@kody-ade/kody-engine 0.4.433 → 0.4.435

package/dist/bin/kody.js

@@ -15,7 +15,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@kody-ade/kody-engine",
-      version: "0.4.433",
+      version: "0.4.435",
       description: "kody \u2014 autonomous development engine. Single-session Claude Code agent behind a generic executor + declarative implementation profiles.",
       license: "MIT",
       type: "module",
@@ -47,7 +47,7 @@ var init_package = __esm({
         "lint:fix": "biome check --write",
         format: "biome format --write",
         "verify:package": "node scripts/verify-package-tarball.cjs",
-        "brain:publish": "docker buildx build --platform linux/amd64 -f runner/Dockerfile.brain -t ghcr.io/${KODY_BRAIN_GHCR_OWNER:-aharonyaircohen}/kody-brain:latest --push runner",
+        "brain:publish": "docker buildx build --platform linux/amd64 -f runner/Dockerfile.brain --build-arg KODY_ENGINE_REF=$(git rev-parse HEAD) -t ghcr.io/${KODY_BRAIN_GHCR_OWNER:-aharonyaircohen}/kody-brain:latest --push runner",
         prepublishOnly: "pnpm typecheck && vitest run tests/unit tests/int --no-coverage && pnpm test:runtime-services && pnpm build && pnpm verify:package"
       },
       dependencies: {
@@ -4194,7 +4194,7 @@ var init_task_artifacts = __esm({
 
 // src/gha.ts
 import { execFileSync as execFileSync2 } from "child_process";
-import * as fs17 from "fs";
+import * as fs18 from "fs";
 function getRunUrl() {
   const server = process.env.GITHUB_SERVER_URL;
   const repo = process.env.GITHUB_REPOSITORY;
@@ -4205,10 +4205,10 @@ function getRunUrl() {
 function reactToTriggerComment(cwd) {
   if (process.env.GITHUB_EVENT_NAME !== "issue_comment") return;
   const eventPath = process.env.GITHUB_EVENT_PATH;
-  if (!eventPath || !fs17.existsSync(eventPath)) return;
+  if (!eventPath || !fs18.existsSync(eventPath)) return;
   let event = null;
   try {
-    event = JSON.parse(fs17.readFileSync(eventPath, "utf-8"));
+    event = JSON.parse(fs18.readFileSync(eventPath, "utf-8"));
   } catch {
     return;
   }
@@ -4771,31 +4771,31 @@ var init_lifecycles = __esm({
 });
 
 // src/scripts/buildSyntheticPlugin.ts
-import * as fs18 from "fs";
+import * as fs19 from "fs";
 import * as os3 from "os";
-import * as path17 from "path";
+import * as path18 from "path";
 function getPluginsCatalogRoot() {
-  const here = path17.dirname(new URL(import.meta.url).pathname);
+  const here = path18.dirname(new URL(import.meta.url).pathname);
   const candidates = [
-    path17.join(here, "..", "plugins"),
+    path18.join(here, "..", "plugins"),
     // dev: src/scripts → src/plugins
-    path17.join(here, "..", "..", "plugins"),
+    path18.join(here, "..", "..", "plugins"),
     // built: dist/scripts → dist/plugins
-    path17.join(here, "..", "..", "src", "plugins")
+    path18.join(here, "..", "..", "src", "plugins")
     // fallback
   ];
   for (const c of candidates) {
-    if (fs18.existsSync(c) && fs18.statSync(c).isDirectory()) return c;
+    if (fs19.existsSync(c) && fs19.statSync(c).isDirectory()) return c;
   }
   return candidates[0];
 }
 function copyDir(src, dst) {
-  fs18.mkdirSync(dst, { recursive: true });
-  for (const ent of fs18.readdirSync(src, { withFileTypes: true })) {
-    const s = path17.join(src, ent.name);
-    const d = path17.join(dst, ent.name);
+  fs19.mkdirSync(dst, { recursive: true });
+  for (const ent of fs19.readdirSync(src, { withFileTypes: true })) {
+    const s = path18.join(src, ent.name);
+    const d = path18.join(dst, ent.name);
     if (ent.isDirectory()) copyDir(s, d);
-    else if (ent.isFile()) fs18.copyFileSync(s, d);
+    else if (ent.isFile()) fs19.copyFileSync(s, d);
   }
 }
 var buildSyntheticPlugin;
@@ -4808,47 +4808,47 @@ var init_buildSyntheticPlugin = __esm({
       if (!needsSynthetic) return;
       const catalog = getPluginsCatalogRoot();
       const runId = `${profile.name}-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
-      const root = path17.join(os3.tmpdir(), `kody-synth-${runId}`);
-      fs18.mkdirSync(path17.join(root, ".claude-plugin"), { recursive: true });
+      const root = path18.join(os3.tmpdir(), `kody-synth-${runId}`);
+      fs19.mkdirSync(path18.join(root, ".claude-plugin"), { recursive: true });
       const resolvePart = (bucket, entry) => {
-        const local = path17.join(profile.dir, bucket, entry);
-        if (fs18.existsSync(local)) return local;
-        const shared = path17.resolve(profile.dir, "..", "..", "shared", bucket, entry);
-        if (fs18.existsSync(shared)) return shared;
-        const central = path17.join(catalog, bucket, entry);
-        if (fs18.existsSync(central)) return central;
+        const local = path18.join(profile.dir, bucket, entry);
+        if (fs19.existsSync(local)) return local;
+        const shared = path18.resolve(profile.dir, "..", "..", "shared", bucket, entry);
+        if (fs19.existsSync(shared)) return shared;
+        const central = path18.join(catalog, bucket, entry);
+        if (fs19.existsSync(central)) return central;
         throw new Error(
-          `buildSyntheticPlugin: ${bucket} entry '${entry}' not found in implementation dir (${profile.dir}/${bucket}/), Store shared assets (${path17.dirname(shared)}/), or catalog (${catalog}/${bucket}/)`
+          `buildSyntheticPlugin: ${bucket} entry '${entry}' not found in implementation dir (${profile.dir}/${bucket}/), Store shared assets (${path18.dirname(shared)}/), or catalog (${catalog}/${bucket}/)`
         );
       };
       if (cc.skills.length > 0) {
-        const dst = path17.join(root, "skills");
-        fs18.mkdirSync(dst, { recursive: true });
+        const dst = path18.join(root, "skills");
+        fs19.mkdirSync(dst, { recursive: true });
         for (const name of cc.skills) {
-          copyDir(resolvePart("skills", name), path17.join(dst, name));
+          copyDir(resolvePart("skills", name), path18.join(dst, name));
         }
       }
       if (cc.commands.length > 0) {
-        const dst = path17.join(root, "commands");
-        fs18.mkdirSync(dst, { recursive: true });
+        const dst = path18.join(root, "commands");
+        fs19.mkdirSync(dst, { recursive: true });
         for (const name of cc.commands) {
-          fs18.copyFileSync(resolvePart("commands", `${name}.md`), path17.join(dst, `${name}.md`));
+          fs19.copyFileSync(resolvePart("commands", `${name}.md`), path18.join(dst, `${name}.md`));
         }
       }
       if (cc.hooks.length > 0) {
-        const dst = path17.join(root, "hooks");
-        fs18.mkdirSync(dst, { recursive: true });
+        const dst = path18.join(root, "hooks");
+        fs19.mkdirSync(dst, { recursive: true });
         const merged = { hooks: {} };
         for (const name of cc.hooks) {
           const src = resolvePart("hooks", `${name}.json`);
-          const parsed = JSON.parse(fs18.readFileSync(src, "utf-8"));
+          const parsed = JSON.parse(fs19.readFileSync(src, "utf-8"));
           for (const [event, entries] of Object.entries(parsed.hooks ?? {})) {
             if (!Array.isArray(entries)) continue;
             if (!merged.hooks[event]) merged.hooks[event] = [];
             merged.hooks[event].push(...entries);
           }
         }
-        fs18.writeFileSync(path17.join(dst, "hooks.json"), `${JSON.stringify(merged, null, 2)}
+        fs19.writeFileSync(path18.join(dst, "hooks.json"), `${JSON.stringify(merged, null, 2)}
 `);
       }
       const manifest = {
@@ -4858,7 +4858,7 @@ var init_buildSyntheticPlugin = __esm({
       };
       if (cc.skills.length > 0) manifest.skills = ["./skills/"];
       if (cc.commands.length > 0) manifest.commands = ["./commands/"];
-      fs18.writeFileSync(path17.join(root, ".claude-plugin", "plugin.json"), `${JSON.stringify(manifest, null, 2)}
+      fs19.writeFileSync(path18.join(root, ".claude-plugin", "plugin.json"), `${JSON.stringify(manifest, null, 2)}
 `);
       ctx.data.syntheticPluginPath = root;
     };
@@ -4866,8 +4866,8 @@ var init_buildSyntheticPlugin = __esm({
 });
 
 // src/subagents.ts
-import * as fs19 from "fs";
-import * as path18 from "path";
+import * as fs20 from "fs";
+import * as path19 from "path";
 function splitFrontmatter(raw) {
   const match = /^---\n([\s\S]*?)\n---\n?([\s\S]*)$/.exec(raw);
   if (!match) return { fm: {}, body: raw.trim() };
@@ -4880,12 +4880,12 @@ function splitFrontmatter(raw) {
   return { fm, body: (match[2] ?? "").trim() };
 }
 function resolveAgentFile2(profileDir, name) {
-  const local = path18.join(profileDir, "agents", `${name}.md`);
-  if (fs19.existsSync(local)) return local;
-  const shared = path18.resolve(profileDir, "..", "..", "shared", "agents", `${name}.md`);
-  if (fs19.existsSync(shared)) return shared;
-  const central = path18.join(getPluginsCatalogRoot(), "agents", `${name}.md`);
-  if (fs19.existsSync(central)) return central;
+  const local = path19.join(profileDir, "agents", `${name}.md`);
+  if (fs20.existsSync(local)) return local;
+  const shared = path19.resolve(profileDir, "..", "..", "shared", "agents", `${name}.md`);
+  if (fs20.existsSync(shared)) return shared;
+  const central = path19.join(getPluginsCatalogRoot(), "agents", `${name}.md`);
+  if (fs20.existsSync(central)) return central;
   throw new Error(
     `loadSubagents: agent '${name}' not found in ${profileDir}/agents/, hydrated shared assets, or engine catalog`
   );
@@ -4896,7 +4896,7 @@ function captureSubagentTemplates(profile) {
   const out = {};
   for (const name of names) {
     try {
-      out[name] = fs19.readFileSync(resolveAgentFile2(profile.dir, name), "utf-8");
+      out[name] = fs20.readFileSync(resolveAgentFile2(profile.dir, name), "utf-8");
     } catch {
     }
   }
@@ -4907,7 +4907,7 @@ function loadSubagents(profile) {
   if (!names || names.length === 0) return void 0;
   const agents = {};
   for (const name of names) {
-    const raw = profile.subagentTemplates?.[name] ?? fs19.readFileSync(resolveAgentFile2(profile.dir, name), "utf-8");
+    const raw = profile.subagentTemplates?.[name] ?? fs20.readFileSync(resolveAgentFile2(profile.dir, name), "utf-8");
     const { fm, body } = splitFrontmatter(raw);
     if (!body) throw new Error(`loadSubagents: agent '${name}' has an empty prompt body`);
     const def = {
@@ -4931,16 +4931,16 @@ var init_subagents = __esm({
 });
 
