@kody-ade/kody-engine 0.4.552 → 0.4.554

package/dist/bin/kody.js

@@ -15,7 +15,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@kody-ade/kody-engine",
-      version: "0.4.552",
+      version: "0.4.554",
       description: "kody \u2014 autonomous development engine. Single-session Claude Code agent behind a generic executor + declarative implementation profiles.",
       license: "MIT",
       type: "module",
@@ -668,6 +668,111 @@ var init_format = __esm({
   }
 });
 
+// src/agency/capability-contract-validation.ts
+import Ajv from "ajv";
+function validateCapabilityContractValue(boundary, schema, value) {
+  const validate = validator.compile(schema);
+  if (!validate(value)) {
+    throw new CapabilityContractValidationError(boundary, validate.errors ?? []);
+  }
+}
+function capabilityContractInput(inputs, args, capabilityId, contractProperties = []) {
+  const isGenericRunnerInput = inputs.some((input) => input.name === "input") && Object.hasOwn(args, "input");
+  if (!isGenericRunnerInput) {
+    const isParameterlessGenericRunner = (inputs.some((input) => input.name === "capability") || args.capability === capabilityId || !contractProperties.includes("capability")) && Object.hasOwn(args, "capability");
+    if (!isParameterlessGenericRunner) return args;
+    const { capability: _routingCapability, ...businessArgs } = args;
+    return businessArgs;
+  }
+  const value = args.input;
+  if (typeof value !== "string") return value;
+  try {
+    return JSON.parse(value);
+  } catch {
+    return value;
+  }
+}
+var validator, CapabilityContractValidationError;
+var init_capability_contract_validation = __esm({
+  "src/agency/capability-contract-validation.ts"() {
+    "use strict";
+    validator = new Ajv({
+      allErrors: true,
+      strict: true,
+      validateFormats: false
+    });
+    CapabilityContractValidationError = class extends Error {
+      constructor(boundary, errors) {
+        const details = errors.map((error) => {
+          const location = error.instancePath || "$";
+          const property = error.keyword === "additionalProperties" && typeof error.params.additionalProperty === "string" ? ` (${error.params.additionalProperty})` : "";
+          return `${location}: ${error.message ?? error.keyword}${property}`;
+        }).join("; ");
+        super(`Capability ${boundary} does not match its declared contract: ${details}`);
+        this.boundary = boundary;
+        this.errors = errors;
+        this.name = "CapabilityContractValidationError";
+      }
+      boundary;
+      errors;
+    };
+  }
+});
+
+// src/outputContractHooks.ts
+import * as fs3 from "fs";
+import * as path3 from "path";
+function outputContractError(contract) {
+  let value;
+  try {
+    value = JSON.parse(fs3.readFileSync(contract.path, "utf8"));
+  } catch (error) {
+    return `The required output file is missing or is not valid JSON: ${error instanceof Error ? error.message : String(error)}`;
+  }
+  try {
+    validateCapabilityContractValue("output", contract.schema, value);
+    return null;
+  } catch (error) {
+    return error instanceof Error ? error.message : String(error);
+  }
+}
+function correctionMessage(contract, error) {
+  return `The authoritative output does not match its required contract: ${error}. Please overwrite ${contract.path} with only the required JSON shape before finishing.`;
+}
+function createOutputContractPostWriteHook(contract) {
+  const expectedPath = path3.resolve(contract.path);
+  return async (input) => {
+    const toolInput = input.tool_input;
+    if (!toolInput || typeof toolInput !== "object" || Array.isArray(toolInput)) return {};
+    const filePath = toolInput.file_path;
+    if (typeof filePath !== "string" || path3.resolve(filePath) !== expectedPath) return {};
+    const error = outputContractError(contract);
+    if (!error) return {};
+    return {
+      hookSpecificOutput: {
+        hookEventName: "PostToolUse",
+        additionalContext: correctionMessage(contract, error)
+      }
+    };
+  };
+}
+function createOutputContractStopHook(contract) {
+  return async () => {
+    const error = outputContractError(contract);
+    if (!error) return {};
+    return {
+      decision: "block",
+      reason: correctionMessage(contract, error)
+    };
+  };
+}
+var init_outputContractHooks = __esm({
+  "src/outputContractHooks.ts"() {
+    "use strict";
+    init_capability_contract_validation();
+  }
+});
+
 // src/runtimePaths.ts
 var runtimePaths_exports = {};
 __export(runtimePaths_exports, {
@@ -678,21 +783,21 @@ __export(runtimePaths_exports, {
 });
 import { createHash } from "crypto";
 import * as os2 from "os";
-import * as path3 from "path";
+import * as path4 from "path";
 function runtimeDirForCwd(cwd, ...parts) {
-  const key = createHash("sha256").update(path3.resolve(cwd)).digest("hex").slice(0, 16);
-  return path3.join(os2.tmpdir(), "kody-engine", key, ...parts);
+  const key = createHash("sha256").update(path4.resolve(cwd)).digest("hex").slice(0, 16);
+  return path4.join(os2.tmpdir(), "kody-engine", key, ...parts);
 }
 function runtimeStatePath(cwd, ...parts) {
   const configuredRoot = process.env.KODY_RUNTIME_DIR?.trim();
-  const base = configuredRoot ? path3.resolve(configuredRoot) : runtimeDirForCwd(cwd);
-  return path3.join(base, ...parts);
+  const base = configuredRoot ? path4.resolve(configuredRoot) : runtimeDirForCwd(cwd);
+  return path4.join(base, ...parts);
 }
 function agentRunDir(cwd) {
   return runtimeStatePath(cwd, "agent-runs");
 }
 function lastRunLogPath(cwd) {
-  return path3.join(agentRunDir(cwd), "last-run.jsonl");
+  return path4.join(agentRunDir(cwd), "last-run.jsonl");
 }
 var init_runtimePaths = __esm({
   "src/runtimePaths.ts"() {
@@ -701,31 +806,31 @@ var init_runtimePaths = __esm({
 });
 
 // src/scripts/buildSyntheticPlugin.ts
-import * as fs3 from "fs";
+import * as fs4 from "fs";
 import * as os3 from "os";
-import * as path4 from "path";
+import * as path5 from "path";
 function getPluginsCatalogRoot() {
-  const here = path4.dirname(new URL(import.meta.url).pathname);
+  const here = path5.dirname(new URL(import.meta.url).pathname);
   const candidates = [
-    path4.join(here, "..", "plugins"),
+    path5.join(here, "..", "plugins"),
     // dev: src/scripts → src/plugins
-    path4.join(here, "..", "..", "plugins"),
+    path5.join(here, "..", "..", "plugins"),
     // built: dist/scripts → dist/plugins
-    path4.join(here, "..", "..", "src", "plugins")
+    path5.join(here, "..", "..", "src", "plugins")
     // fallback
   ];
   for (const c of candidates) {
-    if (fs3.existsSync(c) && fs3.statSync(c).isDirectory()) return c;
+    if (fs4.existsSync(c) && fs4.statSync(c).isDirectory()) return c;
   }
   return candidates[0];
 }
 function copyDir(src, dst) {
-  fs3.mkdirSync(dst, { recursive: true });
-  for (const ent of fs3.readdirSync(src, { withFileTypes: true })) {
-    const s = path4.join(src, ent.name);
-    const d = path4.join(dst, ent.name);
+  fs4.mkdirSync(dst, { recursive: true });
+  for (const ent of fs4.readdirSync(src, { withFileTypes: true })) {
+    const s = path5.join(src, ent.name);
+    const d = path5.join(dst, ent.name);
     if (ent.isDirectory()) copyDir(s, d);
-    else if (ent.isFile()) fs3.copyFileSync(s, d);
+    else if (ent.isFile()) fs4.copyFileSync(s, d);
   }
 }
 var buildSyntheticPlugin;
@@ -738,47 +843,47 @@ var init_buildSyntheticPlugin = __esm({
       if (!needsSynthetic) return;
       const catalog = getPluginsCatalogRoot();
       const runId = `${profile.name}-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
-      const root = path4.join(os3.tmpdir(), `kody-synth-${runId}`);
-      fs3.mkdirSync(path4.join(root, ".claude-plugin"), { recursive: true });
+      const root = path5.join(os3.tmpdir(), `kody-synth-${runId}`);
+      fs4.mkdirSync(path5.join(root, ".claude-plugin"), { recursive: true });
       const resolvePart = (bucket, entry) => {
-        const local = path4.join(profile.dir, bucket, entry);
-        if (fs3.existsSync(local)) return local;
-        const shared = path4.resolve(profile.dir, "..", "..", "shared", bucket, entry);
-        if (fs3.existsSync(shared)) return shared;
-        const central = path4.join(catalog, bucket, entry);
-        if (fs3.existsSync(central)) return central;
+        const local = path5.join(profile.dir, bucket, entry);
+        if (fs4.existsSync(local)) return local;
+        const shared = path5.resolve(profile.dir, "..", "..", "shared", bucket, entry);
+        if (fs4.existsSync(shared)) return shared;
+        const central = path5.join(catalog, bucket, entry);
+        if (fs4.existsSync(central)) return central;
         throw new Error(
-          `buildSyntheticPlugin: ${bucket} entry '${entry}' not found in implementation dir (${profile.dir}/${bucket}/), Store shared assets (${path4.dirname(shared)}/), or catalog (${catalog}/${bucket}/)`
+          `buildSyntheticPlugin: ${bucket} entry '${entry}' not found in implementation dir (${profile.dir}/${bucket}/), Store shared assets (${path5.dirname(shared)}/), or catalog (${catalog}/${bucket}/)`
         );
       };
       if (cc.skills.length > 0) {
-        const dst = path4.join(root, "skills");
-        fs3.mkdirSync(dst, { recursive: true });
+        const dst = path5.join(root, "skills");
+        fs4.mkdirSync(dst, { recursive: true });
         for (const name of cc.skills) {
-          copyDir(resolvePart("skills", name), path4.join(dst, name));
+          copyDir(resolvePart("skills", name), path5.join(dst, name));
         }
       }
       if (cc.commands.length > 0) {
-        const dst = path4.join(root, "commands");
-        fs3.mkdirSync(dst, { recursive: true });
+        const dst = path5.join(root, "commands");
+        fs4.mkdirSync(dst, { recursive: true });
         for (const name of cc.commands) {
-          fs3.copyFileSync(resolvePart("commands", `${name}.md`), path4.join(dst, `${name}.md`));
+          fs4.copyFileSync(resolvePart("commands", `${name}.md`), path5.join(dst, `${name}.md`));
         }
       }
       if (cc.hooks.length > 0) {
-        const dst = path4.join(root, "hooks");
-        fs3.mkdirSync(dst, { recursive: true });
+        const dst = path5.join(root, "hooks");
+        fs4.mkdirSync(dst, { recursive: true });
         const merged = { hooks: {} };
         for (const name of cc.hooks) {
           const src = resolvePart("hooks", `${name}.json`);
-          const parsed = JSON.parse(fs3.readFileSync(src, "utf-8"));
+          const parsed = JSON.parse(fs4.readFileSync(src, "utf-8"));
           for (const [event, entries] of Object.entries(parsed.hooks ?? {})) {
             if (!Array.isArray(entries)) continue;
             if (!merged.hooks[event]) merged.hooks[event] = [];
             merged.hooks[event].push(...entries);
           }
         }
-        fs3.writeFileSync(path4.join(dst, "hooks.json"), `${JSON.stringify(merged, null, 2)}
+        fs4.writeFileSync(path5.join(dst, "hooks.json"), `${JSON.stringify(merged, null, 2)}
 `);
       }
       const manifest = {
@@ -788,7 +893,7 @@ var init_buildSyntheticPlugin = __esm({
       };
       if (cc.skills.length > 0) manifest.skills = ["./skills/"];
       if (cc.commands.length > 0) manifest.commands = ["./commands/"];
-      fs3.writeFileSync(path4.join(root, ".claude-plugin", "plugin.json"), `${JSON.stringify(manifest, null, 2)}
+      fs4.writeFileSync(path5.join(root, ".claude-plugin", "plugin.json"), `${JSON.stringify(manifest, null, 2)}
 `);
       ctx.data.syntheticPluginPath = root;
     };
@@ -796,8 +901,8 @@ var init_buildSyntheticPlugin = __esm({
 });
 
 // src/subagents.ts
-import * as fs4 from "fs";
-import * as path5 from "path";
+import * as fs5 from "fs";
+import * as path6 from "path";
 async function enforceSubagentModelInheritance(input) {
   const toolInput = input.tool_input;
   if (!toolInput || typeof toolInput !== "object" || Array.isArray(toolInput)) return {};
@@ -832,12 +937,12 @@ function splitFrontmatter(raw) {
   return { fm, body: (match[2] ?? "").trim() };
 }
 function resolveAgentFile(profileDir, name) {
-  const local = path5.join(profileDir, "agents", `${name}.md`);
-  if (fs4.existsSync(local)) return local;
-  const shared = path5.resolve(profileDir, "..", "..", "shared", "agents", `${name}.md`);
-  if (fs4.existsSync(shared)) return shared;
-  const central = path5.join(getPluginsCatalogRoot(), "agents", `${name}.md`);
-  if (fs4.existsSync(central)) return central;
+  const local = path6.join(profileDir, "agents", `${name}.md`);
+  if (fs5.existsSync(local)) return local;
+  const shared = path6.resolve(profileDir, "..", "..", "shared", "agents", `${name}.md`);
+  if (fs5.existsSync(shared)) return shared;
+  const central = path6.join(getPluginsCatalogRoot(), "agents", `${name}.md`);
+  if (fs5.existsSync(central)) return central;
   throw new Error(
     `loadSubagents: agent '${name}' not found in ${profileDir}/agents/, hydrated shared assets, or engine catalog`
   );
@@ -848,7 +953,7 @@ function captureSubagentTemplates(profile) {
   const out = {};
   for (const name of names) {
     try {
-      out[name] = fs4.readFileSync(resolveAgentFile(profile.dir, name), "utf-8");
+      out[name] = fs5.readFileSync(resolveAgentFile(profile.dir, name), "utf-8");
     } catch {
     }
   }
@@ -859,7 +964,7 @@ function loadSubagents(profile) {
   if (!names || names.length === 0) return void 0;
   const agents = {};
   for (const name of names) {
-    const raw = profile.subagentTemplates?.[name] ?? fs4.readFileSync(resolveAgentFile(profile.dir, name), "utf-8");
+    const raw = profile.subagentTemplates?.[name] ?? fs5.readFileSync(resolveAgentFile(profile.dir, name), "utf-8");
     const { fm, body } = splitFrontmatter(raw);
     if (!body) throw new Error(`loadSubagents: agent '${name}' has an empty prompt body`);
     const def = {
@@ -892,8 +997,8 @@ __export(events_exports, {
   resolveRunId: () => resolveRunId
 });
 import * as crypto from "crypto";
-import * as fs5 from "fs";
-import * as path6 from "path";
+import * as fs6 from "fs";
+import * as path7 from "path";
 function resolveRunId() {
   if (process.env.KODY_RUN_ID) {
     cachedRunId = process.env.KODY_RUN_ID;
@@ -926,16 +1031,16 @@ function emitEvent(cwd, ev) {
       ...ev
     };
     const file = eventsPath(cwd, runId);
-    fs5.mkdirSync(path6.dirname(file), { recursive: true });
-    fs5.appendFileSync(file, `${JSON.stringify(fullEvent)}
+    fs6.mkdirSync(path7.dirname(file), { recursive: true });
+    fs6.appendFileSync(file, `${JSON.stringify(fullEvent)}
 `);
   } catch {
   }
 }
 function readEvents(cwd, runId) {
   const file = eventsPath(cwd, runId);
-  if (!fs5.existsSync(file)) return [];
-  const lines = fs5.readFileSync(file, "utf-8").split("\n");
+  if (!fs6.existsSync(file)) return [];
+  const lines = fs6.readFileSync(file, "utf-8").split("\n");
   const out = [];
   for (const line of lines) {
     const trimmed = line.trim();
@@ -949,10 +1054,10 @@ function readEvents(cwd, runId) {
 }
 function listRuns(cwd) {
   const runsDir = runtimeStatePath(cwd, "agent-runs");
-  if (!fs5.existsSync(runsDir)) return [];
-  return fs5.readdirSync(runsDir).filter((name) => {
+  if (!fs6.existsSync(runsDir)) return [];
+  return fs6.readdirSync(runsDir).filter((name) => {
     try {
-      return fs5.statSync(path6.join(runsDir, name)).isDirectory();
+      return fs6.statSync(path7.join(runsDir, name)).isDirectory();
     } catch {
       return false;
     }
@@ -989,7 +1094,7 @@ function buildVerifyEnv(source = process.env) {
   return env;
 }
 function runCommand(command, cwd) {
-  return new Promise((resolve20) => {
+  return new Promise((resolve21) => {
     const start = Date.now();
     const child = spawn(command, {
       cwd,
@@ -1018,11 +1123,11 @@ function runCommand(command, cwd) {
     child.on("exit", (code) => {
       clearTimeout(timer);
       const tail = Buffer.concat(buffers).toString("utf-8").slice(-TAIL_CHARS);
-      resolve20({ exitCode: code ?? -1, durationMs: Date.now() - start, tail });
+      resolve21({ exitCode: code ?? -1, durationMs: Date.now() - start, tail });
     });
     child.on("error", (err) => {
       clearTimeout(timer);
-      resolve20({ exitCode: -1, durationMs: Date.now() - start, tail: err.message });
+      resolve21({ exitCode: -1, durationMs: Date.now() - start, tail: err.message });
     });
   });
 }
@@ -1331,7 +1436,7 @@ function cmsHeaders(opts) {
     }
   };
 }
-async function callDashboardCms(opts, path54, init = {}) {
+async function callDashboardCms(opts, path55, init = {}) {
   const baseUrl = dashboardBaseUrl(opts);
   if (!baseUrl) {
     return {
@@ -1343,7 +1448,7 @@ async function callDashboardCms(opts, path54, init = {}) {
   const headerResult = cmsHeaders(opts);
   if (!headerResult.ok) return headerResult;
   try {
-    const res = await fetch(`${baseUrl}${path54}`, {
+    const res = await fetch(`${baseUrl}${path55}`, {
       ...init,
       headers: {
         ...headerResult.headers,
@@ -1415,8 +1520,8 @@ function documentArg(value) {
 function normalizeCmsDocumentIdInput(input) {
   const trimmed = stripWrappingQuotes(input.trim());
   const withoutQuery = trimmed.split(/[?#]/, 1)[0] ?? trimmed;
-  const path54 = parseDocumentPath(withoutQuery);
-  return path54 ?? parseDocumentIdSegment(withoutQuery) ?? withoutQuery;
+  const path55 = parseDocumentPath(withoutQuery);
+  return path55 ?? parseDocumentIdSegment(withoutQuery) ?? withoutQuery;
 }
 function stripWrappingQuotes(value) {
   let current = value;
@@ -1427,9 +1532,9 @@ function stripWrappingQuotes(value) {
   }
 }
 function parseDocumentPath(value) {
-  const path54 = value.startsWith("http://") || value.startsWith("https://") ? urlPathname(value) : value;
-  if (!path54?.includes("/content/entries/")) return null;
-  const parts = path54.split("/").filter(Boolean).map(decodePathPart);
+  const path55 = value.startsWith("http://") || value.startsWith("https://") ? urlPathname(value) : value;
+  if (!path55?.includes("/content/entries/")) return null;
+  const parts = path55.split("/").filter(Boolean).map(decodePathPart);
   const entriesIndex = parts.findIndex((part, index) => part === "content" && parts[index + 1] === "entries");
   const idPart = parts[entriesIndex + 3];
   if (!idPart || idPart === "new") return null;
@@ -1874,8 +1979,8 @@ var init_issue = __esm({
 });
 
 // src/capabilityFolders.ts
-import * as fs6 from "fs";
-import * as path7 from "path";
+import * as fs7 from "fs";
+import * as path8 from "path";
 function capabilityOutputConditionPaths(config) {
   if (config.outputSchema) {
     return new Set(schemaPropertyPaths(config.outputSchema, "result"));
@@ -1890,32 +1995,32 @@ function capabilityOutputConditionPaths(config) {
   ]);
 }
 function listCapabilityFolderSlugs(absDir) {
-  if (!fs6.existsSync(absDir)) return [];
+  if (!fs7.existsSync(absDir)) return [];
   let entries;
   try {
-    entries = fs6.readdirSync(absDir, { withFileTypes: true });
+    entries = fs7.readdirSync(absDir, { withFileTypes: true });
   } catch {
     return [];
   }
-  return entries.filter((e) => e.isDirectory() && !e.name.startsWith("_") && !e.name.startsWith(".")).filter((e) => isCapabilityFolder(path7.join(absDir, e.name))).map((e) => e.name).sort();
+  return entries.filter((e) => e.isDirectory() && !e.name.startsWith("_") && !e.name.startsWith(".")).filter((e) => isCapabilityFolder(path8.join(absDir, e.name))).map((e) => e.name).sort();
 }
 function isCapabilityFolder(dir) {
-  if (!fs6.existsSync(path7.join(dir, CAPABILITY_BODY_FILE))) return false;
-  const entries = fs6.readdirSync(dir, { withFileTypes: true });
+  if (!fs7.existsSync(path8.join(dir, CAPABILITY_BODY_FILE))) return false;
+  const entries = fs7.readdirSync(dir, { withFileTypes: true });
   return entries.every(
     (entry) => entry.name === CAPABILITY_BODY_FILE || entry.name === CAPABILITY_CONTRACT_FILE || entry.isDirectory() && (entry.name === "skills" || entry.name === "tools")
   );
 }
 function readCapabilityFolder(root, slug) {
-  const dir = path7.join(root, slug);
-  const bodyPath = path7.join(dir, CAPABILITY_BODY_FILE);
-  const contractPath = path7.join(dir, CAPABILITY_CONTRACT_FILE);
-  if (!fs6.existsSync(bodyPath) || !fs6.statSync(bodyPath).isFile()) return null;
+  const dir = path8.join(root, slug);
+  const bodyPath = path8.join(dir, CAPABILITY_BODY_FILE);
+  const contractPath = path8.join(dir, CAPABILITY_CONTRACT_FILE);
+  if (!fs7.existsSync(bodyPath) || !fs7.statSync(bodyPath).isFile()) return null;
   if (!isCapabilityFolder(dir)) return null;
   try {
-    const rawBody = fs6.readFileSync(bodyPath, "utf-8");
-    const contract = fs6.existsSync(contractPath) ? parseCapabilityContract(fs6.readFileSync(contractPath, "utf-8")) : void 0;
-    if (contract?.execution === "script" && !isRegularFile(path7.join(dir, "tools", "run.sh"))) {
+    const rawBody = fs7.readFileSync(bodyPath, "utf-8");
+    const contract = fs7.existsSync(contractPath) ? parseCapabilityContract(fs7.readFileSync(contractPath, "utf-8")) : void 0;
+    if (contract?.execution === "script" && !isRegularFile(path8.join(dir, "tools", "run.sh"))) {
       throw new Error('script-backed Capability requires a regular "tools/run.sh" file');
     }
     const { title, body } = parseCapabilityBody(rawBody, slug);
@@ -2028,7 +2133,7 @@ function parseCapabilityRequirements(raw) {
 }
 function isRegularFile(filePath) {
   try {
-    const stat = fs6.lstatSync(filePath);
+    const stat = fs7.lstatSync(filePath);
     return stat.isFile() && !stat.isSymbolicLink();
   } catch {
     return false;
@@ -2037,8 +2142,8 @@ function isRegularFile(filePath) {
 function schemaPropertyPaths(schema, prefix) {
   const properties = isPlainObject(schema.properties) ? schema.properties : {};
   return Object.entries(properties).flatMap(([name, property]) => {
-    const path54 = `${prefix}.${name}`;
-    return isPlainObject(property) ? [path54, ...schemaPropertyPaths(property, path54)] : [path54];
+    const path55 = `${prefix}.${name}`;
+    return isPlainObject(property) ? [path55, ...schemaPropertyPaths(property, path55)] : [path55];
   });
 }
 function parseCapabilityBody(raw, slug) {
@@ -2200,51 +2305,51 @@ var init_capabilityFolders = __esm({
 });
 
