePath, "utf-8").trim();
+    const qaGuidePath = path21.join(projectDir, ".kody", "qa-guide.md");
+    if (fs23.existsSync(qaGuidePath)) {
+      const qaGuide = fs23.readFileSync(qaGuidePath, "utf-8").trim();
       assembled = assembled + "\n\n" + qaGuide;
     }
   }
@@ -4042,8 +5231,8 @@ var init_dev_server = __esm({
 });
 
 // src/stages/agent.ts
-import * as fs19 from "fs";
-import * as path17 from "path";
+import * as fs24 from "fs";
+import * as path22 from "path";
 function getSessionInfo(stageName, sessions) {
   const group = SESSION_GROUP[stageName];
   if (!group) return void 0;
@@ -4157,27 +5346,27 @@ async function executeAgentStage(ctx, def) {
   }
   const result2 = lastResult;
   if (def.outputFile && result2.output) {
-    fs19.writeFileSync(path17.join(ctx.taskDir, def.outputFile), result2.output);
+    fs24.writeFileSync(path22.join(ctx.taskDir, def.outputFile), result2.output);
   }
   if (def.outputFile) {
-    const outputPath = path17.join(ctx.taskDir, def.outputFile);
-    if (!fs19.existsSync(outputPath)) {
-      const ext = path17.extname(def.outputFile);
-      const base = path17.basename(def.outputFile, ext);
-      const files = fs19.readdirSync(ctx.taskDir);
+    const outputPath = path22.join(ctx.taskDir, def.outputFile);
+    if (!fs24.existsSync(outputPath)) {
+      const ext = path22.extname(def.outputFile);
+      const base = path22.basename(def.outputFile, ext);
+      const files = fs24.readdirSync(ctx.taskDir);
       const variant = files.find(
         (f) => f.startsWith(base + "-") && f.endsWith(ext)
       );
       if (variant) {
-        fs19.renameSync(path17.join(ctx.taskDir, variant), outputPath);
+        fs24.renameSync(path22.join(ctx.taskDir, variant), outputPath);
         logger.info(`  Renamed variant ${variant} \u2192 ${def.outputFile}`);
       }
     }
   }
   if (def.outputFile) {
-    const outputPath = path17.join(ctx.taskDir, def.outputFile);
-    if (fs19.existsSync(outputPath)) {
-      const content = fs19.readFileSync(outputPath, "utf-8");
+    const outputPath = path22.join(ctx.taskDir, def.outputFile);
+    if (fs24.existsSync(outputPath)) {
+      const content = fs24.readFileSync(outputPath, "utf-8");
       const validation = validateStageOutput(def.name, content);
       if (!validation.valid) {
         if (def.name === "taskify") {
@@ -4191,7 +5380,7 @@ async function executeAgentStage(ctx, def) {
             const stripped = stripFences(retryResult.output);
             const retryValidation = validateTaskJson(stripped);
             if (retryValidation.valid) {
-              fs19.writeFileSync(outputPath, retryResult.output);
+              fs24.writeFileSync(outputPath, retryResult.output);
               logger.info(`  taskify retry produced valid JSON`);
             } else {
               logger.warn(`  taskify retry still invalid: ${retryValidation.error}`);
@@ -4204,7 +5393,7 @@ async function executeAgentStage(ctx, def) {
                 risk_level: "low",
                 questions: []
               }, null, 2);
-              fs19.writeFileSync(outputPath, fallback);
+              fs24.writeFileSync(outputPath, fallback);
               logger.info(`  taskify fallback: generated minimal task.json (risk_level=low)`);
             }
           }
@@ -4218,7 +5407,7 @@ async function executeAgentStage(ctx, def) {
   return { outcome: "completed", outputFile: def.outputFile, retries };
 }
 function appendStageContext(taskDir, stageName, output) {
-  const contextPath = path17.join(taskDir, "context.md");
+  const contextPath = path22.join(taskDir, "context.md");
   const timestamp2 = (/* @__PURE__ */ new Date()).toISOString().slice(0, 19);
   let summary;
   if (output && output.trim()) {
@@ -4231,7 +5420,7 @@ function appendStageContext(taskDir, stageName, output) {
 ### ${stageName} (${timestamp2})
 ${summary}
 `;
-  fs19.appendFileSync(contextPath, entry);
+  fs24.appendFileSync(contextPath, entry);
 }
 var SESSION_GROUP;
 var init_agent = __esm({
@@ -4255,7 +5444,7 @@ var init_agent = __esm({
 });
 
 // src/verify-runner.ts
-import { execFileSync as execFileSync11 } from "child_process";
+import { execFileSync as execFileSync15 } from "child_process";
 function isExecError(err) {
   return typeof err === "object" && err !== null;
 }
@@ -4291,7 +5480,7 @@ function runCommand(cmd, cwd, timeout) {
     return { success: true, output: "", timedOut: false };
   }
   try {
-    const output = execFileSync11(parts[0], parts.slice(1), {
+    const output = execFileSync15(parts[0], parts.slice(1), {
       cwd,
       timeout,
       encoding: "utf-8",
@@ -4380,7 +5569,7 @@ var init_verify_runner = __esm({
 });
 
 // src/observer.ts
-import { execFileSync as execFileSync12 } from "child_process";
+import { execFileSync as execFileSync16 } from "child_process";
 async function diagnoseFailure(stageName, errorOutput, modifiedFiles, runner, model, options) {
   const context = [
     `Stage: ${stageName}`,
@@ -4463,13 +5652,13 @@ ${modifiedFiles.map((f) => `- ${f}`).join("\n")}` : "No files were modified (bui
 }
 function getModifiedFiles(projectDir) {
   try {
-    const staged = execFileSync12("git", ["diff", "--name-only", "--cached"], {
+    const staged = execFileSync16("git", ["diff", "--name-only", "--cached"], {
       encoding: "utf-8",
       cwd: projectDir,
       timeout: 5e3,
       stdio: ["pipe", "pipe", "pipe"]
     }).trim();
-    const unstaged = execFileSync12("git", ["diff", "--name-only"], {
+    const unstaged = execFileSync16("git", ["diff", "--name-only"], {
       encoding: "utf-8",
       cwd: projectDir,
       timeout: 5e3,
@@ -4512,8 +5701,8 @@ Error context:
 });
 