 // src/profile.ts
-import { createHash as createHash3 } from "crypto";
-import * as fs20 from "fs";
-import * as path19 from "path";
+import { createHash as createHash4 } from "crypto";
+import * as fs21 from "fs";
+import * as path20 from "path";
 function loadProfile(profilePath) {
-  if (!fs20.existsSync(profilePath)) {
+  if (!fs21.existsSync(profilePath)) {
     throw new ProfileError(profilePath, "file not found");
   }
   let raw;
   try {
-    raw = JSON.parse(fs20.readFileSync(profilePath, "utf-8"));
+    raw = JSON.parse(fs21.readFileSync(profilePath, "utf-8"));
   } catch (err) {
     throw new ProfileError(profilePath, `invalid JSON: ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -4952,7 +4952,7 @@ function loadProfile(profilePath) {
   const unknownKeys = Object.keys(r).filter((k) => !KNOWN_PROFILE_KEYS.has(k));
   if (unknownKeys.length > 0) {
     process.stderr.write(
-      `[kody profile] ${path19.basename(path19.dirname(profilePath))}: unknown top-level keys ignored: ${unknownKeys.join(", ")}
+      `[kody profile] ${path20.basename(path20.dirname(profilePath))}: unknown top-level keys ignored: ${unknownKeys.join(", ")}
 `
     );
   }
@@ -4962,7 +4962,7 @@ function loadProfile(profilePath) {
     if (!refPath) {
       throw new ProfileError(profilePath, `capability references unknown implementation '${execRef}'`);
     }
-    if (path19.resolve(refPath) === path19.resolve(profilePath)) {
+    if (path20.resolve(refPath) === path20.resolve(profilePath)) {
     } else {
       const base = loadProfile(refPath);
       return {
@@ -5060,8 +5060,8 @@ function loadProfile(profilePath) {
     // Phase 5 in-process handoff opt-in. Default false; containers
     // flip to true after end-to-end verification.
     preloadContext: r.preloadContext === true,
-    dir: path19.dirname(profilePath),
-    promptTemplates: readPromptTemplates(path19.dirname(profilePath))
+    dir: path20.dirname(profilePath),
+    promptTemplates: readPromptTemplates(path20.dirname(profilePath))
   };
   if (lifecycle) {
     applyLifecycle(profile, profilePath);
@@ -5096,19 +5096,19 @@ function loadProfile(profilePath) {
   return profile;
 }
 function compileRuntimeDocument(runtimePath, document) {
-  if (path19.basename(runtimePath) !== "runtime.json") return document;
+  if (path20.basename(runtimePath) !== "runtime.json") return document;
   if (document.adapter !== "kody-engine-profile") {
     throw new ProfileError(runtimePath, "unsupported runtime adapter document");
   }
-  const implementationDir = path19.dirname(runtimePath);
-  const implementation = readJsonObject(path19.join(implementationDir, "definition.json"), "Implementation definition");
-  const definitionsRoot2 = path19.dirname(path19.dirname(implementationDir));
+  const implementationDir = path20.dirname(runtimePath);
+  const implementation = readJsonObject(path20.join(implementationDir, "definition.json"), "Implementation definition");
+  const definitionsRoot2 = path20.dirname(path20.dirname(implementationDir));
   const capabilityId = implementation.capabilityRef && typeof implementation.capabilityRef === "object" && !Array.isArray(implementation.capabilityRef) ? implementation.capabilityRef.id : void 0;
   if (typeof capabilityId !== "string" || !capabilityId) {
     throw new ProfileError(runtimePath, "Implementation capabilityRef is invalid");
   }
   const capability = readJsonObject(
-    path19.join(definitionsRoot2, "capabilities", capabilityId, "definition.json"),
+    path20.join(definitionsRoot2, "capabilities", capabilityId, "definition.json"),
     "Capability definition"
   );
   const {
@@ -5130,9 +5130,9 @@ function compileRuntimeDocument(runtimePath, document) {
     agent: agentRef,
     canonicalContract: {
       capabilityId,
-      capabilityRevision: createHash3("sha256").update(canonical2(capability)).digest("hex"),
+      capabilityRevision: createHash4("sha256").update(canonical2(capability)).digest("hex"),
       implementationId: String(implementation.id),
-      implementationRevision: createHash3("sha256").update(canonical2(implementation)).digest("hex"),
+      implementationRevision: createHash4("sha256").update(canonical2(implementation)).digest("hex"),
       inputSchema: capability.inputSchema,
       outputSchema: capability.outputSchema
     }
@@ -5147,7 +5147,7 @@ function canonical2(value) {
 }
 function readJsonObject(filePath, label) {
   try {
-    const value = JSON.parse(fs20.readFileSync(filePath, "utf-8"));
+    const value = JSON.parse(fs21.readFileSync(filePath, "utf-8"));
     if (!value || typeof value !== "object" || Array.isArray(value)) {
       throw new Error("must be an object");
     }
@@ -5165,17 +5165,17 @@ function readPromptTemplates(dir) {
   const out = {};
   const read = (p) => {
     try {
-      out[p] = fs20.readFileSync(p, "utf-8");
+      out[p] = fs21.readFileSync(p, "utf-8");
     } catch {
     }
   };
-  read(path19.join(dir, "prompt.md"));
-  read(path19.join(dir, "capability.md"));
-  read(path19.join(dir, "capability.md"));
+  read(path20.join(dir, "prompt.md"));
+  read(path20.join(dir, "capability.md"));
+  read(path20.join(dir, "capability.md"));
   try {
-    const promptsDir = path19.join(dir, "prompts");
-    for (const ent of fs20.readdirSync(promptsDir)) {
-      if (ent.endsWith(".md")) read(path19.join(promptsDir, ent));
+    const promptsDir = path20.join(dir, "prompts");
+    for (const ent of fs21.readdirSync(promptsDir)) {
+      if (ent.endsWith(".md")) read(path20.join(promptsDir, ent));
     }
   } catch {
   }
@@ -5950,16 +5950,16 @@ var init_state = __esm({
 });
 
 // src/prompt.ts
-import * as fs21 from "fs";
-import * as path20 from "path";
+import * as fs22 from "fs";
+import * as path21 from "path";
 function loadProjectConventions(projectDir) {
   const out = [];
   for (const rel of CONVENTION_FILES) {
-    const abs = path20.join(projectDir, rel);
-    if (!fs21.existsSync(abs)) continue;
+    const abs = path21.join(projectDir, rel);
+    if (!fs22.existsSync(abs)) continue;
     let content;
     try {
-      content = fs21.readFileSync(abs, "utf-8");
+      content = fs22.readFileSync(abs, "utf-8");
     } catch {
       continue;
     }
@@ -6194,8 +6194,8 @@ var loadMemoryContext_exports = {};
 __export(loadMemoryContext_exports, {
   loadMemoryContext: () => loadMemoryContext
 });
-import * as fs22 from "fs";
-import * as path21 from "path";
+import * as fs23 from "fs";
+import * as path22 from "path";
 function formatBlockFromBackend(docs) {
   const pages = docs.flatMap((record2) => {
     if (!record2.doc || typeof record2.doc !== "object") return [];
@@ -6218,21 +6218,21 @@ function collectPages(memoryAbs) {
   walkMd(memoryAbs, (file) => {
     let stat;
     try {
-      stat = fs22.statSync(file);
+      stat = fs23.statSync(file);
     } catch {
       return;
     }
     let raw;
     try {
-      raw = fs22.readFileSync(file, "utf-8");
+      raw = fs23.readFileSync(file, "utf-8");
     } catch {
       return;
     }
     const fm = raw.match(/^---\s*\n([\s\S]*?)\n---/);
-    const title = fm?.[1]?.match(/^title:\s*(.+)$/m)?.[1]?.trim() ?? path21.basename(file, ".md");
+    const title = fm?.[1]?.match(/^title:\s*(.+)$/m)?.[1]?.trim() ?? path22.basename(file, ".md");
     const updated = fm?.[1]?.match(/^updated:\s*([0-9T:.+\-Z]+)/m)?.[1]?.trim() ?? "";
     out.push({
-      relPath: path21.relative(memoryAbs, file),
+      relPath: path22.relative(memoryAbs, file),
       title,
       updated,
       content: raw.length > PER_PAGE_MAX_BYTES ? raw.slice(0, PER_PAGE_MAX_BYTES) + TRUNCATED_SUFFIX2 : raw,
@@ -6300,16 +6300,16 @@ function walkMd(root, visit) {
     const dir = stack.pop();
     let names;
     try {
-      names = fs22.readdirSync(dir);
+      names = fs23.readdirSync(dir);
     } catch {
       continue;
     }
     for (const name of names) {
       if (name.startsWith(".")) continue;
-      const full = path21.join(dir, name);
+      const full = path22.join(dir, name);
       let stat;
       try {
-        stat = fs22.statSync(full);
+        stat = fs23.statSync(full);
       } catch {
         continue;
       }
@@ -6344,8 +6344,8 @@ var init_loadMemoryContext = __esm({
         }
         return;
       }
-      const memoryAbs = path21.join(ctx.cwd, MEMORY_DIR_RELATIVE);
-      if (!fs22.existsSync(memoryAbs)) {
+      const memoryAbs = path22.join(ctx.cwd, MEMORY_DIR_RELATIVE);
+      if (!fs23.existsSync(memoryAbs)) {
         ctx.data.memoryContext = "";
         return;
       }
@@ -6389,11 +6389,11 @@ var init_loadCoverageRules = __esm({
 
 // src/container.ts
 import { execFileSync as execFileSync3 } from "child_process";
-import * as fs23 from "fs";
+import * as fs24 from "fs";
 function getProfileInputsForChild(profileName, _cwd) {
   try {
     const profilePath = resolveProfilePath(profileName);
-    if (!fs23.existsSync(profilePath)) return null;
+    if (!fs24.existsSync(profilePath)) return null;
     return loadProfile(profilePath).inputs;
   } catch {
     return null;
@@ -6857,10 +6857,10 @@ var init_lifecycleLabels = __esm({
 
 // src/litellm.ts
 import { execFileSync as execFileSync4, spawn as spawn4 } from "child_process";
-import * as fs24 from "fs";
+import * as fs25 from "fs";
 import * as net from "net";
 import * as os4 from "os";
-import * as path22 from "path";
+import * as path23 from "path";
 async function checkLitellmHealth(url) {
   try {
     const response = await fetch(`${url}/health`, { signal: AbortSignal.timeout(3e3) });
@@ -6930,7 +6930,7 @@ function locateLitellmScript() {
 }
 function resolveLitellmCommand() {
   const imageScript = "/opt/venv/bin/litellm";
-  if (fs24.existsSync(imageScript)) return imageScript;
+  if (fs25.existsSync(imageScript)) return imageScript;
   try {
     execFileSync4("which", ["litellm"], { timeout: 3e3, stdio: "pipe" });
     return "litellm";
@@ -6966,13 +6966,13 @@ async function startLitellmIfNeeded(model, projectDir, url = LITELLM_DEFAULT_URL
   const spawnProxy = () => {
     const portMatch = activeUrl.match(/:(\d+)/);
     const port = portMatch ? portMatch[1] : "4000";
-    const configPath = path22.join(os4.tmpdir(), `kody-local-litellm-${Date.now()}.yaml`);
-    fs24.writeFileSync(configPath, generateLitellmConfigYaml(model));
+    const configPath = path23.join(os4.tmpdir(), `kody-local-litellm-${Date.now()}.yaml`);
+    fs25.writeFileSync(configPath, generateLitellmConfigYaml(model));
     const args = ["--config", configPath, "--port", port];
-    const nextLogPath = path22.join(os4.tmpdir(), `kody-local-litellm-${Date.now()}.log`);
-    const outFd = fs24.openSync(nextLogPath, "w");
+    const nextLogPath = path23.join(os4.tmpdir(), `kody-local-litellm-${Date.now()}.log`);
+    const outFd = fs25.openSync(nextLogPath, "w");
     child = spawn4(cmd, args, { stdio: ["ignore", outFd, outFd], detached: true, env: childEnv });
-    fs24.closeSync(outFd);
+    fs25.closeSync(outFd);
     logPath = nextLogPath;
   };
   const waitForHealth = async () => {
@@ -6986,7 +6986,7 @@ async function startLitellmIfNeeded(model, projectDir, url = LITELLM_DEFAULT_URL
   const readLogTail = () => {
     if (!logPath) return "";
     try {
-      return fs24.readFileSync(logPath, "utf-8").slice(-2e3);
+      return fs25.readFileSync(logPath, "utf-8").slice(-2e3);
     } catch {
       return "";
     }
@@ -7069,10 +7069,10 @@ function canListen(port, host) {
   });
 }
 function readDotenvApiKeys(projectDir) {
-  const dotenvPath = path22.join(projectDir, ".env");
-  if (!fs24.existsSync(dotenvPath)) return {};
+  const dotenvPath = path23.join(projectDir, ".env");
+  if (!fs25.existsSync(dotenvPath)) return {};
   const result = {};
-  for (const rawLine of fs24.readFileSync(dotenvPath, "utf-8").split("\n")) {
+  for (const rawLine of fs25.readFileSync(dotenvPath, "utf-8").split("\n")) {
     const line = rawLine.trim();
     if (!line || line.startsWith("#")) continue;
     const match = line.match(/^([A-Z_][A-Z0-9_]*_API_KEY)=(.*)$/);
@@ -7472,8 +7472,8 @@ var init_pushWithRetry = __esm({
 
 // src/commit.ts
 import { execFileSync as execFileSync6 } from "child_process";
-import * as fs25 from "fs";
-import * as path23 from "path";
+import * as fs26 from "fs";
+import * as path24 from "path";
 function isGitHubYamlPath(filePath) {
   const normalized = filePath.replace(/^\.\/+/, "");
   return normalized.startsWith(".github/") && /\.ya?ml$/i.test(normalized);
@@ -7515,18 +7515,18 @@ function ensureGitIdentity(cwd) {
 }
 function abortUnfinishedGitOps(cwd) {
   const aborted = [];
-  const gitDir = path23.join(cwd ?? process.cwd(), ".git");
-  if (!fs25.existsSync(gitDir)) return aborted;
-  if (fs25.existsSync(path23.join(gitDir, "MERGE_HEAD"))) {
+  const gitDir = path24.join(cwd ?? process.cwd(), ".git");
+  if (!fs26.existsSync(gitDir)) return aborted;
+  if (fs26.existsSync(path24.join(gitDir, "MERGE_HEAD"))) {
     if (tryGit(["merge", "--abort"], cwd)) aborted.push("merge");
   }
-  if (fs25.existsSync(path23.join(gitDir, "CHERRY_PICK_HEAD"))) {
+  if (fs26.existsSync(path24.join(gitDir, "CHERRY_PICK_HEAD"))) {
     if (tryGit(["cherry-pick", "--abort"], cwd)) aborted.push("cherry-pick");
   }
-  if (fs25.existsSync(path23.join(gitDir, "REVERT_HEAD"))) {
+  if (fs26.existsSync(path24.join(gitDir, "REVERT_HEAD"))) {
     if (tryGit(["revert", "--abort"], cwd)) aborted.push("revert");
   }
-  if (fs25.existsSync(path23.join(gitDir, "rebase-merge")) || fs25.existsSync(path23.join(gitDir, "rebase-apply"))) {
+  if (fs26.existsSync(path24.join(gitDir, "rebase-merge")) || fs26.existsSync(path24.join(gitDir, "rebase-apply"))) {
     if (tryGit(["rebase", "--abort"], cwd)) aborted.push("rebase");
   }
   try {
@@ -7583,7 +7583,7 @@ function normalizeCommitMessage(raw) {
 function commitAndPush(branch, agentMessage, cwd) {
   const allChanged = listChangedFiles(cwd);
   const allowedFiles = allChanged.filter((f) => !isForbiddenPath(f));
-  const mergeHeadExists = fs25.existsSync(path23.join(cwd ?? process.cwd(), ".git", "MERGE_HEAD"));
+  const mergeHeadExists = fs26.existsSync(path24.join(cwd ?? process.cwd(), ".git", "MERGE_HEAD"));
   if (allowedFiles.length === 0 && !mergeHeadExists) {
     return { committed: false, pushed: false, sha: "", message: "" };
   }
@@ -8223,7 +8223,7 @@ var init_state2 = __esm({
 });
 