 // src/definition-paths.ts
-import * as fs7 from "fs";
-import * as path8 from "path";
+import * as fs8 from "fs";
+import * as path9 from "path";
 function definitionsRoot(cwd = process.cwd()) {
   const override = process.env.KODY_DEFINITIONS_ROOT?.trim();
   const overrideCwd = process.env.KODY_DEFINITIONS_ROOT_CWD?.trim();
-  if (override && overrideCwd && path8.resolve(cwd) === path8.resolve(overrideCwd)) {
-    return storeCatalogRoot(path8.resolve(override));
+  if (override && overrideCwd && path9.resolve(cwd) === path9.resolve(overrideCwd)) {
+    return storeCatalogRoot(path9.resolve(override));
   }
-  const hydrated = path8.join(cwd, ".kody-engine", "definitions");
-  if (fs7.existsSync(hydrated)) return hydrated;
-  return override ? storeCatalogRoot(path8.resolve(override)) : hydrated;
+  const hydrated = path9.join(cwd, ".kody-engine", "definitions");
+  if (fs8.existsSync(hydrated)) return hydrated;
+  return override ? storeCatalogRoot(path9.resolve(override)) : hydrated;
 }
 function hasExplicitDefinitionsRoot(cwd = process.cwd(), env = process.env) {
   const root = env.KODY_DEFINITIONS_ROOT?.trim();
   const rootCwd = env.KODY_DEFINITIONS_ROOT_CWD?.trim();
-  return Boolean(root && rootCwd && path8.resolve(cwd) === path8.resolve(rootCwd));
+  return Boolean(root && rootCwd && path9.resolve(cwd) === path9.resolve(rootCwd));
 }
 function capabilitiesRoot(cwd = process.cwd()) {
-  return storeAssetRoot(cwd, "capabilities") ?? path8.join(definitionsRoot(cwd), "capabilities");
+  return storeAssetRoot(cwd, "capabilities") ?? path9.join(definitionsRoot(cwd), "capabilities");
 }
 function implementationsRoot(cwd = process.cwd()) {
-  return path8.join(definitionsRoot(cwd), "implementations");
+  return path9.join(definitionsRoot(cwd), "implementations");
 }
 function agentsRoot(cwd = process.cwd()) {
-  return storeAssetRoot(cwd, "agent") ?? path8.join(definitionsRoot(cwd), "agents");
+  return storeAssetRoot(cwd, "agent") ?? path9.join(definitionsRoot(cwd), "agents");
 }
 function storeCatalogRoot(root) {
   const manifest = readStoreManifest(root);
-  const roots = ["capabilities", "workflows", "loops"].map((kind) => manifest?.assetRoots?.[kind]).filter((value) => typeof value === "string" && Boolean(value.trim())).map((value) => path8.dirname(value));
-  return roots.length === 3 && new Set(roots).size === 1 ? path8.join(root, roots[0]) : root;
+  const roots = ["capabilities", "workflows", "loops"].map((kind) => manifest?.assetRoots?.[kind]).filter((value) => typeof value === "string" && Boolean(value.trim())).map((value) => path9.dirname(value));
+  return roots.length === 3 && new Set(roots).size === 1 ? path9.join(root, roots[0]) : root;
 }
 function storeAssetRoot(cwd, kind) {
   const override = process.env.KODY_DEFINITIONS_ROOT?.trim();
   if (!override) return null;
   const overrideCwd = process.env.KODY_DEFINITIONS_ROOT_CWD?.trim();
-  if (overrideCwd && path8.resolve(cwd) !== path8.resolve(overrideCwd)) return null;
-  const root = path8.resolve(override);
+  if (overrideCwd && path9.resolve(cwd) !== path9.resolve(overrideCwd)) return null;
+  const root = path9.resolve(override);
   const configured = readStoreManifest(root)?.assetRoots?.[kind];
-  return typeof configured === "string" && configured.trim() ? path8.join(root, configured) : null;
+  return typeof configured === "string" && configured.trim() ? path9.join(root, configured) : null;
 }
 function readStoreManifest(root) {
-  const file = path8.join(root, "kody-store.json");
-  if (!fs7.existsSync(file)) return null;
+  const file = path9.join(root, "kody-store.json");
+  if (!fs8.existsSync(file)) return null;
   try {
-    return JSON.parse(fs7.readFileSync(file, "utf8"));
+    return JSON.parse(fs8.readFileSync(file, "utf8"));
   } catch {
     return null;
   }
@@ -2256,32 +2361,32 @@ var init_definition_paths = __esm({
 });
 
 // src/registry.ts
-import * as fs8 from "fs";
-import * as path9 from "path";
+import * as fs9 from "fs";
+import * as path10 from "path";
 function getImplementationsRoot() {
-  const here = path9.dirname(new URL(import.meta.url).pathname);
+  const here = path10.dirname(new URL(import.meta.url).pathname);
   const candidates = [
-    path9.join(here, "implementations"),
+    path10.join(here, "implementations"),
     // dev: src/
-    path9.join(here, "..", "implementations"),
+    path10.join(here, "..", "implementations"),
     // built: dist/bin → dist/implementations
-    path9.join(here, "..", "src", "implementations")
+    path10.join(here, "..", "src", "implementations")
     // fallback
   ];
   for (const c of candidates) {
-    if (fs8.existsSync(c) && fs8.statSync(c).isDirectory()) return c;
+    if (fs9.existsSync(c) && fs9.statSync(c).isDirectory()) return c;
   }
   return candidates[0];
 }
 function getRuntimeServicesRoot() {
-  const here = path9.dirname(new URL(import.meta.url).pathname);
+  const here = path10.dirname(new URL(import.meta.url).pathname);
   const candidates = [
-    path9.join(here, "runtime-services"),
-    path9.join(here, "..", "runtime-services"),
-    path9.join(here, "..", "src", "runtime-services")
+    path10.join(here, "runtime-services"),
+    path10.join(here, "..", "runtime-services"),
+    path10.join(here, "..", "src", "runtime-services")
   ];
   for (const candidate of candidates) {
-    if (fs8.existsSync(candidate) && fs8.statSync(candidate).isDirectory()) return candidate;
+    if (fs9.existsSync(candidate) && fs9.statSync(candidate).isDirectory()) return candidate;
   }
   return candidates[0];
 }
@@ -2289,17 +2394,17 @@ function getProjectCapabilitiesRoot() {
   return capabilitiesRoot();
 }
 function getBuiltinCapabilitiesRoot() {
-  const here = path9.dirname(new URL(import.meta.url).pathname);
+  const here = path10.dirname(new URL(import.meta.url).pathname);
   const candidates = [
-    path9.join(here, "capabilities"),
+    path10.join(here, "capabilities"),
     // dev: src/
-    path9.join(here, "..", "capabilities"),
+    path10.join(here, "..", "capabilities"),
     // built: dist/bin → dist/capabilities
-    path9.join(here, "..", "src", "capabilities")
+    path10.join(here, "..", "src", "capabilities")
     // fallback
   ];
   for (const c of candidates) {
-    if (fs8.existsSync(c) && fs8.statSync(c).isDirectory()) return c;
+    if (fs9.existsSync(c) && fs9.statSync(c).isDirectory()) return c;
   }
   return candidates[0];
 }
@@ -2322,14 +2427,14 @@ function listImplementations(roots = getImplementationRoots()) {
   const seen = /* @__PURE__ */ new Set();
   const out = [];
   for (const root of rootList) {
-    if (!fs8.existsSync(root)) continue;
+    if (!fs9.existsSync(root)) continue;
     const requireImplementationProfile = isCapabilityRoot(root);
-    const entries = fs8.readdirSync(root, { withFileTypes: true });
+    const entries = fs9.readdirSync(root, { withFileTypes: true });
     for (const ent of entries) {
       if (!ent.isDirectory()) continue;
       if (seen.has(ent.name)) continue;
       const profilePath = implementationRuntimePath(root, ent.name);
-      if (fs8.existsSync(profilePath) && fs8.statSync(profilePath).isFile() && isImplementationProfile(profilePath, requireImplementationProfile)) {
+      if (fs9.existsSync(profilePath) && fs9.statSync(profilePath).isFile() && isImplementationProfile(profilePath, requireImplementationProfile)) {
         out.push({ name: ent.name, profilePath });
         seen.add(ent.name);
       }
@@ -2349,7 +2454,7 @@ function resolveImplementationCandidates(name, roots = getRuntimeProfileRootsFor
   const out = [];
   for (const root of rootList) {
     const profilePath = implementationRuntimePath(root, name);
-    if (fs8.existsSync(profilePath) && fs8.statSync(profilePath).isFile() && isImplementationProfile(profilePath, isCapabilityRoot(root))) {
+    if (fs9.existsSync(profilePath) && fs9.statSync(profilePath).isFile() && isImplementationProfile(profilePath, isCapabilityRoot(root))) {
       out.push(profilePath);
     }
   }
@@ -2418,7 +2523,7 @@ function implementationDeclaresInput(implementation, inputName, cwd = process.cw
   const profilePath = resolveImplementation(implementation, getRuntimeProfileRootsForCwd(cwd));
   if (!profilePath) return false;
   try {
-    const document = JSON.parse(fs8.readFileSync(profilePath, "utf-8"));
+    const document = JSON.parse(fs9.readFileSync(profilePath, "utf-8"));
     const raw = document.config ?? document;
     if (!Array.isArray(raw.inputs)) return false;
     return raw.inputs.some((entry) => {
@@ -2434,29 +2539,29 @@ function isSafeName(name) {
   return /^[a-z][a-z0-9-]*$/.test(name) && !name.includes("..");
 }
 function isCapabilityRoot(root) {
-  const normalized = path9.normalize(root);
-  if (path9.basename(normalized) === "capabilities") return true;
+  const normalized = path10.normalize(root);
+  if (path10.basename(normalized) === "capabilities") return true;
   const knownRoots = [getProjectCapabilitiesRoot(), getBuiltinCapabilitiesRoot()];
-  return knownRoots.some((candidate) => candidate && path9.normalize(candidate) === normalized);
+  return knownRoots.some((candidate) => candidate && path10.normalize(candidate) === normalized);
 }
 function implementationRuntimePath(root, name) {
-  const runtimePath = path9.join(root, name, "runtime.json");
-  if (fs8.existsSync(runtimePath)) return runtimePath;
-  const internalProfilePath = path9.join(root, name, "profile.json");
-  if (fs8.existsSync(internalProfilePath)) return internalProfilePath;
-  return path9.join(root, name, CAPABILITY_PROFILE_FILE);
+  const runtimePath = path10.join(root, name, "runtime.json");
+  if (fs9.existsSync(runtimePath)) return runtimePath;
+  const internalProfilePath = path10.join(root, name, "profile.json");
+  if (fs9.existsSync(internalProfilePath)) return internalProfilePath;
+  return path10.join(root, name, CAPABILITY_PROFILE_FILE);
 }
 function isImplementationProfile(profilePath, requireImplementationProfile) {
   if (!requireImplementationProfile) return true;
   try {
-    const raw = JSON.parse(fs8.readFileSync(profilePath, "utf-8"));
+    const raw = JSON.parse(fs9.readFileSync(profilePath, "utf-8"));
     return typeof raw.role === "string" && PUBLIC_IMPLEMENTATION_ROLES.has(raw.role);
   } catch {
     return false;
   }
 }
 function listFolderCapabilityActions(root, source) {
-  if (!fs8.existsSync(root) || !fs8.statSync(root).isDirectory()) return [];
+  if (!fs9.existsSync(root) || !fs9.statSync(root).isDirectory()) return [];
   const out = [];
   for (const slug of listCapabilityFolderSlugs(root)) {
     if (!isSafeName(slug)) continue;
@@ -2488,7 +2593,7 @@ function hasUnresolvedExplicitImplementation(capability, implementation) {
   return resolveImplementation(implementation) === null;
 }
 function listBuiltinCapabilityActions(root = getBuiltinCapabilitiesRoot()) {
-  if (!fs8.existsSync(root) || !fs8.statSync(root).isDirectory()) return [];
+  if (!fs9.existsSync(root) || !fs9.statSync(root).isDirectory()) return [];
   const out = [];
   for (const slug of listCapabilityFolderSlugs(root)) {
     if (!isSafeName(slug)) continue;
@@ -2513,7 +2618,7 @@ function getProfileInputs(name, roots = getImplementationRoots()) {
   const profilePath = resolveImplementation(name, roots);
   if (!profilePath) return null;
   try {
-    const document = JSON.parse(fs8.readFileSync(profilePath, "utf-8"));
+    const document = JSON.parse(fs9.readFileSync(profilePath, "utf-8"));
     if (!document || typeof document !== "object") return [];
     const raw = "config" in document && document.config && typeof document.config === "object" ? document.config : document;
     if (!Array.isArray(raw.inputs)) return [];
@@ -3577,8 +3682,8 @@ var init_capabilityMcp = __esm({
 
 // src/repoWorkspace.ts
 import { spawn as spawn2, spawnSync } from "child_process";
-import * as fs9 from "fs";
-import * as path10 from "path";
+import * as fs10 from "fs";
+import * as path11 from "path";
 function buildCloneProcess(repo, token, baseEnv = process.env) {
   const url = `https://github.com/${repo}.git`;
   const env = { ...baseEnv };
@@ -3593,10 +3698,10 @@ function buildCloneProcess(repo, token, baseEnv = process.env) {
 async function resolveAndClone(reposRoot, repo, repoToken, cloneRepo) {
   const name = repo?.trim();
   if (!name || !REPO_RE.test(name)) return null;
-  const root = path10.resolve(reposRoot);
-  const dir = path10.resolve(root, name);
-  if (dir !== root && !dir.startsWith(root + path10.sep)) return null;
-  if (fs9.existsSync(path10.join(dir, ".git"))) return dir;
+  const root = path11.resolve(reposRoot);
+  const dir = path11.resolve(root, name);
+  if (dir !== root && !dir.startsWith(root + path11.sep)) return null;
+  if (fs10.existsSync(path11.join(dir, ".git"))) return dir;
   const inflight = repoClones.get(dir);
   if (inflight) {
     await inflight;
@@ -3628,9 +3733,9 @@ var init_repoWorkspace = __esm({
     repoClones = /* @__PURE__ */ new Map();
     GIT_CREDENTIAL_HELPER = `!f() { if [ "$1" = get ] && [ -n "$GITHUB_TOKEN" ]; then printf '%s\\n' username=x-access-token "password=$GITHUB_TOKEN"; fi; }; f`;
     defaultCloneRepo = (repo, token, dir) => {
-      fs9.mkdirSync(path10.dirname(dir), { recursive: true });
+      fs10.mkdirSync(path11.dirname(dir), { recursive: true });
       const clone = buildCloneProcess(repo, token);
-      return new Promise((resolve20, reject) => {
+      return new Promise((resolve21, reject) => {
         const child = spawn2("git", ["clone", "--depth=1", clone.url, dir], {
           env: clone.env,
           stdio: "inherit"
@@ -3650,7 +3755,7 @@ var init_repoWorkspace = __esm({
             }
           } catch {
           }
-          resolve20();
+          resolve21();
         });
         child.on("error", reject);
       });
@@ -3722,8 +3827,8 @@ var init_fetchRepoMcp = __esm({
 });
 
 // src/agent.ts
-import * as fs10 from "fs";
-import * as path11 from "path";
+import * as fs11 from "fs";
+import * as path12 from "path";
 import { query } from "@anthropic-ai/claude-agent-sdk";
 function classifySubtype(subtype) {
   if (!subtype) return "generic_failed";
@@ -3792,8 +3897,8 @@ function buildAgentEnvironment(baseEnv, repoToken, requestEnvironment) {
 }
 async function runAgent(opts) {
   const ndjsonDir = opts.ndjsonDir ?? agentRunDir(opts.cwd);
-  fs10.mkdirSync(ndjsonDir, { recursive: true });
-  const ndjsonPath = path11.join(ndjsonDir, "last-run.jsonl");
+  fs11.mkdirSync(ndjsonDir, { recursive: true });
+  const ndjsonPath = path12.join(ndjsonDir, "last-run.jsonl");
   const env = buildAgentEnvironment(process.env, opts.repoToken, opts.environment);
   if (opts.litellmUrl) {
     env.ANTHROPIC_BASE_URL = opts.litellmUrl;
@@ -3811,10 +3916,12 @@ async function runAgent(opts) {
   let getSubmitted;
   const invokedSubagents = /* @__PURE__ */ new Set();
   const subagentInvocationHook = createSubagentInvocationHook(invokedSubagents);
+  const outputContractPostWriteHook = opts.outputContract ? createOutputContractPostWriteHook(opts.outputContract) : null;
+  const outputContractStopHook = opts.outputContract ? createOutputContractStopHook(opts.outputContract) : null;
   for (let attempt = 0; ; attempt++) {
     let ndjsonWriteFailed = false;
     let ndjsonWriteError;
-    const fullLog = fs10.createWriteStream(ndjsonPath, { flags: "w" });
+    const fullLog = fs11.createWriteStream(ndjsonPath, { flags: "w" });
     fullLog.on("error", (err) => {
       ndjsonWriteFailed = true;
       ndjsonWriteError = err instanceof Error ? err.message : String(err);
@@ -3837,6 +3944,7 @@ async function runAgent(opts) {
         // Fresh array (never mutate the shared DEFAULT_ALLOWED_TOOLS const) so
         // opt-in tools like fetch_repo can be appended below.
         allowedTools: [...opts.allowedToolsOverride ?? DEFAULT_ALLOWED_TOOLS],
+        ...opts.disallowedToolsOverride?.length ? { disallowedTools: [...opts.disallowedToolsOverride] } : {},
         permissionMode: opts.permissionModeOverride ?? "acceptEdits",
         env,
         hooks: {
@@ -3850,8 +3958,21 @@ async function runAgent(opts) {
             {
               matcher: "Agent",
               hooks: [subagentInvocationHook]
-            }
-          ]
+            },
+            ...outputContractPostWriteHook ? [
+              {
+                matcher: "Write",
+                hooks: [outputContractPostWriteHook]
+              }
+            ] : []
+          ],
+          ...outputContractStopHook ? {
+            Stop: [
+              {
+                hooks: [outputContractStopHook]
+              }
+            ]
+          } : {}
         }
       };
       const additionalDirectories = new Set(opts.additionalDirectories ?? []);
@@ -3981,10 +4102,10 @@ async function runAgent(opts) {
         let timer;
         let next;
         if (turnTimeoutMs > 0) {
-          const timeoutPromise = new Promise((resolve20) => {
+          const timeoutPromise = new Promise((resolve21) => {
             timer = setTimeout(() => {
               timedOut = true;
-              resolve20({ done: true, value: void 0 });
+              resolve21({ done: true, value: void 0 });
             }, turnTimeoutMs);
           });
           next = await Promise.race([nextPromise, timeoutPromise]);
@@ -4000,7 +4121,7 @@ async function runAgent(opts) {
             try {
               await Promise.race([
                 iterator.return(void 0).catch(() => void 0),
-                new Promise((resolve20) => setTimeout(resolve20, 1e4).unref())
+                new Promise((resolve21) => setTimeout(resolve21, 1e4).unref())
               ]);
             } catch {
             }
@@ -4183,6 +4304,7 @@ var init_agent = __esm({
     init_claudeBinary();
     init_config();
     init_format();
+    init_outputContractHooks();
     init_runtimePaths();
     init_subagents();
     DEFAULT_ALLOWED_TOOLS = ["Bash", "Edit", "Read", "Write", "Glob", "Grep"];
@@ -4203,8 +4325,8 @@ var init_agent = __esm({
 });
 
 // src/agents.ts
-import * as fs11 from "fs";
-import * as path12 from "path";
+import * as fs12 from "fs";
+import * as path13 from "path";
 function stripFrontmatter(raw) {
   const match = /^---\n[\s\S]*?\n---\n?([\s\S]*)$/.exec(raw);
   return (match ? match[1] : raw).trim();
@@ -4213,8 +4335,8 @@ function loadAgentIdentity(cwd, slug, agentsDir = agentsRoot(cwd)) {
   const trimmed = slug.trim();
   if (!trimmed) throw new Error("loadAgentIdentity: empty agent slug");
   const agentPath = resolveAgentFile2(cwd, trimmed, agentsDir);
-  if (fs11.existsSync(agentPath)) {
-    const body = stripFrontmatter(fs11.readFileSync(agentPath, "utf-8"));
+  if (fs12.existsSync(agentPath)) {
+    const body = stripFrontmatter(fs12.readFileSync(agentPath, "utf-8"));
     if (body) return body;
     const builtinForEmpty = BUILTIN_AGENTS[trimmed];
     if (builtinForEmpty) return builtinForEmpty;
@@ -4225,8 +4347,8 @@ function loadAgentIdentity(cwd, slug, agentsDir = agentsRoot(cwd)) {
   throw new Error(`loadAgentIdentity: agent '${trimmed}' declared but ${agentPath} does not exist`);
 }
 function resolveAgentFile2(cwd, slug, agentsDir = agentsRoot(cwd)) {
-  const localPath = path12.resolve(cwd, agentsDir, `${slug}.md`);
-  if (fs11.existsSync(localPath)) return localPath;
+  const localPath = path13.resolve(cwd, agentsDir, `${slug}.md`);
+  if (fs12.existsSync(localPath)) return localPath;
   return localPath;
 }
 function frameAgentIdentity(slug, agent) {
@@ -4258,14 +4380,14 @@ var init_agents = __esm({
 });
 