 // src/stages/gate.ts
-import * as fs20 from "fs";
-import * as path18 from "path";
+import * as fs25 from "fs";
+import * as path23 from "path";
 function executeGateStage(ctx, def) {
   if (ctx.input.dryRun) {
     logger.info(`  [dry-run] skipping ${def.name}`);
@@ -4556,7 +5745,7 @@ ${output}
 `);
     }
   }
-  fs20.writeFileSync(path18.join(ctx.taskDir, "verify.md"), lines.join(""));
+  fs25.writeFileSync(path23.join(ctx.taskDir, "verify.md"), lines.join(""));
   return {
     outcome: verifyResult.pass ? "completed" : "failed",
     retries: 0
@@ -4571,9 +5760,9 @@ var init_gate = __esm({
 });
 
 // src/stages/verify.ts
-import * as fs21 from "fs";
-import * as path19 from "path";
-import { execFileSync as execFileSync13 } from "child_process";
+import * as fs26 from "fs";
+import * as path24 from "path";
+import { execFileSync as execFileSync17 } from "child_process";
 async function executeVerifyWithAutofix(ctx, def) {
   const maxAttempts = def.maxRetries ?? 2;
   for (let attempt = 0; attempt <= maxAttempts; attempt++) {
@@ -4583,8 +5772,8 @@ async function executeVerifyWithAutofix(ctx, def) {
       return { ...gateResult, retries: attempt };
     }
     if (attempt < maxAttempts) {
-      const verifyPath = path19.join(ctx.taskDir, "verify.md");
-      const errorOutput = fs21.existsSync(verifyPath) ? fs21.readFileSync(verifyPath, "utf-8") : "Unknown error";
+      const verifyPath = path24.join(ctx.taskDir, "verify.md");
+      const errorOutput = fs26.existsSync(verifyPath) ? fs26.readFileSync(verifyPath, "utf-8") : "Unknown error";
       const modifiedFiles = getModifiedFiles(ctx.projectDir);
       const defaultRunner = getRunnerForStage(ctx, "taskify");
       const diagConfig = getProjectConfig();
@@ -4627,7 +5816,7 @@ ${diagnosis.resolution}`);
         const parts = parseCommand(cmd);
         if (parts.length === 0) return;
         try {
-          execFileSync13(parts[0], parts.slice(1), {
+          execFileSync17(parts[0], parts.slice(1), {
             stdio: "pipe",
             timeout: FIX_COMMAND_TIMEOUT_MS
           });
@@ -4680,8 +5869,8 @@ var init_verify = __esm({
 });
 
 // src/review-standalone.ts
-import * as fs22 from "fs";
-import * as path20 from "path";
+import * as fs27 from "fs";
+import * as path25 from "path";
 function resolveReviewTarget(input) {
   if (input.prs.length === 0) {
     return {
@@ -4705,8 +5894,8 @@ Or comment on the specific PR: \`@kody review\``
 }
 async function runStandaloneReview(input) {
   const taskId = input.taskId ?? `review-${generateTaskId()}`;
-  const taskDir = path20.join(input.projectDir, ".kody", "tasks", taskId);
-  fs22.mkdirSync(taskDir, { recursive: true });
+  const taskDir = path25.join(input.projectDir, ".kody", "tasks", taskId);
+  fs27.mkdirSync(taskDir, { recursive: true });
   let diffInstruction = "";
   let filesChangedSection = "";
   if (input.baseBranch) {
@@ -4733,7 +5922,7 @@ ${fileList}`;
   const taskContent = `# ${input.prTitle}
 
 ${input.prBody ?? ""}${diffInstruction}${filesChangedSection}`;
-  fs22.writeFileSync(path20.join(taskDir, "task.md"), taskContent);
+  fs27.writeFileSync(path25.join(taskDir, "task.md"), taskContent);
   const reviewDef = STAGES.find((s) => s.name === "review");
   const ctx = {
     taskId,
@@ -4755,10 +5944,10 @@ ${input.prBody ?? ""}${diffInstruction}${filesChangedSection}`;
       error: result2.error ?? "Review stage failed"
     };
   }
-  const reviewPath = path20.join(taskDir, "review.md");
+  const reviewPath = path25.join(taskDir, "review.md");
   let reviewContent;
-  if (fs22.existsSync(reviewPath)) {
-    reviewContent = fs22.readFileSync(reviewPath, "utf-8");
+  if (fs27.existsSync(reviewPath)) {
+    reviewContent = fs27.readFileSync(reviewPath, "utf-8");
   }
   return {
     outcome: "completed",
@@ -4798,8 +5987,8 @@ var init_review_standalone = __esm({
 });
 
 // src/stages/review.ts
-import * as fs23 from "fs";
-import * as path21 from "path";
+import * as fs28 from "fs";
+import * as path26 from "path";
 async function executeReviewWithFix(ctx, def) {
   if (ctx.input.dryRun) {
     return { outcome: "completed", retries: 0 };
@@ -4813,11 +6002,11 @@ async function executeReviewWithFix(ctx, def) {
     if (reviewResult.outcome !== "completed") {
       return reviewResult;
     }
-    const reviewFile = path21.join(ctx.taskDir, "review.md");
-    if (!fs23.existsSync(reviewFile)) {
+    const reviewFile = path26.join(ctx.taskDir, "review.md");
+    if (!fs28.existsSync(reviewFile)) {
       return { outcome: "failed", retries: iteration, error: "review.md not found" };
     }
-    const content = fs23.readFileSync(reviewFile, "utf-8");
+    const content = fs28.readFileSync(reviewFile, "utf-8");
     if (detectReviewVerdict(content) !== "fail") {
       return { ...reviewResult, retries: iteration };
     }
@@ -4846,15 +6035,15 @@ var init_review = __esm({
 });
 