 // src/goal/runLog.ts
-import * as fs26 from "fs";
+import * as fs27 from "fs";
 function stageGoalRunLogEvent(data, goalId, event, at = nowIso()) {
   const logs = goalRunLogs(data);
   const existing = logs[goalId];
@@ -8565,8 +8565,8 @@ function readGithubEvent() {
   const eventPath = process.env.GITHUB_EVENT_PATH;
   if (!eventPath) return null;
   try {
-    if (!fs26.existsSync(eventPath)) return null;
-    const parsed = JSON.parse(fs26.readFileSync(eventPath, "utf-8"));
+    if (!fs27.existsSync(eventPath)) return null;
+    const parsed = JSON.parse(fs27.readFileSync(eventPath, "utf-8"));
     return recordValue3(parsed);
   } catch {
     return null;
@@ -8676,8 +8676,8 @@ var init_stateStore = __esm({
 });
 
 // src/goal/targetLoopResolution.ts
-import * as fs27 from "fs";
-import * as path24 from "path";
+import * as fs28 from "fs";
+import * as path25 from "path";
 async function resolveActiveGoalLoopTarget(config, cwd, loopGoalId, loopGoal) {
   const targetId = loopGoal.loopTarget?.id.trim() ?? "";
   assertSafeGoalId(targetId, "loop target");
@@ -8755,11 +8755,11 @@ function goalInstanceTime(state) {
   return Number.isNaN(parsed) ? 0 : parsed;
 }
 function loadGoalTemplate(cwd, targetId) {
-  return readJsonObject2(path24.join(cwd, ".kody-engine", "definitions", "goals", targetId, "state.json"));
+  return readJsonObject2(path25.join(cwd, ".kody-engine", "definitions", "goals", targetId, "state.json"));
 }
 function readJsonObject2(filePath) {
-  if (!fs27.existsSync(filePath)) return null;
-  const parsed = JSON.parse(fs27.readFileSync(filePath, "utf8"));
+  if (!fs28.existsSync(filePath)) return null;
+  const parsed = JSON.parse(fs28.readFileSync(filePath, "utf8"));
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
     throw new Error(`goal template ${filePath} must be a JSON object`);
   }
@@ -9278,8 +9278,8 @@ var init_workflowValidation = __esm({
 });
 
 // src/workflowDefinitions.ts
-import * as fs28 from "fs";
-import * as path25 from "path";
+import * as fs29 from "fs";
+import * as path26 from "path";
 function isWorkflowDefinitionId(value) {
   return WORKFLOW_ID_PATTERN.test(value);
 }
@@ -9323,12 +9323,12 @@ function readWorkflowDefinition(_config, cwd, id) {
   const root = cwd ?? process.cwd();
   const relativePath = workflowDefinitionPath(id);
   const candidates = [
-    path25.join(root, ".kody-engine", "runtime", relativePath),
-    path25.join(root, ".kody-engine", "definitions", relativePath)
+    path26.join(root, ".kody-engine", "runtime", relativePath),
+    path26.join(root, ".kody-engine", "definitions", relativePath)
   ];
   for (const filePath of candidates) {
-    if (!fs28.existsSync(filePath)) continue;
-    const workflow = parseWorkflowDefinition(fs28.readFileSync(filePath, "utf8"));
+    if (!fs29.existsSync(filePath)) continue;
+    const workflow = parseWorkflowDefinition(fs29.readFileSync(filePath, "utf8"));
     if (workflow) return workflow;
   }
   return null;
@@ -9336,7 +9336,7 @@ function readWorkflowDefinition(_config, cwd, id) {
 function workflowDefinitionToCapabilityFolder(id, workflow, source = workflowDefinitionPath(id)) {
   return {
     slug: id,
-    dir: path25.dirname(source),
+    dir: path26.dirname(source),
     profilePath: source,
     bodyPath: source,
     title: workflow.name,
@@ -9541,8 +9541,8 @@ var init_backendStateBackend = __esm({
 });
 
 // src/scripts/jobState/localFileBackend.ts
-import * as fs29 from "fs";
-import * as path26 from "path";
+import * as fs30 from "fs";
+import * as path27 from "path";
 function sanitizeKey(s) {
   return s.replace(/[^A-Za-z0-9._-]/g, "-");
 }
@@ -9598,7 +9598,7 @@ var init_localFileBackend = __esm({
         if (!opts.owner || !opts.repo) throw new Error("LocalFileBackend: owner and repo are required");
         this.cwd = opts.cwd;
         this.jobsDir = opts.jobsDir;
-        this.absDir = path26.resolve(opts.cwd, opts.jobsDir);
+        this.absDir = path27.resolve(opts.cwd, opts.jobsDir);
         this.owner = opts.owner;
         this.repo = opts.repo;
         this.cache = opts.cache ?? defaultCacheAdapter();
@@ -9613,7 +9613,7 @@ var init_localFileBackend = __esm({
 `);
           return;
         }
-        fs29.mkdirSync(this.absDir, { recursive: true });
+        fs30.mkdirSync(this.absDir, { recursive: true });
         const prefix = this.cacheKeyPrefix();
         const probeKey = `${prefix}probe-${Date.now()}`;
         try {
@@ -9642,7 +9642,7 @@ var init_localFileBackend = __esm({
 `);
           return;
         }
-        if (!fs29.existsSync(this.absDir)) {
+        if (!fs30.existsSync(this.absDir)) {
           return;
         }
         const key = `${this.cacheKeyPrefix()}${process.env.GITHUB_RUN_ID ?? "norunid"}-${Date.now()}`;
@@ -9658,11 +9658,11 @@ var init_localFileBackend = __esm({
       }
       load(slug) {
         const relPath = stateFilePath(this.jobsDir, slug);
-        const absPath = path26.resolve(this.cwd, relPath);
-        if (!fs29.existsSync(absPath)) {
+        const absPath = path27.resolve(this.cwd, relPath);
+        if (!fs30.existsSync(absPath)) {
           return { path: relPath, handle: null, state: initialStateEnvelope("seed"), created: true };
         }
-        const raw = fs29.readFileSync(absPath, "utf-8");
+        const raw = fs30.readFileSync(absPath, "utf-8");
         let parsed;
         try {
           parsed = JSON.parse(raw);
@@ -9679,13 +9679,13 @@ var init_localFileBackend = __esm({
         if (!loaded.created && isStateUnchanged(loaded.state, next)) {
           return false;
         }
-        const absPath = path26.resolve(this.cwd, loaded.path);
-        fs29.mkdirSync(path26.dirname(absPath), { recursive: true });
+        const absPath = path27.resolve(this.cwd, loaded.path);
+        fs30.mkdirSync(path27.dirname(absPath), { recursive: true });
         const body = `${JSON.stringify(next, null, 2)}
 `;
         const tmpPath = `${absPath}.${process.pid}.tmp`;
-        fs29.writeFileSync(tmpPath, body, "utf-8");
-        fs29.renameSync(tmpPath, absPath);
+        fs30.writeFileSync(tmpPath, body, "utf-8");
+        fs30.renameSync(tmpPath, absPath);
         return true;
       }
       cacheKeyPrefix() {
@@ -9717,7 +9717,7 @@ var init_jobState = __esm({
 });
 
 // src/scripts/goalCapabilityScheduling.ts
-import * as path27 from "path";
+import * as path28 from "path";
 function isCapabilityCadenceGoal(goal, extra) {
   return extra.scheduleMode === "agentLoop" || extra.scheduler === "agentLoop" || goal.type === "standing" && goal.capabilities.length > 0;
 }
@@ -9773,7 +9773,7 @@ function planTargetLoopSchedule(opts) {
 }
 async function planGoalCapabilitySchedule(opts) {
   const jobsDir = opts.jobsDir ?? capabilitiesRoot(opts.cwd);
-  const jobsRoot = path27.resolve(opts.cwd, jobsDir);
+  const jobsRoot = path28.resolve(opts.cwd, jobsDir);
   const now = opts.now ?? /* @__PURE__ */ new Date();
   const at = now.toISOString();
   const backend = resolveBackend({ config: opts.config, cwd: opts.cwd, jobsDir });
@@ -11588,8 +11588,8 @@ var init_classifyByLabel = __esm({
 });
 
 // src/scripts/commitAndPush.ts
-import * as fs30 from "fs";
-import * as path28 from "path";
+import * as fs31 from "fs";
+import * as path29 from "path";
 function sentinelPathForStage(cwd, profileName) {
   const runId = resolveRunId();
   return runtimeStatePath(cwd, "agent-runs", runId, `commit-${profileName}.lock`);
@@ -11610,9 +11610,9 @@ var init_commitAndPush = __esm({
       }
       const idempotencyEnabled = process.env.KODY_COMMIT_IDEMPOTENCY !== "0";
       const sentinel = idempotencyEnabled ? sentinelPathForStage(ctx.cwd, profile.name) : null;
-      if (sentinel && fs30.existsSync(sentinel)) {
+      if (sentinel && fs31.existsSync(sentinel)) {
         try {
-          const replay = JSON.parse(fs30.readFileSync(sentinel, "utf-8"));
+          const replay = JSON.parse(fs31.readFileSync(sentinel, "utf-8"));
           ctx.data.commitResult = replay.commitResult ?? { committed: false, pushed: false };
           if (Array.isArray(replay.changedFiles)) ctx.data.changedFiles = replay.changedFiles;
           if (typeof replay.hasCommitsAhead === "boolean") ctx.data.hasCommitsAhead = replay.hasCommitsAhead;
@@ -11672,8 +11672,8 @@ var init_commitAndPush = __esm({
       const result = ctx.data.commitResult;
       if (sentinel && result?.committed) {
         try {
-          fs30.mkdirSync(path28.dirname(sentinel), { recursive: true });
-          fs30.writeFileSync(
+          fs31.mkdirSync(path29.dirname(sentinel), { recursive: true });
+          fs31.writeFileSync(
             sentinel,
             JSON.stringify(
               {
@@ -11767,8 +11767,8 @@ var init_commitGoalState = __esm({
 });
 
 // src/scripts/composePrompt.ts
-import * as fs31 from "fs";
-import * as path29 from "path";
+import * as fs32 from "fs";
+import * as path30 from "path";
 function fenceUntrusted(value) {
   if (value.trim().length === 0) return value;
   const safe = value.replace(/-{3,}\s*END UNTRUSTED INPUT\s*-{3,}/gi, "[END UNTRUSTED INPUT]");
@@ -11892,10 +11892,10 @@ var init_composePrompt = __esm({
       const explicit = ctx.data.promptTemplate;
       const mode = ctx.args.mode;
       const candidates = [
-        explicit ? path29.join(profile.dir, explicit) : null,
-        mode ? path29.join(profile.dir, "prompts", `${mode}.md`) : null,
-        path29.join(profile.dir, "prompt.md"),
-        path29.join(profile.dir, "capability.md")
+        explicit ? path30.join(profile.dir, explicit) : null,
+        mode ? path30.join(profile.dir, "prompts", `${mode}.md`) : null,
+        path30.join(profile.dir, "prompt.md"),
+        path30.join(profile.dir, "capability.md")
       ].filter(Boolean);
       let templatePath = "";
       let template = "";
@@ -11908,7 +11908,7 @@ var init_composePrompt = __esm({
           break;
         }
         try {
-          template = fs31.readFileSync(c, "utf-8");
+          template = fs32.readFileSync(c, "utf-8");
           templatePath = c;
           break;
         } catch (err) {
@@ -11919,7 +11919,7 @@ var init_composePrompt = __esm({
       if (!templatePath) {
         let dirState;
         try {
-          dirState = `dir contents: [${fs31.readdirSync(profile.dir).join(", ")}]`;
+          dirState = `dir contents: [${fs32.readdirSync(profile.dir).join(", ")}]`;
         } catch (err) {
           dirState = `readdir(${profile.dir}) failed: ${err?.code ?? String(err)}`;
         }
@@ -12653,19 +12653,19 @@ var init_deriveQaScopeFromIssue = __esm({
 
 // src/scripts/diagMcp.ts
 import { execFileSync as execFileSync9 } from "child_process";
-import * as fs32 from "fs";
+import * as fs33 from "fs";
 import * as os5 from "os";
-import * as path30 from "path";
+import * as path31 from "path";
 var diagMcp;
 var init_diagMcp = __esm({
   "src/scripts/diagMcp.ts"() {
     "use strict";
     diagMcp = async (_ctx) => {
       const home = os5.homedir();
-      const cacheDir = path30.join(home, ".cache", "ms-playwright");
+      const cacheDir = path31.join(home, ".cache", "ms-playwright");
       let entries = [];
       try {
-        entries = fs32.readdirSync(cacheDir);
+        entries = fs33.readdirSync(cacheDir);
       } catch {
       }
       const hasChromium = entries.some((e) => e.startsWith("chromium"));
@@ -12693,13 +12693,13 @@ var init_diagMcp = __esm({
 });
 