 // src/task-artifacts.ts
-import fs12 from "fs";
-import path13 from "path";
+import fs13 from "fs";
+import path14 from "path";
 import posixPath from "path/posix";
 function prepareTaskArtifactsDir(cwd, taskId) {
   const safeId = String(taskId).replace(/[^a-zA-Z0-9._-]/g, "_");
   const absDir = runtimeStatePath(cwd, "task-artifacts", safeId);
   const relDir = absDir;
-  fs12.mkdirSync(absDir, { recursive: true });
+  fs13.mkdirSync(absDir, { recursive: true });
   return { taskId: safeId, absDir, relDir };
 }
 function initializeTaskArtifacts(artifacts, metadata = { taskType: "job" }) {
@@ -4295,16 +4417,16 @@ function initializeTaskArtifacts(artifacts, metadata = { taskType: "job" }) {
     "handoff-notes.md": "Baseline handoff: the agent did not provide additional notes.\n"
   };
   for (const file of TASK_ARTIFACT_FILES) {
-    const full = path13.join(artifacts.absDir, file);
-    if (!fs12.existsSync(full)) fs12.writeFileSync(full, defaults[file], "utf8");
+    const full = path14.join(artifacts.absDir, file);
+    if (!fs13.existsSync(full)) fs13.writeFileSync(full, defaults[file], "utf8");
   }
 }
 function verifyTaskArtifacts(absDir) {
   const missing = [];
   for (const name of TASK_ARTIFACT_FILES) {
-    const full = path13.join(absDir, name);
+    const full = path14.join(absDir, name);
     try {
-      const stat = fs12.statSync(full);
+      const stat = fs13.statSync(full);
       if (!stat.isFile() || stat.size === 0) missing.push(name);
     } catch {
       missing.push(name);
@@ -4320,11 +4442,11 @@ async function persistTaskArtifactsToState(config, _cwd, artifacts) {
   if (hasStateBackendConfig() && tenantId2) {
     const backend = createStateBackendFromEnv();
     for (const file of TASK_ARTIFACT_FILES) {
-      const full = path13.join(artifacts.absDir, file);
-      if (!fs12.existsSync(full)) continue;
-      const stat = fs12.statSync(full);
+      const full = path14.join(artifacts.absDir, file);
+      if (!fs13.existsSync(full)) continue;
+      const stat = fs13.statSync(full);
       if (!stat.isFile() || stat.size === 0) continue;
-      const content = fs12.readFileSync(full, "utf-8");
+      const content = fs13.readFileSync(full, "utf-8");
       const kind = file.replace(/\.(json|md)$/, "");
       let doc = content;
       if (file.endsWith(".json")) {
@@ -4624,15 +4746,15 @@ function validateWorkflow(value, options = {}) {
   }
   return issues;
 }
-function validateInputBindings(value, path54, issues, declaredInputs) {
+function validateInputBindings(value, path55, issues, declaredInputs) {
   if (value === void 0) return;
   const bindings = asRecord(value);
   if (!bindings || Object.keys(bindings).length === 0) {
-    issue(issues, "invalid_inputs", path54, "workflow step inputs must contain at least one named mapping");
+    issue(issues, "invalid_inputs", path55, "workflow step inputs must contain at least one named mapping");
     return;
   }
   for (const [name, value2] of Object.entries(bindings)) {
-    const bindingPath = `${path54}.${name}`;
+    const bindingPath = `${path55}.${name}`;
     if (!/^[A-Za-z_][A-Za-z0-9_-]*$/.test(name)) {
       issue(issues, "invalid_input_name", bindingPath, `workflow input name ${name} is invalid`);
     }
@@ -4651,7 +4773,7 @@ function validateInputBindings(value, path54, issues, declaredInputs) {
     }
   }
 }
-function validateInputBindingSources(value, path54, issues, capabilitiesByStep, capabilityOutputs) {
+function validateInputBindingSources(value, path55, issues, capabilitiesByStep, capabilityOutputs) {
   const bindings = asRecord(value);
   if (!bindings) return;
   for (const [name, rawBinding] of Object.entries(bindings)) {
@@ -4664,7 +4786,7 @@ function validateInputBindingSources(value, path54, issues, capabilitiesByStep,
       issue(
         issues,
         "missing_input_step",
-        `${path54}.${name}.from`,
+        `${path55}.${name}.from`,
         `workflow input mapping references missing step ${sourceStep ?? "<none>"}`
       );
       continue;
@@ -4675,7 +4797,7 @@ function validateInputBindingSources(value, path54, issues, capabilitiesByStep,
       issue(
         issues,
         "undeclared_step_output",
-        `${path54}.${name}.from`,
+        `${path55}.${name}.from`,
         `workflow input mapping reads ${outputPath}, but step ${sourceStep} does not declare it`
       );
     }
@@ -4684,11 +4806,11 @@ function validateInputBindingSources(value, path54, issues, capabilitiesByStep,
 function formatWorkflowValidationIssues(issues) {
   return issues.map((entry) => `${entry.path}: ${entry.message}`);
 }
-function validateDataMatch(value, path54, issues, capabilityOutputs) {
+function validateDataMatch(value, path55, issues, capabilityOutputs) {
   if (value === void 0) return;
   const match = asRecord(value);
   if (!match || Object.keys(match).length === 0) {
-    issue(issues, "invalid_condition", path54, "workflow condition must contain at least one match");
+    issue(issues, "invalid_condition", path55, "workflow condition must contain at least one match");
     return;
   }
   for (const [field, expected] of Object.entries(match)) {
@@ -4696,7 +4818,7 @@ function validateDataMatch(value, path54, issues, capabilityOutputs) {
       issue(
         issues,
         "invalid_data_path",
-        `${path54}.${field}`,
+        `${path55}.${field}`,
         `workflow condition must read from facts, evidence, artifacts, result, workflow, or lastOutcome`
       );
     }
@@ -4704,12 +4826,12 @@ function validateDataMatch(value, path54, issues, capabilityOutputs) {
       issue(
         issues,
         "undeclared_result_path",
-        `${path54}.${field}`,
+        `${path55}.${field}`,
         `workflow condition reads ${field}, but the source capability does not declare it`
       );
     }
     if (!isComparable(expected)) {
-      issue(issues, "invalid_condition_value", `${path54}.${field}`, "workflow condition value must be a JSON scalar");
+      issue(issues, "invalid_condition_value", `${path55}.${field}`, "workflow condition value must be a JSON scalar");
     }
   }
 }
@@ -4733,8 +4855,8 @@ function isJsonValue(value) {
   if (!value || typeof value !== "object") return false;
   return Object.values(value).every(isJsonValue);
 }
-function issue(issues, code, path54, message) {
-  issues.push({ code, path: path54, message });
+function issue(issues, code, path55, message) {
+  issues.push({ code, path: path55, message });
 }
 var SAFE_NAME, SAFE_STEP_ID, SAFE_DATA_PATH, SAFE_INPUT_SOURCE, SUPPORTED_STEP_FIELDS, SUPPORTED_TRANSITION_FIELDS;
 var init_workflowValidation = __esm({
@@ -4766,8 +4888,8 @@ var init_workflowValidation = __esm({
 });
 
 // src/workflowDefinitions.ts
-import * as fs18 from "fs";
-import * as path19 from "path";
+import * as fs19 from "fs";
+import * as path20 from "path";
 function isWorkflowDefinitionId(value) {
   return WORKFLOW_ID_PATTERN.test(value);
 }
@@ -4812,12 +4934,12 @@ function readWorkflowDefinition(_config, cwd, id) {
   const root = cwd ?? process.cwd();
   const relativePath = workflowDefinitionPath(id);
   const candidates = [
-    path19.join(root, ".kody-engine", "runtime", relativePath),
-    path19.join(definitionsRoot(root), relativePath)
+    path20.join(root, ".kody-engine", "runtime", relativePath),
+    path20.join(definitionsRoot(root), relativePath)
   ];
   for (const filePath of candidates) {
-    if (!fs18.existsSync(filePath)) continue;
-    const workflow = parseWorkflowDefinition(fs18.readFileSync(filePath, "utf8"));
+    if (!fs19.existsSync(filePath)) continue;
+    const workflow = parseWorkflowDefinition(fs19.readFileSync(filePath, "utf8"));
     if (workflow) return workflow;
   }
   return null;
@@ -4825,7 +4947,7 @@ function readWorkflowDefinition(_config, cwd, id) {
 function workflowDefinitionToCapabilityFolder(id, workflow, source = workflowDefinitionPath(id)) {
   return {
     slug: id,
-    dir: path19.dirname(source),
+    dir: path20.dirname(source),
     profilePath: source,
     bodyPath: source,
     title: workflow.name,
@@ -4881,7 +5003,7 @@ var init_workflowDefinitions = __esm({
 
 // src/gha.ts
 import { execFileSync as execFileSync2 } from "child_process";
-import * as fs21 from "fs";
+import * as fs22 from "fs";
 function getRunUrl() {
   const server = process.env.GITHUB_SERVER_URL;
   const repo = process.env.GITHUB_REPOSITORY;
@@ -4892,10 +5014,10 @@ function getRunUrl() {
 function reactToTriggerComment(cwd) {
   if (process.env.GITHUB_EVENT_NAME !== "issue_comment") return;
   const eventPath = process.env.GITHUB_EVENT_PATH;
-  if (!eventPath || !fs21.existsSync(eventPath)) return;
+  if (!eventPath || !fs22.existsSync(eventPath)) return;
   let event = null;
   try {
-    event = JSON.parse(fs21.readFileSync(eventPath, "utf-8"));
+    event = JSON.parse(fs22.readFileSync(eventPath, "utf-8"));
   } catch {
     return;
   }
@@ -5029,57 +5151,6 @@ var init_agencyBoundaryEval = __esm({
   }
 });
 
-// src/agency/capability-contract-validation.ts
-import Ajv from "ajv";
-function validateCapabilityContractValue(boundary, schema, value) {
-  const validate = validator.compile(schema);
-  if (!validate(value)) {
-    throw new CapabilityContractValidationError(boundary, validate.errors ?? []);
-  }
-}
-function capabilityContractInput(inputs, args, capabilityId, contractProperties = []) {
-  const isGenericRunnerInput = inputs.some((input) => input.name === "input") && Object.hasOwn(args, "input");
-  if (!isGenericRunnerInput) {
-    const isParameterlessGenericRunner = (inputs.some((input) => input.name === "capability") || args.capability === capabilityId || !contractProperties.includes("capability")) && Object.hasOwn(args, "capability");
-    if (!isParameterlessGenericRunner) return args;
-    const { capability: _routingCapability, ...businessArgs } = args;
-    return businessArgs;
-  }
-  const value = args.input;
-  if (typeof value !== "string") return value;
-  try {
-    return JSON.parse(value);
-  } catch {
-    return value;
-  }
-}
-var validator, CapabilityContractValidationError;
-var init_capability_contract_validation = __esm({
-  "src/agency/capability-contract-validation.ts"() {
-    "use strict";
-    validator = new Ajv({
-      allErrors: true,
-      strict: true,
-      validateFormats: false
-    });
-    CapabilityContractValidationError = class extends Error {
-      constructor(boundary, errors) {
-        const details = errors.map((error) => {
-          const location = error.instancePath || "$";
-          const property = error.keyword === "additionalProperties" && typeof error.params.additionalProperty === "string" ? ` (${error.params.additionalProperty})` : "";
-          return `${location}: ${error.message ?? error.keyword}${property}`;
-        }).join("; ");
-        super(`Capability ${boundary} does not match its declared contract: ${details}`);
-        this.boundary = boundary;
-        this.errors = errors;
-        this.name = "CapabilityContractValidationError";
-      }
-      boundary;
-      errors;
-    };
-  }
-});
-
 // src/capabilityReport.ts
 function parseCapabilityReportsFromText(text2) {
   const reports = [];
@@ -5476,15 +5547,15 @@ var init_lifecycles = __esm({
 
 // src/profile.ts
 import { createHash as createHash3 } from "crypto";
-import * as fs22 from "fs";
-import * as path21 from "path";
+import * as fs23 from "fs";
+import * as path22 from "path";
 function loadProfile(profilePath) {
-  if (!fs22.existsSync(profilePath)) {
+  if (!fs23.existsSync(profilePath)) {
     throw new ProfileError(profilePath, "file not found");
   }
   let raw;
   try {
-    raw = JSON.parse(fs22.readFileSync(profilePath, "utf-8"));
+    raw = JSON.parse(fs23.readFileSync(profilePath, "utf-8"));
   } catch (err) {
     throw new ProfileError(profilePath, `invalid JSON: ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -5496,7 +5567,7 @@ function loadProfile(profilePath) {
   const unknownKeys = Object.keys(r).filter((k) => !KNOWN_PROFILE_KEYS.has(k));
   if (unknownKeys.length > 0) {
     process.stderr.write(
-      `[kody profile] ${path21.basename(path21.dirname(profilePath))}: unknown top-level keys ignored: ${unknownKeys.join(", ")}
+      `[kody profile] ${path22.basename(path22.dirname(profilePath))}: unknown top-level keys ignored: ${unknownKeys.join(", ")}
 `
     );
   }
@@ -5506,7 +5577,7 @@ function loadProfile(profilePath) {
     if (!refPath) {
       throw new ProfileError(profilePath, `capability references unknown implementation '${execRef}'`);
     }
-    if (path21.resolve(refPath) === path21.resolve(profilePath)) {
+    if (path22.resolve(refPath) === path22.resolve(profilePath)) {
     } else {
       const base = loadProfile(refPath);
       return {
@@ -5604,8 +5675,8 @@ function loadProfile(profilePath) {
     // Phase 5 in-process handoff opt-in. Default false; containers
     // flip to true after end-to-end verification.
     preloadContext: r.preloadContext === true,
-    dir: path21.dirname(profilePath),
-    promptTemplates: readPromptTemplates(path21.dirname(profilePath))
+    dir: path22.dirname(profilePath),
+    promptTemplates: readPromptTemplates(path22.dirname(profilePath))
   };
   if (lifecycle) {
     applyLifecycle(profile, profilePath);
@@ -5640,19 +5711,19 @@ function loadProfile(profilePath) {
   return profile;
 }
 function compileRuntimeDocument(runtimePath, document) {
-  if (path21.basename(runtimePath) !== "runtime.json") return document;
+  if (path22.basename(runtimePath) !== "runtime.json") return document;
   if (document.adapter !== "kody-engine-profile") {
     throw new ProfileError(runtimePath, "unsupported runtime adapter document");
   }
-  const implementationDir = path21.dirname(runtimePath);
-  const implementation = readJsonObject(path21.join(implementationDir, "definition.json"), "Implementation definition");
-  const definitionsRoot2 = path21.dirname(path21.dirname(implementationDir));
+  const implementationDir = path22.dirname(runtimePath);
+  const implementation = readJsonObject(path22.join(implementationDir, "definition.json"), "Implementation definition");
+  const definitionsRoot2 = path22.dirname(path22.dirname(implementationDir));
   const capabilityId = implementation.capabilityRef && typeof implementation.capabilityRef === "object" && !Array.isArray(implementation.capabilityRef) ? implementation.capabilityRef.id : void 0;
   if (typeof capabilityId !== "string" || !capabilityId) {
     throw new ProfileError(runtimePath, "Implementation capabilityRef is invalid");
   }
   const capability = readJsonObject(
-    path21.join(definitionsRoot2, "capabilities", capabilityId, "definition.json"),
+    path22.join(definitionsRoot2, "capabilities", capabilityId, "definition.json"),
     "Capability definition"
   );
   const {
@@ -5691,7 +5762,7 @@ function canonical(value) {
 }
 function readJsonObject(filePath, label) {
   try {
-    const value = JSON.parse(fs22.readFileSync(filePath, "utf-8"));
+    const value = JSON.parse(fs23.readFileSync(filePath, "utf-8"));
     if (!value || typeof value !== "object" || Array.isArray(value)) {
       throw new Error("must be an object");
     }
@@ -5709,17 +5780,17 @@ function readPromptTemplates(dir) {
   const out = {};
   const read = (p) => {
     try {
-      out[p] = fs22.readFileSync(p, "utf-8");
+      out[p] = fs23.readFileSync(p, "utf-8");
     } catch {
     }
   };
-  read(path21.join(dir, "prompt.md"));
-  read(path21.join(dir, "capability.md"));
-  read(path21.join(dir, "capability.md"));
+  read(path22.join(dir, "prompt.md"));
+  read(path22.join(dir, "capability.md"));
+  read(path22.join(dir, "capability.md"));
   try {
-    const promptsDir = path21.join(dir, "prompts");
-    for (const ent of fs22.readdirSync(promptsDir)) {
-      if (ent.endsWith(".md")) read(path21.join(promptsDir, ent));
+    const promptsDir = path22.join(dir, "prompts");
+    for (const ent of fs23.readdirSync(promptsDir)) {
+      if (ent.endsWith(".md")) read(path22.join(promptsDir, ent));
     }
   } catch {
   }
@@ -5866,10 +5937,12 @@ function parseClaudeCode(p, raw) {
     throw new ProfileError(p, `claudeCode.permissionMode must be one of default|acceptEdits|plan|bypassPermissions`);
   }
   const tools = Array.isArray(r.tools) ? r.tools : [];
+  const disallowedTools = Array.isArray(r.disallowedTools) ? r.disallowedTools : [];
   return {
     model: typeof r.model === "string" ? r.model : "inherit",
     permissionMode,
     maxTurns: typeof r.maxTurns === "number" ? r.maxTurns : null,
+    disallowedTools,
     maxThinkingTokens: typeof r.maxThinkingTokens === "number" ? r.maxThinkingTokens : null,
     reasoningEffort: typeof r.reasoningEffort === "string" ? parseReasoningEffort(r.reasoningEffort) : null,
     maxTurnTimeoutSec: typeof r.maxTurnTimeoutSec === "number" ? r.maxTurnTimeoutSec : null,
@@ -6494,16 +6567,16 @@ var init_state = __esm({
 });
 
 // src/prompt.ts
-import * as fs23 from "fs";
-import * as path22 from "path";
+import * as fs24 from "fs";
+import * as path23 from "path";
 function loadProjectConventions(projectDir) {
   const out = [];
   for (const rel of CONVENTION_FILES) {
-    const abs = path22.join(projectDir, rel);
-    if (!fs23.existsSync(abs)) continue;
+    const abs = path23.join(projectDir, rel);
+    if (!fs24.existsSync(abs)) continue;
     let content;
     try {
-      content = fs23.readFileSync(abs, "utf-8");
+      content = fs24.readFileSync(abs, "utf-8");
     } catch {
       continue;
     }
@@ -6738,8 +6811,8 @@ var loadMemoryContext_exports = {};
 __export(loadMemoryContext_exports, {
   loadMemoryContext: () => loadMemoryContext
 });
-import * as fs24 from "fs";
-import * as path23 from "path";
+import * as fs25 from "fs";
+import * as path24 from "path";
 function formatBlockFromBackend(docs) {
   const pages = docs.flatMap((record2) => {
     if (!record2.doc || typeof record2.doc !== "object") return [];
@@ -6762,21 +6835,21 @@ function collectPages(memoryAbs) {
   walkMd(memoryAbs, (file) => {
     let stat;
     try {
-      stat = fs24.statSync(file);
+      stat = fs25.statSync(file);
     } catch {
       return;
     }
     let raw;
     try {
-      raw = fs24.readFileSync(file, "utf-8");
+      raw = fs25.readFileSync(file, "utf-8");
     } catch {
       return;
     }
     const fm = raw.match(/^---\s*\n([\s\S]*?)\n---/);
-    const title = fm?.[1]?.match(/^title:\s*(.+)$/m)?.[1]?.trim() ?? path23.basename(file, ".md");
+    const title = fm?.[1]?.match(/^title:\s*(.+)$/m)?.[1]?.trim() ?? path24.basename(file, ".md");
     const updated = fm?.[1]?.match(/^updated:\s*([0-9T:.+\-Z]+)/m)?.[1]?.trim() ?? "";
     out.push({
-      relPath: path23.relative(memoryAbs, file),
+      relPath: path24.relative(memoryAbs, file),
       title,
       updated,
       content: raw.length > PER_PAGE_MAX_BYTES ? raw.slice(0, PER_PAGE_MAX_BYTES) + TRUNCATED_SUFFIX2 : raw,
@@ -6844,16 +6917,16 @@ function walkMd(root, visit) {
     const dir = stack.pop();
     let names;
     try {
-      names = fs24.readdirSync(dir);
+      names = fs25.readdirSync(dir);
     } catch {
       continue;
     }
     for (const name of names) {
       if (name.startsWith(".")) continue;
-      const full = path23.join(dir, name);
+      const full = path24.join(dir, name);
       let stat;
       try {
-        stat = fs24.statSync(full);
+        stat = fs25.statSync(full);
       } catch {
         continue;
       }
@@ -6888,8 +6961,8 @@ var init_loadMemoryContext = __esm({
         }
         return;
       }
-      const memoryAbs = path23.join(ctx.cwd, MEMORY_DIR_RELATIVE);
-      if (!fs24.existsSync(memoryAbs)) {
+      const memoryAbs = path24.join(ctx.cwd, MEMORY_DIR_RELATIVE);
+      if (!fs25.existsSync(memoryAbs)) {
         ctx.data.memoryContext = "";
         return;
       }
@@ -6933,11 +7006,11 @@ var init_loadCoverageRules = __esm({
 
 // src/container.ts
 import { execFileSync as execFileSync3 } from "child_process";
-import * as fs25 from "fs";
+import * as fs26 from "fs";
 function getProfileInputsForChild(profileName, _cwd) {
   try {
     const profilePath = resolveProfilePath(profileName);
-    if (!fs25.existsSync(profilePath)) return null;
+    if (!fs26.existsSync(profilePath)) return null;
     return loadProfile(profilePath).inputs;
   } catch {
     return null;
@@ -7401,10 +7474,10 @@ var init_lifecycleLabels = __esm({
 