 // src/stages/ship.ts
-import * as fs24 from "fs";
-import * as path22 from "path";
-import { execFileSync as execFileSync14 } from "child_process";
+import * as fs29 from "fs";
+import * as path27 from "path";
+import { execFileSync as execFileSync18 } from "child_process";
 function buildPrBody(ctx) {
   const sections = [];
-  const taskJsonPath = path22.join(ctx.taskDir, "task.json");
-  if (fs24.existsSync(taskJsonPath)) {
+  const taskJsonPath = path27.join(ctx.taskDir, "task.json");
+  if (fs29.existsSync(taskJsonPath)) {
     try {
-      const raw = fs24.readFileSync(taskJsonPath, "utf-8");
+      const raw = fs29.readFileSync(taskJsonPath, "utf-8");
       const cleaned = raw.replace(/^```json\s*\n?/m, "").replace(/\n?```\s*$/m, "");
       const task = JSON.parse(cleaned);
       if (task.description) {
@@ -4873,9 +6062,9 @@ ${task.scope.map((s) => `- \`${s}\``).join("\n")}`);
     } catch {
     }
   }
-  const reviewPath = path22.join(ctx.taskDir, "review.md");
-  if (fs24.existsSync(reviewPath)) {
-    const review = fs24.readFileSync(reviewPath, "utf-8");
+  const reviewPath = path27.join(ctx.taskDir, "review.md");
+  if (fs29.existsSync(reviewPath)) {
+    const review = fs29.readFileSync(reviewPath, "utf-8");
     const summaryMatch = review.match(/## Summary\s*\n([\s\S]*?)(?=\n## |\n*$)/);
     if (summaryMatch) {
       const summary = summaryMatch[1].trim();
@@ -4892,14 +6081,14 @@ ${summary}`);
 **Review:** ${verdictMatch[1].toUpperCase() === "PASS" ? "\u2705 PASS" : "\u274C FAIL"}`);
     }
   }
-  const verifyPath = path22.join(ctx.taskDir, "verify.md");
-  if (fs24.existsSync(verifyPath)) {
-    const verify = fs24.readFileSync(verifyPath, "utf-8");
+  const verifyPath = path27.join(ctx.taskDir, "verify.md");
+  if (fs29.existsSync(verifyPath)) {
+    const verify = fs29.readFileSync(verifyPath, "utf-8");
     if (/PASS/i.test(verify)) sections.push(`**Verify:** \u2705 typecheck + tests + lint passed`);
   }
-  const planPath = path22.join(ctx.taskDir, "plan.md");
-  if (fs24.existsSync(planPath)) {
-    const plan = fs24.readFileSync(planPath, "utf-8").trim();
+  const planPath = path27.join(ctx.taskDir, "plan.md");
+  if (fs29.existsSync(planPath)) {
+    const plan = fs29.readFileSync(planPath, "utf-8").trim();
     if (plan) {
       const truncated = plan.length > 800 ? plan.slice(0, 800) + "\n..." : plan;
       sections.push(`
@@ -4919,28 +6108,28 @@ Closes #${ctx.input.issueNumber}`);
   return sections.join("\n");
 }
 function executeShipStage(ctx, _def) {
-  const shipPath = path22.join(ctx.taskDir, "ship.md");
+  const shipPath = path27.join(ctx.taskDir, "ship.md");
   if (ctx.input.dryRun) {
-    fs24.writeFileSync(shipPath, "# Ship\n\nShip stage skipped \u2014 dry run.\n");
+    fs29.writeFileSync(shipPath, "# Ship\n\nShip stage skipped \u2014 dry run.\n");
     return { outcome: "completed", outputFile: "ship.md", retries: 0 };
   }
   if (ctx.input.local && !ctx.input.issueNumber) {
-    fs24.writeFileSync(shipPath, "# Ship\n\nShip stage skipped \u2014 local mode, no issue number.\n");
+    fs29.writeFileSync(shipPath, "# Ship\n\nShip stage skipped \u2014 local mode, no issue number.\n");
     return { outcome: "completed", outputFile: "ship.md", retries: 0 };
   }
   try {
     const head = getCurrentBranch(ctx.projectDir);
     const base = getDefaultBranch(ctx.projectDir);
     try {
-      const memoryDir = path22.join(ctx.projectDir, ".kody", "memory");
+      const memoryDir = path27.join(ctx.projectDir, ".kody", "memory");
       const addPaths = [ctx.taskDir];
-      if (fs24.existsSync(memoryDir)) addPaths.push(memoryDir);
-      execFileSync14("git", ["add", ...addPaths], {
+      if (fs29.existsSync(memoryDir)) addPaths.push(memoryDir);
+      execFileSync18("git", ["add", ...addPaths], {
         cwd: ctx.projectDir,
         env: { ...process.env, HUSKY: "0", SKIP_HOOKS: "1" },
         stdio: "pipe"
       });
-      execFileSync14("git", ["commit", "--no-gpg-sign", "-m", `chore: add kody task artifacts [skip ci]`], {
+      execFileSync18("git", ["commit", "--no-gpg-sign", "-m", `chore: add kody task artifacts [skip ci]`], {
         cwd: ctx.projectDir,
         env: { ...process.env, HUSKY: "0", SKIP_HOOKS: "1" },
         stdio: "pipe"
@@ -4954,7 +6143,7 @@ function executeShipStage(ctx, _def) {
     let repo = config.github?.repo;
     if (!owner || !repo) {
       try {
-        const remoteUrl = execFileSync14("git", ["remote", "get-url", "origin"], {
+        const remoteUrl = execFileSync18("git", ["remote", "get-url", "origin"], {
           encoding: "utf-8",
           cwd: ctx.projectDir
         }).trim();
@@ -4975,28 +6164,28 @@ function executeShipStage(ctx, _def) {
       chore: "chore"
     };
     let prefix = "chore";
-    const taskJsonPath = path22.join(ctx.taskDir, "task.json");
-    if (fs24.existsSync(taskJsonPath)) {
+    const taskJsonPath = path27.join(ctx.taskDir, "task.json");
+    if (fs29.existsSync(taskJsonPath)) {
       try {
-        const raw = fs24.readFileSync(taskJsonPath, "utf-8");
+        const raw = fs29.readFileSync(taskJsonPath, "utf-8");
         const cleaned = raw.replace(/^```json\s*\n?/m, "").replace(/\n?```\s*$/m, "");
         const task = JSON.parse(cleaned);
         prefix = TYPE_PREFIX[task.task_type] ?? "chore";
       } catch {
       }
     }
-    const taskMdPath = path22.join(ctx.taskDir, "task.md");
-    if (fs24.existsSync(taskMdPath)) {
-      const content = fs24.readFileSync(taskMdPath, "utf-8");
+    const taskMdPath = path27.join(ctx.taskDir, "task.md");
+    if (fs29.existsSync(taskMdPath)) {
+      const content = fs29.readFileSync(taskMdPath, "utf-8");
       const heading = content.split("\n").find((l) => l.startsWith("# "));
       if (heading) {
         title = `${prefix}: ${heading.replace(/^#\s*/, "").trim()}`.slice(0, 72);
       }
     }
     if (title === "Update") {
-      if (fs24.existsSync(taskJsonPath)) {
+      if (fs29.existsSync(taskJsonPath)) {
         try {
-          const raw = fs24.readFileSync(taskJsonPath, "utf-8");
+          const raw = fs29.readFileSync(taskJsonPath, "utf-8");
           const cleaned = raw.replace(/^```json\s*\n?/m, "").replace(/\n?```\s*$/m, "");
           const task = JSON.parse(cleaned);
           if (task.title) title = `${prefix}: ${task.title}`.slice(0, 72);
@@ -5019,7 +6208,7 @@ function executeShipStage(ctx, _def) {
         } catch {
         }
       }
-      fs24.writeFileSync(shipPath, `# Ship
+      fs29.writeFileSync(shipPath, `# Ship
 