 // src/scripts/frameworkDetectors.ts
-import * as fs33 from "fs";
-import * as path31 from "path";
+import * as fs34 from "fs";
+import * as path32 from "path";
 function detectFrameworks(cwd) {
   const out = [];
   let deps = {};
   try {
-    const pkg = JSON.parse(fs33.readFileSync(path31.join(cwd, "package.json"), "utf-8"));
+    const pkg = JSON.parse(fs34.readFileSync(path32.join(cwd, "package.json"), "utf-8"));
     deps = { ...pkg.dependencies, ...pkg.devDependencies };
   } catch {
     return out;
@@ -12736,25 +12736,25 @@ function detectFrameworks(cwd) {
 }
 function findFile(cwd, candidates) {
   for (const c of candidates) {
-    if (fs33.existsSync(path31.join(cwd, c))) return c;
+    if (fs34.existsSync(path32.join(cwd, c))) return c;
   }
   return null;
 }
 function discoverPayloadCollections(cwd) {
   const out = [];
   for (const dir of COLLECTION_DIRS) {
-    const full = path31.join(cwd, dir);
-    if (!fs33.existsSync(full)) continue;
+    const full = path32.join(cwd, dir);
+    if (!fs34.existsSync(full)) continue;
     let files;
     try {
-      files = fs33.readdirSync(full).filter((f) => f.endsWith(".ts") || f.endsWith(".tsx"));
+      files = fs34.readdirSync(full).filter((f) => f.endsWith(".ts") || f.endsWith(".tsx"));
     } catch {
       continue;
     }
     for (const file of files) {
       try {
-        const filePath = path31.join(full, file);
-        const content = fs33.readFileSync(filePath, "utf-8").slice(0, 1e4);
+        const filePath = path32.join(full, file);
+        const content = fs34.readFileSync(filePath, "utf-8").slice(0, 1e4);
         const slugMatch = content.match(/slug:\s*['"]([a-z0-9-]+)['"]/);
         if (!slugMatch) continue;
         const slug = slugMatch[1];
@@ -12768,7 +12768,7 @@ function discoverPayloadCollections(cwd) {
         out.push({
           name,
           slug,
-          filePath: path31.relative(cwd, filePath),
+          filePath: path32.relative(cwd, filePath),
           fields: fields.slice(0, 20),
           hasAdmin
         });
@@ -12781,28 +12781,28 @@ function discoverPayloadCollections(cwd) {
 function discoverAdminComponents(cwd, collections) {
   const out = [];
   for (const dir of ADMIN_COMPONENT_DIRS) {
-    const full = path31.join(cwd, dir);
-    if (!fs33.existsSync(full)) continue;
+    const full = path32.join(cwd, dir);
+    if (!fs34.existsSync(full)) continue;
     let entries;
     try {
-      entries = fs33.readdirSync(full, { withFileTypes: true });
+      entries = fs34.readdirSync(full, { withFileTypes: true });
     } catch {
       continue;
     }
     for (const entry of entries) {
-      const entryPath = path31.join(full, entry.name);
+      const entryPath = path32.join(full, entry.name);
       let name;
       let filePath;
       if (entry.isDirectory()) {
         const indexFile = ["index.tsx", "index.ts", "index.jsx", "index.js"].find(
-          (f) => fs33.existsSync(path31.join(entryPath, f))
+          (f) => fs34.existsSync(path32.join(entryPath, f))
         );
         if (!indexFile) continue;
         name = entry.name;
-        filePath = path31.relative(cwd, path31.join(entryPath, indexFile));
+        filePath = path32.relative(cwd, path32.join(entryPath, indexFile));
       } else if (/\.(tsx?|jsx?)$/.test(entry.name)) {
         name = entry.name.replace(/\.(tsx?|jsx?)$/, "");
-        filePath = path31.relative(cwd, entryPath);
+        filePath = path32.relative(cwd, entryPath);
       } else {
         continue;
       }
@@ -12810,7 +12810,7 @@ function discoverAdminComponents(cwd, collections) {
       if (collections) {
         for (const col of collections) {
           try {
-            const colContent = fs33.readFileSync(path31.join(cwd, col.filePath), "utf-8");
+            const colContent = fs34.readFileSync(path32.join(cwd, col.filePath), "utf-8");
             if (colContent.includes(name)) {
               usedInCollection = col.slug;
               break;
@@ -12828,8 +12828,8 @@ function scanApiRoutes(cwd) {
   const out = [];
   const appDirs = ["src/app", "app"];
   for (const appDir of appDirs) {
-    const apiDir = path31.join(cwd, appDir, "api");
-    if (!fs33.existsSync(apiDir)) continue;
+    const apiDir = path32.join(cwd, appDir, "api");
+    if (!fs34.existsSync(apiDir)) continue;
     walkApiRoutes(apiDir, "/api", cwd, out);
     break;
   }
@@ -12838,14 +12838,14 @@ function scanApiRoutes(cwd) {
 function walkApiRoutes(dir, prefix, cwd, out) {
   let entries;
   try {
-    entries = fs33.readdirSync(dir, { withFileTypes: true });
+    entries = fs34.readdirSync(dir, { withFileTypes: true });
   } catch {
     return;
   }
   const routeFile = entries.find((e) => e.isFile() && /^route\.(ts|js|tsx|jsx)$/.test(e.name));
   if (routeFile) {
     try {
-      const content = fs33.readFileSync(path31.join(dir, routeFile.name), "utf-8").slice(0, 5e3);
+      const content = fs34.readFileSync(path32.join(dir, routeFile.name), "utf-8").slice(0, 5e3);
       const methods = HTTP_METHODS.filter(
         (m) => new RegExp(`export\\s+(?:async\\s+)?function\\s+${m}\\b`).test(content)
       );
@@ -12853,7 +12853,7 @@ function walkApiRoutes(dir, prefix, cwd, out) {
         out.push({
           path: prefix,
           methods,
-          filePath: path31.relative(cwd, path31.join(dir, routeFile.name))
+          filePath: path32.relative(cwd, path32.join(dir, routeFile.name))
         });
       }
     } catch {
@@ -12864,7 +12864,7 @@ function walkApiRoutes(dir, prefix, cwd, out) {
     if (entry.name === "node_modules" || entry.name === ".next") continue;
     let segment = entry.name;
     if (segment.startsWith("(") && segment.endsWith(")")) {
-      walkApiRoutes(path31.join(dir, entry.name), prefix, cwd, out);
+      walkApiRoutes(path32.join(dir, entry.name), prefix, cwd, out);
       continue;
     }
     if (segment.startsWith("[[") && segment.endsWith("]]")) {
@@ -12872,16 +12872,16 @@ function walkApiRoutes(dir, prefix, cwd, out) {
     } else if (segment.startsWith("[") && segment.endsWith("]")) {
       segment = `:${segment.slice(1, -1)}`;
     }
-    walkApiRoutes(path31.join(dir, entry.name), `${prefix}/${segment}`, cwd, out);
+    walkApiRoutes(path32.join(dir, entry.name), `${prefix}/${segment}`, cwd, out);
   }
 }
 function scanEnvVars(cwd) {
   const candidates = [".env.example", ".env.local.example", ".env.template"];
   for (const envFile of candidates) {
-    const envPath = path31.join(cwd, envFile);
-    if (!fs33.existsSync(envPath)) continue;
+    const envPath = path32.join(cwd, envFile);
+    if (!fs34.existsSync(envPath)) continue;
     try {
-      const content = fs33.readFileSync(envPath, "utf-8");
+      const content = fs34.readFileSync(envPath, "utf-8");
       const vars = [];
       for (const line of content.split("\n")) {
         const trimmed = line.trim();
@@ -12926,8 +12926,8 @@ var init_frameworkDetectors = __esm({
 });
 
 // src/scripts/discoverQaContext.ts
-import * as fs34 from "fs";
-import * as path32 from "path";
+import * as fs35 from "fs";
+import * as path33 from "path";
 function runQaDiscovery(cwd) {
   const out = {
     routes: [],
@@ -12958,9 +12958,9 @@ function runQaDiscovery(cwd) {
 }
 function detectDevServer(cwd, out) {
   try {
-    const pkg = JSON.parse(fs34.readFileSync(path32.join(cwd, "package.json"), "utf-8"));
+    const pkg = JSON.parse(fs35.readFileSync(path33.join(cwd, "package.json"), "utf-8"));
     const allDeps = { ...pkg.dependencies, ...pkg.devDependencies };
-    const pm = fs34.existsSync(path32.join(cwd, "pnpm-lock.yaml")) ? "pnpm" : fs34.existsSync(path32.join(cwd, "yarn.lock")) ? "yarn" : fs34.existsSync(path32.join(cwd, "bun.lockb")) ? "bun" : "npm";
+    const pm = fs35.existsSync(path33.join(cwd, "pnpm-lock.yaml")) ? "pnpm" : fs35.existsSync(path33.join(cwd, "yarn.lock")) ? "yarn" : fs35.existsSync(path33.join(cwd, "bun.lockb")) ? "bun" : "npm";
     if (pkg.scripts?.dev) out.devCommand = `${pm} dev`;
     if (allDeps.next || allDeps.nuxt) out.devPort = 3e3;
     else if (allDeps.vite) out.devPort = 5173;
@@ -12970,8 +12970,8 @@ function detectDevServer(cwd, out) {
 function scanFrontendRoutes(cwd, out) {
   const appDirs = ["src/app", "app"];
   for (const appDir of appDirs) {
-    const full = path32.join(cwd, appDir);
-    if (!fs34.existsSync(full)) continue;
+    const full = path33.join(cwd, appDir);
+    if (!fs35.existsSync(full)) continue;
     walkFrontendRoutes(full, "", out);
     break;
   }
@@ -12979,7 +12979,7 @@ function scanFrontendRoutes(cwd, out) {
 function walkFrontendRoutes(dir, prefix, out) {
   let entries;
   try {
-    entries = fs34.readdirSync(dir, { withFileTypes: true });
+    entries = fs35.readdirSync(dir, { withFileTypes: true });
   } catch {
     return;
   }
@@ -12996,7 +12996,7 @@ function walkFrontendRoutes(dir, prefix, out) {
     if (entry.name === "node_modules" || entry.name === ".next") continue;
     let segment = entry.name;
     if (segment.startsWith("(") && segment.endsWith(")")) {
-      walkFrontendRoutes(path32.join(dir, entry.name), prefix, out);
+      walkFrontendRoutes(path33.join(dir, entry.name), prefix, out);
       continue;
     }
     if (segment.startsWith("[[") && segment.endsWith("]]")) {
@@ -13004,7 +13004,7 @@ function walkFrontendRoutes(dir, prefix, out) {
     } else if (segment.startsWith("[") && segment.endsWith("]")) {
       segment = `:${segment.slice(1, -1)}`;
     }
-    walkFrontendRoutes(path32.join(dir, entry.name), `${prefix}/${segment}`, out);
+    walkFrontendRoutes(path33.join(dir, entry.name), `${prefix}/${segment}`, out);
   }
 }
 function detectAuthFiles(cwd, out) {
@@ -13021,23 +13021,23 @@ function detectAuthFiles(cwd, out) {
     "src/app/api/oauth"
   ];
   for (const c of candidates) {
-    if (fs34.existsSync(path32.join(cwd, c))) out.authFiles.push(c);
+    if (fs35.existsSync(path33.join(cwd, c))) out.authFiles.push(c);
   }
 }
 function detectRoles(cwd, out) {
   const rolePaths = ["src/types", "src/lib", "src/utils", "src/constants", "src/access", "src/collections"];
   for (const rp of rolePaths) {
-    const dir = path32.join(cwd, rp);
-    if (!fs34.existsSync(dir)) continue;
+    const dir = path33.join(cwd, rp);
+    if (!fs35.existsSync(dir)) continue;
     let files;
     try {
-      files = fs34.readdirSync(dir).filter((f) => f.endsWith(".ts") || f.endsWith(".tsx"));
+      files = fs35.readdirSync(dir).filter((f) => f.endsWith(".ts") || f.endsWith(".tsx"));
     } catch {
       continue;
     }
     for (const f of files) {
       try {
-        const content = fs34.readFileSync(path32.join(dir, f), "utf-8").slice(0, 5e3);
+        const content = fs35.readFileSync(path33.join(dir, f), "utf-8").slice(0, 5e3);
         const roleMatches = content.match(/(?:role|Role|ROLE)\s*[=:]\s*['"](\w+)['"]/g);
         if (roleMatches) {
           for (const m of roleMatches) {
@@ -13524,7 +13524,7 @@ var init_triggerDispatcher = __esm({
 });
 
 // src/goal/policyResolver.ts
-import { createHash as createHash4 } from "crypto";
+import { createHash as createHash5 } from "crypto";
 function resolveDispatchPolicy(input) {
   const operation = input.catalog.operations.get(input.owner.definition.operationId);
   if (!operation) throw new Error(`Dispatch blocked: Operation "${input.owner.definition.operationId}" is unresolved`);
@@ -13542,7 +13542,7 @@ function resolveDispatchPolicy(input) {
   const snapshotValue = { policy, constraints };
   return {
     snapshot: {
-      hash: createHash4("sha256").update(stableJson(snapshotValue)).digest("hex"),
+      hash: createHash5("sha256").update(stableJson(snapshotValue)).digest("hex"),
       ...snapshotValue
     },
     operation,
@@ -14992,15 +14992,15 @@ var init_fixFlow = __esm({
 });
 
 // src/workflow-template.ts
-import * as fs35 from "fs";
-import * as path33 from "path";
+import * as fs36 from "fs";
+import * as path34 from "path";
 import { fileURLToPath } from "url";
 function loadKodyWorkflowTemplate() {
-  const here = path33.dirname(fileURLToPath(import.meta.url));
-  const candidates = [path33.resolve(here, "../templates/kody.yml"), path33.resolve(here, "../../templates/kody.yml")];
-  const source = candidates.find((candidate) => fs35.existsSync(candidate));
+  const here = path34.dirname(fileURLToPath(import.meta.url));
+  const candidates = [path34.resolve(here, "../templates/kody.yml"), path34.resolve(here, "../../templates/kody.yml")];
+  const source = candidates.find((candidate) => fs36.existsSync(candidate));
   if (!source) throw new Error(`Kody workflow template is missing: ${KODY_WORKFLOW_TEMPLATE_PATH}`);
-  return fs35.readFileSync(source, "utf8");
+  return fs36.readFileSync(source, "utf8");
 }
 var KODY_WORKFLOW_TEMPLATE_PATH;
 var init_workflow_template = __esm({
@@ -15012,12 +15012,12 @@ var init_workflow_template = __esm({
 