 // src/litellm.ts
 import { execFileSync as execFileSync4, spawn as spawn4 } from "child_process";
-import * as fs26 from "fs";
+import * as fs27 from "fs";
 import * as net from "net";
 import * as os4 from "os";
-import * as path24 from "path";
+import * as path25 from "path";
 async function checkLitellmHealth(url) {
   try {
     const response = await fetch(`${url}/health`, { signal: AbortSignal.timeout(3e3) });
@@ -7474,7 +7547,7 @@ function locateLitellmScript() {
 }
 function resolveLitellmCommand() {
   const imageScript = "/opt/venv/bin/litellm";
-  if (fs26.existsSync(imageScript)) return imageScript;
+  if (fs27.existsSync(imageScript)) return imageScript;
   try {
     execFileSync4("which", ["litellm"], { timeout: 3e3, stdio: "pipe" });
     return "litellm";
@@ -7517,13 +7590,13 @@ async function startLitellmIfNeeded(model, projectDir, url = LITELLM_DEFAULT_URL
   const spawnProxy = () => {
     const portMatch = activeUrl.match(/:(\d+)/);
     const port = portMatch ? portMatch[1] : "4000";
-    const configPath = path24.join(os4.tmpdir(), `kody-local-litellm-${Date.now()}.yaml`);
-    fs26.writeFileSync(configPath, generateLitellmConfigYaml(model));
+    const configPath = path25.join(os4.tmpdir(), `kody-local-litellm-${Date.now()}.yaml`);
+    fs27.writeFileSync(configPath, generateLitellmConfigYaml(model));
     const args = ["--config", configPath, "--port", port];
-    const nextLogPath = path24.join(os4.tmpdir(), `kody-local-litellm-${Date.now()}.log`);
-    const outFd = fs26.openSync(nextLogPath, "w");
+    const nextLogPath = path25.join(os4.tmpdir(), `kody-local-litellm-${Date.now()}.log`);
+    const outFd = fs27.openSync(nextLogPath, "w");
     child = spawn4(cmd, args, { stdio: ["ignore", outFd, outFd], detached: true, env: childEnv });
-    fs26.closeSync(outFd);
+    fs27.closeSync(outFd);
     logPath = nextLogPath;
   };
   const waitForHealth = async () => {
@@ -7537,7 +7610,7 @@ async function startLitellmIfNeeded(model, projectDir, url = LITELLM_DEFAULT_URL
   const readLogTail = () => {
     if (!logPath) return "";
     try {
-      return fs26.readFileSync(logPath, "utf-8").slice(-2e3);
+      return fs27.readFileSync(logPath, "utf-8").slice(-2e3);
     } catch {
       return "";
     }
@@ -7610,20 +7683,20 @@ async function nextAvailableLitellmUrl(url) {
   throw new Error(`no free LiteLLM port found after ${startPort}`);
 }
 function canListen(port, host) {
-  return new Promise((resolve20) => {
+  return new Promise((resolve21) => {
     const server = net.createServer();
-    server.once("error", () => resolve20(false));
+    server.once("error", () => resolve21(false));
     server.once("listening", () => {
-      server.close(() => resolve20(true));
+      server.close(() => resolve21(true));
     });
     server.listen(port, host);
   });
 }
 function readDotenvApiKeys(projectDir) {
-  const dotenvPath = path24.join(projectDir, ".env");
-  if (!fs26.existsSync(dotenvPath)) return {};
+  const dotenvPath = path25.join(projectDir, ".env");
+  if (!fs27.existsSync(dotenvPath)) return {};
   const result = {};
-  for (const rawLine of fs26.readFileSync(dotenvPath, "utf-8").split("\n")) {
+  for (const rawLine of fs27.readFileSync(dotenvPath, "utf-8").split("\n")) {
     const line = rawLine.trim();
     if (!line || line.startsWith("#")) continue;
     const match = line.match(/^([A-Z_][A-Z0-9_]*_API_KEY)=(.*)$/);
@@ -8282,8 +8355,8 @@ var init_pushWithRetry = __esm({
 
 // src/commit.ts
 import { execFileSync as execFileSync6 } from "child_process";
-import * as fs27 from "fs";
-import * as path25 from "path";
+import * as fs28 from "fs";
+import * as path26 from "path";
 function isGitHubYamlPath(filePath) {
   const normalized = filePath.replace(/^\.\/+/, "");
   return normalized.startsWith(".github/") && /\.ya?ml$/i.test(normalized);
@@ -8325,18 +8398,18 @@ function ensureGitIdentity(cwd) {
 }
 function abortUnfinishedGitOps(cwd) {
   const aborted = [];
-  const gitDir = path25.join(cwd ?? process.cwd(), ".git");
-  if (!fs27.existsSync(gitDir)) return aborted;
-  if (fs27.existsSync(path25.join(gitDir, "MERGE_HEAD"))) {
+  const gitDir = path26.join(cwd ?? process.cwd(), ".git");
+  if (!fs28.existsSync(gitDir)) return aborted;
+  if (fs28.existsSync(path26.join(gitDir, "MERGE_HEAD"))) {
     if (tryGit(["merge", "--abort"], cwd)) aborted.push("merge");
   }
-  if (fs27.existsSync(path25.join(gitDir, "CHERRY_PICK_HEAD"))) {
+  if (fs28.existsSync(path26.join(gitDir, "CHERRY_PICK_HEAD"))) {
     if (tryGit(["cherry-pick", "--abort"], cwd)) aborted.push("cherry-pick");
   }
-  if (fs27.existsSync(path25.join(gitDir, "REVERT_HEAD"))) {
+  if (fs28.existsSync(path26.join(gitDir, "REVERT_HEAD"))) {
     if (tryGit(["revert", "--abort"], cwd)) aborted.push("revert");
   }
-  if (fs27.existsSync(path25.join(gitDir, "rebase-merge")) || fs27.existsSync(path25.join(gitDir, "rebase-apply"))) {
+  if (fs28.existsSync(path26.join(gitDir, "rebase-merge")) || fs28.existsSync(path26.join(gitDir, "rebase-apply"))) {
     if (tryGit(["rebase", "--abort"], cwd)) aborted.push("rebase");
   }
   try {
@@ -8393,7 +8466,7 @@ function normalizeCommitMessage(raw) {
 function commitAndPush(branch, agentMessage, cwd) {
   const allChanged = listChangedFiles(cwd);
   const allowedFiles = allChanged.filter((f) => !isForbiddenPath(f));
-  const mergeHeadExists = fs27.existsSync(path25.join(cwd ?? process.cwd(), ".git", "MERGE_HEAD"));
+  const mergeHeadExists = fs28.existsSync(path26.join(cwd ?? process.cwd(), ".git", "MERGE_HEAD"));
   if (allowedFiles.length === 0 && !mergeHeadExists) {
     return { committed: false, pushed: false, sha: "", message: "" };
   }
@@ -9033,13 +9106,13 @@ var init_state2 = __esm({
 });
 
 // src/goal/runLog.ts
-import * as fs28 from "fs";
+import * as fs29 from "fs";
 function stageGoalRunLogEvent(data, goalId, event, at = nowIso()) {
   const logs = goalRunLogs(data);
   const existing = logs[goalId];
-  const path54 = existing?.path ?? goalRunLogPath(goalId, data);
+  const path55 = existing?.path ?? goalRunLogPath(goalId, data);
   logs[goalId] = {
-    path: path54,
+    path: path55,
     events: [...existing?.events ?? [], buildGoalRunLogEvent(data, goalId, event, at)]
   };
 }
@@ -9375,8 +9448,8 @@ function readGithubEvent() {
   const eventPath = process.env.GITHUB_EVENT_PATH;
   if (!eventPath) return null;
   try {
-    if (!fs28.existsSync(eventPath)) return null;
-    const parsed = JSON.parse(fs28.readFileSync(eventPath, "utf-8"));
+    if (!fs29.existsSync(eventPath)) return null;
+    const parsed = JSON.parse(fs29.readFileSync(eventPath, "utf-8"));
     return recordValue3(parsed);
   } catch {
     return null;
@@ -9486,8 +9559,8 @@ var init_stateStore = __esm({
 });
 
 // src/goal/targetLoopResolution.ts
-import * as fs29 from "fs";
-import * as path26 from "path";
+import * as fs30 from "fs";
+import * as path27 from "path";
 async function resolveActiveGoalLoopTarget(config, cwd, loopGoalId, loopGoal) {
   const targetId = loopGoal.loopTarget?.id.trim() ?? "";
   assertSafeGoalId(targetId, "loop target");
@@ -9565,11 +9638,11 @@ function goalInstanceTime(state) {
   return Number.isNaN(parsed) ? 0 : parsed;
 }
 function loadGoalTemplate(cwd, targetId) {
-  return readJsonObject2(path26.join(cwd, ".kody-engine", "definitions", "goals", targetId, "state.json"));
+  return readJsonObject2(path27.join(cwd, ".kody-engine", "definitions", "goals", targetId, "state.json"));
 }
 function readJsonObject2(filePath) {
-  if (!fs29.existsSync(filePath)) return null;
-  const parsed = JSON.parse(fs29.readFileSync(filePath, "utf8"));
+  if (!fs30.existsSync(filePath)) return null;
+  const parsed = JSON.parse(fs30.readFileSync(filePath, "utf8"));
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
     throw new Error(`goal template ${filePath} must be a JSON object`);
   }
@@ -9916,15 +9989,15 @@ var init_backendStateBackend = __esm({
         this.jobsDir = opts.jobsDir.replace(/\/+$/, "");
       }
       async load(slug) {
-        const path54 = stateFilePath(this.jobsDir, slug);
+        const path55 = stateFilePath(this.jobsDir, slug);
         const loaded = await createStateBackendFromEnv().get(this.tenantId, `capabilities/${slug}`, "job-state");
         if (!loaded) {
-          return { path: path54, handle: null, state: initialStateEnvelope("seed"), created: true };
+          return { path: path55, handle: null, state: initialStateEnvelope("seed"), created: true };
         }
         if (!isStateEnvelope(loaded.doc)) {
           throw new Error(`BackendStateBackend: capabilities/${slug} is not a StateEnvelope`);
         }
-        return { path: path54, handle: loaded.updatedAt, state: loaded.doc, created: false };
+        return { path: path55, handle: loaded.updatedAt, state: loaded.doc, created: false };
       }
       async save(loaded, next) {
         if (!loaded.created && isStateUnchanged(loaded.state, next)) return false;
@@ -9944,8 +10017,8 @@ var init_backendStateBackend = __esm({
 });
 
 // src/scripts/jobState/localFileBackend.ts
-import * as fs30 from "fs";
-import * as path27 from "path";
+import * as fs31 from "fs";
+import * as path28 from "path";
 function sanitizeKey(s) {
   return s.replace(/[^A-Za-z0-9._-]/g, "-");
 }
@@ -10001,7 +10074,7 @@ var init_localFileBackend = __esm({
         if (!opts.owner || !opts.repo) throw new Error("LocalFileBackend: owner and repo are required");
         this.cwd = opts.cwd;
         this.jobsDir = opts.jobsDir;
-        this.absDir = path27.resolve(opts.cwd, opts.jobsDir);
+        this.absDir = path28.resolve(opts.cwd, opts.jobsDir);
         this.owner = opts.owner;
         this.repo = opts.repo;
         this.cache = opts.cache ?? defaultCacheAdapter();
@@ -10016,7 +10089,7 @@ var init_localFileBackend = __esm({
 `);
           return;
         }
-        fs30.mkdirSync(this.absDir, { recursive: true });
+        fs31.mkdirSync(this.absDir, { recursive: true });
         const prefix = this.cacheKeyPrefix();
         const probeKey = `${prefix}probe-${Date.now()}`;
         try {
@@ -10045,7 +10118,7 @@ var init_localFileBackend = __esm({
 `);
           return;
         }
-        if (!fs30.existsSync(this.absDir)) {
+        if (!fs31.existsSync(this.absDir)) {
           return;
         }
         const key = `${this.cacheKeyPrefix()}${process.env.GITHUB_RUN_ID ?? "norunid"}-${Date.now()}`;
@@ -10061,11 +10134,11 @@ var init_localFileBackend = __esm({
       }
       load(slug) {
         const relPath = stateFilePath(this.jobsDir, slug);
-        const absPath = path27.resolve(this.cwd, relPath);
-        if (!fs30.existsSync(absPath)) {
+        const absPath = path28.resolve(this.cwd, relPath);
+        if (!fs31.existsSync(absPath)) {
           return { path: relPath, handle: null, state: initialStateEnvelope("seed"), created: true };
         }
-        const raw = fs30.readFileSync(absPath, "utf-8");
+        const raw = fs31.readFileSync(absPath, "utf-8");
         let parsed;
         try {
           parsed = JSON.parse(raw);
@@ -10082,13 +10155,13 @@ var init_localFileBackend = __esm({
         if (!loaded.created && isStateUnchanged(loaded.state, next)) {
           return false;
         }
-        const absPath = path27.resolve(this.cwd, loaded.path);
-        fs30.mkdirSync(path27.dirname(absPath), { recursive: true });
+        const absPath = path28.resolve(this.cwd, loaded.path);
+        fs31.mkdirSync(path28.dirname(absPath), { recursive: true });
         const body = `${JSON.stringify(next, null, 2)}
 `;
         const tmpPath = `${absPath}.${process.pid}.tmp`;
-        fs30.writeFileSync(tmpPath, body, "utf-8");
-        fs30.renameSync(tmpPath, absPath);
+        fs31.writeFileSync(tmpPath, body, "utf-8");
+        fs31.renameSync(tmpPath, absPath);
         return true;
       }
       cacheKeyPrefix() {
@@ -10120,7 +10193,7 @@ var init_jobState = __esm({
 });
 
 // src/scripts/goalCapabilityScheduling.ts
-import * as path28 from "path";
+import * as path29 from "path";
 function isCapabilityCadenceGoal(goal, extra) {
   return extra.scheduleMode === "agentLoop" || extra.scheduler === "agentLoop" || goal.type === "standing" && goal.capabilities.length > 0;
 }
@@ -10176,7 +10249,7 @@ function planTargetLoopSchedule(opts) {
 }
 async function planGoalCapabilitySchedule(opts) {
   const jobsDir = opts.jobsDir ?? capabilitiesRoot(opts.cwd);
-  const jobsRoot = path28.resolve(opts.cwd, jobsDir);
+  const jobsRoot = path29.resolve(opts.cwd, jobsDir);
   const now = opts.now ?? /* @__PURE__ */ new Date();
   const at = now.toISOString();
   const backend = resolveBackend({ config: opts.config, cwd: opts.cwd, jobsDir });
@@ -11992,8 +12065,8 @@ var init_classifyByLabel = __esm({
 
 // src/scripts/commitAndPush.ts
 import { createHash as createHash5 } from "crypto";
-import * as fs31 from "fs";
-import * as path29 from "path";
+import * as fs32 from "fs";
+import * as path30 from "path";
 function sentinelPathForStage(cwd, profileName, workflowExecutionKey) {
   const runId = resolveRunId();
   const executionSuffix = typeof workflowExecutionKey === "string" && workflowExecutionKey.length > 0 ? `-${createHash5("sha256").update(workflowExecutionKey).digest("hex").slice(0, 16)}` : "";
@@ -12015,9 +12088,9 @@ var init_commitAndPush = __esm({
       }
       const idempotencyEnabled = process.env.KODY_COMMIT_IDEMPOTENCY !== "0";
       const sentinel = idempotencyEnabled ? sentinelPathForStage(ctx.cwd, profile.name, ctx.data.workflowExecutionKey) : null;
-      if (sentinel && fs31.existsSync(sentinel)) {
+      if (sentinel && fs32.existsSync(sentinel)) {
         try {
-          const replay = JSON.parse(fs31.readFileSync(sentinel, "utf-8"));
+          const replay = JSON.parse(fs32.readFileSync(sentinel, "utf-8"));
           ctx.data.commitResult = replay.commitResult ?? { committed: false, pushed: false };
           if (Array.isArray(replay.changedFiles)) ctx.data.changedFiles = replay.changedFiles;
           if (typeof replay.hasCommitsAhead === "boolean") ctx.data.hasCommitsAhead = replay.hasCommitsAhead;
@@ -12077,8 +12150,8 @@ var init_commitAndPush = __esm({
       const result = ctx.data.commitResult;
       if (sentinel && result?.committed) {
         try {
-          fs31.mkdirSync(path29.dirname(sentinel), { recursive: true });
-          fs31.writeFileSync(
+          fs32.mkdirSync(path30.dirname(sentinel), { recursive: true });
+          fs32.writeFileSync(
             sentinel,
             JSON.stringify(
               {
@@ -12172,8 +12245,8 @@ var init_commitGoalState = __esm({
 });
 
 // src/scripts/composePrompt.ts
-import * as fs32 from "fs";
-import * as path30 from "path";
+import * as fs33 from "fs";
+import * as path31 from "path";
 function fenceUntrusted(value) {
   if (value.trim().length === 0) return value;
   const safe = value.replace(/-{3,}\s*END UNTRUSTED INPUT\s*-{3,}/gi, "[END UNTRUSTED INPUT]");
@@ -12297,10 +12370,10 @@ var init_composePrompt = __esm({
       const explicit = ctx.data.promptTemplate;
       const mode = ctx.args.mode;
       const candidates = [
-        explicit ? path30.join(profile.dir, explicit) : null,
-        mode ? path30.join(profile.dir, "prompts", `${mode}.md`) : null,
-        path30.join(profile.dir, "prompt.md"),
-        path30.join(profile.dir, "capability.md")
+        explicit ? path31.join(profile.dir, explicit) : null,
+        mode ? path31.join(profile.dir, "prompts", `${mode}.md`) : null,
+        path31.join(profile.dir, "prompt.md"),
+        path31.join(profile.dir, "capability.md")
       ].filter(Boolean);
       let templatePath = "";
       let template = "";
@@ -12313,7 +12386,7 @@ var init_composePrompt = __esm({
           break;
         }
         try {
-          template = fs32.readFileSync(c, "utf-8");
+          template = fs33.readFileSync(c, "utf-8");
           templatePath = c;
           break;
         } catch (err) {
@@ -12324,7 +12397,7 @@ var init_composePrompt = __esm({
       if (!templatePath) {
         let dirState;
         try {
-          dirState = `dir contents: [${fs32.readdirSync(profile.dir).join(", ")}]`;
+          dirState = `dir contents: [${fs33.readdirSync(profile.dir).join(", ")}]`;
         } catch (err) {
           dirState = `readdir(${profile.dir}) failed: ${err?.code ?? String(err)}`;
         }
@@ -13058,19 +13131,19 @@ var init_deriveQaScopeFromIssue = __esm({
 
 // src/scripts/diagMcp.ts
 import { execFileSync as execFileSync9 } from "child_process";
-import * as fs33 from "fs";
+import * as fs34 from "fs";
 import * as os5 from "os";
-import * as path31 from "path";
+import * as path32 from "path";
 var diagMcp;
 var init_diagMcp = __esm({
   "src/scripts/diagMcp.ts"() {
     "use strict";
     diagMcp = async (_ctx) => {
       const home = os5.homedir();
-      const cacheDir = path31.join(home, ".cache", "ms-playwright");
+      const cacheDir = path32.join(home, ".cache", "ms-playwright");
       let entries = [];
       try {
-        entries = fs33.readdirSync(cacheDir);
+        entries = fs34.readdirSync(cacheDir);
       } catch {
       }
       const hasChromium = entries.some((e) => e.startsWith("chromium"));
@@ -13098,13 +13171,13 @@ var init_diagMcp = __esm({
 });
 