 Updated existing PR: ${existingPr.url}
 PR #${existingPr.number}
@@ -5040,20 +6229,20 @@ PR #${existingPr.number}
           } catch {
           }
         }
-        fs24.writeFileSync(shipPath, `# Ship
+        fs29.writeFileSync(shipPath, `# Ship
 
 PR created: ${pr.url}
 PR #${pr.number}
 `);
       } else {
-        fs24.writeFileSync(shipPath, "# Ship\n\nPushed branch but failed to create PR.\n");
+        fs29.writeFileSync(shipPath, "# Ship\n\nPushed branch but failed to create PR.\n");
       }
     }
     return { outcome: "completed", outputFile: "ship.md", retries: 0 };
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     try {
-      fs24.writeFileSync(shipPath, `# Ship
+      fs29.writeFileSync(shipPath, `# Ship
 
 Failed: ${msg}
 `);
@@ -5102,15 +6291,15 @@ var init_executor_registry = __esm({
 });
 
 // src/pipeline/questions.ts
-import * as fs25 from "fs";
-import * as path23 from "path";
+import * as fs30 from "fs";
+import * as path28 from "path";
 function checkForQuestions(ctx, stageName) {
   if (ctx.input.local || !ctx.input.issueNumber) return false;
   try {
     if (stageName === "taskify") {
-      const taskJsonPath = path23.join(ctx.taskDir, "task.json");
-      if (!fs25.existsSync(taskJsonPath)) return false;
-      const raw = fs25.readFileSync(taskJsonPath, "utf-8");
+      const taskJsonPath = path28.join(ctx.taskDir, "task.json");
+      if (!fs30.existsSync(taskJsonPath)) return false;
+      const raw = fs30.readFileSync(taskJsonPath, "utf-8");
       const cleaned = raw.replace(/^```json\s*\n?/m, "").replace(/\n?```\s*$/m, "");
       const taskJson = JSON.parse(cleaned);
       if (taskJson.questions && Array.isArray(taskJson.questions) && taskJson.questions.length > 0) {
@@ -5125,9 +6314,9 @@ Reply with \`@kody approve\` and your answers in the comment body.`;
       }
     }
     if (stageName === "plan") {
-      const planPath = path23.join(ctx.taskDir, "plan.md");
-      if (!fs25.existsSync(planPath)) return false;
-      const plan = fs25.readFileSync(planPath, "utf-8");
+      const planPath = path28.join(ctx.taskDir, "plan.md");
+      if (!fs30.existsSync(planPath)) return false;
+      const plan = fs30.readFileSync(planPath, "utf-8");
       const questionsMatch = plan.match(/## Questions\s*\n([\s\S]*?)(?=\n## |\n*$)/);
       if (questionsMatch) {
         const questionsText = questionsMatch[1].trim();
@@ -5156,8 +6345,8 @@ var init_questions = __esm({
 });
 
 // src/pipeline/hooks.ts
-import * as fs26 from "fs";
-import * as path24 from "path";
+import * as fs31 from "fs";
+import * as path29 from "path";
 function applyPreStageLabel(ctx, def) {
   if (!ctx.input.issueNumber || ctx.input.local) return;
   if (def.name === "plan") setLifecycleLabel(ctx.input.issueNumber, "planning");
@@ -5198,9 +6387,9 @@ function autoDetectComplexity(ctx, def) {
     return { complexity, activeStages };
   }
   try {
-    const taskJsonPath = path24.join(ctx.taskDir, "task.json");
-    if (!fs26.existsSync(taskJsonPath)) return null;
-    const raw = fs26.readFileSync(taskJsonPath, "utf-8");
+    const taskJsonPath = path29.join(ctx.taskDir, "task.json");
+    if (!fs31.existsSync(taskJsonPath)) return null;
+    const raw = fs31.readFileSync(taskJsonPath, "utf-8");
     const cleaned = raw.replace(/^```json\s*\n?/m, "").replace(/\n?```\s*$/m, "");
     const taskJson = JSON.parse(cleaned);
     if (!taskJson.risk_level || !isValidComplexity(taskJson.risk_level)) return null;
@@ -5230,8 +6419,8 @@ function checkRiskGate(ctx, def, state, complexity) {
   if (ctx.input.dryRun || ctx.input.local) return null;
   if (ctx.input.mode === "rerun") return null;
   if (!ctx.input.issueNumber) return null;
-  const planPath = path24.join(ctx.taskDir, "plan.md");
-  const plan = fs26.existsSync(planPath) ? fs26.readFileSync(planPath, "utf-8").slice(0, 1500) : "(plan not available)";
+  const planPath = path29.join(ctx.taskDir, "plan.md");
+  const plan = fs31.existsSync(planPath) ? fs31.readFileSync(planPath, "utf-8").slice(0, 1500) : "(plan not available)";
   try {
     postComment(
       ctx.input.issueNumber,
@@ -5292,28 +6481,28 @@ var init_hooks = __esm({
     init_git_utils();
     init_questions();
     init_complexity();
-    init_state();
+    init_state2();
     init_logger();
   }
 });
 