 // src/scripts/initFlow.ts
 import { execFileSync as execFileSync14 } from "child_process";
-import * as fs36 from "fs";
-import * as path34 from "path";
+import * as fs37 from "fs";
+import * as path35 from "path";
 function detectPackageManager(cwd) {
-  if (fs36.existsSync(path34.join(cwd, "pnpm-lock.yaml"))) return "pnpm";
-  if (fs36.existsSync(path34.join(cwd, "yarn.lock"))) return "yarn";
-  if (fs36.existsSync(path34.join(cwd, "bun.lockb"))) return "bun";
+  if (fs37.existsSync(path35.join(cwd, "pnpm-lock.yaml"))) return "pnpm";
+  if (fs37.existsSync(path35.join(cwd, "yarn.lock"))) return "yarn";
+  if (fs37.existsSync(path35.join(cwd, "bun.lockb"))) return "bun";
   return "npm";
 }
 function qualityCommandsFor(pm) {
@@ -15089,22 +15089,22 @@ function performInit(cwd, force) {
   const pm = detectPackageManager(cwd);
   const ownerRepo = detectOwnerRepo(cwd);
   const defaultBranch = defaultBranchFromGit(cwd);
-  const configPath = path34.join(cwd, "kody.config.json");
-  if (fs36.existsSync(configPath) && !force) {
+  const configPath = path35.join(cwd, "kody.config.json");
+  if (fs37.existsSync(configPath) && !force) {
     skipped.push("kody.config.json");
   } else {
     const cfg = makeConfig(pm, ownerRepo, defaultBranch);
-    fs36.writeFileSync(configPath, `${JSON.stringify(cfg, null, 2)}
+    fs37.writeFileSync(configPath, `${JSON.stringify(cfg, null, 2)}
 `);
     wrote.push("kody.config.json");
   }
-  const workflowDir = path34.join(cwd, ".github", "workflows");
-  const workflowPath = path34.join(workflowDir, "kody.yml");
-  if (fs36.existsSync(workflowPath) && !force) {
+  const workflowDir = path35.join(cwd, ".github", "workflows");
+  const workflowPath = path35.join(workflowDir, "kody.yml");
+  if (fs37.existsSync(workflowPath) && !force) {
     skipped.push(".github/workflows/kody.yml");
   } else {
-    fs36.mkdirSync(workflowDir, { recursive: true });
-    fs36.writeFileSync(workflowPath, loadKodyWorkflowTemplate());
+    fs37.mkdirSync(workflowDir, { recursive: true });
+    fs37.writeFileSync(workflowPath, loadKodyWorkflowTemplate());
     wrote.push(".github/workflows/kody.yml");
   }
   for (const exe of listRuntimeProfilesForCwd(cwd)) {
@@ -15115,12 +15115,12 @@ function performInit(cwd, force) {
       continue;
     }
     if (profile.kind !== "scheduled" || !profile.schedule) continue;
-    const target = path34.join(workflowDir, `kody-${exe.name}.yml`);
-    if (fs36.existsSync(target) && !force) {
+    const target = path35.join(workflowDir, `kody-${exe.name}.yml`);
+    if (fs37.existsSync(target) && !force) {
       skipped.push(`.github/workflows/kody-${exe.name}.yml`);
       continue;
     }
-    fs36.writeFileSync(target, renderScheduledWorkflow(exe.name, profile.schedule));
+    fs37.writeFileSync(target, renderScheduledWorkflow(exe.name, profile.schedule));
     wrote.push(`.github/workflows/kody-${exe.name}.yml`);
   }
   let labels;
@@ -15208,7 +15208,7 @@ Nothing to do. All files already present. (Use --force to overwrite.)
 });
 
 // src/scripts/loadAgentAdhoc.ts
-import * as fs37 from "fs";
+import * as fs38 from "fs";
 function resolveMessage(messageArg) {
   const fromComment = readCommentBody();
   if (fromComment) return stripDirective(fromComment);
@@ -15216,9 +15216,9 @@ function resolveMessage(messageArg) {
 }
 function readCommentBody() {
   const eventPath = process.env.GITHUB_EVENT_PATH;
-  if (!eventPath || !fs37.existsSync(eventPath)) return "";
+  if (!eventPath || !fs38.existsSync(eventPath)) return "";
   try {
-    const event = JSON.parse(fs37.readFileSync(eventPath, "utf-8"));
+    const event = JSON.parse(fs38.readFileSync(eventPath, "utf-8"));
     return String(event.comment?.body ?? "");
   } catch {
     return "";
@@ -15272,10 +15272,10 @@ var init_loadAgentAdhoc = __esm({
         throw new Error("loadAgentAdhoc: ctx.args.agent must be a non-empty slug");
       }
       const agentPath = resolveAgentFile(ctx.cwd, agentSlug, agentsDir);
-      if (!fs37.existsSync(agentPath)) {
+      if (!fs38.existsSync(agentPath)) {
         throw new Error(`loadAgentAdhoc: agent identity not found: ${agentPath}`);
       }
-      const { title, body } = parseAgentFile(fs37.readFileSync(agentPath, "utf-8"), agentSlug);
+      const { title, body } = parseAgentFile(fs38.readFileSync(agentPath, "utf-8"), agentSlug);
       const message = resolveMessage(ctx.args.message);
       if (!message) {
         throw new Error(
@@ -15345,7 +15345,7 @@ var init_loadCapabilityState = __esm({
 
 // src/companyIntent.ts
 function isCompanyIntentId(value) {
-  return SLUG_RE.test(value);
+  return SLUG_RE2.test(value);
 }
 function normalizeCompanyIntent(path52, raw) {
   if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
@@ -15459,14 +15459,14 @@ function normalizeAutomationPolicy(raw) {
     requiresHumanFor: stringArray2(raw?.requiresHumanFor)
   };
 }
-var SLUG_RE;
+var SLUG_RE2;
 var init_companyIntent = __esm({
   "src/companyIntent.ts"() {
     "use strict";
     init_state2();
     init_stateStore();
     init_state_backend();
-    SLUG_RE = /^[a-z][a-z0-9-]{0,63}$/;
+    SLUG_RE2 = /^[a-z][a-z0-9-]{0,63}$/;
   }
 });
 
@@ -15644,8 +15644,8 @@ var init_loadIssueStateComment = __esm({
 });
 
 // src/scripts/loadJobFromFile.ts
-import * as fs38 from "fs";
-import * as path35 from "path";
+import * as fs39 from "fs";
+import * as path36 from "path";
 function parseJobFile(raw, slug) {
   let stripped = raw;
   if (stripped.startsWith("---\n")) {
@@ -15684,10 +15684,10 @@ var init_loadJobFromFile = __esm({
       if (!slug) {
         throw new Error(`loadJobFromFile: ctx.args.${slugArg} must be a non-empty slug`);
       }
-      const capability = resolveCapabilityFolder(slug, path35.resolve(ctx.cwd, jobsDir));
+      const capability = resolveCapabilityFolder(slug, path36.resolve(ctx.cwd, jobsDir));
       if (!capability) {
         throw new Error(
-          `loadJobFromFile: capability folder not found or incomplete: ${path35.resolve(ctx.cwd, jobsDir, slug)}`
+          `loadJobFromFile: capability folder not found or incomplete: ${path36.resolve(ctx.cwd, jobsDir, slug)}`
         );
       }
       const { title, body, config } = capability;
@@ -15697,12 +15697,12 @@ var init_loadJobFromFile = __esm({
       let agentIdentity = "";
       if (agentSlug) {
         const agentPath = resolveAgentFile(ctx.cwd, agentSlug, agentsDir);
-        if (!fs38.existsSync(agentPath)) {
+        if (!fs39.existsSync(agentPath)) {
           throw new Error(
             `loadJobFromFile: capability '${slug}' declares agent '${agentSlug}' but ${agentPath} does not exist`
           );
         }
-        const agentRaw = fs38.readFileSync(agentPath, "utf-8");
+        const agentRaw = fs39.readFileSync(agentPath, "utf-8");
         const parsed = parseJobFile(agentRaw, agentSlug);
         agentTitle = parsed.title;
         agentIdentity = parsed.body;
@@ -15782,13 +15782,13 @@ ${truncate2(issue2.body, FINDING_BODY_MAX_BYTES)}`;
 });
 
 // src/scripts/kodyVariables.ts
-import * as fs39 from "fs";
-import * as path36 from "path";
+import * as fs40 from "fs";
+import * as path37 from "path";
 function readKodyVariables(cwd) {
-  const full = path36.join(cwd, KODY_VARIABLES_REL_PATH);
+  const full = path37.join(cwd, KODY_VARIABLES_REL_PATH);
   let raw;
   try {
-    raw = fs39.readFileSync(full, "utf-8");
+    raw = fs40.readFileSync(full, "utf-8");
   } catch {
     return {};
   }
@@ -15813,9 +15813,9 @@ var init_kodyVariables = __esm({
 });
 
 // src/backendVault.ts
-import { createDecipheriv, createHash as createHash5 } from "crypto";
+import { createDecipheriv, createHash as createHash6 } from "crypto";
 function cacheKey(owner, repo, masterKey) {
-  const keyHash = createHash5("sha256").update(masterKey).digest("hex").slice(0, 16);
+  const keyHash = createHash6("sha256").update(masterKey).digest("hex").slice(0, 16);
   return `${owner}/${repo}:${keyHash}`.toLowerCase();
 }
 function decryptVault(payload, masterKey) {
@@ -15964,8 +15964,8 @@ var init_runtimeSecrets = __esm({
 });
 
 // src/scripts/loadQaContext.ts
-import * as fs40 from "fs";
-import * as path37 from "path";
+import * as fs41 from "fs";
+import * as path38 from "path";
 function parseSlugList(value) {
   const inner = value.startsWith("[") && value.endsWith("]") ? value.slice(1, -1) : value;
   return inner.split(",").map(
@@ -15994,18 +15994,18 @@ function readProfileAgents(raw) {
   return { agent: agent ?? legacy ?? ["kody"], body };
 }
 function readProfile(cwd) {
-  const dir = path37.join(cwd, CONTEXT_DIR_REL_PATH);
-  if (!fs40.existsSync(dir)) return "";
+  const dir = path38.join(cwd, CONTEXT_DIR_REL_PATH);
+  if (!fs41.existsSync(dir)) return "";
   let entries;
   try {
-    entries = fs40.readdirSync(dir).filter((f) => f.endsWith(".md")).sort();
+    entries = fs41.readdirSync(dir).filter((f) => f.endsWith(".md")).sort();
   } catch {
     return "";
   }
   const blocks = [];
   for (const file of entries) {
     try {
-      const raw = fs40.readFileSync(path37.join(dir, file), "utf-8");
+      const raw = fs41.readFileSync(path38.join(dir, file), "utf-8");
       const { agent, body } = readProfileAgents(raw);
       if (!agent.includes(QA_AGENT) && !agent.includes(ALL_AGENTS)) continue;
       blocks.push(`## ${file}
@@ -16054,8 +16054,8 @@ var init_loadQaContext = __esm({
 });
 
 // src/taskContext.ts
-import * as fs41 from "fs";
-import * as path38 from "path";
+import * as fs42 from "fs";
+import * as path39 from "path";
 function buildTaskContext(args) {
   return {
     schemaVersion: TASK_CONTEXT_SCHEMA_VERSION,
@@ -16071,9 +16071,9 @@ function buildTaskContext(args) {
 function persistTaskContext(cwd, ctx) {
   try {
     const dir = runtimeStatePath(cwd, "agent-runs", ctx.runId);
-    fs41.mkdirSync(dir, { recursive: true });
-    const file = path38.join(dir, "task-context.json");
-    fs41.writeFileSync(file, `${JSON.stringify(ctx, null, 2)}
+    fs42.mkdirSync(dir, { recursive: true });
+    const file = path39.join(dir, "task-context.json");
+    fs42.writeFileSync(file, `${JSON.stringify(ctx, null, 2)}
 `);
     return file;
   } catch (err) {
@@ -16464,7 +16464,7 @@ var init_notifyTerminal = __esm({
 });
 
 // src/scripts/openAgencyModelReviewPr.ts
-import { createHash as createHash6 } from "crypto";
+import { createHash as createHash7 } from "crypto";
 function parseAgencyModelProposal(raw) {
   const text2 = raw.trim();
   const jsonText = (text2.match(/^```(?:json)?\s*\n([\s\S]*?)\n```$/i)?.[1] ?? text2).trim();
@@ -16516,7 +16516,7 @@ function normalizeBundleFiles(bundle) {
   });
 }
 function buildProposalId(issueNumber, bundle, sourceLabel) {
-  const digest = createHash6("sha256").update(JSON.stringify({ issueNumber, sourceLabel, title: bundle.title, files: normalizeBundleFiles(bundle) })).digest("hex").slice(0, 16);
+  const digest = createHash7("sha256").update(JSON.stringify({ issueNumber, sourceLabel, title: bundle.title, files: normalizeBundleFiles(bundle) })).digest("hex").slice(0, 16);
   return `issue-${issueNumber}-${digest}`;
 }
 function isDryRun(ctx) {
@@ -17456,9 +17456,9 @@ var init_postResearchComment = __esm({
 });
 