 // src/scripts/frameworkDetectors.ts
-import * as fs34 from "fs";
-import * as path32 from "path";
+import * as fs35 from "fs";
+import * as path33 from "path";
 function detectFrameworks(cwd) {
   const out = [];
   let deps = {};
   try {
-    const pkg = JSON.parse(fs34.readFileSync(path32.join(cwd, "package.json"), "utf-8"));
+    const pkg = JSON.parse(fs35.readFileSync(path33.join(cwd, "package.json"), "utf-8"));
     deps = { ...pkg.dependencies, ...pkg.devDependencies };
   } catch {
     return out;
@@ -13141,25 +13214,25 @@ function detectFrameworks(cwd) {
 }
 function findFile(cwd, candidates) {
   for (const c of candidates) {
-    if (fs34.existsSync(path32.join(cwd, c))) return c;
+    if (fs35.existsSync(path33.join(cwd, c))) return c;
   }
   return null;
 }
 function discoverPayloadCollections(cwd) {
   const out = [];
   for (const dir of COLLECTION_DIRS) {
-    const full = path32.join(cwd, dir);
-    if (!fs34.existsSync(full)) continue;
+    const full = path33.join(cwd, dir);
+    if (!fs35.existsSync(full)) continue;
     let files;
     try {
-      files = fs34.readdirSync(full).filter((f) => f.endsWith(".ts") || f.endsWith(".tsx"));
+      files = fs35.readdirSync(full).filter((f) => f.endsWith(".ts") || f.endsWith(".tsx"));
     } catch {
       continue;
     }
     for (const file of files) {
       try {
-        const filePath = path32.join(full, file);
-        const content = fs34.readFileSync(filePath, "utf-8").slice(0, 1e4);
+        const filePath = path33.join(full, file);
+        const content = fs35.readFileSync(filePath, "utf-8").slice(0, 1e4);
         const slugMatch = content.match(/slug:\s*['"]([a-z0-9-]+)['"]/);
         if (!slugMatch) continue;
         const slug = slugMatch[1];
@@ -13173,7 +13246,7 @@ function discoverPayloadCollections(cwd) {
         out.push({
           name,
           slug,
-          filePath: path32.relative(cwd, filePath),
+          filePath: path33.relative(cwd, filePath),
           fields: fields.slice(0, 20),
           hasAdmin
         });
@@ -13186,28 +13259,28 @@ function discoverPayloadCollections(cwd) {
 function discoverAdminComponents(cwd, collections) {
   const out = [];
   for (const dir of ADMIN_COMPONENT_DIRS) {
-    const full = path32.join(cwd, dir);
-    if (!fs34.existsSync(full)) continue;
+    const full = path33.join(cwd, dir);
+    if (!fs35.existsSync(full)) continue;
     let entries;
     try {
-      entries = fs34.readdirSync(full, { withFileTypes: true });
+      entries = fs35.readdirSync(full, { withFileTypes: true });
     } catch {
       continue;
     }
     for (const entry of entries) {
-      const entryPath = path32.join(full, entry.name);
+      const entryPath = path33.join(full, entry.name);
       let name;
       let filePath;
       if (entry.isDirectory()) {
         const indexFile = ["index.tsx", "index.ts", "index.jsx", "index.js"].find(
-          (f) => fs34.existsSync(path32.join(entryPath, f))
+          (f) => fs35.existsSync(path33.join(entryPath, f))
         );
         if (!indexFile) continue;
         name = entry.name;
-        filePath = path32.relative(cwd, path32.join(entryPath, indexFile));
+        filePath = path33.relative(cwd, path33.join(entryPath, indexFile));
       } else if (/\.(tsx?|jsx?)$/.test(entry.name)) {
         name = entry.name.replace(/\.(tsx?|jsx?)$/, "");
-        filePath = path32.relative(cwd, entryPath);
+        filePath = path33.relative(cwd, entryPath);
       } else {
         continue;
       }
@@ -13215,7 +13288,7 @@ function discoverAdminComponents(cwd, collections) {
       if (collections) {
         for (const col of collections) {
           try {
-            const colContent = fs34.readFileSync(path32.join(cwd, col.filePath), "utf-8");
+            const colContent = fs35.readFileSync(path33.join(cwd, col.filePath), "utf-8");
             if (colContent.includes(name)) {
               usedInCollection = col.slug;
               break;
@@ -13233,8 +13306,8 @@ function scanApiRoutes(cwd) {
   const out = [];
   const appDirs = ["src/app", "app"];
   for (const appDir of appDirs) {
-    const apiDir = path32.join(cwd, appDir, "api");
-    if (!fs34.existsSync(apiDir)) continue;
+    const apiDir = path33.join(cwd, appDir, "api");
+    if (!fs35.existsSync(apiDir)) continue;
     walkApiRoutes(apiDir, "/api", cwd, out);
     break;
   }
@@ -13243,14 +13316,14 @@ function scanApiRoutes(cwd) {
 function walkApiRoutes(dir, prefix, cwd, out) {
   let entries;
   try {
-    entries = fs34.readdirSync(dir, { withFileTypes: true });
+    entries = fs35.readdirSync(dir, { withFileTypes: true });
   } catch {
     return;
   }
   const routeFile = entries.find((e) => e.isFile() && /^route\.(ts|js|tsx|jsx)$/.test(e.name));
   if (routeFile) {
     try {
-      const content = fs34.readFileSync(path32.join(dir, routeFile.name), "utf-8").slice(0, 5e3);
+      const content = fs35.readFileSync(path33.join(dir, routeFile.name), "utf-8").slice(0, 5e3);
       const methods = HTTP_METHODS.filter(
         (m) => new RegExp(`export\\s+(?:async\\s+)?function\\s+${m}\\b`).test(content)
       );
@@ -13258,7 +13331,7 @@ function walkApiRoutes(dir, prefix, cwd, out) {
         out.push({
           path: prefix,
           methods,
-          filePath: path32.relative(cwd, path32.join(dir, routeFile.name))
+          filePath: path33.relative(cwd, path33.join(dir, routeFile.name))
         });
       }
     } catch {
@@ -13269,7 +13342,7 @@ function walkApiRoutes(dir, prefix, cwd, out) {
     if (entry.name === "node_modules" || entry.name === ".next") continue;
     let segment = entry.name;
     if (segment.startsWith("(") && segment.endsWith(")")) {
-      walkApiRoutes(path32.join(dir, entry.name), prefix, cwd, out);
+      walkApiRoutes(path33.join(dir, entry.name), prefix, cwd, out);
       continue;
     }
     if (segment.startsWith("[[") && segment.endsWith("]]")) {
@@ -13277,16 +13350,16 @@ function walkApiRoutes(dir, prefix, cwd, out) {
     } else if (segment.startsWith("[") && segment.endsWith("]")) {
       segment = `:${segment.slice(1, -1)}`;
     }
-    walkApiRoutes(path32.join(dir, entry.name), `${prefix}/${segment}`, cwd, out);
+    walkApiRoutes(path33.join(dir, entry.name), `${prefix}/${segment}`, cwd, out);
   }
 }
 function scanEnvVars(cwd) {
   const candidates = [".env.example", ".env.local.example", ".env.template"];
   for (const envFile of candidates) {
-    const envPath = path32.join(cwd, envFile);
-    if (!fs34.existsSync(envPath)) continue;
+    const envPath = path33.join(cwd, envFile);
+    if (!fs35.existsSync(envPath)) continue;
     try {
-      const content = fs34.readFileSync(envPath, "utf-8");
+      const content = fs35.readFileSync(envPath, "utf-8");
       const vars = [];
       for (const line of content.split("\n")) {
         const trimmed = line.trim();
@@ -13331,8 +13404,8 @@ var init_frameworkDetectors = __esm({
 });
 
 // src/scripts/discoverQaContext.ts
-import * as fs35 from "fs";
-import * as path33 from "path";
+import * as fs36 from "fs";
+import * as path34 from "path";
 function runQaDiscovery(cwd) {
   const out = {
     routes: [],
@@ -13363,9 +13436,9 @@ function runQaDiscovery(cwd) {
 }
 function detectDevServer(cwd, out) {
   try {
-    const pkg = JSON.parse(fs35.readFileSync(path33.join(cwd, "package.json"), "utf-8"));
+    const pkg = JSON.parse(fs36.readFileSync(path34.join(cwd, "package.json"), "utf-8"));
     const allDeps = { ...pkg.dependencies, ...pkg.devDependencies };
-    const pm = fs35.existsSync(path33.join(cwd, "pnpm-lock.yaml")) ? "pnpm" : fs35.existsSync(path33.join(cwd, "yarn.lock")) ? "yarn" : fs35.existsSync(path33.join(cwd, "bun.lockb")) ? "bun" : "npm";
+    const pm = fs36.existsSync(path34.join(cwd, "pnpm-lock.yaml")) ? "pnpm" : fs36.existsSync(path34.join(cwd, "yarn.lock")) ? "yarn" : fs36.existsSync(path34.join(cwd, "bun.lockb")) ? "bun" : "npm";
     if (pkg.scripts?.dev) out.devCommand = `${pm} dev`;
     if (allDeps.next || allDeps.nuxt) out.devPort = 3e3;
     else if (allDeps.vite) out.devPort = 5173;
@@ -13375,8 +13448,8 @@ function detectDevServer(cwd, out) {
 function scanFrontendRoutes(cwd, out) {
   const appDirs = ["src/app", "app"];
   for (const appDir of appDirs) {
-    const full = path33.join(cwd, appDir);
-    if (!fs35.existsSync(full)) continue;
+    const full = path34.join(cwd, appDir);
+    if (!fs36.existsSync(full)) continue;
     walkFrontendRoutes(full, "", out);
     break;
   }
@@ -13384,7 +13457,7 @@ function scanFrontendRoutes(cwd, out) {
 function walkFrontendRoutes(dir, prefix, out) {
   let entries;
   try {
-    entries = fs35.readdirSync(dir, { withFileTypes: true });
+    entries = fs36.readdirSync(dir, { withFileTypes: true });
   } catch {
     return;
   }
@@ -13401,7 +13474,7 @@ function walkFrontendRoutes(dir, prefix, out) {
     if (entry.name === "node_modules" || entry.name === ".next") continue;
     let segment = entry.name;
     if (segment.startsWith("(") && segment.endsWith(")")) {
-      walkFrontendRoutes(path33.join(dir, entry.name), prefix, out);
+      walkFrontendRoutes(path34.join(dir, entry.name), prefix, out);
       continue;
     }
     if (segment.startsWith("[[") && segment.endsWith("]]")) {
@@ -13409,7 +13482,7 @@ function walkFrontendRoutes(dir, prefix, out) {
     } else if (segment.startsWith("[") && segment.endsWith("]")) {
       segment = `:${segment.slice(1, -1)}`;
     }
-    walkFrontendRoutes(path33.join(dir, entry.name), `${prefix}/${segment}`, out);
+    walkFrontendRoutes(path34.join(dir, entry.name), `${prefix}/${segment}`, out);
   }
 }
 function detectAuthFiles(cwd, out) {
@@ -13426,23 +13499,23 @@ function detectAuthFiles(cwd, out) {
     "src/app/api/oauth"
   ];
   for (const c of candidates) {
-    if (fs35.existsSync(path33.join(cwd, c))) out.authFiles.push(c);
+    if (fs36.existsSync(path34.join(cwd, c))) out.authFiles.push(c);
   }
 }
 function detectRoles(cwd, out) {
   const rolePaths = ["src/types", "src/lib", "src/utils", "src/constants", "src/access", "src/collections"];
   for (const rp of rolePaths) {
-    const dir = path33.join(cwd, rp);
-    if (!fs35.existsSync(dir)) continue;
+    const dir = path34.join(cwd, rp);
+    if (!fs36.existsSync(dir)) continue;
     let files;
     try {
-      files = fs35.readdirSync(dir).filter((f) => f.endsWith(".ts") || f.endsWith(".tsx"));
+      files = fs36.readdirSync(dir).filter((f) => f.endsWith(".ts") || f.endsWith(".tsx"));
     } catch {
       continue;
     }
     for (const f of files) {
       try {
-        const content = fs35.readFileSync(path33.join(dir, f), "utf-8").slice(0, 5e3);
+        const content = fs36.readFileSync(path34.join(dir, f), "utf-8").slice(0, 5e3);
         const roleMatches = content.match(/(?:role|Role|ROLE)\s*[=:]\s*['"](\w+)['"]/g);
         if (roleMatches) {
           for (const m of roleMatches) {
@@ -13703,8 +13776,8 @@ var init_dispatchClassified = __esm({
 });
 
 // src/loopDefinitions.ts
-import * as fs36 from "fs";
-import * as path34 from "path";
+import * as fs37 from "fs";
+import * as path35 from "path";
 function normalizeLoopDefinition(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) return null;
   const raw = value;
@@ -13731,10 +13804,10 @@ function readLoopDefinition(cwd, id) {
   if (!ID.test(id)) return null;
   const roots = loopRoots(cwd);
   for (const root of roots) {
-    const filePath = path34.join(root, "loops", id, "loop.json");
-    if (!fs36.existsSync(filePath)) continue;
+    const filePath = path35.join(root, "loops", id, "loop.json");
+    if (!fs37.existsSync(filePath)) continue;
     try {
-      const loop = normalizeLoopDefinition(JSON.parse(fs36.readFileSync(filePath, "utf8")));
+      const loop = normalizeLoopDefinition(JSON.parse(fs37.readFileSync(filePath, "utf8")));
       if (loop?.id === id) return loop;
       process.stderr.write(`[kody] invalid Loop definition: ${filePath}
 `);
@@ -13744,7 +13817,7 @@ function readLoopDefinition(cwd, id) {
     }
   }
   process.stderr.write(
-    `[kody] Loop not found: ${id} (${roots.map((root) => path34.join(root, "loops", id, "loop.json")).join(", ")})
+    `[kody] Loop not found: ${id} (${roots.map((root) => path35.join(root, "loops", id, "loop.json")).join(", ")})
 `
   );
   return null;
@@ -13753,14 +13826,14 @@ function listLoopDefinitions(cwd) {
   const roots = loopRoots(cwd);
   const byId = /* @__PURE__ */ new Map();
   for (const root of roots.reverse()) {
-    const loopsDir = path34.join(root, "loops");
-    if (!fs36.existsSync(loopsDir)) continue;
-    for (const id of fs36.readdirSync(loopsDir).sort()) {
+    const loopsDir = path35.join(root, "loops");
+    if (!fs37.existsSync(loopsDir)) continue;
+    for (const id of fs37.readdirSync(loopsDir).sort()) {
       if (!ID.test(id)) continue;
-      const filePath = path34.join(loopsDir, id, "loop.json");
-      if (!fs36.existsSync(filePath)) continue;
+      const filePath = path35.join(loopsDir, id, "loop.json");
+      if (!fs37.existsSync(filePath)) continue;
       try {
-        const loop = normalizeLoopDefinition(JSON.parse(fs36.readFileSync(filePath, "utf8")));
+        const loop = normalizeLoopDefinition(JSON.parse(fs37.readFileSync(filePath, "utf8")));
         if (loop?.id === id) byId.set(id, loop);
       } catch {
         process.stderr.write(`[kody] unreadable Loop definition: ${filePath}
@@ -13772,8 +13845,8 @@ function listLoopDefinitions(cwd) {
 }
 function loopRoots(cwd) {
   return [
-    path34.join(cwd, ".kody-engine", "runtime"),
-    path34.join(cwd, ".kody-engine", "definitions"),
+    path35.join(cwd, ".kody-engine", "runtime"),
+    path35.join(cwd, ".kody-engine", "definitions"),
     definitionsRoot(cwd)
   ].filter((root, index, roots) => roots.indexOf(root) === index);
 }
@@ -15051,15 +15124,15 @@ var init_fixFlow = __esm({
 });
 
 // src/workflow-template.ts
-import * as fs37 from "fs";
-import * as path35 from "path";
+import * as fs38 from "fs";
+import * as path36 from "path";
 import { fileURLToPath } from "url";
 function loadKodyWorkflowTemplate() {
-  const here = path35.dirname(fileURLToPath(import.meta.url));
-  const candidates = [path35.resolve(here, "../templates/kody.yml"), path35.resolve(here, "../../templates/kody.yml")];
-  const source = candidates.find((candidate) => fs37.existsSync(candidate));
+  const here = path36.dirname(fileURLToPath(import.meta.url));
+  const candidates = [path36.resolve(here, "../templates/kody.yml"), path36.resolve(here, "../../templates/kody.yml")];
+  const source = candidates.find((candidate) => fs38.existsSync(candidate));
   if (!source) throw new Error(`Kody workflow template is missing: ${KODY_WORKFLOW_TEMPLATE_PATH}`);
-  return fs37.readFileSync(source, "utf8");
+  return fs38.readFileSync(source, "utf8");
 }
 var KODY_WORKFLOW_TEMPLATE_PATH;
 var init_workflow_template = __esm({
@@ -15071,12 +15144,12 @@ var init_workflow_template = __esm({
 
 // src/scripts/initFlow.ts
 import { execFileSync as execFileSync14 } from "child_process";
-import * as fs38 from "fs";
-import * as path36 from "path";
+import * as fs39 from "fs";
+import * as path37 from "path";
 function detectPackageManager(cwd) {
-  if (fs38.existsSync(path36.join(cwd, "pnpm-lock.yaml"))) return "pnpm";
-  if (fs38.existsSync(path36.join(cwd, "yarn.lock"))) return "yarn";
-  if (fs38.existsSync(path36.join(cwd, "bun.lockb"))) return "bun";
+  if (fs39.existsSync(path37.join(cwd, "pnpm-lock.yaml"))) return "pnpm";
+  if (fs39.existsSync(path37.join(cwd, "yarn.lock"))) return "yarn";
+  if (fs39.existsSync(path37.join(cwd, "bun.lockb"))) return "bun";
   return "npm";
 }
 function qualityCommandsFor(pm) {
@@ -15148,22 +15221,22 @@ function performInit(cwd, force) {
   const pm = detectPackageManager(cwd);
   const ownerRepo = detectOwnerRepo(cwd);
   const defaultBranch = defaultBranchFromGit(cwd);
-  const configPath = path36.join(cwd, "kody.config.json");
-  if (fs38.existsSync(configPath) && !force) {
+  const configPath = path37.join(cwd, "kody.config.json");
+  if (fs39.existsSync(configPath) && !force) {
     skipped.push("kody.config.json");
   } else {
     const cfg = makeConfig(pm, ownerRepo, defaultBranch);
-    fs38.writeFileSync(configPath, `${JSON.stringify(cfg, null, 2)}
+    fs39.writeFileSync(configPath, `${JSON.stringify(cfg, null, 2)}
 `);
     wrote.push("kody.config.json");
   }
-  const workflowDir = path36.join(cwd, ".github", "workflows");
-  const workflowPath = path36.join(workflowDir, "kody.yml");
-  if (fs38.existsSync(workflowPath) && !force) {
+  const workflowDir = path37.join(cwd, ".github", "workflows");
+  const workflowPath = path37.join(workflowDir, "kody.yml");
+  if (fs39.existsSync(workflowPath) && !force) {
     skipped.push(".github/workflows/kody.yml");
   } else {
-    fs38.mkdirSync(workflowDir, { recursive: true });
-    fs38.writeFileSync(workflowPath, loadKodyWorkflowTemplate());
+    fs39.mkdirSync(workflowDir, { recursive: true });
+    fs39.writeFileSync(workflowPath, loadKodyWorkflowTemplate());
     wrote.push(".github/workflows/kody.yml");
   }
   let labels;
@@ -15214,7 +15287,7 @@ Nothing to do. All files already present. (Use --force to overwrite.)
 });
 
 // src/scripts/loadAgentAdhoc.ts
-import * as fs39 from "fs";
+import * as fs40 from "fs";
 function resolveMessage(messageArg) {
   const fromComment = readCommentBody();
   if (fromComment) return stripDirective(fromComment);
@@ -15222,9 +15295,9 @@ function resolveMessage(messageArg) {
 }
 function readCommentBody() {
   const eventPath = process.env.GITHUB_EVENT_PATH;
-  if (!eventPath || !fs39.existsSync(eventPath)) return "";
+  if (!eventPath || !fs40.existsSync(eventPath)) return "";
   try {
-    const event = JSON.parse(fs39.readFileSync(eventPath, "utf-8"));
+    const event = JSON.parse(fs40.readFileSync(eventPath, "utf-8"));
     return String(event.comment?.body ?? "");
   } catch {
     return "";
@@ -15278,10 +15351,10 @@ var init_loadAgentAdhoc = __esm({
         throw new Error("loadAgentAdhoc: ctx.args.agent must be a non-empty slug");
       }
       const agentPath = resolveAgentFile2(ctx.cwd, agentSlug, agentsDir);
-      if (!fs39.existsSync(agentPath)) {
+      if (!fs40.existsSync(agentPath)) {
         throw new Error(`loadAgentAdhoc: agent identity not found: ${agentPath}`);
       }
-      const { title, body } = parseAgentFile(fs39.readFileSync(agentPath, "utf-8"), agentSlug);
+      const { title, body } = parseAgentFile(fs40.readFileSync(agentPath, "utf-8"), agentSlug);
       const message = resolveMessage(ctx.args.message);
       if (!message) {
         throw new Error(
@@ -15353,13 +15426,13 @@ var init_loadCapabilityState = __esm({
 function isCompanyIntentId(value) {
   return SLUG_RE2.test(value);
 }
-function normalizeCompanyIntent(path54, raw) {
+function normalizeCompanyIntent(path55, raw) {
   if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
-    throw new Error(`${path54}: intent must be JSON object`);
+    throw new Error(`${path55}: intent must be JSON object`);
   }
   const input = raw;
   const id = stringField4(input.id);
-  if (!id || !isCompanyIntentId(id)) throw new Error(`${path54}: invalid intent id`);
+  if (!id || !isCompanyIntentId(id)) throw new Error(`${path55}: invalid intent id`);
   const createdAt = stringField4(input.createdAt) || nowIso();
   const updatedAt = stringField4(input.updatedAt) || createdAt;
   const description = stringField4(input.description);
@@ -15521,7 +15594,7 @@ function retryDelaysMs() {
 }
 function sleep(ms) {
   if (ms <= 0) return Promise.resolve();
-  return new Promise((resolve20) => setTimeout(resolve20, ms));
+  return new Promise((resolve21) => setTimeout(resolve21, ms));
 }
 async function fetchGoalStateWithRetry(config, goalId, cwd) {
   let state = await fetchGoalStateAsync(config, goalId, cwd);
@@ -15650,8 +15723,8 @@ var init_loadIssueStateComment = __esm({
 });
 
 // src/scripts/loadJobFromFile.ts
-import * as fs40 from "fs";
-import * as path37 from "path";
+import * as fs41 from "fs";
+import * as path38 from "path";
 function parseJobFile(raw, slug) {
   let stripped = raw;
   if (stripped.startsWith("---\n")) {
@@ -15690,10 +15763,10 @@ var init_loadJobFromFile = __esm({
       if (!slug) {
         throw new Error(`loadJobFromFile: ctx.args.${slugArg} must be a non-empty slug`);
       }
-      const capability = resolveCapabilityFolder(slug, path37.resolve(ctx.cwd, jobsDir));
+      const capability = resolveCapabilityFolder(slug, path38.resolve(ctx.cwd, jobsDir));
       if (!capability) {
         throw new Error(
-          `loadJobFromFile: capability folder not found or incomplete: ${path37.resolve(ctx.cwd, jobsDir, slug)}`
+          `loadJobFromFile: capability folder not found or incomplete: ${path38.resolve(ctx.cwd, jobsDir, slug)}`
         );
       }
       const { title, body, config } = capability;
@@ -15703,12 +15776,12 @@ var init_loadJobFromFile = __esm({
       let agentIdentity = "";
       if (agentSlug) {
         const agentPath = resolveAgentFile2(ctx.cwd, agentSlug, agentsDir);
-        if (!fs40.existsSync(agentPath)) {
+        if (!fs41.existsSync(agentPath)) {
           throw new Error(
             `loadJobFromFile: capability '${slug}' declares agent '${agentSlug}' but ${agentPath} does not exist`
           );
         }
-        const agentRaw = fs40.readFileSync(agentPath, "utf-8");
+        const agentRaw = fs41.readFileSync(agentPath, "utf-8");
         const parsed = parseJobFile(agentRaw, agentSlug);
         agentTitle = parsed.title;
         agentIdentity = parsed.body;
@@ -15788,13 +15861,13 @@ ${truncate2(issue2.body, FINDING_BODY_MAX_BYTES)}`;
 });
 
 // src/scripts/kodyVariables.ts
-import * as fs41 from "fs";
-import * as path38 from "path";
+import * as fs42 from "fs";
+import * as path39 from "path";
 function readKodyVariables(cwd) {
-  const full = path38.join(cwd, KODY_VARIABLES_REL_PATH);
+  const full = path39.join(cwd, KODY_VARIABLES_REL_PATH);
   let raw;
   try {
-    raw = fs41.readFileSync(full, "utf-8");
+    raw = fs42.readFileSync(full, "utf-8");
   } catch {
     return {};
   }
@@ -15819,8 +15892,8 @@ var init_kodyVariables = __esm({
 });
 