 // src/learning/auto-learn.ts
-import * as fs27 from "fs";
-import * as path25 from "path";
+import * as fs32 from "fs";
+import * as path30 from "path";
 function stripAnsi(str) {
   return str.replace(/\x1b\[[0-9;]*m/g, "");
 }
 function autoLearn(ctx) {
   try {
-    const memoryDir = path25.join(ctx.projectDir, ".kody", "memory");
-    if (!fs27.existsSync(memoryDir)) {
-      fs27.mkdirSync(memoryDir, { recursive: true });
+    const memoryDir = path30.join(ctx.projectDir, ".kody", "memory");
+    if (!fs32.existsSync(memoryDir)) {
+      fs32.mkdirSync(memoryDir, { recursive: true });
     }
     const learnings = [];
     const timestamp2 = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
-    const verifyPath = path25.join(ctx.taskDir, "verify.md");
-    if (fs27.existsSync(verifyPath)) {
-      const verify = stripAnsi(fs27.readFileSync(verifyPath, "utf-8"));
+    const verifyPath = path30.join(ctx.taskDir, "verify.md");
+    if (fs32.existsSync(verifyPath)) {
+      const verify = stripAnsi(fs32.readFileSync(verifyPath, "utf-8"));
       if (/vitest/i.test(verify)) learnings.push("- Uses vitest for testing");
       if (/jest/i.test(verify)) learnings.push("- Uses jest for testing");
       if (/eslint/i.test(verify)) learnings.push("- Uses eslint for linting");
@@ -5322,18 +6511,18 @@ function autoLearn(ctx) {
       if (/jsdom/i.test(verify)) learnings.push("- Test environment: jsdom");
       if (/node/i.test(verify) && /environment/i.test(verify)) learnings.push("- Test environment: node");
     }
-    const reviewPath = path25.join(ctx.taskDir, "review.md");
-    if (fs27.existsSync(reviewPath)) {
-      const review = fs27.readFileSync(reviewPath, "utf-8");
+    const reviewPath = path30.join(ctx.taskDir, "review.md");
+    if (fs32.existsSync(reviewPath)) {
+      const review = fs32.readFileSync(reviewPath, "utf-8");
       if (/\.js extension/i.test(review)) learnings.push("- Imports use .js extensions (ESM)");
       if (/barrel export/i.test(review)) learnings.push("- Uses barrel exports (index.ts)");
       if (/timezone/i.test(review)) learnings.push("- Timezone handling is a concern in this codebase");
       if (/UTC/i.test(review)) learnings.push("- Date operations should consider UTC vs local time");
     }
-    const taskJsonPath = path25.join(ctx.taskDir, "task.json");
-    if (fs27.existsSync(taskJsonPath)) {
+    const taskJsonPath = path30.join(ctx.taskDir, "task.json");
+    if (fs32.existsSync(taskJsonPath)) {
       try {
-        const raw = stripAnsi(fs27.readFileSync(taskJsonPath, "utf-8"));
+        const raw = stripAnsi(fs32.readFileSync(taskJsonPath, "utf-8"));
         const cleaned = raw.replace(/^```json\s*\n?/m, "").replace(/\n?```\s*$/m, "");
         const task = JSON.parse(cleaned);
         if (task.scope && Array.isArray(task.scope)) {
@@ -5344,12 +6533,12 @@ function autoLearn(ctx) {
       }
     }
     if (learnings.length > 0) {
-      const conventionsPath = path25.join(memoryDir, "conventions.md");
+      const conventionsPath = path30.join(memoryDir, "conventions.md");
       const entry = `
 ## Learned ${timestamp2} (task: ${ctx.taskId})
 ${learnings.join("\n")}
 `;
-      fs27.appendFileSync(conventionsPath, entry);
+      fs32.appendFileSync(conventionsPath, entry);
       logger.info(`Auto-learned ${learnings.length} convention(s)`);
     }
     autoLearnArchitecture(ctx.projectDir, memoryDir, timestamp2);
@@ -5357,8 +6546,8 @@ ${learnings.join("\n")}
   }
 }
 function autoLearnArchitecture(projectDir, memoryDir, timestamp2) {
-  const archPath = path25.join(memoryDir, "architecture.md");
-  if (fs27.existsSync(archPath)) return;
+  const archPath = path30.join(memoryDir, "architecture.md");
+  if (fs32.existsSync(archPath)) return;
   const detected = detectArchitectureBasic(projectDir);
   if (detected.length > 0) {
     const content = `# Architecture (auto-detected ${timestamp2})
@@ -5366,7 +6555,7 @@ function autoLearnArchitecture(projectDir, memoryDir, timestamp2) {
 ## Overview
 ${detected.join("\n")}
 `;
-    fs27.writeFileSync(archPath, content);
+    fs32.writeFileSync(archPath, content);
     logger.info(`Auto-detected architecture (${detected.length} items)`);
   }
 }
@@ -5379,13 +6568,13 @@ var init_auto_learn = __esm({
 });
 
 // src/retrospective.ts
-import * as fs28 from "fs";
-import * as path26 from "path";
+import * as fs33 from "fs";
+import * as path31 from "path";
 function readArtifact(taskDir, filename, maxChars) {
-  const p = path26.join(taskDir, filename);
-  if (!fs28.existsSync(p)) return null;
+  const p = path31.join(taskDir, filename);
+  if (!fs33.existsSync(p)) return null;
   try {
-    const content = fs28.readFileSync(p, "utf-8");
+    const content = fs33.readFileSync(p, "utf-8");
     return content.length > maxChars ? content.slice(0, maxChars) + "\n...(truncated)" : content;
   } catch {
     return null;
@@ -5438,13 +6627,13 @@ function collectRunContext(ctx, state, pipelineStartTime) {
   return lines.join("\n");
 }
 function getLogPath(projectDir) {
-  return path26.join(projectDir, ".kody", "memory", "observer-log.jsonl");
+  return path31.join(projectDir, ".kody", "memory", "observer-log.jsonl");
 }
 function readPreviousRetrospectives(projectDir, limit = 10) {
   const logPath = getLogPath(projectDir);
-  if (!fs28.existsSync(logPath)) return [];
+  if (!fs33.existsSync(logPath)) return [];
   try {
-    const content = fs28.readFileSync(logPath, "utf-8");
+    const content = fs33.readFileSync(logPath, "utf-8");
     const lines = content.split("\n").filter(Boolean);
     const entries = [];
     const start = Math.max(0, lines.length - limit);
@@ -5471,11 +6660,11 @@ function formatPreviousEntries(entries) {
 }
 function appendRetrospectiveEntry(projectDir, entry) {
   const logPath = getLogPath(projectDir);
-  const dir = path26.dirname(logPath);
-  if (!fs28.existsSync(dir)) {
-    fs28.mkdirSync(dir, { recursive: true });
+  const dir = path31.dirname(logPath);
+  if (!fs33.existsSync(dir)) {
+    fs33.mkdirSync(dir, { recursive: true });
   }
-  fs28.appendFileSync(logPath, JSON.stringify(entry) + "\n");
+  fs33.appendFileSync(logPath, JSON.stringify(entry) + "\n");
 }
 async function runRetrospective(ctx, state, pipelineStartTime) {
   if (ctx.input.dryRun) return;
@@ -5643,15 +6832,15 @@ var init_summary = __esm({
 });
 
 // src/tools.ts
-import * as fs29 from "fs";
-import * as path27 from "path";
+import * as fs34 from "fs";
+import * as path32 from "path";
 import { execSync as execSync3 } from "child_process";
 import { parse as parseYaml } from "yaml";
 function loadToolDeclarations(projectDir) {
-  const toolsPath = path27.join(projectDir, ".kody", "tools.yml");
-  if (!fs29.existsSync(toolsPath)) return [];
+  const toolsPath = path32.join(projectDir, ".kody", "tools.yml");
+  if (!fs34.existsSync(toolsPath)) return [];
   try {
-    const raw = fs29.readFileSync(toolsPath, "utf-8");
+    const raw = fs34.readFileSync(toolsPath, "utf-8");
     const parsed = parseYaml(raw);
     if (!parsed || typeof parsed !== "object") return [];
     return Object.entries(parsed).map(([name, value]) => {
@@ -5672,7 +6861,7 @@ function loadToolDeclarations(projectDir) {
 function detectTools(declarations, projectDir) {
   const resolved = [];
   for (const decl of declarations) {
-    const detected = decl.detect.some((pattern) => fs29.existsSync(path27.join(projectDir, pattern)));
+    const detected = decl.detect.some((pattern) => fs34.existsSync(path32.join(projectDir, pattern)));
     if (!detected) continue;
     resolved.push({
       name: decl.name,
@@ -5713,8 +6902,8 @@ var init_tools = __esm({
 });
 