 // src/scripts/prepareBrowserAuth.ts
-import * as fs42 from "fs";
+import * as fs43 from "fs";
 import * as os6 from "os";
-import * as path39 from "path";
+import * as path40 from "path";
 function appendAuthMessage(ctx, message) {
   const current = typeof ctx.data.qaAuthBlock === "string" ? ctx.data.qaAuthBlock.trim() : "";
   ctx.data.qaAuthBlock = current ? `${current}
@@ -17497,9 +17497,9 @@ async function githubJson(url, token) {
   return await response.json();
 }
 function writeKodyStorageState(input) {
-  const directory = fs42.mkdtempSync(path39.join(os6.tmpdir(), "kody-browser-auth-"));
-  fs42.chmodSync(directory, 448);
-  const file = path39.join(directory, "storage-state.json");
+  const directory = fs43.mkdtempSync(path40.join(os6.tmpdir(), "kody-browser-auth-"));
+  fs43.chmodSync(directory, 448);
+  const file = path40.join(directory, "storage-state.json");
   const now = Date.now();
   const repoEntry = {
     repoUrl: input.repoUrl,
@@ -17529,7 +17529,7 @@ function writeKodyStorageState(input) {
       }
     ]
   };
-  fs42.writeFileSync(file, JSON.stringify(storageState), { mode: 384 });
+  fs43.writeFileSync(file, JSON.stringify(storageState), { mode: 384 });
   return { directory, file };
 }
 function configurePlaywright(profile, storageStatePath) {
@@ -17611,7 +17611,7 @@ async function prepareMethod(ctx, profile, method) {
     configurePlaywright(profile, state.file);
     const authDirectory = state.directory;
     registerRuntimeCleanup(ctx, () => {
-      fs42.rmSync(authDirectory, { recursive: true, force: true });
+      fs43.rmSync(authDirectory, { recursive: true, force: true });
     });
     appendAuthMessage(
       ctx,
@@ -17619,7 +17619,7 @@ async function prepareMethod(ctx, profile, method) {
     );
     return true;
   } catch (error) {
-    if (state) fs42.rmSync(state.directory, { recursive: true, force: true });
+    if (state) fs43.rmSync(state.directory, { recursive: true, force: true });
     const reason = error instanceof Error ? error.message : String(error);
     appendAuthMessage(
       ctx,
@@ -18588,9 +18588,9 @@ var init_runFlow = __esm({
 });
 
 // src/scripts/previewBuildHelpers.ts
-import { createDecipheriv as createDecipheriv2, createHash as createHash7, hkdfSync as hkdfSync2 } from "crypto";
+import { createDecipheriv as createDecipheriv2, createHash as createHash8, hkdfSync as hkdfSync2 } from "crypto";
 function shortHash(s) {
-  return createHash7("sha256").update(s).digest("hex").slice(0, 6);
+  return createHash8("sha256").update(s).digest("hex").slice(0, 6);
 }
 function previewAppName(repo, pr) {
   const [owner, name] = repo.split("/");
@@ -18623,7 +18623,7 @@ function formatPreviewComment(args) {
   ].join("\n");
 }
 function defaultImageTag(repo, ref) {
-  return createHash7("sha256").update(`${repo}@${ref}`).digest("hex").slice(0, 12);
+  return createHash8("sha256").update(`${repo}@${ref}`).digest("hex").slice(0, 12);
 }
 var init_previewBuildHelpers = __esm({
   "src/scripts/previewBuildHelpers.ts"() {
@@ -18718,12 +18718,12 @@ fi
 
 // src/scripts/runPreviewBuild.ts
 import { copyFile, writeFile } from "fs/promises";
-import * as path40 from "path";
+import * as path41 from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 function bundledDockerfilePath(mode) {
-  const here = path40.dirname(fileURLToPath2(import.meta.url));
+  const here = path41.dirname(fileURLToPath2(import.meta.url));
   const file = mode === "dev" ? "default-Dockerfile.preview.dev" : "default-Dockerfile.preview.prod";
-  return path40.join(here, "preview-build-templates", file);
+  return path41.join(here, "preview-build-templates", file);
 }
 function required(name) {
   const v = (process.env[name] ?? "").trim();
@@ -18958,10 +18958,10 @@ var init_runPreviewBuild = __esm({
         console.log(`[preview-build] vault: ${Object.keys(buildEnv).length} secrets, mode=${buildMode}`);
         if (Object.keys(buildEnv).length > 0) {
           const lines = Object.entries(buildEnv).map(([k, v]) => `${k}=${JSON.stringify(v)}`);
-          await writeFile(path40.join(ctx.cwd, ".env.production.local"), `${lines.join("\n")}
+          await writeFile(path41.join(ctx.cwd, ".env.production.local"), `${lines.join("\n")}
 `, "utf8");
         }
-        const consumerDockerfile = path40.join(ctx.cwd, "Dockerfile.preview");
+        const consumerDockerfile = path41.join(ctx.cwd, "Dockerfile.preview");
         const { stat } = await import("fs/promises");
         let hasConsumerDockerfile = false;
         try {
@@ -19145,8 +19145,8 @@ var init_tickShellRunner = __esm({
 });
 
 // src/scripts/runScheduledImplementationTick.ts
-import * as fs43 from "fs";
-import * as path41 from "path";
+import * as fs44 from "fs";
+import * as path42 from "path";
 var runScheduledImplementationTick;
 var init_runScheduledImplementationTick = __esm({
   "src/scripts/runScheduledImplementationTick.ts"() {
@@ -19167,14 +19167,14 @@ var init_runScheduledImplementationTick = __esm({
         ctx.output.reason = `runScheduledImplementationTick: args.slug or ctx.args.${slugArg} must be non-empty capability slug`;
         return;
       }
-      const capability = resolveCapabilityFolder(slug, path41.resolve(ctx.cwd, jobsDir));
+      const capability = resolveCapabilityFolder(slug, path42.resolve(ctx.cwd, jobsDir));
       if (!capability) {
         ctx.output.exitCode = 99;
         ctx.output.reason = `runScheduledImplementationTick: capability folder not found or incomplete: ${slug} (searched ${jobsDir} and company store)`;
         return;
       }
-      const shellPath = path41.join(profile.dir, shell);
-      if (!fs43.existsSync(shellPath)) {
+      const shellPath = path42.join(profile.dir, shell);
+      if (!fs44.existsSync(shellPath)) {
         ctx.output.exitCode = 99;
         ctx.output.reason = `runScheduledImplementationTick: shell not found: ${shell} (looked in ${profile.dir})`;
         return;
@@ -19205,8 +19205,8 @@ var init_runScheduledImplementationTick = __esm({
 });
 
 // src/scripts/runTickScript.ts
-import * as fs44 from "fs";
-import * as path42 from "path";
+import * as fs45 from "fs";
+import * as path43 from "path";
 var runTickScript;
 var init_runTickScript = __esm({
   "src/scripts/runTickScript.ts"() {
@@ -19226,10 +19226,10 @@ var init_runTickScript = __esm({
         ctx.output.reason = `runTickScript: ctx.args.${slugArg} must be a non-empty slug`;
         return;
       }
-      const capability = readCapabilityFolder(path42.resolve(ctx.cwd, jobsDir), slug);
+      const capability = readCapabilityFolder(path43.resolve(ctx.cwd, jobsDir), slug);
       if (!capability) {
         ctx.output.exitCode = 99;
-        ctx.output.reason = `runTickScript: capability folder not found or incomplete: ${path42.resolve(ctx.cwd, jobsDir, slug)}`;
+        ctx.output.reason = `runTickScript: capability folder not found or incomplete: ${path43.resolve(ctx.cwd, jobsDir, slug)}`;
         return;
       }
       const tickScript = capability.config.tickScript;
@@ -19238,8 +19238,8 @@ var init_runTickScript = __esm({
         ctx.output.reason = `runTickScript: capability ${slug} has no \`tickScript\` in profile.json \u2014 route via capability-tick instead`;
         return;
       }
-      const scriptPath = path42.isAbsolute(tickScript) ? tickScript : path42.join(ctx.cwd, tickScript);
-      if (!fs44.existsSync(scriptPath)) {
+      const scriptPath = path43.isAbsolute(tickScript) ? tickScript : path43.join(ctx.cwd, tickScript);
+      if (!fs45.existsSync(scriptPath)) {
         ctx.output.exitCode = 99;
         ctx.output.reason = `runTickScript: tickScript not found: ${scriptPath}`;
         return;
@@ -19521,7 +19521,7 @@ var init_syncFlow = __esm({
 });
 
 // src/scripts/validateAgencyModelProposal.ts
-import * as path43 from "path";
+import * as path44 from "path";
 function validateModelBundle(bundle, expectedKind, options = {}) {
   const failures = [];
   validateOneModel(bundle.model, bundle.files, "model", true, failures, expectedKind, options);
@@ -19847,7 +19847,7 @@ var init_validateAgencyModelProposal = __esm({
       const bundle = parseAgencyModelProposal(raw);
       const expectedKind = readExpectedModelKind(args);
       const failures = validateModelBundle(bundle, expectedKind, {
-        capabilityRoot: path43.join(ctx.cwd, ".kody", "capabilities")
+        capabilityRoot: path44.join(ctx.cwd, ".kody", "capabilities")
       });
       if (failures.length > 0) {
         throw new Error(`validateAgencyModelProposal: ${failures.join("; ")}`);
@@ -20398,7 +20398,7 @@ var init_warmupMcp = __esm({
 });
 
 // src/scripts/writeAgentRunSummary.ts
-import * as fs45 from "fs";
+import * as fs46 from "fs";
 var writeAgentRunSummary;
 var init_writeAgentRunSummary = __esm({
   "src/scripts/writeAgentRunSummary.ts"() {
@@ -20424,7 +20424,7 @@ var init_writeAgentRunSummary = __esm({
       if (reason) lines.push(`- **Reason:** ${reason}`);
       lines.push("");
       try {
-        fs45.appendFileSync(summaryPath, `${lines.join("\n")}
+        fs46.appendFileSync(summaryPath, `${lines.join("\n")}
 `);
       } catch {
       }
@@ -20752,17 +20752,17 @@ var init_scripts = __esm({
 });
 
 // src/stateWorkspace.ts
-import * as fs46 from "fs";
-import * as path44 from "path";
+import * as fs47 from "fs";
+import * as path45 from "path";
 function tenantId(config) {
   const owner = config.github?.owner?.trim() || process.env.GITHUB_REPOSITORY?.split("/")[0]?.trim();
   const repo = config.github?.repo?.trim() || process.env.GITHUB_REPOSITORY?.split("/")[1]?.trim();
   return owner && repo ? `${owner}/${repo}` : null;
 }
 function writeRuntimeFile(cwd, relativePath, content) {
-  const target = path44.join(cwd, RUNTIME_ROOT, relativePath);
-  fs46.mkdirSync(path44.dirname(target), { recursive: true });
-  fs46.writeFileSync(target, content, "utf8");
+  const target = path45.join(cwd, RUNTIME_ROOT, relativePath);
+  fs47.mkdirSync(path45.dirname(target), { recursive: true });
+  fs47.writeFileSync(target, content, "utf8");
 }
 function record(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : null;
@@ -20827,11 +20827,11 @@ async function hydrateStateWorkspace(config, cwd, backendOverride) {
       throw new Error("Kody backend access is required for runtime workspace documents");
     return;
   }
-  const key = `${path44.resolve(cwd)}|${tenant}`;
+  const key = `${path45.resolve(cwd)}|${tenant}`;
   if (hydratedWorkspaces.has(key)) return;
   const backend = backendOverride ?? createStateBackendFromEnv();
-  const root = path44.join(cwd, RUNTIME_ROOT);
-  fs46.rmSync(root, { recursive: true, force: true });
+  const root = path45.join(cwd, RUNTIME_ROOT);
+  fs47.rmSync(root, { recursive: true, force: true });
   await Promise.all([
     hydratePrefix(backend, tenant, cwd, "context:"),
     hydratePrefix(backend, tenant, cwd, "memory:"),
@@ -20847,7 +20847,7 @@ var init_stateWorkspace = __esm({
   "src/stateWorkspace.ts"() {
     "use strict";
     init_state_backend();
-    RUNTIME_ROOT = path44.join(".kody-engine", "runtime");
+    RUNTIME_ROOT = path45.join(".kody-engine", "runtime");
     hydratedWorkspaces = /* @__PURE__ */ new Set();
   }
 });
@@ -20918,9 +20918,9 @@ var init_tools = __esm({
 