 // src/scripts/loadQaContext.ts
-import * as fs42 from "fs";
-import * as path39 from "path";
+import * as fs43 from "fs";
+import * as path40 from "path";
 function parseSlugList(value) {
   const inner = value.startsWith("[") && value.endsWith("]") ? value.slice(1, -1) : value;
   return inner.split(",").map(
@@ -15849,18 +15922,18 @@ function readProfileAgents(raw) {
   return { agent: agent ?? legacy ?? ["kody"], body };
 }
 function readProfile(cwd) {
-  const dir = path39.join(cwd, CONTEXT_DIR_REL_PATH);
-  if (!fs42.existsSync(dir)) return "";
+  const dir = path40.join(cwd, CONTEXT_DIR_REL_PATH);
+  if (!fs43.existsSync(dir)) return "";
   let entries;
   try {
-    entries = fs42.readdirSync(dir).filter((f) => f.endsWith(".md")).sort();
+    entries = fs43.readdirSync(dir).filter((f) => f.endsWith(".md")).sort();
   } catch {
     return "";
   }
   const blocks = [];
   for (const file of entries) {
     try {
-      const raw = fs42.readFileSync(path39.join(dir, file), "utf-8");
+      const raw = fs43.readFileSync(path40.join(dir, file), "utf-8");
       const { agent, body } = readProfileAgents(raw);
       if (!agent.includes(QA_AGENT) && !agent.includes(ALL_AGENTS)) continue;
       blocks.push(`## ${file}
@@ -15910,9 +15983,9 @@ var init_loadQaContext = __esm({
 
 // src/scripts/loadSimpleCapability.ts
 import { randomUUID as randomUUID2 } from "crypto";
-import * as fs43 from "fs";
+import * as fs44 from "fs";
 import * as os6 from "os";
-import * as path40 from "path";
+import * as path41 from "path";
 function registerCapabilitySubagents(profile, toolRoot, toolFiles) {
   const subagentFiles = toolFiles.flatMap((file) => {
     const match = /^agents\/([a-z][a-z0-9-]{0,63})\.md$/.exec(file);
@@ -15925,7 +15998,7 @@ function registerCapabilitySubagents(profile, toolRoot, toolFiles) {
   profile.subagentTemplates = {
     ...profile.subagentTemplates ?? {},
     ...Object.fromEntries(
-      subagentFiles.map(({ name, file }) => [name, fs43.readFileSync(path40.join(toolRoot, file), "utf-8")])
+      subagentFiles.map(({ name, file }) => [name, fs44.readFileSync(path41.join(toolRoot, file), "utf-8")])
     )
   };
   if (!profile.claudeCode.tools.includes("Agent")) {
@@ -15966,14 +16039,14 @@ function scalar(value) {
   return value;
 }
 function listFiles(root) {
-  if (!fs43.existsSync(root)) return [];
+  if (!fs44.existsSync(root)) return [];
   const files = [];
   const visit = (dir) => {
-    for (const entry of fs43.readdirSync(dir, { withFileTypes: true })) {
-      const absolute = path40.join(dir, entry.name);
+    for (const entry of fs44.readdirSync(dir, { withFileTypes: true })) {
+      const absolute = path41.join(dir, entry.name);
       if (entry.isSymbolicLink()) continue;
       if (entry.isDirectory()) visit(absolute);
-      else if (entry.isFile()) files.push(path40.relative(root, absolute));
+      else if (entry.isFile()) files.push(path41.relative(root, absolute));
     }
   };
   visit(root);
@@ -15996,8 +16069,8 @@ var init_loadSimpleCapability = __esm({
       if (!capability) {
         throw new Error(`Capability "${slug}" is not a valid simple capability folder`);
       }
-      const toolRoot = path40.join(capability.dir, "tools");
-      const skillRoot = path40.join(capability.dir, "skills");
+      const toolRoot = path41.join(capability.dir, "tools");
+      const skillRoot = path41.join(capability.dir, "skills");
       const toolFiles = listFiles(toolRoot);
       const skillFiles = listFiles(skillRoot);
       const parsedInput = parseInput(ctx.args.input);
@@ -16022,14 +16095,14 @@ var init_loadSimpleCapability = __esm({
       }
       if (requiredSubagents.length > 0) ctx.data.requiredSubagents = requiredSubagents;
       if (capability.contract?.execution === "script") {
-        ctx.data.capabilityScriptPath = path40.join(capability.dir, "tools", "run.sh");
+        ctx.data.capabilityScriptPath = path41.join(capability.dir, "tools", "run.sh");
         ctx.data.capabilitySecretNames = capability.contract.secrets ?? [];
         ctx.data.capabilityScriptTimeoutMs = capability.contract.timeoutMs;
       }
       if (capability.config.outputSchema) {
         ctx.data.capabilityOutputSchema = capability.config.outputSchema;
       }
-      const outputPath = ctx.data.capabilityExecution === "agent" && capability.config.outputSchema ? path40.join(os6.tmpdir(), `kody-capability-output-${randomUUID2()}.json`) : void 0;
+      const outputPath = ctx.data.capabilityExecution === "agent" && capability.config.outputSchema ? path41.join(os6.tmpdir(), `kody-capability-output-${randomUUID2()}.json`) : void 0;
       if (outputPath) ctx.data.capabilityOutputPath = outputPath;
       ctx.data.capabilityEnvironment = {
         ...capabilityInputEnvironment(input),
@@ -16052,7 +16125,7 @@ var init_loadSimpleCapability = __esm({
           ...skillFiles.flatMap((file) => [
             `### ${file}`,
             "",
-            fs43.readFileSync(path40.join(skillRoot, file), "utf-8"),
+            fs44.readFileSync(path41.join(skillRoot, file), "utf-8"),
             ""
           ])
         ] : [],
@@ -16061,7 +16134,7 @@ var init_loadSimpleCapability = __esm({
           "## Tools",
           "",
           "Inspect or run these capability-owned files when needed:",
-          ...toolFiles.map((file) => `- ${path40.join(toolRoot, file)}`)
+          ...toolFiles.map((file) => `- ${path41.join(toolRoot, file)}`)
         ] : [],
         "",
         ...capability.config.outputSchema ? [
@@ -16092,8 +16165,8 @@ var init_loadSimpleCapability = __esm({
 });
 
 // src/taskContext.ts
-import * as fs44 from "fs";
-import * as path41 from "path";
+import * as fs45 from "fs";
+import * as path42 from "path";
 function buildTaskContext(args) {
   return {
     schemaVersion: TASK_CONTEXT_SCHEMA_VERSION,
@@ -16109,9 +16182,9 @@ function buildTaskContext(args) {
 function persistTaskContext(cwd, ctx) {
   try {
     const dir = runtimeStatePath(cwd, "agent-runs", ctx.runId);
-    fs44.mkdirSync(dir, { recursive: true });
-    const file = path41.join(dir, "task-context.json");
-    fs44.writeFileSync(file, `${JSON.stringify(ctx, null, 2)}
+    fs45.mkdirSync(dir, { recursive: true });
+    const file = path42.join(dir, "task-context.json");
+    fs45.writeFileSync(file, `${JSON.stringify(ctx, null, 2)}
 `);
     return file;
   } catch (err) {
@@ -16538,19 +16611,19 @@ function parseAgencyModelProposal(raw) {
 function normalizeBundleFiles(bundle) {
   const seen = /* @__PURE__ */ new Set();
   return bundle.files.map((file, index) => {
-    const path54 = file.path.replace(/^\/+/, "");
-    const parts = path54.split("/");
-    if (!path54 || file.path.startsWith("/") || file.path.includes("\\") || parts.some((part) => !part || part === "." || part === "..")) {
+    const path55 = file.path.replace(/^\/+/, "");
+    const parts = path55.split("/");
+    if (!path55 || file.path.startsWith("/") || file.path.includes("\\") || parts.some((part) => !part || part === "." || part === "..")) {
       throw new Error(`openAgencyModelReviewPr: files[${index}].path is unsafe`);
     }
     if (!/^(agents\/[^/]+\.md|capabilities\/[^/]+\/.+|goals\/(?:templates\/)?[^/]+\/.+|workflows\/[^/]+\.json)$/.test(
-      path54
+      path55
     )) {
       throw new Error(`openAgencyModelReviewPr: files[${index}].path is not a supported definition path`);
     }
-    if (seen.has(path54)) throw new Error(`openAgencyModelReviewPr: duplicate generated file path: ${path54}`);
-    seen.add(path54);
-    return { path: path54, content: file.content.replace(/\r\n?/g, "\n") };
+    if (seen.has(path55)) throw new Error(`openAgencyModelReviewPr: duplicate generated file path: ${path55}`);
+    seen.add(path55);
+    return { path: path55, content: file.content.replace(/\r\n?/g, "\n") };
   });
 }
 function buildProposalId(issueNumber, bundle, sourceLabel) {
@@ -17032,16 +17105,16 @@ var init_parseReproOutput = __esm({
 });
 
 // src/scripts/parseSimpleCapabilityOutput.ts
-import * as fs45 from "fs";
+import * as fs46 from "fs";
 function stringList2(value) {
   return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
 }
 function readOutputFile(outputPath) {
-  if (!outputPath || !fs45.existsSync(outputPath)) return { found: false };
+  if (!outputPath || !fs46.existsSync(outputPath)) return { found: false };
   try {
-    return { found: true, value: JSON.parse(fs45.readFileSync(outputPath, "utf-8")) };
+    return { found: true, value: JSON.parse(fs46.readFileSync(outputPath, "utf-8")) };
   } finally {
-    fs45.rmSync(outputPath, { force: true });
+    fs46.rmSync(outputPath, { force: true });
   }
 }
 function parseOutput(text2) {
@@ -17660,9 +17733,9 @@ var init_postResearchComment = __esm({
 });
 
 // src/scripts/prepareBrowserAuth.ts
-import * as fs46 from "fs";
+import * as fs47 from "fs";
 import * as os7 from "os";
-import * as path42 from "path";
+import * as path43 from "path";
 function appendAuthMessage(ctx, message) {
   const current = typeof ctx.data.qaAuthBlock === "string" ? ctx.data.qaAuthBlock.trim() : "";
   ctx.data.qaAuthBlock = current ? `${current}
@@ -17701,9 +17774,9 @@ async function githubJson(url, token) {
   return await response.json();
 }
 function writeKodyStorageState(input) {
-  const directory = fs46.mkdtempSync(path42.join(os7.tmpdir(), "kody-browser-auth-"));
-  fs46.chmodSync(directory, 448);
-  const file = path42.join(directory, "storage-state.json");
+  const directory = fs47.mkdtempSync(path43.join(os7.tmpdir(), "kody-browser-auth-"));
+  fs47.chmodSync(directory, 448);
+  const file = path43.join(directory, "storage-state.json");
   const now = Date.now();
   const repoEntry = {
     repoUrl: input.repoUrl,
@@ -17733,7 +17806,7 @@ function writeKodyStorageState(input) {
       }
     ]
   };
-  fs46.writeFileSync(file, JSON.stringify(storageState), { mode: 384 });
+  fs47.writeFileSync(file, JSON.stringify(storageState), { mode: 384 });
   return { directory, file };
 }
 function configurePlaywright(profile, storageStatePath) {
@@ -17815,7 +17888,7 @@ async function prepareMethod(ctx, profile, method) {
     configurePlaywright(profile, state.file);
     const authDirectory = state.directory;
     registerRuntimeCleanup(ctx, () => {
-      fs46.rmSync(authDirectory, { recursive: true, force: true });
+      fs47.rmSync(authDirectory, { recursive: true, force: true });
     });
     appendAuthMessage(
       ctx,
@@ -17823,7 +17896,7 @@ async function prepareMethod(ctx, profile, method) {
     );
     return true;
   } catch (error) {
-    if (state) fs46.rmSync(state.directory, { recursive: true, force: true });
+    if (state) fs47.rmSync(state.directory, { recursive: true, force: true });
     const reason = error instanceof Error ? error.message : String(error);
     appendAuthMessage(
       ctx,
@@ -17962,7 +18035,7 @@ var init_prepareCapabilityDelivery = __esm({
 
 // src/scripts/prepareSimpleCapabilityRuntime.ts
 import { isIP } from "net";
-import * as path43 from "path";
+import * as path44 from "path";
 function requirementsFrom(ctx) {
   const raw = ctx.data.capabilityRequirements;
   return raw && typeof raw === "object" && !Array.isArray(raw) ? raw : {};
@@ -18006,7 +18079,7 @@ function browserRuntime(ctx, requirements) {
       "--allowed-origins",
       origin,
       "--output-dir",
-      path43.resolve(ctx.cwd, "test-results", "quality-runs", qualityRunId)
+      path44.resolve(ctx.cwd, "test-results", "quality-runs", qualityRunId)
     ]
   };
 }
@@ -18014,8 +18087,21 @@ function configureBrowser(ctx, profile, requirements) {
   const server = browserRuntime(ctx, requirements);
   if (requirements.browserOnly) {
     profile.claudeCode.tools = ["Write"];
+    profile.claudeCode.disallowedTools = [
+      "Agent",
+      "Bash",
+      "Edit",
+      "Glob",
+      "Grep",
+      "NotebookEdit",
+      "Read",
+      "Task",
+      "TodoWrite",
+      "WebFetch",
+      "WebSearch"
+    ];
     profile.claudeCode.permissionMode = "default";
-    profile.claudeCode.maxTurns = Math.min(profile.claudeCode.maxTurns ?? 50, 50);
+    profile.claudeCode.maxTurns = Math.min(profile.claudeCode.maxTurns ?? 100, 100);
   }
   if (!profile.claudeCode.tools.includes("mcp__playwright")) {
     profile.claudeCode.tools = [...profile.claudeCode.tools, "mcp__playwright"];
@@ -18358,9 +18444,9 @@ function latestResult(raw, agentResult) {
 function recordField4(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
-function resolveDotted(root, path54) {
-  if (!path54) return void 0;
-  return path54.split(".").reduce((value, key) => recordField4(value)?.[key], root);
+function resolveDotted(root, path55) {
+  if (!path55) return void 0;
+  return path55.split(".").reduce((value, key) => recordField4(value)?.[key], root);
 }
 function stringValue5(value) {
   return typeof value === "string" && value.trim() ? value.trim() : null;
@@ -19202,7 +19288,7 @@ var init_previewBuildHelpers = __esm({
 // src/scripts/previewBuildRun.ts
 import { spawn as spawn5 } from "child_process";
 async function runCmd(cmd, args, opts = {}) {
-  await new Promise((resolve20, reject) => {
+  await new Promise((resolve21, reject) => {
     const child = spawn5(cmd, args, {
       cwd: opts.cwd,
       env: { ...process.env, ...opts.env ?? {} },
@@ -19214,7 +19300,7 @@ async function runCmd(cmd, args, opts = {}) {
     }
     child.on("error", reject);
     child.on("close", (code) => {
-      if (code === 0) resolve20();
+      if (code === 0) resolve21();
       else reject(new Error(`${cmd} ${args.join(" ")} exited ${code}`));
     });
   });
@@ -19286,12 +19372,12 @@ fi
 
 // src/scripts/runPreviewBuild.ts
 import { copyFile, writeFile } from "fs/promises";
-import * as path44 from "path";
+import * as path45 from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 function bundledDockerfilePath(mode) {
-  const here = path44.dirname(fileURLToPath2(import.meta.url));
+  const here = path45.dirname(fileURLToPath2(import.meta.url));
   const file = mode === "dev" ? "default-Dockerfile.preview.dev" : "default-Dockerfile.preview.prod";
-  return path44.join(here, "preview-build-templates", file);
+  return path45.join(here, "preview-build-templates", file);
 }
 function required(name) {
   const v = (process.env[name] ?? "").trim();
@@ -19526,10 +19612,10 @@ var init_runPreviewBuild = __esm({
         console.log(`[preview-build] vault: ${Object.keys(buildEnv).length} secrets, mode=${buildMode}`);
         if (Object.keys(buildEnv).length > 0) {
           const lines = Object.entries(buildEnv).map(([k, v]) => `${k}=${JSON.stringify(v)}`);
-          await writeFile(path44.join(ctx.cwd, ".env.production.local"), `${lines.join("\n")}
+          await writeFile(path45.join(ctx.cwd, ".env.production.local"), `${lines.join("\n")}
 `, "utf8");
         }
-        const consumerDockerfile = path44.join(ctx.cwd, "Dockerfile.preview");
+        const consumerDockerfile = path45.join(ctx.cwd, "Dockerfile.preview");
         const { stat } = await import("fs/promises");
         let hasConsumerDockerfile = false;
         try {
@@ -19713,8 +19799,8 @@ var init_tickShellRunner = __esm({
 });
 
 // src/scripts/runScheduledImplementationTick.ts
-import * as fs47 from "fs";
-import * as path45 from "path";
+import * as fs48 from "fs";
+import * as path46 from "path";
 var runScheduledImplementationTick;
 var init_runScheduledImplementationTick = __esm({
   "src/scripts/runScheduledImplementationTick.ts"() {
@@ -19735,14 +19821,14 @@ var init_runScheduledImplementationTick = __esm({
         ctx.output.reason = `runScheduledImplementationTick: args.slug or ctx.args.${slugArg} must be non-empty capability slug`;
         return;
       }
-      const capability = resolveCapabilityFolder(slug, path45.resolve(ctx.cwd, jobsDir));
+      const capability = resolveCapabilityFolder(slug, path46.resolve(ctx.cwd, jobsDir));
       if (!capability) {
         ctx.output.exitCode = 99;
         ctx.output.reason = `runScheduledImplementationTick: capability folder not found or incomplete: ${slug} (searched ${jobsDir} and company store)`;
         return;
       }
-      const shellPath = path45.join(profile.dir, shell);
-      if (!fs47.existsSync(shellPath)) {
+      const shellPath = path46.join(profile.dir, shell);
+      if (!fs48.existsSync(shellPath)) {
         ctx.output.exitCode = 99;
         ctx.output.reason = `runScheduledImplementationTick: shell not found: ${shell} (looked in ${profile.dir})`;
         return;
@@ -19774,13 +19860,13 @@ var init_runScheduledImplementationTick = __esm({
 
 // src/scripts/runSimpleCapabilityScript.ts
 import { spawnSync as spawnSync3 } from "child_process";
-import * as fs48 from "fs";
+import * as fs49 from "fs";
 function formatDuration2(timeoutMs) {
   return timeoutMs % 6e4 === 0 ? `${timeoutMs / 6e4} minutes` : `${timeoutMs}ms`;
 }
 function isRegularFile2(filePath) {
   try {
-    const stat = fs48.lstatSync(filePath);
+    const stat = fs49.lstatSync(filePath);
     return stat.isFile() && !stat.isSymbolicLink();
   } catch {
     return false;
@@ -19859,8 +19945,8 @@ var init_runSimpleCapabilityScript = __esm({
 });
 
 // src/scripts/runTickScript.ts
-import * as fs49 from "fs";
-import * as path46 from "path";
+import * as fs50 from "fs";
+import * as path47 from "path";
 var runTickScript;
 var init_runTickScript = __esm({
   "src/scripts/runTickScript.ts"() {
@@ -19880,10 +19966,10 @@ var init_runTickScript = __esm({
         ctx.output.reason = `runTickScript: ctx.args.${slugArg} must be a non-empty slug`;
         return;
       }
-      const capability = readCapabilityFolder(path46.resolve(ctx.cwd, jobsDir), slug);
+      const capability = readCapabilityFolder(path47.resolve(ctx.cwd, jobsDir), slug);
       if (!capability) {
         ctx.output.exitCode = 99;
-        ctx.output.reason = `runTickScript: capability folder not found or incomplete: ${path46.resolve(ctx.cwd, jobsDir, slug)}`;
+        ctx.output.reason = `runTickScript: capability folder not found or incomplete: ${path47.resolve(ctx.cwd, jobsDir, slug)}`;
         return;
       }
       const tickScript = capability.config.tickScript;
@@ -19892,8 +19978,8 @@ var init_runTickScript = __esm({
         ctx.output.reason = `runTickScript: capability ${slug} has no \`tickScript\` in profile.json \u2014 route via capability-tick instead`;
         return;
       }
-      const scriptPath = path46.isAbsolute(tickScript) ? tickScript : path46.join(ctx.cwd, tickScript);
-      if (!fs49.existsSync(scriptPath)) {
+      const scriptPath = path47.isAbsolute(tickScript) ? tickScript : path47.join(ctx.cwd, tickScript);
+      if (!fs50.existsSync(scriptPath)) {
         ctx.output.exitCode = 99;
         ctx.output.reason = `runTickScript: tickScript not found: ${scriptPath}`;
         return;
@@ -20175,7 +20261,7 @@ var init_syncFlow = __esm({
 });
 
 // src/scripts/validateAgencyModelProposal.ts
-import * as path47 from "path";
+import * as path48 from "path";
 function validateModelBundle(bundle, expectedKind, options = {}) {
   const failures = [];
   validateOneModel(bundle.model, bundle.files, "model", true, failures, expectedKind, options);
@@ -20493,7 +20579,7 @@ var init_validateAgencyModelProposal = __esm({
       const bundle = parseAgencyModelProposal(raw);
       const expectedKind = readExpectedModelKind(args);
       const failures = validateModelBundle(bundle, expectedKind, {
-        capabilityRoot: path47.join(ctx.cwd, ".kody", "capabilities")
+        capabilityRoot: path48.join(ctx.cwd, ".kody", "capabilities")
       });
       if (failures.length > 0) {
         throw new Error(`validateAgencyModelProposal: ${failures.join("; ")}`);
@@ -20556,7 +20642,7 @@ function stripAnsi2(s) {
   return s.replace(ANSI_RE2, "");
 }
 function runCommand2(command, cwd) {
-  return new Promise((resolve20) => {
+  return new Promise((resolve21) => {
     const child = spawn6(command, {
       cwd,
       shell: true,
@@ -20583,11 +20669,11 @@ function runCommand2(command, cwd) {
     }, TEST_TIMEOUT_MS);
     child.on("exit", (code) => {
       clearTimeout(timer);
-      resolve20({ exitCode: code ?? -1, output: Buffer.concat(buffers).toString("utf-8") });
+      resolve21({ exitCode: code ?? -1, output: Buffer.concat(buffers).toString("utf-8") });
     });
     child.on("error", (err) => {
       clearTimeout(timer);
-      resolve20({ exitCode: -1, output: err.message });
+      resolve21({ exitCode: -1, output: err.message });
     });
   });
 }
@@ -20993,21 +21079,21 @@ function lineStream(stream) {
     tryDeliver();
   });
   return {
-    next: (timeoutMs) => new Promise((resolve20) => {
+    next: (timeoutMs) => new Promise((resolve21) => {
       if (queue.length > 0) {
-        resolve20(queue.shift());
+        resolve21(queue.shift());
         return;
       }
       if (ended) {
-        resolve20(null);
+        resolve21(null);
         return;
       }
-      waiter = resolve20;
+      waiter = resolve21;
       const t = setTimeout(
         () => {
-          if (waiter === resolve20) {
+          if (waiter === resolve21) {
             waiter = null;
-            resolve20(null);
+            resolve21(null);
           }
         },
         Math.max(0, timeoutMs)
@@ -21044,7 +21130,7 @@ var init_warmupMcp = __esm({
 });
 