 // src/pipeline.ts
-import * as fs30 from "fs";
-import * as path28 from "path";
+import * as fs35 from "fs";
+import * as path33 from "path";
 function ensureFeatureBranchIfNeeded(ctx) {
   if (ctx.input.dryRun) return;
   if (ctx.input.prNumber) {
@@ -5727,8 +6916,8 @@ function ensureFeatureBranchIfNeeded(ctx) {
   }
   if (!ctx.input.issueNumber) return;
   try {
-    const taskMdPath = path28.join(ctx.taskDir, "task.md");
-    const title = fs30.existsSync(taskMdPath) ? fs30.readFileSync(taskMdPath, "utf-8").split("\n")[0].slice(0, 50) : ctx.taskId;
+    const taskMdPath = path33.join(ctx.taskDir, "task.md");
+    const title = fs35.existsSync(taskMdPath) ? fs35.readFileSync(taskMdPath, "utf-8").split("\n")[0].slice(0, 50) : ctx.taskId;
     ensureFeatureBranch(ctx.input.issueNumber, title, ctx.projectDir);
     syncWithDefault(ctx.projectDir);
   } catch (err) {
@@ -5742,10 +6931,10 @@ function ensureFeatureBranchIfNeeded(ctx) {
   }
 }
 function acquireLock(taskDir) {
-  const lockPath = path28.join(taskDir, ".lock");
-  if (fs30.existsSync(lockPath)) {
+  const lockPath = path33.join(taskDir, ".lock");
+  if (fs35.existsSync(lockPath)) {
     try {
-      const pid = parseInt(fs30.readFileSync(lockPath, "utf-8").trim(), 10);
+      const pid = parseInt(fs35.readFileSync(lockPath, "utf-8").trim(), 10);
       if (!isNaN(pid)) {
         try {
           process.kill(pid, 0);
@@ -5762,14 +6951,14 @@ function acquireLock(taskDir) {
       logger.warn(`  Corrupt lock file \u2014 overwriting`);
     }
     try {
-      fs30.unlinkSync(lockPath);
+      fs35.unlinkSync(lockPath);
     } catch {
     }
   }
   try {
-    const fd = fs30.openSync(lockPath, fs30.constants.O_WRONLY | fs30.constants.O_CREAT | fs30.constants.O_EXCL);
-    fs30.writeSync(fd, String(process.pid));
-    fs30.closeSync(fd);
+    const fd = fs35.openSync(lockPath, fs35.constants.O_WRONLY | fs35.constants.O_CREAT | fs35.constants.O_EXCL);
+    fs35.writeSync(fd, String(process.pid));
+    fs35.closeSync(fd);
   } catch (err) {
     if (err.code === "EEXIST") {
       throw new Error("Pipeline already running (lock acquired by another process)");
@@ -5779,7 +6968,7 @@ function acquireLock(taskDir) {
 }
 function releaseLock(taskDir) {
   try {
-    fs30.unlinkSync(path28.join(taskDir, ".lock"));
+    fs35.unlinkSync(path33.join(taskDir, ".lock"));
   } catch {
   }
 }
@@ -5982,7 +7171,7 @@ var init_pipeline = __esm({
     init_git_utils();
     init_github_api();
     init_logger();
-    init_state();
+    init_state2();
     init_complexity();
     init_executor_registry();
     init_hooks();
@@ -5995,8 +7184,8 @@ var init_pipeline = __esm({
 });
 
 // src/preflight.ts
-import { execFileSync as execFileSync15 } from "child_process";
-import * as fs31 from "fs";
+import { execFileSync as execFileSync19 } from "child_process";
+import * as fs36 from "fs";
 function check(name, fn) {
   try {
     const detail = fn() ?? void 0;
@@ -6008,7 +7197,7 @@ function check(name, fn) {
 function runPreflight() {
   const checks = [
     check("claude CLI", () => {
-      const v = execFileSync15("claude", ["--version"], {
+      const v = execFileSync19("claude", ["--version"], {
         encoding: "utf-8",
         timeout: 1e4,
         stdio: ["pipe", "pipe", "pipe"]
@@ -6016,14 +7205,14 @@ function runPreflight() {
       return v;
     }),
     check("git repo", () => {
-      execFileSync15("git", ["rev-parse", "--is-inside-work-tree"], {
+      execFileSync19("git", ["rev-parse", "--is-inside-work-tree"], {
         encoding: "utf-8",
         timeout: 5e3,
         stdio: ["pipe", "pipe", "pipe"]
       });
     }),
     check("pnpm", () => {
-      const v = execFileSync15("pnpm", ["--version"], {
+      const v = execFileSync19("pnpm", ["--version"], {
         encoding: "utf-8",
         timeout: 5e3,
         stdio: ["pipe", "pipe", "pipe"]
@@ -6031,7 +7220,7 @@ function runPreflight() {
       return v;
     }),
     check("node >= 18", () => {
-      const v = execFileSync15("node", ["--version"], {
+      const v = execFileSync19("node", ["--version"], {
         encoding: "utf-8",
         timeout: 5e3,
         stdio: ["pipe", "pipe", "pipe"]
@@ -6041,7 +7230,7 @@ function runPreflight() {
       return v;
     }),
     check("gh CLI", () => {
-      const v = execFileSync15("gh", ["--version"], {
+      const v = execFileSync19("gh", ["--version"], {
         encoding: "utf-8",
         timeout: 5e3,
         stdio: ["pipe", "pipe", "pipe"]
@@ -6049,7 +7238,7 @@ function runPreflight() {
       return v;
     }),
     check("package.json", () => {
-      if (!fs31.existsSync("package.json")) throw new Error("not found");
+      if (!fs36.existsSync("package.json")) throw new Error("not found");
     })
   ];
   const failed = checks.filter((c) => !c.ok);
@@ -6126,8 +7315,8 @@ var init_args = __esm({
 });
 