 // src/executor.ts
 import { spawn as spawn8 } from "child_process";
-import * as fs47 from "fs";
+import * as fs48 from "fs";
 import * as os7 from "os";
-import * as path45 from "path";
+import * as path46 from "path";
 function isMutatingPostflight(scriptName) {
   return MUTATING_POSTFLIGHTS.has(scriptName ?? "");
 }
@@ -21161,7 +21161,7 @@ async function runImplementation(profileName, input) {
   const jobWhyBlock = typeof ctx.data.jobWhy === "string" ? operatorRequestBlock(ctx.data.jobWhy) : null;
   const jobRefBlock = jobReferenceBlock(profileName, profile, ctx.data);
   const invokeAgent = async (prompt) => {
-    const externalPlugins = (profile.claudeCode.plugins ?? []).map((p) => path45.isAbsolute(p) ? p : path45.resolve(profile.dir, p)).filter((p) => p.length > 0);
+    const externalPlugins = (profile.claudeCode.plugins ?? []).map((p) => path46.isAbsolute(p) ? p : path46.resolve(profile.dir, p)).filter((p) => p.length > 0);
     const syntheticPath = ctx.data.syntheticPluginPath;
     const pluginPaths = [...externalPlugins, ...syntheticPath ? [syntheticPath] : []];
     const agents = loadSubagents(profile);
@@ -21623,17 +21623,17 @@ function clearStampedLifecycleLabels(profile, ctx) {
 function resolveProfilePath(profileName, cwd = process.cwd()) {
   const found = resolveImplementation(profileName, getRuntimeProfileRootsForCwd(cwd));
   if (found) return found;
-  const here = path45.dirname(new URL(import.meta.url).pathname);
+  const here = path46.dirname(new URL(import.meta.url).pathname);
   const candidates = [
-    path45.join(here, "implementations", profileName, "profile.json"),
+    path46.join(here, "implementations", profileName, "profile.json"),
     // same-dir sibling (dev)
-    path45.join(here, "..", "implementations", profileName, "profile.json"),
+    path46.join(here, "..", "implementations", profileName, "profile.json"),
     // up one (prod: dist/bin → dist/implementations)
-    path45.join(here, "..", "src", "implementations", profileName, "profile.json")
+    path46.join(here, "..", "src", "implementations", profileName, "profile.json")
     // fallback
   ];
   for (const c of candidates) {
-    if (fs47.existsSync(c)) return c;
+    if (fs48.existsSync(c)) return c;
   }
   return candidates[0];
 }
@@ -21748,15 +21748,15 @@ function resolveShellTimeoutMs(entry) {
 }
 async function runShellEntry(entry, ctx, profile) {
   const shellName = entry.shell;
-  const shellPath = path45.join(profile.dir, shellName);
-  if (!fs47.existsSync(shellPath)) {
+  const shellPath = path46.join(profile.dir, shellName);
+  if (!fs48.existsSync(shellPath)) {
     ctx.skipAgent = true;
     ctx.output.exitCode = 99;
     ctx.output.reason = `shell script not found: ${shellName} (looked in ${profile.dir})`;
     return;
   }
   const positional = entry.with ? Object.values(entry.with).map((v) => String(v)) : [];
-  const outputFile = path45.join(
+  const outputFile = path46.join(
     os7.tmpdir(),
     `kody-shell-output-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`
   );
@@ -21828,9 +21828,9 @@ async function runShellEntry(entry, ctx, profile) {
   }
   let sideChannelText = "";
   try {
-    if (fs47.existsSync(outputFile)) {
-      sideChannelText = fs47.readFileSync(outputFile, "utf-8");
-      fs47.rmSync(outputFile, { force: true });
+    if (fs48.existsSync(outputFile)) {
+      sideChannelText = fs48.readFileSync(outputFile, "utf-8");
+      fs48.rmSync(outputFile, { force: true });
     }
   } catch {
   }
@@ -22002,7 +22002,7 @@ __export(job_exports, {
   stableJobKey: () => stableJobKey,
   validateJob: () => validateJob
 });
-import * as path46 from "path";
+import * as path47 from "path";
 function newJobId(flavor) {
   localJobSeq += 1;
   const runId = process.env.GITHUB_RUN_ID;
@@ -22679,7 +22679,7 @@ function loadCapabilityContext(slug, cwd) {
   return resolveCapabilityFolder(slug, hydratedCapabilitiesRoot(cwd));
 }
 function hydratedCapabilitiesRoot(cwd) {
-  return path46.join(cwd, ".kody-engine", "definitions", "capabilities");
+  return path47.join(cwd, ".kody-engine", "definitions", "capabilities");
 }
 function loadWorkflowContext(slug, base) {
   if (!slug || !isWorkflowDefinitionId(slug)) return null;
@@ -22844,7 +22844,7 @@ function translateOpenAISseToBrain(opts) {
 
 // src/servers/brain-serve.ts
 import { createServer as createServer2 } from "http";
-import * as path49 from "path";
+import * as path50 from "path";
 
 // src/chat/loop.ts
 init_agent();
@@ -23884,10 +23884,142 @@ function readSession(file) {
 // src/servers/brain-serve.ts
 init_config();
 
+// src/definition-hydration.ts
+init_state_backend();
+import { createHash as createHash3 } from "crypto";
+import * as fs16 from "fs";
+import * as path17 from "path";
+var SLUG_RE = /^[a-z0-9][a-z0-9_-]{0,127}$/;
+function assertSafeDefinitionPath(filePath) {
+  const segments = filePath.split("/");
+  if (!filePath || filePath.startsWith("/") || filePath.includes("\\") || filePath.includes("\0") || segments.some((segment) => !segment || segment === "." || segment === "..")) {
+    throw new Error(`unsafe definition path: ${filePath}`);
+  }
+}
+function normalizeDefinitionBundle(bundle) {
+  if (bundle.schemaVersion !== 1) throw new Error("unsupported definition bundle schema");
+  const files = Object.fromEntries(
+    Object.entries(bundle.files).sort(([left], [right]) => left.localeCompare(right)).map(([filePath, content]) => {
+      assertSafeDefinitionPath(filePath);
+      return [filePath, content.replace(/\r\n?/g, "\n")];
+    })
+  );
+  return { schemaVersion: 1, files };
+}
+function definitionVersion(bundle) {
+  return `sha256:${createHash3("sha256").update(JSON.stringify(normalizeDefinitionBundle(bundle))).digest("hex")}`;
+}
+function verifyDefinition(definition) {
+  if (!SLUG_RE.test(definition.slug)) throw new Error(`invalid definition slug: ${definition.slug}`);
+  const bundle = normalizeDefinitionBundle(definition.bundle);
+  if (definitionVersion(bundle) !== definition.version) {
+    throw new Error(`definition version mismatch for ${definition.slug}: ${definition.version}`);
+  }
+  return bundle;
+}
+function writeBundle(root, bundle) {
+  for (const [filePath, contents] of Object.entries(bundle.files)) {
+    const target = path17.join(root, filePath);
+    fs16.mkdirSync(path17.dirname(target), { recursive: true });
+    fs16.writeFileSync(target, contents, "utf8");
+  }
+}
+function writeDefinition(root, kind, definition) {
+  const bundle = verifyDefinition(definition);
+  if (kind === "agent") {
+    const raw = bundle.files["agent.md"];
+    if (typeof raw !== "string") throw new Error(`agent definition ${definition.slug} is missing agent.md`);
+    fs16.writeFileSync(path17.join(root, "agents", `${definition.slug}.md`), raw, "utf8");
+    return;
+  }
+  if (kind === "goal") {
+    writeBundle(path17.join(root, "goals", definition.slug), bundle);
+    return;
+  }
+  if (kind === "implementation") {
+    writeBundle(path17.join(root, "implementations", definition.slug), bundle);
+    return;
+  }
+  if (kind === "asset") {
+    writeBundle(path17.join(root, "shared"), bundle);
+    return;
+  }
+  writeBundle(path17.join(root, "capabilities", definition.slug), bundle);
+}
+async function hydrateDefinitions(options) {
+  const root = path17.join(options.cwd, ".kody-engine", "definitions");
+  const staging = `${root}.tmp-${process.pid}-${Date.now()}`;
+  fs16.rmSync(staging, { recursive: true, force: true });
+  fs16.mkdirSync(path17.join(staging, "agents"), { recursive: true });
+  fs16.mkdirSync(path17.join(staging, "capabilities"), { recursive: true });
+  fs16.mkdirSync(path17.join(staging, "goals"), { recursive: true });
+  fs16.mkdirSync(path17.join(staging, "implementations"), { recursive: true });
+  fs16.mkdirSync(path17.join(staging, "shared"), { recursive: true });
+  try {
+    const [capabilities, agents, goals, implementations, assets] = await Promise.all([
+      options.backend.listDefinitions(options.tenantId, "capability"),
+      options.backend.listDefinitions(options.tenantId, "agent"),
+      options.backend.listDefinitions(options.tenantId, "goal"),
+      options.backend.listDefinitions(options.tenantId, "implementation"),
+      options.backend.listDefinitions(options.tenantId, "asset")
+    ]);
+    const versions = {};
+    for (const definition of capabilities) {
+      writeDefinition(staging, "capability", definition);
+      versions[`capability:${definition.slug}`] = definition.version;
+    }
+    for (const definition of agents) {
+      writeDefinition(staging, "agent", definition);
+      versions[`agent:${definition.slug}`] = definition.version;
+    }
+    for (const definition of goals) {
+      writeDefinition(staging, "goal", definition);
+      versions[`goal:${definition.slug}`] = definition.version;
+    }
+    for (const definition of implementations) {
+      writeDefinition(staging, "implementation", definition);
+      versions[`implementation:${definition.slug}`] = definition.version;
+    }
+    for (const definition of assets) {
+      writeDefinition(staging, "asset", definition);
+      versions[`asset:${definition.slug}`] = definition.version;
+    }
+    const manifest = {
+      schemaVersion: 1,
+      tenantId: options.tenantId,
+      hydratedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      versions: Object.fromEntries(Object.entries(versions).sort(([left], [right]) => left.localeCompare(right)))
+    };
+    fs16.writeFileSync(path17.join(staging, "manifest.json"), `${JSON.stringify(manifest, null, 2)}
+`, "utf8");
+    fs16.rmSync(root, { recursive: true, force: true });
+    fs16.renameSync(staging, root);
+    return { root, tenantId: options.tenantId, versions: manifest.versions };
+  } catch (error) {
+    fs16.rmSync(staging, { recursive: true, force: true });
+    throw error;
+  }
+}
+async function hydrateDefinitionsFromEnv(cwd = process.cwd(), env = process.env) {
+  const tenantId2 = env.GITHUB_REPOSITORY?.trim();
+  if (!hasStateBackendConfig(env)) {
+    if (env.GITHUB_ACTIONS === "true") {
+      throw new Error("GitHub Actions workflow identity is required for backend definitions");
+    }
+    return null;
+  }
+  if (!tenantId2) throw new Error("GITHUB_REPOSITORY is required for backend definitions");
+  return hydrateDefinitions({
+    cwd,
+    tenantId: tenantId2,
+    backend: createStateBackendFromEnv(env)
+  });
+}
+
 // src/kody-cli.ts
 import { execFileSync as execFileSync24 } from "child_process";
-import * as fs48 from "fs";
-import * as path47 from "path";
+import * as fs49 from "fs";
+import * as path48 from "path";
 
 // src/app-auth.ts
 import { createSign } from "crypto";
@@ -24014,7 +24146,7 @@ init_config();
 
 // src/dispatch.ts
 init_config();
-import * as fs16 from "fs";
+import * as fs17 from "fs";
 
 // src/cron-match.ts
 var FIELD_BOUNDS = [
@@ -24116,10 +24248,10 @@ function autoDispatch(opts) {
   }
   const eventName = process.env.GITHUB_EVENT_NAME;
   const eventPath = process.env.GITHUB_EVENT_PATH;
-  if (!eventName || !eventPath || !fs16.existsSync(eventPath)) return null;
+  if (!eventName || !eventPath || !fs17.existsSync(eventPath)) return null;
   let event = {};
   try {
-    event = JSON.parse(fs16.readFileSync(eventPath, "utf-8"));
+    event = JSON.parse(fs17.readFileSync(eventPath, "utf-8"));
   } catch {
     return null;
   }
@@ -24243,7 +24375,7 @@ function autoDispatchTyped(opts) {
   if (legacy) return { kind: "route", ...legacy };
   const eventName = process.env.GITHUB_EVENT_NAME;
   const eventPath = process.env.GITHUB_EVENT_PATH;
-  if (!eventName || !eventPath || !fs16.existsSync(eventPath)) {
+  if (!eventName || !eventPath || !fs17.existsSync(eventPath)) {
     return { kind: "silent", reason: "no GHA event context" };
   }
   if (eventName !== "issue_comment") {
@@ -24251,7 +24383,7 @@ function autoDispatchTyped(opts) {
   }
   let event = {};
   try {
-    event = JSON.parse(fs16.readFileSync(eventPath, "utf-8"));
+    event = JSON.parse(fs17.readFileSync(eventPath, "utf-8"));
   } catch {
     return { kind: "silent", reason: "GHA event payload unreadable" };
   }
@@ -24305,7 +24437,7 @@ function dispatchScheduledWatches(opts) {
   for (const exe of listRuntimeProfilesForCwd(opts?.cwd ?? process.cwd())) {
     let raw;
     try {
-      raw = fs16.readFileSync(exe.profilePath, "utf-8");
+      raw = fs17.readFileSync(exe.profilePath, "utf-8");
     } catch {
       continue;
     }
@@ -24700,9 +24832,9 @@ async function resolveAuthToken(env = process.env) {
   return void 0;
 }
 function detectPackageManager2(cwd) {
-  if (fs48.existsSync(path47.join(cwd, "pnpm-lock.yaml"))) return "pnpm";
-  if (fs48.existsSync(path47.join(cwd, "yarn.lock"))) return "yarn";
-  if (fs48.existsSync(path47.join(cwd, "bun.lockb"))) return "bun";
+  if (fs49.existsSync(path48.join(cwd, "pnpm-lock.yaml"))) return "pnpm";
+  if (fs49.existsSync(path48.join(cwd, "yarn.lock"))) return "yarn";
+  if (fs49.existsSync(path48.join(cwd, "bun.lockb"))) return "bun";
   return "npm";
 }
 function shouldChainScheduledWatch(match) {
@@ -24795,8 +24927,8 @@ function postFailureTail(issueNumber, cwd, reason) {
   const logPath = lastRunLogPath(cwd);
   let tail = "";
   try {
-    if (fs48.existsSync(logPath)) {
-      const content = fs48.readFileSync(logPath, "utf-8");
+    if (fs49.existsSync(logPath)) {
+      const content = fs49.readFileSync(logPath, "utf-8");
       tail = content.slice(-3e3);
     }
   } catch {
@@ -24825,7 +24957,7 @@ async function runCi(argv) {
     return 0;
   }
   const args = parseCiArgs(argv);
-  const cwd = args.cwd ? path47.resolve(args.cwd) : process.cwd();
+  const cwd = args.cwd ? path48.resolve(args.cwd) : process.cwd();
   try {
     const n = unpackAllSecrets();
     if (n > 0) process.stdout.write(`\u2192 kody: unpacked ${n} secret(s) from ALL_SECRETS
@@ -24884,9 +25016,9 @@ async function runCi(argv) {
       forceRunCliArgs = { goal: envForceMessage };
     }
   }
-  if (!args.issueNumber && !autoFallback && !forceRunAction && !runRequestFanOut && eventName === "workflow_dispatch" && dispatchEventPath && fs48.existsSync(dispatchEventPath)) {
+  if (!args.issueNumber && !autoFallback && !forceRunAction && !runRequestFanOut && eventName === "workflow_dispatch" && dispatchEventPath && fs49.existsSync(dispatchEventPath)) {
     try {
-      const evt = JSON.parse(fs48.readFileSync(dispatchEventPath, "utf-8"));
+      const evt = JSON.parse(fs49.readFileSync(dispatchEventPath, "utf-8"));
       const inputs = objectValue2(evt.inputs);
       const issueInput = parseInt(String(inputs?.issue_number ?? ""), 10);
       const sessionInput = String(inputs?.sessionId ?? "");
@@ -25293,8 +25425,8 @@ init_repoWorkspace();
 