 // src/scripts/writeAgentRunSummary.ts
-import * as fs50 from "fs";
+import * as fs51 from "fs";
 var writeAgentRunSummary;
 var init_writeAgentRunSummary = __esm({
   "src/scripts/writeAgentRunSummary.ts"() {
@@ -21070,7 +21156,7 @@ var init_writeAgentRunSummary = __esm({
       if (reason) lines.push(`- **Reason:** ${reason}`);
       lines.push("");
       try {
-        fs50.appendFileSync(summaryPath, `${lines.join("\n")}
+        fs51.appendFileSync(summaryPath, `${lines.join("\n")}
 `);
       } catch {
       }
@@ -21408,17 +21494,17 @@ var init_scripts = __esm({
 });
 
 // src/stateWorkspace.ts
-import * as fs51 from "fs";
-import * as path48 from "path";
+import * as fs52 from "fs";
+import * as path49 from "path";
 function tenantId(config) {
   const owner = config.github?.owner?.trim() || process.env.GITHUB_REPOSITORY?.split("/")[0]?.trim();
   const repo = config.github?.repo?.trim() || process.env.GITHUB_REPOSITORY?.split("/")[1]?.trim();
   return owner && repo ? `${owner}/${repo}` : null;
 }
 function writeRuntimeFile(cwd, relativePath, content) {
-  const target = path48.join(cwd, RUNTIME_ROOT, relativePath);
-  fs51.mkdirSync(path48.dirname(target), { recursive: true });
-  fs51.writeFileSync(target, content, "utf8");
+  const target = path49.join(cwd, RUNTIME_ROOT, relativePath);
+  fs52.mkdirSync(path49.dirname(target), { recursive: true });
+  fs52.writeFileSync(target, content, "utf8");
 }
 function record(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : null;
@@ -21483,11 +21569,11 @@ async function hydrateStateWorkspace(config, cwd, backendOverride) {
       throw new Error("Kody backend access is required for runtime workspace documents");
     return;
   }
-  const key = `${path48.resolve(cwd)}|${tenant}`;
+  const key = `${path49.resolve(cwd)}|${tenant}`;
   if (hydratedWorkspaces.has(key)) return;
   const backend = backendOverride ?? createStateBackendFromEnv();
-  const root = path48.join(cwd, RUNTIME_ROOT);
-  fs51.rmSync(root, { recursive: true, force: true });
+  const root = path49.join(cwd, RUNTIME_ROOT);
+  fs52.rmSync(root, { recursive: true, force: true });
   await Promise.all([
     hydratePrefix(backend, tenant, cwd, "context:"),
     hydratePrefix(backend, tenant, cwd, "memory:"),
@@ -21503,7 +21589,7 @@ var init_stateWorkspace = __esm({
   "src/stateWorkspace.ts"() {
     "use strict";
     init_state_backend();
-    RUNTIME_ROOT = path48.join(".kody-engine", "runtime");
+    RUNTIME_ROOT = path49.join(".kody-engine", "runtime");
     hydratedWorkspaces = /* @__PURE__ */ new Set();
   }
 });
@@ -21574,9 +21660,9 @@ var init_tools = __esm({
 
 // src/executor.ts
 import { spawn as spawn8 } from "child_process";
-import * as fs52 from "fs";
+import * as fs53 from "fs";
 import * as os8 from "os";
-import * as path49 from "path";
+import * as path50 from "path";
 function isMutatingPostflight(scriptName) {
   return MUTATING_POSTFLIGHTS.has(scriptName ?? "");
 }
@@ -21828,7 +21914,7 @@ async function runImplementation(profileName, input) {
   const jobWhyBlock = typeof ctx.data.jobWhy === "string" ? operatorRequestBlock(ctx.data.jobWhy) : null;
   const jobRefBlock = jobReferenceBlock(profileName, profile, ctx.data);
   const invokeAgent = async (prompt) => {
-    const externalPlugins = (profile.claudeCode.plugins ?? []).map((p) => path49.isAbsolute(p) ? p : path49.resolve(profile.dir, p)).filter((p) => p.length > 0);
+    const externalPlugins = (profile.claudeCode.plugins ?? []).map((p) => path50.isAbsolute(p) ? p : path50.resolve(profile.dir, p)).filter((p) => p.length > 0);
     const syntheticPath = ctx.data.syntheticPluginPath;
     const pluginPaths = [...externalPlugins, ...syntheticPath ? [syntheticPath] : []];
     const agents = loadSubagents(profile);
@@ -21870,6 +21956,7 @@ async function runImplementation(profileName, input) {
       ndjsonDir,
       additionalDirectories: agentTaskArtifacts ? [agentTaskArtifacts.absDir] : void 0,
       allowedToolsOverride: profile.claudeCode.tools,
+      disallowedToolsOverride: profile.claudeCode.disallowedTools,
       permissionModeOverride: profile.claudeCode.permissionMode,
       mcpServers: profile.claudeCode.mcpServers.length > 0 ? profile.claudeCode.mcpServers : void 0,
       pluginPaths: pluginPaths.length > 0 ? pluginPaths : void 0,
@@ -21908,7 +21995,11 @@ async function runImplementation(profileName, input) {
       verifyToolMaxAttempts: profile.claudeCode.verifyAttempts ?? null,
       verifyConfig: profile.claudeCode.enableVerifyTool ? config : void 0,
       implementationName: profileName,
-      settingSources: profile.claudeCode.settingSources
+      settingSources: profile.claudeCode.settingSources,
+      outputContract: typeof ctx.data.capabilityOutputPath === "string" && ctx.data.capabilityOutputSchema && typeof ctx.data.capabilityOutputSchema === "object" && !Array.isArray(ctx.data.capabilityOutputSchema) ? {
+        path: ctx.data.capabilityOutputPath,
+        schema: ctx.data.capabilityOutputSchema
+      } : void 0
     });
   };
   ctx.data.__invokeAgent = invokeAgent;
@@ -22304,17 +22395,17 @@ function clearStampedLifecycleLabels(profile, ctx) {
 function resolveProfilePath(profileName, cwd = process.cwd()) {
   const found = resolveImplementation(profileName, getRuntimeProfileRootsForCwd(cwd));
   if (found) return found;
-  const here = path49.dirname(new URL(import.meta.url).pathname);
+  const here = path50.dirname(new URL(import.meta.url).pathname);
   const candidates = [
-    path49.join(here, "implementations", profileName, "profile.json"),
+    path50.join(here, "implementations", profileName, "profile.json"),
     // same-dir sibling (dev)
-    path49.join(here, "..", "implementations", profileName, "profile.json"),
+    path50.join(here, "..", "implementations", profileName, "profile.json"),
     // up one (prod: dist/bin → dist/implementations)
-    path49.join(here, "..", "src", "implementations", profileName, "profile.json")
+    path50.join(here, "..", "src", "implementations", profileName, "profile.json")
     // fallback
   ];
   for (const c of candidates) {
-    if (fs52.existsSync(c)) return c;
+    if (fs53.existsSync(c)) return c;
   }
   return candidates[0];
 }
@@ -22429,15 +22520,15 @@ function resolveShellTimeoutMs(entry) {
 }
 async function runShellEntry(entry, ctx, profile) {
   const shellName = entry.shell;
-  const shellPath = path49.join(profile.dir, shellName);
-  if (!fs52.existsSync(shellPath)) {
+  const shellPath = path50.join(profile.dir, shellName);
+  if (!fs53.existsSync(shellPath)) {
     ctx.skipAgent = true;
     ctx.output.exitCode = 99;
     ctx.output.reason = `shell script not found: ${shellName} (looked in ${profile.dir})`;
     return;
   }
   const positional = entry.with ? Object.values(entry.with).map((v) => String(v)) : [];
-  const outputFile = path49.join(
+  const outputFile = path50.join(
     os8.tmpdir(),
     `kody-shell-output-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`
   );
@@ -22467,14 +22558,14 @@ async function runShellEntry(entry, ctx, profile) {
   let killTimer;
   let escalateTimer;
   const result = await new Promise(
-    (resolve20) => {
+    (resolve21) => {
       let settled = false;
       const settle = (code, signal, spawnErr) => {
         if (settled) return;
         settled = true;
         if (killTimer) clearTimeout(killTimer);
         if (escalateTimer) clearTimeout(escalateTimer);
-        resolve20({ code, signal, spawnErr });
+        resolve21({ code, signal, spawnErr });
       };
       child.on("error", (err) => settle(null, null, err));
       child.on("close", (code, signal) => settle(code, signal));
@@ -22504,9 +22595,9 @@ async function runShellEntry(entry, ctx, profile) {
   }
   let sideChannelText = "";
   try {
-    if (fs52.existsSync(outputFile)) {
-      sideChannelText = fs52.readFileSync(outputFile, "utf-8");
-      fs52.rmSync(outputFile, { force: true });
+    if (fs53.existsSync(outputFile)) {
+      sideChannelText = fs53.readFileSync(outputFile, "utf-8");
+      fs53.rmSync(outputFile, { force: true });
     }
   } catch {
   }
@@ -23362,11 +23453,11 @@ function exhaustedWorkflowTransitions(step, data, counts) {
 }
 function workflowResultConditionPaths(transitions) {
   return transitions.flatMap(
-    (transition) => Object.keys(transition.when ?? {}).filter((path54) => path54.startsWith("result."))
+    (transition) => Object.keys(transition.when ?? {}).filter((path55) => path55.startsWith("result."))
   );
 }
 function conditionMatches(condition, context) {
-  return Object.entries(condition).every(([path54, expected]) => valueMatches(resolveDottedPath2(context, path54), expected));
+  return Object.entries(condition).every(([path55, expected]) => valueMatches(resolveDottedPath2(context, path55), expected));
 }
 function withWorkflowBoundaryEval(capability, result) {
   const capabilityKind = capability.config.capabilityKind;
@@ -23803,7 +23894,7 @@ function translateOpenAISseToBrain(opts) {
 
 // src/servers/brain-serve.ts
 import { createServer as createServer2 } from "http";
-import * as path52 from "path";
+import * as path53 from "path";
 
 // src/chat/loop.ts
 init_agent();
@@ -23811,13 +23902,13 @@ init_agents();
 init_config();
 init_registry();
 init_task_artifacts();
-import * as fs16 from "fs";
-import * as path17 from "path";
+import * as fs17 from "fs";
+import * as path18 from "path";
 
 // src/chat/attachments.ts
 init_runtimePaths();
-import * as fs13 from "fs";
-import * as path14 from "path";
+import * as fs14 from "fs";
+import * as path15 from "path";
 var INLINE_ATTACHMENT_RE = /(?:\[(?:Image|File): ([^\]]*)\]\n)?data:([\w.+-]+\/[\w.+-]+);base64,([A-Za-z0-9+/=]+)/g;
 var EXT_BY_MIME = {
   "image/png": "png",
@@ -23850,11 +23941,11 @@ function prepareAttachments(turns, cwd, sessionId) {
         if (!isImage) return `[File: ${name}]`;
         try {
           if (!dirEnsured) {
-            fs13.mkdirSync(dir, { recursive: true });
+            fs14.mkdirSync(dir, { recursive: true });
             dirEnsured = true;
           }
-          const filePath = path14.join(dir, `${imageCounter}.${extFor(mime)}`);
-          fs13.writeFileSync(filePath, Buffer.from(data, "base64"));
+          const filePath = path15.join(dir, `${imageCounter}.${extFor(mime)}`);
+          fs14.writeFileSync(filePath, Buffer.from(data, "base64"));
           imageCounter += 1;
           imagePaths.push(filePath);
           return `[Image "${name}" is attached \u2014 saved to ${filePath}. Use the Read tool on that exact path to view it.]`;
@@ -23871,8 +23962,8 @@ function prepareAttachments(turns, cwd, sessionId) {
 
 // src/chat/codex-app-server.ts
 import { spawn as spawn3 } from "child_process";
-import * as fs14 from "fs";
-import * as path15 from "path";
+import * as fs15 from "fs";
+import * as path16 from "path";
 import { createInterface } from "readline";
 function codexThreadStartParams(args) {
   return {
@@ -23957,9 +24048,9 @@ var CodexAppServerClient = class {
     await this.request("thread/resume", { threadId });
   }
   async runTurn(args) {
-    await new Promise((resolve20, reject) => {
+    await new Promise((resolve21, reject) => {
       this.process.turnWaiters.set(args.threadId, {
-        resolve: resolve20,
+        resolve: resolve21,
         reject,
         onNotification: args.onNotification,
         queue: Promise.resolve()
@@ -23976,8 +24067,8 @@ var CodexAppServerClient = class {
   }
   request(method, params) {
     const id = this.process.nextId++;
-    return new Promise((resolve20, reject) => {
-      this.process.pending.set(id, { resolve: resolve20, reject });
+    return new Promise((resolve21, reject) => {
+      this.process.pending.set(id, { resolve: resolve21, reject });
       this.process.child.stdin.write(`${JSON.stringify({ method, id, params })}
 `);
     });
@@ -24043,11 +24134,11 @@ var CodexAppServerClient = class {
 };
 var clients = /* @__PURE__ */ new Map();
 function threadMapPath(cwd) {
-  return path15.join(cwd, ".kody-engine", "runtime", "codex-threads.json");
+  return path16.join(cwd, ".kody-engine", "runtime", "codex-threads.json");
 }
 function readThreadMap(cwd) {
   try {
-    const value = JSON.parse(fs14.readFileSync(threadMapPath(cwd), "utf8"));
+    const value = JSON.parse(fs15.readFileSync(threadMapPath(cwd), "utf8"));
     if (!value || typeof value !== "object" || Array.isArray(value)) return {};
     return Object.fromEntries(
       Object.entries(value).filter(
@@ -24060,8 +24151,8 @@ function readThreadMap(cwd) {
 }
 function writeThreadMap(cwd, map) {
   const file = threadMapPath(cwd);
-  fs14.mkdirSync(path15.dirname(file), { recursive: true });
-  fs14.writeFileSync(file, `${JSON.stringify(map, null, 2)}
+  fs15.mkdirSync(path16.dirname(file), { recursive: true });
+  fs15.writeFileSync(file, `${JSON.stringify(map, null, 2)}
 `);
 }
 async function runCodexChatTurn(args) {
@@ -24151,8 +24242,8 @@ async function runCodexChatTurn(args) {
 }
 
 // src/chat/events.ts
-import * as fs15 from "fs";
-import * as path16 from "path";
+import * as fs16 from "fs";
+import * as path17 from "path";
 import posixPath2 from "path/posix";
 var BackendEventSink = class {
   constructor(append, tenantId2, sessionId) {
@@ -24168,7 +24259,7 @@ var BackendEventSink = class {
   }
 };
 function eventsFilePath(cwd, sessionId) {
-  return path16.join(cwd, ".kody-engine", "runtime", "events", `${sessionId}.jsonl`);
+  return path17.join(cwd, ".kody-engine", "runtime", "events", `${sessionId}.jsonl`);
 }
 var FileSink = class {
   constructor(file) {
@@ -24176,8 +24267,8 @@ var FileSink = class {
   }
   file;
   async emit(event) {
-    fs15.mkdirSync(path16.dirname(this.file), { recursive: true });
-    fs15.appendFileSync(this.file, `${JSON.stringify(event)}
+    fs16.mkdirSync(path17.dirname(this.file), { recursive: true });
+    fs16.appendFileSync(this.file, `${JSON.stringify(event)}
 `);
   }
 };
@@ -24442,7 +24533,7 @@ function buildImplementationCatalog() {
   const entries = [];
   for (const { name, profilePath } of discovered) {
     try {
-      const raw = JSON.parse(fs16.readFileSync(profilePath, "utf-8"));
+      const raw = JSON.parse(fs17.readFileSync(profilePath, "utf-8"));
       const describe = typeof raw.describe === "string" ? raw.describe : "";
       const firstSentence = describe.split(/(?<=[.!?])\s+/, 1)[0] ?? "";
       entries.push({ name, describe: firstSentence.trim() });
@@ -24564,7 +24655,7 @@ async function runChatTurn(opts) {
     quiet: opts.quiet,
     additionalDirectories: [
       taskArtifactsPaths.absDir,
-      ...Array.from(new Set(imagePaths.map((p2) => path17.dirname(p2))))
+      ...Array.from(new Set(imagePaths.map((p2) => path18.dirname(p2))))
     ],
     systemPromptAppend: systemPrompt,
     ...opts.reasoningEffort ? { reasoningEffort: opts.reasoningEffort } : {},
@@ -24752,10 +24843,10 @@ async function emit(sink, type, sessionId, suffix, payload) {
 var MEMORY_INDEX_REL = ".kody-engine/runtime/memory/INDEX.md";
 var MAX_INDEX_BYTES = 8e3;
 function readMemoryIndexBlock(cwd) {
-  const indexPath = path17.join(cwd, MEMORY_INDEX_REL);
+  const indexPath = path18.join(cwd, MEMORY_INDEX_REL);
   let raw;
   try {
-    raw = fs16.readFileSync(indexPath, "utf-8");
+    raw = fs17.readFileSync(indexPath, "utf-8");
   } catch {
     return "";
   }
@@ -24775,17 +24866,17 @@ _\u2026 (memory index truncated; use recall_search to read more)_` : trimmed;
 var CONTEXT_DIR_REL = ".kody-engine/runtime/context";
 var MAX_CONTEXT_BYTES = 12e3;
 function readContextBlock(cwd) {
-  const dir = path17.join(cwd, CONTEXT_DIR_REL);
+  const dir = path18.join(cwd, CONTEXT_DIR_REL);
   let files;
   try {
-    files = fs16.readdirSync(dir).filter((f) => f.endsWith(".md")).sort();
+    files = fs17.readdirSync(dir).filter((f) => f.endsWith(".md")).sort();
   } catch {
     return "";
   }
   const sections = [];
   for (const file of files) {
     try {
-      const content = fs16.readFileSync(path17.join(dir, file), "utf-8").trim();
+      const content = fs17.readFileSync(path18.join(dir, file), "utf-8").trim();
       if (content) sections.push(`### ${file.replace(/\.md$/, "")}
 
 ${content}`);
@@ -24811,7 +24902,7 @@ var SYSTEM_PROMPT_OVERRIDE_REL = ".kody-engine/runtime/system-prompt.md";
 function readSystemPromptOverride(cwd) {
   let raw;
   try {
-    raw = fs16.readFileSync(path17.join(cwd, SYSTEM_PROMPT_OVERRIDE_REL), "utf-8");
+    raw = fs17.readFileSync(path18.join(cwd, SYSTEM_PROMPT_OVERRIDE_REL), "utf-8");
   } catch {
     return null;
   }
@@ -24819,10 +24910,10 @@ function readSystemPromptOverride(cwd) {
   return trimmed.length > 0 ? trimmed : null;
 }
 function readInstructionsBlock(cwd) {
-  const instructionsPath = path17.join(cwd, INSTRUCTIONS_REL);
+  const instructionsPath = path18.join(cwd, INSTRUCTIONS_REL);
   let raw;
   try {
-    raw = fs16.readFileSync(instructionsPath, "utf-8");
+    raw = fs17.readFileSync(instructionsPath, "utf-8");
   } catch {
     return "";
   }
@@ -24856,15 +24947,15 @@ function resolveBrainDriver(runtime) {
 }
 