 // src/cli/task-state.ts
-import * as fs32 from "fs";
-import * as path29 from "path";
+import * as fs37 from "fs";
+import * as path34 from "path";
 function resolveTaskAction(issueNumber, existingTaskId, existingState) {
   if (!existingTaskId || !existingState) {
     return { action: "start-fresh", taskId: `${issueNumber}-${generateTaskId()}` };
@@ -6159,11 +7348,11 @@ function resolveTaskAction(issueNumber, existingTaskId, existingState) {
 function resolveForIssue(issueNumber, projectDir) {
   const existingTaskId = findLatestTaskForIssue(issueNumber, projectDir);
   if (existingTaskId) {
-    const statusPath = path29.join(projectDir, ".kody", "tasks", existingTaskId, "status.json");
+    const statusPath = path34.join(projectDir, ".kody", "tasks", existingTaskId, "status.json");
     let existingState = null;
-    if (fs32.existsSync(statusPath)) {
+    if (fs37.existsSync(statusPath)) {
       try {
-        existingState = JSON.parse(fs32.readFileSync(statusPath, "utf-8"));
+        existingState = JSON.parse(fs37.readFileSync(statusPath, "utf-8"));
       } catch {
       }
     }
@@ -6196,12 +7385,12 @@ var resolve_exports = {};
 __export(resolve_exports, {
   runResolve: () => runResolve
 });
-import { execFileSync as execFileSync16 } from "child_process";
+import { execFileSync as execFileSync20 } from "child_process";
 function getConflictContext(cwd, files) {
   const parts = [];
   for (const file of files.slice(0, 10)) {
     try {
-      const content = execFileSync16("git", ["diff", file], {
+      const content = execFileSync20("git", ["diff", file], {
         cwd,
         encoding: "utf-8",
         stdio: ["pipe", "pipe", "pipe"]
@@ -6359,8 +7548,8 @@ var init_resolve = __esm({
 
 // src/entry.ts
 var entry_exports = {};
-import * as fs33 from "fs";
-import * as path30 from "path";
+import * as fs38 from "fs";
+import * as path35 from "path";
 async function ensureLitellmProxy(config, projectDir) {
   if (!anyStageNeedsProxy(config)) return null;
   const litellmUrl = getLitellmUrl();
@@ -6415,9 +7604,9 @@ async function runModelHealthCheck(config) {
 }
 async function main() {
   const input = parseArgs();
-  const projectDir = input.cwd ? path30.resolve(input.cwd) : process.cwd();
+  const projectDir = input.cwd ? path35.resolve(input.cwd) : process.cwd();
   if (input.cwd) {
-    if (!fs33.existsSync(projectDir)) {
+    if (!fs38.existsSync(projectDir)) {
       console.error(`--cwd path does not exist: ${projectDir}`);
       process.exit(1);
     }
@@ -6477,8 +7666,8 @@ async function main() {
       process.exit(1);
     }
   }
-  const taskDir = path30.join(projectDir, ".kody", "tasks", taskId);
-  fs33.mkdirSync(taskDir, { recursive: true });
+  const taskDir = path35.join(projectDir, ".kody", "tasks", taskId);
+  fs38.mkdirSync(taskDir, { recursive: true });
   if (input.command === "rerun" && isTaskifyRun(taskDir)) {
     const marker = readTaskifyMarker(taskDir);
     if (marker) {
@@ -6610,31 +7799,31 @@ async function main() {
   logger.info("Preflight checks:");
   runPreflight();
   if (input.task) {
-    fs33.writeFileSync(path30.join(taskDir, "task.md"), input.task);
+    fs38.writeFileSync(path35.join(taskDir, "task.md"), input.task);
   }
-  const taskMdPath = path30.join(taskDir, "task.md");
-  if (!fs33.existsSync(taskMdPath) && isPRFix && input.prNumber) {
+  const taskMdPath = path35.join(taskDir, "task.md");
+  if (!fs38.existsSync(taskMdPath) && isPRFix && input.prNumber) {
     logger.info(`Fetching PR #${input.prNumber} details as task context...`);
     const prDetails = getPRDetails(input.prNumber);
     if (prDetails) {
       const taskContent = `# ${prDetails.title}
 
 ${prDetails.body ?? ""}`;
-      fs33.writeFileSync(taskMdPath, taskContent);
+      fs38.writeFileSync(taskMdPath, taskContent);
       logger.info(`  Task loaded from PR #${input.prNumber}: ${prDetails.title}`);
     }
-  } else if (!fs33.existsSync(taskMdPath) && input.issueNumber) {
+  } else if (!fs38.existsSync(taskMdPath) && input.issueNumber) {
     logger.info(`Fetching issue #${input.issueNumber} body as task...`);
     const issue = getIssue(input.issueNumber);
     if (issue) {
       const taskContent = `# ${issue.title}
 
 ${issue.body ?? ""}`;
-      fs33.writeFileSync(taskMdPath, taskContent);
+      fs38.writeFileSync(taskMdPath, taskContent);
       logger.info(`  Task loaded from issue #${input.issueNumber}: ${issue.title}`);
     }
   }
-  if (!fs33.existsSync(taskMdPath)) {
+  if (!fs38.existsSync(taskMdPath)) {
     console.error("No task.md found. Provide --task, --issue-number, or ensure .kody/tasks/<id>/task.md exists.");
     process.exit(1);
   }
@@ -6778,7 +7967,7 @@ To rerun: \`@kody rerun ${taskId} --from <stage>\``
     }
   }
   const state = await runPipeline(ctx);
-  const files = fs33.readdirSync(taskDir);
+  const files = fs38.readdirSync(taskDir);
   console.log(`
 Artifacts in ${taskDir}:`);
   for (const f of files) {
@@ -6844,8 +8033,8 @@ var init_entry = __esm({
 });
 