 // src/scripts/brainTurnLog.ts
 init_runtimePaths();
-import * as fs49 from "fs";
-import * as path48 from "path";
+import * as fs50 from "fs";
+import * as path49 from "path";
 import posixPath4 from "path/posix";
 var live = /* @__PURE__ */ new Map();
 function brainEventsFilePath(dir, chatId) {
@@ -25302,8 +25434,8 @@ function brainEventsFilePath(dir, chatId) {
 }
 function lastPersistedSeq(dir, chatId) {
   const p = brainEventsFilePath(dir, chatId);
-  if (!fs49.existsSync(p)) return 0;
-  const lines = fs49.readFileSync(p, "utf-8").split("\n").filter(Boolean);
+  if (!fs50.existsSync(p)) return 0;
+  const lines = fs50.readFileSync(p, "utf-8").split("\n").filter(Boolean);
   if (lines.length === 0) return 0;
   try {
     return JSON.parse(lines[lines.length - 1]).seq || 0;
@@ -25313,9 +25445,9 @@ function lastPersistedSeq(dir, chatId) {
 }
 function readSince(dir, chatId, since) {
   const p = brainEventsFilePath(dir, chatId);
-  if (!fs49.existsSync(p)) return [];
+  if (!fs50.existsSync(p)) return [];
   const out = [];
-  for (const line of fs49.readFileSync(p, "utf-8").split("\n")) {
+  for (const line of fs50.readFileSync(p, "utf-8").split("\n")) {
     if (!line) continue;
     try {
       const rec = JSON.parse(line);
@@ -25341,12 +25473,12 @@ function beginTurn(dir, chatId) {
   };
   live.set(chatId, state);
   const p = brainEventsFilePath(dir, chatId);
-  fs49.mkdirSync(path48.dirname(p), { recursive: true });
+  fs50.mkdirSync(path49.dirname(p), { recursive: true });
   return (event) => {
     state.seq += 1;
     const rec = { seq: state.seq, turn, ts: Date.now(), event };
     try {
-      fs49.appendFileSync(p, `${JSON.stringify(rec)}
+      fs50.appendFileSync(p, `${JSON.stringify(rec)}
 `);
     } catch (err) {
       process.stderr.write(
@@ -25385,7 +25517,7 @@ function endTurnIfUnterminated(dir, chatId, errMessage) {
     event: { type: "error", error: errMessage || "turn ended unexpectedly", chatId }
   };
   try {
-    fs49.appendFileSync(brainEventsFilePath(dir, chatId), `${JSON.stringify(rec)}
+    fs50.appendFileSync(brainEventsFilePath(dir, chatId), `${JSON.stringify(rec)}
 `);
   } catch {
   }
@@ -25590,6 +25722,25 @@ var BrokerSink = class {
 function hasStateBackendConfig2(env = process.env) {
   return Boolean(env.CONVEX_URL?.trim() && env.KODY_SERVICE_KEY?.trim());
 }
+var definitionHydrations = /* @__PURE__ */ new Map();
+async function hydrateBrainDefinitions(options) {
+  const env = options.env ?? process.env;
+  if (!options.repo || !hasStateBackendConfig2(env)) return;
+  const key = `${options.cwd}\0${options.repo}`;
+  const running = definitionHydrations.get(key);
+  if (running) return running;
+  const hydration = hydrateDefinitions({
+    cwd: options.cwd,
+    tenantId: options.repo,
+    backend: options.backend ?? createStateBackendFromEnv(env)
+  }).then(() => void 0).finally(() => {
+    if (definitionHydrations.get(key) === hydration) {
+      definitionHydrations.delete(key);
+    }
+  });
+  definitionHydrations.set(key, hydration);
+  return hydration;
+}
 var chatQueues = /* @__PURE__ */ new Map();
 function enqueue(chatId, fn) {
   const prev = chatQueues.get(chatId) ?? Promise.resolve();
@@ -25689,6 +25840,17 @@ async function handleChatTurn(req, res, chatId, opts) {
     res.end();
     return;
   }
+  try {
+    await hydrateBrainDefinitions({ cwd: agentCwd, repo });
+  } catch (err) {
+    emitSse(res, {
+      type: "error",
+      chatId,
+      error: `Definition hydration failed: ${err instanceof Error ? err.message : String(err)}`
+    });
+    res.end();
+    return;
+  }
   const stateToken = repoToken || envGithubToken();
   const sessionFile = sessionFilePath(agentCwd, chatId);
   const sessionStore = opts.createStore({
@@ -25748,7 +25910,7 @@ function buildServer(opts) {
   const runTurn = opts.runTurn ?? runChatTurn;
   const createStore = opts.createStore ?? createSessionStore;
   const cloneRepo = opts.cloneRepo ?? defaultCloneRepo;
-  const reposRoot = opts.reposRoot ?? path49.join(path49.dirname(path49.resolve(opts.cwd)), "repos");
+  const reposRoot = opts.reposRoot ?? path50.join(path50.dirname(path50.resolve(opts.cwd)), "repos");
   return createServer2(async (req, res) => {
     if (!req.method || !req.url) {
       sendJson(res, 400, { error: "bad request" });
@@ -26352,7 +26514,7 @@ async function loadConfigSafe() {
 }
 
 // src/chat-cli.ts
-import * as path50 from "path";
+import * as path51 from "path";
 
 // src/chat/inbox.ts
 import { execFileSync as execFileSync25 } from "child_process";
@@ -26633,7 +26795,7 @@ async function runChat(argv) {
 ${CHAT_HELP}`);
     return 64;
   }
-  const cwd = args.cwd ? path50.resolve(args.cwd) : process.cwd();
+  const cwd = args.cwd ? path51.resolve(args.cwd) : process.cwd();
   const sessionId = args.sessionId;
   const runRequest = readRunRequestFromEnv();
   if (runRequest && "request" in runRequest) {
@@ -26751,140 +26913,6 @@ ${CHAT_HELP}`);
 // src/entry.ts
 init_config();
 init_definition_paths();
-
-// src/definition-hydration.ts
-init_state_backend();
-import { createHash as createHash8 } from "crypto";
-import * as fs50 from "fs";
-import * as path51 from "path";
-var SLUG_RE2 = /^[a-z0-9][a-z0-9_-]{0,127}$/;
-function assertSafeDefinitionPath(filePath) {
-  const segments = filePath.split("/");
-  if (!filePath || filePath.startsWith("/") || filePath.includes("\\") || filePath.includes("\0") || segments.some((segment) => !segment || segment === "." || segment === "..")) {
-    throw new Error(`unsafe definition path: ${filePath}`);
-  }
-}
-function normalizeDefinitionBundle(bundle) {
-  if (bundle.schemaVersion !== 1) throw new Error("unsupported definition bundle schema");
-  const files = Object.fromEntries(
-    Object.entries(bundle.files).sort(([left], [right]) => left.localeCompare(right)).map(([filePath, content]) => {
-      assertSafeDefinitionPath(filePath);
-      return [filePath, content.replace(/\r\n?/g, "\n")];
-    })
-  );
-  return { schemaVersion: 1, files };
-}
-function definitionVersion(bundle) {
-  return `sha256:${createHash8("sha256").update(JSON.stringify(normalizeDefinitionBundle(bundle))).digest("hex")}`;
-}
-function verifyDefinition(definition) {
-  if (!SLUG_RE2.test(definition.slug)) throw new Error(`invalid definition slug: ${definition.slug}`);
-  const bundle = normalizeDefinitionBundle(definition.bundle);
-  if (definitionVersion(bundle) !== definition.version) {
-    throw new Error(`definition version mismatch for ${definition.slug}: ${definition.version}`);
-  }
-  return bundle;
-}
-function writeBundle(root, bundle) {
-  for (const [filePath, contents] of Object.entries(bundle.files)) {
-    const target = path51.join(root, filePath);
-    fs50.mkdirSync(path51.dirname(target), { recursive: true });
-    fs50.writeFileSync(target, contents, "utf8");
-  }
-}
-function writeDefinition(root, kind, definition) {
-  const bundle = verifyDefinition(definition);
-  if (kind === "agent") {
-    const raw = bundle.files["agent.md"];
-    if (typeof raw !== "string") throw new Error(`agent definition ${definition.slug} is missing agent.md`);
-    fs50.writeFileSync(path51.join(root, "agents", `${definition.slug}.md`), raw, "utf8");
-    return;
-  }
-  if (kind === "goal") {
-    writeBundle(path51.join(root, "goals", definition.slug), bundle);
-    return;
-  }
-  if (kind === "implementation") {
-    writeBundle(path51.join(root, "implementations", definition.slug), bundle);
-    return;
-  }
-  if (kind === "asset") {
-    writeBundle(path51.join(root, "shared"), bundle);
-    return;
-  }
-  writeBundle(path51.join(root, "capabilities", definition.slug), bundle);
-}
-async function hydrateDefinitions(options) {
-  const root = path51.join(options.cwd, ".kody-engine", "definitions");
-  const staging = `${root}.tmp-${process.pid}-${Date.now()}`;
-  fs50.rmSync(staging, { recursive: true, force: true });
-  fs50.mkdirSync(path51.join(staging, "agents"), { recursive: true });
-  fs50.mkdirSync(path51.join(staging, "capabilities"), { recursive: true });
-  fs50.mkdirSync(path51.join(staging, "goals"), { recursive: true });
-  fs50.mkdirSync(path51.join(staging, "implementations"), { recursive: true });
-  fs50.mkdirSync(path51.join(staging, "shared"), { recursive: true });
-  try {
-    const [capabilities, agents, goals, implementations, assets] = await Promise.all([
-      options.backend.listDefinitions(options.tenantId, "capability"),
-      options.backend.listDefinitions(options.tenantId, "agent"),
-      options.backend.listDefinitions(options.tenantId, "goal"),
-      options.backend.listDefinitions(options.tenantId, "implementation"),
-      options.backend.listDefinitions(options.tenantId, "asset")
-    ]);
-    const versions = {};
-    for (const definition of capabilities) {
-      writeDefinition(staging, "capability", definition);
-      versions[`capability:${definition.slug}`] = definition.version;
-    }
-    for (const definition of agents) {
-      writeDefinition(staging, "agent", definition);
-      versions[`agent:${definition.slug}`] = definition.version;
-    }
-    for (const definition of goals) {
-      writeDefinition(staging, "goal", definition);
-      versions[`goal:${definition.slug}`] = definition.version;
-    }
-    for (const definition of implementations) {
-      writeDefinition(staging, "implementation", definition);
-      versions[`implementation:${definition.slug}`] = definition.version;
-    }
-    for (const definition of assets) {
-      writeDefinition(staging, "asset", definition);
-      versions[`asset:${definition.slug}`] = definition.version;
-    }
-    const manifest = {
-      schemaVersion: 1,
-      tenantId: options.tenantId,
-      hydratedAt: (/* @__PURE__ */ new Date()).toISOString(),
-      versions: Object.fromEntries(Object.entries(versions).sort(([left], [right]) => left.localeCompare(right)))
-    };
-    fs50.writeFileSync(path51.join(staging, "manifest.json"), `${JSON.stringify(manifest, null, 2)}
-`, "utf8");
-    fs50.rmSync(root, { recursive: true, force: true });
-    fs50.renameSync(staging, root);
-    return { root, tenantId: options.tenantId, versions: manifest.versions };
-  } catch (error) {
-    fs50.rmSync(staging, { recursive: true, force: true });
-    throw error;
-  }
-}
-async function hydrateDefinitionsFromEnv(cwd = process.cwd(), env = process.env) {
-  const tenantId2 = env.GITHUB_REPOSITORY?.trim();
-  if (!hasStateBackendConfig(env)) {
-    if (env.GITHUB_ACTIONS === "true") {
-      throw new Error("GitHub Actions workflow identity is required for backend definitions");
-    }
-    return null;
-  }
-  if (!tenantId2) throw new Error("GITHUB_REPOSITORY is required for backend definitions");
-  return hydrateDefinitions({
-    cwd,
-    tenantId: tenantId2,
-    backend: createStateBackendFromEnv(env)
-  });
-}
-
-// src/entry.ts
 init_job();
 init_registry();
 
@@ -28433,9 +28461,10 @@ function parseArgs(argv) {
 }
 async function main(argv = process.argv.slice(2)) {
   unpackAllSecrets();
+  const args = parseArgs(argv);
   const cwdFlag = argv.indexOf("--cwd");
   const definitionCwd = cwdFlag >= 0 && argv[cwdFlag + 1] ? argv[cwdFlag + 1] : process.cwd();
-  const shouldHydrate = !hasExplicitDefinitionsRoot(definitionCwd) && (Boolean(process.env.CONVEX_URL?.trim()) || process.env.GITHUB_ACTIONS === "true" && Boolean(process.env.GITHUB_EVENT_NAME));
+  const shouldHydrate = !(args.command === "server" && args.serverName === "brain-serve") && !hasExplicitDefinitionsRoot(definitionCwd) && (Boolean(process.env.CONVEX_URL?.trim()) || process.env.GITHUB_ACTIONS === "true" && Boolean(process.env.GITHUB_EVENT_NAME));
   if (shouldHydrate) {
     try {
       await hydrateDefinitionsFromEnv(definitionCwd);
@@ -28446,7 +28475,6 @@ async function main(argv = process.argv.slice(2)) {
       return 99;
     }
   }
-  const args = parseArgs(argv);
   if (args.errors.length > 0) {
     for (const e of args.errors) process.stderr.write(`error: ${e}
 `);