 // src/chat/session.ts
-import * as fs17 from "fs";
-import * as path18 from "path";
+import * as fs18 from "fs";
+import * as path19 from "path";
 import posixPath3 from "path/posix";
 function sessionFilePath(cwd, sessionId) {
-  return path18.join(cwd, ".kody-engine", "runtime", "sessions", `${sessionId}.jsonl`);
+  return path19.join(cwd, ".kody-engine", "runtime", "sessions", `${sessionId}.jsonl`);
 }
 function readSession(file) {
-  if (!fs17.existsSync(file)) return [];
-  const raw = fs17.readFileSync(file, "utf-8").trim();
+  if (!fs18.existsSync(file)) return [];
+  const raw = fs18.readFileSync(file, "utf-8").trim();
   if (!raw) return [];
   const turns = [];
   for (const line of raw.split("\n")) {
@@ -24887,8 +24978,8 @@ init_config();
 init_state_backend();
 init_workflowDefinitions();
 import { createHash as createHash2 } from "crypto";
-import * as fs19 from "fs";
-import * as path20 from "path";
+import * as fs20 from "fs";
+import * as path21 from "path";
 var SLUG_RE = /^[a-z0-9][a-z0-9_-]{0,127}$/;
 var REPOSITORY_OWNED_NAMESPACES = ["loops"];
 function assertSafeDefinitionPath(filePath) {
@@ -24920,9 +25011,9 @@ function verifyDefinition(definition) {
 }
 function writeBundle(root, bundle) {
   for (const [filePath, contents] of Object.entries(bundle.files)) {
-    const target = path20.join(root, filePath);
-    fs19.mkdirSync(path20.dirname(target), { recursive: true });
-    fs19.writeFileSync(target, contents, "utf8");
+    const target = path21.join(root, filePath);
+    fs20.mkdirSync(path21.dirname(target), { recursive: true });
+    fs20.writeFileSync(target, contents, "utf8");
   }
 }
 function writeDefinition(root, kind, definition) {
@@ -24930,22 +25021,22 @@ function writeDefinition(root, kind, definition) {
   if (kind === "agent") {
     const raw = bundle.files["agent.md"];
     if (typeof raw !== "string") throw new Error(`agent definition ${definition.slug} is missing agent.md`);
-    fs19.writeFileSync(path20.join(root, "agents", `${definition.slug}.md`), raw, "utf8");
+    fs20.writeFileSync(path21.join(root, "agents", `${definition.slug}.md`), raw, "utf8");
     return;
   }
   if (kind === "goal") {
-    writeBundle(path20.join(root, "goals", definition.slug), bundle);
+    writeBundle(path21.join(root, "goals", definition.slug), bundle);
     return;
   }
   if (kind === "implementation") {
-    writeBundle(path20.join(root, "implementations", definition.slug), bundle);
+    writeBundle(path21.join(root, "implementations", definition.slug), bundle);
     return;
   }
   if (kind === "asset") {
-    writeBundle(path20.join(root, "shared"), bundle);
+    writeBundle(path21.join(root, "shared"), bundle);
     return;
   }
-  writeBundle(path20.join(root, "capabilities", definition.slug), bundle);
+  writeBundle(path21.join(root, "capabilities", definition.slug), bundle);
 }
 function writeWorkflow(root, document) {
   const workflow = normalizeWorkflowDefinition(document.definition);
@@ -24953,28 +25044,28 @@ function writeWorkflow(root, document) {
   const contents = `${JSON.stringify(workflow, null, 2)}
 `;
   const bundle = { schemaVersion: 1, files: { "workflow.json": contents } };
-  const target = path20.join(root, workflowDefinitionPath(document.workflowId));
-  fs19.mkdirSync(path20.dirname(target), { recursive: true });
-  fs19.writeFileSync(target, contents, "utf8");
+  const target = path21.join(root, workflowDefinitionPath(document.workflowId));
+  fs20.mkdirSync(path21.dirname(target), { recursive: true });
+  fs20.writeFileSync(target, contents, "utf8");
   return definitionVersion(bundle);
 }
 function preserveRepositoryDefinitions(root, staging) {
   for (const namespace of REPOSITORY_OWNED_NAMESPACES) {
-    const source = path20.join(root, namespace);
-    if (!fs19.existsSync(source)) continue;
-    fs19.cpSync(source, path20.join(staging, namespace), { recursive: true });
+    const source = path21.join(root, namespace);
+    if (!fs20.existsSync(source)) continue;
+    fs20.cpSync(source, path21.join(staging, namespace), { recursive: true });
   }
 }
 async function hydrateDefinitions(options) {
-  const root = path20.join(options.cwd, ".kody-engine", "definitions");
+  const root = path21.join(options.cwd, ".kody-engine", "definitions");
   const staging = `${root}.tmp-${process.pid}-${Date.now()}`;
-  fs19.rmSync(staging, { recursive: true, force: true });
-  fs19.mkdirSync(path20.join(staging, "agents"), { recursive: true });
-  fs19.mkdirSync(path20.join(staging, "capabilities"), { recursive: true });
-  fs19.mkdirSync(path20.join(staging, "goals"), { recursive: true });
-  fs19.mkdirSync(path20.join(staging, "implementations"), { recursive: true });
-  fs19.mkdirSync(path20.join(staging, "shared"), { recursive: true });
-  fs19.mkdirSync(path20.join(staging, "workflows"), { recursive: true });
+  fs20.rmSync(staging, { recursive: true, force: true });
+  fs20.mkdirSync(path21.join(staging, "agents"), { recursive: true });
+  fs20.mkdirSync(path21.join(staging, "capabilities"), { recursive: true });
+  fs20.mkdirSync(path21.join(staging, "goals"), { recursive: true });
+  fs20.mkdirSync(path21.join(staging, "implementations"), { recursive: true });
+  fs20.mkdirSync(path21.join(staging, "shared"), { recursive: true });
+  fs20.mkdirSync(path21.join(staging, "workflows"), { recursive: true });
   try {
     const [capabilities, agents, goals, implementations, assets, workflows] = await Promise.all([
       options.backend.listDefinitions(options.tenantId, "capability"),
@@ -25015,13 +25106,13 @@ async function hydrateDefinitions(options) {
       hydratedAt: (/* @__PURE__ */ new Date()).toISOString(),
       versions: Object.fromEntries(Object.entries(versions).sort(([left], [right]) => left.localeCompare(right)))
     };
-    fs19.writeFileSync(path20.join(staging, "manifest.json"), `${JSON.stringify(manifest, null, 2)}
+    fs20.writeFileSync(path21.join(staging, "manifest.json"), `${JSON.stringify(manifest, null, 2)}
 `, "utf8");
-    fs19.rmSync(root, { recursive: true, force: true });
-    fs19.renameSync(staging, root);
+    fs20.rmSync(root, { recursive: true, force: true });
+    fs20.renameSync(staging, root);
     return { root, tenantId: options.tenantId, versions: manifest.versions };
   } catch (error) {
-    fs19.rmSync(staging, { recursive: true, force: true });
+    fs20.rmSync(staging, { recursive: true, force: true });
     throw error;
   }
 }
@@ -25043,8 +25134,8 @@ async function hydrateDefinitionsFromEnv(cwd = process.cwd(), env = process.env)
 
 // src/kody-cli.ts
 import { execFileSync as execFileSync24 } from "child_process";
-import * as fs53 from "fs";
-import * as path50 from "path";
+import * as fs54 from "fs";
+import * as path51 from "path";
 
 // src/app-auth.ts
 import { createSign } from "crypto";
@@ -25173,7 +25264,7 @@ init_definition_paths();
 
 // src/dispatch.ts
 init_config();
-import * as fs20 from "fs";
+import * as fs21 from "fs";
 
 // src/cron-match.ts
 var FIELD_BOUNDS = [
@@ -25280,10 +25371,10 @@ function autoDispatch(opts) {
   }
   const eventName = process.env.GITHUB_EVENT_NAME;
   const eventPath = process.env.GITHUB_EVENT_PATH;
-  if (!eventName || !eventPath || !fs20.existsSync(eventPath)) return null;
+  if (!eventName || !eventPath || !fs21.existsSync(eventPath)) return null;
   let event = {};
   try {
-    event = JSON.parse(fs20.readFileSync(eventPath, "utf-8"));
+    event = JSON.parse(fs21.readFileSync(eventPath, "utf-8"));
   } catch {
     return null;
   }
@@ -25407,7 +25498,7 @@ function autoDispatchTyped(opts) {
   if (legacy) return { kind: "route", ...legacy };
   const eventName = process.env.GITHUB_EVENT_NAME;
   const eventPath = process.env.GITHUB_EVENT_PATH;
-  if (!eventName || !eventPath || !fs20.existsSync(eventPath)) {
+  if (!eventName || !eventPath || !fs21.existsSync(eventPath)) {
     return { kind: "silent", reason: "no GHA event context" };
   }
   if (eventName !== "issue_comment") {
@@ -25415,7 +25506,7 @@ function autoDispatchTyped(opts) {
   }
   let event = {};
   try {
-    event = JSON.parse(fs20.readFileSync(eventPath, "utf-8"));
+    event = JSON.parse(fs21.readFileSync(eventPath, "utf-8"));
   } catch {
     return { kind: "silent", reason: "GHA event payload unreadable" };
   }
@@ -25469,7 +25560,7 @@ function dispatchScheduledWatches(opts) {
   for (const exe of listRuntimeProfilesForCwd(opts?.cwd ?? process.cwd())) {
     let raw;
     try {
-      raw = fs20.readFileSync(exe.profilePath, "utf-8");
+      raw = fs21.readFileSync(exe.profilePath, "utf-8");
     } catch {
       continue;
     }
@@ -25846,9 +25937,9 @@ async function resolveAuthToken(env = process.env) {
   return void 0;
 }
 function detectPackageManager2(cwd) {
-  if (fs53.existsSync(path50.join(cwd, "pnpm-lock.yaml"))) return "pnpm";
-  if (fs53.existsSync(path50.join(cwd, "yarn.lock"))) return "yarn";
-  if (fs53.existsSync(path50.join(cwd, "bun.lockb"))) return "bun";
+  if (fs54.existsSync(path51.join(cwd, "pnpm-lock.yaml"))) return "pnpm";
+  if (fs54.existsSync(path51.join(cwd, "yarn.lock"))) return "yarn";
+  if (fs54.existsSync(path51.join(cwd, "bun.lockb"))) return "bun";
   return "npm";
 }
 function shouldChainScheduledWatch(match) {
@@ -25951,8 +26042,8 @@ function postFailureTail(issueNumber, cwd, reason) {
   const logPath = lastRunLogPath(cwd);
   let tail = "";
   try {
-    if (fs53.existsSync(logPath)) {
-      const content = fs53.readFileSync(logPath, "utf-8");
+    if (fs54.existsSync(logPath)) {
+      const content = fs54.readFileSync(logPath, "utf-8");
       tail = content.slice(-3e3);
     }
   } catch {
@@ -25981,7 +26072,7 @@ async function runCi(argv) {
     return 0;
   }
   const args = parseCiArgs(argv);
-  const cwd = args.cwd ? path50.resolve(args.cwd) : process.cwd();
+  const cwd = args.cwd ? path51.resolve(args.cwd) : process.cwd();
   try {
     const n = unpackAllSecrets();
     if (n > 0) process.stdout.write(`\u2192 kody: unpacked ${n} secret(s) from ALL_SECRETS
@@ -26047,9 +26138,9 @@ async function runCi(argv) {
       forceRunCliArgs = { goal: envForceMessage };
     }
   }
-  if (!args.issueNumber && !autoFallback && !forceRunAction && !runRequestFanOut && eventName === "workflow_dispatch" && dispatchEventPath && fs53.existsSync(dispatchEventPath)) {
+  if (!args.issueNumber && !autoFallback && !forceRunAction && !runRequestFanOut && eventName === "workflow_dispatch" && dispatchEventPath && fs54.existsSync(dispatchEventPath)) {
     try {
-      const evt = JSON.parse(fs53.readFileSync(dispatchEventPath, "utf-8"));
+      const evt = JSON.parse(fs54.readFileSync(dispatchEventPath, "utf-8"));
       const inputs = objectValue2(evt.inputs);
       const issueInput = parseInt(String(inputs?.issue_number ?? ""), 10);
       const sessionInput = String(inputs?.sessionId ?? "");
@@ -26464,8 +26555,8 @@ init_repoWorkspace();
 
 // src/scripts/brainTurnLog.ts
 init_runtimePaths();
-import * as fs54 from "fs";
-import * as path51 from "path";
+import * as fs55 from "fs";
+import * as path52 from "path";
 import posixPath4 from "path/posix";
 var live = /* @__PURE__ */ new Map();
 function brainEventsFilePath(dir, chatId) {
@@ -26473,8 +26564,8 @@ function brainEventsFilePath(dir, chatId) {
 }
 function lastPersistedSeq(dir, chatId) {
   const p = brainEventsFilePath(dir, chatId);
-  if (!fs54.existsSync(p)) return 0;
-  const lines = fs54.readFileSync(p, "utf-8").split("\n").filter(Boolean);
+  if (!fs55.existsSync(p)) return 0;
+  const lines = fs55.readFileSync(p, "utf-8").split("\n").filter(Boolean);
   if (lines.length === 0) return 0;
   try {
     return JSON.parse(lines[lines.length - 1]).seq || 0;
@@ -26484,9 +26575,9 @@ function lastPersistedSeq(dir, chatId) {
 }
 function readSince(dir, chatId, since) {
   const p = brainEventsFilePath(dir, chatId);
-  if (!fs54.existsSync(p)) return [];
+  if (!fs55.existsSync(p)) return [];
   const out = [];
-  for (const line of fs54.readFileSync(p, "utf-8").split("\n")) {
+  for (const line of fs55.readFileSync(p, "utf-8").split("\n")) {
     if (!line) continue;
     try {
       const rec = JSON.parse(line);
@@ -26512,12 +26603,12 @@ function beginTurn(dir, chatId) {
   };
   live.set(chatId, state);
   const p = brainEventsFilePath(dir, chatId);
-  fs54.mkdirSync(path51.dirname(p), { recursive: true });
+  fs55.mkdirSync(path52.dirname(p), { recursive: true });
   return (event) => {
     state.seq += 1;
     const rec = { seq: state.seq, turn, ts: Date.now(), event };
     try {
-      fs54.appendFileSync(p, `${JSON.stringify(rec)}
+      fs55.appendFileSync(p, `${JSON.stringify(rec)}
 `);
     } catch (err) {
       process.stderr.write(
@@ -26556,7 +26647,7 @@ function endTurnIfUnterminated(dir, chatId, errMessage) {
     event: { type: "error", error: errMessage || "turn ended unexpectedly", chatId }
   };
   try {
-    fs54.appendFileSync(brainEventsFilePath(dir, chatId), `${JSON.stringify(rec)}
+    fs55.appendFileSync(brainEventsFilePath(dir, chatId), `${JSON.stringify(rec)}
 `);
   } catch {
   }
@@ -26650,17 +26741,17 @@ function authOk(req, expected) {
   return false;
 }
 function readJsonBody(req) {
-  return new Promise((resolve20, reject) => {
+  return new Promise((resolve21, reject) => {
     const chunks = [];
     req.on("data", (c) => chunks.push(c));
     req.on("end", () => {
       const raw = Buffer.concat(chunks).toString("utf-8");
       if (!raw.trim()) {
-        resolve20({});
+        resolve21({});
         return;
       }
       try {
-        resolve20(JSON.parse(raw));
+        resolve21(JSON.parse(raw));
       } catch (err) {
         reject(err instanceof Error ? err : new Error(String(err)));
       }
@@ -26952,7 +27043,7 @@ function buildServer(opts) {
   const runTurn = opts.runTurn ?? runChatTurn;
   const createStore = opts.createStore ?? createSessionStore;
   const cloneRepo = opts.cloneRepo ?? defaultCloneRepo;
-  const reposRoot = opts.reposRoot ?? path52.join(path52.dirname(path52.resolve(opts.cwd)), "repos");
+  const reposRoot = opts.reposRoot ?? path53.join(path53.dirname(path53.resolve(opts.cwd)), "repos");
   return createServer2(async (req, res) => {
     if (!req.method || !req.url) {
       sendJson(res, 400, { error: "bad request" });
@@ -27033,11 +27124,11 @@ async function brainServe(opts) {
     litellmUrl,
     driver
   });
-  await new Promise((resolve20) => {
+  await new Promise((resolve21) => {
     server.listen(port, "0.0.0.0", () => {
       process.stdout.write(`[brain-serve] listening on 0.0.0.0:${port} (cwd=${opts.cwd})
 `);
-      resolve20();
+      resolve21();
     });
   });
   const shutdown = (signal) => {
@@ -27292,14 +27383,14 @@ async function startBrainProxy(opts) {
   const { httpServer, handler } = buildBrainProxy(opts);
   const port = opts.port ?? 0;
   const host = opts.host ?? "127.0.0.1";
-  await new Promise((resolve20) => httpServer.listen(port, host, () => resolve20()));
+  await new Promise((resolve21) => httpServer.listen(port, host, () => resolve21()));
   const addr = httpServer.address();
   return {
     httpServer,
     port: addr.port,
     url: `http://${host}:${addr.port}`,
-    stop: () => new Promise((resolve20) => {
-      httpServer.close(() => resolve20());
+    stop: () => new Promise((resolve21) => {
+      httpServer.close(() => resolve21());
     }),
     handler
   };
@@ -27449,23 +27540,23 @@ function buildMcpHttpServer(opts) {
     httpServer,
     routes,
     port,
-    stop: () => new Promise((resolve20) => {
+    stop: () => new Promise((resolve21) => {
       let pending = transports.size;
       if (pending === 0) {
-        httpServer.close(() => resolve20());
+        httpServer.close(() => resolve21());
         return;
       }
       for (const transport of transports.values()) {
         void transport.close().finally(() => {
           pending--;
-          if (pending === 0) httpServer.close(() => resolve20());
+          if (pending === 0) httpServer.close(() => resolve21());
         });
       }
     })
   };
 }
 function listenMcpHttpServer(server, host = "127.0.0.1") {
-  return new Promise((resolve20, reject) => {
+  return new Promise((resolve21, reject) => {
     server.httpServer.once("error", reject);
     server.httpServer.listen(server.port, host, () => {
       server.httpServer.off("error", reject);
@@ -27473,7 +27564,7 @@ function listenMcpHttpServer(server, host = "127.0.0.1") {
       if (addr && typeof addr === "object") {
         server.port = addr.port;
       }
-      resolve20();
+      resolve21();
     });
   });
 }
@@ -27556,7 +27647,7 @@ async function loadConfigSafe() {
 }
 
 // src/chat-cli.ts
-import * as path53 from "path";
+import * as path54 from "path";
 
 // src/chat/inbox.ts
 import { execFileSync as execFileSync25 } from "child_process";
@@ -27623,7 +27714,7 @@ async function waitForNextUserMessage(opts) {
   }
 }
 function sleep3(ms) {
-  return new Promise((resolve20) => setTimeout(resolve20, ms));
+  return new Promise((resolve21) => setTimeout(resolve21, ms));
 }
 function currentBranch(cwd) {
   try {
@@ -27847,7 +27938,7 @@ async function runChat(argv) {
 ${CHAT_HELP}`);
     return 64;
   }
-  const cwd = args.cwd ? path53.resolve(args.cwd) : process.cwd();
+  const cwd = args.cwd ? path54.resolve(args.cwd) : process.cwd();
   const sessionId = args.sessionId;
   const runRequest = readRunRequestFromEnv();
   if (runRequest && "request" in runRequest) {
@@ -28043,8 +28134,8 @@ var FlyClient = class {
   get fetch() {
     return this.opts.fetchImpl ?? fetch;
   }
-  async call(path54, init = {}) {
-    const res = await this.fetch(`${FLY_API_BASE}${path54}`, {
+  async call(path55, init = {}) {
+    const res = await this.fetch(`${FLY_API_BASE}${path55}`, {
       method: init.method ?? "GET",
       headers: {
         Authorization: `Bearer ${this.opts.token}`,
@@ -28055,7 +28146,7 @@ var FlyClient = class {
     if (res.status === 404 && init.allow404) return null;
     if (!res.ok) {
       const text2 = await res.text().catch(() => "");
-      throw new Error(`Fly API ${res.status} on ${path54}: ${text2.slice(0, 200) || res.statusText}`);
+      throw new Error(`Fly API ${res.status} on ${path55}: ${text2.slice(0, 200) || res.statusText}`);
     }
     if (res.status === 204) return null;
     const raw = await res.text();
@@ -28568,14 +28659,14 @@ function sendJson2(res, status, body) {
   res.end(JSON.stringify(body));
 }
 function readJsonBody2(req) {
-  return new Promise((resolve20, reject) => {
+  return new Promise((resolve21, reject) => {
     const chunks = [];
     req.on("data", (c) => chunks.push(c));
     req.on("end", () => {
       const raw = Buffer.concat(chunks).toString("utf-8");
-      if (!raw.trim()) return resolve20({});
+      if (!raw.trim()) return resolve21({});
       try {
-        resolve20(JSON.parse(raw));
+        resolve21(JSON.parse(raw));
       } catch (err) {
         reject(err instanceof Error ? err : new Error(String(err)));
       }
@@ -28729,10 +28820,10 @@ async function poolServe() {
     }
   });
   const apiHost = process.env.POOL_API_HOST ?? "::";
-  await new Promise((resolve20) => {
+  await new Promise((resolve21) => {
     server.listen(apiPort, apiHost, () => {
       log(`listening on ${apiHost}:${apiPort} (min=${min}, app=${app}, region=${region})`);
-      resolve20();
+      resolve21();
     });
   });
   if (loopTickEnabled) void runLoopTick();
@@ -28751,7 +28842,7 @@ async function poolServe() {
 
 // src/servers/runner-serve.ts
 import { spawn as spawn9 } from "child_process";
-import * as fs55 from "fs";
+import * as fs56 from "fs";
 import { createServer as createServer6 } from "http";
 var DEFAULT_PORT2 = 8080;
 var DEFAULT_WORKDIR = "/workspace/repo";
@@ -28772,17 +28863,17 @@ function authOk2(req, expected) {
   return false;
 }
 function readJsonBody3(req) {
-  return new Promise((resolve20, reject) => {
+  return new Promise((resolve21, reject) => {
     const chunks = [];
     req.on("data", (c) => chunks.push(c));
     req.on("end", () => {
       const raw = Buffer.concat(chunks).toString("utf-8");
       if (!raw.trim()) {
-        resolve20({});
+        resolve21({});
         return;
       }
       try {
-        resolve20(JSON.parse(raw));
+        resolve21(JSON.parse(raw));
       } catch (err) {
         reject(err instanceof Error ? err : new Error(String(err)));
       }
@@ -28827,8 +28918,8 @@ async function defaultRunJob(job) {
   const workdir = process.env.RUNNER_WORKDIR ?? DEFAULT_WORKDIR;
   const branch = job.ref ?? "main";
   const authUrl = `https://x-access-token:${job.githubToken}@github.com/${job.repo}.git`;
-  fs55.rmSync(workdir, { recursive: true, force: true });
-  fs55.mkdirSync(workdir, { recursive: true });
+  fs56.rmSync(workdir, { recursive: true, force: true });
+  fs56.mkdirSync(workdir, { recursive: true });
   const allSecrets = typeof job.allSecrets === "string" ? job.allSecrets : JSON.stringify(job.allSecrets ?? {});
   const target = job.runRequest.target;
   const interactive = target.type === "chat";
@@ -28857,13 +28948,13 @@ async function defaultRunJob(job) {
     ...interactive && job.idleExitMs ? { KODY_IDLE_EXIT_MS: String(job.idleExitMs) } : {},
     ...interactive && job.hardCapMs ? { KODY_HARD_CAP_MS: String(job.hardCapMs) } : {}
   };
-  const run = (cmd, args, cwd) => new Promise((resolve20) => {
+  const run = (cmd, args, cwd) => new Promise((resolve21) => {
     const child = spawn9(cmd, args, { stdio: "inherit", env: childEnv, cwd });
-    child.on("exit", (code) => resolve20(code ?? 0));
+    child.on("exit", (code) => resolve21(code ?? 0));
     child.on("error", (err) => {
       process.stderr.write(`[runner-serve] ${cmd} failed: ${err.message}
 `);
-      resolve20(1);
+      resolve21(1);
     });
   });
   process.stdout.write(`[runner-serve] job ${job.jobId}: cloning ${job.repo}@${branch}
@@ -28939,11 +29030,11 @@ async function runnerServe() {
   const port = Number(process.env.PORT ?? DEFAULT_PORT2);
   const server = buildServer2({ apiKey });
   const host = process.env.RUNNER_HOST ?? "::";
-  await new Promise((resolve20) => {
+  await new Promise((resolve21) => {
     server.listen(port, host, () => {
       process.stdout.write(`[runner-serve] listening on ${host}:${port} (idle, awaiting job)
 `);
-      resolve20();
+      resolve21();
     });
   });
   const shutdown = (signal) => {
@@ -29012,14 +29103,14 @@ async function serve(opts) {
 `);
     const args = ["--dangerously-skip-permissions", "--model", model.model];
     const child = spawn10("claude", args, { stdio: "inherit", env: editorEnv, cwd: opts.cwd });
-    const exitCode = await new Promise((resolve20) => {
-      child.on("exit", (code) => resolve20(code ?? 0));
+    const exitCode = await new Promise((resolve21) => {
+      child.on("exit", (code) => resolve21(code ?? 0));
       child.on("error", (err) => {
         process.stderr.write(`[kody serve] failed to launch Claude Code: ${err.message}
 `);
         process.stderr.write(`  Install: https://docs.anthropic.com/claude/docs/claude-code
 `);
-        resolve20(1);
+        resolve21(1);
       });
     });
     killProxy();