 // src/bin/cli.ts
-import * as fs34 from "fs";
-import * as path31 from "path";
+import * as fs39 from "fs";
+import * as path36 from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 
 // src/bin/commands/init.ts
@@ -7147,9 +8336,37 @@ function initCommand(opts, pkgRoot) {
       console.log("  \u2717 kody.config.json \u2014 invalid JSON");
     }
   }
+  console.log("\n\u2500\u2500 Kody Watch \u2500\u2500");
+  const watchWorkflowSrc = path2.join(templatesDir, "kody-watch.yml");
+  const watchWorkflowDest = path2.join(cwd, ".github", "workflows", "kody-watch.yml");
+  if (fs3.existsSync(watchWorkflowSrc)) {
+    if (fs3.existsSync(watchWorkflowDest) && !opts.force) {
+      console.log("  \u25CB .github/workflows/kody-watch.yml (exists)");
+    } else {
+      fs3.mkdirSync(path2.dirname(watchWorkflowDest), { recursive: true });
+      fs3.copyFileSync(watchWorkflowSrc, watchWorkflowDest);
+      console.log("  \u2713 .github/workflows/kody-watch.yml");
+      if (fs3.existsSync(configDest)) {
+        try {
+          const config = JSON.parse(fs3.readFileSync(configDest, "utf-8"));
+          if (!config.watch) {
+            config.watch = { enabled: true };
+            fs3.writeFileSync(configDest, JSON.stringify(config, null, 2) + "\n");
+            console.log("  \u2713 Added watch config to kody.config.json");
+          }
+        } catch {
+        }
+      }
+      console.log("  \u2139 Kody Watch will monitor pipeline health every 30 minutes");
+      console.log("  \u2139 Digest issue will be created during bootstrap");
+    }
+  } else {
+    console.log("  \u25CB kody-watch.yml template not found \u2014 skipping");
+  }
   console.log("\n\u2500\u2500 Git \u2500\u2500");
   const filesToCommit = [
     ".github/workflows/kody.yml",
+    ".github/workflows/kody-watch.yml",
     "kody.config.json"
   ].filter((f) => fs3.existsSync(path2.join(cwd, f)));
   if (filesToCommit.length > 0) {
@@ -8277,6 +9494,87 @@ Command and URL.
   } else {
     console.log("  \u25CB No routes or collections detected \u2014 skipping QA guide");
   }
+  console.log("\n\u2500\u2500 Kody Watch \u2500\u2500");
+  const kodyConfigPath = path7.join(cwd, "kody.config.json");
+  if (fs8.existsSync(kodyConfigPath)) {
+    try {
+      const config = JSON.parse(fs8.readFileSync(kodyConfigPath, "utf-8"));
+      if (config.watch?.enabled && !config.watch?.digestIssue) {
+        let watchRepoSlug = "";
+        if (config.github?.owner && config.github?.repo) {
+          watchRepoSlug = `${config.github.owner}/${config.github.repo}`;
+        }
+        if (watchRepoSlug) {
+          console.log("  \u23F3 Creating Watch digest issue...");
+          try {
+            const issueUrl = execFileSync4("gh", [
+              "issue",
+              "create",
+              "--repo",
+              watchRepoSlug,
+              "--title",
+              "[Kody Watch] Health Digest",
+              "--body",
+              "This issue receives periodic health reports from Kody Watch.\n\n**Plugins:** pipeline-health, security-scan, config-health\n\n_Do not close this issue \u2014 Kody Watch posts digest comments here._"
+            ], {
+              cwd,
+              encoding: "utf-8",
+              timeout: 15e3,
+              stdio: ["pipe", "pipe", "pipe"]
+            }).trim();
+            const digestMatch = issueUrl.match(/\/issues\/(\d+)/);
+            if (digestMatch) {
+              const digestIssueNumber = parseInt(digestMatch[1], 10);
+              config.watch.digestIssue = digestIssueNumber;
+              fs8.writeFileSync(kodyConfigPath, JSON.stringify(config, null, 2) + "\n");
+              console.log(`  \u2713 Created digest issue #${digestIssueNumber}`);
+              try {
+                execFileSync4("gh", [
+                  "issue",
+                  "pin",
+                  String(digestIssueNumber),
+                  "--repo",
+                  watchRepoSlug
+                ], {
+                  cwd,
+                  encoding: "utf-8",
+                  timeout: 1e4,
+                  stdio: ["pipe", "pipe", "pipe"]
+                });
+                console.log(`  \u2713 Pinned digest issue`);
+              } catch {
+              }
+              try {
+                execFileSync4("gh", [
+                  "variable",
+                  "set",
+                  "WATCH_DIGEST_ISSUE",
+                  "--repo",
+                  watchRepoSlug,
+                  "--body",
+                  String(digestIssueNumber)
+                ], {
+                  cwd,
+                  encoding: "utf-8",
+                  timeout: 1e4,
+                  stdio: ["pipe", "pipe", "pipe"]
+                });
+                console.log(`  \u2713 Set WATCH_DIGEST_ISSUE variable`);
+              } catch {
+              }
+            }
+          } catch (err) {
+            console.log(`  \u26A0 Failed to create digest issue: ${err instanceof Error ? err.message : err}`);
+          }
+        }
+      } else if (config.watch?.digestIssue) {
+        console.log(`  \u25CB Digest issue already set: #${config.watch.digestIssue}`);
+      } else {
+        console.log("  \u25CB Watch not enabled \u2014 skipping digest issue setup");
+      }
+    } catch {
+    }
+  }
   console.log("\n\u2500\u2500 Labels \u2500\u2500");
   try {
     let repoSlug = "";
@@ -8457,6 +9755,7 @@ ${entries}
     ".kody/memory/conventions.md",
     ".kody/qa-guide.md",
     ".kody/tools.yml",
+    "kody.config.json",
     ...installedSkillPaths
   ].filter((f) => fs8.existsSync(path7.join(cwd, f)));
   for (const stage of STEP_STAGES) {
@@ -8570,11 +9869,11 @@ Create it manually.`, cwd);
 
 // src/bin/cli.ts
 init_architecture_detection();
-var __dirname2 = path31.dirname(fileURLToPath2(import.meta.url));
-var PKG_ROOT = path31.resolve(__dirname2, "..", "..");
+var __dirname2 = path36.dirname(fileURLToPath2(import.meta.url));
+var PKG_ROOT = path36.resolve(__dirname2, "..", "..");
 function getVersion() {
-  const pkgPath = path31.join(PKG_ROOT, "package.json");
-  const pkg = JSON.parse(fs34.readFileSync(pkgPath, "utf-8"));
+  const pkgPath = path36.join(PKG_ROOT, "package.json");
+  const pkg = JSON.parse(fs39.readFileSync(pkgPath, "utf-8"));
   return pkg.version;
 }
 var args = process.argv.slice(2);
@@ -8589,6 +9888,10 @@ if (command === "init") {
   Promise.resolve().then(() => (init_test_model_command(), test_model_command_exports)).then(({ runTestModelCommand: runTestModelCommand2 }) => runTestModelCommand2());
 } else if (command === "ci-parse") {
   Promise.resolve().then(() => (init_parse_inputs(), parse_inputs_exports)).then(({ runCiParse: runCiParse2 }) => runCiParse2());
+} else if (command === "watch") {
+  Promise.resolve().then(() => (init_watch2(), watch_exports)).then(
+    ({ runWatchCommand: runWatchCommand2 }) => runWatchCommand2({ dryRun: args.includes("--dry-run") })
+  );
 } else if (command === "version" || command === "--version" || command === "-v") {
   console.log(getVersion());
 } else {